Merge ../scsi-rc-fixes-2.6

1886 files changed, 57083 insertions, 18670 deletions

diff --git a/.gitignore b/.gitignore
index e1d5c17c12c2..9eb4b7711499 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,6 +20,7 @@
 # Top-level generic files
 #
 tags
+TAGS
 vmlinux*
 System.map
 Module.symvers
diff --git a/CREDITS b/CREDITS
index 5329ead9c672..ccd4f9f4dd71 100644
--- a/CREDITS
+++ b/CREDITS
@@ -45,7 +45,7 @@ S: Longford, Ireland
 S: Sydney, Australia
 
 N: Tigran A. Aivazian
-E: tigran@veritas.com
+E: tigran@aivazian.fsnet.co.uk
 W: http://www.moses.uklinux.net/patches
 D: BFS filesystem
 D: Intel IA32 CPU microcode update support
@@ -3511,14 +3511,12 @@ D: The Linux Support Team Erlangen
 
 N: David Weinehall
 E: tao@acc.umu.se
+P: 1024D/DC47CA16 7ACE 0FB0 7A74 F994 9B36  E1D1 D14E 8526 DC47 CA16
 W: http://www.acc.umu.se/~tao/
-W: http://www.acc.umu.se/~mcalinux/
+D: v2.0 kernel maintainer
 D: Fixes for the NE/2-driver
 D: Miscellaneous MCA-support
 D: Cleanup of the Config-files
-S: Axtorpsvagen 40:20
-S: S-903 37  UMEA
-S: Sweden
 
 N: Matt Welsh
 E: mdw@metalab.unc.edu
diff --git a/Documentation/ABI/testing/sysfs-power b/Documentation/ABI/testing/sysfs-power
index d882f8093871..dcff4d0623ad 100644
--- a/Documentation/ABI/testing/sysfs-power
+++ b/Documentation/ABI/testing/sysfs-power
@@ -21,7 +21,7 @@ Description:
                 these states.
 
 What:           /sys/power/disk
-Date:           August 2006
+Date:           September 2006
 Contact:        Rafael J. Wysocki <rjw@sisk.pl>
 Description:
                 The /sys/power/disk file controls the operating mode of the
@@ -39,6 +39,19 @@ Description:
                 'reboot' - the memory image will be saved by the kernel and
                 the system will be rebooted.
 
+                Additionally, /sys/power/disk can be used to turn on one of the
+                two testing modes of the suspend-to-disk mechanism: 'testproc'
+                or 'test'.  If the suspend-to-disk mechanism is in the
+                'testproc' mode, writing 'disk' to /sys/power/state will cause
+                the kernel to disable nonboot CPUs and freeze tasks, wait for 5
+                seconds, unfreeze tasks and enable nonboot CPUs.  If it is in
+                the 'test' mode, writing 'disk' to /sys/power/state will cause
+                the kernel to disable nonboot CPUs and freeze tasks, shrink
+                memory, suspend devices, wait for 5 seconds, resume devices,
+                unfreeze tasks and enable nonboot CPUs.  Then, we are able to
+                look in the log messages and work out, for example, which code
+                is being slow and which device drivers are misbehaving.
+
                 The suspend-to-disk method may be chosen by writing to this
                 file one of the accepted strings:
 
@@ -46,6 +59,8 @@ Description:
                 'platform'
                 'shutdown'
                 'reboot'
+                'testproc'
+                'test'
 
                 It will only change to 'firmware' or 'platform' if the system
                 supports that.
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 66e1cf733571..db9499adbed4 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -9,7 +9,7 @@
 DOCBOOKS := wanbook.xml z8530book.xml mcabook.xml videobook.xml \
             kernel-hacking.xml kernel-locking.xml deviceiobook.xml \
             procfs-guide.xml writing_usb_driver.xml \
-            kernel-api.xml journal-api.xml lsm.xml usb.xml \
+            kernel-api.xml filesystems.xml lsm.xml usb.xml \
             gadget.xml libata.xml mtdnand.xml librs.xml rapidio.xml \
             genericirq.xml
 
diff --git a/Documentation/DocBook/journal-api.tmpl b/Documentation/DocBook/filesystems.tmpl
index 2077f9a28c19..39fa2aba7f9b 100644
--- a/Documentation/DocBook/journal-api.tmpl
+++ b/Documentation/DocBook/filesystems.tmpl
@@ -2,39 +2,11 @@
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.1.2//EN"
         "http://www.oasis-open.org/docbook/xml/4.1.2/docbookx.dtd" []>
 
-<book id="LinuxJBDAPI">
+<book id="Linux-filesystems-API">
  <bookinfo>
-  <title>The Linux Journalling API</title>
-  <authorgroup>
-  <author>
-     <firstname>Roger</firstname>
-     <surname>Gammans</surname>
-     <affiliation>
-     <address>
-      <email>rgammans@computer-surgery.co.uk</email>
-     </address>
-    </affiliation>
-     </author> 
-  </authorgroup>
-  
-  <authorgroup>
-   <author>
-    <firstname>Stephen</firstname>
-    <surname>Tweedie</surname>
-    <affiliation>
-     <address>
-      <email>sct@redhat.com</email>
-     </address>
-    </affiliation>
-   </author>
-  </authorgroup>
+  <title>Linux Filesystems API</title>
 
-  <copyright>
-   <year>2002</year>
-   <holder>Roger Gammans</holder>
-  </copyright>
-
-<legalnotice>
+  <legalnotice>
    <para>
      This documentation is free software; you can redistribute
      it and/or modify it under the terms of the GNU General Public
@@ -42,21 +14,21 @@
      version 2 of the License, or (at your option) any later
      version.
    </para>
-      
+
    <para>
      This program is distributed in the hope that it will be
      useful, but WITHOUT ANY WARRANTY; without even the implied
      warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
      See the GNU General Public License for more details.
    </para>
-      
+
    <para>
      You should have received a copy of the GNU General Public
      License along with this program; if not, write to the Free
      Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
      MA 02111-1307 USA
    </para>
-      
+
    <para>
      For more details see the file COPYING in the source
      distribution of Linux.
@@ -66,17 +38,113 @@
 
 <toc></toc>
 
-  <chapter id="Overview">
+  <chapter id="vfs">
+     <title>The Linux VFS</title>
+     <sect1><title>The Filesystem types</title>
+!Iinclude/linux/fs.h
+     </sect1>
+     <sect1><title>The Directory Cache</title>
+!Efs/dcache.c
+!Iinclude/linux/dcache.h
+     </sect1>
+     <sect1><title>Inode Handling</title>
+!Efs/inode.c
+!Efs/bad_inode.c
+     </sect1>
+     <sect1><title>Registration and Superblocks</title>
+!Efs/super.c
+     </sect1>
+     <sect1><title>File Locks</title>
+!Efs/locks.c
+!Ifs/locks.c
+     </sect1>
+     <sect1><title>Other Functions</title>
+!Efs/mpage.c
+!Efs/namei.c
+!Efs/buffer.c
+!Efs/bio.c
+!Efs/seq_file.c
+!Efs/filesystems.c
+!Efs/fs-writeback.c
+!Efs/block_dev.c
+     </sect1>
+  </chapter>
+
+  <chapter id="proc">
+     <title>The proc filesystem</title>
+
+     <sect1><title>sysctl interface</title>
+!Ekernel/sysctl.c
+     </sect1>
+
+     <sect1><title>proc filesystem interface</title>
+!Ifs/proc/base.c
+     </sect1>
+  </chapter>
+
+  <chapter id="sysfs">
+     <title>The Filesystem for Exporting Kernel Objects</title>
+!Efs/sysfs/file.c
+!Efs/sysfs/symlink.c
+!Efs/sysfs/bin.c
+  </chapter>
+
+  <chapter id="debugfs">
+     <title>The debugfs filesystem</title>
+
+     <sect1><title>debugfs interface</title>
+!Efs/debugfs/inode.c
+!Efs/debugfs/file.c
+     </sect1>
+  </chapter>
+
+  <chapter id="LinuxJDBAPI">
+  <chapterinfo>
+  <title>The Linux Journalling API</title>
+
+  <authorgroup>
+  <author>
+     <firstname>Roger</firstname>
+     <surname>Gammans</surname>
+     <affiliation>
+     <address>
+      <email>rgammans@computer-surgery.co.uk</email>
+     </address>
+    </affiliation>
+     </author>
+  </authorgroup>
+
+  <authorgroup>
+   <author>
+    <firstname>Stephen</firstname>
+    <surname>Tweedie</surname>
+    <affiliation>
+     <address>
+      <email>sct@redhat.com</email>
+     </address>
+    </affiliation>
+   </author>
+  </authorgroup>
+
+  <copyright>
+   <year>2002</year>
+   <holder>Roger Gammans</holder>
+  </copyright>
+  </chapterinfo>
+
+  <title>The Linux Journalling API</title>
+
+    <sect1>
      <title>Overview</title>
-  <sect1>
+    <sect2>
      <title>Details</title>
 <para>
-The journalling layer is  easy to use. You need to 
+The journalling layer is  easy to use. You need to
 first of all create a journal_t data structure. There are
 two calls to do this dependent on how you decide to allocate the physical
-media on which the journal resides. The journal_init_inode() call 
+media on which the journal resides. The journal_init_inode() call
 is for journals stored in filesystem inodes, or the journal_init_dev()
-call can be use for journal stored on a raw device (in a continuous range 
+call can be use for journal stored on a raw device (in a continuous range
 of blocks). A journal_t is a typedef for a struct pointer, so when
 you are finally finished make sure you call journal_destroy() on it
 to free up any used kernel memory.
@@ -91,27 +159,26 @@ need to call journal_create().
 <para>
 Most of the time however your journal file will already have been created, but
 before you load it you must call journal_wipe() to empty the journal file.
-Hang on, you say , what if the filesystem wasn't cleanly umount()'d . Well, it is the 
+Hang on, you say , what if the filesystem wasn't cleanly umount()'d . Well, it is the
 job of the client file system to detect this and skip the call to journal_wipe().
 </para>
 
 <para>
 In either case the next call should be to journal_load() which prepares the
-journal file for use. Note that journal_wipe(..,0) calls journal_skip_recovery() 
+journal file for use. Note that journal_wipe(..,0) calls journal_skip_recovery()
 for you if it detects any outstanding transactions in the journal and similarly
 journal_load() will call journal_recover() if necessary.
 I would advise reading fs/ext3/super.c for examples on this stage.
-[RGG: Why is the journal_wipe() call necessary - doesn't this needlessly 
-complicate the API. Or isn't a good idea for the journal layer to hide 
+[RGG: Why is the journal_wipe() call necessary - doesn't this needlessly
+complicate the API. Or isn't a good idea for the journal layer to hide
 dirty mounts from the client fs]
 </para>
 
 <para>
-Now you can go ahead and start modifying the underlying 
+Now you can go ahead and start modifying the underlying
 filesystem. Almost.
 </para>
 
-
 <para>
 
 You still need to actually journal your filesystem changes, this
@@ -138,10 +205,10 @@ individual buffers (blocks). Before you start to modify a buffer you
 need to call journal_get_{create,write,undo}_access() as appropriate,
 this allows the journalling layer to copy the unmodified data if it
 needs to. After all the buffer may be part of a previously uncommitted
-transaction. 
+transaction.
 At this point you are at last ready to modify a buffer, and once
 you are have done so you need to call journal_dirty_{meta,}data().
-Or if you've asked for access to a buffer you now know is now longer 
+Or if you've asked for access to a buffer you now know is now longer
 required to be pushed back on the device you can call journal_forget()
 in much the same way as you might have used bforget() in the past.
 </para>
@@ -156,7 +223,6 @@ Then at umount time , in your put_super() (2.4) or write_super() (2.5)
 you can then call journal_destroy() to clean up your in-core journal object.
 </para>
 
-
 <para>
 Unfortunately there a couple of ways the journal layer can cause a deadlock.
 The first thing to note is that each task can only have
@@ -164,19 +230,19 @@ a single outstanding transaction at any one time, remember nothing
 commits until the outermost journal_stop(). This means
 you must complete the transaction at the end of each file/inode/address
 etc. operation you perform, so that the journalling system isn't re-entered
-on another journal. Since transactions can't be nested/batched 
+on another journal. Since transactions can't be nested/batched
 across differing journals, and another filesystem other than
 yours (say ext3) may be modified in a later syscall.
 </para>
 
 <para>
-The second case to bear in mind is that journal_start() can 
-block if there isn't enough space in the journal for your transaction 
+The second case to bear in mind is that journal_start() can
+block if there isn't enough space in the journal for your transaction
 (based on the passed nblocks param) - when it blocks it merely(!) needs to
-wait for transactions to complete and be committed from other tasks, 
-so essentially we are waiting for journal_stop(). So to avoid 
+wait for transactions to complete and be committed from other tasks,
+so essentially we are waiting for journal_stop(). So to avoid
 deadlocks you must treat journal_start/stop() as if they
-were semaphores and include them in your semaphore ordering rules to prevent 
+were semaphores and include them in your semaphore ordering rules to prevent
 deadlocks. Note that journal_extend() has similar blocking behaviour to
 journal_start() so you can deadlock here just as easily as on journal_start().
 </para>
@@ -184,7 +250,7 @@ journal_start() so you can deadlock here just as easily as on journal_start().
 <para>
 Try to reserve the right number of blocks the first time. ;-). This will
 be the maximum number of blocks you are going to touch in this transaction.
-I advise having a look at at least ext3_jbd.h to see the basis on which 
+I advise having a look at at least ext3_jbd.h to see the basis on which
 ext3 uses to make these decisions.
 </para>
 
@@ -193,13 +259,13 @@ Another wriggle to watch out for is your on-disk block allocation strategy.
 why? Because, if you undo a delete, you need to ensure you haven't reused any
 of the freed blocks in a later transaction. One simple way of doing this
 is make sure any blocks you allocate only have checkpointed transactions
-listed against them. Ext3 does this in ext3_test_allocatable(). 
+listed against them. Ext3 does this in ext3_test_allocatable().
 </para>
 
 <para>
 Lock is also providing through journal_{un,}lock_updates(),
 ext3 uses this when it wants a window with a clean and stable fs for a moment.
-eg. 
+eg.
 </para>
 
 <programlisting>
@@ -230,19 +296,19 @@ extend it like this:-
                 struct journal_callback for_jbd;
                 // Stuff for myfs allocated together.
                 myfs_inode*    i_commited;
-        
+
         }
 </programlisting>
 
 <para>
-this would be useful if you needed to know when data was committed to a 
+this would be useful if you needed to know when data was committed to a
 particular inode.
 </para>
 
-</sect1>
+    </sect2>
 
-<sect1>
-<title>Summary</title>
+    <sect2>
+     <title>Summary</title>
 <para>
 Using the journal is a matter of wrapping the different context changes,
 being each mount, each modification (transaction) and each changed buffer
@@ -260,15 +326,15 @@ an example.
   if (clean) journal_wipe();
   journal_load();
 
-   foreach(transaction) { /*transactions must be 
+   foreach(transaction) { /*transactions must be
                             completed before
-                            a syscall returns to 
+                            a syscall returns to
                             userspace*/
 
           handle_t * xct=journal_start(my_jnrl);
           foreach(bh) {
                 journal_get_{create,write,undo}_access(xact,bh);
-                if ( myfs_modify(bh) ) { /* returns true 
+                if ( myfs_modify(bh) ) { /* returns true
                                         if makes changes */
                            journal_dirty_{meta,}data(xact,bh);
                 } else {
@@ -279,55 +345,57 @@ an example.
    }
    journal_destroy(my_jrnl);
 </programlisting>
-</sect1>
+    </sect2>
 
-</chapter>
+    </sect1>
 
-  <chapter id="adt">
+    <sect1>
      <title>Data Types</title>
-     <para>     
+     <para>
         The journalling layer uses typedefs to 'hide' the concrete definitions
         of the structures used. As a client of the JBD layer you can
         just rely on the using the pointer as a magic cookie  of some sort.
-        
+
         Obviously the hiding is not enforced as this is 'C'.
-        </para>
-        <sect1><title>Structures</title>
+     </para>
+        <sect2><title>Structures</title>
 !Iinclude/linux/jbd.h
-        </sect1>
-</chapter>
+        </sect2>
+    </sect1>
 
-  <chapter id="calls">
+    <sect1>
      <title>Functions</title>
-     <para>     
+     <para>
         The functions here are split into two groups those that
         affect a journal as a whole, and those which are used to
         manage transactions
-</para>
-        <sect1><title>Journal Level</title>
+     </para>
+        <sect2><title>Journal Level</title>
 !Efs/jbd/journal.c
 !Ifs/jbd/recovery.c
-        </sect1>
-        <sect1><title>Transasction Level</title>
-!Efs/jbd/transaction.c  
-        </sect1>
-</chapter>
-<chapter>
+        </sect2>
+        <sect2><title>Transasction Level</title>
+!Efs/jbd/transaction.c
+        </sect2>
+    </sect1>
+    <sect1>
      <title>See also</title>
         <para>
-        <citation>
+          <citation>
            <ulink url="ftp://ftp.uk.linux.org/pub/linux/sct/fs/jfs/journal-design.ps.gz">
-                Journaling the Linux ext2fs Filesystem,LinuxExpo 98, Stephen Tweedie
+                Journaling the Linux ext2fs Filesystem, LinuxExpo 98, Stephen Tweedie
            </ulink>
-           </citation>
-           </para>
-           <para>
+          </citation>
+        </para>
+        <para>
            <citation>
            <ulink url="http://olstrans.sourceforge.net/release/OLS2000-ext3/OLS2000-ext3.html">
-                Ext3 Journalling FileSystem , OLS 2000, Dr. Stephen Tweedie
+                Ext3 Journalling FileSystem, OLS 2000, Dr. Stephen Tweedie
            </ulink>
            </citation>
-           </para>
-</chapter>
+        </para>
+    </sect1>
+
+  </chapter>
 
 </book>
diff --git a/Documentation/DocBook/kernel-api.tmpl b/Documentation/DocBook/kernel-api.tmpl
index 2b5ac604948c..a166675c4303 100644
--- a/Documentation/DocBook/kernel-api.tmpl
+++ b/Documentation/DocBook/kernel-api.tmpl
@@ -182,66 +182,6 @@ X!Ilib/string.c
      </sect1>
   </chapter>
 
-  <chapter id="vfs">
-     <title>The Linux VFS</title>
-     <sect1><title>The Filesystem types</title>
-!Iinclude/linux/fs.h
-     </sect1>
-     <sect1><title>The Directory Cache</title>
-!Efs/dcache.c
-!Iinclude/linux/dcache.h
-     </sect1>
-     <sect1><title>Inode Handling</title>
-!Efs/inode.c
-!Efs/bad_inode.c
-     </sect1>
-     <sect1><title>Registration and Superblocks</title>
-!Efs/super.c
-     </sect1>
-     <sect1><title>File Locks</title>
-!Efs/locks.c
-!Ifs/locks.c
-     </sect1>
-     <sect1><title>Other Functions</title>
-!Efs/mpage.c
-!Efs/namei.c
-!Efs/buffer.c
-!Efs/bio.c
-!Efs/seq_file.c
-!Efs/filesystems.c
-!Efs/fs-writeback.c
-!Efs/block_dev.c
-     </sect1>
-  </chapter>
-
-  <chapter id="proc">
-     <title>The proc filesystem</title>
- 
-     <sect1><title>sysctl interface</title>
-!Ekernel/sysctl.c
-     </sect1>
-
-     <sect1><title>proc filesystem interface</title>
-!Ifs/proc/base.c
-     </sect1>
-  </chapter>
-
-  <chapter id="sysfs">
-     <title>The Filesystem for Exporting Kernel Objects</title>
-!Efs/sysfs/file.c
-!Efs/sysfs/symlink.c
-!Efs/sysfs/bin.c
-  </chapter>
-
-  <chapter id="debugfs">
-     <title>The debugfs filesystem</title>
- 
-     <sect1><title>debugfs interface</title>
-!Efs/debugfs/inode.c
-!Efs/debugfs/file.c
-     </sect1>
-  </chapter>
-
   <chapter id="relayfs">
      <title>relay interface support</title>
 
diff --git a/Documentation/HOWTO b/Documentation/HOWTO
index d6f3dd1a3464..8d51c148f721 100644
--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
@@ -395,6 +395,26 @@ bugme-janitor mailing list (every change in the bugzilla is mailed here)
 
 
 
+Managing bug reports
+--------------------
+
+One of the best ways to put into practice your hacking skills is by fixing
+bugs reported by other people. Not only you will help to make the kernel
+more stable, you'll learn to fix real world problems and you will improve
+your skills, and other developers will be aware of your presence. Fixing
+bugs is one of the best ways to get merits among other developers, because
+not many people like wasting time fixing other people's bugs.
+
+To work in the already reported bug reports, go to http://bugzilla.kernel.org.
+If you want to be advised of the future bug reports, you can subscribe to the
+bugme-new mailing list (only new bug reports are mailed here) or to the
+bugme-janitor mailing list (every change in the bugzilla is mailed here)
+
+        http://lists.osdl.org/mailman/listinfo/bugme-new
+        http://lists.osdl.org/mailman/listinfo/bugme-janitors
+
+
+
 Mailing lists
 -------------
 
diff --git a/Documentation/MSI-HOWTO.txt b/Documentation/MSI-HOWTO.txt
index c70306abb7b2..5c34910665d1 100644
--- a/Documentation/MSI-HOWTO.txt
+++ b/Documentation/MSI-HOWTO.txt
@@ -470,7 +470,68 @@ LOC:     324553     325068
 ERR:          0
 MIS:          0
 
-6. FAQ
+6. MSI quirks
+
+Several PCI chipsets or devices are known to not support MSI.
+The PCI stack provides 3 possible levels of MSI disabling:
+* on a single device
+* on all devices behind a specific bridge
+* globally
+
+6.1. Disabling MSI on a single device
+
+Under some circumstances, it might be required to disable MSI on a
+single device, It may be achived by either not calling pci_enable_msi()
+or all, or setting the pci_dev->no_msi flag before (most of the time
+in a quirk).
+
+6.2. Disabling MSI below a bridge
+
+The vast majority of MSI quirks are required by PCI bridges not
+being able to route MSI between busses. In this case, MSI have to be
+disabled on all devices behind this bridge. It is achieves by setting
+the PCI_BUS_FLAGS_NO_MSI flag in the pci_bus->bus_flags of the bridge
+subordinate bus. There is no need to set the same flag on bridges that
+are below the broken brigde. When pci_enable_msi() is called to enable
+MSI on a device, pci_msi_supported() takes care of checking the NO_MSI
+flag in all parent busses of the device.
+
+Some bridges actually support dynamic MSI support enabling/disabling
+by changing some bits in their PCI configuration space (especially
+the Hypertransport chipsets such as the nVidia nForce and Serverworks
+HT2000). It may then be required to update the NO_MSI flag on the
+corresponding devices in the sysfs hierarchy. To enable MSI support
+on device "0000:00:0e", do:
+
+        echo 1 > /sys/bus/pci/devices/0000:00:0e/msi_bus
+
+To disable MSI support, echo 0 instead of 1. Note that it should be
+used with caution since changing this value might break interrupts.
+
+6.3. Disabling MSI globally
+
+Some extreme cases may require to disable MSI globally on the system.
+For now, the only known case is a Serverworks PCI-X chipsets (MSI are
+not supported on several busses that are not all connected to the
+chipset in the Linux PCI hierarchy). In the vast majority of other
+cases, disabling only behind a specific bridge is enough.
+
+For debugging purpose, the user may also pass pci=nomsi on the kernel
+command-line to explicitly disable MSI globally. But, once the appro-
+priate quirks are added to the kernel, this option should not be
+required anymore.
+
+6.4. Finding why MSI cannot be enabled on a device
+
+Assuming that MSI are not enabled on a device, you should look at
+dmesg to find messages that quirks may output when disabling MSI
+on some devices, some bridges or even globally.
+Then, lspci -t gives the list of bridges above a device. Reading
+/sys/bus/pci/devices/0000:00:0e/msi_bus will tell you whether MSI
+are enabled (1) or disabled (0). In 0 is found in a single bridge
+msi_bus file above the device, MSI cannot be enabled.
+
+7. FAQ
 
 Q1. Are there any limitations on using the MSI?
 
diff --git a/Documentation/accounting/getdelays.c b/Documentation/accounting/getdelays.c
index b11792abd6b6..bf2b0e2f87e1 100644
--- a/Documentation/accounting/getdelays.c
+++ b/Documentation/accounting/getdelays.c
@@ -49,7 +49,7 @@ __u64 stime, utime;
         }
 
 /* Maximum size of response requested or message sent */
-#define MAX_MSG_SIZE    256
+#define MAX_MSG_SIZE    1024
 /* Maximum number of cpus expected to be specified in a cpumask */
 #define MAX_CPUS        32
 /* Maximum length of pathname to log file */
diff --git a/Documentation/cpu-hotplug.txt b/Documentation/cpu-hotplug.txt
index bc107cb157a8..4868c34f7509 100644
--- a/Documentation/cpu-hotplug.txt
+++ b/Documentation/cpu-hotplug.txt
@@ -46,7 +46,7 @@ maxcpus=n    Restrict boot time cpus to n. Say if you have 4 cpus, using
              maxcpus=2 will only boot 2. You can choose to bring the
              other cpus later online, read FAQ's for more info.
 
-additional_cpus*=n      Use this to limit hotpluggable cpus. This option sets
+additional_cpus=n (*)   Use this to limit hotpluggable cpus. This option sets
                         cpu_possible_map = cpu_present_map + additional_cpus
 
 (*) Option valid only for following architectures
@@ -101,15 +101,15 @@ cpu_possible_map/for_each_possible_cpu() to iterate.
 
 Never use anything other than cpumask_t to represent bitmap of CPUs.
 
-#include <linux/cpumask.h>
+        #include <linux/cpumask.h>
 
-for_each_possible_cpu     - Iterate over cpu_possible_map
-for_each_online_cpu       - Iterate over cpu_online_map
-for_each_present_cpu      - Iterate over cpu_present_map
-for_each_cpu_mask(x,mask) - Iterate over some random collection of cpu mask.
+        for_each_possible_cpu     - Iterate over cpu_possible_map
+        for_each_online_cpu       - Iterate over cpu_online_map
+        for_each_present_cpu      - Iterate over cpu_present_map
+        for_each_cpu_mask(x,mask) - Iterate over some random collection of cpu mask.
 
-#include <linux/cpu.h>
-lock_cpu_hotplug() and unlock_cpu_hotplug():
+        #include <linux/cpu.h>
+        lock_cpu_hotplug() and unlock_cpu_hotplug():
 
 The above calls are used to inhibit cpu hotplug operations. While holding the
 cpucontrol mutex, cpu_online_map will not change. If you merely need to avoid
@@ -120,7 +120,7 @@ will work as long as stop_machine_run() is used to take a cpu down.
 
 CPU Hotplug - Frequently Asked Questions.
 
-Q: How to i enable my kernel to support CPU hotplug?
+Q: How to enable my kernel to support CPU hotplug?
 A: When doing make defconfig, Enable CPU hotplug support
 
    "Processor type and Features" -> Support for Hotpluggable CPUs
@@ -141,39 +141,39 @@ A: You should now notice an entry in sysfs.
 Check if sysfs is mounted, using the "mount" command. You should notice
 an entry as shown below in the output.
 
-....
-none on /sys type sysfs (rw)
-....
+        ....
+        none on /sys type sysfs (rw)
+        ....
 
-if this is not mounted, do the following.
+If this is not mounted, do the following.
 
-#mkdir /sysfs
-#mount -t sysfs sys /sys
+         #mkdir /sysfs
+        #mount -t sysfs sys /sys
 
-now you should see entries for all present cpu, the following is an example
+Now you should see entries for all present cpu, the following is an example
 in a 8-way system.
 
-#pwd
-#/sys/devices/system/cpu
-#ls -l
-total 0
-drwxr-xr-x  10 root root 0 Sep 19 07:44 .
-drwxr-xr-x  13 root root 0 Sep 19 07:45 ..
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu0
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu1
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu2
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu3
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu4
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu5
-drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu6
-drwxr-xr-x   3 root root 0 Sep 19 07:48 cpu7
+        #pwd
+        #/sys/devices/system/cpu
+        #ls -l
+        total 0
+        drwxr-xr-x  10 root root 0 Sep 19 07:44 .
+        drwxr-xr-x  13 root root 0 Sep 19 07:45 ..
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu0
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu1
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu2
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu3
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu4
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu5
+        drwxr-xr-x   3 root root 0 Sep 19 07:44 cpu6
+        drwxr-xr-x   3 root root 0 Sep 19 07:48 cpu7
 
 Under each directory you would find an "online" file which is the control
 file to logically online/offline a processor.
 
 Q: Does hot-add/hot-remove refer to physical add/remove of cpus?
 A: The usage of hot-add/remove may not be very consistently used in the code.
-CONFIG_CPU_HOTPLUG enables logical online/offline capability in the kernel.
+CONFIG_HOTPLUG_CPU enables logical online/offline capability in the kernel.
 To support physical addition/removal, one would need some BIOS hooks and
 the platform should have something like an attention button in PCI hotplug.
 CONFIG_ACPI_HOTPLUG_CPU enables ACPI support for physical add/remove of CPUs.
@@ -181,17 +181,17 @@ CONFIG_ACPI_HOTPLUG_CPU enables ACPI support for physical add/remove of CPUs.
 Q: How do i logically offline a CPU?
 A: Do the following.
 
-#echo 0 > /sys/devices/system/cpu/cpuX/online
+        #echo 0 > /sys/devices/system/cpu/cpuX/online
 
-once the logical offline is successful, check
+Once the logical offline is successful, check
 
-#cat /proc/interrupts
+        #cat /proc/interrupts
 
-you should now not see the CPU that you removed. Also online file will report
+You should now not see the CPU that you removed. Also online file will report
 the state as 0 when a cpu if offline and 1 when its online.
 
-#To display the current cpu state.
-#cat /sys/devices/system/cpu/cpuX/online
+        #To display the current cpu state.
+        #cat /sys/devices/system/cpu/cpuX/online
 
 Q: Why cant i remove CPU0 on some systems?
 A: Some architectures may have some special dependency on a certain CPU.
@@ -234,8 +234,8 @@ Q: If i have some kernel code that needs to be aware of CPU arrival and
    departure, how to i arrange for proper notification?
 A: This is what you would need in your kernel code to receive notifications.
 
-    #include <linux/cpu.h>
-    static int __cpuinit foobar_cpu_callback(struct notifier_block *nfb,
+        #include <linux/cpu.h>
+        static int __cpuinit foobar_cpu_callback(struct notifier_block *nfb,
                                             unsigned long action, void *hcpu)
         {
                 unsigned int cpu = (unsigned long)hcpu;
@@ -279,10 +279,10 @@ Q: I don't see my action being called for all CPUs already up and running?
 A: Yes, CPU notifiers are called only when new CPUs are on-lined or offlined.
    If you need to perform some action for each cpu already in the system, then
 
-  for_each_online_cpu(i) {
+        for_each_online_cpu(i) {
                 foobar_cpu_callback(&foobar_cpu_notifier, CPU_UP_PREPARE, i);
-                foobar_cpu_callback(&foobar-cpu_notifier, CPU_ONLINE, i);
-  }
+                foobar_cpu_callback(&foobar_cpu_notifier, CPU_ONLINE, i);
+        }
 
 Q: If i would like to develop cpu hotplug support for a new architecture,
    what do i need at a minimum?
@@ -307,38 +307,38 @@ Q: I need to ensure that a particular cpu is not removed when there is some
    work specific to this cpu is in progress.
 A: First switch the current thread context to preferred cpu
 
-   int my_func_on_cpu(int cpu)
-   {
-       cpumask_t saved_mask, new_mask = CPU_MASK_NONE;
-       int curr_cpu, err = 0;
-
-       saved_mask = current->cpus_allowed;
-       cpu_set(cpu, new_mask);
-       err = set_cpus_allowed(current, new_mask);
-
-       if (err)
-           return err;
-
-       /*
-        * If we got scheduled out just after the return from
-        * set_cpus_allowed() before running the work, this ensures
-        * we stay locked.
-        */
-       curr_cpu = get_cpu();
-
-       if (curr_cpu != cpu) {
-           err = -EAGAIN;
-           goto ret;
-       } else {
-           /*
-            * Do work : But cant sleep, since get_cpu() disables preempt
-            */
-       }
-    ret:
-        put_cpu();
-        set_cpus_allowed(current, saved_mask);
-        return err;
-    }
+        int my_func_on_cpu(int cpu)
+        {
+                cpumask_t saved_mask, new_mask = CPU_MASK_NONE;
+                int curr_cpu, err = 0;
+
+                saved_mask = current->cpus_allowed;
+                cpu_set(cpu, new_mask);
+                err = set_cpus_allowed(current, new_mask);
+
+                if (err)
+                        return err;
+
+                /*
+                 * If we got scheduled out just after the return from
+                 * set_cpus_allowed() before running the work, this ensures
+                 * we stay locked.
+                 */
+                curr_cpu = get_cpu();
+
+                if (curr_cpu != cpu) {
+                        err = -EAGAIN;
+                        goto ret;
+                } else {
+                        /*
+                         * Do work : But cant sleep, since get_cpu() disables preempt
+                         */
+                }
+                ret:
+                        put_cpu();
+                        set_cpus_allowed(current, saved_mask);
+                        return err;
+                }
 
 
 Q: How do we determine how many CPUs are available for hotplug.
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 24f3c63b3017..d52c4aaaf17f 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -53,18 +53,6 @@ Who:	Mauro Carvalho Chehab <mchehab@brturbo.com.br>
 
 ---------------------------
 
-What:   sys_sysctl
-When:   January 2007
-Why:    The same information is available through /proc/sys and that is the
-        interface user space prefers to use. And there do not appear to be
-        any existing user in user space of sys_sysctl.  The additional
-        maintenance overhead of keeping a set of binary names gets
-        in the way of doing a good job of maintaining this interface.
-
-Who:    Eric Biederman <ebiederm@xmission.com>
-
----------------------------
-
 What:   PCMCIA control ioctl (needed for pcmcia-cs [cardmgr, cardctl])
 When:   November 2005
 Files:  drivers/pcmcia/: pcmcia_ioctl.c
@@ -255,7 +243,7 @@ Who:	Stephen Hemminger <shemminger@osdl.org>
 
 
 What:   PHYSDEVPATH, PHYSDEVBUS, PHYSDEVDRIVER in the uevent environment
-When:   Oktober 2008
+When:   October 2008
 Why:    The stacking of class devices makes these values misleading and
         inconsistent.
         Class devices should not carry any of these properties, and bus
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index 3c384c0cf86e..4dc28cc93503 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -34,6 +34,8 @@ ext2.txt
         - info, mount options and specifications for the Ext2 filesystem.
 ext3.txt
         - info, mount options and specifications for the Ext3 filesystem.
+ext4.txt
+        - info, mount options and specifications for the Ext4 filesystem.
 files.txt
         - info on file management in the Linux kernel.
 fuse.txt
diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt
new file mode 100644
index 000000000000..6a4adcae9f9a
--- /dev/null
+++ b/Documentation/filesystems/ext4.txt
@@ -0,0 +1,236 @@
+
+Ext4 Filesystem
+===============
+
+This is a development version of the ext4 filesystem, an advanced level
+of the ext3 filesystem which incorporates scalability and reliability
+enhancements for supporting large filesystems (64 bit) in keeping with
+increasing disk capacities and state-of-the-art feature requirements.
+
+Mailing list: linux-ext4@vger.kernel.org
+
+
+1. Quick usage instructions:
+===========================
+
+  - Grab updated e2fsprogs from
+    ftp://ftp.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs-interim/
+    This is a patchset on top of e2fsprogs-1.39, which can be found at
+    ftp://ftp.kernel.org/pub/linux/kernel/people/tytso/e2fsprogs/
+
+  - It's still mke2fs -j /dev/hda1
+
+  - mount /dev/hda1 /wherever -t ext4dev
+
+  - To enable extents,
+
+        mount /dev/hda1 /wherever -t ext4dev -o extents
+
+  - The filesystem is compatible with the ext3 driver until you add a file
+    which has extents (ie: `mount -o extents', then create a file).
+
+    NOTE: The "extents" mount flag is temporary.  It will soon go away and
+    extents will be enabled by the "-o extents" flag to mke2fs or tune2fs
+
+  - When comparing performance with other filesystems, remember that
+    ext3/4 by default offers higher data integrity guarantees than most.  So
+    when comparing with a metadata-only journalling filesystem, use `mount -o
+    data=writeback'.  And you might as well use `mount -o nobh' too along
+    with it.  Making the journal larger than the mke2fs default often helps
+    performance with metadata-intensive workloads.
+
+2. Features
+===========
+
+2.1 Currently available
+
+* ability to use filesystems > 16TB
+* extent format reduces metadata overhead (RAM, IO for access, transactions)
+* extent format more robust in face of on-disk corruption due to magics,
+* internal redunancy in tree
+
+2.1 Previously available, soon to be enabled by default by "mkefs.ext4":
+
+* dir_index and resize inode will be on by default
+* large inodes will be used by default for fast EAs, nsec timestamps, etc
+
+2.2 Candidate features for future inclusion
+
+There are several under discussion, whether they all make it in is
+partly a function of how much time everyone has to work on them:
+
+* improved file allocation (multi-block alloc, delayed alloc; basically done)
+* fix 32000 subdirectory limit (patch exists, needs some e2fsck work)
+* nsec timestamps for mtime, atime, ctime, create time (patch exists,
+  needs some e2fsck work)
+* inode version field on disk (NFSv4, Lustre; prototype exists)
+* reduced mke2fs/e2fsck time via uninitialized groups (prototype exists)
+* journal checksumming for robustness, performance (prototype exists)
+* persistent file preallocation (e.g for streaming media, databases)
+
+Features like metadata checksumming have been discussed and planned for
+a bit but no patches exist yet so I'm not sure they're in the near-term
+roadmap.
+
+The big performance win will come with mballoc and delalloc.  CFS has
+been using mballoc for a few years already with Lustre, and IBM + Bull
+did a lot of benchmarking on it.  The reason it isn't in the first set of
+patches is partly a manageability issue, and partly because it doesn't
+directly affect the on-disk format (outside of much better allocation)
+so it isn't critical to get into the first round of changes.  I believe
+Alex is working on a new set of patches right now.
+
+3. Options
+==========
+
+When mounting an ext4 filesystem, the following option are accepted:
+(*) == default
+
+extents                 ext4 will use extents to address file data.  The
+                        file system will no longer be mountable by ext3.
+
+journal=update          Update the ext4 file system's journal to the current
+                        format.
+
+journal=inum            When a journal already exists, this option is ignored.
+                        Otherwise, it specifies the number of the inode which
+                        will represent the ext4 file system's journal file.
+
+journal_dev=devnum      When the external journal device's major/minor numbers
+                        have changed, this option allows the user to specify
+                        the new journal location.  The journal device is
+                        identified through its new major/minor numbers encoded
+                        in devnum.
+
+noload                  Don't load the journal on mounting.
+
+data=journal            All data are committed into the journal prior to being
+                        written into the main file system.
+
+data=ordered    (*)     All data are forced directly out to the main file
+                        system prior to its metadata being committed to the
+                        journal.
+
+data=writeback          Data ordering is not preserved, data may be written
+                        into the main file system after its metadata has been
+                        committed to the journal.
+
+commit=nrsec    (*)     Ext4 can be told to sync all its data and metadata
+                        every 'nrsec' seconds. The default value is 5 seconds.
+                        This means that if you lose your power, you will lose
+                        as much as the latest 5 seconds of work (your
+                        filesystem will not be damaged though, thanks to the
+                        journaling).  This default value (or any low value)
+                        will hurt performance, but it's good for data-safety.
+                        Setting it to 0 will have the same effect as leaving
+                        it at the default (5 seconds).
+                        Setting it to very large values will improve
+                        performance.
+
+barrier=1               This enables/disables barriers.  barrier=0 disables
+                        it, barrier=1 enables it.
+
+orlov           (*)     This enables the new Orlov block allocator. It is
+                        enabled by default.
+
+oldalloc                This disables the Orlov block allocator and enables
+                        the old block allocator.  Orlov should have better
+                        performance - we'd like to get some feedback if it's
+                        the contrary for you.
+
+user_xattr              Enables Extended User Attributes.  Additionally, you
+                        need to have extended attribute support enabled in the
+                        kernel configuration (CONFIG_EXT4_FS_XATTR).  See the
+                        attr(5) manual page and http://acl.bestbits.at/ to
+                        learn more about extended attributes.
+
+nouser_xattr            Disables Extended User Attributes.
+
+acl                     Enables POSIX Access Control Lists support.
+                        Additionally, you need to have ACL support enabled in
+                        the kernel configuration (CONFIG_EXT4_FS_POSIX_ACL).
+                        See the acl(5) manual page and http://acl.bestbits.at/
+                        for more information.
+
+noacl                   This option disables POSIX Access Control List
+                        support.
+
+reservation
+
+noreservation
+
+bsddf           (*)     Make 'df' act like BSD.
+minixdf                 Make 'df' act like Minix.
+
+check=none              Don't do extra checking of bitmaps on mount.
+nocheck
+
+debug                   Extra debugging information is sent to syslog.
+
+errors=remount-ro(*)    Remount the filesystem read-only on an error.
+errors=continue         Keep going on a filesystem error.
+errors=panic            Panic and halt the machine if an error occurs.
+
+grpid                   Give objects the same group ID as their creator.
+bsdgroups
+
+nogrpid         (*)     New objects have the group ID of their creator.
+sysvgroups
+
+resgid=n                The group ID which may use the reserved blocks.
+
+resuid=n                The user ID which may use the reserved blocks.
+
+sb=n                    Use alternate superblock at this location.
+
+quota
+noquota
+grpquota
+usrquota
+
+bh              (*)     ext4 associates buffer heads to data pages to
+nobh                    (a) cache disk block mapping information
+                        (b) link pages into transaction to provide
+                            ordering guarantees.
+                        "bh" option forces use of buffer heads.
+                        "nobh" option tries to avoid associating buffer
+                        heads (supported only for "writeback" mode).
+
+
+Data Mode
+---------
+There are 3 different data modes:
+
+* writeback mode
+In data=writeback mode, ext4 does not journal data at all.  This mode provides
+a similar level of journaling as that of XFS, JFS, and ReiserFS in its default
+mode - metadata journaling.  A crash+recovery can cause incorrect data to
+appear in files which were written shortly before the crash.  This mode will
+typically provide the best ext4 performance.
+
+* ordered mode
+In data=ordered mode, ext4 only officially journals metadata, but it logically
+groups metadata and data blocks into a single unit called a transaction.  When
+it's time to write the new metadata out to disk, the associated data blocks
+are written first.  In general, this mode performs slightly slower than
+writeback but significantly faster than journal mode.
+
+* journal mode
+data=journal mode provides full data and metadata journaling.  All new data is
+written to the journal first, and then to its final location.
+In the event of a crash, the journal can be replayed, bringing both data and
+metadata into a consistent state.  This mode is the slowest except when data
+needs to be read from and written to disk at the same time where it
+outperforms all others modes.
+
+References
+==========
+
+kernel source:  <file:fs/ext4/>
+                <file:fs/jbd2/>
+
+programs:       http://e2fsprogs.sourceforge.net/
+                http://ext2resize.sourceforge.net
+
+useful links:   http://fedoraproject.org/wiki/ext3-devel
+                http://www.bullopensource.org/ext4/
diff --git a/Documentation/filesystems/udf.txt b/Documentation/filesystems/udf.txt
index 511b4230c053..fde829a756e6 100644
--- a/Documentation/filesystems/udf.txt
+++ b/Documentation/filesystems/udf.txt
@@ -7,8 +7,17 @@ If you encounter problems with reading UDF discs using this driver,
 please report them to linux_udf@hpesjro.fc.hp.com, which is the
 developer's list.
 
-Write support requires a block driver which supports writing. The current
-scsi and ide cdrom drivers do not support writing.
+Write support requires a block driver which supports writing.  Currently
+dvd+rw drives and media support true random sector writes, and so a udf
+filesystem on such devices can be directly mounted read/write.  CD-RW
+media however, does not support this.  Instead the media can be formatted
+for packet mode using the utility cdrwtool, then the pktcdvd driver can
+be bound to the underlying cd device to provide the required buffering
+and read-modify-write cycles to allow the filesystem random sector writes
+while providing the hardware with only full packet writes.  While not
+required for dvd+rw media, use of the pktcdvd driver often enhances
+performance due to very poor read-modify-write support supplied internally
+by drive firmware.
 
 -------------------------------------------------------------------------------
 The following mount options are supported:
diff --git a/Documentation/hwmon/adm9240 b/Documentation/hwmon/adm9240
index 35f618f32896..2c6f1fed4618 100644
--- a/Documentation/hwmon/adm9240
+++ b/Documentation/hwmon/adm9240
@@ -24,7 +24,7 @@ Authors:
     Frodo Looijaard <frodol@dds.nl>,
     Philip Edelbrock <phil@netroedge.com>,
     Michiel Rook <michiel@grendelproject.nl>,
-    Grant Coady <gcoady@gmail.com> with guidance
+    Grant Coady <gcoady.lk@gmail.com> with guidance
         from Jean Delvare <khali@linux-fr.org>
 
 Interface
diff --git a/Documentation/hwmon/f71805f b/Documentation/hwmon/f71805f
index 28c5b7d1eb90..2ca69df669c3 100644
--- a/Documentation/hwmon/f71805f
+++ b/Documentation/hwmon/f71805f
@@ -17,7 +17,7 @@ Thanks to Kris Chen from Fintek for answering technical questions and
 providing additional documentation.
 
 Thanks to Chris Lin from Jetway for providing wiring schematics and
-anwsering technical questions.
+answering technical questions.
 
 
 Description
diff --git a/Documentation/hwmon/k8temp b/Documentation/hwmon/k8temp
index bab445ab0f52..30d123b8d920 100644
--- a/Documentation/hwmon/k8temp
+++ b/Documentation/hwmon/k8temp
@@ -2,7 +2,7 @@ Kernel driver k8temp
 ====================
 
 Supported chips:
-  * AMD K8 CPU
+  * AMD Athlon64/FX or Opteron CPUs
     Prefix: 'k8temp'
     Addresses scanned: PCI space
     Datasheet: http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/32559.pdf
@@ -13,10 +13,13 @@ Contact: Rudolf Marek <r.marek@sh.cvut.cz>
 Description
 -----------
 
-This driver permits reading temperature sensor(s) embedded inside AMD K8 CPUs.
-Official documentation says that it works from revision F of K8 core, but
-in fact it seems to be implemented for all revisions of K8 except the first
-two revisions (SH-B0 and SH-B3).
+This driver permits reading temperature sensor(s) embedded inside AMD K8
+family CPUs (Athlon64/FX, Opteron). Official documentation says that it works
+from revision F of K8 core, but in fact it seems to be implemented for all
+revisions of K8 except the first two revisions (SH-B0 and SH-B3).
+
+Please note that you will need at least lm-sensors 2.10.1 for proper userspace
+support.
 
 There can be up to four temperature sensors inside single CPU. The driver
 will auto-detect the sensors and will display only temperatures from
diff --git a/Documentation/hwmon/smsc47m1 b/Documentation/hwmon/smsc47m1
index c15bbe68264e..04a11124f667 100644
--- a/Documentation/hwmon/smsc47m1
+++ b/Documentation/hwmon/smsc47m1
@@ -2,12 +2,14 @@ Kernel driver smsc47m1
 ======================
 
 Supported chips:
-  * SMSC LPC47B27x, LPC47M10x, LPC47M13x, LPC47M14x, LPC47M15x and LPC47M192
+  * SMSC LPC47B27x, LPC47M112, LPC47M10x, LPC47M13x, LPC47M14x,
+    LPC47M15x and LPC47M192
     Addresses scanned: none, address read from Super I/O config space
     Prefix: 'smsc47m1'
     Datasheets:
         http://www.smsc.com/main/datasheets/47b27x.pdf
         http://www.smsc.com/main/datasheets/47m10x.pdf
+        http://www.smsc.com/main/datasheets/47m112.pdf
         http://www.smsc.com/main/tools/discontinued/47m13x.pdf
         http://www.smsc.com/main/datasheets/47m14x.pdf
         http://www.smsc.com/main/tools/discontinued/47m15x.pdf
diff --git a/Documentation/hwmon/w83627ehf b/Documentation/hwmon/w83627ehf
index fae3b781d82d..caa610a297e8 100644
--- a/Documentation/hwmon/w83627ehf
+++ b/Documentation/hwmon/w83627ehf
@@ -26,7 +26,7 @@ fan control mode).
 Temperatures are measured in degrees Celsius and measurement resolution is 1
 degC for temp1 and 0.5 degC for temp2 and temp3. An alarm is triggered when
 the temperature gets higher than high limit; it stays on until the temperature
-falls below the Hysteresis value.
+falls below the hysteresis value.
 
 Fan rotation speeds are reported in RPM (rotations per minute). An alarm is
 triggered if the rotation speed has dropped below a programmable limit. Fan
@@ -67,9 +67,9 @@ Thermal Cruise mode
 
 If the temperature is in the range defined by:
 
-pwm[1-4]_target    - set target temperature, unit millidegree Celcius
+pwm[1-4]_target    - set target temperature, unit millidegree Celsius
                      (range 0 - 127000)
-pwm[1-4]_tolerance - tolerance, unit millidegree Celcius (range 0 - 15000)
+pwm[1-4]_tolerance - tolerance, unit millidegree Celsius (range 0 - 15000)
 
 there are no changes to fan speed. Once the temperature leaves the interval,
 fan speed increases (temp is higher) or decreases if lower than desired.
diff --git a/Documentation/ibm-acpi.txt b/Documentation/ibm-acpi.txt
index 71aa40345272..e50595bfd8ea 100644
--- a/Documentation/ibm-acpi.txt
+++ b/Documentation/ibm-acpi.txt
@@ -30,9 +30,10 @@ detailed description):
         - ACPI sounds
         - temperature sensors
         - Experimental: embedded controller register dump
-        - Experimental: LCD brightness control
-        - Experimental: volume control
+        - LCD brightness control
+        - Volume control
         - Experimental: fan speed, fan enable/disable
+        - Experimental: WAN enable and disable
 
 A compatibility table by model and feature is maintained on the web
 site, http://ibm-acpi.sf.net/. I appreciate any success or failure
@@ -52,40 +53,7 @@ Installation
 
 If you are compiling this driver as included in the Linux kernel
 sources, simply enable the CONFIG_ACPI_IBM option (Power Management /
-ACPI / IBM ThinkPad Laptop Extras). The rest of this section describes
-how to install this driver when downloaded from the web site.
-
-First, you need to get a kernel with ACPI support up and running.
-Please refer to http://acpi.sourceforge.net/ for help with this
-step. How successful you will be depends a lot on you ThinkPad model,
-the kernel you are using and any additional patches applied. The
-kernel provided with your distribution may not be good enough. I
-needed to compile a 2.6.7 kernel with the 20040715 ACPI patch to get
-ACPI working reliably on my ThinkPad X40. Old ThinkPad models may not
-be supported at all.
-
-Assuming you have the basic ACPI support working (e.g. you can see the
-/proc/acpi directory), follow the following steps to install this
-driver:
-
-        - unpack the archive:
-
-                tar xzvf ibm-acpi-x.y.tar.gz; cd ibm-acpi-x.y
-
-        - compile the driver:
-
-                make
-
-        - install the module in your kernel modules directory:
-
-                make install
-
-        - load the module:
-
-                modprobe ibm_acpi
-
-After loading the module, check the "dmesg" output for any error messages.
-
+ACPI / IBM ThinkPad Laptop Extras).
 
 Features
 --------
@@ -523,13 +491,8 @@ registers contain the current battery capacity, etc. If you experiment
 with this, do send me your results (including some complete dumps with
 a description of the conditions when they were taken.)
 
-EXPERIMENTAL: LCD brightness control -- /proc/acpi/ibm/brightness
------------------------------------------------------------------
-
-This feature is marked EXPERIMENTAL because the implementation
-directly accesses hardware registers and may not work as expected. USE
-WITH CAUTION! To use this feature, you need to supply the
-experimental=1 parameter when loading the module.
+LCD brightness control -- /proc/acpi/ibm/brightness
+---------------------------------------------------
 
 This feature allows software control of the LCD brightness on ThinkPad
 models which don't have a hardware brightness slider. The available
@@ -542,13 +505,8 @@ commands are:
 The <level> number range is 0 to 7, although not all of them may be
 distinct. The current brightness level is shown in the file.
 
-EXPERIMENTAL: Volume control -- /proc/acpi/ibm/volume
------------------------------------------------------
-
-This feature is marked EXPERIMENTAL because the implementation
-directly accesses hardware registers and may not work as expected. USE
-WITH CAUTION! To use this feature, you need to supply the
-experimental=1 parameter when loading the module.
+Volume control -- /proc/acpi/ibm/volume
+---------------------------------------
 
 This feature allows volume control on ThinkPad models which don't have
 a hardware volume knob. The available commands are:
@@ -611,6 +569,23 @@ with the following command:
 
         echo 'level <level>' > /proc/acpi/ibm/thermal
 
+EXPERIMENTAL: WAN -- /proc/acpi/ibm/wan
+---------------------------------------
+
+This feature is marked EXPERIMENTAL because the implementation
+directly accesses hardware registers and may not work as expected. USE
+WITH CAUTION! To use this feature, you need to supply the
+experimental=1 parameter when loading the module.
+
+This feature shows the presence and current state of a WAN (Sierra
+Wireless EV-DO) device. If WAN is installed, the following commands can
+be used:
+
+        echo enable > /proc/acpi/ibm/wan
+        echo disable > /proc/acpi/ibm/wan
+
+It was tested on a Lenovo Thinkpad X60. It should probably work on other
+Thinkpad models which come with this module installed.
 
 Multiple Commands, Module Parameters
 ------------------------------------
diff --git a/Documentation/input/xpad.txt b/Documentation/input/xpad.txt
index b9111a703ce0..5427bdf225ed 100644
--- a/Documentation/input/xpad.txt
+++ b/Documentation/input/xpad.txt
@@ -3,20 +3,37 @@ xpad - Linux USB driver for X-Box gamepads
 This is the very first release of a driver for X-Box gamepads.
 Basically, this was hacked away in just a few hours, so don't expect
 miracles.
+
 In particular, there is currently NO support for the rumble pack.
 You won't find many ff-aware linux applications anyway.
 
 
-0. Status
----------
+0. Notes
+--------
+
+Driver updated for kernel 2.6.17.11. (Based on a patch for 2.6.11.4.)
 
-For now, this driver has only been tested on just one Linux-Box.
-This one is running a 2.4.18 kernel with usb-uhci on an amd athlon 600.
+The number of buttons/axes reported varies based on 3 things:
+- if you are using a known controller
+- if you are using a known dance pad
+- if using an unknown device (one not listed below), what you set in the
+  module configuration for "Map D-PAD to buttons rather than axes for unknown
+  pads" (module option dpad_to_buttons)
 
-The jstest-program from joystick-1.2.15 (jstest-version 2.1.0) reports
-8 axes and 10 buttons.
+If you set dpad_to_buttons to 0 and you are using an unknown device (one
+not listed below), the driver will map the directional pad to axes (X/Y),
+if you said N it will map the d-pad to buttons, which is needed for dance
+style games to function correctly.  The default is Y.
+
+dpad_to_buttons has no effect for known pads.
+
+0.1 Normal Controllers
+----------------------
+With a normal controller, the directional pad is mapped to its own X/Y axes.
+The jstest-program from joystick-1.2.15 (jstest-version 2.1.0) will report 8
+axes and 10 buttons.
 
-Alls 8 axes work, though they all have the same range (-32768..32767)
+All 8 axes work, though they all have the same range (-32768..32767)
 and the zero-setting is not correct for the triggers (I don't know if that
 is some limitation of jstest, since the input device setup should be fine. I
 didn't have a look at jstest itself yet).
@@ -30,16 +47,50 @@ in game functionality were OK. However, I find it rather difficult to
 play first person shooters with a pad. Your mileage may vary.
 
 
+0.2 Xbox Dance Pads
+-------------------
+When using a known dance pad, jstest will report 6 axes and 14 buttons.
+
+For dance style pads (like the redoctane pad) several changes
+have been made.  The old driver would map the d-pad to axes, resulting
+in the driver being unable to report when the user was pressing both
+left+right or up+down, making DDR style games unplayable.
+
+Known dance pads automatically map the d-pad to buttons and will work
+correctly out of the box.
+
+If your dance pad is recognized by the driver but is using axes instead
+of buttons, see section 0.3 - Unknown Controllers
+
+I've tested this with Stepmania, and it works quite well.
+
+
+0.3 Unkown Controllers
+----------------------
+If you have an unkown xbox controller, it should work just fine with
+the default settings.
+
+HOWEVER if you have an unknown dance pad not listed below, it will not
+work UNLESS you set "dpad_to_buttons" to 1 in the module configuration.
+
+PLEASE if you have an unkown controller, email Dom <binary1230@yahoo.com> with
+a dump from /proc/bus/usb and a description of the pad (manufacturer, country,
+whether it is a dance pad or normal controller) so that we can add your pad
+to the list of supported devices, ensuring that it will work out of the
+box in the future.
+
+
 1. USB adapter
 --------------
 
 Before you can actually use the driver, you need to get yourself an
-adapter cable to connect the X-Box controller to your Linux-Box.
+adapter cable to connect the X-Box controller to your Linux-Box. You
+can buy these online fairly cheap, or build your own.
 
-Such a cable is pretty easy to build. The Controller itself is a USB compound
-device (a hub with three ports for two expansion slots and the controller
-device) with the only difference in a nonstandard connector (5 pins vs. 4 on
-standard USB connector).
+Such a cable is pretty easy to build. The Controller itself is a USB
+compound device (a hub with three ports for two expansion slots and
+the controller device) with the only difference in a nonstandard connector
+(5 pins vs. 4 on standard USB connector).
 
 You just need to solder a USB connector onto the cable and keep the
 yellow wire unconnected. The other pins have the same order on both
@@ -51,36 +102,36 @@ original one. You can buy an extension cable and cut that instead. That way,
 you can still use the controller with your X-Box, if you have one ;)
 
 
-2. driver installation
+2. Driver Installation
 ----------------------
 
 Once you have the adapter cable and the controller is connected, you need
 to load your USB subsystem and should cat /proc/bus/usb/devices.
 There should be an entry like the one at the end [4].
 
-Currently (as of version 0.0.4), the following three devices are included:
+Currently (as of version 0.0.6), the following devices are included:
  original Microsoft XBOX controller (US), vendor=0x045e, product=0x0202
+ smaller  Microsoft XBOX controller (US), vendor=0x045e, product=0x0289
  original Microsoft XBOX controller (Japan), vendor=0x045e, product=0x0285
  InterAct PowerPad Pro (Germany), vendor=0x05fd, product=0x107a
+ RedOctane Xbox Dance Pad (US), vendor=0x0c12, product=0x8809
 
-If you have another controller that is not listed above and is not recognized
-by the driver, please drop me a line with the appropriate info (that is, include
-the name, vendor and product ID, as well as the country where you bought it;
-sending the whole dump out of /proc/bus/usb/devices along would be even better).
+The driver should work with xbox pads not listed above as well, however
+you will need to do something extra for dance pads to work.
 
-In theory, the driver should work with other controllers than mine
-(InterAct PowerPad pro, bought in Germany) just fine, but I cannot test this
-for I only have this one controller.
+If you have a controller not listed above, see 0.3 - Unknown Controllers
 
 If you compiled and installed the driver, test the functionality:
 > modprobe xpad
 > modprobe joydev
 > jstest /dev/js0
 
-There should be a single line showing 18 inputs (8 axes, 10 buttons), and
-it's values should change if you move the sticks and push the buttons.
+If you're using a normal controller, there should be a single line showing
+18 inputs (8 axes, 10 buttons), and its values should change if you move
+the sticks and push the buttons.  If you're using a dance pad, it should
+show 20 inputs (6 axes, 14 buttons).
 
-It works? Voila, your done ;)
+It works? Voila, you're done ;)
 
 
 3. Thanks
@@ -111,6 +162,22 @@ I:  If#= 0 Alt= 0 #EPs= 2 Cls=58(unk. ) Sub=42 Prot=00 Driver=(none)
 E:  Ad=81(I) Atr=03(Int.) MxPS=  32 Ivl= 10ms
 E:  Ad=02(O) Atr=03(Int.) MxPS=  32 Ivl= 10ms
 
+5. /proc/bus/usb/devices - dump from Redoctane Xbox Dance Pad (US):
+
+T:  Bus=01 Lev=02 Prnt=09 Port=00 Cnt=01 Dev#= 10 Spd=12  MxCh= 0
+D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
+P:  Vendor=0c12 ProdID=8809 Rev= 0.01
+S:  Product=XBOX DDR
+C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=100mA
+I:  If#= 0 Alt= 0 #EPs= 2 Cls=58(unk. ) Sub=42 Prot=00 Driver=xpad
+E:  Ad=82(I) Atr=03(Int.) MxPS=  32 Ivl=4ms
+E:  Ad=02(O) Atr=03(Int.) MxPS=  32 Ivl=4ms
+
 -- 
 Marko Friedemann <mfr@bmx-chemnitz.de>
 2002-07-16
+ - original doc
+
+Dominic Cerquetti <binary1230@yahoo.com>
+2005-03-19
+ - added stuff for dance pads, new d-pad->axes mappings
diff --git a/Documentation/kernel-doc-nano-HOWTO.txt b/Documentation/kernel-doc-nano-HOWTO.txt
index c65233d430f0..284e7e198e93 100644
--- a/Documentation/kernel-doc-nano-HOWTO.txt
+++ b/Documentation/kernel-doc-nano-HOWTO.txt
@@ -17,7 +17,7 @@ are:
   special place-holders for where the extracted documentation should
   go.
 
-- scripts/docproc.c
+- scripts/basic/docproc.c
 
   This is a program for converting SGML template files into SGML
   files. When a file is referenced it is searched for symbols
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 5a92ac085969..9913f0676643 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -164,6 +164,10 @@ and is between 256 and 4096 characters. It is defined in the file
         acpi_skip_timer_override [HW,ACPI]
                         Recognize and ignore IRQ0/pin2 Interrupt Override.
                         For broken nForce2 BIOS resulting in XT-PIC timer.
+        acpi_use_timer_override [HW,ACPI}
+                        Use timer override. For some broken Nvidia NF5 boards
+                        that require a timer override, but don't have
+                        HPET
 
         acpi_dbg_layer= [HW,ACPI]
                         Format: <int>
@@ -1231,6 +1235,11 @@ and is between 256 and 4096 characters. It is defined in the file
                                 machine check when some devices' config space
                                 is read. But various workarounds are disabled
                                 and some IOMMU drivers will not work.
+                bfsort          Sort PCI devices into breadth-first order.
+                                This sorting is done to get a device
+                                order compatible with older (<= 2.4) kernels.
+                nobfsort        Don't sort PCI devices into breadth-first order.
+
         pcmv=           [HW,PCMCIA] BadgePAD 4
 
         pd.             [PARIDE]
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt
index ba26201d5023..d71fafffce90 100644
--- a/Documentation/kprobes.txt
+++ b/Documentation/kprobes.txt
@@ -442,9 +442,10 @@ static int __init kprobe_init(void)
         kp.fault_handler = handler_fault;
         kp.symbol_name = "do_fork";
 
-        if ((ret = register_kprobe(&kp) < 0)) {
+        ret = register_kprobe(&kp);
+        if (ret < 0) {
                 printk("register_kprobe failed, returned %d\n", ret);
-                return -1;
+                return ret;
         }
         printk("kprobe registered\n");
         return 0;
diff --git a/Documentation/lockdep-design.txt b/Documentation/lockdep-design.txt
index dab123db5a4f..488773018152 100644
--- a/Documentation/lockdep-design.txt
+++ b/Documentation/lockdep-design.txt
@@ -50,10 +50,10 @@ The bit position indicates hardirq, softirq, hardirq-read,
 softirq-read respectively, and the character displayed in each
 indicates:
 
-   '.'   acquired while irqs enabled
+   '.'  acquired while irqs disabled
    '+'  acquired in irq context
-   '-'  acquired in process context with irqs disabled
-   '?'  read-acquired both with irqs enabled and in irq context
+   '-'  acquired with irqs enabled
+   '?' read acquired in irq context with irqs enabled.
 
 Unused mutexes cannot be part of the cause of an error.
 
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index 994355b0cd19..7751704b6db1 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -1016,7 +1016,7 @@ There are some more advanced barrier functions:
 
  (*) set_mb(var, value)
 
-     This assigns the value to the variable and then inserts at least a write
+     This assigns the value to the variable and then inserts a full memory
      barrier after it, depending on the function.  It isn't guaranteed to
      insert anything more than a compiler barrier in a UP compilation.
 
@@ -1898,7 +1898,7 @@ queue before processing any further requests:
         smp_wmb();
         <A:modify v=2>  <C:busy>
                         <C:queue v=2>
-        p = &b;         q = p;
+        p = &v;         q = p;
                         <D:request p>
         <B:modify p=&v> <D:commit p=&v>
                         <D:read p>
diff --git a/Documentation/mips/time.README b/Documentation/mips/time.README
index 69ddc5c14b79..a4ce603ed3b3 100644
--- a/Documentation/mips/time.README
+++ b/Documentation/mips/time.README
@@ -38,19 +38,14 @@ The new time code provide the following services:
 
   a) Implements functions required by Linux common code:
         time_init
-        do_gettimeofday
-        do_settimeofday
 
   b) provides an abstraction of RTC and null RTC implementation as default.
         extern unsigned long (*rtc_get_time)(void);
         extern int (*rtc_set_time)(unsigned long);
 
-  c) a set of gettimeoffset functions for different CPUs and different
-     needs.
-
-  d) high-level and low-level timer interrupt routines where the timer 
-     interrupt source  may or may not be the CPU timer.  The high-level 
-     routine is dispatched through do_IRQ() while the low-level is 
+  c) high-level and low-level timer interrupt routines where the timer
+     interrupt source  may or may not be the CPU timer.  The high-level
+     routine is dispatched through do_IRQ() while the low-level is
      dispatched in assemably code (usually int-handler.S)
 
 
@@ -63,7 +58,7 @@ the following functions or values:
   a) board_time_init - a function pointer.  Invoked at the beginnig of
      time_init().  It is optional.
         1. (optional) set up RTC routines
-        2. (optional) calibrate and set the mips_counter_frequency
+        2. (optional) calibrate and set the mips_hpt_frequency
 
   b) plat_timer_setup - a function pointer.  Invoked at the end of time_init()
         1. (optional) over-ride any decisions made in time_init()
@@ -72,9 +67,8 @@ the following functions or values:
 
   c) (optional) board-specific RTC routines.
 
-  d) (optional) mips_counter_frequency - It must be definied if the board
-     is using CPU counter for timer interrupt or it is using fixed rate
-     gettimeoffset().
+  d) (optional) mips_hpt_frequency - It must be definied if the board
+     is using CPU counter for timer interrupt.
 
 
 PORTING GUIDE
@@ -89,22 +83,12 @@ Step 1: decide how you like to implement the time services.
      If the answer is no, you need a timer to provide the timer interrupt
      at 100 HZ speed.
 
-     You cannot use the fast gettimeoffset functions, i.e.,
-
-        unsigned long fixed_rate_gettimeoffset(void);
-        unsigned long calibrate_div32_gettimeoffset(void);
-        unsigned long calibrate_div64_gettimeoffset(void);
-
-    You can use null_gettimeoffset() will gives the same time resolution as
-    jiffy.  Or you can implement your own gettimeoffset (probably based on 
-    some ad hoc hardware on your machine.)
-
   c) The following sub steps assume your CPU has counter register.
      Do you plan to use the CPU counter register as the timer interrupt
      or use an exnternal timer?
 
      In order to use CPU counter register as the timer interrupt source, you
-     must know the counter speed (mips_counter_frequency).  It is usually the
+     must know the counter speed (mips_hpt_frequency).  It is usually the
      same as the CPU speed or an integral divisor of it.
 
   d) decide on whether you want to use high-level or low-level timer
@@ -121,10 +105,10 @@ Step 3: implement rtc routines, board_time_init() and plat_timer_setup()
   if needed.
 
   board_time_init() -
-        a) (optional) set up RTC routines, 
-        b) (optional) calibrate and set the mips_counter_frequency
-            (only needed if you intended to use fixed_rate_gettimeoffset
-             or use cpu counter as timer interrupt source)
+        a) (optional) set up RTC routines,
+        b) (optional) calibrate and set the mips_hpt_frequency
+            (only needed if you intended to use cpu counter as timer interrupt
+             source)
 
   plat_timer_setup() -
         a) (optional) over-write any choices made above by time_init().
@@ -154,8 +138,8 @@ for some of the functions in time.c.
 For example, you may define your own timer interrupt routine, which does
 some of its own processing and then calls timer_interrupt().
 
-You can also over-ride any of the built-in functions (gettimeoffset,
-RTC routines and/or timer interrupt routine).
+You can also over-ride any of the built-in functions (RTC routines
+and/or timer interrupt routine).
 
 
 PORTING NOTES FOR SMP
@@ -187,10 +171,3 @@ You need to decide on your timer interrupt sources.
 
         You can also do the low-level version of those interrupt routines,
         following similar dispatching routes described above.
-
-Note about do_gettimeoffset():
-
-  It is very likely the CPU counter registers are not sync'ed up in a SMP box.
-  Therefore you cannot really use the many of the existing routines that
-  are based on CPU counter.  You should wirte your own gettimeoffset rouinte
-  if you want intra-jiffy resolution.
diff --git a/Documentation/power/interface.txt b/Documentation/power/interface.txt
index a66bec222b16..74311d7e0f3c 100644
--- a/Documentation/power/interface.txt
+++ b/Documentation/power/interface.txt
@@ -30,6 +30,17 @@ testing). The system will support either 'firmware' or 'platform', and
 that is known a priori. But, the user may choose 'shutdown' or
 'reboot' as alternatives. 
 
+Additionally, /sys/power/disk can be used to turn on one of the two testing
+modes of the suspend-to-disk mechanism: 'testproc' or 'test'.  If the
+suspend-to-disk mechanism is in the 'testproc' mode, writing 'disk' to
+/sys/power/state will cause the kernel to disable nonboot CPUs and freeze
+tasks, wait for 5 seconds, unfreeze tasks and enable nonboot CPUs.  If it is
+in the 'test' mode, writing 'disk' to /sys/power/state will cause the kernel
+to disable nonboot CPUs and freeze tasks, shrink memory, suspend devices, wait
+for 5 seconds, resume devices, unfreeze tasks and enable nonboot CPUs.  Then,
+we are able to look in the log messages and work out, for example, which code
+is being slow and which device drivers are misbehaving.
+
 Reading from this file will display what the mode is currently set
 to. Writing to this file will accept one of
 
@@ -37,6 +48,8 @@ to. Writing to this file will accept one of
        'platform'
        'shutdown'
        'reboot'
+       'testproc'
+       'test'
 
 It will only change to 'firmware' or 'platform' if the system supports
 it. 
diff --git a/Documentation/s390/CommonIO b/Documentation/s390/CommonIO
index 59d1166d41ee..d684a6ac69a8 100644
--- a/Documentation/s390/CommonIO
+++ b/Documentation/s390/CommonIO
@@ -66,7 +66,7 @@ Command line parameters
 
   When a device is un-ignored, device recognition and sensing is performed and 
   the device driver will be notified if possible, so the device will become
-  available to the system.
+  available to the system. Note that un-ignoring is performed asynchronously.
 
   You can also add ranges of devices to be ignored by piping to 
   /proc/cio_ignore; "add <device range>, <device range>, ..." will ignore the
diff --git a/Documentation/s390/cds.txt b/Documentation/s390/cds.txt
index d80e5733827d..32a96cc39215 100644
--- a/Documentation/s390/cds.txt
+++ b/Documentation/s390/cds.txt
@@ -174,14 +174,10 @@ read_dev_chars() - Read Device Characteristics
 
 This routine returns the characteristics for the device specified.
 
-The function is meant to be called with an irq handler in place; that is,
+The function is meant to be called with the device already enabled; that is,
 at earliest during set_online() processing.
 
-While the request is processed synchronously, the device interrupt
-handler is called for final ending status. In case of error situations the
-interrupt handler may recover appropriately. The device irq handler can
-recognize the corresponding interrupts by the interruption parameter be
-0x00524443. The ccw_device must not be locked prior to calling read_dev_chars().
+The ccw_device must not be locked prior to calling read_dev_chars().
 
 The function may be called enabled or disabled.
 
@@ -410,26 +406,7 @@ individual flag meanings.
 
 Usage Notes :
 
-Prior to call ccw_device_start() the device driver must assure disabled state,
-i.e. the I/O mask value in the PSW must be disabled. This can be accomplished
-by calling local_save_flags( flags). The current PSW flags are preserved and
-can be restored by local_irq_restore( flags) at a later time.
-
-If the device driver violates this rule while running in a uni-processor
-environment an interrupt might be presented prior to the ccw_device_start()
-routine returning to the device driver main path. In this case we will end in a
-deadlock situation as the interrupt handler will try to obtain the irq
-lock the device driver still owns (see below) !
-
-The driver must assure to hold the device specific lock. This can be
-accomplished by
-
-(i)  spin_lock(get_ccwdev_lock(cdev)), or
-(ii) spin_lock_irqsave(get_ccwdev_lock(cdev), flags)
-
-Option (i) should be used if the calling routine is running disabled for
-I/O interrupts (see above) already. Option (ii) obtains the device gate und
-puts the CPU into I/O disabled state by preserving the current PSW flags.
+ccw_device_start() must be called disabled and with the ccw device lock held.
 
 The device driver is allowed to issue the next ccw_device_start() call from
 within its interrupt handler already. It is not required to schedule a
@@ -488,7 +465,7 @@ int ccw_device_resume(struct ccw_device *cdev);
 
 cdev - ccw_device the resume operation is requested for
 
-The resume_IO() function returns:
+The ccw_device_resume() function returns:
 
         0  - suspended channel program is resumed
 -EBUSY     - status pending
@@ -507,6 +484,8 @@ a long-running channel program or the device might require to initially issue
 a halt subchannel (HSCH) I/O command. For those purposes the ccw_device_halt()
 command is provided.
 
+ccw_device_halt() must be called disabled and with the ccw device lock held.
+
 int ccw_device_halt(struct ccw_device *cdev,
                     unsigned long intparm);
 
@@ -517,7 +496,7 @@ intparm : interruption parameter; value is only used if no I/O
 
 The ccw_device_halt() function returns :
 
-      0 - successful completion or request successfully initiated
+      0 - request successfully initiated
 -EBUSY  - the device is currently busy, or status pending.
 -ENODEV - cdev invalid.
 -EINVAL - The device is not operational or the ccw device is not online.
@@ -533,6 +512,23 @@ can then perform an appropriate action. Prior to interrupt of an outstanding
 read to a network device (with or without PCI flag) a ccw_device_halt()
 is required to end the pending operation.
 
+ccw_device_clear() - Terminage I/O Request Processing
+
+In order to terminate all I/O processing at the subchannel, the clear subchannel
+(CSCH) command is used. It can be issued via ccw_device_clear().
+
+ccw_device_clear() must be called disabled and with the ccw device lock held.
+
+int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm);
+
+cdev:    ccw_device the clear operation is requested for
+intparm: interruption parameter (see ccw_device_halt())
+
+The ccw_device_clear() function returns:
+
+      0 - request successfully initiated
+-ENODEV - cdev invalid
+-EINVAL - The device is not operational or the ccw device is not online.
 
 Miscellaneous Support Routines
 
diff --git a/Documentation/s390/driver-model.txt b/Documentation/s390/driver-model.txt
index 62c082387aea..77bf450ec39b 100644
--- a/Documentation/s390/driver-model.txt
+++ b/Documentation/s390/driver-model.txt
@@ -239,6 +239,9 @@ status - Can be 'online' or 'offline'.
 
 type - The physical type of the channel path.
 
+shared - Whether the channel path is shared.
+
+cmg - The channel measurement group.
 
 3. System devices
 -----------------
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 138673a907f5..3472d9c4ef1b 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -753,7 +753,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     position_fix - Fix DMA pointer (0 = auto, 1 = none, 2 = POSBUF, 3 = FIFO size)
     single_cmd  - Use single immediate commands to communicate with
                 codecs (for debugging only)
-    disable_msi - Disable Message Signaled Interrupt (MSI)
+    enable_msi  - Enable Message Signaled Interrupt (MSI) (default = off)
 
     This module supports one card and autoprobe.
 
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 89bf8c20a586..0bc7f1e3c9e6 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -86,7 +86,7 @@ valid for 30 seconds.
 core_pattern:
 
 core_pattern is used to specify a core dumpfile pattern name.
-. max length 64 characters; default value is "core"
+. max length 128 characters; default value is "core"
 . core_pattern is used as a pattern template for the output filename;
   certain string patterns (beginning with '%') are substituted with
   their actual values.
@@ -105,6 +105,9 @@ core_pattern is used to specify a core dumpfile pattern name.
         %h      hostname
         %e      executable filename
         %<OTHER> both are dropped
+. If the first character of the pattern is a '|', the kernel will treat
+  the rest of the pattern as a command to run.  The core dump will be
+  written to the standard input of that program instead of to a file.
 
 ==============================================================
 
diff --git a/Documentation/usb/usb-serial.txt b/Documentation/usb/usb-serial.txt
index 8dc2bacc8f1f..50436e1663ea 100644
--- a/Documentation/usb/usb-serial.txt
+++ b/Documentation/usb/usb-serial.txt
@@ -428,12 +428,6 @@ Options supported:
   See http://www.uuhaus.de/linux/palmconnect.html for up-to-date
   information on this driver.
 
-AIRcable USB Dongle Bluetooth driver
-  If there is the cdc_acm driver loaded in the system, you will find that the
-  cdc_acm claims the device before AIRcable can. This is simply corrected
-  by unloading both modules and then loading the aircable module before
-  cdc_acm module
-
 Generic Serial driver
 
   If your device is not one of the above listed devices, compatible with
diff --git a/Documentation/video4linux/CARDLIST.cx88 b/Documentation/video4linux/CARDLIST.cx88
index 126e59d935cd..8755b3e7b09e 100644
--- a/Documentation/video4linux/CARDLIST.cx88
+++ b/Documentation/video4linux/CARDLIST.cx88
@@ -51,7 +51,7 @@
  50 -> NPG Tech Real TV FM Top 10                          [14f1:0842]
  51 -> WinFast DTV2000 H                                   [107d:665e]
  52 -> Geniatech DVB-S                                     [14f1:0084]
- 53 -> Hauppauge WinTV-HVR3000 TriMode Analog/DVB-S/DVB-T  [0070:1404]
+ 53 -> Hauppauge WinTV-HVR3000 TriMode Analog/DVB-S/DVB-T  [0070:1404,0070:1400,0070:1401,0070:1402]
  54 -> Norwood Micro TV Tuner
  55 -> Shenzhen Tungsten Ages Tech TE-DTV-250 / Swann OEM  [c180:c980]
  56 -> Hauppauge WinTV-HVR1300 DVB-T/Hybrid MPEG Encoder   [0070:9600,0070:9601,0070:9602]
diff --git a/Documentation/watchdog/src/watchdog-simple.c b/Documentation/watchdog/src/watchdog-simple.c
index 85cf17c48669..47801bc7e742 100644
--- a/Documentation/watchdog/src/watchdog-simple.c
+++ b/Documentation/watchdog/src/watchdog-simple.c
@@ -1,4 +1,6 @@
+#include <stdio.h>
 #include <stdlib.h>
+#include <unistd.h>
 #include <fcntl.h>
 
 int main(int argc, const char *argv[]) {
diff --git a/MAINTAINERS b/MAINTAINERS
index 931e6e40c08b..a5508f930ed9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -493,7 +493,7 @@ S:	Maintained
 
 BFS FILE SYSTEM
 P:      Tigran A. Aivazian
-M:      tigran@veritas.com
+M:      tigran@aivazian.fsnet.co.uk
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 
@@ -905,7 +905,8 @@ P:	David Teigland
 M:      teigland@redhat.com
 L:      cluster-devel@redhat.com
 W:      http://sources.redhat.com/cluster/
-T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs-2.6.git
+T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes.git
+T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs2-2.6-nmw.git
 S:      Supported
 
 DAVICOM FAST ETHERNET (DMFE) NETWORK DRIVER
@@ -1188,7 +1189,8 @@ P:	Steven Whitehouse
 M:      swhiteho@redhat.com
 L:      cluster-devel@redhat.com
 W:      http://sources.redhat.com/cluster/
-T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs-2.6.git
+T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes.git
+T:      git kernel.org:/pub/scm/linux/kernel/git/steve/gfs2-2.6-nmw.git
 S:      Supported
 
 GIGASET ISDN DRIVERS
@@ -1511,7 +1513,7 @@ S:	Maintained
 
 INTEL IA32 MICROCODE UPDATE SUPPORT
 P:      Tigran Aivazian
-M:      tigran@veritas.com
+M:      tigran@aivazian.fsnet.co.uk
 S:      Maintained
 
 INTEL IXP4XX RANDOM NUMBER GENERATOR SUPPORT
@@ -1666,6 +1668,12 @@ M:	sct@redhat.com, akpm@osdl.org
 L:      ext2-devel@lists.sourceforge.net
 S:      Maintained
 
+K8TEMP HARDWARE MONITORING DRIVER
+P:      Rudolf Marek
+M:      r.marek@assembler.cz
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+
 KCONFIG
 P:      Roman Zippel
 M:      zippel@linux-m68k.org
@@ -1996,6 +2004,13 @@ M:	rubini@ipvvis.unipv.it
 L:      linux-kernel@vger.kernel.org
 S:      Maintained
 
+MSI LAPTOP SUPPORT
+P:      Lennart Poettering
+M:      mzxreary@0pointer.de
+L:      https://tango.0pointer.de/mailman/listinfo/s270-linux
+W:      http://0pointer.de/lennart/tchibo.html
+S:      Maintained
+
 MTRR AND SIMILAR SUPPORT [i386]
 P:      Richard Gooch
 M:      rgooch@atnf.csiro.au
@@ -2003,8 +2018,11 @@ L:	linux-kernel@vger.kernel.org
 W:      http://www.atnf.csiro.au/~rgooch/linux/kernel-patches.html
 S:      Maintained
 
-MULTIMEDIA CARD (MMC) SUBSYSTEM
-S:      Orphan
+MULTIMEDIA CARD (MMC) AND SECURE DIGITAL (SD) SUBSYSTEM
+P:      Pierre Ossman
+M:      drzeus-mmc@drzeus.cx
+L:      linux-kernel@vger.kernel.org
+S:      Maintained
 
 MULTISOUND SOUND DRIVER
 P:      Andrew Veliath
@@ -2040,11 +2058,13 @@ P:	Marc Boucher
 P:      James Morris
 P:      Harald Welte
 P:      Jozsef Kadlecsik
-M:      coreteam@netfilter.org
+P:      Patrick McHardy
+M:      kaber@trash.net
+L:      netfilter-devel@lists.netfilter.org
+L:      netfilter@lists.netfilter.org
+L:      coreteam@netfilter.org
 W:      http://www.netfilter.org/
 W:      http://www.iptables.org/
-L:      netfilter@lists.netfilter.org
-L:      netfilter-devel@lists.netfilter.org
 S:      Supported
 
 NETLABEL
@@ -2295,8 +2315,8 @@ T:	quilt kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
 S:      Supported
 
 PCI HOTPLUG CORE
-P:      Greg Kroah-Hartman
-M:      gregkh@suse.de
+P:      Kristen Carlson Accardi
+M:      kristen.c.accardi@intel.com
 S:      Supported
 
 PCI HOTPLUG COMPAQ DRIVER
@@ -3052,6 +3072,13 @@ L:	video4linux-list@redhat.com
 W:      http://www.linux-projects.org
 S:      Maintained
 
+USB GADGET/PERIPHERAL SUBSYSTEM
+P:      David Brownell
+M:      dbrownell@users.sourceforge.net
+L:      linux-usb-devel@lists.sourceforge.net
+W:      http://www.linux-usb.org/gadget
+S:      Maintained
+
 USB HID/HIDBP DRIVERS
 P:      Vojtech Pavlik
 M:      vojtech@suse.cz
@@ -3235,10 +3262,11 @@ L:	linux-usb-users@lists.sourceforge.net
 L:      linux-usb-devel@lists.sourceforge.net
 S:      Maintained
 
-USB "USBNET" DRIVER
+USB "USBNET" DRIVER FRAMEWORK
 P:      David Brownell
 M:      dbrownell@users.sourceforge.net
 L:      linux-usb-devel@lists.sourceforge.net
+W:      http://www.linux-usb.org/usbnet
 S:      Maintained
 
 USB W996[87]CF DRIVER
diff --git a/Makefile b/Makefile
index 274b780029b1..958fad6739b3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 19
-EXTRAVERSION =-rc1
+EXTRAVERSION =-rc6
 NAME=Avast! A bilge rat!
 
 # *DOCUMENTATION*
@@ -499,6 +499,7 @@ endif
 
 ifdef CONFIG_UNWIND_INFO
 CFLAGS          += -fasynchronous-unwind-tables
+LDFLAGS_vmlinux += --eh-frame-hdr
 endif
 
 ifdef CONFIG_DEBUG_INFO
@@ -741,6 +742,9 @@ endif # ifdef CONFIG_KALLSYMS
 
 # vmlinux image - including updated kernel symbols
 vmlinux: $(vmlinux-lds) $(vmlinux-init) $(vmlinux-main) $(kallsyms.o) FORCE
+ifdef CONFIG_HEADERS_CHECK
+        $(Q)$(MAKE) -f $(srctree)/Makefile headers_check
+endif
         $(call if_changed_rule,vmlinux__)
         $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost $@
         $(Q)rm -f .old_version
@@ -932,7 +936,7 @@ headers_install_all: include/linux/version.h scripts_basic FORCE
 
 PHONY += headers_install
 headers_install: include/linux/version.h scripts_basic FORCE
-        @if [ ! -r include/asm-$(ARCH)/Kbuild ]; then \
+        @if [ ! -r $(srctree)/include/asm-$(ARCH)/Kbuild ]; then \
           echo '*** Error: Headers not exportable for this architecture ($(ARCH))'; \
           exit 1 ; fi
         $(Q)$(MAKE) $(build)=scripts scripts/unifdef
@@ -1316,7 +1320,8 @@ define xtags
             $(all-sources) | xargs $1 -a \
                 -I __initdata,__exitdata,__acquires,__releases \
                 -I EXPORT_SYMBOL,EXPORT_SYMBOL_GPL \
-                --extra=+f --c-kinds=+px; \
+                --extra=+f --c-kinds=+px \
+                --regex-asm='/ENTRY\(([^)]*)\).*/\1/'; \
             $(all-kconfigs) | xargs $1 -a \
                 --langdef=kconfig \
                 --language-force=kconfig \
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index 8b02420f732e..e9762a33b043 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -6,40 +6,13 @@
  */
 
 #include <linux/module.h>
-#include <linux/string.h>
-#include <linux/user.h>
-#include <linux/elfcore.h>
-#include <linux/socket.h>
-#include <linux/syscalls.h>
-#include <linux/in.h>
-#include <linux/in6.h>
-#include <linux/pci.h>
-#include <linux/screen_info.h>
-#include <linux/tty.h>
-#include <linux/mm.h>
-#include <linux/delay.h>
-#include <linux/dma-mapping.h>
-
-#include <asm/io.h>
 #include <asm/console.h>
-#include <asm/hwrpb.h>
 #include <asm/uaccess.h>
-#include <asm/processor.h>
 #include <asm/checksum.h>
-#include <linux/interrupt.h>
 #include <asm/fpu.h>
-#include <asm/irq.h>
 #include <asm/machvec.h>
-#include <asm/pgalloc.h>
-#include <asm/semaphore.h>
-#include <asm/tlbflush.h>
-#include <asm/cacheflush.h>
-#include <asm/vga.h>
 
-#include <asm/unistd.h>
-
-extern struct hwrpb_struct *hwrpb;
-extern spinlock_t rtc_lock;
+#include <linux/syscalls.h>
 
 /* these are C runtime functions with special calling conventions: */
 extern void __divl (void);
@@ -52,14 +25,9 @@ extern void __divqu (void);
 extern void __remqu (void);
 
 EXPORT_SYMBOL(alpha_mv);
-EXPORT_SYMBOL(screen_info);
-EXPORT_SYMBOL(perf_irq);
 EXPORT_SYMBOL(callback_getenv);
 EXPORT_SYMBOL(callback_setenv);
 EXPORT_SYMBOL(callback_save_env);
-#ifdef CONFIG_ALPHA_GENERIC
-EXPORT_SYMBOL(alpha_using_srm);
-#endif /* CONFIG_ALPHA_GENERIC */
 
 /* platform dependent support */
 EXPORT_SYMBOL(strcat);
@@ -77,47 +45,14 @@ EXPORT_SYMBOL(__constant_c_memset);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(clear_page);
 
-EXPORT_SYMBOL(__direct_map_base);
-EXPORT_SYMBOL(__direct_map_size);
-
-#ifdef CONFIG_PCI
-EXPORT_SYMBOL(pci_alloc_consistent);
-EXPORT_SYMBOL(pci_free_consistent);
-EXPORT_SYMBOL(pci_map_single);
-EXPORT_SYMBOL(pci_map_page);
-EXPORT_SYMBOL(pci_unmap_single);
-EXPORT_SYMBOL(pci_unmap_page);
-EXPORT_SYMBOL(pci_map_sg);
-EXPORT_SYMBOL(pci_unmap_sg);
-EXPORT_SYMBOL(pci_dma_supported);
-EXPORT_SYMBOL(pci_dac_dma_supported);
-EXPORT_SYMBOL(pci_dac_page_to_dma);
-EXPORT_SYMBOL(pci_dac_dma_to_page);
-EXPORT_SYMBOL(pci_dac_dma_to_offset);
-EXPORT_SYMBOL(alpha_gendev_to_pci);
-#endif
-EXPORT_SYMBOL(dma_set_mask);
-
-EXPORT_SYMBOL(dump_thread);
-EXPORT_SYMBOL(dump_elf_thread);
-EXPORT_SYMBOL(dump_elf_task);
-EXPORT_SYMBOL(dump_elf_task_fp);
-EXPORT_SYMBOL(hwrpb);
-EXPORT_SYMBOL(start_thread);
 EXPORT_SYMBOL(alpha_read_fp_reg);
 EXPORT_SYMBOL(alpha_read_fp_reg_s);
 EXPORT_SYMBOL(alpha_write_fp_reg);
 EXPORT_SYMBOL(alpha_write_fp_reg_s);
 
-/* In-kernel system calls.  */
+/* entry.S */
 EXPORT_SYMBOL(kernel_thread);
-EXPORT_SYMBOL(sys_dup);
-EXPORT_SYMBOL(sys_exit);
-EXPORT_SYMBOL(sys_write);
-EXPORT_SYMBOL(sys_lseek);
 EXPORT_SYMBOL(kernel_execve);
-EXPORT_SYMBOL(sys_setsid);
-EXPORT_SYMBOL(sys_wait4);
 
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_tcpudp_magic);
@@ -134,10 +69,6 @@ EXPORT_SYMBOL(alpha_fp_emul_imprecise);
 EXPORT_SYMBOL(alpha_fp_emul);
 #endif
 
-#ifdef CONFIG_ALPHA_BROKEN_IRQ_MASK
-EXPORT_SYMBOL(__min_ipl);
-#endif
-
 /*
  * The following are specially called from the uaccess assembly stubs.
  */
@@ -160,27 +91,10 @@ EXPORT_SYMBOL(up);
  */
 
 #ifdef CONFIG_SMP
-EXPORT_SYMBOL(flush_tlb_mm);
-EXPORT_SYMBOL(flush_tlb_range);
-EXPORT_SYMBOL(flush_tlb_page);
-EXPORT_SYMBOL(smp_imb);
-EXPORT_SYMBOL(cpu_data);
-EXPORT_SYMBOL(smp_num_cpus);
-EXPORT_SYMBOL(smp_call_function);
-EXPORT_SYMBOL(smp_call_function_on_cpu);
 EXPORT_SYMBOL(_atomic_dec_and_lock);
 #endif /* CONFIG_SMP */
 
 /*
- * NUMA specific symbols
- */
-#ifdef CONFIG_DISCONTIGMEM
-EXPORT_SYMBOL(node_data);
-#endif /* CONFIG_DISCONTIGMEM */
-
-EXPORT_SYMBOL(rtc_lock);
-
-/*
  * The following are special because they're not called
  * explicitly (the C compiler or assembler generates them in
  * response to division operations).  Fortunately, their
@@ -200,8 +114,3 @@ EXPORT_SYMBOL(__remqu);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memchr);
-
-#ifdef CONFIG_ALPHA_IRONGATE
-EXPORT_SYMBOL(irongate_ioremap);
-EXPORT_SYMBOL(irongate_iounmap);
-#endif
diff --git a/arch/alpha/kernel/core_irongate.c b/arch/alpha/kernel/core_irongate.c
index 138d497d1cca..e4a0bcf1d28b 100644
--- a/arch/alpha/kernel/core_irongate.c
+++ b/arch/alpha/kernel/core_irongate.c
@@ -404,6 +404,7 @@ irongate_ioremap(unsigned long addr, unsigned long size)
 #endif
         return (void __iomem *)vaddr;
 }
+EXPORT_SYMBOL(irongate_ioremap);
 
 void
 irongate_iounmap(volatile void __iomem *xaddr)
@@ -414,3 +415,4 @@ irongate_iounmap(volatile void __iomem *xaddr)
         if (addr)
                 return vfree((void *)(PAGE_MASK & addr)); 
 }
+EXPORT_SYMBOL(irongate_iounmap);
diff --git a/arch/alpha/kernel/irq_alpha.c b/arch/alpha/kernel/irq_alpha.c
index 6dd126b8be85..e16aeb6e79ef 100644
--- a/arch/alpha/kernel/irq_alpha.c
+++ b/arch/alpha/kernel/irq_alpha.c
@@ -6,6 +6,7 @@
 #include <linux/sched.h>
 #include <linux/irq.h>
 #include <linux/kernel_stat.h>
+#include <linux/module.h>
 
 #include <asm/machvec.h>
 #include <asm/dma.h>
@@ -16,6 +17,7 @@
 /* Hack minimum IPL during interrupt processing for broken hardware.  */
 #ifdef CONFIG_ALPHA_BROKEN_IRQ_MASK
 int __min_ipl;
+EXPORT_SYMBOL(__min_ipl);
 #endif
 
 /*
@@ -30,6 +32,7 @@ dummy_perf(unsigned long vector, struct pt_regs *regs)
 }
 
 void (*perf_irq)(unsigned long, struct pt_regs *) = dummy_perf;
+EXPORT_SYMBOL(perf_irq);
 
 /*
  * The main interrupt entry point.
diff --git a/arch/alpha/kernel/pci-noop.c b/arch/alpha/kernel/pci-noop.c
index fff5cf93e816..174b729c504b 100644
--- a/arch/alpha/kernel/pci-noop.c
+++ b/arch/alpha/kernel/pci-noop.c
@@ -201,6 +201,7 @@ dma_set_mask(struct device *dev, u64 mask)
 
         return 0;
 }
+EXPORT_SYMBOL(dma_set_mask);
 
 void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
 {
diff --git a/arch/alpha/kernel/pci_iommu.c b/arch/alpha/kernel/pci_iommu.c
index c468e312e5f8..6e7d1fe6e935 100644
--- a/arch/alpha/kernel/pci_iommu.c
+++ b/arch/alpha/kernel/pci_iommu.c
@@ -300,6 +300,7 @@ pci_map_single(struct pci_dev *pdev, void *cpu_addr, size_t size, int dir)
         dac_allowed = pdev ? pci_dac_dma_supported(pdev, pdev->dma_mask) : 0; 
         return pci_map_single_1(pdev, cpu_addr, size, dac_allowed);
 }
+EXPORT_SYMBOL(pci_map_single);
 
 dma_addr_t
 pci_map_page(struct pci_dev *pdev, struct page *page, unsigned long offset,
@@ -314,6 +315,7 @@ pci_map_page(struct pci_dev *pdev, struct page *page, unsigned long offset,
         return pci_map_single_1(pdev, (char *)page_address(page) + offset, 
                                 size, dac_allowed);
 }
+EXPORT_SYMBOL(pci_map_page);
 
 /* Unmap a single streaming mode DMA translation.  The DMA_ADDR and
    SIZE must match what was provided for in a previous pci_map_single
@@ -379,6 +381,7 @@ pci_unmap_single(struct pci_dev *pdev, dma_addr_t dma_addr, size_t size,
         DBGA2("pci_unmap_single: sg [%lx,%lx] np %ld from %p\n",
               dma_addr, size, npages, __builtin_return_address(0));
 }
+EXPORT_SYMBOL(pci_unmap_single);
 
 void
 pci_unmap_page(struct pci_dev *pdev, dma_addr_t dma_addr,
@@ -386,6 +389,7 @@ pci_unmap_page(struct pci_dev *pdev, dma_addr_t dma_addr,
 {
         pci_unmap_single(pdev, dma_addr, size, direction);
 }
+EXPORT_SYMBOL(pci_unmap_page);
 
 /* Allocate and map kernel buffer using consistent mode DMA for PCI
    device.  Returns non-NULL cpu-view pointer to the buffer if
@@ -427,6 +431,7 @@ try_again:
 
         return cpu_addr;
 }
+EXPORT_SYMBOL(pci_alloc_consistent);
 
 /* Free and unmap a consistent DMA buffer.  CPU_ADDR and DMA_ADDR must
    be values that were returned from pci_alloc_consistent.  SIZE must
@@ -444,7 +449,7 @@ pci_free_consistent(struct pci_dev *pdev, size_t size, void *cpu_addr,
         DBGA2("pci_free_consistent: [%x,%lx] from %p\n",
               dma_addr, size, __builtin_return_address(0));
 }
-
+EXPORT_SYMBOL(pci_free_consistent);
 
 /* Classify the elements of the scatterlist.  Write dma_address
    of each element with:
@@ -672,6 +677,7 @@ pci_map_sg(struct pci_dev *pdev, struct scatterlist *sg, int nents,
                 pci_unmap_sg(pdev, start, out - start, direction);
         return 0;
 }
+EXPORT_SYMBOL(pci_map_sg);
 
 /* Unmap a set of streaming mode DMA translations.  Again, cpu read
    rules concerning calls here are the same as for pci_unmap_single()
@@ -752,6 +758,7 @@ pci_unmap_sg(struct pci_dev *pdev, struct scatterlist *sg, int nents,
 
         DBGA("pci_unmap_sg: %ld entries\n", nents - (end - sg));
 }
+EXPORT_SYMBOL(pci_unmap_sg);
 
 
 /* Return whether the given PCI device DMA address mask can be
@@ -786,6 +793,7 @@ pci_dma_supported(struct pci_dev *pdev, u64 mask)
 
         return 0;
 }
+EXPORT_SYMBOL(pci_dma_supported);
 
 
 /*
@@ -908,6 +916,7 @@ pci_dac_dma_supported(struct pci_dev *dev, u64 mask)
 
         return ok;
 }
+EXPORT_SYMBOL(pci_dac_dma_supported);
 
 dma64_addr_t
 pci_dac_page_to_dma(struct pci_dev *pdev, struct page *page,
@@ -917,6 +926,7 @@ pci_dac_page_to_dma(struct pci_dev *pdev, struct page *page,
                 + __pa(page_address(page)) 
                 + (dma64_addr_t) offset);
 }
+EXPORT_SYMBOL(pci_dac_page_to_dma);
 
 struct page *
 pci_dac_dma_to_page(struct pci_dev *pdev, dma64_addr_t dma_addr)
@@ -924,13 +934,14 @@ pci_dac_dma_to_page(struct pci_dev *pdev, dma64_addr_t dma_addr)
         unsigned long paddr = (dma_addr & PAGE_MASK) - alpha_mv.pci_dac_offset;
         return virt_to_page(__va(paddr));
 }
+EXPORT_SYMBOL(pci_dac_dma_to_page);
 
 unsigned long
 pci_dac_dma_to_offset(struct pci_dev *pdev, dma64_addr_t dma_addr)
 {
         return (dma_addr & ~PAGE_MASK);
 }
-
+EXPORT_SYMBOL(pci_dac_dma_to_offset);
 
 /* Helper for generic DMA-mapping functions. */
 
@@ -957,6 +968,7 @@ alpha_gendev_to_pci(struct device *dev)
         /* This assumes ISA bus master with dma_mask 0xffffff. */
         return NULL;
 }
+EXPORT_SYMBOL(alpha_gendev_to_pci);
 
 int
 dma_set_mask(struct device *dev, u64 mask)
@@ -969,3 +981,4 @@ dma_set_mask(struct device *dev, u64 mask)
 
         return 0;
 }
+EXPORT_SYMBOL(dma_set_mask);
diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c
index b3a8a2980365..3370e6faeae0 100644
--- a/arch/alpha/kernel/process.c
+++ b/arch/alpha/kernel/process.c
@@ -205,6 +205,7 @@ start_thread(struct pt_regs * regs, unsigned long pc, unsigned long sp)
         regs->ps = 8;
         wrusp(sp);
 }
+EXPORT_SYMBOL(start_thread);
 
 /*
  * Free current thread data structures etc..
@@ -376,6 +377,7 @@ dump_thread(struct pt_regs * pt, struct user * dump)
         dump->regs[EF_A2]  = pt->r18;
         memcpy((char *)dump->regs + EF_SIZE, sw->fp, 32 * 8);
 }
+EXPORT_SYMBOL(dump_thread);
 
 /*
  * Fill in the user structure for a ELF core dump.
@@ -424,6 +426,7 @@ dump_elf_thread(elf_greg_t *dest, struct pt_regs *pt, struct thread_info *ti)
            useful value of the thread's UNIQUE field.  */
         dest[32] = ti->pcb.unique;
 }
+EXPORT_SYMBOL(dump_elf_thread);
 
 int
 dump_elf_task(elf_greg_t *dest, struct task_struct *task)
@@ -431,6 +434,7 @@ dump_elf_task(elf_greg_t *dest, struct task_struct *task)
         dump_elf_thread(dest, task_pt_regs(task), task_thread_info(task));
         return 1;
 }
+EXPORT_SYMBOL(dump_elf_task);
 
 int
 dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task)
@@ -439,6 +443,7 @@ dump_elf_task_fp(elf_fpreg_t *dest, struct task_struct *task)
         memcpy(dest, sw->fp, 32 * 8);
         return 1;
 }
+EXPORT_SYMBOL(dump_elf_task_fp);
 
 /*
  * sys_execve() executes a new program.
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index a94e6d93e2ee..1aea7c7c683c 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -66,6 +66,7 @@ static struct notifier_block alpha_panic_block = {
 
 
 struct hwrpb_struct *hwrpb;
+EXPORT_SYMBOL(hwrpb);
 unsigned long srm_hae;
 
 int alpha_l1i_cacheshape;
@@ -111,6 +112,7 @@ unsigned long alpha_agpgart_size = DEFAULT_AGP_APER_SIZE;
 #ifdef CONFIG_ALPHA_GENERIC
 struct alpha_machine_vector alpha_mv;
 int alpha_using_srm;
+EXPORT_SYMBOL(alpha_using_srm);
 #endif
 
 static struct alpha_machine_vector *get_sysvec(unsigned long, unsigned long,
@@ -137,6 +139,8 @@ struct screen_info screen_info = {
         .orig_video_points = 16
 };
 
+EXPORT_SYMBOL(screen_info);
+
 /*
  * The direct map I/O window, if any.  This should be the same
  * for all busses, since it's used by virt_to_bus.
@@ -144,6 +148,8 @@ struct screen_info screen_info = {
 
 unsigned long __direct_map_base;
 unsigned long __direct_map_size;
+EXPORT_SYMBOL(__direct_map_base);
+EXPORT_SYMBOL(__direct_map_size);
 
 /*
  * Declare all of the machine vectors.
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 596780e2c7da..d1ec4f51df1a 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -52,6 +52,7 @@
 
 /* A collection of per-processor data.  */
 struct cpuinfo_alpha cpu_data[NR_CPUS];
+EXPORT_SYMBOL(cpu_data);
 
 /* A collection of single bit ipi messages.  */
 static struct {
@@ -74,6 +75,7 @@ EXPORT_SYMBOL(cpu_online_map);
 
 int smp_num_probed;             /* Internal processor count */
 int smp_num_cpus = 1;           /* Number that came online.  */
+EXPORT_SYMBOL(smp_num_cpus);
 
 extern void calibrate_delay(void);
 
@@ -790,6 +792,7 @@ smp_call_function_on_cpu (void (*func) (void *info), void *info, int retry,
 
         return 0;
 }
+EXPORT_SYMBOL(smp_call_function_on_cpu);
 
 int
 smp_call_function (void (*func) (void *info), void *info, int retry, int wait)
@@ -797,6 +800,7 @@ smp_call_function (void (*func) (void *info), void *info, int retry, int wait)
         return smp_call_function_on_cpu (func, info, retry, wait,
                                          cpu_online_map);
 }
+EXPORT_SYMBOL(smp_call_function);
 
 static void
 ipi_imb(void *ignored)
@@ -811,6 +815,7 @@ smp_imb(void)
         if (on_each_cpu(ipi_imb, NULL, 1, 1))
                 printk(KERN_CRIT "smp_imb: timed out\n");
 }
+EXPORT_SYMBOL(smp_imb);
 
 static void
 ipi_flush_tlb_all(void *ignored)
@@ -866,6 +871,7 @@ flush_tlb_mm(struct mm_struct *mm)
 
         preempt_enable();
 }
+EXPORT_SYMBOL(flush_tlb_mm);
 
 struct flush_tlb_page_struct {
         struct vm_area_struct *vma;
@@ -918,6 +924,7 @@ flush_tlb_page(struct vm_area_struct *vma, unsigned long addr)
 
         preempt_enable();
 }
+EXPORT_SYMBOL(flush_tlb_page);
 
 void
 flush_tlb_range(struct vm_area_struct *vma, unsigned long start, unsigned long end)
@@ -925,6 +932,7 @@ flush_tlb_range(struct vm_area_struct *vma, unsigned long start, unsigned long e
         /* On the Alpha we always flush the whole user tlb.  */
         flush_tlb_mm(vma->vm_mm);
 }
+EXPORT_SYMBOL(flush_tlb_range);
 
 static void
 ipi_flush_icache_page(void *x)
diff --git a/arch/alpha/kernel/srm_env.c b/arch/alpha/kernel/srm_env.c
index 990ac61028f8..f7dd081d57ff 100644
--- a/arch/alpha/kernel/srm_env.c
+++ b/arch/alpha/kernel/srm_env.c
@@ -2,7 +2,7 @@
  * srm_env.c - Access to SRM environment
  *             variables through linux' procfs
  *
- * Copyright (C) 2001-2002 Jan-Benedict Glaw <jbglaw@lug-owl.de>
+ * (C) 2001,2002,2006 by Jan-Benedict Glaw <jbglaw@lug-owl.de>
  *
  * This driver is at all a modified version of Erik Mouw's
  * Documentation/DocBook/procfs_example.c, so: thank
@@ -21,7 +21,7 @@
  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
  * PURPOSE.  See the GNU General Public License for more
  * details.
- * 
+ *
  * You should have received a copy of the GNU General Public
  * License along with this program; if not, write to the
  * Free Software Foundation, Inc., 59 Temple Place,
@@ -29,33 +29,6 @@
  *
  */
 
-/*
- * Changelog
- * ~~~~~~~~~
- *
- * Thu, 22 Aug 2002 15:10:43 +0200
- *      - Update Config.help entry. I got a number of emails asking
- *        me to tell their senders if they could make use of this
- *        piece of code... So: "SRM is something like BIOS for your
- *        Alpha"
- *      - Update code formatting a bit to better conform CodingStyle
- *        rules.
- *      - So this is v0.0.5, with no changes (except formatting)
- *      
- * Wed, 22 May 2002 00:11:21 +0200
- *      - Fix typo on comment (SRC -> SRM)
- *      - Call this "Version 0.0.4"
- *
- * Tue,  9 Apr 2002 18:44:40 +0200
- *      - Implement access by variable name and additionally
- *        by number. This is done by creating two subdirectories
- *        where one holds all names (like the old directory
- *        did) and the other holding 256 files named like "0",
- *        "1" and so on.
- *      - Call this "Version 0.0.3"
- *
- */
-
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -67,7 +40,7 @@
 #define BASE_DIR        "srm_environment"       /* Subdir in /proc/             */
 #define NAMED_DIR       "named_variables"       /* Subdir for known variables   */
 #define NUMBERED_DIR    "numbered_variables"    /* Subdir for all variables     */
-#define VERSION         "0.0.5"                 /* Module version               */
+#define VERSION         "0.0.6"                 /* Module version               */
 #define NAME            "srm_env"               /* Module name                  */
 
 MODULE_AUTHOR("Jan-Benedict Glaw <jbglaw@lug-owl.de>");
@@ -106,7 +79,6 @@ static srm_env_t	srm_named_entries[] = {
 static srm_env_t        srm_numbered_entries[256];
 
 
-
 static int
 srm_env_read(char *page, char **start, off_t off, int count, int *eof,
                 void *data)
@@ -115,21 +87,23 @@ srm_env_read(char *page, char **start, off_t off, int count, int *eof,
         unsigned long   ret;
         srm_env_t       *entry;
 
-        if(off != 0)
-                return -EFAULT;
+        if (off != 0) {
+                *eof = 1;
+                return 0;
+        }
 
         entry   = (srm_env_t *) data;
         ret     = callback_getenv(entry->id, page, count);
 
-        if((ret >> 61) == 0)
+        if ((ret >> 61) == 0) {
                 nbytes = (int) ret;
-        else
+                *eof = 1;
+        } else
                 nbytes = -EFAULT;
 
         return nbytes;
 }
 
-
 static int
 srm_env_write(struct file *file, const char __user *buffer, unsigned long count,
                 void *data)
@@ -155,7 +129,7 @@ srm_env_write(struct file *file, const char __user *buffer, unsigned long count,
 
         ret1 = callback_setenv(entry->id, buf, count);
         if ((ret1 >> 61) == 0) {
-                do 
+                do
                         ret2 = callback_save_env();
                 while((ret2 >> 61) == 1);
                 res = (int) ret1;
@@ -172,14 +146,14 @@ srm_env_cleanup(void)
         srm_env_t       *entry;
         unsigned long   var_num;
 
-        if(base_dir) {
+        if (base_dir) {
                 /*
                  * Remove named entries
                  */
-                if(named_dir) {
+                if (named_dir) {
                         entry = srm_named_entries;
-                        while(entry->name != NULL && entry->id != 0) {
-                                if(entry->proc_entry) {
+                        while (entry->name != NULL && entry->id != 0) {
+                                if (entry->proc_entry) {
                                         remove_proc_entry(entry->name,
                                                         named_dir);
                                         entry->proc_entry = NULL;
@@ -192,11 +166,11 @@ srm_env_cleanup(void)
                 /*
                  * Remove numbered entries
                  */
-                if(numbered_dir) {
-                        for(var_num = 0; var_num <= 255; var_num++) {
+                if (numbered_dir) {
+                        for (var_num = 0; var_num <= 255; var_num++) {
                                 entry = &srm_numbered_entries[var_num];
 
-                                if(entry->proc_entry) {
+                                if (entry->proc_entry) {
                                         remove_proc_entry(entry->name,
                                                         numbered_dir);
                                         entry->proc_entry       = NULL;
@@ -212,7 +186,6 @@ srm_env_cleanup(void)
         return;
 }
 
-
 static int __init
 srm_env_init(void)
 {
@@ -222,7 +195,7 @@ srm_env_init(void)
         /*
          * Check system
          */
-        if(!alpha_using_srm) {
+        if (!alpha_using_srm) {
                 printk(KERN_INFO "%s: This Alpha system doesn't "
                                 "know about SRM (or you've booted "
                                 "SRM->MILO->Linux, which gets "
@@ -233,14 +206,14 @@ srm_env_init(void)
         /*
          * Init numbers
          */
-        for(var_num = 0; var_num <= 255; var_num++)
+        for (var_num = 0; var_num <= 255; var_num++)
                 sprintf(number[var_num], "%ld", var_num);
 
         /*
          * Create base directory
          */
         base_dir = proc_mkdir(BASE_DIR, NULL);
-        if(base_dir == NULL) {
+        if (!base_dir) {
                 printk(KERN_ERR "Couldn't create base dir /proc/%s\n",
                                 BASE_DIR);
                 goto cleanup;
@@ -251,7 +224,7 @@ srm_env_init(void)
          * Create per-name subdirectory
          */
         named_dir = proc_mkdir(NAMED_DIR, base_dir);
-        if(named_dir == NULL) {
+        if (!named_dir) {
                 printk(KERN_ERR "Couldn't create dir /proc/%s/%s\n",
                                 BASE_DIR, NAMED_DIR);
                 goto cleanup;
@@ -262,7 +235,7 @@ srm_env_init(void)
          * Create per-number subdirectory
          */
         numbered_dir = proc_mkdir(NUMBERED_DIR, base_dir);
-        if(numbered_dir == NULL) {
+        if (!numbered_dir) {
                 printk(KERN_ERR "Couldn't create dir /proc/%s/%s\n",
                                 BASE_DIR, NUMBERED_DIR);
                 goto cleanup;
@@ -274,10 +247,10 @@ srm_env_init(void)
          * Create all named nodes
          */
         entry = srm_named_entries;
-        while(entry->name != NULL && entry->id != 0) {
+        while (entry->name && entry->id) {
                 entry->proc_entry = create_proc_entry(entry->name,
                                 0644, named_dir);
-                if(entry->proc_entry == NULL)
+                if (!entry->proc_entry)
                         goto cleanup;
 
                 entry->proc_entry->data         = (void *) entry;
@@ -291,13 +264,13 @@ srm_env_init(void)
         /*
          * Create all numbered nodes
          */
-        for(var_num = 0; var_num <= 255; var_num++) {
+        for (var_num = 0; var_num <= 255; var_num++) {
                 entry = &srm_numbered_entries[var_num];
                 entry->name = number[var_num];
 
                 entry->proc_entry = create_proc_entry(entry->name,
                                 0644, numbered_dir);
-                if(entry->proc_entry == NULL)
+                if (!entry->proc_entry)
                         goto cleanup;
 
                 entry->id                       = var_num;
@@ -318,7 +291,6 @@ cleanup:
         return -ENOMEM;
 }
 
-
 static void __exit
 srm_env_exit(void)
 {
@@ -328,7 +300,5 @@ srm_env_exit(void)
         return;
 }
 
-
 module_init(srm_env_init);
 module_exit(srm_env_exit);
-
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index cf0666523989..d7053eb4ffcf 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -57,6 +57,7 @@
 static int set_rtc_mmss(unsigned long);
 
 DEFINE_SPINLOCK(rtc_lock);
+EXPORT_SYMBOL(rtc_lock);
 
 #define TICK_SIZE (tick_nsec / 1000)
 
diff --git a/arch/alpha/kernel/vmlinux.lds.S b/arch/alpha/kernel/vmlinux.lds.S
index 71470e9d93ba..76bf071e376c 100644
--- a/arch/alpha/kernel/vmlinux.lds.S
+++ b/arch/alpha/kernel/vmlinux.lds.S
@@ -48,13 +48,7 @@ SECTIONS
   . = ALIGN(8);
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
 
diff --git a/arch/alpha/mm/numa.c b/arch/alpha/mm/numa.c
index b826f58c6e72..e3e3806a6f25 100644
--- a/arch/alpha/mm/numa.c
+++ b/arch/alpha/mm/numa.c
@@ -13,12 +13,14 @@
 #include <linux/swap.h>
 #include <linux/initrd.h>
 #include <linux/pfn.h>
+#include <linux/module.h>
 
 #include <asm/hwrpb.h>
 #include <asm/pgalloc.h>
 
 pg_data_t node_data[MAX_NUMNODES];
 bootmem_data_t node_bdata[MAX_NUMNODES];
+EXPORT_SYMBOL(node_data);
 
 #undef DEBUG_DISCONTIG
 #ifdef DEBUG_DISCONTIG
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 2a0b2c8a1fe0..6f4f8bf36071 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -174,11 +174,13 @@ libs-y				:= arch/arm/lib/ $(libs-y)
 
 # Default target when executing plain make
 ifeq ($(CONFIG_XIP_KERNEL),y)
-all: xipImage
+KBUILD_IMAGE := xipImage
 else
-all: zImage
+KBUILD_IMAGE := zImage
 endif
 
+all:    $(KBUILD_IMAGE)
+
 boot := arch/arm/boot
 
 #       Update machine arch and proc symlinks if something which affects
diff --git a/arch/arm/common/dmabounce.c b/arch/arm/common/dmabounce.c
index 028bdc9228fb..2e635b814c14 100644
--- a/arch/arm/common/dmabounce.c
+++ b/arch/arm/common/dmabounce.c
@@ -662,7 +662,8 @@ EXPORT_SYMBOL(dma_map_single);
 EXPORT_SYMBOL(dma_unmap_single);
 EXPORT_SYMBOL(dma_map_sg);
 EXPORT_SYMBOL(dma_unmap_sg);
-EXPORT_SYMBOL(dma_sync_single);
+EXPORT_SYMBOL(dma_sync_single_for_cpu);
+EXPORT_SYMBOL(dma_sync_single_for_device);
 EXPORT_SYMBOL(dma_sync_sg);
 EXPORT_SYMBOL(dmabounce_register_dev);
 EXPORT_SYMBOL(dmabounce_unregister_dev);
diff --git a/arch/arm/configs/at91rm9200dk_defconfig b/arch/arm/configs/at91rm9200dk_defconfig
index c82e4667f45e..b43041476e02 100644
--- a/arch/arm/configs/at91rm9200dk_defconfig
+++ b/arch/arm/configs/at91rm9200dk_defconfig
@@ -577,7 +577,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/at91rm9200ek_defconfig b/arch/arm/configs/at91rm9200ek_defconfig
index b983fc59aa42..d96fc8386e2f 100644
--- a/arch/arm/configs/at91rm9200ek_defconfig
+++ b/arch/arm/configs/at91rm9200ek_defconfig
@@ -558,7 +558,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/ateb9200_defconfig b/arch/arm/configs/ateb9200_defconfig
index 15e6b0bbbde8..3de5c643848c 100644
--- a/arch/arm/configs/ateb9200_defconfig
+++ b/arch/arm/configs/ateb9200_defconfig
@@ -217,7 +217,7 @@ CONFIG_BINFMT_ELF=y
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff --git a/arch/arm/configs/collie_defconfig b/arch/arm/configs/collie_defconfig
index 074c47a4fb2e..a3758913c0bb 100644
--- a/arch/arm/configs/collie_defconfig
+++ b/arch/arm/configs/collie_defconfig
@@ -219,7 +219,7 @@ CONFIG_BINFMT_ELF=y
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 CONFIG_APM=y
 
diff --git a/arch/arm/configs/csb337_defconfig b/arch/arm/configs/csb337_defconfig
index a2d6fd398f16..20e68250d835 100644
--- a/arch/arm/configs/csb337_defconfig
+++ b/arch/arm/configs/csb337_defconfig
@@ -615,7 +615,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/csb637_defconfig b/arch/arm/configs/csb637_defconfig
index 2a1ac6c60abc..df8595ac031f 100644
--- a/arch/arm/configs/csb637_defconfig
+++ b/arch/arm/configs/csb637_defconfig
@@ -615,7 +615,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/ixp4xx_defconfig b/arch/arm/configs/ixp4xx_defconfig
index 4975b914f923..fac7c3b240c0 100644
--- a/arch/arm/configs/ixp4xx_defconfig
+++ b/arch/arm/configs/ixp4xx_defconfig
@@ -206,10 +206,8 @@ CONFIG_BINFMT_ELF=y
 #
 # Power management options
 #
-CONFIG_PM=y
-CONFIG_PM_LEGACY=y
-# CONFIG_PM_DEBUG is not set
-CONFIG_APM=y
+# CONFIG_PM is not set
+# CONFIG_APM is not set
 
 #
 # Networking
diff --git a/arch/arm/configs/kafa_defconfig b/arch/arm/configs/kafa_defconfig
index 54fcd75779da..a4cdafc1548a 100644
--- a/arch/arm/configs/kafa_defconfig
+++ b/arch/arm/configs/kafa_defconfig
@@ -560,7 +560,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 # CONFIG_NVRAM is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
diff --git a/arch/arm/configs/omap_h2_1610_defconfig b/arch/arm/configs/omap_h2_1610_defconfig
index 05adb0b34e72..b0efd4ca9935 100644
--- a/arch/arm/configs/omap_h2_1610_defconfig
+++ b/arch/arm/configs/omap_h2_1610_defconfig
@@ -257,7 +257,7 @@ CONFIG_BINFMT_AOUT=y
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff --git a/arch/arm/configs/onearm_defconfig b/arch/arm/configs/onearm_defconfig
index cb1d94f9049e..9b9f2155af35 100644
--- a/arch/arm/configs/onearm_defconfig
+++ b/arch/arm/configs/onearm_defconfig
@@ -607,7 +607,7 @@ CONFIG_WATCHDOG_NOWAYOUT=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
-CONFIG_AT91_WATCHDOG=y
+CONFIG_AT91RM9200_WATCHDOG=y
 
 #
 # USB-based Watchdog Cards
diff --git a/arch/arm/configs/bast_defconfig b/arch/arm/configs/realview-smp_defconfig
index 4a8564f386af..ffd905ff19f1 100644
--- a/arch/arm/configs/bast_defconfig
+++ b/arch/arm/configs/realview-smp_defconfig
@@ -1,136 +1,168 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.12-rc1-bk2
-# Sun Mar 27 02:24:16 2005
+# Linux kernel version: 2.6.19-rc3
+# Wed Oct 25 14:12:00 2006
 #
 CONFIG_ARM=y
+# CONFIG_GENERIC_TIME is not set
 CONFIG_MMU=y
-CONFIG_UID16=y
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
-CONFIG_GENERIC_IOMAP=y
+CONFIG_VECTORS_BASE=0xffff0000
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
 # Code maturity level options
 #
 CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
-CONFIG_BROKEN_ON_SMP=y
+CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
 
 #
 # General setup
 #
 CONFIG_LOCALVERSION=""
-CONFIG_SWAP=y
+CONFIG_LOCALVERSION_AUTO=y
+# CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
 # CONFIG_IKCONFIG is not set
+# CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
+CONFIG_UID16=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
-# CONFIG_KALLSYMS_ALL is not set
+CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_HOTPLUG=y
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
-CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
+CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
 #
 CONFIG_MODULES=y
-# CONFIG_MODULE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
+# CONFIG_KMOD is not set
+CONFIG_STOP_MACHINE=y
+
+#
+# Block layer
+#
+CONFIG_BLOCK=y
+# CONFIG_BLK_DEV_IO_TRACE is not set
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+# CONFIG_IOSCHED_AS is not set
+CONFIG_IOSCHED_DEADLINE=y
+# CONFIG_IOSCHED_CFQ is not set
+# CONFIG_DEFAULT_AS is not set
+CONFIG_DEFAULT_DEADLINE=y
+# CONFIG_DEFAULT_CFQ is not set
+# CONFIG_DEFAULT_NOOP is not set
+CONFIG_DEFAULT_IOSCHED="deadline"
 
 #
 # System Type
 #
+# CONFIG_ARCH_AAEC2000 is not set
+# CONFIG_ARCH_INTEGRATOR is not set
+CONFIG_ARCH_REALVIEW=y
+# CONFIG_ARCH_VERSATILE is not set
+# CONFIG_ARCH_AT91 is not set
 # CONFIG_ARCH_CLPS7500 is not set
 # CONFIG_ARCH_CLPS711X is not set
 # CONFIG_ARCH_CO285 is not set
 # CONFIG_ARCH_EBSA110 is not set
+# CONFIG_ARCH_EP93XX is not set
 # CONFIG_ARCH_FOOTBRIDGE is not set
-# CONFIG_ARCH_INTEGRATOR is not set
-# CONFIG_ARCH_IOP3XX is not set
+# CONFIG_ARCH_NETX is not set
+# CONFIG_ARCH_H720X is not set
+# CONFIG_ARCH_IMX is not set
+# CONFIG_ARCH_IOP32X is not set
+# CONFIG_ARCH_IOP33X is not set
 # CONFIG_ARCH_IXP4XX is not set
 # CONFIG_ARCH_IXP2000 is not set
+# CONFIG_ARCH_IXP23XX is not set
 # CONFIG_ARCH_L7200 is not set
+# CONFIG_ARCH_PNX4008 is not set
 # CONFIG_ARCH_PXA is not set
 # CONFIG_ARCH_RPC is not set
 # CONFIG_ARCH_SA1100 is not set
-CONFIG_ARCH_S3C2410=y
+# CONFIG_ARCH_S3C2410 is not set
 # CONFIG_ARCH_SHARK is not set
 # CONFIG_ARCH_LH7A40X is not set
 # CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_VERSATILE is not set
-# CONFIG_ARCH_IMX is not set
-# CONFIG_ARCH_H720X is not set
-
-#
-# S3C24XX Implementations
-#
-CONFIG_ARCH_BAST=y
-# CONFIG_ARCH_H1940 is not set
-# CONFIG_MACH_N30 is not set
-# CONFIG_ARCH_SMDK2410 is not set
-# CONFIG_ARCH_S3C2440 is not set
-CONFIG_MACH_VR1000=y
-# CONFIG_MACH_RX3715 is not set
-# CONFIG_MACH_OTOM is not set
-# CONFIG_MACH_NEXCODER_2440 is not set
-CONFIG_CPU_S3C2410=y
-
-#
-# S3C2410 Boot
-#
-# CONFIG_S3C2410_BOOT_WATCHDOG is not set
 
 #
-# S3C2410 Setup
+# RealView platform type
 #
-CONFIG_S3C2410_DMA=y
-# CONFIG_S3C2410_DMA_DEBUG is not set
-# CONFIG_S3C2410_PM_DEBUG is not set
-# CONFIG_S3C2410_PM_CHECK is not set
-CONFIG_S3C2410_LOWLEVEL_UART_PORT=0
+CONFIG_MACH_REALVIEW_EB=y
+CONFIG_REALVIEW_MPCORE=y
 
 #
 # Processor Type
 #
 CONFIG_CPU_32=y
-CONFIG_CPU_ARM920T=y
-CONFIG_CPU_32v4=y
-CONFIG_CPU_ABRT_EV4T=y
-CONFIG_CPU_CACHE_V4WT=y
-CONFIG_CPU_CACHE_VIVT=y
-CONFIG_CPU_COPY_V4WB=y
-CONFIG_CPU_TLB_V4WBI=y
+# CONFIG_CPU_ARM926T is not set
+CONFIG_CPU_V6=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v6=y
+CONFIG_CPU_ABRT_EV6=y
+CONFIG_CPU_CACHE_V6=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_TLB_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
 
 #
 # Processor Features
 #
-# CONFIG_ARM_THUMB is not set
+CONFIG_ARM_THUMB=y
 # CONFIG_CPU_ICACHE_DISABLE is not set
 # CONFIG_CPU_DCACHE_DISABLE is not set
 # CONFIG_CPU_DCACHE_WRITETHROUGH is not set
+# CONFIG_CPU_BPREDICT_DISABLE is not set
+CONFIG_HAS_TLS_REG=y
+CONFIG_ARM_GIC=y
+CONFIG_ICST307=y
 
 #
 # Bus support
 #
+CONFIG_ARM_AMBA=y
 
 #
 # PCCARD (PCMCIA/CardBus) support
@@ -140,7 +172,24 @@ CONFIG_CPU_TLB_V4WBI=y
 #
 # Kernel Features
 #
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
+CONFIG_HOTPLUG_CPU=y
+CONFIG_LOCAL_TIMERS=y
 # CONFIG_PREEMPT is not set
+# CONFIG_NO_IDLE_HZ is not set
+CONFIG_HZ=100
+# CONFIG_AEABI is not set
+# CONFIG_ARCH_DISCONTIGMEM_ENABLE is not set
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_SPARSEMEM_STATIC is not set
+CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_RESOURCES_64BIT is not set
 CONFIG_ALIGNMENT_TRAP=y
 
 #
@@ -148,7 +197,7 @@ CONFIG_ALIGNMENT_TRAP=y
 #
 CONFIG_ZBOOT_ROM_TEXT=0x0
 CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="root=/dev/hda1 ro init=/bin/bash console=ttySAC0"
+CONFIG_CMDLINE="root=/dev/nfs nfsroot=10.1.69.3:/work/nfsroot ip=dhcp console=ttyAMA0 mem=128M"
 # CONFIG_XIP_KERNEL is not set
 
 #
@@ -161,20 +210,105 @@ CONFIG_CMDLINE="root=/dev/hda1 ro init=/bin/bash console=ttySAC0"
 CONFIG_FPE_NWFPE=y
 # CONFIG_FPE_NWFPE_XP is not set
 # CONFIG_FPE_FASTFPE is not set
+CONFIG_VFP=y
 
 #
 # Userspace binary formats
 #
 CONFIG_BINFMT_ELF=y
-CONFIG_BINFMT_AOUT=y
+# CONFIG_BINFMT_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
 # CONFIG_ARTHUR is not set
 
 #
 # Power management options
 #
-CONFIG_PM=y
-CONFIG_APM=y
+# CONFIG_PM is not set
+# CONFIG_APM is not set
+
+#
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+# CONFIG_NETDEBUG is not set
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+CONFIG_UNIX=y
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+# CONFIG_IP_MULTICAST is not set
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+# CONFIG_IP_PNP_RARP is not set
+# CONFIG_NET_IPIP is not set
+# CONFIG_NET_IPGRE is not set
+# CONFIG_ARPD is not set
+# CONFIG_SYN_COOKIES is not set
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
+# CONFIG_INET_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
+# CONFIG_INET_XFRM_MODE_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_BEET is not set
+CONFIG_INET_DIAG=y
+CONFIG_INET_TCP_DIAG=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
+# CONFIG_IPV6 is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
+# CONFIG_INET6_TUNNEL is not set
+# CONFIG_NETWORK_SECMARK is not set
+# CONFIG_NETFILTER is not set
+
+#
+# DCCP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+
+#
+# TIPC Configuration (EXPERIMENTAL)
+#
+# CONFIG_TIPC is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+
+#
+# QoS and/or fair queueing
+#
+# CONFIG_NET_SCHED is not set
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+# CONFIG_IEEE80211 is not set
 
 #
 # Device Drivers
@@ -187,6 +321,12 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
+
+#
+# Connector - unified userspace <-> kernelspace linker
+#
+# CONFIG_CONNECTOR is not set
 
 #
 # Memory Technology Devices (MTD)
@@ -195,10 +335,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 # CONFIG_MTD_CONCAT is not set
 CONFIG_MTD_PARTITIONS=y
-CONFIG_MTD_REDBOOT_PARTS=y
-CONFIG_MTD_REDBOOT_DIRECTORY_BLOCK=-1
-CONFIG_MTD_REDBOOT_PARTS_UNALLOCATED=y
-# CONFIG_MTD_REDBOOT_PARTS_READONLY is not set
+# CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_AFS_PARTS is not set
 
@@ -210,44 +347,42 @@ CONFIG_MTD_BLOCK=y
 # CONFIG_FTL is not set
 # CONFIG_NFTL is not set
 # CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
 
 #
 # RAM/ROM/Flash chip drivers
 #
 CONFIG_MTD_CFI=y
-CONFIG_MTD_JEDECPROBE=y
+# CONFIG_MTD_JEDECPROBE is not set
 CONFIG_MTD_GEN_PROBE=y
 # CONFIG_MTD_CFI_ADV_OPTIONS is not set
 CONFIG_MTD_MAP_BANK_WIDTH_1=y
 CONFIG_MTD_MAP_BANK_WIDTH_2=y
 CONFIG_MTD_MAP_BANK_WIDTH_4=y
 # CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
-CONFIG_MTD_MAP_BANK_WIDTH_16=y
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
 # CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
 CONFIG_MTD_CFI_I1=y
 CONFIG_MTD_CFI_I2=y
 # CONFIG_MTD_CFI_I4 is not set
 # CONFIG_MTD_CFI_I8 is not set
 CONFIG_MTD_CFI_INTELEXT=y
-# CONFIG_MTD_CFI_AMDSTD is not set
+CONFIG_MTD_CFI_AMDSTD=y
 # CONFIG_MTD_CFI_STAA is not set
 CONFIG_MTD_CFI_UTIL=y
 # CONFIG_MTD_RAM is not set
 # CONFIG_MTD_ROM is not set
 # CONFIG_MTD_ABSENT is not set
 # CONFIG_MTD_OBSOLETE_CHIPS is not set
-# CONFIG_MTD_XIP is not set
 
 #
 # Mapping drivers for chip access
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 # CONFIG_MTD_PHYSMAP is not set
-# CONFIG_MTD_ARM_INTEGRATOR is not set
-# CONFIG_MTD_EDB7312 is not set
-# CONFIG_MTD_IMPA7 is not set
-CONFIG_MTD_BAST=y
-CONFIG_MTD_BAST_MAXSIZE=4
+CONFIG_MTD_ARM_INTEGRATOR=y
+# CONFIG_MTD_PLATRAM is not set
 
 #
 # Self-contained MTD device drivers
@@ -255,7 +390,6 @@ CONFIG_MTD_BAST_MAXSIZE=4
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLKMTD is not set
 # CONFIG_MTD_BLOCK2MTD is not set
 
 #
@@ -268,23 +402,17 @@ CONFIG_MTD_BAST_MAXSIZE=4
 #
 # NAND Flash Device Drivers
 #
-CONFIG_MTD_NAND=y
-# CONFIG_MTD_NAND_VERIFY_WRITE is not set
-CONFIG_MTD_NAND_IDS=y
-CONFIG_MTD_NAND_S3C2410=y
-# CONFIG_MTD_NAND_S3C2410_DEBUG is not set
-# CONFIG_MTD_NAND_S3C2410_HWECC is not set
-# CONFIG_MTD_NAND_DISKONCHIP is not set
-# CONFIG_MTD_NAND_NANDSIM is not set
+# CONFIG_MTD_NAND is not set
+
+#
+# OneNAND Flash Device Drivers
+#
+# CONFIG_MTD_ONENAND is not set
 
 #
 # Parallel port support
 #
-CONFIG_PARPORT=y
-# CONFIG_PARPORT_PC is not set
-# CONFIG_PARPORT_ARC is not set
-# CONFIG_PARPORT_GSC is not set
-CONFIG_PARPORT_1284=y
+# CONFIG_PARPORT is not set
 
 #
 # Plug and Play support
@@ -293,59 +421,20 @@ CONFIG_PARPORT_1284=y
 #
 # Block devices
 #
-# CONFIG_BLK_DEV_FD is not set
-# CONFIG_PARIDE is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
-CONFIG_BLK_DEV_LOOP=y
-# CONFIG_BLK_DEV_CRYPTOLOOP is not set
-CONFIG_BLK_DEV_NBD=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_COUNT=16
-CONFIG_BLK_DEV_RAM_SIZE=4096
+# CONFIG_BLK_DEV_LOOP is not set
+# CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_RAM is not set
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
-# ATA/ATAPI/MFM/RLL support
-#
-CONFIG_IDE=y
-CONFIG_BLK_DEV_IDE=y
-
-#
-# Please see Documentation/ide.txt for help/info on IDE drives
-#
-# CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_BLK_DEV_IDEDISK=y
-# CONFIG_IDEDISK_MULTI_MODE is not set
-CONFIG_BLK_DEV_IDECD=y
-CONFIG_BLK_DEV_IDETAPE=m
-CONFIG_BLK_DEV_IDEFLOPPY=m
-# CONFIG_IDE_TASK_IOCTL is not set
-
-#
-# IDE chipset support/bugfixes
-#
-CONFIG_IDE_GENERIC=y
-# CONFIG_IDE_ARM is not set
-CONFIG_BLK_DEV_IDE_BAST=y
-# CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_IDEDMA_AUTO is not set
-# CONFIG_BLK_DEV_HD is not set
-
-#
 # SCSI device support
 #
+# CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
+# CONFIG_SCSI_NETLINK is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -355,6 +444,7 @@ CONFIG_BLK_DEV_IDE_BAST=y
 #
 # Fusion MPT device support
 #
+# CONFIG_FUSION is not set
 
 #
 # IEEE 1394 (FireWire) support
@@ -365,69 +455,8 @@ CONFIG_BLK_DEV_IDE_BAST=y
 #
 
 #
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-# CONFIG_PACKET is not set
-# CONFIG_NETLINK_DEV is not set
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_PNP=y
-# CONFIG_IP_PNP_DHCP is not set
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-# CONFIG_SYN_COOKIES is not set
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-CONFIG_IP_TCPDIAG=y
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
+# Network device support
 #
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
 CONFIG_NETDEVICES=y
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
@@ -435,11 +464,17 @@ CONFIG_NETDEVICES=y
 # CONFIG_TUN is not set
 
 #
+# PHY device support
+#
+# CONFIG_PHYLIB is not set
+
+#
 # Ethernet (10 or 100Mbit)
 #
 CONFIG_NET_ETHERNET=y
-# CONFIG_MII is not set
-# CONFIG_SMC91X is not set
+CONFIG_MII=y
+CONFIG_SMC91X=y
+# CONFIG_DM9000 is not set
 
 #
 # Ethernet (1000 Mbit)
@@ -462,11 +497,12 @@ CONFIG_NET_ETHERNET=y
 # Wan interfaces
 #
 # CONFIG_WAN is not set
-# CONFIG_PLIP is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -477,6 +513,7 @@ CONFIG_NET_ETHERNET=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -499,6 +536,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -511,12 +549,11 @@ CONFIG_MOUSE_PS2=y
 # Hardware I/O ports
 #
 CONFIG_SERIO=y
-CONFIG_SERIO_SERPORT=y
-# CONFIG_SERIO_PARKBD is not set
+# CONFIG_SERIO_SERPORT is not set
+CONFIG_SERIO_AMBAKMI=y
 CONFIG_SERIO_LIBPS2=y
 # CONFIG_SERIO_RAW is not set
 # CONFIG_GAMEPORT is not set
-CONFIG_SOUND_GAMEPORT=y
 
 #
 # Character devices
@@ -524,49 +561,25 @@ CONFIG_SOUND_GAMEPORT=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
-CONFIG_SERIAL_NONSTANDARD=y
-# CONFIG_COMPUTONE is not set
-# CONFIG_ROCKETPORT is not set
-# CONFIG_CYCLADES is not set
-# CONFIG_DIGIEPCA is not set
-# CONFIG_MOXA_INTELLIO is not set
-# CONFIG_MOXA_SMARTIO is not set
-# CONFIG_ISI is not set
-# CONFIG_SYNCLINKMP is not set
-# CONFIG_N_HDLC is not set
-# CONFIG_RISCOM8 is not set
-# CONFIG_SPECIALIX is not set
-# CONFIG_SX is not set
-# CONFIG_RIO is not set
-# CONFIG_STALDRV is not set
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
+# CONFIG_SERIAL_NONSTANDARD is not set
 
 #
 # Serial drivers
 #
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_NR_UARTS=8
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_MANY_PORTS=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-# CONFIG_SERIAL_8250_DETECT_IRQ is not set
-# CONFIG_SERIAL_8250_MULTIPORT is not set
-# CONFIG_SERIAL_8250_RSA is not set
+# CONFIG_SERIAL_8250 is not set
 
 #
 # Non-8250 serial port support
 #
-CONFIG_SERIAL_S3C2410=y
-CONFIG_SERIAL_S3C2410_CONSOLE=y
+# CONFIG_SERIAL_AMBA_PL010 is not set
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=256
-CONFIG_PRINTER=y
-# CONFIG_LP_CONSOLE is not set
-CONFIG_PPDEV=y
-# CONFIG_TIPAR is not set
+CONFIG_LEGACY_PTY_COUNT=16
 
 #
 # IPMI
@@ -576,24 +589,15 @@ CONFIG_PPDEV=y
 #
 # Watchdog Cards
 #
-CONFIG_WATCHDOG=y
-# CONFIG_WATCHDOG_NOWAYOUT is not set
-
-#
-# Watchdog Device Drivers
-#
-# CONFIG_SOFT_WATCHDOG is not set
-CONFIG_S3C2410_WATCHDOG=y
+# CONFIG_WATCHDOG is not set
+# CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
-CONFIG_S3C2410_RTC=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 
 #
 # Ftape, the floppy tape device driver
 #
-# CONFIG_DRM is not set
 # CONFIG_RAW_DRIVER is not set
 
 #
@@ -604,73 +608,43 @@ CONFIG_S3C2410_RTC=y
 #
 # I2C support
 #
-CONFIG_I2C=y
-CONFIG_I2C_CHARDEV=m
-
-#
-# I2C Algorithms
-#
-CONFIG_I2C_ALGOBIT=m
-# CONFIG_I2C_ALGOPCF is not set
-# CONFIG_I2C_ALGOPCA is not set
-
-#
-# I2C Hardware Bus support
-#
-# CONFIG_I2C_ISA is not set
-# CONFIG_I2C_PARPORT is not set
-# CONFIG_I2C_PARPORT_LIGHT is not set
-CONFIG_I2C_S3C2410=y
-# CONFIG_I2C_STUB is not set
-# CONFIG_I2C_PCA_ISA is not set
-
-#
-# Hardware Sensors Chip support
-#
-CONFIG_I2C_SENSOR=m
-# CONFIG_SENSORS_ADM1021 is not set
-# CONFIG_SENSORS_ADM1025 is not set
-# CONFIG_SENSORS_ADM1026 is not set
-# CONFIG_SENSORS_ADM1031 is not set
-# CONFIG_SENSORS_ASB100 is not set
-# CONFIG_SENSORS_DS1621 is not set
-# CONFIG_SENSORS_FSCHER is not set
-# CONFIG_SENSORS_FSCPOS is not set
-# CONFIG_SENSORS_GL518SM is not set
-# CONFIG_SENSORS_GL520SM is not set
-# CONFIG_SENSORS_IT87 is not set
-# CONFIG_SENSORS_LM63 is not set
-CONFIG_SENSORS_LM75=m
-# CONFIG_SENSORS_LM77 is not set
-CONFIG_SENSORS_LM78=m
-# CONFIG_SENSORS_LM80 is not set
-# CONFIG_SENSORS_LM83 is not set
-CONFIG_SENSORS_LM85=m
-# CONFIG_SENSORS_LM87 is not set
-# CONFIG_SENSORS_LM90 is not set
-# CONFIG_SENSORS_MAX1619 is not set
-# CONFIG_SENSORS_PC87360 is not set
-# CONFIG_SENSORS_SMSC47B397 is not set
-# CONFIG_SENSORS_SMSC47M1 is not set
-# CONFIG_SENSORS_W83781D is not set
-# CONFIG_SENSORS_W83L785TS is not set
-# CONFIG_SENSORS_W83627HF is not set
-
-#
-# Other I2C Chip support
-#
-CONFIG_SENSORS_EEPROM=m
-# CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
-# CONFIG_I2C_DEBUG_CORE is not set
-# CONFIG_I2C_DEBUG_ALGO is not set
-# CONFIG_I2C_DEBUG_BUS is not set
-# CONFIG_I2C_DEBUG_CHIP is not set
+# CONFIG_I2C is not set
+
+#
+# SPI support
+#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
+
+#
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Hardware Monitoring support
+#
+# CONFIG_HWMON is not set
+# CONFIG_HWMON_VID is not set
 
 #
 # Misc devices
 #
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
+# LED drivers
+#
+
+#
+# LED Triggers
+#
 
 #
 # Multimedia devices
@@ -685,13 +659,17 @@ CONFIG_SENSORS_EEPROM=m
 #
 # Graphics support
 #
+# CONFIG_FIRMWARE_EDID is not set
 CONFIG_FB=y
-# CONFIG_FB_CFB_FILLRECT is not set
-# CONFIG_FB_CFB_COPYAREA is not set
-# CONFIG_FB_CFB_IMAGEBLIT is not set
-# CONFIG_FB_SOFT_CURSOR is not set
-CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_CFB_FILLRECT=y
+CONFIG_FB_CFB_COPYAREA=y
+CONFIG_FB_CFB_IMAGEBLIT=y
+# CONFIG_FB_MACMODES is not set
+# CONFIG_FB_BACKLIGHT is not set
+# CONFIG_FB_MODE_HELPERS is not set
 # CONFIG_FB_TILEBLITTING is not set
+CONFIG_FB_ARMCLCD=y
+# CONFIG_FB_S1D13XXX is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
@@ -699,27 +677,76 @@ CONFIG_FB_MODE_HELPERS=y
 #
 # CONFIG_VGA_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
-# CONFIG_FRAMEBUFFER_CONSOLE is not set
+CONFIG_FRAMEBUFFER_CONSOLE=y
+# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+# CONFIG_FONTS is not set
+CONFIG_FONT_8x8=y
+CONFIG_FONT_8x16=y
 
 #
 # Logo configuration
 #
-# CONFIG_LOGO is not set
+CONFIG_LOGO=y
+# CONFIG_LOGO_LINUX_MONO is not set
+# CONFIG_LOGO_LINUX_VGA16 is not set
+CONFIG_LOGO_LINUX_CLUT224=y
 # CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
 #
-# CONFIG_SOUND is not set
+CONFIG_SOUND=y
+
+#
+# Advanced Linux Sound Architecture
+#
+CONFIG_SND=y
+CONFIG_SND_TIMER=y
+CONFIG_SND_PCM=y
+# CONFIG_SND_SEQUENCER is not set
+CONFIG_SND_OSSEMUL=y
+CONFIG_SND_MIXER_OSS=y
+CONFIG_SND_PCM_OSS=y
+CONFIG_SND_PCM_OSS_PLUGINS=y
+# CONFIG_SND_DYNAMIC_MINORS is not set
+CONFIG_SND_SUPPORT_OLD_API=y
+CONFIG_SND_VERBOSE_PROCFS=y
+# CONFIG_SND_VERBOSE_PRINTK is not set
+# CONFIG_SND_DEBUG is not set
+
+#
+# Generic devices
+#
+CONFIG_SND_AC97_CODEC=m
+CONFIG_SND_AC97_BUS=m
+# CONFIG_SND_DUMMY is not set
+# CONFIG_SND_MTPAV is not set
+# CONFIG_SND_SERIAL_U16550 is not set
+# CONFIG_SND_MPU401 is not set
+
+#
+# ALSA ARM devices
+#
+CONFIG_SND_ARMAACI=m
+
+#
+# Open Sound System
+#
+# CONFIG_SOUND_PRIME is not set
 
 #
 # USB support
 #
 CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_OHCI is not set
+# CONFIG_USB_ARCH_HAS_EHCI is not set
 # CONFIG_USB is not set
 
 #
+# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
@@ -727,33 +754,62 @@ CONFIG_USB_ARCH_HAS_HCD=y
 #
 # MMC/SD Card support
 #
-# CONFIG_MMC is not set
+CONFIG_MMC=y
+# CONFIG_MMC_DEBUG is not set
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_ARMMMCI=y
+# CONFIG_MMC_TIFM_SD is not set
+
+#
+# Real Time Clock
+#
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+CONFIG_RTC_INTF_DEV_UIE_EMUL=y
+
+#
+# RTC drivers
+#
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+CONFIG_RTC_DRV_PL031=y
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_V3020 is not set
 
 #
 # File systems
 #
 CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XATTR is not set
-CONFIG_EXT3_FS=y
-CONFIG_EXT3_FS_XATTR=y
-# CONFIG_EXT3_FS_POSIX_ACL is not set
-# CONFIG_EXT3_FS_SECURITY is not set
-CONFIG_JBD=y
-# CONFIG_JBD_DEBUG is not set
-CONFIG_FS_MBCACHE=y
+# CONFIG_EXT2_FS_XIP is not set
+# CONFIG_EXT3_FS is not set
+# CONFIG_EXT4DEV_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
-
-#
-# XFS support
-#
+# CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
+# CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
-CONFIG_ROMFS_FS=y
+# CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
+# CONFIG_INOTIFY_USER is not set
 # CONFIG_QUOTA is not set
 CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
+# CONFIG_FUSE_FS is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -765,7 +821,7 @@ CONFIG_DNOTIFY=y
 # DOS/FAT/NT Filesystems
 #
 CONFIG_FAT_FS=y
-CONFIG_MSDOS_FS=y
+# CONFIG_MSDOS_FS is not set
 CONFIG_VFAT_FS=y
 CONFIG_FAT_DEFAULT_CODEPAGE=437
 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
@@ -775,12 +831,13 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # Pseudo filesystems
 #
 CONFIG_PROC_FS=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_DEVFS_FS is not set
-# CONFIG_DEVPTS_FS_XATTR is not set
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
+# CONFIG_CONFIGFS_FS is not set
 
 #
 # Miscellaneous filesystems
@@ -792,18 +849,9 @@ CONFIG_RAMFS=y
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
-CONFIG_JFFS_FS=y
-CONFIG_JFFS_FS_VERBOSE=0
-# CONFIG_JFFS_PROC_FS is not set
-CONFIG_JFFS2_FS=y
-CONFIG_JFFS2_FS_DEBUG=0
-# CONFIG_JFFS2_FS_NAND is not set
-# CONFIG_JFFS2_FS_NOR_ECC is not set
-# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
-CONFIG_JFFS2_ZLIB=y
-CONFIG_JFFS2_RTIME=y
-# CONFIG_JFFS2_RUBIN is not set
-# CONFIG_CRAMFS is not set
+# CONFIG_JFFS_FS is not set
+# CONFIG_JFFS2_FS is not set
+CONFIG_CRAMFS=y
 # CONFIG_VXFS_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
@@ -814,12 +862,15 @@ CONFIG_JFFS2_RTIME=y
 # Network File Systems
 #
 CONFIG_NFS_FS=y
-# CONFIG_NFS_V3 is not set
+CONFIG_NFS_V3=y
+# CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
 # CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
 CONFIG_LOCKD=y
+CONFIG_LOCKD_V4=y
+CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
@@ -828,33 +879,20 @@ CONFIG_SUNRPC=y
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
+# CONFIG_9P_FS is not set
 
 #
 # Partition Types
 #
-CONFIG_PARTITION_ADVANCED=y
-# CONFIG_ACORN_PARTITION is not set
-# CONFIG_OSF_PARTITION is not set
-# CONFIG_AMIGA_PARTITION is not set
-# CONFIG_ATARI_PARTITION is not set
-# CONFIG_MAC_PARTITION is not set
+# CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
-CONFIG_BSD_DISKLABEL=y
-# CONFIG_MINIX_SUBPARTITION is not set
-CONFIG_SOLARIS_X86_PARTITION=y
-# CONFIG_UNIXWARE_DISKLABEL is not set
-# CONFIG_LDM_PARTITION is not set
-# CONFIG_SGI_PARTITION is not set
-# CONFIG_ULTRIX_PARTITION is not set
-# CONFIG_SUN_PARTITION is not set
-# CONFIG_EFI_PARTITION is not set
 
 #
 # Native Language Support
 #
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="iso8859-1"
-# CONFIG_NLS_CODEPAGE_437 is not set
+CONFIG_NLS_CODEPAGE_437=y
 # CONFIG_NLS_CODEPAGE_737 is not set
 # CONFIG_NLS_CODEPAGE_775 is not set
 # CONFIG_NLS_CODEPAGE_850 is not set
@@ -878,7 +916,7 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_CODEPAGE_1250 is not set
 # CONFIG_NLS_CODEPAGE_1251 is not set
 # CONFIG_NLS_ASCII is not set
-# CONFIG_NLS_ISO8859_1 is not set
+CONFIG_NLS_ISO8859_1=y
 # CONFIG_NLS_ISO8859_2 is not set
 # CONFIG_NLS_ISO8859_3 is not set
 # CONFIG_NLS_ISO8859_4 is not set
@@ -902,25 +940,37 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_MAGIC_SYSRQ=y
+# CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
-# CONFIG_MAGIC_SYSRQ is not set
-CONFIG_LOG_BUF_SHIFT=16
+CONFIG_LOG_BUF_SHIFT=14
+CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
-# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_RWSEMS=y
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_BUGVERBOSE=y
-CONFIG_DEBUG_INFO=y
+# CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
+# CONFIG_UNWIND_INFO is not set
+CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
+# CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
 # CONFIG_DEBUG_WAITQ is not set
-# CONFIG_DEBUG_ERRORS is not set
+CONFIG_DEBUG_ERRORS=y
 CONFIG_DEBUG_LL=y
 # CONFIG_DEBUG_ICEDCC is not set
-CONFIG_DEBUG_S3C2410_PORT=y
-CONFIG_DEBUG_S3C2410_UART=0
 
 #
 # Security options
@@ -934,14 +984,11 @@ CONFIG_DEBUG_S3C2410_UART=0
 # CONFIG_CRYPTO is not set
 
 #
-# Hardware crypto devices
-#
-
-#
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
+# CONFIG_CRC16 is not set
 CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
 CONFIG_ZLIB_INFLATE=y
-CONFIG_ZLIB_DEFLATE=y
+CONFIG_PLIST=y
diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig
index a83222641045..c0152393e494 100644
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -1,9 +1,10 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18
-# Wed Sep 20 20:27:31 2006
+# Linux kernel version: 2.6.19-rc4
+# Fri Nov  3 17:41:31 2006
 #
 CONFIG_ARM=y
+# CONFIG_GENERIC_TIME is not set
 CONFIG_MMU=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
@@ -29,17 +30,20 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 # CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
 CONFIG_UID16=y
-CONFIG_SYSCTL=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -62,7 +66,8 @@ CONFIG_BASE_SMALL=0
 # Loadable module support
 #
 CONFIG_MODULES=y
-# CONFIG_MODULE_UNLOAD is not set
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
@@ -70,6 +75,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
@@ -120,6 +126,7 @@ CONFIG_ARCH_S3C2410=y
 #
 # S3C24XX Implementations
 #
+# CONFIG_MACH_AML_M5900 is not set
 CONFIG_MACH_ANUBIS=y
 CONFIG_MACH_OSIRIS=y
 CONFIG_ARCH_BAST=y
@@ -178,6 +185,8 @@ CONFIG_CPU_CACHE_V4WT=y
 CONFIG_CPU_CACHE_VIVT=y
 CONFIG_CPU_COPY_V4WB=y
 CONFIG_CPU_TLB_V4WBI=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
 
 #
 # Processor Features
@@ -249,8 +258,9 @@ CONFIG_BINFMT_AOUT=y
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
+# CONFIG_PM_SYSFS_DEPRECATED is not set
 CONFIG_APM=y
 
 #
@@ -266,6 +276,7 @@ CONFIG_NET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
@@ -286,10 +297,12 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -377,6 +390,7 @@ CONFIG_MTD_BLOCK=y
 # CONFIG_NFTL is not set
 # CONFIG_INFTL is not set
 # CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
 
 #
 # RAM/ROM/Flash chip drivers
@@ -418,6 +432,8 @@ CONFIG_MTD_BAST_MAXSIZE=4
 #
 # Self-contained MTD device drivers
 #
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_M25P80 is not set
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
@@ -512,6 +528,7 @@ CONFIG_BLK_DEV_IDE_BAST=y
 #
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
+# CONFIG_SCSI_NETLINK is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -606,6 +623,7 @@ CONFIG_DM9000=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -628,6 +646,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -734,7 +753,6 @@ CONFIG_S3C2410_WATCHDOG=y
 # CONFIG_USBPCWATCHDOG is not set
 CONFIG_HW_RANDOM=y
 # CONFIG_NVRAM is not set
-CONFIG_S3C2410_RTC=y
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 
@@ -747,7 +765,6 @@ CONFIG_S3C2410_RTC=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -792,12 +809,26 @@ CONFIG_SENSORS_EEPROM=m
 #
 # SPI support
 #
-# CONFIG_SPI is not set
-# CONFIG_SPI_MASTER is not set
+CONFIG_SPI=y
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
+
+#
+# SPI Master Controller Drivers
+#
+CONFIG_SPI_BITBANG=m
+# CONFIG_SPI_BUTTERFLY is not set
+CONFIG_SPI_S3C24XX_GPIO=m
+CONFIG_SPI_S3C24XX=m
+
+#
+# SPI Protocol Masters
+#
 
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -820,6 +851,7 @@ CONFIG_HWMON_VID=m
 # CONFIG_SENSORS_GL520SM is not set
 # CONFIG_SENSORS_IT87 is not set
 # CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM70 is not set
 CONFIG_SENSORS_LM75=m
 # CONFIG_SENSORS_LM77 is not set
 CONFIG_SENSORS_LM78=m
@@ -834,6 +866,7 @@ CONFIG_SENSORS_LM85=m
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
@@ -845,25 +878,31 @@ CONFIG_SENSORS_LM85=m
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # LED devices
 #
-# CONFIG_NEW_LEDS is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=m
 
 #
 # LED drivers
 #
+CONFIG_LEDS_S3C24XX=m
 
 #
 # LED Triggers
 #
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=m
+# CONFIG_LEDS_TRIGGER_IDE_DISK is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=m
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -876,6 +915,7 @@ CONFIG_VIDEO_V4L2=y
 #
 CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
+# CONFIG_FB_DDC is not set
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -951,7 +991,6 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 #
 # may also be needed; see USB_STORAGE Help for more information
 #
-# CONFIG_USB_STORAGE is not set
 # CONFIG_USB_LIBUSUAL is not set
 
 #
@@ -1007,6 +1046,7 @@ CONFIG_USB_MON=y
 #
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
 # CONFIG_USB_AUERSWALD is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
@@ -1014,11 +1054,12 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LED is not set
 # CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
-# CONFIG_USB_PHIDGETKIT is not set
-# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_PHIDGET is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1039,7 +1080,37 @@ CONFIG_USB_MON=y
 # Real Time Clock
 #
 CONFIG_RTC_LIB=y
-# CONFIG_RTC_CLASS is not set
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+
+#
+# RTC drivers
+#
+# CONFIG_RTC_DRV_X1205 is not set
+# CONFIG_RTC_DRV_DS1307 is not set
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_ISL1208 is not set
+# CONFIG_RTC_DRV_DS1672 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_PCF8563 is not set
+# CONFIG_RTC_DRV_PCF8583 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_RS5C372 is not set
+CONFIG_RTC_DRV_S3C=y
+# CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_V3020 is not set
 
 #
 # File systems
@@ -1051,6 +1122,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1058,6 +1130,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 CONFIG_ROMFS_FS=y
@@ -1089,6 +1162,7 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # Pseudo filesystems
 #
 CONFIG_PROC_FS=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 # CONFIG_TMPFS is not set
 # CONFIG_HUGETLB_PAGE is not set
@@ -1219,6 +1293,7 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
@@ -1238,9 +1313,10 @@ CONFIG_DEBUG_BUGVERBOSE=y
 CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
-# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_DEBUG_USER=y
 # CONFIG_DEBUG_WAITQ is not set
@@ -1262,10 +1338,6 @@ CONFIG_DEBUG_S3C2410_UART=0
 # CONFIG_CRYPTO is not set
 
 #
-# Hardware crypto devices
-#
-
-#
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
diff --git a/arch/arm/configs/smdk2410_defconfig b/arch/arm/configs/smdk2410_defconfig
deleted file mode 100644
index 4d123d33c7df..000000000000
--- a/arch/arm/configs/smdk2410_defconfig
+++ /dev/null
@@ -1,735 +0,0 @@
-#
-# Automatically generated make config: don't edit
-# Linux kernel version: 2.6.12-rc1-bk2
-# Sun Mar 27 22:42:40 2005
-#
-CONFIG_ARM=y
-CONFIG_MMU=y
-CONFIG_UID16=y
-CONFIG_RWSEM_GENERIC_SPINLOCK=y
-CONFIG_GENERIC_CALIBRATE_DELAY=y
-CONFIG_GENERIC_IOMAP=y
-
-#
-# Code maturity level options
-#
-CONFIG_EXPERIMENTAL=y
-CONFIG_CLEAN_COMPILE=y
-CONFIG_BROKEN_ON_SMP=y
-
-#
-# General setup
-#
-CONFIG_LOCALVERSION=""
-CONFIG_SWAP=y
-CONFIG_SYSVIPC=y
-# CONFIG_POSIX_MQUEUE is not set
-# CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
-# CONFIG_AUDIT is not set
-# CONFIG_HOTPLUG is not set
-CONFIG_KOBJECT_UEVENT=y
-# CONFIG_IKCONFIG is not set
-# CONFIG_EMBEDDED is not set
-CONFIG_KALLSYMS=y
-# CONFIG_KALLSYMS_ALL is not set
-# CONFIG_KALLSYMS_EXTRA_PASS is not set
-CONFIG_BASE_FULL=y
-CONFIG_FUTEX=y
-CONFIG_EPOLL=y
-CONFIG_CC_OPTIMIZE_FOR_SIZE=y
-CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
-# CONFIG_TINY_SHMEM is not set
-CONFIG_BASE_SMALL=0
-
-#
-# Loadable module support
-#
-# CONFIG_MODULES is not set
-
-#
-# System Type
-#
-# CONFIG_ARCH_CLPS7500 is not set
-# CONFIG_ARCH_CLPS711X is not set
-# CONFIG_ARCH_CO285 is not set
-# CONFIG_ARCH_EBSA110 is not set
-# CONFIG_ARCH_FOOTBRIDGE is not set
-# CONFIG_ARCH_INTEGRATOR is not set
-# CONFIG_ARCH_IOP3XX is not set
-# CONFIG_ARCH_IXP4XX is not set
-# CONFIG_ARCH_IXP2000 is not set
-# CONFIG_ARCH_L7200 is not set
-# CONFIG_ARCH_PXA is not set
-# CONFIG_ARCH_RPC is not set
-# CONFIG_ARCH_SA1100 is not set
-CONFIG_ARCH_S3C2410=y
-# CONFIG_ARCH_SHARK is not set
-# CONFIG_ARCH_LH7A40X is not set
-# CONFIG_ARCH_OMAP is not set
-# CONFIG_ARCH_VERSATILE is not set
-# CONFIG_ARCH_IMX is not set
-# CONFIG_ARCH_H720X is not set
-
-#
-# S3C24XX Implementations
-#
-# CONFIG_ARCH_BAST is not set
-# CONFIG_ARCH_H1940 is not set
-# CONFIG_MACH_N30 is not set
-CONFIG_ARCH_SMDK2410=y
-# CONFIG_ARCH_S3C2440 is not set
-# CONFIG_MACH_VR1000 is not set
-# CONFIG_MACH_RX3715 is not set
-# CONFIG_MACH_OTOM is not set
-# CONFIG_MACH_NEXCODER_2440 is not set
-CONFIG_CPU_S3C2410=y
-
-#
-# S3C2410 Boot
-#
-
-#
-# S3C2410 Setup
-#
-# CONFIG_S3C2410_DMA is not set
-CONFIG_S3C2410_LOWLEVEL_UART_PORT=0
-
-#
-# Processor Type
-#
-CONFIG_CPU_32=y
-CONFIG_CPU_ARM920T=y
-CONFIG_CPU_32v4=y
-CONFIG_CPU_ABRT_EV4T=y
-CONFIG_CPU_CACHE_V4WT=y
-CONFIG_CPU_CACHE_VIVT=y
-CONFIG_CPU_COPY_V4WB=y
-CONFIG_CPU_TLB_V4WBI=y
-
-#
-# Processor Features
-#
-CONFIG_ARM_THUMB=y
-# CONFIG_CPU_ICACHE_DISABLE is not set
-# CONFIG_CPU_DCACHE_DISABLE is not set
-# CONFIG_CPU_DCACHE_WRITETHROUGH is not set
-
-#
-# Bus support
-#
-
-#
-# PCCARD (PCMCIA/CardBus) support
-#
-# CONFIG_PCCARD is not set
-
-#
-# Kernel Features
-#
-# CONFIG_PREEMPT is not set
-CONFIG_ALIGNMENT_TRAP=y
-
-#
-# Boot options
-#
-CONFIG_ZBOOT_ROM_TEXT=0x0
-CONFIG_ZBOOT_ROM_BSS=0x0
-CONFIG_CMDLINE="root=1f04 mem=32M"
-# CONFIG_XIP_KERNEL is not set
-
-#
-# Floating point emulation
-#
-
-#
-# At least one emulation must be selected
-#
-# CONFIG_FPE_NWFPE is not set
-# CONFIG_FPE_FASTFPE is not set
-
-#
-# Userspace binary formats
-#
-CONFIG_BINFMT_ELF=y
-CONFIG_BINFMT_AOUT=y
-# CONFIG_BINFMT_MISC is not set
-# CONFIG_ARTHUR is not set
-
-#
-# Power management options
-#
-# CONFIG_PM is not set
-
-#
-# Device Drivers
-#
-
-#
-# Generic Driver Options
-#
-CONFIG_STANDALONE=y
-CONFIG_PREVENT_FIRMWARE_BUILD=y
-# CONFIG_FW_LOADER is not set
-# CONFIG_DEBUG_DRIVER is not set
-
-#
-# Memory Technology Devices (MTD)
-#
-CONFIG_MTD=y
-# CONFIG_MTD_DEBUG is not set
-# CONFIG_MTD_CONCAT is not set
-# CONFIG_MTD_PARTITIONS is not set
-
-#
-# User Modules And Translation Layers
-#
-CONFIG_MTD_CHAR=y
-CONFIG_MTD_BLOCK=y
-# CONFIG_FTL is not set
-# CONFIG_NFTL is not set
-# CONFIG_INFTL is not set
-
-#
-# RAM/ROM/Flash chip drivers
-#
-CONFIG_MTD_CFI=y
-# CONFIG_MTD_JEDECPROBE is not set
-CONFIG_MTD_GEN_PROBE=y
-# CONFIG_MTD_CFI_ADV_OPTIONS is not set
-CONFIG_MTD_MAP_BANK_WIDTH_1=y
-CONFIG_MTD_MAP_BANK_WIDTH_2=y
-CONFIG_MTD_MAP_BANK_WIDTH_4=y
-# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
-# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
-# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
-CONFIG_MTD_CFI_I1=y
-CONFIG_MTD_CFI_I2=y
-# CONFIG_MTD_CFI_I4 is not set
-# CONFIG_MTD_CFI_I8 is not set
-CONFIG_MTD_CFI_INTELEXT=y
-# CONFIG_MTD_CFI_AMDSTD is not set
-# CONFIG_MTD_CFI_STAA is not set
-CONFIG_MTD_CFI_UTIL=y
-# CONFIG_MTD_RAM is not set
-# CONFIG_MTD_ROM is not set
-# CONFIG_MTD_ABSENT is not set
-# CONFIG_MTD_XIP is not set
-
-#
-# Mapping drivers for chip access
-#
-# CONFIG_MTD_COMPLEX_MAPPINGS is not set
-# CONFIG_MTD_PHYSMAP is not set
-# CONFIG_MTD_ARM_INTEGRATOR is not set
-# CONFIG_MTD_EDB7312 is not set
-
-#
-# Self-contained MTD device drivers
-#
-# CONFIG_MTD_SLRAM is not set
-# CONFIG_MTD_PHRAM is not set
-# CONFIG_MTD_MTDRAM is not set
-# CONFIG_MTD_BLKMTD is not set
-# CONFIG_MTD_BLOCK2MTD is not set
-
-#
-# Disk-On-Chip Device Drivers
-#
-# CONFIG_MTD_DOC2000 is not set
-# CONFIG_MTD_DOC2001 is not set
-# CONFIG_MTD_DOC2001PLUS is not set
-
-#
-# NAND Flash Device Drivers
-#
-# CONFIG_MTD_NAND is not set
-
-#
-# Parallel port support
-#
-# CONFIG_PARPORT is not set
-
-#
-# Plug and Play support
-#
-
-#
-# Block devices
-#
-# CONFIG_BLK_DEV_FD is not set
-# CONFIG_BLK_DEV_COW_COMMON is not set
-# CONFIG_BLK_DEV_LOOP is not set
-# CONFIG_BLK_DEV_NBD is not set
-CONFIG_BLK_DEV_RAM=y
-CONFIG_BLK_DEV_RAM_COUNT=16
-CONFIG_BLK_DEV_RAM_SIZE=4096
-# CONFIG_BLK_DEV_INITRD is not set
-CONFIG_INITRAMFS_SOURCE=""
-# CONFIG_CDROM_PKTCDVD is not set
-
-#
-# IO Schedulers
-#
-CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
-CONFIG_IOSCHED_DEADLINE=y
-CONFIG_IOSCHED_CFQ=y
-# CONFIG_ATA_OVER_ETH is not set
-
-#
-# ATA/ATAPI/MFM/RLL support
-#
-# CONFIG_IDE is not set
-
-#
-# SCSI device support
-#
-# CONFIG_SCSI is not set
-
-#
-# Multi-device support (RAID and LVM)
-#
-# CONFIG_MD is not set
-
-#
-# Fusion MPT device support
-#
-
-#
-# IEEE 1394 (FireWire) support
-#
-
-#
-# I2O device support
-#
-
-#
-# Networking support
-#
-CONFIG_NET=y
-
-#
-# Networking options
-#
-# CONFIG_PACKET is not set
-# CONFIG_NETLINK_DEV is not set
-CONFIG_UNIX=y
-# CONFIG_NET_KEY is not set
-CONFIG_INET=y
-# CONFIG_IP_MULTICAST is not set
-# CONFIG_IP_ADVANCED_ROUTER is not set
-CONFIG_IP_PNP=y
-# CONFIG_IP_PNP_DHCP is not set
-CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IP_PNP_RARP is not set
-# CONFIG_NET_IPIP is not set
-# CONFIG_NET_IPGRE is not set
-# CONFIG_ARPD is not set
-# CONFIG_SYN_COOKIES is not set
-# CONFIG_INET_AH is not set
-# CONFIG_INET_ESP is not set
-# CONFIG_INET_IPCOMP is not set
-# CONFIG_INET_TUNNEL is not set
-# CONFIG_IP_TCPDIAG is not set
-# CONFIG_IP_TCPDIAG_IPV6 is not set
-# CONFIG_IPV6 is not set
-# CONFIG_NETFILTER is not set
-
-#
-# SCTP Configuration (EXPERIMENTAL)
-#
-# CONFIG_IP_SCTP is not set
-# CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
-# CONFIG_DECNET is not set
-# CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
-# CONFIG_ATALK is not set
-# CONFIG_X25 is not set
-# CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
-# CONFIG_ECONET is not set
-# CONFIG_WAN_ROUTER is not set
-
-#
-# QoS and/or fair queueing
-#
-# CONFIG_NET_SCHED is not set
-# CONFIG_NET_CLS_ROUTE is not set
-
-#
-# Network testing
-#
-# CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
-# CONFIG_HAMRADIO is not set
-# CONFIG_IRDA is not set
-# CONFIG_BT is not set
-CONFIG_NETDEVICES=y
-# CONFIG_DUMMY is not set
-# CONFIG_BONDING is not set
-# CONFIG_EQUALIZER is not set
-# CONFIG_TUN is not set
-
-#
-# Ethernet (10 or 100Mbit)
-#
-CONFIG_NET_ETHERNET=y
-# CONFIG_MII is not set
-# CONFIG_SMC91X is not set
-
-#
-# Ethernet (1000 Mbit)
-#
-
-#
-# Ethernet (10000 Mbit)
-#
-
-#
-# Token Ring devices
-#
-
-#
-# Wireless LAN (non-hamradio)
-#
-# CONFIG_NET_RADIO is not set
-
-#
-# Wan interfaces
-#
-# CONFIG_WAN is not set
-# CONFIG_PPP is not set
-# CONFIG_SLIP is not set
-# CONFIG_SHAPER is not set
-# CONFIG_NETCONSOLE is not set
-
-#
-# ISDN subsystem
-#
-# CONFIG_ISDN is not set
-
-#
-# Input device support
-#
-CONFIG_INPUT=y
-
-#
-# Userland interfaces
-#
-CONFIG_INPUT_MOUSEDEV=y
-CONFIG_INPUT_MOUSEDEV_PSAUX=y
-CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
-CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
-# CONFIG_INPUT_JOYDEV is not set
-# CONFIG_INPUT_TSDEV is not set
-# CONFIG_INPUT_EVDEV is not set
-# CONFIG_INPUT_EVBUG is not set
-
-#
-# Input Device Drivers
-#
-CONFIG_INPUT_KEYBOARD=y
-CONFIG_KEYBOARD_ATKBD=y
-# CONFIG_KEYBOARD_SUNKBD is not set
-# CONFIG_KEYBOARD_LKKBD is not set
-# CONFIG_KEYBOARD_XTKBD is not set
-# CONFIG_KEYBOARD_NEWTON is not set
-CONFIG_INPUT_MOUSE=y
-CONFIG_MOUSE_PS2=y
-# CONFIG_MOUSE_SERIAL is not set
-# CONFIG_MOUSE_VSXXXAA is not set
-# CONFIG_INPUT_JOYSTICK is not set
-# CONFIG_INPUT_TOUCHSCREEN is not set
-# CONFIG_INPUT_MISC is not set
-
-#
-# Hardware I/O ports
-#
-CONFIG_SERIO=y
-CONFIG_SERIO_SERPORT=y
-CONFIG_SERIO_LIBPS2=y
-# CONFIG_SERIO_RAW is not set
-# CONFIG_GAMEPORT is not set
-CONFIG_SOUND_GAMEPORT=y
-
-#
-# Character devices
-#
-CONFIG_VT=y
-CONFIG_VT_CONSOLE=y
-CONFIG_HW_CONSOLE=y
-# CONFIG_SERIAL_NONSTANDARD is not set
-
-#
-# Serial drivers
-#
-# CONFIG_SERIAL_8250 is not set
-
-#
-# Non-8250 serial port support
-#
-CONFIG_SERIAL_S3C2410=y
-CONFIG_SERIAL_S3C2410_CONSOLE=y
-CONFIG_SERIAL_CORE=y
-CONFIG_SERIAL_CORE_CONSOLE=y
-CONFIG_UNIX98_PTYS=y
-CONFIG_LEGACY_PTYS=y
-CONFIG_LEGACY_PTY_COUNT=256
-
-#
-# IPMI
-#
-# CONFIG_IPMI_HANDLER is not set
-
-#
-# Watchdog Cards
-#
-# CONFIG_WATCHDOG is not set
-# CONFIG_NVRAM is not set
-# CONFIG_RTC is not set
-# CONFIG_S3C2410_RTC is not set
-# CONFIG_DTLK is not set
-# CONFIG_R3964 is not set
-
-#
-# Ftape, the floppy tape device driver
-#
-# CONFIG_DRM is not set
-# CONFIG_RAW_DRIVER is not set
-
-#
-# TPM devices
-#
-# CONFIG_TCG_TPM is not set
-
-#
-# I2C support
-#
-# CONFIG_I2C is not set
-
-#
-# Misc devices
-#
-
-#
-# Multimedia devices
-#
-# CONFIG_VIDEO_DEV is not set
-
-#
-# Digital Video Broadcasting Devices
-#
-# CONFIG_DVB is not set
-
-#
-# Graphics support
-#
-CONFIG_FB=y
-CONFIG_FB_CFB_FILLRECT=y
-CONFIG_FB_CFB_COPYAREA=y
-CONFIG_FB_CFB_IMAGEBLIT=y
-CONFIG_FB_SOFT_CURSOR=y
-# CONFIG_FB_MODE_HELPERS is not set
-# CONFIG_FB_TILEBLITTING is not set
-CONFIG_FB_VIRTUAL=y
-
-#
-# Console display driver support
-#
-# CONFIG_VGA_CONSOLE is not set
-CONFIG_DUMMY_CONSOLE=y
-CONFIG_FRAMEBUFFER_CONSOLE=y
-# CONFIG_FONTS is not set
-CONFIG_FONT_8x8=y
-CONFIG_FONT_8x16=y
-
-#
-# Logo configuration
-#
-# CONFIG_LOGO is not set
-# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
-
-#
-# Sound
-#
-# CONFIG_SOUND is not set
-
-#
-# USB support
-#
-CONFIG_USB_ARCH_HAS_HCD=y
-# CONFIG_USB_ARCH_HAS_OHCI is not set
-# CONFIG_USB is not set
-
-#
-# USB Gadget Support
-#
-# CONFIG_USB_GADGET is not set
-
-#
-# MMC/SD Card support
-#
-# CONFIG_MMC is not set
-
-#
-# File systems
-#
-CONFIG_EXT2_FS=y
-# CONFIG_EXT2_FS_XATTR is not set
-# CONFIG_EXT3_FS is not set
-# CONFIG_JBD is not set
-# CONFIG_REISERFS_FS is not set
-# CONFIG_JFS_FS is not set
-
-#
-# XFS support
-#
-# CONFIG_XFS_FS is not set
-# CONFIG_MINIX_FS is not set
-CONFIG_ROMFS_FS=y
-# CONFIG_QUOTA is not set
-CONFIG_DNOTIFY=y
-# CONFIG_AUTOFS_FS is not set
-# CONFIG_AUTOFS4_FS is not set
-
-#
-# CD-ROM/DVD Filesystems
-#
-# CONFIG_ISO9660_FS is not set
-# CONFIG_UDF_FS is not set
-
-#
-# DOS/FAT/NT Filesystems
-#
-# CONFIG_MSDOS_FS is not set
-# CONFIG_VFAT_FS is not set
-# CONFIG_NTFS_FS is not set
-
-#
-# Pseudo filesystems
-#
-CONFIG_PROC_FS=y
-CONFIG_SYSFS=y
-# CONFIG_DEVFS_FS is not set
-# CONFIG_DEVPTS_FS_XATTR is not set
-# CONFIG_TMPFS is not set
-# CONFIG_HUGETLB_PAGE is not set
-CONFIG_RAMFS=y
-
-#
-# Miscellaneous filesystems
-#
-# CONFIG_ADFS_FS is not set
-# CONFIG_AFFS_FS is not set
-# CONFIG_HFS_FS is not set
-# CONFIG_HFSPLUS_FS is not set
-# CONFIG_BEFS_FS is not set
-# CONFIG_BFS_FS is not set
-# CONFIG_EFS_FS is not set
-# CONFIG_JFFS_FS is not set
-# CONFIG_JFFS2_FS is not set
-# CONFIG_CRAMFS is not set
-# CONFIG_VXFS_FS is not set
-# CONFIG_HPFS_FS is not set
-# CONFIG_QNX4FS_FS is not set
-# CONFIG_SYSV_FS is not set
-# CONFIG_UFS_FS is not set
-
-#
-# Network File Systems
-#
-CONFIG_NFS_FS=y
-# CONFIG_NFS_V3 is not set
-# CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
-# CONFIG_NFSD is not set
-CONFIG_ROOT_NFS=y
-CONFIG_LOCKD=y
-CONFIG_SUNRPC=y
-# CONFIG_RPCSEC_GSS_KRB5 is not set
-# CONFIG_RPCSEC_GSS_SPKM3 is not set
-# CONFIG_SMB_FS is not set
-# CONFIG_CIFS is not set
-# CONFIG_NCP_FS is not set
-# CONFIG_CODA_FS is not set
-# CONFIG_AFS_FS is not set
-
-#
-# Partition Types
-#
-CONFIG_PARTITION_ADVANCED=y
-# CONFIG_ACORN_PARTITION is not set
-# CONFIG_OSF_PARTITION is not set
-# CONFIG_AMIGA_PARTITION is not set
-# CONFIG_ATARI_PARTITION is not set
-# CONFIG_MAC_PARTITION is not set
-# CONFIG_MSDOS_PARTITION is not set
-# CONFIG_LDM_PARTITION is not set
-# CONFIG_SGI_PARTITION is not set
-# CONFIG_ULTRIX_PARTITION is not set
-# CONFIG_SUN_PARTITION is not set
-# CONFIG_EFI_PARTITION is not set
-
-#
-# Native Language Support
-#
-# CONFIG_NLS is not set
-
-#
-# Profiling support
-#
-# CONFIG_PROFILING is not set
-
-#
-# Kernel hacking
-#
-# CONFIG_PRINTK_TIME is not set
-CONFIG_DEBUG_KERNEL=y
-# CONFIG_MAGIC_SYSRQ is not set
-CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_SCHEDSTATS is not set
-# CONFIG_DEBUG_SLAB is not set
-# CONFIG_DEBUG_SPINLOCK is not set
-# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
-# CONFIG_DEBUG_KOBJECT is not set
-CONFIG_DEBUG_BUGVERBOSE=y
-# CONFIG_DEBUG_INFO is not set
-# CONFIG_DEBUG_FS is not set
-CONFIG_FRAME_POINTER=y
-CONFIG_DEBUG_USER=y
-# CONFIG_DEBUG_WAITQ is not set
-# CONFIG_DEBUG_ERRORS is not set
-CONFIG_DEBUG_LL=y
-# CONFIG_DEBUG_ICEDCC is not set
-CONFIG_DEBUG_S3C2410_PORT=y
-CONFIG_DEBUG_S3C2410_UART=0
-
-#
-# Security options
-#
-# CONFIG_KEYS is not set
-# CONFIG_SECURITY is not set
-
-#
-# Cryptographic options
-#
-# CONFIG_CRYPTO is not set
-
-#
-# Hardware crypto devices
-#
-
-#
-# Library routines
-#
-# CONFIG_CRC_CCITT is not set
-CONFIG_CRC32=y
-CONFIG_LIBCRC32C=y
diff --git a/arch/arm/configs/versatile_defconfig b/arch/arm/configs/versatile_defconfig
index 96b7a7762426..f7bf6ef27d19 100644
--- a/arch/arm/configs/versatile_defconfig
+++ b/arch/arm/configs/versatile_defconfig
@@ -200,7 +200,7 @@ CONFIG_BINFMT_ELF=y
 # Power management options
 #
 CONFIG_PM=y
-CONFIG_PM_LEGACY=y
+# CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
 # CONFIG_APM is not set
 
diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
index da69e660574b..4779f474f911 100644
--- a/arch/arm/kernel/armksyms.c
+++ b/arch/arm/kernel/armksyms.c
@@ -178,9 +178,3 @@ EXPORT_SYMBOL(_find_next_zero_bit_be);
 EXPORT_SYMBOL(_find_first_bit_be);
 EXPORT_SYMBOL(_find_next_bit_be);
 #endif
-
-        /* syscalls */
-EXPORT_SYMBOL(sys_write);
-EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_exit);
-EXPORT_SYMBOL(sys_wait4);
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 6bbd93dd186a..29efc9f82057 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -357,6 +357,9 @@ static void __init setup_processor(void)
 #ifndef CONFIG_VFP
         elf_hwcap &= ~HWCAP_VFP;
 #endif
+#ifndef CONFIG_IWMMXT
+        elf_hwcap &= ~HWCAP_IWMMXT;
+#endif
 
         cpu_proc_init();
 }
@@ -854,6 +857,7 @@ static const char *hwcap_str[] = {
         "vfp",
         "edsp",
         "java",
+        "iwmmxt",
         NULL
 };
 
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index 421329f5e18e..a07d202143c3 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -7,6 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
@@ -19,6 +20,7 @@
 #include <linux/cpu.h>
 #include <linux/smp.h>
 #include <linux/seq_file.h>
+#include <linux/irq.h>
 
 #include <asm/atomic.h>
 #include <asm/cacheflush.h>
@@ -474,25 +476,26 @@ void show_local_irqs(struct seq_file *p)
         seq_putc(p, '\n');
 }
 
-static void ipi_timer(struct pt_regs *regs)
+static void ipi_timer(void)
 {
-        int user = user_mode(regs);
-
         irq_enter();
-        profile_tick(CPU_PROFILING, regs);
-        update_process_times(user);
+        profile_tick(CPU_PROFILING);
+        update_process_times(user_mode(get_irq_regs()));
         irq_exit();
 }
 
 #ifdef CONFIG_LOCAL_TIMERS
 asmlinkage void do_local_timer(struct pt_regs *regs)
 {
+        struct pt_regs *old_regs = set_irq_regs(regs);
         int cpu = smp_processor_id();
 
         if (local_timer_ack()) {
                 irq_stat[cpu].local_timer_irqs++;
-                ipi_timer(regs);
+                ipi_timer();
         }
+
+        set_irq_regs(old_regs);
 }
 #endif
 
@@ -551,6 +554,7 @@ asmlinkage void do_IPI(struct pt_regs *regs)
 {
         unsigned int cpu = smp_processor_id();
         struct ipi_data *ipi = &per_cpu(ipi_data, cpu);
+        struct pt_regs *old_regs = set_irq_regs(regs);
 
         ipi->ipi_count++;
 
@@ -574,7 +578,7 @@ asmlinkage void do_IPI(struct pt_regs *regs)
 
                         switch (nextmsg) {
                         case IPI_TIMER:
-                                ipi_timer(regs);
+                                ipi_timer();
                                 break;
 
                         case IPI_RESCHEDULE:
@@ -599,6 +603,8 @@ asmlinkage void do_IPI(struct pt_regs *regs)
                         }
                 } while (msgs);
         }
+
+        set_irq_regs(old_regs);
 }
 
 void smp_send_reschedule(int cpu)
diff --git a/arch/arm/kernel/time.c b/arch/arm/kernel/time.c
index c03cab5c4c79..6ff5e3ff6cb5 100644
--- a/arch/arm/kernel/time.c
+++ b/arch/arm/kernel/time.c
@@ -220,10 +220,10 @@ EXPORT_SYMBOL(leds_event);
 #ifdef CONFIG_LEDS_TIMER
 static inline void do_leds(void)
 {
-        static unsigned int count = 50;
+        static unsigned int count = HZ/2;
 
         if (--count == 0) {
-                count = 50;
+                count = HZ/2;
                 leds_event(led_timer);
         }
 }
@@ -327,13 +327,12 @@ EXPORT_SYMBOL(restore_time_delta);
  */
 void timer_tick(void)
 {
-        struct pt_regs *regs = get_irq_regs();
         profile_tick(CPU_PROFILING);
         do_leds();
         do_set_rtc();
         do_timer(1);
 #ifndef CONFIG_SMP
-        update_process_times(user_mode(regs));
+        update_process_times(user_mode(get_irq_regs()));
 #endif
 }
 
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 3ca574ee2772..a8fa75ea07a9 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -45,13 +45,7 @@ SECTIONS
                         *(.early_param.init)
                 __early_end = .;
                 __initcall_start = .;
-                        *(.initcall1.init)
-                        *(.initcall2.init)
-                        *(.initcall3.init)
-                        *(.initcall4.init)
-                        *(.initcall5.init)
-                        *(.initcall6.init)
-                        *(.initcall7.init)
+                        INITCALLS
                 __initcall_end = .;
                 __con_initcall_start = .;
                         *(.con_initcall.init)
diff --git a/arch/arm/mach-footbridge/dc21285.c b/arch/arm/mach-footbridge/dc21285.c
index fa5d4976f514..1463330ed8ee 100644
--- a/arch/arm/mach-footbridge/dc21285.c
+++ b/arch/arm/mach-footbridge/dc21285.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
+#include <linux/irq.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c
index a2c94a47b2b2..2499a7707e3c 100644
--- a/arch/arm/mach-iop32x/n2100.c
+++ b/arch/arm/mach-iop32x/n2100.c
@@ -85,7 +85,7 @@ n2100_pci_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
                 irq = IRQ_IOP32X_XINT0;
         } else if (PCI_SLOT(dev->devfn) == 2) {
                 /* RTL8110SB #2 */
-                irq = IRQ_IOP32X_XINT1;
+                irq = IRQ_IOP32X_XINT3;
         } else if (PCI_SLOT(dev->devfn) == 3) {
                 /* Sil3512 */
                 irq = IRQ_IOP32X_XINT2;
diff --git a/arch/arm/mach-ixp2000/ixdp2400.c b/arch/arm/mach-ixp2000/ixdp2400.c
index a6f14801872d..0fdd03ab36e6 100644
--- a/arch/arm/mach-ixp2000/ixdp2400.c
+++ b/arch/arm/mach-ixp2000/ixdp2400.c
@@ -133,11 +133,13 @@ static void ixdp2400_pci_postinit(void)
         struct pci_dev *dev;
 
         if (ixdp2x00_master_npu()) {
-                dev = pci_find_slot(1, IXDP2400_SLAVE_ENET_DEVFN);
+                dev = pci_get_bus_and_slot(1, IXDP2400_SLAVE_ENET_DEVFN);
                 pci_remove_bus_device(dev);
+                pci_dev_put(dev);
         } else {
-                dev = pci_find_slot(1, IXDP2400_MASTER_ENET_DEVFN);
+                dev = pci_get_bus_and_slot(1, IXDP2400_MASTER_ENET_DEVFN);
                 pci_remove_bus_device(dev);
+                pci_dev_put(dev);
 
                 ixdp2x00_slave_pci_postinit();
         }
diff --git a/arch/arm/mach-ixp2000/ixdp2800.c b/arch/arm/mach-ixp2000/ixdp2800.c
index 91d36d91dac0..70d247f09a7e 100644
--- a/arch/arm/mach-ixp2000/ixdp2800.c
+++ b/arch/arm/mach-ixp2000/ixdp2800.c
@@ -261,14 +261,16 @@ int __init ixdp2800_pci_init(void)
 
                 pci_common_init(&ixdp2800_pci);
                 if (ixdp2x00_master_npu()) {
-                        dev = pci_find_slot(1, IXDP2800_SLAVE_ENET_DEVFN);
+                        dev = pci_get_bus_and_slot(1, IXDP2800_SLAVE_ENET_DEVFN);
                         pci_remove_bus_device(dev);
+                        pci_dev_put(dev);
 
                         ixdp2800_master_enable_slave();
                         ixdp2800_master_wait_for_slave_bus_scan();
                 } else {
-                        dev = pci_find_slot(1, IXDP2800_MASTER_ENET_DEVFN);
+                        dev = pci_get_bus_and_slot(1, IXDP2800_MASTER_ENET_DEVFN);
                         pci_remove_bus_device(dev);
+                        pci_dev_put(dev);
                 }
         }
 
diff --git a/arch/arm/mach-ixp2000/ixdp2x00.c b/arch/arm/mach-ixp2000/ixdp2x00.c
index af48cb52dfc4..aa2655092d2d 100644
--- a/arch/arm/mach-ixp2000/ixdp2x00.c
+++ b/arch/arm/mach-ixp2000/ixdp2x00.c
@@ -241,11 +241,14 @@ void ixdp2x00_slave_pci_postinit(void)
         /*
          * Remove PMC device is there is one
          */
-        if((dev = pci_find_slot(1, IXDP2X00_PMC_DEVFN)))
+        if((dev = pci_get_bus_and_slot(1, IXDP2X00_PMC_DEVFN))) {
                 pci_remove_bus_device(dev);
+                pci_dev_put(dev);
+        }
 
-        dev = pci_find_slot(0, IXDP2X00_21555_DEVFN);
+        dev = pci_get_bus_and_slot(0, IXDP2X00_21555_DEVFN);
         pci_remove_bus_device(dev);
+        pci_dev_put(dev);
 }
 
 /**************************************************************************
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index c7513f6eb50c..fbe288a8da65 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -86,7 +86,8 @@ enum ixp4xx_irq_type {
         IXP4XX_IRQ_LEVEL, IXP4XX_IRQ_EDGE
 };
 
-static void ixp4xx_config_irq(unsigned irq, enum ixp4xx_irq_type type);
+/* Each bit represents an IRQ: 1: edge-triggered, 0: level triggered */
+static unsigned long long ixp4xx_irq_edge = 0;
 
 /*
  * IRQ -> GPIO mapping table
@@ -135,7 +136,11 @@ static int ixp4xx_set_irq_type(unsigned int irq, unsigned int type)
         default:
                 return -EINVAL;
         }
-        ixp4xx_config_irq(irq, irq_type);
+
+        if (irq_type == IXP4XX_IRQ_EDGE)
+                ixp4xx_irq_edge |= (1 << irq);
+        else
+                ixp4xx_irq_edge &= ~(1 << irq);
 
         if (line >= 8) {        /* pins 8-15 */
                 line -= 8;
@@ -167,14 +172,6 @@ static void ixp4xx_irq_mask(unsigned int irq)
                 *IXP4XX_ICMR &= ~(1 << irq);
 }
 
-static void ixp4xx_irq_unmask(unsigned int irq)
-{
-        if (cpu_is_ixp46x() && irq >= 32)
-                *IXP4XX_ICMR2 |= (1 << (irq - 32));
-        else
-                *IXP4XX_ICMR |= (1 << irq);
-}
-
 static void ixp4xx_irq_ack(unsigned int irq)
 {
         int line = (irq < 32) ? irq2gpio[irq] : -1;
@@ -187,41 +184,25 @@ static void ixp4xx_irq_ack(unsigned int irq)
  * Level triggered interrupts on GPIO lines can only be cleared when the
  * interrupt condition disappears.
  */
-static void ixp4xx_irq_level_unmask(unsigned int irq)
+static void ixp4xx_irq_unmask(unsigned int irq)
 {
-        ixp4xx_irq_ack(irq);
-        ixp4xx_irq_unmask(irq);
-}
+        if (!(ixp4xx_irq_edge & (1 << irq)))
+                ixp4xx_irq_ack(irq);
 
-static struct irqchip ixp4xx_irq_level_chip = {
-        .ack            = ixp4xx_irq_mask,
-        .mask           = ixp4xx_irq_mask,
-        .unmask         = ixp4xx_irq_level_unmask,
-        .set_type       = ixp4xx_set_irq_type,
-};
+        if (cpu_is_ixp46x() && irq >= 32)
+                *IXP4XX_ICMR2 |= (1 << (irq - 32));
+        else
+                *IXP4XX_ICMR |= (1 << irq);
+}
 
-static struct irqchip ixp4xx_irq_edge_chip = {
+static struct irqchip ixp4xx_irq_chip = {
+        .name           = "IXP4xx",
         .ack            = ixp4xx_irq_ack,
         .mask           = ixp4xx_irq_mask,
         .unmask         = ixp4xx_irq_unmask,
         .set_type       = ixp4xx_set_irq_type,
 };
 
-static void ixp4xx_config_irq(unsigned irq, enum ixp4xx_irq_type type)
-{
-        switch (type) {
-        case IXP4XX_IRQ_LEVEL:
-                set_irq_chip(irq, &ixp4xx_irq_level_chip);
-                set_irq_handler(irq, do_level_IRQ);
-                break;
-        case IXP4XX_IRQ_EDGE:
-                set_irq_chip(irq, &ixp4xx_irq_edge_chip);
-                set_irq_handler(irq, do_edge_IRQ);
-                break;
-        }
-        set_irq_flags(irq, IRQF_VALID);
-}
-
 void __init ixp4xx_init_irq(void)
 {
         int i = 0;
@@ -241,8 +222,11 @@ void __init ixp4xx_init_irq(void)
         }
 
         /* Default to all level triggered */
-        for(i = 0; i < NR_IRQS; i++)
-                ixp4xx_config_irq(i, IXP4XX_IRQ_LEVEL);
+        for(i = 0; i < NR_IRQS; i++) {
+                set_irq_chip(i, &ixp4xx_irq_chip);
+                set_irq_handler(i, do_level_IRQ);
+                set_irq_flags(i, IRQF_VALID);
+        }
 }
 
 
diff --git a/arch/arm/mach-lh7a40x/Kconfig b/arch/arm/mach-lh7a40x/Kconfig
index 558a34f53b1c..147b01928a9b 100644
--- a/arch/arm/mach-lh7a40x/Kconfig
+++ b/arch/arm/mach-lh7a40x/Kconfig
@@ -14,7 +14,7 @@ config MACH_LPD7A400
         bool "LPD7A400 Card Engine"
         select ARCH_LH7A400
 #       select IDE_POLL
-        select HAS_TOUCHSCREEN_ADS7843_LH7
+#       select HAS_TOUCHSCREEN_ADS7843_LH7
         help
           Say Y here if you are using Logic Product Development's
           LPD7A400 CardEngine.  For the time being, the LPD7A400 and
@@ -24,7 +24,7 @@ config MACH_LPD7A404
         bool "LPD7A404 Card Engine"
         select ARCH_LH7A404
 #       select IDE_POLL
-        select HAS_TOUCHSCREEN_ADC_LH7
+#       select HAS_TOUCHSCREEN_ADC_LH7
         help
           Say Y here if you are using Logic Product Development's
           LPD7A404 CardEngine. For the time being, the LPD7A400 and
diff --git a/arch/arm/mach-lh7a40x/common.h b/arch/arm/mach-lh7a40x/common.h
index 18e8bb4eb202..0ca20c6c83b7 100644
--- a/arch/arm/mach-lh7a40x/common.h
+++ b/arch/arm/mach-lh7a40x/common.h
@@ -15,4 +15,4 @@ extern void lh7a404_init_irq (void);
 extern void lh7a40x_clcd_init (void);
 extern void lh7a40x_init_board_irq (void);
 
-#define IRQ_DISPATCH(irq) desc_handle_irq((irq),(irq_desc + irq), regs)
+#define IRQ_DISPATCH(irq) desc_handle_irq((irq),(irq_desc + irq))
diff --git a/arch/arm/mach-pnx4008/core.c b/arch/arm/mach-pnx4008/core.c
index 3d73c1e93752..429c796938be 100644
--- a/arch/arm/mach-pnx4008/core.c
+++ b/arch/arm/mach-pnx4008/core.c
@@ -133,10 +133,79 @@ static struct platform_device serial_device = {
         },
 };
 
+static struct platform_device nand_flash_device = {
+        .name = "pnx4008-flash",
+        .id = -1,
+        .dev = {
+                .coherent_dma_mask = 0xFFFFFFFF,
+        },
+};
+
+/* The dmamask must be set for OHCI to work */
+static u64 ohci_dmamask = ~(u32) 0;
+
+static struct resource ohci_resources[] = {
+        {
+                .start = IO_ADDRESS(PNX4008_USB_CONFIG_BASE),
+                .end = IO_ADDRESS(PNX4008_USB_CONFIG_BASE + 0x100),
+                .flags = IORESOURCE_MEM,
+        }, {
+                .start = USB_HOST_INT,
+                .flags = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device ohci_device = {
+        .name = "pnx4008-usb-ohci",
+        .id = -1,
+        .dev = {
+                .dma_mask = &ohci_dmamask,
+                .coherent_dma_mask = 0xffffffff,
+                },
+        .num_resources = ARRAY_SIZE(ohci_resources),
+        .resource = ohci_resources,
+};
+
+static struct platform_device sdum_device = {
+        .name = "pnx4008-sdum",
+        .id = 0,
+        .dev = {
+                .coherent_dma_mask = 0xffffffff,
+        },
+};
+
+static struct platform_device rgbfb_device = {
+        .name = "pnx4008-rgbfb",
+        .id = 0,
+        .dev = {
+                .coherent_dma_mask = 0xffffffff,
+        }
+};
+
+struct resource watchdog_resources[] = {
+        {
+                .start = PNX4008_WDOG_BASE,
+                .end = PNX4008_WDOG_BASE + SZ_4K - 1,
+                .flags = IORESOURCE_MEM,
+        },
+};
+
+static struct platform_device watchdog_device = {
+        .name = "pnx4008-watchdog",
+        .id = -1,
+        .num_resources = ARRAY_SIZE(watchdog_resources),
+        .resource = watchdog_resources,
+};
+
 static struct platform_device *devices[] __initdata = {
         &spipnx_1,
         &spipnx_2,
         &serial_device,
+        &ohci_device,
+        &nand_flash_device,
+        &sdum_device,
+        &rgbfb_device,
+        &watchdog_device,
 };
 
 
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index ee80d62119d3..142c33c3dff5 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -397,7 +397,7 @@ static void lubbock_mmc_poll(unsigned long data)
         if (LUB_IRQ_SET_CLR & (1 << 0))
                 mod_timer(&mmc_timer, jiffies + MMC_POLL_RATE);
         else {
-                (void) mmc_detect_int(LUBBOCK_SD_IRQ, (void *)data, NULL);
+                (void) mmc_detect_int(LUBBOCK_SD_IRQ, (void *)data);
                 enable_irq(LUBBOCK_SD_IRQ);
         }
 }
diff --git a/arch/arm/mach-s3c2410/gpio.c b/arch/arm/mach-s3c2410/gpio.c
index db6393c99860..ba346546150b 100644
--- a/arch/arm/mach-s3c2410/gpio.c
+++ b/arch/arm/mach-s3c2410/gpio.c
@@ -3,7 +3,7 @@
  * Copyright (c) 2004-2005 Simtec Electronics
  *      Ben Dooks <ben@simtec.co.uk>
  *
- * S3C2410 GPIO support
+ * S3C24XX GPIO support
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -163,3 +163,22 @@ unsigned int s3c2410_modify_misccr(unsigned int clear, unsigned int change)
 }
 
 EXPORT_SYMBOL(s3c2410_modify_misccr);
+
+int s3c2410_gpio_getirq(unsigned int pin)
+{
+        if (pin < S3C2410_GPF0 || pin > S3C2410_GPG15)
+                return -1;      /* not valid interrupts */
+
+        if (pin < S3C2410_GPG0 && pin > S3C2410_GPF7)
+                return -1;      /* not valid pin */
+
+        if (pin < S3C2410_GPF4)
+                return (pin - S3C2410_GPF0) + IRQ_EINT0;
+
+        if (pin < S3C2410_GPG0)
+                return (pin - S3C2410_GPF4) + IRQ_EINT4;
+
+        return (pin - S3C2410_GPG0) + IRQ_EINT8;
+}
+
+EXPORT_SYMBOL(s3c2410_gpio_getirq);
diff --git a/arch/arm/mach-s3c2410/s3c2410-gpio.c b/arch/arm/mach-s3c2410/s3c2410-gpio.c
index a2098f692d83..ec3a276cc3cf 100644
--- a/arch/arm/mach-s3c2410/s3c2410-gpio.c
+++ b/arch/arm/mach-s3c2410/s3c2410-gpio.c
@@ -69,22 +69,3 @@ int s3c2410_gpio_irqfilter(unsigned int pin, unsigned int on,
 }
 
 EXPORT_SYMBOL(s3c2410_gpio_irqfilter);
-
-int s3c2410_gpio_getirq(unsigned int pin)
-{
-        if (pin < S3C2410_GPF0 || pin > S3C2410_GPG15)
-                return -1;      /* not valid interrupts */
-
-        if (pin < S3C2410_GPG0 && pin > S3C2410_GPF7)
-                return -1;      /* not valid pin */
-
-        if (pin < S3C2410_GPF4)
-                return (pin - S3C2410_GPF0) + IRQ_EINT0;
-
-        if (pin < S3C2410_GPG0)
-                return (pin - S3C2410_GPF4) + IRQ_EINT4;
-
-        return (pin - S3C2410_GPG0) + IRQ_EINT8;
-}
-
-EXPORT_SYMBOL(s3c2410_gpio_getirq);
diff --git a/arch/arm/mach-sa1100/cpu-sa1110.c b/arch/arm/mach-sa1100/cpu-sa1110.c
index 639597729932..78f4c1346044 100644
--- a/arch/arm/mach-sa1100/cpu-sa1110.c
+++ b/arch/arm/mach-sa1100/cpu-sa1110.c
@@ -82,6 +82,14 @@ static struct sdram_params sdram_tbl[] __initdata = {
                 .twr            = 9,
                 .refresh        = 64000,
                 .cas_latency    = 3,
+        }, {    /* Samsung K4S281632B-1H */
+                .name           = "K4S281632B-1H",
+                .rows           = 12,
+                .tck            = 10,
+                .trp            = 20,
+                .twr            = 10,
+                .refresh        = 64000,
+                .cas_latency    = 3,
         }, {    /* Samsung KM416S4030CT */
                 .name           = "KM416S4030CT",
                 .rows           = 13,
@@ -366,6 +374,8 @@ static int __init sa1110_clk_init(void)
 
                 if (machine_is_h3100())
                         name = "KM416S4030CT";
+                if (machine_is_jornada720())
+                        name = "K4S281632B-1H";
         }
 
         sdram = sa1110_find_sdram(name);
diff --git a/arch/arm/mach-versatile/core.c b/arch/arm/mach-versatile/core.c
index 2aa150b57ba1..3b8576111c16 100644
--- a/arch/arm/mach-versatile/core.c
+++ b/arch/arm/mach-versatile/core.c
@@ -188,12 +188,12 @@ static struct map_desc versatile_io_desc[] __initdata = {
                 .length         = SZ_4K,
                 .type           = MT_DEVICE
         }, {
-                .virtual        =  VERSATILE_PCI_VIRT_BASE,
+                .virtual        =  (unsigned long)VERSATILE_PCI_VIRT_BASE,
                 .pfn            = __phys_to_pfn(VERSATILE_PCI_BASE),
                 .length         = VERSATILE_PCI_BASE_SIZE,
                 .type           = MT_DEVICE
         }, {
-                .virtual        =  VERSATILE_PCI_CFG_VIRT_BASE,
+                .virtual        =  (unsigned long)VERSATILE_PCI_CFG_VIRT_BASE,
                 .pfn            = __phys_to_pfn(VERSATILE_PCI_CFG_BASE),
                 .length         = VERSATILE_PCI_CFG_BASE_SIZE,
                 .type           = MT_DEVICE
diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
index 13bbd08ff841..5cd0b5d9e7eb 100644
--- a/arch/arm/mach-versatile/pci.c
+++ b/arch/arm/mach-versatile/pci.c
@@ -40,14 +40,15 @@
  * Cfg   42000000 - 42FFFFFF      PCI config
  *
  */
-#define SYS_PCICTL                      IO_ADDRESS(VERSATILE_SYS_PCICTL)
-#define PCI_IMAP0                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
-#define PCI_IMAP1                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
-#define PCI_IMAP2                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
-#define PCI_SMAP0                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
-#define PCI_SMAP1                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
-#define PCI_SMAP2                       IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
-#define PCI_SELFID                      IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
+#define __IO_ADDRESS(n) ((void __iomem *)(unsigned long)IO_ADDRESS(n))
+#define SYS_PCICTL              __IO_ADDRESS(VERSATILE_SYS_PCICTL)
+#define PCI_IMAP0               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
+#define PCI_IMAP1               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
+#define PCI_IMAP2               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
+#define PCI_SMAP0               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
+#define PCI_SMAP1               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
+#define PCI_SMAP2               __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
+#define PCI_SELFID              __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
 
 #define DEVICE_ID_OFFSET                0x00
 #define CSR_OFFSET                      0x04
@@ -76,7 +77,7 @@ static int __init versatile_pci_slot_ignore(char *str)
 __setup("pci_slot_ignore=", versatile_pci_slot_ignore);
 
 
-static unsigned long __pci_addr(struct pci_bus *bus,
+static void __iomem *__pci_addr(struct pci_bus *bus,
                                 unsigned int devfn, int offset)
 {
         unsigned int busnr = bus->number;
@@ -91,14 +92,14 @@ static unsigned long __pci_addr(struct pci_bus *bus,
         if (devfn > 255)
                 BUG();
 
-        return (VERSATILE_PCI_CFG_VIRT_BASE | (busnr << 16) |
+        return VERSATILE_PCI_CFG_VIRT_BASE + ((busnr << 16) |
                 (PCI_SLOT(devfn) << 11) | (PCI_FUNC(devfn) << 8) | offset);
 }
 
 static int versatile_read_config(struct pci_bus *bus, unsigned int devfn, int where,
                                  int size, u32 *val)
 {
-        unsigned long addr = __pci_addr(bus, devfn, where);
+        void __iomem *addr = __pci_addr(bus, devfn, where & ~3);
         u32 v;
         int slot = PCI_SLOT(devfn);
 
@@ -121,13 +122,12 @@ static int versatile_read_config(struct pci_bus *bus, unsigned int devfn, int wh
                         break;
 
                 case 2:
-                        v = __raw_readl(addr & ~3);
-                        if (addr & 2) v >>= 16;
+                        v = __raw_readl(addr);
+                        if (where & 2) v >>= 16;
                         v &= 0xffff;
                         break;
 
                 default:
-                        addr &= ~3;
                         v = __raw_readl(addr);
                         break;
                 }
@@ -140,7 +140,7 @@ static int versatile_read_config(struct pci_bus *bus, unsigned int devfn, int wh
 static int versatile_write_config(struct pci_bus *bus, unsigned int devfn, int where,
                                   int size, u32 val)
 {
-        unsigned long addr = __pci_addr(bus, devfn, where);
+        void __iomem *addr = __pci_addr(bus, devfn, where);
         int slot = PCI_SLOT(devfn);
 
         if (pci_slot_ignore & (1 << slot)) {
@@ -279,7 +279,7 @@ int __init pci_versatile_setup(int nr, struct pci_sys_data *sys)
         printk("PCI core found (slot %d)\n",myslot);
 
         __raw_writel(myslot, PCI_SELFID);
-        local_pci_cfg_base = (void *) VERSATILE_PCI_CFG_VIRT_BASE + (myslot << 11);
+        local_pci_cfg_base = VERSATILE_PCI_CFG_VIRT_BASE + (myslot << 11);
 
         val = __raw_readl(local_pci_cfg_base + CSR_OFFSET);
         val |= PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER | PCI_COMMAND_INVALIDATE;
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 22217fe2650b..b5814b4b6f35 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -32,40 +32,51 @@ extern unsigned long phys_initrd_start;
 extern unsigned long phys_initrd_size;
 
 /*
- * The sole use of this is to pass memory configuration
- * data from paging_init to mem_init.
+ * This is used to pass memory configuration data from paging_init
+ * to mem_init, and by show_mem() to skip holes in the memory map.
  */
-static struct meminfo meminfo __initdata = { 0, };
+static struct meminfo meminfo = { 0, };
+
+#define for_each_nodebank(iter,mi,no)                   \
+        for (iter = 0; iter < mi->nr_banks; iter++)     \
+                if (mi->bank[iter].node == no)
 
 void show_mem(void)
 {
         int free = 0, total = 0, reserved = 0;
-        int shared = 0, cached = 0, slab = 0, node;
+        int shared = 0, cached = 0, slab = 0, node, i;
+        struct meminfo * mi = &meminfo;
 
         printk("Mem-info:\n");
         show_free_areas();
         printk("Free swap:       %6ldkB\n", nr_swap_pages<<(PAGE_SHIFT-10));
 
         for_each_online_node(node) {
-                struct page *page, *end;
-
-                page = NODE_MEM_MAP(node);
-                end  = page + NODE_DATA(node)->node_spanned_pages;
-
-                do {
-                        total++;
-                        if (PageReserved(page))
-                                reserved++;
-                        else if (PageSwapCache(page))
-                                cached++;
-                        else if (PageSlab(page))
-                                slab++;
-                        else if (!page_count(page))
-                                free++;
-                        else
-                                shared += page_count(page) - 1;
-                        page++;
-                } while (page < end);
+                for_each_nodebank (i,mi,node) {
+                        unsigned int pfn1, pfn2;
+                        struct page *page, *end;
+
+                        pfn1 = mi->bank[i].start >> PAGE_SHIFT;
+                        pfn2 = (mi->bank[i].size + mi->bank[i].start) >> PAGE_SHIFT;
+
+                        page = NODE_MEM_MAP(node) + pfn1;
+                        end  = NODE_MEM_MAP(node) + pfn2;
+
+                        do {
+                                total++;
+                                if (PageReserved(page))
+                                        reserved++;
+                                else if (PageSwapCache(page))
+                                        cached++;
+                                else if (PageSlab(page))
+                                        slab++;
+                                else if (!page_count(page))
+                                        free++;
+                                else
+                                        shared += page_count(page) - 1;
+                                page++;
+                        } while (page < end);
+                }
         }
 
         printk("%d pages of RAM\n", total);
@@ -76,10 +87,6 @@ void show_mem(void)
         printk("%d pages swap cached\n", cached);
 }
 
-#define for_each_nodebank(iter,mi,no)                   \
-        for (iter = 0; iter < mi->nr_banks; iter++)     \
-                if (mi->bank[iter].node == no)
-
 /*
  * FIXME: We really want to avoid allocating the bootmap bitmap
  * over the top of the initrd.  Hopefully, this is located towards
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index e8b377d637f6..2749c1f88d7d 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -909,7 +909,7 @@ __pxa270_proc_info:
         b       __xscale_setup
         .long   cpu_arch_name
         .long   cpu_elf_name
-        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP
+        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_IWMMXT
         .long   cpu_pxa270_name
         .long   xscale_processor_functions
         .long   v4wbi_tlb_fns
diff --git a/arch/arm/oprofile/op_counter.h b/arch/arm/oprofile/op_counter.h
index 8c5351d751cf..ca942a63b52f 100644
--- a/arch/arm/oprofile/op_counter.h
+++ b/arch/arm/oprofile/op_counter.h
@@ -10,8 +10,6 @@
 #ifndef OP_COUNTER_H
 #define OP_COUNTER_H
 
-#define OP_MAX_COUNTER 5
-
 /* Per performance monitor configuration as set via
  * oprofilefs.
  */
diff --git a/arch/arm/oprofile/op_model_xscale.c b/arch/arm/oprofile/op_model_xscale.c
index 7899d3ca75a3..7c3289c2acd7 100644
--- a/arch/arm/oprofile/op_model_xscale.c
+++ b/arch/arm/oprofile/op_model_xscale.c
@@ -20,7 +20,8 @@
 #include <linux/sched.h>
 #include <linux/oprofile.h>
 #include <linux/interrupt.h>
-#include <asm/irq.h>
+#include <linux/irq.h>
+
 #include <asm/system.h>
 
 #include "op_counter.h"
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index b02af1d740fa..579c69ae9ff7 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -4,7 +4,7 @@
 #
 # Up to date versions of this file can be obtained from:
 #
-#   http://www.arm.linux.org.uk/developer/machines/?action=download
+#   http://www.arm.linux.org.uk/developer/machines/download.php
 #
 # Please do not send patches to this file; it is automatically generated!
 # To add an entry into this database, please see Documentation/arm/README,
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Sat Sep 23 13:20:43 2006
+# Last update: Mon Oct 16 21:13:36 2006
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -1157,3 +1157,17 @@ adsturboxb		MACH_ADSTURBOXB		ADSTURBOXB		1143
 oti4110                 MACH_OTI4110            OTI4110                 1144
 hme_pxa                 MACH_HME_PXA            HME_PXA                 1145
 deisterdca              MACH_DEISTERDCA         DEISTERDCA              1146
+ces_ssem2               MACH_CES_SSEM2          CES_SSEM2               1147
+ces_mtr                 MACH_CES_MTR            CES_MTR                 1148
+tds_avng_sbc            MACH_TDS_AVNG_SBC       TDS_AVNG_SBC            1149
+everest                 MACH_EVEREST            EVEREST                 1150
+pnx4010                 MACH_PNX4010            PNX4010                 1151
+oxnas                   MACH_OXNAS              OXNAS                   1152
+fiori                   MACH_FIORI              FIORI                   1153
+ml1200                  MACH_ML1200             ML1200                  1154
+cactus                  MACH_CACTUS             CACTUS                  1155
+nb2xxx                  MACH_NB2XXX             NB2XXX                  1156
+hw6900                  MACH_HW6900             HW6900                  1157
+cdcs_quoll              MACH_CDCS_QUOLL         CDCS_QUOLL              1158
+quicksilver             MACH_QUICKSILVER        QUICKSILVER             1159
+uplat926                MACH_UPLAT926           UPLAT926                1160
diff --git a/arch/arm/vfp/vfpdouble.c b/arch/arm/vfp/vfpdouble.c
index 4fc05ee0a2ef..e44b9ed0f81f 100644
--- a/arch/arm/vfp/vfpdouble.c
+++ b/arch/arm/vfp/vfpdouble.c
@@ -56,7 +56,7 @@ static void vfp_double_normalise_denormal(struct vfp_double *vd)
 {
         int bits = 31 - fls(vd->significand >> 32);
         if (bits == 31)
-                bits = 62 - fls(vd->significand);
+                bits = 63 - fls(vd->significand);
 
         vfp_double_dump("normalise_denormal: in", vd);
 
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index dedbb449632e..f08eafbddcc1 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -90,7 +90,7 @@ void vfp_raise_sigfpe(unsigned int sicode, struct pt_regs *regs)
 
         info.si_signo = SIGFPE;
         info.si_code = sicode;
-        info.si_addr = (void *)(instruction_pointer(regs) - 4);
+        info.si_addr = (void __user *)(instruction_pointer(regs) - 4);
 
         /*
          * This is the same as NWFPE, because it's not clear what
@@ -148,6 +148,7 @@ static void vfp_raise_exceptions(u32 exceptions, u32 inst, u32 fpscr, struct pt_
         /*
          * These are arranged in priority order, least to highest.
          */
+        RAISE(FPSCR_DZC, FPSCR_DZE, FPE_FLTDIV);
         RAISE(FPSCR_IXC, FPSCR_IXE, FPE_FLTRES);
         RAISE(FPSCR_UFC, FPSCR_UFE, FPE_FLTUND);
         RAISE(FPSCR_OFC, FPSCR_OFE, FPE_FLTOVF);
diff --git a/arch/arm26/kernel/armksyms.c b/arch/arm26/kernel/armksyms.c
index 07907b6ecb63..93293d04b303 100644
--- a/arch/arm26/kernel/armksyms.c
+++ b/arch/arm26/kernel/armksyms.c
@@ -202,14 +202,6 @@ EXPORT_SYMBOL(_find_next_zero_bit_le);
 EXPORT_SYMBOL(elf_platform);
 EXPORT_SYMBOL(elf_hwcap);
 
-        /* syscalls */
-EXPORT_SYMBOL(sys_write);
-EXPORT_SYMBOL(sys_read);
-EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_open);
-EXPORT_SYMBOL(sys_exit);
-EXPORT_SYMBOL(sys_wait4);
-
 #ifdef CONFIG_PREEMPT
 EXPORT_SYMBOL(kernel_flag);
 #endif
diff --git a/arch/avr32/Makefile b/arch/avr32/Makefile
index cefc95a73980..7b842e98efed 100644
--- a/arch/avr32/Makefile
+++ b/arch/avr32/Makefile
@@ -7,7 +7,7 @@
 
 # Default target when executing plain make
 .PHONY: all
-all: uImage vmlinux.elf linux.lst
+all: uImage vmlinux.elf
 
 KBUILD_DEFCONFIG        := atstk1002_defconfig
 
@@ -21,9 +21,7 @@ cpuflags-$(CONFIG_CPU_AP7000)	+= -mcpu=ap7000
 CFLAGS          += $(cpuflags-y)
 AFLAGS          += $(cpuflags-y)
 
-CHECKFLAGS      += -D__avr32__
-
-LIBGCC          := $(shell $(CC) $(CFLAGS) -print-libgcc-file-name)
+CHECKFLAGS      += -D__avr32__ -D__BIG_ENDIAN
 
 head-$(CONFIG_LOADER_U_BOOT)            += arch/avr32/boot/u-boot/head.o
 head-y                                  += arch/avr32/kernel/head.o
@@ -32,7 +30,7 @@ core-$(CONFIG_BOARD_ATSTK1000)		+= arch/avr32/boards/atstk1000/
 core-$(CONFIG_LOADER_U_BOOT)            += arch/avr32/boot/u-boot/
 core-y                                  += arch/avr32/kernel/
 core-y                                  += arch/avr32/mm/
-libs-y                                  += arch/avr32/lib/ #$(LIBGCC)
+libs-y                                  += arch/avr32/lib/
 
 archincdir-$(CONFIG_PLATFORM_AT32AP)    := arch-at32ap
 
@@ -48,6 +46,8 @@ endif
 
 archprepare: include/asm-avr32/.arch
 
+CLEAN_FILES += include/asm-avr32/.arch include/asm-avr32/arch
+
 BOOT_TARGETS := vmlinux.elf vmlinux.bin uImage uImage.srec
 
 .PHONY: $(BOOT_TARGETS) install
@@ -71,14 +71,19 @@ vmlinux.elf vmlinux.bin uImage.srec uImage vmlinux.cso: vmlinux
 install: vmlinux
         $(Q)$(MAKE) $(build)=$(boot) BOOTIMAGE=$(KBUILD_IMAGE) $@
 
-linux.s: vmlinux
+vmlinux.s: vmlinux
         $(call if_changed,disasm)
 
-linux.lst: vmlinux
+vmlinux.lst: vmlinux
         $(call if_changed,listing)
 
+CLEAN_FILES += vmlinux.s vmlinux.lst
+
+archclean:
+        $(Q)$(MAKE) $(clean)=$(boot)
+
 define archhelp
   @echo '* vmlinux.elf          - ELF image with load address 0'
   @echo '  vmlinux.cso          - PathFinder CSO image'
-  @echo '  uImage               - Create a bootable image for U-Boot'
+  @echo '* uImage               - Create a bootable image for U-Boot'
 endef
diff --git a/arch/avr32/boards/atstk1000/setup.c b/arch/avr32/boards/atstk1000/setup.c
index 191ab85de9a3..272c011802a7 100644
--- a/arch/avr32/boards/atstk1000/setup.c
+++ b/arch/avr32/boards/atstk1000/setup.c
@@ -21,15 +21,6 @@ struct tag *bootloader_tags __initdata;
 
 struct lcdc_platform_data __initdata atstk1000_fb0_data;
 
-asmlinkage void __init board_early_init(void)
-{
-        extern void sdram_init(void);
-
-#ifdef CONFIG_LOADER_STANDALONE
-        sdram_init();
-#endif
-}
-
 void __init board_setup_fbmem(unsigned long fbmem_start,
                               unsigned long fbmem_size)
 {
diff --git a/arch/avr32/boot/images/Makefile b/arch/avr32/boot/images/Makefile
index ccd74eeecec3..219720a47bf9 100644
--- a/arch/avr32/boot/images/Makefile
+++ b/arch/avr32/boot/images/Makefile
@@ -37,14 +37,12 @@ OBJCOPYFLAGS_vmlinux.elf := --change-section-lma .text-0x80000000 \
                             --change-section-lma .data-0x80000000 \
                             --change-section-lma .init-0x80000000 \
                             --change-section-lma .bss-0x80000000 \
-                            --change-section-lma .initrd-0x80000000 \
                             --change-section-lma __param-0x80000000 \
                             --change-section-lma __ksymtab-0x80000000 \
                             --change-section-lma __ksymtab_gpl-0x80000000 \
                             --change-section-lma __kcrctab-0x80000000 \
                             --change-section-lma __kcrctab_gpl-0x80000000 \
                             --change-section-lma __ksymtab_strings-0x80000000 \
-                            --change-section-lma .got-0x80000000 \
                             --set-start 0xa0000000
 $(obj)/vmlinux.elf: vmlinux FORCE
         $(call if_changed,objcopy)
@@ -59,4 +57,4 @@ install: $(BOOTIMAGE)
         sh $(srctree)/install-kernel.sh $<
 
 # Generated files to be removed upon make clean
-clean-files     := vmlinux* uImage uImage.srec
+clean-files     := vmlinux.elf vmlinux.bin vmlinux.gz uImage uImage.srec
diff --git a/arch/avr32/configs/atstk1002_defconfig b/arch/avr32/configs/atstk1002_defconfig
index 6c2c5e00dfc7..ae92a14ef9a0 100644
--- a/arch/avr32/configs/atstk1002_defconfig
+++ b/arch/avr32/configs/atstk1002_defconfig
@@ -1,13 +1,14 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Tue Jul 11 12:41:36 2006
+# Linux kernel version: 2.6.19-rc2
+# Fri Oct 20 11:52:37 2006
 #
 CONFIG_AVR32=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_HARDIRQS_SW_RESEND=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
@@ -25,16 +26,23 @@ CONFIG_INIT_ENV_ARG_LIMIT=32
 CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SWAP=y
-# CONFIG_SYSVIPC is not set
-# CONFIG_POSIX_MQUEUE is not set
-# CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
-# CONFIG_AUDIT is not set
+CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
+CONFIG_POSIX_MQUEUE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+# CONFIG_UTS_NS is not set
+CONFIG_AUDIT=y
 # CONFIG_IKCONFIG is not set
-# CONFIG_RELAY is not set
+CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_TASK_XACCT is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -43,14 +51,15 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 # CONFIG_BASE_FULL is not set
-# CONFIG_FUTEX is not set
-# CONFIG_EPOLL is not set
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-# CONFIG_SLAB is not set
-# CONFIG_VM_EVENT_COUNTERS is not set
+CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=1
-CONFIG_SLOB=y
+# CONFIG_SLOB is not set
 
 #
 # Loadable module support
@@ -65,6 +74,7 @@ CONFIG_MODULE_UNLOAD=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
@@ -166,10 +176,12 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_TUNNEL is not set
 # CONFIG_INET_XFRM_MODE_TRANSPORT is not set
 # CONFIG_INET_XFRM_MODE_TUNNEL is not set
+# CONFIG_INET_XFRM_MODE_BEET is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -199,7 +211,6 @@ CONFIG_TCP_CONG_BIC=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -212,7 +223,6 @@ CONFIG_TCP_CONG_BIC=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NET_TCPPROBE is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -239,7 +249,84 @@ CONFIG_STANDALONE=y
 #
 # Memory Technology Devices (MTD)
 #
-# CONFIG_MTD is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+# CONFIG_MTD_CONCAT is not set
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_REDBOOT_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+CONFIG_MTD_BLOCK=y
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+# CONFIG_MTD_JEDECPROBE is not set
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+# CONFIG_MTD_OBSOLETE_CHIPS is not set
+
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_START=0x8000000
+CONFIG_MTD_PHYSMAP_LEN=0x0
+CONFIG_MTD_PHYSMAP_BANKWIDTH=2
+# CONFIG_MTD_PLATRAM is not set
+
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+
+#
+# NAND Flash Device Drivers
+#
+# CONFIG_MTD_NAND is not set
+
+#
+# OneNAND Flash Device Drivers
+#
+# CONFIG_MTD_ONENAND is not set
 
 #
 # Parallel port support
@@ -260,11 +347,18 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=m
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 # CONFIG_IDE is not set
@@ -274,6 +368,12 @@ CONFIG_BLK_DEV_INITRD=y
 #
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
+# CONFIG_SCSI_NETLINK is not set
+
+#
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+# CONFIG_ATA is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -305,14 +405,11 @@ CONFIG_TUN=m
 #
 # PHY device support
 #
-# CONFIG_PHYLIB is not set
 
 #
 # Ethernet (10 or 100Mbit)
 #
-CONFIG_NET_ETHERNET=y
-CONFIG_MII=y
-CONFIG_MACB=y
+# CONFIG_NET_ETHERNET is not set
 
 #
 # Ethernet (1000 Mbit)
@@ -341,10 +438,11 @@ CONFIG_PPP=m
 CONFIG_PPP_ASYNC=m
 # CONFIG_PPP_SYNC_TTY is not set
 CONFIG_PPP_DEFLATE=m
-# CONFIG_PPP_BSDCOMP is not set
+CONFIG_PPP_BSDCOMP=m
 # CONFIG_PPP_MPPE is not set
 # CONFIG_PPPOE is not set
 # CONFIG_SLIP is not set
+CONFIG_SLHC=m
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -417,7 +515,6 @@ CONFIG_UNIX98_PTYS=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -427,23 +524,13 @@ CONFIG_UNIX98_PTYS=y
 #
 # SPI support
 #
-CONFIG_SPI=y
-# CONFIG_SPI_DEBUG is not set
-CONFIG_SPI_MASTER=y
-
-#
-# SPI Master Controller Drivers
-#
-CONFIG_SPI_ATMEL=m
-# CONFIG_SPI_BITBANG is not set
-
-#
-# SPI Protocol Masters
-#
+# CONFIG_SPI is not set
+# CONFIG_SPI_MASTER is not set
 
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -452,14 +539,9 @@ CONFIG_SPI_ATMEL=m
 # CONFIG_HWMON_VID is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -470,28 +552,8 @@ CONFIG_VIDEO_V4L2=y
 # Graphics support
 #
 # CONFIG_FIRMWARE_EDID is not set
-CONFIG_FB=m
-CONFIG_FB_CFB_FILLRECT=m
-CONFIG_FB_CFB_COPYAREA=m
-CONFIG_FB_CFB_IMAGEBLIT=m
-# CONFIG_FB_MACMODES is not set
-# CONFIG_FB_BACKLIGHT is not set
-# CONFIG_FB_MODE_HELPERS is not set
-# CONFIG_FB_TILEBLITTING is not set
-CONFIG_FB_SIDSA=m
-CONFIG_FB_SIDSA_DEFAULT_BPP=24
-# CONFIG_FB_S1D13XXX is not set
-# CONFIG_FB_VIRTUAL is not set
-
-#
-# Logo configuration
-#
-# CONFIG_LOGO is not set
-CONFIG_BACKLIGHT_LCD_SUPPORT=y
-# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
-CONFIG_LCD_CLASS_DEVICE=m
-CONFIG_LCD_DEVICE=y
-CONFIG_LCD_LTV350QV=m
+# CONFIG_FB is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -561,18 +623,21 @@ CONFIG_LCD_LTV350QV=m
 #
 # File systems
 #
-CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS=m
 # CONFIG_EXT2_FS_XATTR is not set
 # CONFIG_EXT2_FS_XIP is not set
 # CONFIG_EXT3_FS is not set
+# CONFIG_EXT4DEV_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 CONFIG_MINIX_FS=m
-CONFIG_ROMFS_FS=m
-# CONFIG_INOTIFY is not set
+# CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
 # CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
@@ -600,8 +665,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 CONFIG_CONFIGFS_FS=m
@@ -616,6 +683,16 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_JFFS_FS is not set
+CONFIG_JFFS2_FS=y
+CONFIG_JFFS2_FS_DEBUG=0
+CONFIG_JFFS2_FS_WRITEBUFFER=y
+# CONFIG_JFFS2_SUMMARY is not set
+# CONFIG_JFFS2_FS_XATTR is not set
+# CONFIG_JFFS2_COMPRESSION_OPTIONS is not set
+CONFIG_JFFS2_ZLIB=y
+CONFIG_JFFS2_RTIME=y
+# CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_HPFS_FS is not set
@@ -626,26 +703,10 @@ CONFIG_CONFIGFS_FS=m
 #
 # Network File Systems
 #
-CONFIG_NFS_FS=y
-CONFIG_NFS_V3=y
-# CONFIG_NFS_V3_ACL is not set
-# CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
+# CONFIG_NFS_FS is not set
 # CONFIG_NFSD is not set
-CONFIG_ROOT_NFS=y
-CONFIG_LOCKD=y
-CONFIG_LOCKD_V4=y
-CONFIG_NFS_COMMON=y
-CONFIG_SUNRPC=y
-# CONFIG_RPCSEC_GSS_KRB5 is not set
-# CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
-CONFIG_CIFS=m
-# CONFIG_CIFS_STATS is not set
-# CONFIG_CIFS_WEAK_PW_HASH is not set
-# CONFIG_CIFS_XATTR is not set
-# CONFIG_CIFS_DEBUG2 is not set
-# CONFIG_CIFS_EXPERIMENTAL is not set
+# CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -665,7 +726,7 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 CONFIG_NLS_CODEPAGE_437=m
 # CONFIG_NLS_CODEPAGE_737 is not set
 # CONFIG_NLS_CODEPAGE_775 is not set
-CONFIG_NLS_CODEPAGE_850=m
+# CONFIG_NLS_CODEPAGE_850 is not set
 # CONFIG_NLS_CODEPAGE_852 is not set
 # CONFIG_NLS_CODEPAGE_855 is not set
 # CONFIG_NLS_CODEPAGE_857 is not set
@@ -705,13 +766,17 @@ CONFIG_NLS_UTF8=m
 # Kernel hacking
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
-CONFIG_PRINTK_TIME=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_RWSEMS is not set
@@ -722,11 +787,13 @@ CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
 # CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
-CONFIG_KPROBES=y
+# CONFIG_KPROBES is not set
 
 #
 # Security options
@@ -740,15 +807,13 @@ CONFIG_KPROBES=y
 # CONFIG_CRYPTO is not set
 
 #
-# Hardware crypto devices
-#
-
-#
 # Library routines
 #
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
-CONFIG_CRC32=m
+CONFIG_CRC32=y
 # CONFIG_LIBCRC32C is not set
-CONFIG_ZLIB_INFLATE=m
-CONFIG_ZLIB_DEFLATE=m
+CONFIG_AUDIT_GENERIC=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_PLIST=y
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index 04f767a272b7..372e3f8b2417 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -7,6 +7,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/io.h>
 #include <linux/module.h>
 
 #include <asm/checksum.h>
@@ -53,3 +54,11 @@ EXPORT_SYMBOL(find_next_zero_bit);
 EXPORT_SYMBOL(find_first_bit);
 EXPORT_SYMBOL(find_next_bit);
 EXPORT_SYMBOL(generic_find_next_zero_le_bit);
+
+/* I/O primitives (lib/io-*.S) */
+EXPORT_SYMBOL(__raw_readsb);
+EXPORT_SYMBOL(__raw_readsw);
+EXPORT_SYMBOL(__raw_readsl);
+EXPORT_SYMBOL(__raw_writesb);
+EXPORT_SYMBOL(__raw_writesw);
+EXPORT_SYMBOL(__raw_writesl);
diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
index 773b7ad87be9..6163bd0acb95 100644
--- a/arch/avr32/kernel/head.S
+++ b/arch/avr32/kernel/head.S
@@ -30,9 +30,6 @@ kernel_entry:
         mov     r7, 0
 #endif
 
-        /* Set up the PIO, SDRAM controller, early printk, etc. */
-        rcall   board_early_init
-
         /* Start the show */
         lddpc   pc, kernel_start_addr
 
diff --git a/arch/avr32/kernel/kprobes.c b/arch/avr32/kernel/kprobes.c
index 6caf9e8d8080..ca41fc1edbe1 100644
--- a/arch/avr32/kernel/kprobes.c
+++ b/arch/avr32/kernel/kprobes.c
@@ -109,7 +109,7 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
         void *addr = (void *)regs->pc;
         int ret = 0;
 
-        pr_debug("kprobe_handler: kprobe_running=%d\n",
+        pr_debug("kprobe_handler: kprobe_running=%p\n",
                  kprobe_running());
 
         /*
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index dfc32f2817b6..b599eae64576 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -263,7 +263,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                          * value of PC.  Just subtract the value of
                          * GOT, and we're done.
                          */
-                        pr_debug("GOTPC: PC=0x%lx, got_offset=0x%lx, core=0x%p\n",
+                        pr_debug("GOTPC: PC=0x%x, got_offset=0x%lx, core=0x%p\n",
                                  relocation, module->arch.got_offset,
                                  module->module_core);
                         relocation -= ((unsigned long)module->module_core
@@ -282,7 +282,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
                             && (relocation & 0xffff0000) != 0xffff0000)
                                 return reloc_overflow(module, "R_AVR32_GOT16S",
                                                       relocation);
-                        pr_debug("GOT reloc @ 0x%lx -> %lu\n",
+                        pr_debug("GOT reloc @ 0x%x -> %u\n",
                                  rel->r_offset, relocation);
                         value = *location;
                         value = ((value & 0xffff0000)
diff --git a/arch/avr32/kernel/ptrace.c b/arch/avr32/kernel/ptrace.c
index 3c89e59029ab..f2e81cd79002 100644
--- a/arch/avr32/kernel/ptrace.c
+++ b/arch/avr32/kernel/ptrace.c
@@ -157,7 +157,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
         unsigned long tmp;
         int ret;
 
-        pr_debug("arch_ptrace(%ld, %ld, %#lx, %#lx)\n",
+        pr_debug("arch_ptrace(%ld, %d, %#lx, %#lx)\n",
                  request, child->pid, addr, data);
 
         pr_debug("ptrace: Enabling monitor mode...\n");
diff --git a/arch/avr32/kernel/syscall-stubs.S b/arch/avr32/kernel/syscall-stubs.S
index 7589a9b426cb..890286a1e62b 100644
--- a/arch/avr32/kernel/syscall-stubs.S
+++ b/arch/avr32/kernel/syscall-stubs.S
@@ -100,3 +100,12 @@ __sys_splice:
         rcall   sys_splice
         sub     sp, -4
         popm    pc
+
+        .global __sys_epoll_pwait
+        .type   __sys_epoll_pwait,@function
+__sys_epoll_pwait:
+        pushm   lr
+        st.w    --sp, ARG6
+        rcall   sys_epoll_pwait
+        sub     sp, -4
+        popm    pc
diff --git a/arch/avr32/kernel/syscall_table.S b/arch/avr32/kernel/syscall_table.S
index 63b206965d05..db8f8b55ffdf 100644
--- a/arch/avr32/kernel/syscall_table.S
+++ b/arch/avr32/kernel/syscall_table.S
@@ -286,4 +286,5 @@ sys_call_table:
         .long   sys_sync_file_range
         .long   sys_tee
         .long   sys_vmsplice
+        .long   __sys_epoll_pwait       /* 265 */
         .long   sys_ni_syscall          /* r8 is saturated at nr_syscalls */
diff --git a/arch/avr32/kernel/time.c b/arch/avr32/kernel/time.c
index 3e56b9f4358a..5a247ba71a72 100644
--- a/arch/avr32/kernel/time.c
+++ b/arch/avr32/kernel/time.c
@@ -124,15 +124,15 @@ unsigned long long sched_clock(void)
  *
  * In UP mode, it is invoked from the (global) timer_interrupt.
  */
-static void local_timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static void local_timer_interrupt(int irq, void *dev_id)
 {
         if (current->pid)
-                profile_tick(CPU_PROFILING, regs);
-        update_process_times(user_mode(regs));
+                profile_tick(CPU_PROFILING);
+        update_process_times(user_mode(get_irq_regs()));
 }
 
 static irqreturn_t
-timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+timer_interrupt(int irq, void *dev_id)
 {
         unsigned int count;
 
@@ -157,7 +157,7 @@ timer_interrupt(int irq, void *dev_id, struct pt_regs *regs)
          *
          * SMP is not supported yet.
          */
-        local_timer_interrupt(irq, dev_id, regs);
+        local_timer_interrupt(irq, dev_id);
 
         return IRQ_HANDLED;
 }
diff --git a/arch/avr32/kernel/vmlinux.lds.c b/arch/avr32/kernel/vmlinux.lds.c
index cdd627c6b7dc..5c4424e362b5 100644
--- a/arch/avr32/kernel/vmlinux.lds.c
+++ b/arch/avr32/kernel/vmlinux.lds.c
@@ -38,13 +38,7 @@ SECTIONS
                 __setup_end = .;
                 . = ALIGN(4);
                 __initcall_start = .;
-                        *(.initcall1.init)
-                        *(.initcall2.init)
-                        *(.initcall3.init)
-                        *(.initcall4.init)
-                        *(.initcall5.init)
-                        *(.initcall6.init)
-                        *(.initcall7.init)
+                        INITCALLS
                 __initcall_end = .;
                 __con_initcall_start = .;
                         *(.con_initcall.init)
diff --git a/arch/avr32/lib/Makefile b/arch/avr32/lib/Makefile
index 09ac43e40522..084d95bac5e7 100644
--- a/arch/avr32/lib/Makefile
+++ b/arch/avr32/lib/Makefile
@@ -7,4 +7,5 @@ lib-y	+= strncpy_from_user.o strnlen_user.o
 lib-y   += delay.o memset.o memcpy.o findbit.o
 lib-y   += csum_partial.o csum_partial_copy_generic.o
 lib-y   += io-readsw.o io-readsl.o io-writesw.o io-writesl.o
+lib-y   += io-readsb.o io-writesb.o
 lib-y   += __avr32_lsl64.o __avr32_lsr64.o __avr32_asr64.o
diff --git a/arch/avr32/lib/findbit.S b/arch/avr32/lib/findbit.S
index 2b4856f4bf7c..c6b91dee857c 100644
--- a/arch/avr32/lib/findbit.S
+++ b/arch/avr32/lib/findbit.S
@@ -136,6 +136,7 @@ ENTRY(generic_find_next_zero_le_bit)
         /* offset is not word-aligned. Handle the first (32 - r10) bits */
         ldswp.w r8, r12[0]
         sub     r12, -4
+        com     r8
         lsr     r8, r8, r10
         brne    .L_found
 
@@ -146,7 +147,7 @@ ENTRY(generic_find_next_zero_le_bit)
 
         /* Main loop. offset must be word-aligned */
 1:      ldswp.w r8, r12[0]
-        cp.w    r8, 0
+        com     r8
         brne    .L_found
         sub     r12, -4
         sub     r9, 32
diff --git a/arch/avr32/lib/io-readsb.S b/arch/avr32/lib/io-readsb.S
new file mode 100644
index 000000000000..2be5da7ed26b
--- /dev/null
+++ b/arch/avr32/lib/io-readsb.S
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2004-2006 Atmel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+        .text
+.Lnot_word_aligned:
+1:      ld.ub   r8, r12[0]
+        sub     r10, 1
+        st.b    r11++, r8
+        reteq   r12
+        tst     r11, r9
+        brne    1b
+
+        /* fall through */
+
+        .global __raw_readsb
+        .type   __raw_readsb,@function
+__raw_readsb:
+        cp.w    r10, 0
+        mov     r9, 3
+        reteq   r12
+
+        tst     r11, r9
+        brne    .Lnot_word_aligned
+
+        sub     r10, 4
+        brlt    2f
+
+1:      ldins.b r8:t, r12[0]
+        ldins.b r8:u, r12[0]
+        ldins.b r8:l, r12[0]
+        ldins.b r8:b, r12[0]
+        st.w    r11++, r8
+        sub     r10, 4
+        brge    1b
+
+2:      sub     r10, -4
+        reteq   r12
+
+3:      ld.uh   r8, r12[0]
+        sub     r10, 1
+        st.b    r11++, r8
+        brne    3b
+
+        retal   r12
diff --git a/arch/avr32/lib/io-writesb.S b/arch/avr32/lib/io-writesb.S
new file mode 100644
index 000000000000..b4ebaacccf68
--- /dev/null
+++ b/arch/avr32/lib/io-writesb.S
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2004-2006 Atmel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+        .text
+.Lnot_word_aligned:
+1:      ld.ub   r8, r11++
+        sub     r10, 1
+        st.b    r12[0], r8
+        reteq   r12
+        tst     r11, r9
+        brne    1b
+
+        /* fall through */
+
+        .global __raw_writesb
+        .type   __raw_writesb,@function
+__raw_writesb:
+        cp.w    r10, 0
+        mov     r9, 3
+        reteq   r12
+
+        tst     r11, r9
+        brne    .Lnot_word_aligned
+
+        sub     r10, 4
+        brlt    2f
+
+1:      ld.w    r8, r11++
+        bfextu  r9, r8, 24, 8
+        st.b    r12[0], r9
+        bfextu  r9, r8, 16, 8
+        st.b    r12[0], r9
+        bfextu  r9, r8, 8, 8
+        st.b    r12[0], r9
+        st.b    r12[0], r8
+        sub     r10, 4
+        brge    1b
+
+2:      sub     r10, -4
+        reteq   r12
+
+3:      ld.ub   r8, r11++
+        sub     r10, 1
+        st.b    r12[0], r8
+        brne    3b
+
+        retal   r12
diff --git a/arch/avr32/mach-at32ap/extint.c b/arch/avr32/mach-at32ap/extint.c
index 7da9c5f7a0eb..4dff1f988900 100644
--- a/arch/avr32/mach-at32ap/extint.c
+++ b/arch/avr32/mach-at32ap/extint.c
@@ -102,8 +102,7 @@ struct irq_chip eim_chip = {
         .set_type       = eim_set_irq_type,
 };
 
-static void demux_eim_irq(unsigned int irq, struct irq_desc *desc,
-                          struct pt_regs *regs)
+static void demux_eim_irq(unsigned int irq, struct irq_desc *desc)
 {
         struct at32_sm *sm = desc->handler_data;
         struct irq_desc *ext_desc;
@@ -121,7 +120,7 @@ static void demux_eim_irq(unsigned int irq, struct irq_desc *desc,
 
                 ext_irq = i + sm->eim_first_irq;
                 ext_desc = irq_desc + ext_irq;
-                ext_desc->handle_irq(ext_irq, ext_desc, regs);
+                ext_desc->handle_irq(ext_irq, ext_desc);
         }
 
         spin_unlock(&sm->lock);
diff --git a/arch/avr32/mach-at32ap/hsmc.h b/arch/avr32/mach-at32ap/hsmc.h
index 5681276fafdb..d1d48e26e393 100644
--- a/arch/avr32/mach-at32ap/hsmc.h
+++ b/arch/avr32/mach-at32ap/hsmc.h
@@ -120,8 +120,8 @@
 
 /* Register access macros */
 #define hsmc_readl(port,reg)                                            \
-        readl((port)->regs + HSMC_##reg)
+        __raw_readl((port)->regs + HSMC_##reg)
 #define hsmc_writel(port,reg,value)                                     \
-        writel((value), (port)->regs + HSMC_##reg)
+        __raw_writel((value), (port)->regs + HSMC_##reg)
 
 #endif /* __ASM_AVR32_HSMC_H__ */
diff --git a/arch/avr32/mach-at32ap/intc.c b/arch/avr32/mach-at32ap/intc.c
index 74f8c9f2f03d..eb87a18ad7b2 100644
--- a/arch/avr32/mach-at32ap/intc.c
+++ b/arch/avr32/mach-at32ap/intc.c
@@ -52,16 +52,19 @@ static struct intc intc0 = {
 asmlinkage void do_IRQ(int level, struct pt_regs *regs)
 {
         struct irq_desc *desc;
+        struct pt_regs *old_regs;
         unsigned int irq;
         unsigned long status_reg;
 
         local_irq_disable();
 
+        old_regs = set_irq_regs(regs);
+
         irq_enter();
 
         irq = intc_readl(&intc0, INTCAUSE0 - 4 * level);
         desc = irq_desc + irq;
-        desc->handle_irq(irq, desc, regs);
+        desc->handle_irq(irq, desc);
 
         /*
          * Clear all interrupt level masks so that we may handle
@@ -75,6 +78,8 @@ asmlinkage void do_IRQ(int level, struct pt_regs *regs)
         sysreg_write(SR, status_reg);
 
         irq_exit();
+
+        set_irq_regs(old_regs);
 }
 
 void __init init_IRQ(void)
diff --git a/arch/avr32/mach-at32ap/intc.h b/arch/avr32/mach-at32ap/intc.h
index d289ca2fff13..4d3664e43a8e 100644
--- a/arch/avr32/mach-at32ap/intc.h
+++ b/arch/avr32/mach-at32ap/intc.h
@@ -321,7 +321,9 @@
 #define INTC_MKBF(name, value)       (((value) & ((1 << INTC_##name##_SIZE) - 1)) << INTC_##name##_OFFSET)
 #define INTC_GETBF(name, value)      (((value) >> INTC_##name##_OFFSET) & ((1 << INTC_##name##_SIZE) - 1))
 
-#define intc_readl(port,reg)         readl((port)->regs + INTC_##reg)
-#define intc_writel(port,reg,value)  writel((value), (port)->regs + INTC_##reg)
+#define intc_readl(port,reg)                                    \
+        __raw_readl((port)->regs + INTC_##reg)
+#define intc_writel(port,reg,value)                             \
+        __raw_writel((value), (port)->regs + INTC_##reg)
 
 #endif /* __ASM_AVR32_PERIHP_INTC_H__ */
diff --git a/arch/avr32/mach-at32ap/pio.h b/arch/avr32/mach-at32ap/pio.h
index cfea12351599..50fa3aca32c5 100644
--- a/arch/avr32/mach-at32ap/pio.h
+++ b/arch/avr32/mach-at32ap/pio.h
@@ -170,8 +170,10 @@
 #define PIO_BFINS(name,value,old)              (((old) & ~(((1 << PIO_##name##_SIZE) - 1) << PIO_##name##_OFFSET)) | PIO_BF(name,value))
 
 /* Register access macros */
-#define pio_readl(port,reg)                    readl((port)->regs + PIO_##reg)
-#define pio_writel(port,reg,value)             writel((value), (port)->regs + PIO_##reg)
+#define pio_readl(port,reg)                                     \
+        __raw_readl((port)->regs + PIO_##reg)
+#define pio_writel(port,reg,value)                              \
+        __raw_writel((value), (port)->regs + PIO_##reg)
 
 void at32_init_pio(struct platform_device *pdev);
 
diff --git a/arch/avr32/mach-at32ap/sm.h b/arch/avr32/mach-at32ap/sm.h
index 27565822ae2a..cad02b512bcb 100644
--- a/arch/avr32/mach-at32ap/sm.h
+++ b/arch/avr32/mach-at32ap/sm.h
@@ -234,7 +234,9 @@
 #define SM_BFINS(name,value,old)                (((old) & ~(((1 << SM_##name##_SIZE) - 1) << SM_##name##_OFFSET)) | SM_BF(name,value))
 
 /* Register access macros */
-#define sm_readl(port,reg)                      readl((port)->regs + SM_##reg)
-#define sm_writel(port,reg,value)               writel((value), (port)->regs + SM_##reg)
+#define sm_readl(port,reg)                                      \
+        __raw_readl((port)->regs + SM_##reg)
+#define sm_writel(port,reg,value)                               \
+        __raw_writel((value), (port)->regs + SM_##reg)
 
 #endif /* __ASM_AVR32_SM_H__ */
diff --git a/arch/avr32/mm/init.c b/arch/avr32/mm/init.c
index 3e6c41039808..70da6894acc1 100644
--- a/arch/avr32/mm/init.c
+++ b/arch/avr32/mm/init.c
@@ -206,7 +206,7 @@ void __init setup_bootmem(void)
 
         if (mem_ramdisk) {
 #ifdef CONFIG_BLK_DEV_INITRD
-                initrd_start = __va(mem_ramdisk->addr);
+                initrd_start = (unsigned long)__va(mem_ramdisk->addr);
                 initrd_end = initrd_start + mem_ramdisk->size;
 
                 print_memory_map("RAMDISK images", mem_ramdisk);
diff --git a/arch/avr32/mm/ioremap.c b/arch/avr32/mm/ioremap.c
index 8cfec65e37f7..3437c82434ac 100644
--- a/arch/avr32/mm/ioremap.c
+++ b/arch/avr32/mm/ioremap.c
@@ -77,6 +77,8 @@ void __iounmap(void __iomem *addr)
 
         if ((unsigned long)addr >= P4SEG)
                 return;
+        if (PXSEG(addr) == P2SEG)
+                return;
 
         p = remove_vm_area((void *)(PAGE_MASK & (unsigned long __force)addr));
         if (unlikely(!p)) {
diff --git a/arch/cris/arch-v32/drivers/cryptocop.c b/arch/cris/arch-v32/drivers/cryptocop.c
index ba096ebb0b15..2449637e6fc0 100644
--- a/arch/cris/arch-v32/drivers/cryptocop.c
+++ b/arch/cris/arch-v32/drivers/cryptocop.c
@@ -2051,7 +2051,6 @@ static void cryptocop_job_queue_close(void)
         spin_lock_irqsave(&cryptocop_process_lock, process_flags);
 
         /* Empty the job queue. */
-        spin_lock_irqsave(&cryptocop_process_lock, process_flags);
         for (i = 0; i < cryptocop_prio_no_prios; i++){
                 if (!list_empty(&(cryptocop_job_queues[i].jobs))){
                         list_for_each_safe(node, tmp, &(cryptocop_job_queues[i].jobs)) {
diff --git a/arch/frv/kernel/vmlinux.lds.S b/arch/frv/kernel/vmlinux.lds.S
index f474534ba78a..9c1fb12367fa 100644
--- a/arch/frv/kernel/vmlinux.lds.S
+++ b/arch/frv/kernel/vmlinux.lds.S
@@ -44,13 +44,7 @@ SECTIONS
 
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/h8300/kernel/vmlinux.lds.S b/arch/h8300/kernel/vmlinux.lds.S
index 6406c388f88a..756325dd480e 100644
--- a/arch/h8300/kernel/vmlinux.lds.S
+++ b/arch/h8300/kernel/vmlinux.lds.S
@@ -118,13 +118,7 @@ SECTIONS
         . = ALIGN(0x4) ;
         ___setup_end = .;
         ___initcall_start = .;
-                *(.initcall1.init)
-                *(.initcall2.init)
-                *(.initcall3.init)
-                *(.initcall4.init)
-                *(.initcall5.init)
-                *(.initcall6.init)
-                *(.initcall7.init)
+                INITCALLS
         ___initcall_end = .;
         ___con_initcall_start = .;
                 *(.con_initcall.init)
diff --git a/arch/i386/Kconfig.cpu b/arch/i386/Kconfig.cpu
index 21c9a4e71104..fc4f2abccf06 100644
--- a/arch/i386/Kconfig.cpu
+++ b/arch/i386/Kconfig.cpu
@@ -7,6 +7,7 @@ choice
 
 config M386
         bool "386"
+        depends on !UML
         ---help---
           This is the processor type of your CPU. This information is used for
           optimizing purposes. In order to compile a kernel that can run on
@@ -301,7 +302,7 @@ config X86_USE_PPRO_CHECKSUM
 
 config X86_USE_3DNOW
         bool
-        depends on MCYRIXIII || MK7 || MGEODE_LX
+        depends on (MCYRIXIII || MK7 || MGEODE_LX) && !UML
         default y
 
 config X86_OOSTORE
diff --git a/arch/i386/Makefile b/arch/i386/Makefile
index 7cc0b189b82b..0677908dfa06 100644
--- a/arch/i386/Makefile
+++ b/arch/i386/Makefile
@@ -42,6 +42,10 @@ cflags-$(CONFIG_REGPARM) += -mregparm=3
 # temporary until string.h is fixed
 cflags-y += -ffreestanding
 
+# this works around some issues with generating unwind tables in older gccs
+# newer gccs do it by default
+cflags-y += -maccumulate-outgoing-args
+
 # Disable unit-at-a-time mode on pre-gcc-4.0 compilers, it makes gcc use
 # a lot more stack due to the lack of sharing of stacklots:
 CFLAGS                          += $(shell if [ $(call cc-version) -lt 0400 ] ; then echo $(call cc-option,-fno-unit-at-a-time); fi ;)
@@ -51,8 +55,8 @@ cflags-y += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 
 # is .cfi_signal_frame supported too?
-cflags-y += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
-AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
+cflags-y += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
+AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
 
 CFLAGS += $(cflags-y)
 
diff --git a/arch/i386/defconfig b/arch/i386/defconfig
index 60c0c02574f0..97aacd6bd7d8 100644
--- a/arch/i386/defconfig
+++ b/arch/i386/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-rc1
-# Thu Oct  5 13:04:53 2006
+# Linux kernel version: 2.6.19-rc2-git4
+# Sat Oct 21 03:38:56 2006
 #
 CONFIG_X86_32=y
 CONFIG_GENERIC_TIME=y
@@ -380,8 +380,8 @@ CONFIG_INET6_XFRM_MODE_TRANSPORT=y
 CONFIG_INET6_XFRM_MODE_TUNNEL=y
 # CONFIG_INET6_XFRM_MODE_BEET is not set
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=y
 # CONFIG_IPV6_TUNNEL is not set
-# CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
@@ -483,6 +483,13 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_IBM_ASM is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -1024,6 +1031,7 @@ CONFIG_HANGCHECK_TIMER=y
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -1032,12 +1040,6 @@ CONFIG_HANGCHECK_TIMER=y
 # CONFIG_HWMON_VID is not set
 
 #
-# Misc devices
-#
-# CONFIG_IBM_ASM is not set
-# CONFIG_TIFM_CORE is not set
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1169,7 +1171,6 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
-# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -1215,6 +1216,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1284,6 +1286,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1307,6 +1310,7 @@ CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 CONFIG_AUTOFS4_FS=y
 # CONFIG_FUSE_FS is not set
+CONFIG_GENERIC_ACL=y
 
 #
 # CD-ROM/DVD Filesystems
@@ -1384,7 +1388,6 @@ CONFIG_SUNRPC=y
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
 # CONFIG_9P_FS is not set
-CONFIG_GENERIC_ACL=y
 
 #
 # Partition Types
@@ -1437,10 +1440,6 @@ CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 
 #
-# Distributed Lock Manager
-#
-
-#
 # Instrumentation Support
 #
 CONFIG_PROFILING=y
@@ -1480,6 +1479,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 CONFIG_UNWIND_INFO=y
 CONFIG_STACK_UNWIND=y
 # CONFIG_FORCED_INLINING is not set
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 CONFIG_EARLY_PRINTK=y
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 92f79cdd9a48..d12fb97a5337 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -70,7 +70,7 @@ static inline int acpi_madt_oem_check(char *oem_id, char *oem_table_id) { return
 
 #define PREFIX                  "ACPI: "
 
-int acpi_noirq __initdata;      /* skip ACPI IRQ initialization */
+int acpi_noirq;                         /* skip ACPI IRQ initialization */
 int acpi_pci_disabled __initdata;       /* skip ACPI PCI scan and IRQ initialization */
 int acpi_ht __initdata = 1;     /* enable HT */
 
@@ -82,6 +82,7 @@ EXPORT_SYMBOL(acpi_strict);
 acpi_interrupt_flags acpi_sci_flags __initdata;
 int acpi_sci_override_gsi __initdata;
 int acpi_skip_timer_override __initdata;
+int acpi_use_timer_override __initdata;
 
 #ifdef CONFIG_X86_LOCAL_APIC
 static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
@@ -332,7 +333,7 @@ acpi_parse_ioapic(acpi_table_entry_header * header, const unsigned long end)
 /*
  * Parse Interrupt Source Override for the ACPI SCI
  */
-static void acpi_sci_ioapic_setup(u32 gsi, u16 polarity, u16 trigger)
+static void acpi_sci_ioapic_setup(u32 bus_irq, u32 gsi, u16 polarity, u16 trigger)
 {
         if (trigger == 0)       /* compatible SCI trigger is level */
                 trigger = 3;
@@ -352,13 +353,13 @@ static void acpi_sci_ioapic_setup(u32 gsi, u16 polarity, u16 trigger)
          * If GSI is < 16, this will update its flags,
          * else it will create a new mp_irqs[] entry.
          */
-        mp_override_legacy_irq(gsi, polarity, trigger, gsi);
+        mp_override_legacy_irq(bus_irq, polarity, trigger, gsi);
 
         /*
          * stash over-ride to indicate we've been here
          * and for later update of acpi_fadt
          */
-        acpi_sci_override_gsi = gsi;
+        acpi_sci_override_gsi = bus_irq;
         return;
 }
 
@@ -376,7 +377,7 @@ acpi_parse_int_src_ovr(acpi_table_entry_header * header,
         acpi_table_print_madt_entry(header);
 
         if (intsrc->bus_irq == acpi_fadt.sci_int) {
-                acpi_sci_ioapic_setup(intsrc->global_irq,
+                acpi_sci_ioapic_setup(intsrc->bus_irq, intsrc->global_irq,
                                       intsrc->flags.polarity,
                                       intsrc->flags.trigger);
                 return 0;
@@ -879,7 +880,7 @@ static int __init acpi_parse_madt_ioapic_entries(void)
          * pretend we got one so we can set the SCI flags.
          */
         if (!acpi_sci_override_gsi)
-                acpi_sci_ioapic_setup(acpi_fadt.sci_int, 0, 0);
+                acpi_sci_ioapic_setup(acpi_fadt.sci_int, acpi_fadt.sci_int, 0, 0);
 
         /* Fill in identity legacy mapings where no override */
         mp_config_acpi_legacy_irqs();
@@ -1300,6 +1301,13 @@ static int __init parse_acpi_skip_timer_override(char *arg)
         return 0;
 }
 early_param("acpi_skip_timer_override", parse_acpi_skip_timer_override);
+
+static int __init parse_acpi_use_timer_override(char *arg)
+{
+        acpi_use_timer_override = 1;
+        return 0;
+}
+early_param("acpi_use_timer_override", parse_acpi_use_timer_override);
 #endif /* CONFIG_X86_IO_APIC */
 
 static int __init setup_acpi_sci(char *s)
diff --git a/arch/i386/kernel/acpi/cstate.c b/arch/i386/kernel/acpi/cstate.c
index 25db49ef1770..20563e52c622 100644
--- a/arch/i386/kernel/acpi/cstate.c
+++ b/arch/i386/kernel/acpi/cstate.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
+#include <linux/cpu.h>
 
 #include <acpi/processor.h>
 #include <asm/acpi.h>
@@ -41,5 +42,124 @@ void acpi_processor_power_init_bm_check(struct acpi_processor_flags *flags,
                 flags->bm_check = 1;
         }
 }
-
 EXPORT_SYMBOL(acpi_processor_power_init_bm_check);
+
+/* The code below handles cstate entry with monitor-mwait pair on Intel*/
+
+struct cstate_entry_s {
+        struct {
+                unsigned int eax;
+                unsigned int ecx;
+        } states[ACPI_PROCESSOR_MAX_POWER];
+};
+static struct cstate_entry_s *cpu_cstate_entry; /* per CPU ptr */
+
+static short mwait_supported[ACPI_PROCESSOR_MAX_POWER];
+
+#define MWAIT_SUBSTATE_MASK     (0xf)
+#define MWAIT_SUBSTATE_SIZE     (4)
+
+#define CPUID_MWAIT_LEAF (5)
+#define CPUID5_ECX_EXTENSIONS_SUPPORTED (0x1)
+#define CPUID5_ECX_INTERRUPT_BREAK      (0x2)
+
+#define MWAIT_ECX_INTERRUPT_BREAK       (0x1)
+
+#define NATIVE_CSTATE_BEYOND_HALT       (2)
+
+int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+                struct acpi_processor_cx *cx, struct acpi_power_register *reg)
+{
+        struct cstate_entry_s *percpu_entry;
+        struct cpuinfo_x86 *c = cpu_data + cpu;
+
+        cpumask_t saved_mask;
+        int retval;
+        unsigned int eax, ebx, ecx, edx;
+        unsigned int edx_part;
+        unsigned int cstate_type; /* C-state type and not ACPI C-state type */
+        unsigned int num_cstate_subtype;
+
+        if (!cpu_cstate_entry || c->cpuid_level < CPUID_MWAIT_LEAF )
+                return -1;
+
+        if (reg->bit_offset != NATIVE_CSTATE_BEYOND_HALT)
+                return -1;
+
+        percpu_entry = per_cpu_ptr(cpu_cstate_entry, cpu);
+        percpu_entry->states[cx->index].eax = 0;
+        percpu_entry->states[cx->index].ecx = 0;
+
+        /* Make sure we are running on right CPU */
+        saved_mask = current->cpus_allowed;
+        retval = set_cpus_allowed(current, cpumask_of_cpu(cpu));
+        if (retval)
+                return -1;
+
+        cpuid(CPUID_MWAIT_LEAF, &eax, &ebx, &ecx, &edx);
+
+        /* Check whether this particular cx_type (in CST) is supported or not */
+        cstate_type = (cx->address >> MWAIT_SUBSTATE_SIZE) + 1;
+        edx_part = edx >> (cstate_type * MWAIT_SUBSTATE_SIZE);
+        num_cstate_subtype = edx_part & MWAIT_SUBSTATE_MASK;
+
+        retval = 0;
+        if (num_cstate_subtype < (cx->address & MWAIT_SUBSTATE_MASK)) {
+                retval = -1;
+                goto out;
+        }
+
+        /* mwait ecx extensions INTERRUPT_BREAK should be supported for C2/C3 */
+        if (!(ecx & CPUID5_ECX_EXTENSIONS_SUPPORTED) ||
+            !(ecx & CPUID5_ECX_INTERRUPT_BREAK)) {
+                retval = -1;
+                goto out;
+        }
+        percpu_entry->states[cx->index].ecx = MWAIT_ECX_INTERRUPT_BREAK;
+
+        /* Use the hint in CST */
+        percpu_entry->states[cx->index].eax = cx->address;
+
+        if (!mwait_supported[cstate_type]) {
+                mwait_supported[cstate_type] = 1;
+                printk(KERN_DEBUG "Monitor-Mwait will be used to enter C-%d "
+                       "state\n", cx->type);
+        }
+
+out:
+        set_cpus_allowed(current, saved_mask);
+        return retval;
+}
+EXPORT_SYMBOL_GPL(acpi_processor_ffh_cstate_probe);
+
+void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx *cx)
+{
+        unsigned int cpu = smp_processor_id();
+        struct cstate_entry_s *percpu_entry;
+
+        percpu_entry = per_cpu_ptr(cpu_cstate_entry, cpu);
+        mwait_idle_with_hints(percpu_entry->states[cx->index].eax,
+                              percpu_entry->states[cx->index].ecx);
+}
+EXPORT_SYMBOL_GPL(acpi_processor_ffh_cstate_enter);
+
+static int __init ffh_cstate_init(void)
+{
+        struct cpuinfo_x86 *c = &boot_cpu_data;
+        if (c->x86_vendor != X86_VENDOR_INTEL)
+                return -1;
+
+        cpu_cstate_entry = alloc_percpu(struct cstate_entry_s);
+        return 0;
+}
+
+static void __exit ffh_cstate_exit(void)
+{
+        if (cpu_cstate_entry) {
+                free_percpu(cpu_cstate_entry);
+                cpu_cstate_entry = NULL;
+        }
+}
+
+arch_initcall(ffh_cstate_init);
+__exitcall(ffh_cstate_exit);
diff --git a/arch/i386/kernel/acpi/earlyquirk.c b/arch/i386/kernel/acpi/earlyquirk.c
index fe799b11ac0a..c9841692bb7c 100644
--- a/arch/i386/kernel/acpi/earlyquirk.c
+++ b/arch/i386/kernel/acpi/earlyquirk.c
@@ -27,11 +27,17 @@ static int __init check_bridge(int vendor, int device)
 #ifdef CONFIG_ACPI
         /* According to Nvidia all timer overrides are bogus unless HPET
            is enabled. */
-        if (vendor == PCI_VENDOR_ID_NVIDIA) {
+        if (!acpi_use_timer_override && vendor == PCI_VENDOR_ID_NVIDIA) {
                 nvidia_hpet_detected = 0;
                 acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
                 if (nvidia_hpet_detected == 0) {
                         acpi_skip_timer_override = 1;
+                          printk(KERN_INFO "Nvidia board "
+                       "detected. Ignoring ACPI "
+                       "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                                 "try acpi_use_timer_override\n");
+
                 }
         }
 #endif
diff --git a/arch/i386/kernel/alternative.c b/arch/i386/kernel/alternative.c
index 28ab80649764..583c238e17fb 100644
--- a/arch/i386/kernel/alternative.c
+++ b/arch/i386/kernel/alternative.c
@@ -344,6 +344,7 @@ void alternatives_smp_switch(int smp)
 
 void __init alternative_instructions(void)
 {
+        unsigned long flags;
         if (no_replacement) {
                 printk(KERN_INFO "(SMP-)alternatives turned off\n");
                 free_init_pages("SMP alternatives",
@@ -351,6 +352,8 @@ void __init alternative_instructions(void)
                                 (unsigned long)__smp_alt_end);
                 return;
         }
+
+        local_irq_save(flags);
         apply_alternatives(__alt_instructions, __alt_instructions_end);
 
         /* switch to patch-once-at-boottime-only mode and free the
@@ -386,4 +389,5 @@ void __init alternative_instructions(void)
                 alternatives_smp_switch(0);
         }
 #endif
+        local_irq_restore(flags);
 }
diff --git a/arch/i386/kernel/apm.c b/arch/i386/kernel/apm.c
index b42f2d914af3..a60358fe9a49 100644
--- a/arch/i386/kernel/apm.c
+++ b/arch/i386/kernel/apm.c
@@ -198,7 +198,7 @@
  *   (APM) BIOS Interface Specification, Revision 1.2, February 1996.
  *
  * [This document is available from Microsoft at:
- *    http://www.microsoft.com/hwdev/busbios/amp_12.htm]
+ *    http://www.microsoft.com/whdc/archive/amp_12.mspx]
  */
 
 #include <linux/module.h>
@@ -540,11 +540,30 @@ static inline void apm_restore_cpus(cpumask_t mask)
  * Also, we KNOW that for the non error case of apm_bios_call, there
  * is no useful data returned in the low order 8 bits of eax.
  */
-#define APM_DO_CLI      \
-        if (apm_info.allow_ints) \
-                local_irq_enable(); \
-        else \
+
+static inline unsigned long __apm_irq_save(void)
+{
+        unsigned long flags;
+        local_save_flags(flags);
+        if (apm_info.allow_ints) {
+                if (irqs_disabled_flags(flags))
+                        local_irq_enable();
+        } else
+                local_irq_disable();
+
+        return flags;
+}
+
+#define apm_irq_save(flags) \
+        do { flags = __apm_irq_save(); } while (0)
+
+static inline void apm_irq_restore(unsigned long flags)
+{
+        if (irqs_disabled_flags(flags))
                 local_irq_disable();
+        else if (irqs_disabled())
+                local_irq_enable();
+}
 
 #ifdef APM_ZERO_SEGS
 #       define APM_DECL_SEGS \
@@ -596,12 +615,11 @@ static u8 apm_bios_call(u32 func, u32 ebx_in, u32 ecx_in,
         save_desc_40 = gdt[0x40 / 8];
         gdt[0x40 / 8] = bad_bios_desc;
 
-        local_save_flags(flags);
-        APM_DO_CLI;
+        apm_irq_save(flags);
         APM_DO_SAVE_SEGS;
         apm_bios_call_asm(func, ebx_in, ecx_in, eax, ebx, ecx, edx, esi);
         APM_DO_RESTORE_SEGS;
-        local_irq_restore(flags);
+        apm_irq_restore(flags);
         gdt[0x40 / 8] = save_desc_40;
         put_cpu();
         apm_restore_cpus(cpus);
@@ -640,12 +658,11 @@ static u8 apm_bios_call_simple(u32 func, u32 ebx_in, u32 ecx_in, u32 *eax)
         save_desc_40 = gdt[0x40 / 8];
         gdt[0x40 / 8] = bad_bios_desc;
 
-        local_save_flags(flags);
-        APM_DO_CLI;
+        apm_irq_save(flags);
         APM_DO_SAVE_SEGS;
         error = apm_bios_call_simple_asm(func, ebx_in, ecx_in, eax);
         APM_DO_RESTORE_SEGS;
-        local_irq_restore(flags);
+        apm_irq_restore(flags);
         gdt[0x40 / 8] = save_desc_40;
         put_cpu();
         apm_restore_cpus(cpus);
diff --git a/arch/i386/kernel/cpu/mcheck/therm_throt.c b/arch/i386/kernel/cpu/mcheck/therm_throt.c
index 4f43047de406..2d8703b7ce65 100644
--- a/arch/i386/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/i386/kernel/cpu/mcheck/therm_throt.c
@@ -110,17 +110,15 @@ int therm_throt_process(int curr)
 
 #ifdef CONFIG_SYSFS
 /* Add/Remove thermal_throttle interface for CPU device */
-static __cpuinit int thermal_throttle_add_dev(struct sys_device * sys_dev)
+static __cpuinit int thermal_throttle_add_dev(struct sys_device *sys_dev)
 {
-        sysfs_create_group(&sys_dev->kobj, &thermal_throttle_attr_group);
-        return 0;
+        return sysfs_create_group(&sys_dev->kobj, &thermal_throttle_attr_group);
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-static __cpuinit int thermal_throttle_remove_dev(struct sys_device * sys_dev)
+static __cpuinit void thermal_throttle_remove_dev(struct sys_device *sys_dev)
 {
-        sysfs_remove_group(&sys_dev->kobj, &thermal_throttle_attr_group);
-        return 0;
+        return sysfs_remove_group(&sys_dev->kobj, &thermal_throttle_attr_group);
 }
 
 /* Mutex protecting device creation against CPU hotplug */
@@ -133,12 +131,14 @@ static __cpuinit int thermal_throttle_cpu_callback(struct notifier_block *nfb,
 {
         unsigned int cpu = (unsigned long)hcpu;
         struct sys_device *sys_dev;
+        int err;
 
         sys_dev = get_cpu_sysdev(cpu);
         mutex_lock(&therm_cpu_lock);
         switch (action) {
         case CPU_ONLINE:
-                thermal_throttle_add_dev(sys_dev);
+                err = thermal_throttle_add_dev(sys_dev);
+                WARN_ON(err);
                 break;
         case CPU_DEAD:
                 thermal_throttle_remove_dev(sys_dev);
@@ -157,6 +157,7 @@ static struct notifier_block thermal_throttle_cpu_notifier =
 static __init int thermal_throttle_init_device(void)
 {
         unsigned int cpu = 0;
+        int err;
 
         if (!atomic_read(&therm_throt_en))
                 return 0;
@@ -167,8 +168,10 @@ static __init int thermal_throttle_init_device(void)
         mutex_lock(&therm_cpu_lock);
 #endif
         /* connect live CPUs to sysfs */
-        for_each_online_cpu(cpu)
-                thermal_throttle_add_dev(get_cpu_sysdev(cpu));
+        for_each_online_cpu(cpu) {
+                err = thermal_throttle_add_dev(get_cpu_sysdev(cpu));
+                WARN_ON(err);
+        }
 #ifdef CONFIG_HOTPLUG_CPU
         mutex_unlock(&therm_cpu_lock);
 #endif
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index be9d883c62ce..ca31f18d277c 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -317,7 +317,7 @@ is386:	movl $2,%ecx		# set MP
         movl %eax,%gs
         lldt %ax
         cld                     # gcc2 wants the direction flag cleared at all times
-        pushl %eax              # fake return address
+        pushl $0                # fake return address for unwinder
 #ifdef CONFIG_SMP
         movb ready, %cl
         movb $1, ready
diff --git a/arch/i386/kernel/i8253.c b/arch/i386/kernel/i8253.c
index 477b24daff53..9a0060b92e32 100644
--- a/arch/i386/kernel/i8253.c
+++ b/arch/i386/kernel/i8253.c
@@ -109,7 +109,7 @@ static struct clocksource clocksource_pit = {
 
 static int __init init_pit_clocksource(void)
 {
-        if (num_possible_cpus() > 4) /* PIT does not scale! */
+        if (num_possible_cpus() > 1) /* PIT does not scale! */
                 return 0;
 
         clocksource_pit.mult = clocksource_hz2mult(CLOCK_TICK_RATE, 20);
diff --git a/arch/i386/kernel/i8259.c b/arch/i386/kernel/i8259.c
index d53eafb6daa7..62996cd17084 100644
--- a/arch/i386/kernel/i8259.c
+++ b/arch/i386/kernel/i8259.c
@@ -113,7 +113,8 @@ void make_8259A_irq(unsigned int irq)
 {
         disable_irq_nosync(irq);
         io_apic_irqs &= ~(1<<irq);
-        set_irq_chip_and_handler(irq, &i8259A_chip, handle_level_irq);
+        set_irq_chip_and_handler_name(irq, &i8259A_chip, handle_level_irq,
+                                      "XT");
         enable_irq(irq);
 }
 
@@ -369,8 +370,8 @@ void __init init_ISA_irqs (void)
                         /*
                          * 16 old-style INTA-cycle interrupts:
                          */
-                        set_irq_chip_and_handler(i, &i8259A_chip,
-                                                 handle_level_irq);
+                        set_irq_chip_and_handler_name(i, &i8259A_chip,
+                                                      handle_level_irq, "XT");
                 } else {
                         /*
                          * 'high' PCI IRQs filled in on demand
diff --git a/arch/i386/kernel/io_apic.c b/arch/i386/kernel/io_apic.c
index cd082c36ca03..3b7a63e0ed1a 100644
--- a/arch/i386/kernel/io_apic.c
+++ b/arch/i386/kernel/io_apic.c
@@ -91,6 +91,46 @@ static struct irq_pin_list {
         int apic, pin, next;
 } irq_2_pin[PIN_MAP_SIZE];
 
+struct io_apic {
+        unsigned int index;
+        unsigned int unused[3];
+        unsigned int data;
+};
+
+static __attribute_const__ struct io_apic __iomem *io_apic_base(int idx)
+{
+        return (void __iomem *) __fix_to_virt(FIX_IO_APIC_BASE_0 + idx)
+                + (mp_ioapics[idx].mpc_apicaddr & ~PAGE_MASK);
+}
+
+static inline unsigned int io_apic_read(unsigned int apic, unsigned int reg)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        writel(reg, &io_apic->index);
+        return readl(&io_apic->data);
+}
+
+static inline void io_apic_write(unsigned int apic, unsigned int reg, unsigned int value)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        writel(reg, &io_apic->index);
+        writel(value, &io_apic->data);
+}
+
+/*
+ * Re-write a value: to be used for read-modify-write
+ * cycles where the read already set up the index register.
+ *
+ * Older SiS APIC requires we rewrite the index register
+ */
+static inline void io_apic_modify(unsigned int apic, unsigned int reg, unsigned int value)
+{
+        volatile struct io_apic *io_apic = io_apic_base(apic);
+        if (sis_apic_bug)
+                writel(reg, &io_apic->index);
+        writel(value, &io_apic->data);
+}
+
 union entry_union {
         struct { u32 w1, w2; };
         struct IO_APIC_route_entry entry;
@@ -107,12 +147,34 @@ static struct IO_APIC_route_entry ioapic_read_entry(int apic, int pin)
         return eu.entry;
 }
 
+/*
+ * When we write a new IO APIC routing entry, we need to write the high
+ * word first! If the mask bit in the low word is clear, we will enable
+ * the interrupt, and we need to make sure the entry is fully populated
+ * before that happens.
+ */
 static void ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
 {
         unsigned long flags;
         union entry_union eu;
         eu.entry = e;
         spin_lock_irqsave(&ioapic_lock, flags);
+        io_apic_write(apic, 0x11 + 2*pin, eu.w2);
+        io_apic_write(apic, 0x10 + 2*pin, eu.w1);
+        spin_unlock_irqrestore(&ioapic_lock, flags);
+}
+
+/*
+ * When we mask an IO APIC routing entry, we need to write the low
+ * word first, in order to set the mask bit before we change the
+ * high bits!
+ */
+static void ioapic_mask_entry(int apic, int pin)
+{
+        unsigned long flags;
+        union entry_union eu = { .entry.mask = 1 };
+
+        spin_lock_irqsave(&ioapic_lock, flags);
         io_apic_write(apic, 0x10 + 2*pin, eu.w1);
         io_apic_write(apic, 0x11 + 2*pin, eu.w2);
         spin_unlock_irqrestore(&ioapic_lock, flags);
@@ -234,9 +296,7 @@ static void clear_IO_APIC_pin(unsigned int apic, unsigned int pin)
         /*
          * Disable it in the IO-APIC irq-routing table:
          */
-        memset(&entry, 0, sizeof(entry));
-        entry.mask = 1;
-        ioapic_write_entry(apic, pin, entry);
+        ioapic_mask_entry(apic, pin);
 }
 
 static void clear_IO_APIC (void)
@@ -1225,11 +1285,13 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
 {
         if ((trigger == IOAPIC_AUTO && IO_APIC_irq_trigger(irq)) ||
                         trigger == IOAPIC_LEVEL)
-                set_irq_chip_and_handler(irq, &ioapic_chip,
-                                         handle_fasteoi_irq);
-        else
-                set_irq_chip_and_handler(irq, &ioapic_chip,
-                                         handle_edge_irq);
+                set_irq_chip_and_handler_name(irq, &ioapic_chip,
+                                         handle_fasteoi_irq, "fasteoi");
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
+                set_irq_chip_and_handler_name(irq, &ioapic_chip,
+                                         handle_edge_irq, "edge");
+        }
         set_intr_gate(vector, interrupt[irq]);
 }
 
@@ -2235,7 +2297,8 @@ static inline void check_timer(void)
         printk(KERN_INFO "...trying to set up timer as Virtual Wire IRQ...");
 
         disable_8259A_irq(0);
-        set_irq_chip_and_handler(0, &lapic_chip, handle_fasteoi_irq);
+        set_irq_chip_and_handler_name(0, &lapic_chip, handle_fasteoi_irq,
+                                      "fasteio");
         apic_write_around(APIC_LVT0, APIC_DM_FIXED | vector);   /* Fixed mode */
         enable_8259A_irq(0);
 
@@ -2541,7 +2604,8 @@ int arch_setup_msi_irq(unsigned int irq, struct pci_dev *dev)
 
         write_msi_msg(irq, &msg);
 
-        set_irq_chip_and_handler(irq, &msi_chip, handle_edge_irq);
+        set_irq_chip_and_handler_name(irq, &msi_chip, handle_edge_irq,
+                                      "edge");
 
         return 0;
 }
@@ -2562,18 +2626,16 @@ void arch_teardown_msi_irq(unsigned int irq)
 
 static void target_ht_irq(unsigned int irq, unsigned int dest)
 {
-        u32 low, high;
-        low  = read_ht_irq_low(irq);
-        high = read_ht_irq_high(irq);
+        struct ht_irq_msg msg;
+        fetch_ht_irq_msg(irq, &msg);
 
-        low  &= ~(HT_IRQ_LOW_DEST_ID_MASK);
-        high &= ~(HT_IRQ_HIGH_DEST_ID_MASK);
+        msg.address_lo &= ~(HT_IRQ_LOW_DEST_ID_MASK);
+        msg.address_hi &= ~(HT_IRQ_HIGH_DEST_ID_MASK);
 
-        low  |= HT_IRQ_LOW_DEST_ID(dest);
-        high |= HT_IRQ_HIGH_DEST_ID(dest);
+        msg.address_lo |= HT_IRQ_LOW_DEST_ID(dest);
+        msg.address_hi |= HT_IRQ_HIGH_DEST_ID(dest);
 
-        write_ht_irq_low(irq, low);
-        write_ht_irq_high(irq, high);
+        write_ht_irq_msg(irq, &msg);
 }
 
 static void set_ht_irq_affinity(unsigned int irq, cpumask_t mask)
@@ -2594,7 +2656,7 @@ static void set_ht_irq_affinity(unsigned int irq, cpumask_t mask)
 }
 #endif
 
-static struct hw_interrupt_type ht_irq_chip = {
+static struct irq_chip ht_irq_chip = {
         .name           = "PCI-HT",
         .mask           = mask_ht_irq,
         .unmask         = unmask_ht_irq,
@@ -2611,7 +2673,7 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
 
         vector = assign_irq_vector(irq);
         if (vector >= 0) {
-                u32 low, high;
+                struct ht_irq_msg msg;
                 unsigned dest;
                 cpumask_t tmp;
 
@@ -2619,9 +2681,10 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
                 cpu_set(vector >> 8, tmp);
                 dest = cpu_mask_to_apicid(tmp);
 
-                high =  HT_IRQ_HIGH_DEST_ID(dest);
+                msg.address_hi = HT_IRQ_HIGH_DEST_ID(dest);
 
-                low =   HT_IRQ_LOW_BASE |
+                msg.address_lo =
+                        HT_IRQ_LOW_BASE |
                         HT_IRQ_LOW_DEST_ID(dest) |
                         HT_IRQ_LOW_VECTOR(vector) |
                         ((INT_DEST_MODE == 0) ?
@@ -2633,10 +2696,10 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
                                 HT_IRQ_LOW_MT_ARBITRATED) |
                         HT_IRQ_LOW_IRQ_MASKED;
 
-                write_ht_irq_low(irq, low);
-                write_ht_irq_high(irq, high);
+                write_ht_irq_msg(irq, &msg);
 
-                set_irq_chip_and_handler(irq, &ht_irq_chip, handle_edge_irq);
+                set_irq_chip_and_handler_name(irq, &ht_irq_chip,
+                                              handle_edge_irq, "edge");
         }
         return vector;
 }
diff --git a/arch/i386/kernel/irq.c b/arch/i386/kernel/irq.c
index 8cfc7dbec7b9..3201d421090a 100644
--- a/arch/i386/kernel/irq.c
+++ b/arch/i386/kernel/irq.c
@@ -258,7 +258,7 @@ int show_interrupts(struct seq_file *p, void *v)
                         seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
 #endif
                 seq_printf(p, " %8s", irq_desc[i].chip->name);
-                seq_printf(p, "-%s", handle_irq_name(irq_desc[i].handle_irq));
+                seq_printf(p, "-%-8s", irq_desc[i].name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
diff --git a/arch/i386/kernel/kprobes.c b/arch/i386/kernel/kprobes.c
index d98e44b16fe2..fc79e1e859c4 100644
--- a/arch/i386/kernel/kprobes.c
+++ b/arch/i386/kernel/kprobes.c
@@ -361,8 +361,11 @@ no_kprobe:
         asm volatile ( ".global kretprobe_trampoline\n"
                         "kretprobe_trampoline: \n"
                         "       pushf\n"
-                        /* skip cs, eip, orig_eax, es, ds */
-                        "       subl $20, %esp\n"
+                        /* skip cs, eip, orig_eax */
+                        "       subl $12, %esp\n"
+                        "       pushl %gs\n"
+                        "       pushl %ds\n"
+                        "       pushl %es\n"
                         "       pushl %eax\n"
                         "       pushl %ebp\n"
                         "       pushl %edi\n"
@@ -373,10 +376,10 @@ no_kprobe:
                         "       movl %esp, %eax\n"
                         "       call trampoline_handler\n"
                         /* move eflags to cs */
-                        "       movl 48(%esp), %edx\n"
-                        "       movl %edx, 44(%esp)\n"
+                        "       movl 52(%esp), %edx\n"
+                        "       movl %edx, 48(%esp)\n"
                         /* save true return address on eflags */
-                        "       movl %eax, 48(%esp)\n"
+                        "       movl %eax, 52(%esp)\n"
                         "       popl %ebx\n"
                         "       popl %ecx\n"
                         "       popl %edx\n"
@@ -384,8 +387,8 @@ no_kprobe:
                         "       popl %edi\n"
                         "       popl %ebp\n"
                         "       popl %eax\n"
-                        /* skip eip, orig_eax, es, ds */
-                        "       addl $16, %esp\n"
+                        /* skip eip, orig_eax, es, ds, gs */
+                        "       addl $20, %esp\n"
                         "       popf\n"
                         "       ret\n");
 }
@@ -404,6 +407,10 @@ fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
         INIT_HLIST_HEAD(&empty_rp);
         spin_lock_irqsave(&kretprobe_lock, flags);
         head = kretprobe_inst_table_head(current);
+        /* fixup registers */
+        regs->xcs = __KERNEL_CS;
+        regs->eip = trampoline_address;
+        regs->orig_eax = 0xffffffff;
 
         /*
          * It is possible to have multiple instances associated with a given
@@ -425,6 +432,7 @@ fastcall void *__kprobes trampoline_handler(struct pt_regs *regs)
 
                 if (ri->rp && ri->rp->handler){
                         __get_cpu_var(current_kprobe) = &ri->rp->kp;
+                        get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE;
                         ri->rp->handler(ri, regs);
                         __get_cpu_var(current_kprobe) = NULL;
                 }
diff --git a/arch/i386/kernel/microcode.c b/arch/i386/kernel/microcode.c
index 9b9479768d5e..23f5984d0654 100644
--- a/arch/i386/kernel/microcode.c
+++ b/arch/i386/kernel/microcode.c
@@ -577,7 +577,7 @@ static void microcode_init_cpu(int cpu)
         set_cpus_allowed(current, cpumask_of_cpu(cpu));
         mutex_lock(&microcode_mutex);
         collect_cpu_info(cpu);
-        if (uci->valid)
+        if (uci->valid && system_state == SYSTEM_RUNNING)
                 cpu_request_microcode(cpu);
         mutex_unlock(&microcode_mutex);
         set_cpus_allowed(current, old);
@@ -656,14 +656,18 @@ static struct attribute_group mc_attr_group = {
 
 static int mc_sysdev_add(struct sys_device *sys_dev)
 {
-        int cpu = sys_dev->id;
+        int err, cpu = sys_dev->id;
         struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
 
         if (!cpu_online(cpu))
                 return 0;
+
         pr_debug("Microcode:CPU %d added\n", cpu);
         memset(uci, 0, sizeof(*uci));
-        sysfs_create_group(&sys_dev->kobj, &mc_attr_group);
+
+        err = sysfs_create_group(&sys_dev->kobj, &mc_attr_group);
+        if (err)
+                return err;
 
         microcode_init_cpu(cpu);
         return 0;
diff --git a/arch/i386/kernel/nmi.c b/arch/i386/kernel/nmi.c
index 3e8e3adb0489..eaafe233a5da 100644
--- a/arch/i386/kernel/nmi.c
+++ b/arch/i386/kernel/nmi.c
@@ -219,11 +219,11 @@ static int __init check_nmi_watchdog(void)
         int cpu;
 
         /* Enable NMI watchdog for newer systems.
-           Actually it should be safe for most systems before 2004 too except
-           for some IBM systems that corrupt registers when NMI happens
-           during SMM. Unfortunately we don't have more exact information
-           on these and use this coarse check. */
-        if (nmi_watchdog == NMI_DEFAULT && dmi_get_year(DMI_BIOS_DATE) >= 2004)
+           Probably safe on most older systems too, but let's be careful.
+           IBM ThinkPads use INT10 inside SMM and that allows early NMI inside SMM
+           which hangs the system. Disable watchdog for all thinkpads */
+        if (nmi_watchdog == NMI_DEFAULT && dmi_get_year(DMI_BIOS_DATE) >= 2004 &&
+                !dmi_name_in_vendors("ThinkPad"))
                 nmi_watchdog = NMI_LOCAL_APIC;
 
         if ((nmi_watchdog == NMI_NONE) || (nmi_watchdog == NMI_DEFAULT))
diff --git a/arch/i386/kernel/process.c b/arch/i386/kernel/process.c
index b0a07801d9df..dd53c58f64f1 100644
--- a/arch/i386/kernel/process.c
+++ b/arch/i386/kernel/process.c
@@ -205,7 +205,7 @@ void cpu_idle(void)
 void cpu_idle_wait(void)
 {
         unsigned int cpu, this_cpu = get_cpu();
-        cpumask_t map;
+        cpumask_t map, tmp = current->cpus_allowed;
 
         set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
         put_cpu();
@@ -227,6 +227,8 @@ void cpu_idle_wait(void)
                 }
                 cpus_and(map, map, cpu_online_map);
         } while (!cpus_empty(map));
+
+        set_cpus_allowed(current, tmp);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
@@ -236,20 +238,28 @@ EXPORT_SYMBOL_GPL(cpu_idle_wait);
  * We execute MONITOR against need_resched and enter optimized wait state
  * through MWAIT. Whenever someone changes need_resched, we would be woken
  * up from MWAIT (without an IPI).
+ *
+ * New with Core Duo processors, MWAIT can take some hints based on CPU
+ * capability.
  */
-static void mwait_idle(void)
+void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
 {
-        local_irq_enable();
-
-        while (!need_resched()) {
+        if (!need_resched()) {
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
-                if (need_resched())
-                        break;
-                __mwait(0, 0);
+                if (!need_resched())
+                        __mwait(eax, ecx);
         }
 }
 
+/* Default MONITOR/MWAIT with no hints, used for default C1 state */
+static void mwait_idle(void)
+{
+        local_irq_enable();
+        while (!need_resched())
+                mwait_idle_with_hints(0, 0);
+}
+
 void __devinit select_idle_routine(const struct cpuinfo_x86 *c)
 {
         if (cpu_has(c, X86_FEATURE_MWAIT)) {
@@ -328,7 +338,6 @@ extern void kernel_thread_helper(void);
 int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
 {
         struct pt_regs regs;
-        int err;
 
         memset(&regs, 0, sizeof(regs));
 
@@ -343,10 +352,7 @@ int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
         regs.eflags = X86_EFLAGS_IF | X86_EFLAGS_SF | X86_EFLAGS_PF | 0x2;
 
         /* Ok, create the new process.. */
-        err = do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
-        if (err == 0) /* terminate kernel stack */
-                task_pt_regs(current)->eip = 0;
-        return err;
+        return do_fork(flags | CLONE_VM | CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
 }
 EXPORT_SYMBOL(kernel_thread);
 
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index 000cf03751fe..141041dde74d 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -846,7 +846,7 @@ efi_find_max_pfn(unsigned long start, unsigned long end, void *arg)
 static int __init
 efi_memory_present_wrapper(unsigned long start, unsigned long end, void *arg)
 {
-        memory_present(0, start, end);
+        memory_present(0, PFN_UP(start), PFN_DOWN(end));
         return 0;
 }
 
@@ -1083,16 +1083,15 @@ static unsigned long __init setup_memory(void)
 
 void __init zone_sizes_init(void)
 {
+        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_DMA] =
+                virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
 #ifdef CONFIG_HIGHMEM
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = {
-                        virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT,
-                        max_low_pfn,
-                        highend_pfn};
+        max_zone_pfns[ZONE_HIGHMEM] = highend_pfn;
         add_active_range(0, 0, highend_pfn);
 #else
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = {
-                        virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT,
-                        max_low_pfn};
         add_active_range(0, 0, max_low_pfn);
 #endif
 
diff --git a/arch/i386/kernel/syscall_table.S b/arch/i386/kernel/syscall_table.S
index 7e639f78b0b9..2697e9210e92 100644
--- a/arch/i386/kernel/syscall_table.S
+++ b/arch/i386/kernel/syscall_table.S
@@ -318,3 +318,4 @@ ENTRY(sys_call_table)
         .long sys_vmsplice
         .long sys_move_pages
         .long sys_getcpu
+        .long sys_epoll_pwait
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index 00489b706d27..fe9c5e8e7e6f 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -129,15 +129,19 @@ static inline unsigned long print_context_stack(struct thread_info *tinfo,
 
 #ifdef  CONFIG_FRAME_POINTER
         while (valid_stack_ptr(tinfo, (void *)ebp)) {
+                unsigned long new_ebp;
                 addr = *(unsigned long *)(ebp + 4);
                 ops->address(data, addr);
                 /*
                  * break out of recursive entries (such as
-                 * end_of_stack_stop_unwind_function):
+                 * end_of_stack_stop_unwind_function). Also,
+                 * we can never allow a frame pointer to
+                 * move downwards!
                  */
-                if (ebp == *(unsigned long *)ebp)
+                new_ebp = *(unsigned long *)ebp;
+                if (new_ebp <= ebp)
                         break;
-                ebp = *(unsigned long *)ebp;
+                ebp = new_ebp;
         }
 #else
         while (valid_stack_ptr(tinfo, stack)) {
diff --git a/arch/i386/kernel/tsc.c b/arch/i386/kernel/tsc.c
index b8fa0a8b2e47..fbc95828cd74 100644
--- a/arch/i386/kernel/tsc.c
+++ b/arch/i386/kernel/tsc.c
@@ -349,8 +349,8 @@ static int tsc_update_callback(void)
         int change = 0;
 
         /* check to see if we should switch to the safe clocksource: */
-        if (clocksource_tsc.rating != 50 && check_tsc_unstable()) {
-                clocksource_tsc.rating = 50;
+        if (clocksource_tsc.rating != 0 && check_tsc_unstable()) {
+                clocksource_tsc.rating = 0;
                 clocksource_reselect();
                 change = 1;
         }
@@ -461,7 +461,7 @@ static int __init init_tsc_clocksource(void)
                                                         clocksource_tsc.shift);
                 /* lower the rating if we already know its unstable: */
                 if (check_tsc_unstable())
-                        clocksource_tsc.rating = 50;
+                        clocksource_tsc.rating = 0;
 
                 init_timer(&verify_tsc_freq_timer);
                 verify_tsc_freq_timer.function = verify_tsc_freq;
diff --git a/arch/i386/kernel/vmlinux.lds.S b/arch/i386/kernel/vmlinux.lds.S
index 1e7ac1c44ddc..c6f84a0322ba 100644
--- a/arch/i386/kernel/vmlinux.lds.S
+++ b/arch/i386/kernel/vmlinux.lds.S
@@ -51,6 +51,7 @@ SECTIONS
   __tracedata_end = .;
 
   /* writeable */
+  . = ALIGN(4096);
   .data : AT(ADDR(.data) - LOAD_OFFSET) {       /* Data */
         *(.data)
         CONSTRUCTORS
@@ -126,13 +127,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : AT(ADDR(.initcall.init) - LOAD_OFFSET) {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/i386/lib/usercopy.c b/arch/i386/lib/usercopy.c
index 08502fc6d0cb..d22cfc9d656c 100644
--- a/arch/i386/lib/usercopy.c
+++ b/arch/i386/lib/usercopy.c
@@ -9,6 +9,7 @@
 #include <linux/highmem.h>
 #include <linux/blkdev.h>
 #include <linux/module.h>
+#include <linux/backing-dev.h>
 #include <asm/uaccess.h>
 #include <asm/mmx.h>
 
@@ -179,7 +180,7 @@ __clear_user(void __user *to, unsigned long n)
 EXPORT_SYMBOL(__clear_user);
 
 /**
- * strlen_user: - Get the size of a string in user space.
+ * strnlen_user: - Get the size of a string in user space.
  * @s: The string to measure.
  * @n: The maximum valid length
  *
@@ -741,7 +742,7 @@ survive:
 
                         if (retval == -ENOMEM && is_init(current)) {
                                 up_read(&current->mm->mmap_sem);
-                                blk_congestion_wait(WRITE, HZ/50);
+                                congestion_wait(WRITE, HZ/50);
                                 goto survive;
                         }
 
diff --git a/arch/i386/mach-visws/visws_apic.c b/arch/i386/mach-visws/visws_apic.c
index 07097ed48890..38c2b13124d9 100644
--- a/arch/i386/mach-visws/visws_apic.c
+++ b/arch/i386/mach-visws/visws_apic.c
@@ -122,7 +122,7 @@ static void end_cobalt_irq(unsigned int irq)
         spin_unlock_irqrestore(&cobalt_lock, flags);
 }
 
-static struct hw_interrupt_type cobalt_irq_type = {
+static struct irq_chip cobalt_irq_type = {
         .typename =     "Cobalt-APIC",
         .startup =      startup_cobalt_irq,
         .shutdown =     disable_cobalt_irq,
@@ -159,7 +159,7 @@ static void end_piix4_master_irq(unsigned int irq)
         spin_unlock_irqrestore(&cobalt_lock, flags);
 }
 
-static struct hw_interrupt_type piix4_master_irq_type = {
+static struct irq_chip piix4_master_irq_type = {
         .typename =     "PIIX4-master",
         .startup =      startup_piix4_master_irq,
         .ack =          ack_cobalt_irq,
@@ -167,9 +167,8 @@ static struct hw_interrupt_type piix4_master_irq_type = {
 };
 
 
-static struct hw_interrupt_type piix4_virtual_irq_type = {
+static struct irq_chip piix4_virtual_irq_type = {
         .typename =     "PIIX4-virtual",
-        .startup =      startup_8259A_irq,
         .shutdown =     disable_8259A_irq,
         .enable =       enable_8259A_irq,
         .disable =      disable_8259A_irq,
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index c639d30d8bdc..8fe7e4593d5f 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -44,7 +44,7 @@ struct voyager_SUS *voyager_SUS = NULL;
 
 #ifdef CONFIG_SMP
 static void
-voyager_dump(int dummy1, struct pt_regs *dummy2, struct tty_struct *dummy3)
+voyager_dump(int dummy1, struct tty_struct *dummy3)
 {
         /* get here via a sysrq */
         voyager_smp_dump();
@@ -166,7 +166,7 @@ voyager_memory_detect(int region, __u32 *start, __u32 *length)
  * off the timer tick to the SMP code, since the VIC doesn't have an
  * internal timer (The QIC does, but that's another story). */
 void
-voyager_timer_interrupt(struct pt_regs *regs)
+voyager_timer_interrupt(void)
 {
         if((jiffies & 0x3ff) == 0) {
 
@@ -202,7 +202,7 @@ voyager_timer_interrupt(struct pt_regs *regs)
                 }
         }
 #ifdef CONFIG_SMP
-        smp_vic_timer_interrupt(regs);
+        smp_vic_timer_interrupt();
 #endif
 }
 
diff --git a/arch/i386/mach-voyager/voyager_smp.c b/arch/i386/mach-voyager/voyager_smp.c
index d42422fc4af3..f3fea2ad50fe 100644
--- a/arch/i386/mach-voyager/voyager_smp.c
+++ b/arch/i386/mach-voyager/voyager_smp.c
@@ -85,8 +85,8 @@ static int ack_QIC_CPI(__u8 cpi);
 static void ack_special_QIC_CPI(__u8 cpi);
 static void ack_VIC_CPI(__u8 cpi);
 static void send_CPI_allbutself(__u8 cpi);
-static void enable_vic_irq(unsigned int irq);
-static void disable_vic_irq(unsigned int irq);
+static void mask_vic_irq(unsigned int irq);
+static void unmask_vic_irq(unsigned int irq);
 static unsigned int startup_vic_irq(unsigned int irq);
 static void enable_local_vic_irq(unsigned int irq);
 static void disable_local_vic_irq(unsigned int irq);
@@ -205,15 +205,12 @@ ack_CPI(__u8 cpi)
 /* The VIC IRQ descriptors -- these look almost identical to the
  * 8259 IRQs except that masks and things must be kept per processor
  */
-static struct hw_interrupt_type vic_irq_type = {
-        .typename = "VIC-level",
-        .startup = startup_vic_irq,
-        .shutdown = disable_vic_irq,
-        .enable = enable_vic_irq,
-        .disable = disable_vic_irq,
-        .ack = before_handle_vic_irq,
-        .end = after_handle_vic_irq,
-        .set_affinity = set_vic_irq_affinity,
+static struct irq_chip vic_chip = {
+        .name           = "VIC",
+        .startup        = startup_vic_irq,
+        .mask           = mask_vic_irq,
+        .unmask         = unmask_vic_irq,
+        .set_affinity   = set_vic_irq_affinity,
 };
 
 /* used to count up as CPUs are brought on line (starts at 0) */
@@ -1144,9 +1141,9 @@ smp_apic_timer_interrupt(struct pt_regs *regs)
 fastcall void
 smp_qic_timer_interrupt(struct pt_regs *regs)
 {
-        ack_QIC_CPI(QIC_TIMER_CPI);
         struct pt_regs *old_regs = set_irq_regs(regs);
-        wrapper_smp_local_timer_interrupt(void);
+        ack_QIC_CPI(QIC_TIMER_CPI);
+        wrapper_smp_local_timer_interrupt();
         set_irq_regs(old_regs);
 }
 
@@ -1270,12 +1267,10 @@ smp_send_stop(void)
 /* this function is triggered in time.c when a clock tick fires
  * we need to re-broadcast the tick to all CPUs */
 void
-smp_vic_timer_interrupt(struct pt_regs *regs)
+smp_vic_timer_interrupt(void)
 {
-        struct pt_regs *old_regs = set_irq_regs(regs);
         send_CPI_allbutself(VIC_TIMER_CPI);
         smp_local_timer_interrupt();
-        set_irq_regs(old_regs);
 }
 
 /* local (per CPU) timer interrupt.  It does both profiling and
@@ -1310,7 +1305,7 @@ smp_local_timer_interrupt(void)
                                                 per_cpu(prof_counter, cpu);
                 }
 
-                update_process_times(user_mode_vm(irq_regs));
+                update_process_times(user_mode_vm(get_irq_regs()));
         }
 
         if( ((1<<cpu) & voyager_extended_vic_processors) == 0)
@@ -1397,6 +1392,17 @@ setup_profiling_timer(unsigned int multiplier)
         return 0;
 }
 
+/* This is a bit of a mess, but forced on us by the genirq changes
+ * there's no genirq handler that really does what voyager wants
+ * so hack it up with the simple IRQ handler */
+static void fastcall
+handle_vic_irq(unsigned int irq, struct irq_desc *desc)
+{
+        before_handle_vic_irq(irq);
+        handle_simple_irq(irq, desc);
+        after_handle_vic_irq(irq);
+}
+
 
 /*  The CPIs are handled in the per cpu 8259s, so they must be
  *  enabled to be received: FIX: enabling the CPIs in the early
@@ -1433,7 +1439,7 @@ smp_intr_init(void)
          * This is for later: first 16 correspond to PC IRQs; next 16
          * are Primary MC IRQs and final 16 are Secondary MC IRQs */
         for(i = 0; i < 48; i++)
-                irq_desc[i].chip = &vic_irq_type;
+                set_irq_chip_and_handler(i, &vic_chip, handle_vic_irq);
 }
 
 /* send a CPI at level cpi to a set of cpus in cpuset (set 1 bit per
@@ -1531,7 +1537,7 @@ ack_VIC_CPI(__u8 cpi)
 static unsigned int
 startup_vic_irq(unsigned int irq)
 {
-        enable_vic_irq(irq);
+        unmask_vic_irq(irq);
 
         return 0;
 }
@@ -1558,7 +1564,7 @@ startup_vic_irq(unsigned int irq)
  *    adjust their masks accordingly.  */
 
 static void
-enable_vic_irq(unsigned int irq)
+unmask_vic_irq(unsigned int irq)
 {
         /* linux doesn't to processor-irq affinity, so enable on
          * all CPUs we know about */
@@ -1567,7 +1573,7 @@ enable_vic_irq(unsigned int irq)
         __u32 processorList = 0;
         unsigned long flags;
 
-        VDEBUG(("VOYAGER: enable_vic_irq(%d) CPU%d affinity 0x%lx\n",
+        VDEBUG(("VOYAGER: unmask_vic_irq(%d) CPU%d affinity 0x%lx\n",
                 irq, cpu, cpu_irq_affinity[cpu]));
         spin_lock_irqsave(&vic_irq_lock, flags);
         for_each_online_cpu(real_cpu) {
@@ -1591,7 +1597,7 @@ enable_vic_irq(unsigned int irq)
 }
 
 static void
-disable_vic_irq(unsigned int irq)
+mask_vic_irq(unsigned int irq)
 {
         /* lazy disable, do nothing */
 }
@@ -1819,7 +1825,7 @@ set_vic_irq_affinity(unsigned int irq, cpumask_t mask)
          * disabled again as it comes in (voyager lazy disable).  If
          * the affinity map is tightened to disable the interrupt on a
          * cpu, it will be pushed off when it comes in */
-        enable_vic_irq(irq);
+        unmask_vic_irq(irq);
 }
 
 static void
diff --git a/arch/i386/mm/discontig.c b/arch/i386/mm/discontig.c
index 455597db84df..ddbdb0336f28 100644
--- a/arch/i386/mm/discontig.c
+++ b/arch/i386/mm/discontig.c
@@ -356,11 +356,12 @@ void __init numa_kva_reserve(void)
 void __init zone_sizes_init(void)
 {
         int nid;
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = {
-                virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT,
-                max_low_pfn,
-                highend_pfn
-        };
+        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_DMA] =
+                virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
+        max_zone_pfns[ZONE_HIGHMEM] = highend_pfn;
 
         /* If SRAT has not registered memory, register it now */
         if (find_max_pfn_with_active_regions() == 0) {
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 68bce194e688..cdfcf971098b 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -20,6 +20,7 @@
 unsigned int pci_probe = PCI_PROBE_BIOS | PCI_PROBE_CONF1 | PCI_PROBE_CONF2 |
                                 PCI_PROBE_MMCONF;
 
+int pci_bf_sort;
 int pci_routeirq;
 int pcibios_last_bus = -1;
 unsigned long pirq_table_addr;
@@ -118,6 +119,20 @@ void __devinit  pcibios_fixup_bus(struct pci_bus *b)
 }
 
 /*
+ * Only use DMI information to set this if nothing was passed
+ * on the kernel command line (which was parsed earlier).
+ */
+
+static int __devinit set_bf_sort(struct dmi_system_id *d)
+{
+        if (pci_bf_sort == pci_bf_sort_default) {
+                pci_bf_sort = pci_dmi_bf;
+                printk(KERN_INFO "PCI: %s detected, enabling pci=bfsort.\n", d->ident);
+        }
+        return 0;
+}
+
+/*
  * Enable renumbering of PCI bus# ranges to reach all PCI busses (Cardbus)
  */
 #ifdef __i386__
@@ -130,11 +145,11 @@ static int __devinit assign_all_busses(struct dmi_system_id *d)
 }
 #endif
 
+static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
+#ifdef __i386__
 /*
  * Laptops which need pci=assign-busses to see Cardbus cards
  */
-static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
-#ifdef __i386__
         {
                 .callback = assign_all_busses,
                 .ident = "Samsung X20 Laptop",
@@ -144,6 +159,38 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
                 },
         },
 #endif          /* __i386__ */
+        {
+                .callback = set_bf_sort,
+                .ident = "Dell PowerEdge 1950",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 1950"),
+                },
+        },
+        {
+                .callback = set_bf_sort,
+                .ident = "Dell PowerEdge 1955",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 1955"),
+                },
+        },
+        {
+                .callback = set_bf_sort,
+                .ident = "Dell PowerEdge 2900",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 2900"),
+                },
+        },
+        {
+                .callback = set_bf_sort,
+                .ident = "Dell PowerEdge 2950",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PowerEdge 2950"),
+                },
+        },
         {}
 };
 
@@ -189,6 +236,8 @@ static int __init pcibios_init(void)
 
         pcibios_resource_survey();
 
+        if (pci_bf_sort >= pci_force_bf)
+                pci_sort_breadthfirst();
 #ifdef CONFIG_PCI_BIOS
         if ((pci_probe & PCI_BIOS_SORT) && !(pci_probe & PCI_NO_SORT))
                 pcibios_sort();
@@ -203,6 +252,12 @@ char * __devinit  pcibios_setup(char *str)
         if (!strcmp(str, "off")) {
                 pci_probe = 0;
                 return NULL;
+        } else if (!strcmp(str, "bfsort")) {
+                pci_bf_sort = pci_force_bf;
+                return NULL;
+        } else if (!strcmp(str, "nobfsort")) {
+                pci_bf_sort = pci_force_nobf;
+                return NULL;
         }
 #ifdef CONFIG_PCI_BIOS
         else if (!strcmp(str, "bios")) {
@@ -288,7 +343,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
 
 void pcibios_disable_device (struct pci_dev *dev)
 {
-        pcibios_disable_resources(dev);
         if (pcibios_disable_irq)
                 pcibios_disable_irq(dev);
 }
diff --git a/arch/i386/pci/fixup.c b/arch/i386/pci/fixup.c
index b60d7e8689ed..c1949ff38d61 100644
--- a/arch/i386/pci/fixup.c
+++ b/arch/i386/pci/fixup.c
@@ -348,8 +348,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	PCI_DEVICE_ID_INTEL_MCH_PC1,	pcie_r
  * From information provided by "Jon Smirl" <jonsmirl@gmail.com>
  *
  * The standard boot ROM sequence for an x86 machine uses the BIOS
- * to select an initial video card for boot display. This boot video 
- * card will have it's BIOS copied to C0000 in system RAM. 
+ * to select an initial video card for boot display. This boot video
+ * card will have it's BIOS copied to C0000 in system RAM.
  * IORESOURCE_ROM_SHADOW is used to associate the boot video
  * card with this copy. On laptops this copy has to be used since
  * the main ROM may be compressed or combined with another image.
@@ -371,7 +371,17 @@ static void __devinit pci_fixup_video(struct pci_dev *pdev)
         bus = pdev->bus;
         while (bus) {
                 bridge = bus->self;
-                if (bridge) {
+
+                /*
+                 * From information provided by
+                 * "David Miller" <davem@davemloft.net>
+                 * The bridge control register is valid for PCI header
+                 * type BRIDGE, or CARDBUS. Host to PCI controllers use
+                 * PCI header type NORMAL.
+                 */
+                if (bridge
+                    &&((bridge->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+                       ||(bridge->hdr_type == PCI_HEADER_TYPE_CARDBUS))) {
                         pci_read_config_word(bridge, PCI_BRIDGE_CONTROL,
                                                 &config);
                         if (!(config & PCI_BRIDGE_CTL_VGA))
diff --git a/arch/i386/pci/i386.c b/arch/i386/pci/i386.c
index 10154a2cac68..98580292f0d4 100644
--- a/arch/i386/pci/i386.c
+++ b/arch/i386/pci/i386.c
@@ -242,15 +242,6 @@ int pcibios_enable_resources(struct pci_dev *dev, int mask)
         return 0;
 }
 
-void pcibios_disable_resources(struct pci_dev *dev)
-{
-        u16 cmd;
-
-        pci_read_config_word(dev, PCI_COMMAND, &cmd);
-        cmd &= ~(PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
-        pci_write_config_word(dev, PCI_COMMAND, cmd);
-}
-
 /*
  *  If we set up a device for bus mastering, we need to check the latency
  *  timer as certain crappy BIOSes forget to set it properly.
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index dbc4aae91959..69163998adeb 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -255,13 +255,13 @@ static int pirq_via_set(struct pci_dev *router, struct pci_dev *dev, int pirq, i
  */
 static int pirq_via586_get(struct pci_dev *router, struct pci_dev *dev, int pirq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
         return read_config_nybble(router, 0x55, pirqmap[pirq-1]);
 }
 
 static int pirq_via586_set(struct pci_dev *router, struct pci_dev *dev, int pirq, int irq)
 {
-        static const unsigned int pirqmap[4] = { 3, 2, 5, 1 };
+        static const unsigned int pirqmap[5] = { 3, 2, 5, 1, 1 };
         write_config_nybble(router, 0x55, pirqmap[pirq-1], irq);
         return 1;
 }
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index d0c3da3aa2aa..c6b6d9bbc453 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -154,38 +154,6 @@ static struct pci_raw_ops pci_mmcfg = {
         .write =        pci_mmcfg_write,
 };
 
-
-static __init void pci_mmcfg_insert_resources(void)
-{
-#define PCI_MMCFG_RESOURCE_NAME_LEN 19
-        int i;
-        struct resource *res;
-        char *names;
-        unsigned num_buses;
-
-        res = kcalloc(PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res),
-                        pci_mmcfg_config_num, GFP_KERNEL);
-
-        if (!res) {
-                printk(KERN_ERR "PCI: Unable to allocate MMCONFIG resources\n");
-                return;
-        }
-
-        names = (void *)&res[pci_mmcfg_config_num];
-        for (i = 0; i < pci_mmcfg_config_num; i++, res++) {
-                num_buses = pci_mmcfg_config[i].end_bus_number -
-                    pci_mmcfg_config[i].start_bus_number + 1;
-                res->name = names;
-                snprintf(names, PCI_MMCFG_RESOURCE_NAME_LEN, "PCI MMCONFIG %u",
-                        pci_mmcfg_config[i].pci_segment_group_number);
-                res->start = pci_mmcfg_config[i].base_address;
-                res->end = res->start + (num_buses << 20) - 1;
-                res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
-                insert_resource(&iomem_resource, res);
-                names += PCI_MMCFG_RESOURCE_NAME_LEN;
-        }
-}
-
 /* K8 systems have some devices (typically in the builtin northbridge)
    that are only accessible using type1
    Normally this can be expressed in the MCFG by not listing them
@@ -222,8 +190,6 @@ static __init void unreachable_devices(void)
         }
 }
 
-
-
 void __init pci_mmcfg_init(int type)
 {
         if ((pci_probe & PCI_PROBE_MMCONF) == 0)
@@ -251,5 +217,4 @@ void __init pci_mmcfg_init(int type)
         pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
 
         unreachable_devices();
-        pci_mmcfg_insert_resources();
 }
diff --git a/arch/i386/pci/pci.h b/arch/i386/pci/pci.h
index 1814f74569c6..a0a25180b61a 100644
--- a/arch/i386/pci/pci.h
+++ b/arch/i386/pci/pci.h
@@ -30,13 +30,19 @@
 extern unsigned int pci_probe;
 extern unsigned long pirq_table_addr;
 
+enum pci_bf_sort_state {
+        pci_bf_sort_default,
+        pci_force_nobf,
+        pci_force_bf,
+        pci_dmi_bf,
+};
+
 /* pci-i386.c */
 
 extern unsigned int pcibios_max_latency;
 
 void pcibios_resource_survey(void);
 int pcibios_enable_resources(struct pci_dev *, int);
-void pcibios_disable_resources(struct pci_dev *);
 
 /* pci-pc.c */
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 70f7eb9fed35..683b12c6f76c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -341,6 +341,7 @@ config NUMA
         bool "NUMA support"
         depends on !IA64_HP_SIM && !FLATMEM
         default y if IA64_SGI_SN2
+        select ACPI_NUMA if ACPI
         help
           Say Y to compile the kernel to support NUMA (Non-Uniform Memory
           Access).  This option is for configuring high-end multiprocessor
@@ -483,6 +484,15 @@ source "net/Kconfig"
 
 source "drivers/Kconfig"
 
+config MSPEC
+        tristate "Memory special operations driver"
+        depends on IA64
+        select IA64_UNCACHED_ALLOCATOR
+        help
+          If you have an ia64 and you want to enable memory special
+          operations support (formerly known as fetchop), say Y here,
+          otherwise say N.
+
 source "fs/Kconfig"
 
 source "lib/Kconfig"
diff --git a/arch/ia64/configs/sn2_defconfig b/arch/ia64/configs/sn2_defconfig
index 0f14a82b856e..64e951de4e57 100644
--- a/arch/ia64/configs/sn2_defconfig
+++ b/arch/ia64/configs/sn2_defconfig
@@ -1,8 +1,9 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.17-rc3
-# Thu Apr 27 11:48:23 2006
+# Linux kernel version: 2.6.19-rc1
+# Mon Oct  9 10:53:59 2006
 #
+CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
 # Code maturity level options
@@ -18,16 +19,22 @@ CONFIG_LOCALVERSION=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+CONFIG_TASKSTATS=y
+# CONFIG_TASK_DELAY_ACCT is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_CPUSETS=y
 CONFIG_RELAY=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_TASK_XACCT=y
+CONFIG_SYSCTL=y
 # CONFIG_EMBEDDED is not set
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 CONFIG_KALLSYMS_ALL=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -40,6 +47,8 @@ CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -58,6 +67,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
@@ -89,7 +99,7 @@ CONFIG_EFI=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_IA64_UNCACHED_ALLOCATOR=y
-CONFIG_DMA_IS_DMA32=y
+CONFIG_AUDIT_ARCH=y
 # CONFIG_IA64_GENERIC is not set
 # CONFIG_IA64_DIG is not set
 # CONFIG_IA64_HP_ZX1 is not set
@@ -116,6 +126,7 @@ CONFIG_FORCE_MAX_ZONEORDER=17
 CONFIG_SMP=y
 CONFIG_NR_CPUS=1024
 # CONFIG_HOTPLUG_CPU is not set
+CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_SCHED_SMT=y
 CONFIG_PREEMPT=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -128,6 +139,7 @@ CONFIG_NEED_MULTIPLE_NODES=y
 # CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
+CONFIG_RESOURCES_64BIT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ARCH_DISCONTIGMEM_ENABLE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
@@ -135,15 +147,24 @@ CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_DISCONTIGMEM_DEFAULT=y
 CONFIG_NUMA=y
 CONFIG_NODES_SHIFT=10
+CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_VIRTUAL_MEM_MAP=y
 CONFIG_HOLES_IN_ZONE=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
+CONFIG_HAVE_ARCH_NODEDATA_EXTENSION=y
 CONFIG_IA32_SUPPORT=y
 CONFIG_COMPAT=y
 CONFIG_IA64_MCA_RECOVERY=y
 CONFIG_PERFMON=y
 CONFIG_IA64_PALINFO=y
 CONFIG_SGI_SN=y
+# CONFIG_IA64_ESI is not set
+
+#
+# SN Devices
+#
+CONFIG_SGI_IOC4=y
+CONFIG_SGI_IOC3=y
 
 #
 # Firmware Drivers
@@ -159,6 +180,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_PM=y
 # CONFIG_PM_LEGACY is not set
 # CONFIG_PM_DEBUG is not set
+# CONFIG_PM_SYSFS_DEPRECATED is not set
 
 #
 # ACPI (Advanced Configuration and Power Interface) Support
@@ -166,6 +188,7 @@ CONFIG_PM=y
 CONFIG_ACPI=y
 # CONFIG_ACPI_BUTTON is not set
 # CONFIG_ACPI_FAN is not set
+# CONFIG_ACPI_DOCK is not set
 # CONFIG_ACPI_PROCESSOR is not set
 CONFIG_ACPI_NUMA=y
 CONFIG_ACPI_BLACKLIST_YEAR=0
@@ -185,7 +208,12 @@ CONFIG_ACPI_SYSTEM=y
 #
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_HOTPLUG_PCI_PCIE=y
+# CONFIG_HOTPLUG_PCI_PCIE_POLL_EVENT_MODE is not set
+CONFIG_PCIEAER=y
 # CONFIG_PCI_MSI is not set
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 # CONFIG_PCI_DEBUG is not set
 
 #
@@ -215,6 +243,9 @@ CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -231,19 +262,31 @@ CONFIG_SYN_COOKIES=y
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=m
 CONFIG_INET_TCP_DIAG=m
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_IPV6=m
 # CONFIG_IPV6_PRIVACY is not set
 # CONFIG_IPV6_ROUTER_PREF is not set
 # CONFIG_INET6_AH is not set
 # CONFIG_INET6_ESP is not set
 # CONFIG_INET6_IPCOMP is not set
+# CONFIG_IPV6_MIP6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
+CONFIG_INET6_XFRM_MODE_TRANSPORT=m
+CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
 # CONFIG_IPV6_TUNNEL is not set
+# CONFIG_IPV6_SUBTREES is not set
+# CONFIG_IPV6_MULTIPLE_TABLES is not set
+# CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -269,7 +312,6 @@ CONFIG_IPV6=m
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -298,6 +340,7 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
 # CONFIG_DEBUG_DRIVER is not set
+# CONFIG_SYS_HYPERVISOR is not set
 
 #
 # Connector - unified userspace <-> kernelspace linker
@@ -335,6 +378,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 CONFIG_ATA_OVER_ETH=m
@@ -381,6 +425,7 @@ CONFIG_IDEDMA_PCI_AUTO=y
 # CONFIG_BLK_DEV_CS5530 is not set
 # CONFIG_BLK_DEV_HPT34X is not set
 # CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
 # CONFIG_BLK_DEV_IT821X is not set
@@ -404,6 +449,7 @@ CONFIG_IDEDMA_AUTO=y
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+CONFIG_SCSI_NETLINK=y
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -425,12 +471,14 @@ CONFIG_SCSI_CONSTANTS=y
 # CONFIG_SCSI_LOGGING is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 CONFIG_SCSI_SPI_ATTRS=y
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_ISCSI_ATTRS=m
 CONFIG_SCSI_SAS_ATTRS=y
+CONFIG_SCSI_SAS_LIBSAS=y
+# CONFIG_SCSI_SAS_LIBSAS_DEBUG is not set
 
 #
 # SCSI low-level drivers
@@ -443,46 +491,82 @@ CONFIG_ISCSI_TCP=m
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
-CONFIG_SCSI_SATA=y
-# CONFIG_SCSI_SATA_AHCI is not set
-# CONFIG_SCSI_SATA_SVW is not set
-# CONFIG_SCSI_ATA_PIIX is not set
-# CONFIG_SCSI_SATA_MV is not set
-# CONFIG_SCSI_SATA_NV is not set
-# CONFIG_SCSI_PDC_ADMA is not set
-# CONFIG_SCSI_SATA_QSTOR is not set
-# CONFIG_SCSI_SATA_PROMISE is not set
-# CONFIG_SCSI_SATA_SX4 is not set
-# CONFIG_SCSI_SATA_SIL is not set
-# CONFIG_SCSI_SATA_SIL24 is not set
-# CONFIG_SCSI_SATA_SIS is not set
-# CONFIG_SCSI_SATA_ULI is not set
-# CONFIG_SCSI_SATA_VIA is not set
-CONFIG_SCSI_SATA_VITESSE=y
+# CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_IPR is not set
 CONFIG_SCSI_QLOGIC_1280=y
 CONFIG_SCSI_QLA_FC=y
-CONFIG_SCSI_QLA2XXX_EMBEDDED_FIRMWARE=y
-# CONFIG_SCSI_QLA21XX is not set
-CONFIG_SCSI_QLA22XX=y
-CONFIG_SCSI_QLA2300=y
-CONFIG_SCSI_QLA2322=y
-# CONFIG_SCSI_QLA24XX is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
 # CONFIG_SCSI_DEBUG is not set
 
 #
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+CONFIG_ATA=y
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+CONFIG_SATA_VITESSE=y
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
+
+#
 # Multi-device support (RAID and LVM)
 #
 CONFIG_MD=y
@@ -491,12 +575,12 @@ CONFIG_MD_LINEAR=y
 CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
 # CONFIG_MD_RAID10 is not set
-CONFIG_MD_RAID5=y
+CONFIG_MD_RAID456=y
 # CONFIG_MD_RAID5_RESHAPE is not set
-# CONFIG_MD_RAID6 is not set
 CONFIG_MD_MULTIPATH=y
 # CONFIG_MD_FAULTY is not set
 CONFIG_BLK_DEV_DM=y
+# CONFIG_DM_DEBUG is not set
 CONFIG_DM_CRYPT=m
 CONFIG_DM_SNAPSHOT=m
 CONFIG_DM_MIRROR=m
@@ -563,6 +647,7 @@ CONFIG_NETDEVICES=y
 # CONFIG_SK98LIN is not set
 CONFIG_TIGON3=y
 # CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
@@ -571,6 +656,7 @@ CONFIG_CHELSIO_T1=m
 # CONFIG_IXGB is not set
 CONFIG_S2IO=m
 # CONFIG_S2IO_NAPI is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
@@ -612,6 +698,7 @@ CONFIG_NET_POLL_CONTROLLER=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -646,6 +733,7 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
@@ -659,10 +747,12 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_N_HDLC is not set
 # CONFIG_SPECIALIX is not set
 # CONFIG_SX is not set
+# CONFIG_RIO is not set
 # CONFIG_STALDRV is not set
 CONFIG_SGI_SNSC=y
 CONFIG_SGI_TIOCX=y
 CONFIG_SGI_MBCS=m
+CONFIG_MSPEC=y
 
 #
 # Serial drivers
@@ -701,6 +791,7 @@ CONFIG_EFI_RTC=y
 # Ftape, the floppy tape device driver
 #
 CONFIG_AGP=y
+# CONFIG_AGP_SIS is not set
 # CONFIG_AGP_VIA is not set
 CONFIG_AGP_SGI_TIOCA=y
 # CONFIG_DRM is not set
@@ -730,7 +821,6 @@ CONFIG_MMTIMER=y
 #
 # Dallas's 1-wire bus
 #
-# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -741,6 +831,7 @@ CONFIG_MMTIMER=y
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
@@ -756,6 +847,7 @@ CONFIG_MMTIMER=y
 #
 # Graphics support
 #
+CONFIG_FIRMWARE_EDID=y
 # CONFIG_FB is not set
 
 #
@@ -764,6 +856,7 @@ CONFIG_MMTIMER=y
 CONFIG_VGA_CONSOLE=y
 # CONFIG_VGACON_SOFT_SCROLLBACK is not set
 CONFIG_DUMMY_CONSOLE=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -794,6 +887,7 @@ CONFIG_USB=m
 CONFIG_USB_EHCI_HCD=m
 # CONFIG_USB_EHCI_SPLIT_ISO is not set
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
+# CONFIG_USB_EHCI_TT_NEWSCHED is not set
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=m
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
@@ -843,6 +937,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -874,15 +969,18 @@ CONFIG_USB_MON=y
 #
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
 # CONFIG_USB_AUERSWALD is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
-# CONFIG_USB_PHIDGETKIT is not set
-# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_PHIDGET is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
 
@@ -919,18 +1017,15 @@ CONFIG_USB_MON=y
 CONFIG_INFINIBAND=m
 # CONFIG_INFINIBAND_USER_MAD is not set
 CONFIG_INFINIBAND_USER_ACCESS=m
+CONFIG_INFINIBAND_ADDR_TRANS=y
 CONFIG_INFINIBAND_MTHCA=m
 CONFIG_INFINIBAND_MTHCA_DEBUG=y
+# CONFIG_INFINIBAND_AMSO1100 is not set
 CONFIG_INFINIBAND_IPOIB=m
 CONFIG_INFINIBAND_IPOIB_DEBUG=y
 # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set
 CONFIG_INFINIBAND_SRP=m
-
-#
-# SN Devices
-#
-CONFIG_SGI_IOC4=y
-CONFIG_SGI_IOC3=y
+# CONFIG_INFINIBAND_ISER is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
@@ -942,6 +1037,19 @@ CONFIG_SGI_IOC3=y
 # CONFIG_RTC_CLASS is not set
 
 #
+# DMA Engine support
+#
+# CONFIG_DMA_ENGINE is not set
+
+#
+# DMA Clients
+#
+
+#
+# DMA Devices
+#
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=y
@@ -965,15 +1073,16 @@ CONFIG_REISERFS_FS_SECURITY=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 CONFIG_XFS_FS=y
-CONFIG_XFS_EXPORT=y
 CONFIG_XFS_QUOTA=y
 # CONFIG_XFS_SECURITY is not set
 CONFIG_XFS_POSIX_ACL=y
 CONFIG_XFS_RT=y
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
 CONFIG_INOTIFY=y
+CONFIG_INOTIFY_USER=y
 CONFIG_QUOTA=y
 # CONFIG_QFMT_V1 is not set
 # CONFIG_QFMT_V2 is not set
@@ -1007,8 +1116,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
@@ -1046,7 +1157,7 @@ CONFIG_NFSD_V4=y
 CONFIG_NFSD_TCP=y
 CONFIG_LOCKD=m
 CONFIG_LOCKD_V4=y
-CONFIG_EXPORTFS=y
+CONFIG_EXPORTFS=m
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=m
 CONFIG_SUNRPC_GSS=m
@@ -1056,7 +1167,9 @@ CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
 CONFIG_CIFS=m
 # CONFIG_CIFS_STATS is not set
+# CONFIG_CIFS_WEAK_PW_HASH is not set
 # CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
@@ -1129,6 +1242,10 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_UTF8=y
 
 #
+# Distributed Lock Manager
+#
+
+#
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
@@ -1138,9 +1255,11 @@ CONFIG_LIBCRC32C=m
 CONFIG_ZLIB_INFLATE=m
 CONFIG_ZLIB_DEFLATE=m
 CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_PLIST=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
+CONFIG_IRQ_PER_CPU=y
 
 #
 # Instrumentation Support
@@ -1152,20 +1271,26 @@ CONFIG_GENERIC_PENDING_IRQ=y
 # Kernel hacking
 #
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
+# CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=20
 CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
-CONFIG_DEBUG_PREEMPT=y
-# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_RWSEMS is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_IA64_GRANULE_16MB=y
@@ -1186,6 +1311,10 @@ CONFIG_SYSVIPC_COMPAT=y
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_MANAGER=m
 CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_MD4 is not set
@@ -1195,6 +1324,8 @@ CONFIG_CRYPTO_SHA1=m
 # CONFIG_CRYPTO_SHA512 is not set
 # CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=m
 CONFIG_CRYPTO_DES=m
 # CONFIG_CRYPTO_BLOWFISH is not set
 # CONFIG_CRYPTO_TWOFISH is not set
diff --git a/arch/ia64/hp/sim/Kconfig b/arch/ia64/hp/sim/Kconfig
index 18ccb1266e18..f92306bbedb8 100644
--- a/arch/ia64/hp/sim/Kconfig
+++ b/arch/ia64/hp/sim/Kconfig
@@ -13,8 +13,8 @@ config HP_SIMSERIAL_CONSOLE
         depends on HP_SIMSERIAL
 
 config HP_SIMSCSI
-        tristate "Simulated SCSI disk"
-        depends on SCSI
+        bool "Simulated SCSI disk"
+        depends on SCSI=y
 
 endmenu
 
diff --git a/arch/ia64/hp/sim/hpsim_irq.c b/arch/ia64/hp/sim/hpsim_irq.c
index 8145547bb52d..c2f58ff364e7 100644
--- a/arch/ia64/hp/sim/hpsim_irq.c
+++ b/arch/ia64/hp/sim/hpsim_irq.c
@@ -27,7 +27,7 @@ hpsim_set_affinity_noop (unsigned int a, cpumask_t b)
 }
 
 static struct hw_interrupt_type irq_type_hp_sim = {
-        .typename =     "hpsim",
+        .name =         "hpsim",
         .startup =      hpsim_irq_startup,
         .shutdown =     hpsim_irq_noop,
         .enable =       hpsim_irq_noop,
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 32c3abededc6..73ef4a85b861 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -64,9 +64,6 @@ EXPORT_SYMBOL(pm_idle);
 void (*pm_power_off) (void);
 EXPORT_SYMBOL(pm_power_off);
 
-unsigned char acpi_kbd_controller_present = 1;
-unsigned char acpi_legacy_devices;
-
 unsigned int acpi_cpei_override;
 unsigned int acpi_cpei_phys_cpuid;
 
@@ -628,12 +625,6 @@ static int __init acpi_parse_fadt(unsigned long phys_addr, unsigned long size)
 
         fadt = (struct fadt_descriptor *)fadt_header;
 
-        if (!(fadt->iapc_boot_arch & BAF_8042_KEYBOARD_CONTROLLER))
-                acpi_kbd_controller_present = 0;
-
-        if (fadt->iapc_boot_arch & BAF_LEGACY_DEVICES)
-                acpi_legacy_devices = 1;
-
         acpi_register_gsi(fadt->sci_int, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW);
         return 0;
 }
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 9bf15fefa7e4..60d64950e3c2 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -426,7 +426,7 @@ iosapic_end_level_irq (unsigned int irq)
 #define iosapic_ack_level_irq           nop
 
 struct hw_interrupt_type irq_type_iosapic_level = {
-        .typename =     "IO-SAPIC-level",
+        .name =         "IO-SAPIC-level",
         .startup =      iosapic_startup_level_irq,
         .shutdown =     iosapic_shutdown_level_irq,
         .enable =       iosapic_enable_level_irq,
@@ -473,7 +473,7 @@ iosapic_ack_edge_irq (unsigned int irq)
 #define iosapic_end_edge_irq            nop
 
 struct hw_interrupt_type irq_type_iosapic_edge = {
-        .typename =     "IO-SAPIC-edge",
+        .name =         "IO-SAPIC-edge",
         .startup =      iosapic_startup_edge_irq,
         .shutdown =     iosapic_disable_edge_irq,
         .enable =       iosapic_enable_edge_irq,
@@ -664,7 +664,7 @@ register_intr (unsigned int gsi, int vector, unsigned char delivery,
                         printk(KERN_WARNING
                                "%s: changing vector %d from %s to %s\n",
                                __FUNCTION__, vector,
-                               idesc->chip->typename, irq_type->typename);
+                               idesc->chip->name, irq_type->name);
                 idesc->chip = irq_type;
         }
         return 0;
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index f07c0864b0b4..54d55e4d64f7 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -76,7 +76,7 @@ int show_interrupts(struct seq_file *p, void *v)
                         seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
                 }
 #endif
-                seq_printf(p, " %14s", irq_desc[i].chip->typename);
+                seq_printf(p, " %14s", irq_desc[i].chip->name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
@@ -197,7 +197,7 @@ void fixup_irqs(void)
                         struct pt_regs *old_regs = set_irq_regs(NULL);
 
                         vectors_in_migration[irq]=0;
-                        __do_IRQ(irq);
+                        generic_handle_irq(irq);
                         set_irq_regs(old_regs);
                 }
         }
diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
index 68339dd0c9e2..ba3ba8bc50be 100644
--- a/arch/ia64/kernel/irq_ia64.c
+++ b/arch/ia64/kernel/irq_ia64.c
@@ -180,11 +180,13 @@ ia64_handle_irq (ia64_vector vector, struct pt_regs *regs)
         saved_tpr = ia64_getreg(_IA64_REG_CR_TPR);
         ia64_srlz_d();
         while (vector != IA64_SPURIOUS_INT_VECTOR) {
-                if (!IS_RESCHEDULE(vector)) {
+                if (unlikely(IS_RESCHEDULE(vector)))
+                         kstat_this_cpu.irqs[vector]++;
+                else {
                         ia64_setreg(_IA64_REG_CR_TPR, vector);
                         ia64_srlz_d();
 
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
 
                         /*
                          * Disable interrupts and send EOI:
@@ -225,7 +227,9 @@ void ia64_process_pending_intr(void)
           * Perform normal interrupt style processing
           */
         while (vector != IA64_SPURIOUS_INT_VECTOR) {
-                if (!IS_RESCHEDULE(vector)) {
+                if (unlikely(IS_RESCHEDULE(vector)))
+                         kstat_this_cpu.irqs[vector]++;
+                else {
                         struct pt_regs *old_regs = set_irq_regs(NULL);
 
                         ia64_setreg(_IA64_REG_CR_TPR, vector);
@@ -238,7 +242,7 @@ void ia64_process_pending_intr(void)
                          * Probably could shared code.
                          */
                         vectors_in_migration[local_vector_to_irq(vector)]=0;
-                        __do_IRQ(local_vector_to_irq(vector));
+                        generic_handle_irq(local_vector_to_irq(vector));
                         set_irq_regs(old_regs);
 
                         /*
@@ -258,11 +262,22 @@ void ia64_process_pending_intr(void)
 #ifdef CONFIG_SMP
 extern irqreturn_t handle_IPI (int irq, void *dev_id);
 
+static irqreturn_t dummy_handler (int irq, void *dev_id)
+{
+        BUG();
+}
+
 static struct irqaction ipi_irqaction = {
         .handler =      handle_IPI,
         .flags =        IRQF_DISABLED,
         .name =         "IPI"
 };
+
+static struct irqaction resched_irqaction = {
+        .handler =      dummy_handler,
+        .flags =        SA_INTERRUPT,
+        .name =         "resched"
+};
 #endif
 
 void
@@ -287,6 +302,7 @@ init_IRQ (void)
         register_percpu_irq(IA64_SPURIOUS_INT_VECTOR, NULL);
 #ifdef CONFIG_SMP
         register_percpu_irq(IA64_IPI_VECTOR, &ipi_irqaction);
+        register_percpu_irq(IA64_IPI_RESCHEDULE, &resched_irqaction);
 #endif
 #ifdef CONFIG_PERFMON
         pfm_init_percpu();
diff --git a/arch/ia64/kernel/irq_lsapic.c b/arch/ia64/kernel/irq_lsapic.c
index 1ab58b09f3d7..c2f07beb1759 100644
--- a/arch/ia64/kernel/irq_lsapic.c
+++ b/arch/ia64/kernel/irq_lsapic.c
@@ -34,7 +34,7 @@ static int lsapic_retrigger(unsigned int irq)
 }
 
 struct hw_interrupt_type irq_type_ia64_lsapic = {
-        .typename =     "LSAPIC",
+        .name =         "LSAPIC",
         .startup =      lsapic_noop_startup,
         .shutdown =     lsapic_noop,
         .enable =       lsapic_noop,
diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c
index a45009d2bc90..afc1403799c9 100644
--- a/arch/ia64/kernel/mca_drv.c
+++ b/arch/ia64/kernel/mca_drv.c
@@ -435,6 +435,50 @@ is_mca_global(peidx_table_t *peidx, pal_bus_check_info_t *pbci,
 }
 
 /**
+ * get_target_identifier - Get the valid Cache or Bus check target identifier.
+ * @peidx:      pointer of index of processor error section
+ *
+ * Return value:
+ *      target address on Success / 0 on Failue
+ */
+static u64
+get_target_identifier(peidx_table_t *peidx)
+{
+        u64 target_address = 0;
+        sal_log_mod_error_info_t *smei;
+        pal_cache_check_info_t *pcci;
+        int i, level = 9;
+
+        /*
+         * Look through the cache checks for a valid target identifier
+         * If more than one valid target identifier, return the one
+         * with the lowest cache level.
+         */
+        for (i = 0; i < peidx_cache_check_num(peidx); i++) {
+                smei = (sal_log_mod_error_info_t *)peidx_cache_check(peidx, i);
+                if (smei->valid.target_identifier && smei->target_identifier) {
+                        pcci = (pal_cache_check_info_t *)&(smei->check_info);
+                        if (!target_address || (pcci->level < level)) {
+                                target_address = smei->target_identifier;
+                                level = pcci->level;
+                                continue;
+                        }
+                }
+        }
+        if (target_address)
+                return target_address;
+
+        /*
+         * Look at the bus check for a valid target identifier
+         */
+        smei = peidx_bus_check(peidx, 0);
+        if (smei && smei->valid.target_identifier)
+                return smei->target_identifier;
+
+        return 0;
+}
+
+/**
  * recover_from_read_error - Try to recover the errors which type are "read"s.
  * @slidx:      pointer of index of SAL error record
  * @peidx:      pointer of index of processor error section
@@ -450,13 +494,14 @@ recover_from_read_error(slidx_table_t *slidx,
                         peidx_table_t *peidx, pal_bus_check_info_t *pbci,
                         struct ia64_sal_os_state *sos)
 {
-        sal_log_mod_error_info_t *smei;
+        u64 target_identifier;
         pal_min_state_area_t *pmsa;
         struct ia64_psr *psr1, *psr2;
         ia64_fptr_t *mca_hdlr_bh = (ia64_fptr_t*)mca_handler_bhhook;
 
         /* Is target address valid? */
-        if (!pbci->tv)
+        target_identifier = get_target_identifier(peidx);
+        if (!target_identifier)
                 return fatal_mca("target address not valid");
 
         /*
@@ -487,32 +532,28 @@ recover_from_read_error(slidx_table_t *slidx,
         pmsa = sos->pal_min_state;
         if (psr1->cpl != 0 ||
            ((psr2->cpl != 0) && mca_recover_range(pmsa->pmsa_iip))) {
-                smei = peidx_bus_check(peidx, 0);
-                if (smei->valid.target_identifier) {
-                        /*
-                         *  setup for resume to bottom half of MCA,
-                         * "mca_handler_bhhook"
-                         */
-                        /* pass to bhhook as argument (gr8, ...) */
-                        pmsa->pmsa_gr[8-1] = smei->target_identifier;
-                        pmsa->pmsa_gr[9-1] = pmsa->pmsa_iip;
-                        pmsa->pmsa_gr[10-1] = pmsa->pmsa_ipsr;
-                        /* set interrupted return address (but no use) */
-                        pmsa->pmsa_br0 = pmsa->pmsa_iip;
-                        /* change resume address to bottom half */
-                        pmsa->pmsa_iip = mca_hdlr_bh->fp;
-                        pmsa->pmsa_gr[1-1] = mca_hdlr_bh->gp;
-                        /* set cpl with kernel mode */
-                        psr2 = (struct ia64_psr *)&pmsa->pmsa_ipsr;
-                        psr2->cpl = 0;
-                        psr2->ri  = 0;
-                        psr2->bn  = 1;
-                        psr2->i  = 0;
-
-                        return mca_recovered("user memory corruption. "
+                /*
+                 *  setup for resume to bottom half of MCA,
+                 * "mca_handler_bhhook"
+                 */
+                /* pass to bhhook as argument (gr8, ...) */
+                pmsa->pmsa_gr[8-1] = target_identifier;
+                pmsa->pmsa_gr[9-1] = pmsa->pmsa_iip;
+                pmsa->pmsa_gr[10-1] = pmsa->pmsa_ipsr;
+                /* set interrupted return address (but no use) */
+                pmsa->pmsa_br0 = pmsa->pmsa_iip;
+                /* change resume address to bottom half */
+                pmsa->pmsa_iip = mca_hdlr_bh->fp;
+                pmsa->pmsa_gr[1-1] = mca_hdlr_bh->gp;
+                /* set cpl with kernel mode */
+                psr2 = (struct ia64_psr *)&pmsa->pmsa_ipsr;
+                psr2->cpl = 0;
+                psr2->ri  = 0;
+                psr2->bn  = 1;
+                psr2->i  = 0;
+
+                return mca_recovered("user memory corruption. "
                                 "kill affected process - recovered.");
-                }
-
         }
 
         return fatal_mca("kernel context not recovered, iip 0x%lx\n",
diff --git a/arch/ia64/kernel/pal.S b/arch/ia64/kernel/pal.S
index ebaf1e685f5e..0b533441c3c9 100644
--- a/arch/ia64/kernel/pal.S
+++ b/arch/ia64/kernel/pal.S
@@ -21,11 +21,12 @@ pal_entry_point:
         .text
 
 /*
- * Set the PAL entry point address.  This could be written in C code, but we do it here
- * to keep it all in one module (besides, it's so trivial that it's
+ * Set the PAL entry point address.  This could be written in C code, but we
+ * do it here to keep it all in one module (besides, it's so trivial that it's
  * not a big deal).
  *
- * in0          Address of the PAL entry point (text address, NOT a function descriptor).
+ * in0          Address of the PAL entry point (text address, NOT a function
+ *              descriptor).
  */
 GLOBAL_ENTRY(ia64_pal_handler_init)
         alloc r3=ar.pfs,1,0,0,0
@@ -36,9 +37,9 @@ GLOBAL_ENTRY(ia64_pal_handler_init)
 END(ia64_pal_handler_init)
 
 /*
- * Default PAL call handler.  This needs to be coded in assembly because it uses
- * the static calling convention, i.e., the RSE may not be used and calls are
- * done via "br.cond" (not "br.call").
+ * Default PAL call handler.  This needs to be coded in assembly because it
+ * uses the static calling convention, i.e., the RSE may not be used and
+ * calls are done via "br.cond" (not "br.call").
  */
 GLOBAL_ENTRY(ia64_pal_default_handler)
         mov r8=-1
@@ -50,12 +51,10 @@ END(ia64_pal_default_handler)
  *
  * in0         Index of PAL service
  * in1 - in3   Remaining PAL arguments
- * in4         1 ==> clear psr.ic,  0 ==> don't clear psr.ic
- *
  */
 GLOBAL_ENTRY(ia64_pal_call_static)
-        .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(5)
-        alloc loc1 = ar.pfs,5,5,0,0
+        .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(4)
+        alloc loc1 = ar.pfs,4,5,0,0
         movl loc2 = pal_entry_point
 1:      {
           mov r28 = in0
@@ -64,7 +63,6 @@ GLOBAL_ENTRY(ia64_pal_call_static)
         }
         ;;
         ld8 loc2 = [loc2]               // loc2 <- entry point
-        tbit.nz p6,p7 = in4, 0
         adds r8 = 1f-1b,r8
         mov loc4=ar.rsc                 // save RSE configuration
         ;;
@@ -74,13 +72,11 @@ GLOBAL_ENTRY(ia64_pal_call_static)
         .body
         mov r30 = in2
 
-(p6)    rsm psr.i | psr.ic
         mov r31 = in3
         mov b7 = loc2
 
-(p7)    rsm psr.i
+        rsm psr.i
         ;;
-(p6)    srlz.i
         mov rp = r8
         br.cond.sptk.many b7
 1:      mov psr.l = loc3
@@ -96,8 +92,8 @@ END(ia64_pal_call_static)
  * Make a PAL call using the stacked registers calling convention.
  *
  * Inputs:
- *      in0         Index of PAL service
- *      in2 - in3   Remaning PAL arguments
+ *      in0         Index of PAL service
+ *      in2 - in3   Remaining PAL arguments
  */
 GLOBAL_ENTRY(ia64_pal_call_stacked)
         .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(4)
@@ -131,18 +127,18 @@ END(ia64_pal_call_stacked)
  * Make a physical mode PAL call using the static registers calling convention.
  *
  * Inputs:
- *      in0         Index of PAL service
- *      in2 - in3   Remaning PAL arguments
+ *      in0         Index of PAL service
+ *      in2 - in3   Remaining PAL arguments
  *
  * PSR_LP, PSR_TB, PSR_ID, PSR_DA are never set by the kernel.
  * So we don't need to clear them.
  */
-#define PAL_PSR_BITS_TO_CLEAR                                                   \
-        (IA64_PSR_I | IA64_PSR_IT | IA64_PSR_DT  | IA64_PSR_DB | IA64_PSR_RT |  \
-         IA64_PSR_DD | IA64_PSR_SS | IA64_PSR_RI | IA64_PSR_ED |                \
+#define PAL_PSR_BITS_TO_CLEAR                                                 \
+        (IA64_PSR_I | IA64_PSR_IT | IA64_PSR_DT  | IA64_PSR_DB | IA64_PSR_RT |\
+         IA64_PSR_DD | IA64_PSR_SS | IA64_PSR_RI | IA64_PSR_ED |              \
          IA64_PSR_DFL | IA64_PSR_DFH)
 
-#define PAL_PSR_BITS_TO_SET                                                     \
+#define PAL_PSR_BITS_TO_SET                                                   \
         (IA64_PSR_BN)
 
 
@@ -178,7 +174,7 @@ GLOBAL_ENTRY(ia64_pal_call_phys_static)
         ;;
         andcm r16=loc3,r16              // removes bits to clear from psr
         br.call.sptk.many rp=ia64_switch_mode_phys
-.ret1:  mov rp = r8                     // install return address (physical)
+        mov rp = r8                     // install return address (physical)
         mov loc5 = r19
         mov loc6 = r20
         br.cond.sptk.many b7
@@ -188,7 +184,6 @@ GLOBAL_ENTRY(ia64_pal_call_phys_static)
         mov r19=loc5
         mov r20=loc6
         br.call.sptk.many rp=ia64_switch_mode_virt // return to virtual mode
-.ret2:
         mov psr.l = loc3                // restore init PSR
 
         mov ar.pfs = loc1
@@ -203,8 +198,8 @@ END(ia64_pal_call_phys_static)
  * Make a PAL call using the stacked registers in physical mode.
  *
  * Inputs:
- *      in0         Index of PAL service
- *      in2 - in3   Remaning PAL arguments
+ *      in0         Index of PAL service
+ *      in2 - in3   Remaining PAL arguments
  */
 GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
         .prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(5)
@@ -212,7 +207,7 @@ GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
         movl    loc2 = pal_entry_point
 1:      {
           mov r28  = in0                // copy procedure index
-          mov loc0 = rp         // save rp
+          mov loc0 = rp                 // save rp
         }
         .body
         ;;
@@ -245,7 +240,7 @@ GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
         mov r16=loc3                    // r16= original psr
         mov r19=loc5
         mov r20=loc6
-        br.call.sptk.many rp=ia64_switch_mode_virt      // return to virtual mode
+        br.call.sptk.many rp=ia64_switch_mode_virt // return to virtual mode
 
         mov psr.l  = loc3               // restore init PSR
         mov ar.pfs = loc1
@@ -257,10 +252,11 @@ GLOBAL_ENTRY(ia64_pal_call_phys_stacked)
 END(ia64_pal_call_phys_stacked)
 
 /*
- * Save scratch fp scratch regs which aren't saved in pt_regs already (fp10-fp15).
+ * Save scratch fp scratch regs which aren't saved in pt_regs already
+ * (fp10-fp15).
  *
- * NOTE: We need to do this since firmware (SAL and PAL) may use any of the scratch
- * regs fp-low partition.
+ * NOTE: We need to do this since firmware (SAL and PAL) may use any of the
+ * scratch regs fp-low partition.
  *
  * Inputs:
  *      in0     Address of stack storage for fp regs
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index 281004ff7b00..3aaede0d6981 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -5558,12 +5558,13 @@ report_spurious2:
 }
 
 static irqreturn_t
-pfm_interrupt_handler(int irq, void *arg, struct pt_regs *regs)
+pfm_interrupt_handler(int irq, void *arg)
 {
         unsigned long start_cycles, total_cycles;
         unsigned long min, max;
         int this_cpu;
         int ret;
+        struct pt_regs *regs = get_irq_regs();
 
         this_cpu = get_cpu();
         if (likely(!pfm_alt_intr_handler)) {
diff --git a/arch/ia64/kernel/sal.c b/arch/ia64/kernel/sal.c
index 642fdc7b969d..20bad78b5073 100644
--- a/arch/ia64/kernel/sal.c
+++ b/arch/ia64/kernel/sal.c
@@ -223,12 +223,13 @@ static void __init sal_desc_ap_wakeup(void *p) { }
  */
 static int sal_cache_flush_drops_interrupts;
 
-static void __init
+void __init
 check_sal_cache_flush (void)
 {
         unsigned long flags;
         int cpu;
-        u64 vector;
+        u64 vector, cache_type = 3;
+        struct ia64_sal_retval isrv;
 
         cpu = get_cpu();
         local_irq_save(flags);
@@ -243,7 +244,10 @@ check_sal_cache_flush (void)
         while (!ia64_get_irr(IA64_TIMER_VECTOR))
                 cpu_relax();
 
-        ia64_sal_cache_flush(3);
+        SAL_CALL(isrv, SAL_CACHE_FLUSH, cache_type, 0, 0, 0, 0, 0, 0);
+
+        if (isrv.status)
+                printk(KERN_ERR "SAL_CAL_FLUSH failed with %ld\n", isrv.status);
 
         if (ia64_get_irr(IA64_TIMER_VECTOR)) {
                 vector = ia64_get_ivr();
@@ -331,7 +335,6 @@ ia64_sal_init (struct ia64_sal_systab *systab)
                 p += SAL_DESC_SIZE(*p);
         }
 
-        check_sal_cache_flush();
 }
 
 int
diff --git a/arch/ia64/kernel/setup.c b/arch/ia64/kernel/setup.c
index c4caa8003492..d10404a41756 100644
--- a/arch/ia64/kernel/setup.c
+++ b/arch/ia64/kernel/setup.c
@@ -457,6 +457,8 @@ setup_arch (char **cmdline_p)
         cpu_init();     /* initialize the bootstrap CPU */
         mmu_context_init();     /* initialize context_id bitmap */
 
+        check_sal_cache_flush();
+
 #ifdef CONFIG_ACPI
         acpi_boot_init();
 #endif
diff --git a/arch/ia64/kernel/smp.c b/arch/ia64/kernel/smp.c
index 657ac99a451c..6ab95ceaf9d4 100644
--- a/arch/ia64/kernel/smp.c
+++ b/arch/ia64/kernel/smp.c
@@ -108,7 +108,7 @@ cpu_die(void)
 }
 
 irqreturn_t
-handle_IPI (int irq, void *dev_id, struct pt_regs *regs)
+handle_IPI (int irq, void *dev_id)
 {
         int this_cpu = get_cpu();
         unsigned long *pending_ipis = &__ia64_per_cpu_var(ipi_operation);
@@ -328,10 +328,14 @@ int
 smp_call_function (void (*func) (void *info), void *info, int nonatomic, int wait)
 {
         struct call_data_struct data;
-        int cpus = num_online_cpus()-1;
+        int cpus;
 
-        if (!cpus)
+        spin_lock(&call_lock);
+        cpus = num_online_cpus() - 1;
+        if (!cpus) {
+                spin_unlock(&call_lock);
                 return 0;
+        }
 
         /* Can deadlock when called with interrupts disabled */
         WARN_ON(irqs_disabled());
@@ -343,8 +347,6 @@ smp_call_function (void (*func) (void *info), void *info, int nonatomic, int wai
         if (wait)
                 atomic_set(&data.finished, 0);
 
-        spin_lock(&call_lock);
-
         call_data = &data;
         mb();   /* ensure store to call_data precedes setting of IPI_CALL_FUNC */
         send_IPI_allbutself(IPI_CALL_FUNC);
diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c
index 41169a9bc301..39e0cd3a0884 100644
--- a/arch/ia64/kernel/time.c
+++ b/arch/ia64/kernel/time.c
@@ -84,6 +84,12 @@ timer_interrupt (int irq, void *dev_id)
 
                 if (time_after(new_itm, ia64_get_itc()))
                         break;
+
+                /*
+                 * Allow IPIs to interrupt the timer loop.
+                 */
+                local_irq_enable();
+                local_irq_disable();
         }
 
         do {
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index b3b2e389d6b2..d6083a0936f4 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -128,13 +128,7 @@ SECTIONS
   .initcall.init : AT(ADDR(.initcall.init) - LOAD_OFFSET)
         {
           __initcall_start = .;
-          *(.initcall1.init)
-          *(.initcall2.init)
-          *(.initcall3.init)
-          *(.initcall4.init)
-          *(.initcall5.init)
-          *(.initcall6.init)
-          *(.initcall7.init)
+        INITCALLS
           __initcall_end = .;
         }
 
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index daf977ff2920..82deaa3a7c48 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -233,6 +233,7 @@ paging_init (void)
         efi_memmap_walk(count_pages, &num_physpages);
 
         max_dma = virt_to_phys((void *) MAX_DMA_ADDRESS) >> PAGE_SHIFT;
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
         max_zone_pfns[ZONE_DMA] = max_dma;
         max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
 
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index d497b6b0f5b2..96722cb1b49d 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -709,6 +709,7 @@ void __init paging_init(void)
                         max_pfn = mem_data[node].max_pfn;
         }
 
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
         max_zone_pfns[ZONE_DMA] = max_dma;
         max_zone_pfns[ZONE_NORMAL] = max_pfn;
         free_area_init_nodes(max_zone_pfns);
diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index eee5c1cfbe32..f3a9585e98a8 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c
@@ -70,8 +70,10 @@ huge_pte_offset (struct mm_struct *mm, unsigned long addr)
  * Don't actually need to do any preparation, but need to make sure
  * the address is in the right region.
  */
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
         if (len & ~HPAGE_MASK)
                 return -EINVAL;
         if (addr & ~HPAGE_MASK)
diff --git a/arch/ia64/pci/Makefile b/arch/ia64/pci/Makefile
index e66889e6922a..fb14dc520d2d 100644
--- a/arch/ia64/pci/Makefile
+++ b/arch/ia64/pci/Makefile
@@ -1,4 +1,4 @@
 #
 # Makefile for the ia64-specific parts of the pci bus
 #
-obj-y           := pci.o
+obj-y           := pci.o fixup.o
diff --git a/arch/ia64/pci/fixup.c b/arch/ia64/pci/fixup.c
new file mode 100644
index 000000000000..245dc1fedc24
--- /dev/null
+++ b/arch/ia64/pci/fixup.c
@@ -0,0 +1,69 @@
+/*
+ * Exceptions for specific devices. Usually work-arounds for fatal design flaws.
+ * Derived from fixup.c of i386 tree.
+ */
+
+#include <linux/pci.h>
+#include <linux/init.h>
+
+#include <asm/machvec.h>
+
+/*
+ * Fixup to mark boot BIOS video selected by BIOS before it changes
+ *
+ * From information provided by "Jon Smirl" <jonsmirl@gmail.com>
+ *
+ * The standard boot ROM sequence for an x86 machine uses the BIOS
+ * to select an initial video card for boot display. This boot video
+ * card will have it's BIOS copied to C0000 in system RAM.
+ * IORESOURCE_ROM_SHADOW is used to associate the boot video
+ * card with this copy. On laptops this copy has to be used since
+ * the main ROM may be compressed or combined with another image.
+ * See pci_map_rom() for use of this flag. IORESOURCE_ROM_SHADOW
+ * is marked here since the boot video device will be the only enabled
+ * video device at this point.
+ */
+
+static void __devinit pci_fixup_video(struct pci_dev *pdev)
+{
+        struct pci_dev *bridge;
+        struct pci_bus *bus;
+        u16 config;
+
+        if ((strcmp(platform_name, "dig") != 0)
+            && (strcmp(platform_name, "hpzx1")  != 0))
+                return;
+        /* Maybe, this machine supports legacy memory map. */
+
+        if ((pdev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
+                return;
+
+        /* Is VGA routed to us? */
+        bus = pdev->bus;
+        while (bus) {
+                bridge = bus->self;
+
+                /*
+                 * From information provided by
+                 * "David Miller" <davem@davemloft.net>
+                 * The bridge control register is valid for PCI header
+                 * type BRIDGE, or CARDBUS. Host to PCI controllers use
+                 * PCI header type NORMAL.
+                 */
+                if (bridge
+                    &&((bridge->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+                       ||(bridge->hdr_type == PCI_HEADER_TYPE_CARDBUS))) {
+                        pci_read_config_word(bridge, PCI_BRIDGE_CONTROL,
+                                                &config);
+                        if (!(config & PCI_BRIDGE_CTL_VGA))
+                                return;
+                }
+                bus = bus->parent;
+        }
+        pci_read_config_word(pdev, PCI_COMMAND, &config);
+        if (config & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
+                pdev->resource[PCI_ROM_RESOURCE].flags |= IORESOURCE_ROM_SHADOW;
+                printk(KERN_DEBUG "Boot video device is %s\n", pci_name(pdev));
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_ANY_ID, PCI_ANY_ID, pci_fixup_video);
diff --git a/arch/ia64/sn/kernel/bte.c b/arch/ia64/sn/kernel/bte.c
index 7f73ad4408aa..ff1c55601178 100644
--- a/arch/ia64/sn/kernel/bte.c
+++ b/arch/ia64/sn/kernel/bte.c
@@ -381,14 +381,13 @@ bte_result_t bte_unaligned_copy(u64 src, u64 dest, u64 len, u64 mode)
                  * bcopy to the destination.
                  */
 
-                /* Add the leader from source */
-                headBteLen = len + (src & L1_CACHE_MASK);
-                /* Add the trailing bytes from footer. */
-                headBteLen += L1_CACHE_BYTES - (headBteLen & L1_CACHE_MASK);
-                headBteSource = src & ~L1_CACHE_MASK;
                 headBcopySrcOffset = src & L1_CACHE_MASK;
                 headBcopyDest = dest;
                 headBcopyLen = len;
+
+                headBteSource = src - headBcopySrcOffset;
+                /* Add the leading and trailing bytes from source */
+                headBteLen = L1_CACHE_ALIGN(len + headBcopySrcOffset);
         }
 
         if (headBcopyLen > 0) {
diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
index 7bb6ad188ba3..0b49459a878a 100644
--- a/arch/ia64/sn/kernel/irq.c
+++ b/arch/ia64/sn/kernel/irq.c
@@ -201,7 +201,7 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
 }
 
 struct hw_interrupt_type irq_type_sn = {
-        .typename       = "SN hub",
+        .name           = "SN hub",
         .startup        = sn_startup_irq,
         .shutdown       = sn_shutdown_irq,
         .enable         = sn_enable_irq,
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index 5f2dcba7fa8d..7a2d824c5ce3 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -65,7 +65,6 @@ extern void sn_timer_init(void);
 extern unsigned long last_time_offset;
 extern void (*ia64_mark_idle) (int);
 extern void snidle(int);
-extern unsigned char acpi_kbd_controller_present;
 extern unsigned long long (*ia64_printk_clock)(void);
 
 unsigned long sn_rtc_cycles_per_second;
@@ -452,17 +451,6 @@ void __init sn_setup(char **cmdline_p)
 
         ia64_printk_clock = ia64_sn2_printk_clock;
 
-        /*
-         * Old PROMs do not provide an ACPI FADT. Disable legacy keyboard
-         * support here so we don't have to listen to failed keyboard probe
-         * messages.
-         */
-        if (is_shub1() && version <= 0x0209 && acpi_kbd_controller_present) {
-                printk(KERN_INFO "Disabling legacy keyboard support as prom "
-                       "is too old and doesn't provide FADT\n");
-                acpi_kbd_controller_present = 0;
-        }
-
         printk("SGI SAL version %x.%02x\n", version >> 8, version & 0x00FF);
 
         /*
diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
index 3f35ab3d2dc2..0e7778be33cc 100644
--- a/arch/m32r/kernel/setup.c
+++ b/arch/m32r/kernel/setup.c
@@ -369,10 +369,10 @@ static void c_stop(struct seq_file *m, void *v)
 }
 
 struct seq_operations cpuinfo_op = {
-        start:  c_start,
-        next:   c_next,
-        stop:   c_stop,
-        show:   show_cpuinfo,
+        .start = c_start,
+        .next = c_next,
+        .stop = c_stop,
+        .show = show_cpuinfo,
 };
 #endif  /* CONFIG_PROC_FS */
 
diff --git a/arch/m32r/kernel/setup_mappi.c b/arch/m32r/kernel/setup_mappi.c
index 67dbbdc9d111..6b2d77da0683 100644
--- a/arch/m32r/kernel/setup_mappi.c
+++ b/arch/m32r/kernel/setup_mappi.c
@@ -86,7 +86,7 @@ void __init init_IRQ(void)
         /* INT0 : LAN controller (RTL8019AS) */
         irq_desc[M32R_IRQ_INT0].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_INT0].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT0].action = 0;
+        irq_desc[M32R_IRQ_INT0].action = NULL;
         irq_desc[M32R_IRQ_INT0].depth = 1;
         icu_data[M32R_IRQ_INT0].icucr = M32R_ICUCR_IEN|M32R_ICUCR_ISMOD10;
         disable_mappi_irq(M32R_IRQ_INT0);
@@ -95,7 +95,7 @@ void __init init_IRQ(void)
         /* MFT2 : system timer */
         irq_desc[M32R_IRQ_MFT2].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_MFT2].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_MFT2].action = 0;
+        irq_desc[M32R_IRQ_MFT2].action = NULL;
         irq_desc[M32R_IRQ_MFT2].depth = 1;
         icu_data[M32R_IRQ_MFT2].icucr = M32R_ICUCR_IEN;
         disable_mappi_irq(M32R_IRQ_MFT2);
@@ -104,7 +104,7 @@ void __init init_IRQ(void)
         /* SIO0_R : uart receive data */
         irq_desc[M32R_IRQ_SIO0_R].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_SIO0_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_R].action = 0;
+        irq_desc[M32R_IRQ_SIO0_R].action = NULL;
         irq_desc[M32R_IRQ_SIO0_R].depth = 1;
         icu_data[M32R_IRQ_SIO0_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_R);
@@ -112,7 +112,7 @@ void __init init_IRQ(void)
         /* SIO0_S : uart send data */
         irq_desc[M32R_IRQ_SIO0_S].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_SIO0_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO0_S].action = 0;
+        irq_desc[M32R_IRQ_SIO0_S].action = NULL;
         irq_desc[M32R_IRQ_SIO0_S].depth = 1;
         icu_data[M32R_IRQ_SIO0_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO0_S);
@@ -120,7 +120,7 @@ void __init init_IRQ(void)
         /* SIO1_R : uart receive data */
         irq_desc[M32R_IRQ_SIO1_R].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_SIO1_R].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_R].action = 0;
+        irq_desc[M32R_IRQ_SIO1_R].action = NULL;
         irq_desc[M32R_IRQ_SIO1_R].depth = 1;
         icu_data[M32R_IRQ_SIO1_R].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_R);
@@ -128,7 +128,7 @@ void __init init_IRQ(void)
         /* SIO1_S : uart send data */
         irq_desc[M32R_IRQ_SIO1_S].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_SIO1_S].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_SIO1_S].action = 0;
+        irq_desc[M32R_IRQ_SIO1_S].action = NULL;
         irq_desc[M32R_IRQ_SIO1_S].depth = 1;
         icu_data[M32R_IRQ_SIO1_S].icucr = 0;
         disable_mappi_irq(M32R_IRQ_SIO1_S);
@@ -138,7 +138,7 @@ void __init init_IRQ(void)
         /* INT1 : pccard0 interrupt */
         irq_desc[M32R_IRQ_INT1].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_INT1].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT1].action = 0;
+        irq_desc[M32R_IRQ_INT1].action = NULL;
         irq_desc[M32R_IRQ_INT1].depth = 1;
         icu_data[M32R_IRQ_INT1].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD00;
         disable_mappi_irq(M32R_IRQ_INT1);
@@ -146,7 +146,7 @@ void __init init_IRQ(void)
         /* INT2 : pccard1 interrupt */
         irq_desc[M32R_IRQ_INT2].status = IRQ_DISABLED;
         irq_desc[M32R_IRQ_INT2].chip = &mappi_irq_type;
-        irq_desc[M32R_IRQ_INT2].action = 0;
+        irq_desc[M32R_IRQ_INT2].action = NULL;
         irq_desc[M32R_IRQ_INT2].depth = 1;
         icu_data[M32R_IRQ_INT2].icucr = M32R_ICUCR_IEN | M32R_ICUCR_ISMOD00;
         disable_mappi_irq(M32R_IRQ_INT2);
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index a9174efe80cb..b60cea4aebaa 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -33,7 +33,7 @@
 int do_signal(struct pt_regs *, sigset_t *);
 
 asmlinkage int
-sys_rt_sigsuspend(sigset_t *unewset, size_t sigsetsize,
+sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize,
                   unsigned long r2, unsigned long r3, unsigned long r4,
                   unsigned long r5, unsigned long r6, struct pt_regs *regs)
 {
@@ -78,8 +78,8 @@ sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
 struct rt_sigframe
 {
         int sig;
-        struct siginfo *pinfo;
-        void *puc;
+        struct siginfo __user *pinfo;
+        void __user *puc;
         struct siginfo info;
         struct ucontext uc;
 //      struct _fpstate fpstate;
diff --git a/arch/m32r/kernel/smp.c b/arch/m32r/kernel/smp.c
index 722e21f556dc..360129174b2b 100644
--- a/arch/m32r/kernel/smp.c
+++ b/arch/m32r/kernel/smp.c
@@ -231,7 +231,7 @@ void smp_flush_tlb_all(void)
         local_irq_save(flags);
         __flush_tlb_all();
         local_irq_restore(flags);
-        smp_call_function(flush_tlb_all_ipi, 0, 1, 1);
+        smp_call_function(flush_tlb_all_ipi, NULL, 1, 1);
         preempt_enable();
 }
 
diff --git a/arch/m32r/kernel/sys_m32r.c b/arch/m32r/kernel/sys_m32r.c
index b567351f3c52..b4e7bcb43540 100644
--- a/arch/m32r/kernel/sys_m32r.c
+++ b/arch/m32r/kernel/sys_m32r.c
@@ -31,7 +31,7 @@
 /*
  * sys_tas() - test-and-set
  */
-asmlinkage int sys_tas(int *addr)
+asmlinkage int sys_tas(int __user *addr)
 {
         int oldval;
 
@@ -90,7 +90,7 @@ sys_pipe(unsigned long r0, unsigned long r1, unsigned long r2,
 
         error = do_pipe(fd);
         if (!error) {
-                if (copy_to_user((void *)r0, (void *)fd, 2*sizeof(int)))
+                if (copy_to_user((void __user *)r0, fd, 2*sizeof(int)))
                         error = -EFAULT;
         }
         return error;
@@ -201,7 +201,7 @@ asmlinkage int sys_ipc(uint call, int first, int second,
         }
 }
 
-asmlinkage int sys_uname(struct old_utsname * name)
+asmlinkage int sys_uname(struct old_utsname __user * name)
 {
         int err;
         if (!name)
diff --git a/arch/m32r/kernel/traps.c b/arch/m32r/kernel/traps.c
index c1daf2c40c7c..97e0b1c0830e 100644
--- a/arch/m32r/kernel/traps.c
+++ b/arch/m32r/kernel/traps.c
@@ -268,7 +268,7 @@ static __inline__ void do_trap(int trapnr, int signr, const char * str,
 #define DO_ERROR(trapnr, signr, str, name) \
 asmlinkage void do_##name(struct pt_regs * regs, long error_code) \
 { \
-        do_trap(trapnr, signr, 0, regs, error_code, NULL); \
+        do_trap(trapnr, signr, NULL, regs, error_code, NULL); \
 }
 
 #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr) \
diff --git a/arch/m32r/kernel/vmlinux.lds.S b/arch/m32r/kernel/vmlinux.lds.S
index 13c7bb698e37..358b9cee2c65 100644
--- a/arch/m32r/kernel/vmlinux.lds.S
+++ b/arch/m32r/kernel/vmlinux.lds.S
@@ -83,13 +83,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/m68k/kernel/m68k_ksyms.c b/arch/m68k/kernel/m68k_ksyms.c
index f9636e84e6a4..6fc69c74fe2e 100644
--- a/arch/m68k/kernel/m68k_ksyms.c
+++ b/arch/m68k/kernel/m68k_ksyms.c
@@ -1,61 +1,10 @@
 #include <linux/module.h>
-#include <linux/linkage.h>
-#include <linux/sched.h>
-#include <linux/mm.h>
-#include <linux/user.h>
-#include <linux/elfcore.h>
-#include <linux/in6.h>
-#include <linux/interrupt.h>
-
-#include <asm/setup.h>
-#include <asm/machdep.h>
-#include <asm/pgalloc.h>
-#include <asm/irq.h>
-#include <asm/io.h>
 #include <asm/semaphore.h>
-#include <asm/checksum.h>
 
 asmlinkage long long __ashldi3 (long long, int);
 asmlinkage long long __ashrdi3 (long long, int);
 asmlinkage long long __lshrdi3 (long long, int);
 asmlinkage long long __muldi3 (long long, long long);
-extern char m68k_debug_device[];
-
-/* platform dependent support */
-
-EXPORT_SYMBOL(m68k_machtype);
-EXPORT_SYMBOL(m68k_cputype);
-EXPORT_SYMBOL(m68k_is040or060);
-EXPORT_SYMBOL(m68k_realnum_memory);
-EXPORT_SYMBOL(m68k_memory);
-#ifndef CONFIG_SUN3
-EXPORT_SYMBOL(cache_push);
-EXPORT_SYMBOL(cache_clear);
-#ifndef CONFIG_SINGLE_MEMORY_CHUNK
-EXPORT_SYMBOL(mm_vtop);
-EXPORT_SYMBOL(mm_ptov);
-EXPORT_SYMBOL(mm_end_of_chunk);
-#else
-EXPORT_SYMBOL(m68k_memoffset);
-#endif /* !CONFIG_SINGLE_MEMORY_CHUNK */
-EXPORT_SYMBOL(__ioremap);
-EXPORT_SYMBOL(iounmap);
-EXPORT_SYMBOL(kernel_set_cachemode);
-#endif /* !CONFIG_SUN3 */
-EXPORT_SYMBOL(m68k_debug_device);
-EXPORT_SYMBOL(mach_hwclk);
-EXPORT_SYMBOL(mach_get_ss);
-EXPORT_SYMBOL(mach_get_rtc_pll);
-EXPORT_SYMBOL(mach_set_rtc_pll);
-#ifdef CONFIG_INPUT_M68K_BEEP_MODULE
-EXPORT_SYMBOL(mach_beep);
-#endif
-EXPORT_SYMBOL(dump_fpu);
-EXPORT_SYMBOL(dump_thread);
-EXPORT_SYMBOL(kernel_thread);
-#ifdef CONFIG_VME
-EXPORT_SYMBOL(vme_brdtype);
-#endif
 
 /* The following are special because they're not called
    explicitly (the C compiler generates them).  Fortunately,
diff --git a/arch/m68k/kernel/process.c b/arch/m68k/kernel/process.c
index 45a46646c1b3..99fc1226f7f8 100644
--- a/arch/m68k/kernel/process.c
+++ b/arch/m68k/kernel/process.c
@@ -187,6 +187,7 @@ int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags)
         set_fs (fs);
         return pid;
 }
+EXPORT_SYMBOL(kernel_thread);
 
 void flush_thread(void)
 {
@@ -221,13 +222,13 @@ asmlinkage int m68k_clone(struct pt_regs *regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
-        int *parent_tidptr, *child_tidptr;
+        int __user *parent_tidptr, *child_tidptr;
 
         /* syscall2 puts clone_flags in d1 and usp in d2 */
         clone_flags = regs->d1;
         newsp = regs->d2;
-        parent_tidptr = (int *)regs->d3;
-        child_tidptr = (int *)regs->d4;
+        parent_tidptr = (int __user *)regs->d3;
+        child_tidptr = (int __user *)regs->d4;
         if (!newsp)
                 newsp = rdusp();
         return do_fork(clone_flags, newsp, regs, 0,
@@ -311,6 +312,7 @@ int dump_fpu (struct pt_regs *regs, struct user_m68kfp_struct *fpu)
                 : "memory");
         return 1;
 }
+EXPORT_SYMBOL(dump_fpu);
 
 /*
  * fill in the user structure for a core dump..
@@ -357,11 +359,12 @@ void dump_thread(struct pt_regs * regs, struct user * dump)
         /* dump floating point stuff */
         dump->u_fpvalid = dump_fpu (regs, &dump->m68kfp);
 }
+EXPORT_SYMBOL(dump_thread);
 
 /*
  * sys_execve() executes a new program.
  */
-asmlinkage int sys_execve(char *name, char **argv, char **envp)
+asmlinkage int sys_execve(char __user *name, char __user * __user *argv, char __user * __user *envp)
 {
         int error;
         char * filename;
diff --git a/arch/m68k/kernel/setup.c b/arch/m68k/kernel/setup.c
index 42d5b85f3350..9af3ee0e555d 100644
--- a/arch/m68k/kernel/setup.c
+++ b/arch/m68k/kernel/setup.c
@@ -42,27 +42,37 @@
 
 unsigned long m68k_machtype;
 unsigned long m68k_cputype;
+EXPORT_SYMBOL(m68k_machtype);
+EXPORT_SYMBOL(m68k_cputype);
 unsigned long m68k_fputype;
 unsigned long m68k_mmutype;
 #ifdef CONFIG_VME
 unsigned long vme_brdtype;
+EXPORT_SYMBOL(vme_brdtype);
 #endif
 
 int m68k_is040or060;
+EXPORT_SYMBOL(m68k_is040or060);
 
 extern int end;
 extern unsigned long availmem;
 
 int m68k_num_memory;
 int m68k_realnum_memory;
+EXPORT_SYMBOL(m68k_realnum_memory);
+#ifdef CONFIG_SINGLE_MEMORY_CHUNK
 unsigned long m68k_memoffset;
+EXPORT_SYMBOL(m68k_memoffset);
+#endif
 struct mem_info m68k_memory[NUM_MEMINFO];
+EXPORT_SYMBOL(m68k_memory);
 
 static struct mem_info m68k_ramdisk;
 
 static char m68k_command_line[CL_SIZE];
 
 char m68k_debug_device[6] = "";
+EXPORT_SYMBOL(m68k_debug_device);
 
 void (*mach_sched_init) (irq_handler_t handler) __initdata = NULL;
 /* machine dependent irq functions */
@@ -72,10 +82,14 @@ int (*mach_get_hardware_list) (char *buffer);
 /* machine dependent timer functions */
 unsigned long (*mach_gettimeoffset) (void);
 int (*mach_hwclk) (int, struct rtc_time*);
+EXPORT_SYMBOL(mach_hwclk);
 int (*mach_set_clock_mmss) (unsigned long);
 unsigned int (*mach_get_ss)(void);
 int (*mach_get_rtc_pll)(struct rtc_pll_info *);
 int (*mach_set_rtc_pll)(struct rtc_pll_info *);
+EXPORT_SYMBOL(mach_get_ss);
+EXPORT_SYMBOL(mach_get_rtc_pll);
+EXPORT_SYMBOL(mach_set_rtc_pll);
 void (*mach_reset)( void );
 void (*mach_halt)( void );
 void (*mach_power_off)( void );
@@ -89,6 +103,7 @@ void (*mach_l2_flush) (int);
 #endif
 #if defined(CONFIG_INPUT_M68K_BEEP) || defined(CONFIG_INPUT_M68K_BEEP_MODULE)
 void (*mach_beep)(unsigned int, unsigned int);
+EXPORT_SYMBOL(mach_beep);
 #endif
 #if defined(CONFIG_ISA) && defined(MULTI_ISA)
 int isa_type;
diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
index 4569406a2e1f..759fa244e6cd 100644
--- a/arch/m68k/kernel/traps.c
+++ b/arch/m68k/kernel/traps.c
@@ -326,13 +326,13 @@ static inline int do_040writeback1(unsigned short wbs, unsigned long wba,
 
         switch (wbs & WBSIZ_040) {
         case BA_SIZE_BYTE:
-                res = put_user(wbd & 0xff, (char *)wba);
+                res = put_user(wbd & 0xff, (char __user *)wba);
                 break;
         case BA_SIZE_WORD:
-                res = put_user(wbd & 0xffff, (short *)wba);
+                res = put_user(wbd & 0xffff, (short __user *)wba);
                 break;
         case BA_SIZE_LONG:
-                res = put_user(wbd, (int *)wba);
+                res = put_user(wbd, (int __user *)wba);
                 break;
         }
 
diff --git a/arch/m68k/kernel/vmlinux-std.lds b/arch/m68k/kernel/vmlinux-std.lds
index 69d1d3d30c78..d2794452b195 100644
--- a/arch/m68k/kernel/vmlinux-std.lds
+++ b/arch/m68k/kernel/vmlinux-std.lds
@@ -54,13 +54,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/m68k/kernel/vmlinux-sun3.lds b/arch/m68k/kernel/vmlinux-sun3.lds
index 65cc39c24185..2550b4ae2732 100644
--- a/arch/m68k/kernel/vmlinux-sun3.lds
+++ b/arch/m68k/kernel/vmlinux-sun3.lds
@@ -48,13 +48,7 @@ __init_begin = .;
         __setup_end = .;
         __initcall_start = .;
         .initcall.init : {
-                *(.initcall1.init)
-                *(.initcall2.init)
-                *(.initcall3.init)
-                *(.initcall4.init)
-                *(.initcall5.init)
-                *(.initcall6.init)
-                *(.initcall7.init)
+                INITCALLS
         }
         __initcall_end = .;
         __con_initcall_start = .;
diff --git a/arch/m68k/mm/kmap.c b/arch/m68k/mm/kmap.c
index f46f049d29ff..b54ef1726c55 100644
--- a/arch/m68k/mm/kmap.c
+++ b/arch/m68k/mm/kmap.c
@@ -7,6 +7,7 @@
  *           used by other architectures                /Roman Zippel
  */
 
+#include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -219,6 +220,7 @@ void __iomem *__ioremap(unsigned long physaddr, unsigned long size, int cachefla
 
         return (void __iomem *)retaddr;
 }
+EXPORT_SYMBOL(__ioremap);
 
 /*
  * Unmap a ioremap()ed region again
@@ -234,6 +236,7 @@ void iounmap(void __iomem *addr)
         free_io_area((__force void *)addr);
 #endif
 }
+EXPORT_SYMBOL(iounmap);
 
 /*
  * __iounmap unmaps nearly everything, so be careful
@@ -360,3 +363,4 @@ void kernel_set_cachemode(void *addr, unsigned long size, int cmode)
 
         flush_tlb_all();
 }
+EXPORT_SYMBOL(kernel_set_cachemode);
diff --git a/arch/m68k/mm/memory.c b/arch/m68k/mm/memory.c
index a0c095e17222..0f88812822b1 100644
--- a/arch/m68k/mm/memory.c
+++ b/arch/m68k/mm/memory.c
@@ -4,6 +4,7 @@
  *  Copyright (C) 1995  Hamish Macdonald
  */
 
+#include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -157,9 +158,8 @@ unsigned long mm_vtop(unsigned long vaddr)
 
         return -1;
 }
-#endif
+EXPORT_SYMBOL(mm_vtop);
 
-#ifndef CONFIG_SINGLE_MEMORY_CHUNK
 unsigned long mm_ptov (unsigned long paddr)
 {
         int i = 0;
@@ -185,6 +185,7 @@ unsigned long mm_ptov (unsigned long paddr)
 #endif
         return -1;
 }
+EXPORT_SYMBOL(mm_ptov);
 #endif
 
 /* invalidate page in both caches */
@@ -298,6 +299,7 @@ void cache_clear (unsigned long paddr, int len)
         mach_l2_flush(0);
 #endif
 }
+EXPORT_SYMBOL(cache_clear);     /* probably can be unexported */
 
 
 /*
@@ -350,6 +352,7 @@ void cache_push (unsigned long paddr, int len)
         mach_l2_flush(1);
 #endif
 }
+EXPORT_SYMBOL(cache_push);      /* probably can be unexported */
 
 #ifndef CONFIG_SINGLE_MEMORY_CHUNK
 int mm_end_of_chunk (unsigned long addr, int len)
@@ -361,4 +364,5 @@ int mm_end_of_chunk (unsigned long addr, int len)
                         return 1;
         return 0;
 }
+EXPORT_SYMBOL(mm_end_of_chunk);
 #endif
diff --git a/arch/m68k/mm/sun3kmap.c b/arch/m68k/mm/sun3kmap.c
index 7f0d86f3fe73..1af24cb5bfe1 100644
--- a/arch/m68k/mm/sun3kmap.c
+++ b/arch/m68k/mm/sun3kmap.c
@@ -8,6 +8,7 @@
  * for more details.
  */
 
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
@@ -59,7 +60,7 @@ static inline void do_pmeg_mapin(unsigned long phys, unsigned long virt,
         }
 }
 
-void *sun3_ioremap(unsigned long phys, unsigned long size,
+void __iomem *sun3_ioremap(unsigned long phys, unsigned long size,
                    unsigned long type)
 {
         struct vm_struct *area;
@@ -101,22 +102,24 @@ void *sun3_ioremap(unsigned long phys, unsigned long size,
                 virt += seg_pages * PAGE_SIZE;
         }
 
-        return (void *)ret;
+        return (void __iomem *)ret;
 
 }
 
 
-void *__ioremap(unsigned long phys, unsigned long size, int cache)
+void __iomem *__ioremap(unsigned long phys, unsigned long size, int cache)
 {
 
         return sun3_ioremap(phys, size, SUN3_PAGE_TYPE_IO);
 
 }
+EXPORT_SYMBOL(__ioremap);
 
-void iounmap(void *addr)
+void iounmap(void __iomem *addr)
 {
         vfree((void *)(PAGE_MASK & (unsigned long)addr));
 }
+EXPORT_SYMBOL(iounmap);
 
 /* sun3_map_test(addr, val) -- Reads a byte from addr, storing to val,
  * trapping the potential read fault.  Returns 0 if the access faulted,
diff --git a/arch/m68k/sun3/Makefile b/arch/m68k/sun3/Makefile
index 4d4f0695d985..be1a8470d636 100644
--- a/arch/m68k/sun3/Makefile
+++ b/arch/m68k/sun3/Makefile
@@ -2,6 +2,6 @@
 # Makefile for Linux arch/m68k/sun3 source directory
 #
 
-obj-y   := sun3_ksyms.o sun3ints.o sun3dvma.o sbus.o idprom.o
+obj-y   := sun3ints.o sun3dvma.o sbus.o idprom.o
 
 obj-$(CONFIG_SUN3) += config.o mmu_emu.o leds.o dvma.o intersil.o
diff --git a/arch/m68k/sun3/idprom.c b/arch/m68k/sun3/idprom.c
index 02c1fee6fe74..dca6ab6a4ede 100644
--- a/arch/m68k/sun3/idprom.c
+++ b/arch/m68k/sun3/idprom.c
@@ -6,6 +6,7 @@
  * Sun3/3x models added by David Monro (davidm@psrg.cs.usyd.edu.au)
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/init.h>
@@ -16,6 +17,8 @@
 #include <asm/machines.h>  /* Fun with Sun released architectures. */
 
 struct idprom *idprom;
+EXPORT_SYMBOL(idprom);
+
 static struct idprom idprom_buffer;
 
 /* Here is the master table of Sun machines which use some implementation
diff --git a/arch/m68k/sun3/sun3_ksyms.c b/arch/m68k/sun3/sun3_ksyms.c
deleted file mode 100644
index 43e5a9af8abd..000000000000
--- a/arch/m68k/sun3/sun3_ksyms.c
+++ /dev/null
@@ -1,13 +0,0 @@
-#include <linux/module.h>
-#include <linux/types.h>
-#include <asm/dvma.h>
-#include <asm/idprom.h>
-
-/*
- * Add things here when you find the need for it.
- */
-EXPORT_SYMBOL(dvma_map_align);
-EXPORT_SYMBOL(dvma_unmap);
-EXPORT_SYMBOL(dvma_malloc_align);
-EXPORT_SYMBOL(dvma_free);
-EXPORT_SYMBOL(idprom);
diff --git a/arch/m68k/sun3/sun3dvma.c b/arch/m68k/sun3/sun3dvma.c
index a2bc2da7f8f0..8709677fa025 100644
--- a/arch/m68k/sun3/sun3dvma.c
+++ b/arch/m68k/sun3/sun3dvma.c
@@ -6,6 +6,7 @@
  * Contains common routines for sun3/sun3x DVMA management.
  */
 
+#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/list.h>
@@ -312,6 +313,7 @@ inline unsigned long dvma_map_align(unsigned long kaddr, int len, int align)
         BUG();
         return 0;
 }
+EXPORT_SYMBOL(dvma_map_align);
 
 void dvma_unmap(void *baddr)
 {
@@ -327,7 +329,7 @@ void dvma_unmap(void *baddr)
         return;
 
 }
-
+EXPORT_SYMBOL(dvma_unmap);
 
 void *dvma_malloc_align(unsigned long len, unsigned long align)
 {
@@ -367,6 +369,7 @@ void *dvma_malloc_align(unsigned long len, unsigned long align)
         return (void *)vaddr;
 
 }
+EXPORT_SYMBOL(dvma_malloc_align);
 
 void dvma_free(void *vaddr)
 {
@@ -374,3 +377,4 @@ void dvma_free(void *vaddr)
         return;
 
 }
+EXPORT_SYMBOL(dvma_free);
diff --git a/arch/m68knommu/kernel/setup.c b/arch/m68knommu/kernel/setup.c
index bde9811cf98c..7b21959eaeae 100644
--- a/arch/m68knommu/kernel/setup.c
+++ b/arch/m68knommu/kernel/setup.c
@@ -62,7 +62,7 @@ int (*mach_kbdrate) (struct kbd_repeat *);
 void (*mach_kbd_leds) (unsigned int);
 /* machine dependent irq functions */
 void (*mach_init_IRQ) (void);
-irqreturn_t (*(*mach_default_handler)[]) (int, void *, struct pt_regs *);
+irq_handler_t mach_default_handler;
 int (*mach_get_irq_list) (struct seq_file *, void *);
 void (*mach_process_int) (int irq, struct pt_regs *fp);
 void (*mach_trap_init) (void);
diff --git a/arch/m68knommu/kernel/syscalltable.S b/arch/m68knommu/kernel/syscalltable.S
index 617e43ec95ae..4603f4f3c935 100644
--- a/arch/m68knommu/kernel/syscalltable.S
+++ b/arch/m68knommu/kernel/syscalltable.S
@@ -296,10 +296,39 @@ ENTRY(sys_call_table)
         .long sys_mq_notify     /* 275 */
         .long sys_mq_getsetattr
         .long sys_waitid
-        .long sys_ni_syscall    /* sys_setaltroot */
-        .long sys_ni_syscall    /* sys_add_key */
-        .long sys_ni_syscall    /* 280 */ /* sys_request_key */
-        .long sys_ni_syscall    /* sys_keyctl */
+        .long sys_ni_syscall    /* for sys_vserver */
+        .long sys_add_key
+        .long sys_request_key   /* 280 */
+        .long sys_keyctl
+        .long sys_ioprio_set
+        .long sys_ioprio_get
+        .long sys_inotify_init
+        .long sys_inotify_add_watch     /* 285 */
+        .long sys_inotify_rm_watch
+        .long sys_migrate_pages
+        .long sys_openat
+        .long sys_mkdirat
+        .long sys_mknodat               /* 290 */
+        .long sys_fchownat
+        .long sys_futimesat
+        .long sys_fstatat64
+        .long sys_unlinkat
+        .long sys_renameat              /* 295 */
+        .long sys_linkat
+        .long sys_symlinkat
+        .long sys_readlinkat
+        .long sys_fchmodat
+        .long sys_faccessat             /* 300 */
+        .long sys_ni_syscall            /* Reserved for pselect6 */
+        .long sys_ni_syscall            /* Reserved for ppoll */
+        .long sys_unshare
+        .long sys_set_robust_list
+        .long sys_get_robust_list       /* 305 */
+        .long sys_splice
+        .long sys_sync_file_range
+        .long sys_tee
+        .long sys_vmsplice
+        .long sys_move_pages            /* 310 */
 
         .rept NR_syscalls-(.-sys_call_table)/4
                 .long sys_ni_syscall
diff --git a/arch/m68knommu/kernel/time.c b/arch/m68knommu/kernel/time.c
index c5667bdddd5e..9226264abf1a 100644
--- a/arch/m68knommu/kernel/time.c
+++ b/arch/m68knommu/kernel/time.c
@@ -54,7 +54,7 @@ static irqreturn_t timer_interrupt(int irq, void *dummy, struct pt_regs * regs)
         update_process_times(user_mode(regs));
 #endif
         if (current->pid)
-                profile_tick(CPU_PROFILING, regs);
+                profile_tick(CPU_PROFILING);
 
         /*
          * If we have an externally synchronized Linux clock, then update
diff --git a/arch/m68knommu/kernel/vmlinux.lds.S b/arch/m68knommu/kernel/vmlinux.lds.S
index ccd2ceb05cfb..58afa8be604e 100644
--- a/arch/m68knommu/kernel/vmlinux.lds.S
+++ b/arch/m68knommu/kernel/vmlinux.lds.S
@@ -140,13 +140,7 @@ SECTIONS {
                 *(.init.setup)
                 __setup_end = .;
                 __initcall_start = .;
-                *(.initcall1.init)
-                *(.initcall2.init)
-                *(.initcall3.init)
-                *(.initcall4.init)
-                *(.initcall5.init)
-                *(.initcall6.init)
-                *(.initcall7.init)
+                INITCALLS
                 __initcall_end = .;
                 __con_initcall_start = .;
                 *(.con_initcall.init)
diff --git a/arch/m68knommu/platform/5307/ints.c b/arch/m68knommu/platform/5307/ints.c
index b4b55093ae7e..a57239ec6c8c 100644
--- a/arch/m68knommu/platform/5307/ints.c
+++ b/arch/m68knommu/platform/5307/ints.c
@@ -33,7 +33,7 @@
 /*
  *      This table stores the address info for each vector handler.
  */
-irq_handler_t irq_list[SYS_IRQS];
+struct irq_entry irq_list[SYS_IRQS];
 
 #define NUM_IRQ_NODES 16
 static irq_node_t nodes[NUM_IRQ_NODES];
@@ -44,7 +44,7 @@ volatile unsigned int num_spurious;
 unsigned int local_bh_count[NR_CPUS];
 unsigned int local_irq_count[NR_CPUS];
 
-static irqreturn_t default_irq_handler(int irq, void *ptr, struct pt_regs *regs)
+static irqreturn_t default_irq_handler(int irq, void *ptr)
 {
 #if 1
         printk(KERN_INFO "%s(%d): default irq handler vec=%d [0x%x]\n",
@@ -70,7 +70,7 @@ void __init init_IRQ(void)
 
         for (i = 0; i < SYS_IRQS; i++) {
                 if (mach_default_handler)
-                        irq_list[i].handler = (*mach_default_handler)[i];
+                        irq_list[i].handler = mach_default_handler;
                 else
                         irq_list[i].handler = default_irq_handler;
                 irq_list[i].flags   = IRQ_FLG_STD;
@@ -100,7 +100,7 @@ irq_node_t *new_irq_node(void)
 
 int request_irq(
         unsigned int irq,
-        irqreturn_t (*handler)(int, void *, struct pt_regs *),
+        irq_handler_t handler,
         unsigned long flags,
         const char *devname,
         void *dev_id)
@@ -157,7 +157,7 @@ void free_irq(unsigned int irq, void *dev_id)
         }
 
         if (mach_default_handler)
-                irq_list[irq].handler = (*mach_default_handler)[irq];
+                irq_list[irq].handler = mach_default_handler;
         else
                 irq_list[irq].handler = default_irq_handler;
         irq_list[irq].flags   = IRQ_FLG_STD;
@@ -168,8 +168,7 @@ void free_irq(unsigned int irq, void *dev_id)
 EXPORT_SYMBOL(free_irq);
 
 
-int sys_request_irq(unsigned int irq, 
-                    irqreturn_t (*handler)(int, void *, struct pt_regs *), 
+int sys_request_irq(unsigned int irq, irq_handler_t handler, 
                     unsigned long flags, const char *devname, void *dev_id)
 {
         if (irq > IRQ7) {
@@ -211,7 +210,7 @@ void sys_free_irq(unsigned int irq, void *dev_id)
                 printk(KERN_WARNING "%s: Removing probably wrong IRQ %d from %s\n",
                        __FUNCTION__, irq, irq_list[irq].devname);
 
-        irq_list[irq].handler = (*mach_default_handler)[irq];
+        irq_list[irq].handler = mach_default_handler;
         irq_list[irq].flags   = 0;
         irq_list[irq].dev_id  = NULL;
         irq_list[irq].devname = NULL;
@@ -241,7 +240,7 @@ asmlinkage void process_int(unsigned long vec, struct pt_regs *fp)
         if (vec >= VEC_INT1 && vec <= VEC_INT7) {
                 vec -= VEC_SPUR;
                 kstat_cpu(0).irqs[vec]++;
-                irq_list[vec].handler(vec, irq_list[vec].dev_id, fp);
+                irq_list[vec].handler(vec, irq_list[vec].dev_id);
         } else {
                 if (mach_process_int)
                         mach_process_int(vec, fp);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 14af6cce2fa2..1443024b1c7c 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -425,9 +425,8 @@ config MOMENCO_OCELOT_G
         select SWAP_IO_SPACE
         select SYS_HAS_CPU_RM7000
         select SYS_SUPPORTS_32BIT_KERNEL
-        select SYS_SUPPORTS_64BIT_KERNEL
+        select SYS_SUPPORTS_64BIT_KERNEL if BROKEN
         select SYS_SUPPORTS_BIG_ENDIAN
-        select ARCH_SPARSEMEM_ENABLE
         help
           The Ocelot is a MIPS-based Single Board Computer (SBC) made by
           Momentum Computer <http://www.momenco.com/>.
@@ -560,6 +559,7 @@ config SGI_IP27
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_NUMA
+        select SYS_SUPPORTS_SMP
         help
           This are the SGI Origin 200, Origin 2000 and Onyx 2 Graphics
           workstations.  To compile a Linux kernel that runs on these, say Y
@@ -1633,9 +1633,6 @@ config ARCH_DISCONTIGMEM_ENABLE
 
 config ARCH_SPARSEMEM_ENABLE
         bool
-
-config ARCH_SPARSEMEM_ENABLE
-        bool
         select SPARSEMEM_STATIC
 
 config NUMA
@@ -1690,6 +1687,7 @@ config NR_CPUS
         depends on SMP
         default "64" if SGI_IP27
         default "2"
+        default "8" if MIPS_MT_SMTC
         help
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  The maximum supported value is 32 for 32-bit
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index 2124350ab94d..d580d46f967b 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -63,7 +63,9 @@ cflags-y		+= -mabi=64
 ifdef CONFIG_BUILD_ELF64
 cflags-y                += $(call cc-option,-mno-explicit-relocs)
 else
-cflags-y                += $(call cc-option,-msym32)
+# -msym32 can not be used for modules since they are loaded into XKSEG
+CFLAGS_MODULE           += $(call cc-option,-mno-explicit-relocs)
+CFLAGS_KERNEL           += $(call cc-option,-msym32)
 endif
 endif
 
@@ -91,8 +93,17 @@ cflags-y += -ffreestanding
 # carefully avoid to add it redundantly because gcc 3.3/3.4 complains
 # when fed the toolchain default!
 #
-cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' && echo -EB -D__MIPSEB__)
-cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' || echo -EL -D__MIPSEL__)
+# Certain gcc versions upto gcc 4.1.1 (probably 4.2-subversion as of
+# 2006-10-10 don't properly change the the predefined symbols if -EB / -EL
+# are used, so we kludge that here.  A bug has been filed at
+# http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29413.
+#
+undef-all += -UMIPSEB -U_MIPSEB -U__MIPSEB -U__MIPSEB__
+undef-all += -UMIPSEL -U_MIPSEL -U__MIPSEL -U__MIPSEL__
+predef-be += -DMIPSEB -D_MIPSEB -D__MIPSEB -D__MIPSEB__
+predef-le += -DMIPSEL -D_MIPSEL -D__MIPSEL -D__MIPSEL__
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' && echo -EB $(undef-all) $(predef-be))
+cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += $(shell $(CC) -dumpmachine |grep -q 'mips.*el-.*' || echo -EL $(undef-all) $(predef-le))
 
 cflags-$(CONFIG_SB1XXX_CORELIS) += $(call cc-option,-mno-sched-prolog) \
                                    -fno-omit-frame-pointer
diff --git a/arch/mips/au1000/common/dbdma.c b/arch/mips/au1000/common/dbdma.c
index c4fae8ff4671..626de44bd888 100644
--- a/arch/mips/au1000/common/dbdma.c
+++ b/arch/mips/au1000/common/dbdma.c
@@ -849,7 +849,7 @@ au1xxx_dbdma_chan_free(u32 chanid)
 EXPORT_SYMBOL(au1xxx_dbdma_chan_free);
 
 static irqreturn_t
-dbdma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+dbdma_interrupt(int irq, void *dev_id)
 {
         u32 intstat;
         u32 chan_index;
diff --git a/arch/mips/au1000/common/prom.c b/arch/mips/au1000/common/prom.c
index b4b010a2fe36..6fce60af005d 100644
--- a/arch/mips/au1000/common/prom.c
+++ b/arch/mips/au1000/common/prom.c
@@ -47,7 +47,7 @@ extern int prom_argc;
 extern char **prom_argv, **prom_envp;
 
 
-char * prom_getcmdline(void)
+char * __init_or_module prom_getcmdline(void)
 {
         return &(arcs_cmdline[0]);
 }
diff --git a/arch/mips/au1000/common/setup.c b/arch/mips/au1000/common/setup.c
index 377ae0d8ff00..919172db560c 100644
--- a/arch/mips/au1000/common/setup.c
+++ b/arch/mips/au1000/common/setup.c
@@ -43,7 +43,7 @@
 #include <asm/mach-au1x00/au1000.h>
 #include <asm/time.h>
 
-extern char * __init prom_getcmdline(void);
+extern char * prom_getcmdline(void);
 extern void __init board_setup(void);
 extern void au1000_restart(char *);
 extern void au1000_halt(void);
diff --git a/arch/mips/au1000/common/time.c b/arch/mips/au1000/common/time.c
index 94f09194d63d..fa1c62f05515 100644
--- a/arch/mips/au1000/common/time.c
+++ b/arch/mips/au1000/common/time.c
@@ -53,9 +53,6 @@ static unsigned long r4k_cur;    /* What counter should be at next timer irq */
 int     no_au1xxx_32khz;
 extern int allow_au1k_wait; /* default off for CP0 Counter */
 
-/* Cycle counter value at the previous timer interrupt.. */
-static unsigned int timerhi = 0, timerlo = 0;
-
 #ifdef CONFIG_PM
 #if HZ < 100 || HZ > 1000
 #error "unsupported HZ value! Must be in [100,1000]"
@@ -82,7 +79,6 @@ unsigned long wtimer;
 void mips_timer_interrupt(void)
 {
         int irq = 63;
-        unsigned long count;
 
         irq_enter();
         kstat_this_cpu.irqs[irq]++;
@@ -91,10 +87,6 @@ void mips_timer_interrupt(void)
                 goto null;
 
         do {
-                count = read_c0_count();
-                timerhi += (count < timerlo);   /* Wrap around */
-                timerlo = count;
-
                 kstat_this_cpu.irqs[irq]++;
                 do_timer(1);
 #ifndef CONFIG_SMP
@@ -231,7 +223,6 @@ wakeup_counter0_set(int ticks)
  */
 unsigned long cal_r4koff(void)
 {
-        unsigned long count;
         unsigned long cpu_speed;
         unsigned long flags;
         unsigned long counter;
@@ -258,7 +249,7 @@ unsigned long cal_r4koff(void)
 
 #if defined(CONFIG_AU1000_USE32K)
                 {
-                        unsigned long start, end;
+                        unsigned long start, end, count;
 
                         start = au_readl(SYS_RTCREAD);
                         start += 2;
@@ -282,7 +273,6 @@ unsigned long cal_r4koff(void)
 #else
                 cpu_speed = (au_readl(SYS_CPUPLL) & 0x0000003f) *
                         AU1000_SRC_CLK;
-                count = cpu_speed / 2;
 #endif
         }
         else {
@@ -291,98 +281,15 @@ unsigned long cal_r4koff(void)
                  * NOTE: some old silicon doesn't allow reading the PLL.
                  */
                 cpu_speed = (au_readl(SYS_CPUPLL) & 0x0000003f) * AU1000_SRC_CLK;
-                count = cpu_speed / 2;
                 no_au1xxx_32khz = 1;
         }
-        mips_hpt_frequency = count;
+        mips_hpt_frequency = cpu_speed;
         // Equation: Baudrate = CPU / (SD * 2 * CLKDIV * 16)
         set_au1x00_uart_baud_base(cpu_speed / (2 * ((int)(au_readl(SYS_POWERCTRL)&0x03) + 2) * 16));
         spin_unlock_irqrestore(&time_lock, flags);
         return (cpu_speed / HZ);
 }
 
-/* This is for machines which generate the exact clock. */
-#define USECS_PER_JIFFY (1000000/HZ)
-#define USECS_PER_JIFFY_FRAC (0x100000000LL*1000000/HZ&0xffffffff)
-
-static unsigned long
-div64_32(unsigned long v1, unsigned long v2, unsigned long v3)
-{
-        unsigned long r0;
-        do_div64_32(r0, v1, v2, v3);
-        return r0;
-}
-
-static unsigned long do_fast_cp0_gettimeoffset(void)
-{
-        u32 count;
-        unsigned long res, tmp;
-        unsigned long r0;
-
-        /* Last jiffy when do_fast_gettimeoffset() was called. */
-        static unsigned long last_jiffies=0;
-        unsigned long quotient;
-
-        /*
-         * Cached "1/(clocks per usec)*2^32" value.
-         * It has to be recalculated once each jiffy.
-         */
-        static unsigned long cached_quotient=0;
-
-        tmp = jiffies;
-
-        quotient = cached_quotient;
-
-        if (tmp && last_jiffies != tmp) {
-                last_jiffies = tmp;
-                if (last_jiffies != 0) {
-                        r0 = div64_32(timerhi, timerlo, tmp);
-                        quotient = div64_32(USECS_PER_JIFFY, USECS_PER_JIFFY_FRAC, r0);
-                        cached_quotient = quotient;
-                }
-        }
-
-        /* Get last timer tick in absolute kernel time */
-        count = read_c0_count();
-
-        /* .. relative to previous jiffy (32 bits is enough) */
-        count -= timerlo;
-
-        __asm__("multu\t%1,%2\n\t"
-                "mfhi\t%0"
-                : "=r" (res)
-                : "r" (count), "r" (quotient)
-                : "hi", "lo", GCC_REG_ACCUM);
-
-        /*
-         * Due to possible jiffies inconsistencies, we need to check
-         * the result so that we'll get a timer that is monotonic.
-         */
-        if (res >= USECS_PER_JIFFY)
-                res = USECS_PER_JIFFY-1;
-
-        return res;
-}
-
-#ifdef CONFIG_PM
-static unsigned long do_fast_pm_gettimeoffset(void)
-{
-        unsigned long pc0;
-        unsigned long offset;
-
-        pc0 = au_readl(SYS_TOYREAD);
-        au_sync();
-        offset = pc0 - last_pc0;
-        if (offset > 2*MATCH20_INC) {
-                printk("huge offset %x, last_pc0 %x last_match20 %x pc0 %x\n",
-                                (unsigned)offset, (unsigned)last_pc0,
-                                (unsigned)last_match20, (unsigned)pc0);
-        }
-        offset = (unsigned long)((offset * 305) / 10);
-        return offset;
-}
-#endif
-
 void __init plat_timer_setup(struct irqaction *irq)
 {
         unsigned int est_freq;
@@ -420,7 +327,6 @@ void __init plat_timer_setup(struct irqaction *irq)
                 unsigned int c0_status;
 
                 printk("WARNING: no 32KHz clock found.\n");
-                do_gettimeoffset = do_fast_cp0_gettimeoffset;
 
                 /* Ensure we get CPO_COUNTER interrupts.
                 */
@@ -445,19 +351,11 @@ void __init plat_timer_setup(struct irqaction *irq)
                 while (au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_M20);
                 startup_match20_interrupt(counter0_irq);
 
-                do_gettimeoffset = do_fast_pm_gettimeoffset;
-
                 /* We can use the real 'wait' instruction.
                 */
                 allow_au1k_wait = 1;
         }
 
-#else
-        /* We have to do this here instead of in timer_init because
-         * the generic code in arch/mips/kernel/time.c will write
-         * over our function pointer.
-         */
-        do_gettimeoffset = do_fast_cp0_gettimeoffset;
 #endif
 }
 
diff --git a/arch/mips/configs/bigsur_defconfig b/arch/mips/configs/bigsur_defconfig
index c6a015940b41..ba3bf733d27d 100644
--- a/arch/mips/configs/bigsur_defconfig
+++ b/arch/mips/configs/bigsur_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Thu Jul  6 10:02:58 2006
+# Linux kernel version: 2.6.19-rc1
+# Wed Oct 11 01:41:41 2006
 #
 CONFIG_MIPS=y
 
@@ -25,8 +25,6 @@ CONFIG_MIPS=y
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MIPS_EV64120 is not set
-# CONFIG_MIPS_IVR is not set
-# CONFIG_MIPS_ITE8172 is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
 # CONFIG_MIPS_ATLAS is not set
@@ -83,6 +81,7 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_TIME=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_COHERENT=y
 CONFIG_CPU_BIG_ENDIAN=y
@@ -132,8 +131,8 @@ CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_64KB is not set
 # CONFIG_SIBYTE_DMA_PAGEOPS is not set
 CONFIG_MIPS_MT_DISABLED=y
-# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_VPE_LOADER is not set
 CONFIG_CPU_HAS_LLSC=y
 CONFIG_CPU_HAS_SYNC=y
@@ -185,9 +184,11 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
@@ -195,7 +196,9 @@ CONFIG_IKCONFIG_PROC=y
 # CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -204,12 +207,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -228,6 +231,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
@@ -249,18 +253,17 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 CONFIG_HW_HAS_PCI=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 CONFIG_PCI_DEBUG=y
 CONFIG_MMU=y
 
 #
 # PCCARD (PCMCIA/CardBus) support
 #
-# CONFIG_PCCARD is not set
 
 #
 # PCI Hotplug Support
 #
-# CONFIG_HOTPLUG_PCI is not set
 
 #
 # Executable file formats
@@ -271,7 +274,7 @@ CONFIG_BINFMT_ELF=y
 CONFIG_MIPS32_COMPAT=y
 CONFIG_COMPAT=y
 CONFIG_MIPS32_O32=y
-# CONFIG_MIPS32_N32 is not set
+CONFIG_MIPS32_N32=y
 CONFIG_BINFMT_ELF32=y
 
 #
@@ -288,6 +291,7 @@ CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 CONFIG_XFRM_USER=m
+# CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_NET_KEY=y
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
@@ -308,10 +312,12 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -341,7 +347,6 @@ CONFIG_NETWORK_SECMARK=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -368,7 +373,6 @@ CONFIG_NETWORK_SECMARK=y
 #
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-# CONFIG_FW_LOADER is not set
 # CONFIG_DEBUG_DRIVER is not set
 # CONFIG_SYS_HYPERVISOR is not set
 
@@ -404,7 +408,7 @@ CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_NBD=m
 # CONFIG_BLK_DEV_SX8 is not set
 # CONFIG_BLK_DEV_RAM is not set
-# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
 
@@ -412,6 +416,7 @@ CONFIG_BLK_DEV_NBD=m
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -429,10 +434,40 @@ CONFIG_BLK_DEV_IDEFLOPPY=y
 # IDE chipset support/bugfixes
 #
 CONFIG_IDE_GENERIC=y
-# CONFIG_BLK_DEV_IDEPCI is not set
+CONFIG_BLK_DEV_IDEPCI=y
+# CONFIG_IDEPCI_SHARE_IRQ is not set
+# CONFIG_BLK_DEV_OFFBOARD is not set
+CONFIG_BLK_DEV_GENERIC=y
+# CONFIG_BLK_DEV_OPTI621 is not set
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+# CONFIG_IDEDMA_PCI_AUTO is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+CONFIG_BLK_DEV_CMD64X=y
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
 # CONFIG_BLK_DEV_IDE_SWARM is not set
 # CONFIG_IDE_ARM is not set
-# CONFIG_BLK_DEV_IDEDMA is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
 # CONFIG_IDEDMA_AUTO is not set
 # CONFIG_BLK_DEV_HD is not set
 
@@ -441,6 +476,12 @@ CONFIG_IDE_GENERIC=y
 #
 # CONFIG_RAID_ATTRS is not set
 # CONFIG_SCSI is not set
+# CONFIG_SCSI_NETLINK is not set
+
+#
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+# CONFIG_ATA is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -516,6 +557,7 @@ CONFIG_NET_SB1250_MAC=y
 # CONFIG_SK98LIN is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
@@ -650,7 +692,6 @@ CONFIG_I2C_CHARDEV=y
 # CONFIG_I2C_ALGOBIT is not set
 # CONFIG_I2C_ALGOPCF is not set
 # CONFIG_I2C_ALGOPCA is not set
-CONFIG_I2C_ALGO_SIBYTE=y
 
 #
 # I2C Hardware Bus support
@@ -712,12 +753,12 @@ CONFIG_I2C_DEBUG_CHIP=y
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -729,6 +770,7 @@ CONFIG_VIDEO_V4L2=y
 #
 # CONFIG_FIRMWARE_EDID is not set
 # CONFIG_FB is not set
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -811,6 +853,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -840,8 +883,10 @@ CONFIG_DNOTIFY=y
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_CONFIGFS_FS is not set
@@ -851,6 +896,7 @@ CONFIG_RAMFS=y
 #
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
+# CONFIG_ECRYPT_FS is not set
 # CONFIG_HFS_FS is not set
 # CONFIG_HFSPLUS_FS is not set
 # CONFIG_BEFS_FS is not set
@@ -881,7 +927,6 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -899,6 +944,10 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_NLS is not set
 
 #
+# Distributed Lock Manager
+#
+
+#
 # Profiling support
 #
 # CONFIG_PROFILING is not set
@@ -907,7 +956,8 @@ CONFIG_MSDOS_PARTITION=y
 # Kernel hacking
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
-CONFIG_PRINTK_TIME=y
+# CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
@@ -920,12 +970,15 @@ CONFIG_DETECT_SOFTLOCKUP=y
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_CROSSCOMPILE=y
@@ -946,6 +999,10 @@ CONFIG_KEYS_DEBUG_PROC_KEYS=y
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_MANAGER=m
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_NULL=y
 CONFIG_CRYPTO_MD4=y
@@ -955,9 +1012,12 @@ CONFIG_CRYPTO_SHA256=y
 CONFIG_CRYPTO_SHA512=y
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_TGR192=m
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=m
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_BLOWFISH=y
 CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_TWOFISH_COMMON=y
 CONFIG_CRYPTO_SERPENT=y
 CONFIG_CRYPTO_AES=m
 # CONFIG_CRYPTO_CAST5 is not set
diff --git a/arch/mips/configs/pnx8550-jbs_defconfig b/arch/mips/configs/pnx8550-jbs_defconfig
index 26b0b9883496..280a8001eacf 100644
--- a/arch/mips/configs/pnx8550-jbs_defconfig
+++ b/arch/mips/configs/pnx8550-jbs_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Thu Jul  6 10:04:18 2006
+# Linux kernel version: 2.6.19-rc2
+# Sat Oct 14 23:01:16 2006
 #
 CONFIG_MIPS=y
 
@@ -25,8 +25,6 @@ CONFIG_MIPS=y
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MIPS_EV64120 is not set
-# CONFIG_MIPS_IVR is not set
-# CONFIG_MIPS_ITE8172 is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
 # CONFIG_MIPS_ATLAS is not set
@@ -41,13 +39,13 @@ CONFIG_MIPS=y
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
 # CONFIG_PNX8550_V2PCI is not set
-# CONFIG_PNX8550_JBS is not set
+CONFIG_PNX8550_JBS=y
 # CONFIG_DDB5477 is not set
 # CONFIG_MACH_VR41XX is not set
 # CONFIG_PMC_YOSEMITE is not set
 # CONFIG_QEMU is not set
 # CONFIG_MARKEINS is not set
-CONFIG_SGI_IP22=y
+# CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP32 is not set
 # CONFIG_SIBYTE_BIGSUR is not set
@@ -67,25 +65,21 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_TIME=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
-CONFIG_ARC=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
-CONFIG_CPU_BIG_ENDIAN=y
-# CONFIG_CPU_LITTLE_ENDIAN is not set
-CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
-CONFIG_IRQ_CPU=y
-CONFIG_SWAP_IO_SPACE=y
-CONFIG_ARC32=y
-CONFIG_BOOT_ELF32=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_PNX8550=y
+CONFIG_SOC_PNX8550=y
 CONFIG_MIPS_L1_CACHE_SHIFT=5
-# CONFIG_ARC_CONSOLE is not set
-CONFIG_ARC_PROMLIB=y
 
 #
 # CPU selection
 #
-# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R1=y
 # CONFIG_CPU_MIPS32_R2 is not set
 # CONFIG_CPU_MIPS64_R1 is not set
 # CONFIG_CPU_MIPS64_R2 is not set
@@ -93,7 +87,7 @@ CONFIG_ARC_PROMLIB=y
 # CONFIG_CPU_TX39XX is not set
 # CONFIG_CPU_VR41XX is not set
 # CONFIG_CPU_R4300 is not set
-CONFIG_CPU_R4X00=y
+# CONFIG_CPU_R4X00 is not set
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
@@ -104,12 +98,11 @@ CONFIG_CPU_R4X00=y
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
-CONFIG_SYS_HAS_CPU_R4X00=y
-CONFIG_SYS_HAS_CPU_R5000=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPSR1=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
-CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
-CONFIG_CPU_SUPPORTS_64BIT_KERNEL=y
 
 #
 # Kernel type
@@ -120,17 +113,17 @@ CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_8KB is not set
 # CONFIG_PAGE_SIZE_16KB is not set
 # CONFIG_PAGE_SIZE_64KB is not set
-CONFIG_BOARD_SCACHE=y
-CONFIG_IP22_CPU_SCACHE=y
+CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_MIPS_MT_DISABLED=y
-# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_VPE_LOADER is not set
 # CONFIG_64BIT_PHYS_ADDR is not set
 CONFIG_CPU_HAS_LLSC=y
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -144,12 +137,12 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_HZ_48 is not set
 # CONFIG_HZ_100 is not set
 # CONFIG_HZ_128 is not set
-# CONFIG_HZ_250 is not set
+CONFIG_HZ_250=y
 # CONFIG_HZ_256 is not set
-CONFIG_HZ_1000=y
+# CONFIG_HZ_1000 is not set
 # CONFIG_HZ_1024 is not set
 CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
-CONFIG_HZ=1000
+CONFIG_HZ=250
 CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
@@ -171,16 +164,20 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
@@ -189,12 +186,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -211,6 +208,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
@@ -231,8 +229,10 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # Bus options (PCI, PCMCIA, EISA, ISA, TC)
 #
-CONFIG_HW_HAS_EISA=y
-# CONFIG_EISA is not set
+CONFIG_HW_HAS_PCI=y
+CONFIG_PCI=y
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
+# CONFIG_PCI_DEBUG is not set
 CONFIG_MMU=y
 
 #
@@ -243,6 +243,7 @@ CONFIG_MMU=y
 #
 # PCI Hotplug Support
 #
+# CONFIG_HOTPLUG_PCI is not set
 
 #
 # Executable file formats
@@ -265,6 +266,7 @@ CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
@@ -283,16 +285,18 @@ CONFIG_IP_PNP_BOOTP=y
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
-CONFIG_NETWORK_SECMARK=y
+# CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
 
 #
@@ -318,7 +322,6 @@ CONFIG_NETWORK_SECMARK=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -371,13 +374,20 @@ CONFIG_FW_LOADER=y
 #
 # Block devices
 #
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_UB is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -386,6 +396,7 @@ CONFIG_BLK_DEV_INITRD=y
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -404,8 +415,39 @@ CONFIG_BLK_DEV_IDESCSI=y
 # IDE chipset support/bugfixes
 #
 CONFIG_IDE_GENERIC=y
+CONFIG_BLK_DEV_IDEPCI=y
+CONFIG_IDEPCI_SHARE_IRQ=y
+CONFIG_BLK_DEV_OFFBOARD=y
+CONFIG_BLK_DEV_GENERIC=y
+# CONFIG_BLK_DEV_OPTI621 is not set
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+# CONFIG_IDEDMA_PCI_AUTO is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+CONFIG_BLK_DEV_HPT366=y
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
 # CONFIG_IDE_ARM is not set
-# CONFIG_BLK_DEV_IDEDMA is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
 # CONFIG_IDEDMA_AUTO is not set
 # CONFIG_BLK_DEV_HD is not set
 
@@ -414,6 +456,7 @@ CONFIG_IDE_GENERIC=y
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+CONFIG_SCSI_NETLINK=y
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -434,22 +477,54 @@ CONFIG_SCSI_CONSTANTS=y
 # CONFIG_SCSI_LOGGING is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 # CONFIG_SCSI_SPI_ATTRS is not set
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
 # SCSI low-level drivers
 #
 CONFIG_ISCSI_TCP=m
-# CONFIG_SGIWD93_SCSI is not set
-# CONFIG_SCSI_SATA is not set
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_ACARD is not set
+# CONFIG_SCSI_AACRAID is not set
+# CONFIG_SCSI_AIC7XXX is not set
+# CONFIG_SCSI_AIC7XXX_OLD is not set
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_SCSI_ARCMSR is not set
+# CONFIG_MEGARAID_NEWGEN is not set
+# CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
+# CONFIG_SCSI_HPTIOP is not set
+# CONFIG_SCSI_DMX3191D is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_SCSI_INITIO is not set
+# CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
+# CONFIG_SCSI_SYM53C8XX_2 is not set
+# CONFIG_SCSI_QLOGIC_1280 is not set
+# CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
+# CONFIG_SCSI_LPFC is not set
+# CONFIG_SCSI_DC395x is not set
+# CONFIG_SCSI_DC390T is not set
+# CONFIG_SCSI_NSP32 is not set
 # CONFIG_SCSI_DEBUG is not set
 
 #
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+# CONFIG_ATA is not set
+
+#
 # Multi-device support (RAID and LVM)
 #
 # CONFIG_MD is not set
@@ -458,14 +533,19 @@ CONFIG_ISCSI_TCP=m
 # Fusion MPT device support
 #
 # CONFIG_FUSION is not set
+# CONFIG_FUSION_SPI is not set
+# CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
 
 #
 # IEEE 1394 (FireWire) support
 #
+# CONFIG_IEEE1394 is not set
 
 #
 # I2O device support
 #
+# CONFIG_I2O is not set
 
 #
 # Network device support
@@ -477,6 +557,11 @@ CONFIG_NETDEVICES=y
 # CONFIG_TUN is not set
 
 #
+# ARCnet devices
+#
+# CONFIG_ARCNET is not set
+
+#
 # PHY device support
 #
 # CONFIG_PHYLIB is not set
@@ -486,20 +571,73 @@ CONFIG_NETDEVICES=y
 #
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
+# CONFIG_HAPPYMEAL is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
+# CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_DM9000 is not set
-# CONFIG_SGISEEQ is not set
+
+#
+# Tulip family network device support
+#
+# CONFIG_NET_TULIP is not set
+# CONFIG_HP100 is not set
+CONFIG_NET_PCI=y
+# CONFIG_PCNET32 is not set
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_ADAPTEC_STARFIRE is not set
+# CONFIG_B44 is not set
+# CONFIG_FORCEDETH is not set
+# CONFIG_DGRS is not set
+# CONFIG_EEPRO100 is not set
+# CONFIG_E100 is not set
+# CONFIG_FEALNX is not set
+# CONFIG_NATSEMI is not set
+# CONFIG_NE2K_PCI is not set
+# CONFIG_8139CP is not set
+CONFIG_8139TOO=y
+# CONFIG_8139TOO_PIO is not set
+CONFIG_8139TOO_TUNE_TWISTER=y
+CONFIG_8139TOO_8129=y
+# CONFIG_8139_OLD_RX_RESET is not set
+# CONFIG_SIS900 is not set
+# CONFIG_EPIC100 is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_TLAN is not set
+# CONFIG_VIA_RHINE is not set
+# CONFIG_LAN_SAA9730 is not set
 
 #
 # Ethernet (1000 Mbit)
 #
+# CONFIG_ACENIC is not set
+# CONFIG_DL2K is not set
+# CONFIG_E1000 is not set
+# CONFIG_NS83820 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_R8169 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+# CONFIG_SK98LIN is not set
+# CONFIG_VIA_VELOCITY is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
 #
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_IXGB is not set
+# CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
 #
+# CONFIG_TR is not set
 
 #
 # Wireless LAN (non-hamradio)
@@ -510,8 +648,11 @@ CONFIG_MII=y
 # Wan interfaces
 #
 # CONFIG_WAN is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
+# CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -531,6 +672,7 @@ CONFIG_MII=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -556,6 +698,7 @@ CONFIG_INPUT=y
 CONFIG_SERIO=y
 # CONFIG_SERIO_I8042 is not set
 # CONFIG_SERIO_SERPORT is not set
+# CONFIG_SERIO_PCIPS2 is not set
 CONFIG_SERIO_LIBPS2=y
 # CONFIG_SERIO_RAW is not set
 # CONFIG_GAMEPORT is not set
@@ -566,7 +709,7 @@ CONFIG_SERIO_LIBPS2=y
 CONFIG_VT=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
-CONFIG_VT_HW_CONSOLE_BINDING=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
@@ -577,7 +720,8 @@ CONFIG_VT_HW_CONSOLE_BINDING=y
 #
 # Non-8250 serial port support
 #
-# CONFIG_SERIAL_IP22_ZILOG is not set
+# CONFIG_SERIAL_IP3106 is not set
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -591,16 +735,17 @@ CONFIG_LEGACY_PTY_COUNT=256
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
-# CONFIG_HW_RANDOM is not set
+CONFIG_HW_RANDOM=y
 # CONFIG_RTC is not set
-# CONFIG_SGI_DS1286 is not set
 # CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
 
 #
 # Ftape, the floppy tape device driver
 #
+# CONFIG_DRM is not set
 # CONFIG_RAW_DRIVER is not set
 
 #
@@ -631,35 +776,37 @@ CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
 # CONFIG_SENSORS_ABITUGURU is not set
 # CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_VT1211 is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
 #
-# CONFIG_FIRMWARE_EDID is not set
+CONFIG_FIRMWARE_EDID=y
 # CONFIG_FB is not set
 
 #
 # Console display driver support
 #
 # CONFIG_VGA_CONSOLE is not set
-# CONFIG_SGI_NEWPORT_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
+# CONFIG_BACKLIGHT_LCD_SUPPORT is not set
 
 #
 # Sound
@@ -669,15 +816,131 @@ CONFIG_DUMMY_CONSOLE=y
 #
 # USB support
 #
-# CONFIG_USB_ARCH_HAS_HCD is not set
-# CONFIG_USB_ARCH_HAS_OHCI is not set
-# CONFIG_USB_ARCH_HAS_EHCI is not set
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB=y
+# CONFIG_USB_DEBUG is not set
+
+#
+# Miscellaneous USB options
+#
+# CONFIG_USB_DEVICEFS is not set
+# CONFIG_USB_BANDWIDTH is not set
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_OTG is not set
+
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_ISP116X_HCD is not set
+CONFIG_USB_OHCI_HCD=y
+# CONFIG_USB_OHCI_BIG_ENDIAN is not set
+CONFIG_USB_OHCI_LITTLE_ENDIAN=y
+# CONFIG_USB_UHCI_HCD is not set
+# CONFIG_USB_SL811_HCD is not set
+
+#
+# USB Device Class drivers
+#
+# CONFIG_USB_ACM is not set
+# CONFIG_USB_PRINTER is not set
 
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
 
 #
+# may also be needed; see USB_STORAGE Help for more information
+#
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+CONFIG_USB_STORAGE_DATAFAB=y
+CONFIG_USB_STORAGE_FREECOM=y
+CONFIG_USB_STORAGE_ISD200=y
+CONFIG_USB_STORAGE_DPCM=y
+CONFIG_USB_STORAGE_USBAT=y
+CONFIG_USB_STORAGE_SDDR09=y
+CONFIG_USB_STORAGE_SDDR55=y
+CONFIG_USB_STORAGE_JUMPSHOT=y
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_LIBUSUAL is not set
+
+#
+# USB Input Devices
+#
+# CONFIG_USB_HID is not set
+
+#
+# USB HID Boot Protocol drivers
+#
+# CONFIG_USB_KBD is not set
+# CONFIG_USB_MOUSE is not set
+# CONFIG_USB_AIPTEK is not set
+# CONFIG_USB_WACOM is not set
+# CONFIG_USB_ACECAD is not set
+# CONFIG_USB_KBTAB is not set
+# CONFIG_USB_POWERMATE is not set
+# CONFIG_USB_TOUCHSCREEN is not set
+# CONFIG_USB_YEALINK is not set
+# CONFIG_USB_XPAD is not set
+# CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
+# CONFIG_USB_KEYSPAN_REMOTE is not set
+# CONFIG_USB_APPLETOUCH is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+
+#
+# USB Network Adapters
+#
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_USBNET is not set
+CONFIG_USB_MON=y
+
+#
+# USB port drivers
+#
+
+#
+# USB Serial Converter support
+#
+# CONFIG_USB_SERIAL is not set
+
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_AUERSWALD is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_PHIDGET is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_LD is not set
+
+#
+# USB DSL modem support
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
@@ -703,6 +966,7 @@ CONFIG_DUMMY_CONSOLE=y
 #
 # InfiniBand support
 #
+# CONFIG_INFINIBAND is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
@@ -733,10 +997,12 @@ CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XATTR is not set
 # CONFIG_EXT2_FS_XIP is not set
 # CONFIG_EXT3_FS is not set
+# CONFIG_EXT4DEV_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -769,8 +1035,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 # CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_CONFIGFS_FS is not set
@@ -813,7 +1081,6 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -824,7 +1091,6 @@ CONFIG_SUNRPC=y
 #
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
-CONFIG_SGI_PARTITION=y
 
 #
 # Native Language Support
@@ -880,6 +1146,7 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
@@ -893,13 +1160,17 @@ CONFIG_DEBUG_SLAB=y
 # CONFIG_DEBUG_SPINLOCK is not set
 CONFIG_DEBUG_MUTEXES=y
 # CONFIG_DEBUG_RWSEMS is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_LIST is not set
 CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 CONFIG_CROSSCOMPILE=y
 CONFIG_CMDLINE="console=ttyS1,38400n8 kgdb=ttyS0 root=/dev/nfs ip=bootp"
@@ -918,6 +1189,9 @@ CONFIG_CMDLINE="console=ttyS1,38400n8 kgdb=ttyS0 root=/dev/nfs ip=bootp"
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=m
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_MANAGER=m
 # CONFIG_CRYPTO_HMAC is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_MD4 is not set
@@ -927,6 +1201,8 @@ CONFIG_CRYPTO_MD5=m
 # CONFIG_CRYPTO_SHA512 is not set
 # CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=m
 # CONFIG_CRYPTO_DES is not set
 # CONFIG_CRYPTO_BLOWFISH is not set
 # CONFIG_CRYPTO_TWOFISH is not set
diff --git a/arch/mips/configs/pnx8550-v2pci_defconfig b/arch/mips/configs/pnx8550-v2pci_defconfig
index e93266b37dd9..64b9fbf44a64 100644
--- a/arch/mips/configs/pnx8550-v2pci_defconfig
+++ b/arch/mips/configs/pnx8550-v2pci_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Thu Jul  6 10:04:18 2006
+# Linux kernel version: 2.6.19-rc2
+# Sat Oct 14 23:12:15 2006
 #
 CONFIG_MIPS=y
 
@@ -25,8 +25,6 @@ CONFIG_MIPS=y
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MIPS_EV64120 is not set
-# CONFIG_MIPS_IVR is not set
-# CONFIG_MIPS_ITE8172 is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
 # CONFIG_MIPS_ATLAS is not set
@@ -40,14 +38,14 @@ CONFIG_MIPS=y
 # CONFIG_MOMENCO_OCELOT_C is not set
 # CONFIG_MOMENCO_OCELOT_G is not set
 # CONFIG_MIPS_XXS1500 is not set
-# CONFIG_PNX8550_V2PCI is not set
+CONFIG_PNX8550_V2PCI=y
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_DDB5477 is not set
 # CONFIG_MACH_VR41XX is not set
 # CONFIG_PMC_YOSEMITE is not set
 # CONFIG_QEMU is not set
 # CONFIG_MARKEINS is not set
-CONFIG_SGI_IP22=y
+# CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP32 is not set
 # CONFIG_SIBYTE_BIGSUR is not set
@@ -67,25 +65,21 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_TIME=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
-CONFIG_ARC=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
-CONFIG_CPU_BIG_ENDIAN=y
-# CONFIG_CPU_LITTLE_ENDIAN is not set
-CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
-CONFIG_IRQ_CPU=y
-CONFIG_SWAP_IO_SPACE=y
-CONFIG_ARC32=y
-CONFIG_BOOT_ELF32=y
+# CONFIG_CPU_BIG_ENDIAN is not set
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_PNX8550=y
+CONFIG_SOC_PNX8550=y
 CONFIG_MIPS_L1_CACHE_SHIFT=5
-# CONFIG_ARC_CONSOLE is not set
-CONFIG_ARC_PROMLIB=y
 
 #
 # CPU selection
 #
-# CONFIG_CPU_MIPS32_R1 is not set
+CONFIG_CPU_MIPS32_R1=y
 # CONFIG_CPU_MIPS32_R2 is not set
 # CONFIG_CPU_MIPS64_R1 is not set
 # CONFIG_CPU_MIPS64_R2 is not set
@@ -93,7 +87,7 @@ CONFIG_ARC_PROMLIB=y
 # CONFIG_CPU_TX39XX is not set
 # CONFIG_CPU_VR41XX is not set
 # CONFIG_CPU_R4300 is not set
-CONFIG_CPU_R4X00=y
+# CONFIG_CPU_R4X00 is not set
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
@@ -104,12 +98,11 @@ CONFIG_CPU_R4X00=y
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
-CONFIG_SYS_HAS_CPU_R4X00=y
-CONFIG_SYS_HAS_CPU_R5000=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPSR1=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
-CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
-CONFIG_CPU_SUPPORTS_64BIT_KERNEL=y
 
 #
 # Kernel type
@@ -120,17 +113,17 @@ CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_8KB is not set
 # CONFIG_PAGE_SIZE_16KB is not set
 # CONFIG_PAGE_SIZE_64KB is not set
-CONFIG_BOARD_SCACHE=y
-CONFIG_IP22_CPU_SCACHE=y
+CONFIG_CPU_HAS_PREFETCH=y
 CONFIG_MIPS_MT_DISABLED=y
-# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_VPE_LOADER is not set
 # CONFIG_64BIT_PHYS_ADDR is not set
 CONFIG_CPU_HAS_LLSC=y
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
@@ -144,12 +137,12 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_HZ_48 is not set
 # CONFIG_HZ_100 is not set
 # CONFIG_HZ_128 is not set
-# CONFIG_HZ_250 is not set
+CONFIG_HZ_250=y
 # CONFIG_HZ_256 is not set
-CONFIG_HZ_1000=y
+# CONFIG_HZ_1000 is not set
 # CONFIG_HZ_1024 is not set
 CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
-CONFIG_HZ=1000
+CONFIG_HZ=250
 CONFIG_PREEMPT_NONE=y
 # CONFIG_PREEMPT_VOLUNTARY is not set
 # CONFIG_PREEMPT is not set
@@ -171,16 +164,20 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
@@ -188,12 +185,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -210,6 +207,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
@@ -230,8 +228,9 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 # Bus options (PCI, PCMCIA, EISA, ISA, TC)
 #
-CONFIG_HW_HAS_EISA=y
-# CONFIG_EISA is not set
+CONFIG_HW_HAS_PCI=y
+CONFIG_PCI=y
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 CONFIG_MMU=y
 
 #
@@ -242,6 +241,7 @@ CONFIG_MMU=y
 #
 # PCI Hotplug Support
 #
+# CONFIG_HOTPLUG_PCI is not set
 
 #
 # Executable file formats
@@ -264,6 +264,7 @@ CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
@@ -282,12 +283,14 @@ CONFIG_IP_PNP=y
 # CONFIG_INET_IPCOMP is not set
 # CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
-CONFIG_INET_XFRM_MODE_TRANSPORT=m
-CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
-CONFIG_TCP_CONG_BIC=y
+CONFIG_TCP_CONG_CUBIC=y
+CONFIG_DEFAULT_TCP_CONG="cubic"
 
 #
 # IP: Virtual Server Configuration
@@ -300,12 +303,18 @@ CONFIG_IPV6_ROUTE_INFO=y
 # CONFIG_INET6_AH is not set
 # CONFIG_INET6_ESP is not set
 # CONFIG_INET6_IPCOMP is not set
+# CONFIG_IPV6_MIP6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
 CONFIG_INET6_XFRM_MODE_TRANSPORT=m
 CONFIG_INET6_XFRM_MODE_TUNNEL=m
+CONFIG_INET6_XFRM_MODE_BEET=m
+# CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=m
 # CONFIG_IPV6_TUNNEL is not set
-CONFIG_NETWORK_SECMARK=y
+# CONFIG_IPV6_SUBTREES is not set
+# CONFIG_IPV6_MULTIPLE_TABLES is not set
+# CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
 
@@ -318,9 +327,9 @@ CONFIG_NETFILTER_XTABLES=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
 CONFIG_NETFILTER_XT_TARGET_MARK=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
-CONFIG_NETFILTER_XT_TARGET_SECMARK=m
 CONFIG_NETFILTER_XT_MATCH_COMMENT=m
 CONFIG_NETFILTER_XT_MATCH_DCCP=m
+# CONFIG_NETFILTER_XT_MATCH_DSCP is not set
 CONFIG_NETFILTER_XT_MATCH_ESP=m
 CONFIG_NETFILTER_XT_MATCH_LENGTH=m
 CONFIG_NETFILTER_XT_MATCH_LIMIT=m
@@ -329,10 +338,10 @@ CONFIG_NETFILTER_XT_MATCH_MARK=m
 # CONFIG_NETFILTER_XT_MATCH_POLICY is not set
 CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
 CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
-CONFIG_NETFILTER_XT_MATCH_QUOTA=m
+# CONFIG_NETFILTER_XT_MATCH_QUOTA is not set
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_SCTP=m
-CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
+# CONFIG_NETFILTER_XT_MATCH_STATISTIC is not set
 CONFIG_NETFILTER_XT_MATCH_STRING=m
 CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 
@@ -373,7 +382,6 @@ CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -426,13 +434,20 @@ CONFIG_FW_LOADER=y
 #
 # Block devices
 #
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=y
 # CONFIG_BLK_DEV_CRYPTOLOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
+# CONFIG_BLK_DEV_SX8 is not set
+# CONFIG_BLK_DEV_UB is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_BLK_DEV_INITRD=y
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -441,6 +456,7 @@ CONFIG_BLK_DEV_INITRD=y
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
+CONFIG_IDE_MAX_HWIFS=4
 CONFIG_BLK_DEV_IDE=y
 
 #
@@ -459,9 +475,41 @@ CONFIG_IDEDISK_MULTI_MODE=y
 # IDE chipset support/bugfixes
 #
 CONFIG_IDE_GENERIC=y
+CONFIG_BLK_DEV_IDEPCI=y
+CONFIG_IDEPCI_SHARE_IRQ=y
+# CONFIG_BLK_DEV_OFFBOARD is not set
+# CONFIG_BLK_DEV_GENERIC is not set
+# CONFIG_BLK_DEV_OPTI621 is not set
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+CONFIG_IDEDMA_PCI_AUTO=y
+# CONFIG_IDEDMA_ONLYDISK is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+CONFIG_BLK_DEV_CMD64X=y
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
 # CONFIG_IDE_ARM is not set
-# CONFIG_BLK_DEV_IDEDMA is not set
-# CONFIG_IDEDMA_AUTO is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
+CONFIG_IDEDMA_AUTO=y
 # CONFIG_BLK_DEV_HD is not set
 
 #
@@ -469,6 +517,7 @@ CONFIG_IDE_GENERIC=y
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+CONFIG_SCSI_NETLINK=y
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -489,22 +538,59 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOGGING is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 CONFIG_SCSI_SPI_ATTRS=m
 CONFIG_SCSI_FC_ATTRS=y
 CONFIG_SCSI_ISCSI_ATTRS=m
 # CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
 # SCSI low-level drivers
 #
 CONFIG_ISCSI_TCP=m
-# CONFIG_SGIWD93_SCSI is not set
-# CONFIG_SCSI_SATA is not set
+# CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_ACARD is not set
+# CONFIG_SCSI_AACRAID is not set
+CONFIG_SCSI_AIC7XXX=m
+CONFIG_AIC7XXX_CMDS_PER_DEVICE=32
+CONFIG_AIC7XXX_RESET_DELAY_MS=15000
+# CONFIG_AIC7XXX_DEBUG_ENABLE is not set
+CONFIG_AIC7XXX_DEBUG_MASK=0
+# CONFIG_AIC7XXX_REG_PRETTY_PRINT is not set
+# CONFIG_SCSI_AIC7XXX_OLD is not set
+# CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_SCSI_ARCMSR is not set
+# CONFIG_MEGARAID_NEWGEN is not set
+# CONFIG_MEGARAID_LEGACY is not set
+# CONFIG_MEGARAID_SAS is not set
+# CONFIG_SCSI_HPTIOP is not set
+# CONFIG_SCSI_DMX3191D is not set
+# CONFIG_SCSI_FUTURE_DOMAIN is not set
+# CONFIG_SCSI_IPS is not set
+# CONFIG_SCSI_INITIO is not set
+# CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
+# CONFIG_SCSI_SYM53C8XX_2 is not set
+# CONFIG_SCSI_QLOGIC_1280 is not set
+# CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
+# CONFIG_SCSI_LPFC is not set
+# CONFIG_SCSI_DC395x is not set
+# CONFIG_SCSI_DC390T is not set
+# CONFIG_SCSI_NSP32 is not set
 # CONFIG_SCSI_DEBUG is not set
 
 #
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+# CONFIG_ATA is not set
+
+#
 # Multi-device support (RAID and LVM)
 #
 # CONFIG_MD is not set
@@ -513,14 +599,19 @@ CONFIG_ISCSI_TCP=m
 # Fusion MPT device support
 #
 # CONFIG_FUSION is not set
+# CONFIG_FUSION_SPI is not set
+# CONFIG_FUSION_FC is not set
+# CONFIG_FUSION_SAS is not set
 
 #
 # IEEE 1394 (FireWire) support
 #
+# CONFIG_IEEE1394 is not set
 
 #
 # I2O device support
 #
+# CONFIG_I2O is not set
 
 #
 # Network device support
@@ -532,6 +623,11 @@ CONFIG_NETDEVICES=y
 CONFIG_TUN=m
 
 #
+# ARCnet devices
+#
+# CONFIG_ARCNET is not set
+
+#
 # PHY device support
 #
 # CONFIG_PHYLIB is not set
@@ -541,20 +637,73 @@ CONFIG_TUN=m
 #
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
+# CONFIG_HAPPYMEAL is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_CASSINI is not set
+# CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_DM9000 is not set
-# CONFIG_SGISEEQ is not set
+
+#
+# Tulip family network device support
+#
+# CONFIG_NET_TULIP is not set
+# CONFIG_HP100 is not set
+CONFIG_NET_PCI=y
+# CONFIG_PCNET32 is not set
+# CONFIG_AMD8111_ETH is not set
+# CONFIG_ADAPTEC_STARFIRE is not set
+# CONFIG_B44 is not set
+# CONFIG_FORCEDETH is not set
+# CONFIG_DGRS is not set
+# CONFIG_EEPRO100 is not set
+# CONFIG_E100 is not set
+# CONFIG_FEALNX is not set
+CONFIG_NATSEMI=y
+# CONFIG_NE2K_PCI is not set
+# CONFIG_8139CP is not set
+CONFIG_8139TOO=y
+# CONFIG_8139TOO_PIO is not set
+# CONFIG_8139TOO_TUNE_TWISTER is not set
+# CONFIG_8139TOO_8129 is not set
+# CONFIG_8139_OLD_RX_RESET is not set
+# CONFIG_SIS900 is not set
+# CONFIG_EPIC100 is not set
+# CONFIG_SUNDANCE is not set
+# CONFIG_TLAN is not set
+# CONFIG_VIA_RHINE is not set
+# CONFIG_LAN_SAA9730 is not set
 
 #
 # Ethernet (1000 Mbit)
 #
+# CONFIG_ACENIC is not set
+# CONFIG_DL2K is not set
+# CONFIG_E1000 is not set
+# CONFIG_NS83820 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_R8169 is not set
+# CONFIG_SIS190 is not set
+# CONFIG_SKGE is not set
+# CONFIG_SKY2 is not set
+# CONFIG_SK98LIN is not set
+# CONFIG_VIA_VELOCITY is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
 #
+# CONFIG_CHELSIO_T1 is not set
+# CONFIG_IXGB is not set
+# CONFIG_S2IO is not set
+# CONFIG_MYRI10GE is not set
 
 #
 # Token Ring devices
 #
+# CONFIG_TR is not set
 
 #
 # Wireless LAN (non-hamradio)
@@ -565,6 +714,8 @@ CONFIG_MII=y
 # Wan interfaces
 #
 # CONFIG_WAN is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
 CONFIG_PPP=m
 # CONFIG_PPP_MULTILINK is not set
 # CONFIG_PPP_FILTER is not set
@@ -575,6 +726,8 @@ CONFIG_PPP_DEFLATE=m
 CONFIG_PPP_MPPE=m
 # CONFIG_PPPOE is not set
 # CONFIG_SLIP is not set
+CONFIG_SLHC=m
+# CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
@@ -594,6 +747,7 @@ CONFIG_PPP_MPPE=m
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -616,6 +770,7 @@ CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_KEYBOARD_LKKBD is not set
 # CONFIG_KEYBOARD_XTKBD is not set
 # CONFIG_KEYBOARD_NEWTON is not set
+# CONFIG_KEYBOARD_STOWAWAY is not set
 CONFIG_INPUT_MOUSE=y
 CONFIG_MOUSE_PS2=y
 # CONFIG_MOUSE_SERIAL is not set
@@ -630,6 +785,7 @@ CONFIG_MOUSE_PS2=y
 CONFIG_SERIO=y
 CONFIG_SERIO_I8042=y
 CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_PCIPS2 is not set
 CONFIG_SERIO_LIBPS2=y
 # CONFIG_SERIO_RAW is not set
 # CONFIG_GAMEPORT is not set
@@ -640,7 +796,7 @@ CONFIG_SERIO_LIBPS2=y
 CONFIG_VT=y
 # CONFIG_VT_CONSOLE is not set
 CONFIG_HW_CONSOLE=y
-CONFIG_VT_HW_CONSOLE_BINDING=y
+# CONFIG_VT_HW_CONSOLE_BINDING is not set
 CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_COMPUTONE is not set
 # CONFIG_ROCKETPORT is not set
@@ -650,6 +806,7 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_MOXA_SMARTIO is not set
 # CONFIG_ISI is not set
 # CONFIG_SYNCLINKMP is not set
+# CONFIG_SYNCLINK_GT is not set
 # CONFIG_N_HDLC is not set
 # CONFIG_RISCOM8 is not set
 # CONFIG_SPECIALIX is not set
@@ -665,7 +822,8 @@ CONFIG_SERIAL_NONSTANDARD=y
 #
 # Non-8250 serial port support
 #
-# CONFIG_SERIAL_IP22_ZILOG is not set
+# CONFIG_SERIAL_IP3106 is not set
+# CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
@@ -679,16 +837,17 @@ CONFIG_LEGACY_PTY_COUNT=256
 # Watchdog Cards
 #
 # CONFIG_WATCHDOG is not set
-# CONFIG_HW_RANDOM is not set
+CONFIG_HW_RANDOM=y
 # CONFIG_RTC is not set
-# CONFIG_SGI_DS1286 is not set
 # CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
 
 #
 # Ftape, the floppy tape device driver
 #
+# CONFIG_DRM is not set
 # CONFIG_RAW_DRIVER is not set
 
 #
@@ -709,14 +868,30 @@ CONFIG_I2C_CHARDEV=m
 CONFIG_I2C_ALGOBIT=m
 # CONFIG_I2C_ALGOPCF is not set
 # CONFIG_I2C_ALGOPCA is not set
-# CONFIG_I2C_ALGO_SGI is not set
 
 #
 # I2C Hardware Bus support
 #
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_I810 is not set
+# CONFIG_I2C_PIIX4 is not set
+# CONFIG_I2C_NFORCE2 is not set
 # CONFIG_I2C_OCORES is not set
 # CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PROSAVAGE is not set
+# CONFIG_I2C_SAVAGE4 is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
 # CONFIG_I2C_STUB is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+# CONFIG_I2C_VOODOO3 is not set
 # CONFIG_I2C_PCA_ISA is not set
 
 #
@@ -776,9 +951,13 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_SIS5595 is not set
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
@@ -790,23 +969,25 @@ CONFIG_HWMON=y
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
 #
-# CONFIG_FIRMWARE_EDID is not set
+CONFIG_FIRMWARE_EDID=y
 CONFIG_FB=y
+# CONFIG_FB_DDC is not set
 # CONFIG_FB_CFB_FILLRECT is not set
 # CONFIG_FB_CFB_COPYAREA is not set
 # CONFIG_FB_CFB_IMAGEBLIT is not set
@@ -814,14 +995,32 @@ CONFIG_FB=y
 # CONFIG_FB_BACKLIGHT is not set
 # CONFIG_FB_MODE_HELPERS is not set
 # CONFIG_FB_TILEBLITTING is not set
+# CONFIG_FB_CIRRUS is not set
+# CONFIG_FB_PM2 is not set
+# CONFIG_FB_CYBER2000 is not set
+# CONFIG_FB_ASILIANT is not set
+# CONFIG_FB_IMSTT is not set
 # CONFIG_FB_S1D13XXX is not set
+# CONFIG_FB_NVIDIA is not set
+# CONFIG_FB_RIVA is not set
+# CONFIG_FB_MATROX is not set
+# CONFIG_FB_RADEON is not set
+# CONFIG_FB_ATY128 is not set
+# CONFIG_FB_ATY is not set
+# CONFIG_FB_SAVAGE is not set
+# CONFIG_FB_SIS is not set
+# CONFIG_FB_NEOMAGIC is not set
+# CONFIG_FB_KYRO is not set
+# CONFIG_FB_3DFX is not set
+# CONFIG_FB_VOODOO1 is not set
+# CONFIG_FB_SMIVGX is not set
+# CONFIG_FB_TRIDENT is not set
 # CONFIG_FB_VIRTUAL is not set
 
 #
 # Console display driver support
 #
 # CONFIG_VGA_CONSOLE is not set
-# CONFIG_SGI_NEWPORT_CONSOLE is not set
 CONFIG_DUMMY_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE is not set
 
@@ -839,15 +1038,129 @@ CONFIG_DUMMY_CONSOLE=y
 #
 # USB support
 #
-# CONFIG_USB_ARCH_HAS_HCD is not set
-# CONFIG_USB_ARCH_HAS_OHCI is not set
-# CONFIG_USB_ARCH_HAS_EHCI is not set
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+CONFIG_USB_ARCH_HAS_EHCI=y
+CONFIG_USB=y
+# CONFIG_USB_DEBUG is not set
+
+#
+# Miscellaneous USB options
+#
+CONFIG_USB_DEVICEFS=y
+# CONFIG_USB_BANDWIDTH is not set
+# CONFIG_USB_DYNAMIC_MINORS is not set
+# CONFIG_USB_OTG is not set
+
+#
+# USB Host Controller Drivers
+#
+# CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_ISP116X_HCD is not set
+# CONFIG_USB_OHCI_HCD is not set
+# CONFIG_USB_UHCI_HCD is not set
+# CONFIG_USB_SL811_HCD is not set
+
+#
+# USB Device Class drivers
+#
+# CONFIG_USB_ACM is not set
+# CONFIG_USB_PRINTER is not set
 
 #
 # NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
 #
 
 #
+# may also be needed; see USB_STORAGE Help for more information
+#
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_DPCM is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_LIBUSUAL is not set
+
+#
+# USB Input Devices
+#
+CONFIG_USB_HID=y
+CONFIG_USB_HIDINPUT=y
+# CONFIG_USB_HIDINPUT_POWERBOOK is not set
+# CONFIG_HID_FF is not set
+CONFIG_USB_HIDDEV=y
+# CONFIG_USB_AIPTEK is not set
+# CONFIG_USB_WACOM is not set
+# CONFIG_USB_ACECAD is not set
+# CONFIG_USB_KBTAB is not set
+# CONFIG_USB_POWERMATE is not set
+# CONFIG_USB_TOUCHSCREEN is not set
+# CONFIG_USB_YEALINK is not set
+# CONFIG_USB_XPAD is not set
+# CONFIG_USB_ATI_REMOTE is not set
+# CONFIG_USB_ATI_REMOTE2 is not set
+# CONFIG_USB_KEYSPAN_REMOTE is not set
+# CONFIG_USB_APPLETOUCH is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
+
+#
+# USB Imaging devices
+#
+# CONFIG_USB_MDC800 is not set
+# CONFIG_USB_MICROTEK is not set
+
+#
+# USB Network Adapters
+#
+# CONFIG_USB_CATC is not set
+# CONFIG_USB_KAWETH is not set
+# CONFIG_USB_PEGASUS is not set
+# CONFIG_USB_RTL8150 is not set
+# CONFIG_USB_USBNET is not set
+CONFIG_USB_MON=y
+
+#
+# USB port drivers
+#
+
+#
+# USB Serial Converter support
+#
+# CONFIG_USB_SERIAL is not set
+
+#
+# USB Miscellaneous drivers
+#
+# CONFIG_USB_EMI62 is not set
+# CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_AUERSWALD is not set
+# CONFIG_USB_RIO500 is not set
+# CONFIG_USB_LEGOTOWER is not set
+# CONFIG_USB_LCD is not set
+# CONFIG_USB_LED is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
+# CONFIG_USB_CYTHERM is not set
+# CONFIG_USB_PHIDGET is not set
+# CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
+# CONFIG_USB_APPLEDISPLAY is not set
+# CONFIG_USB_LD is not set
+# CONFIG_USB_TEST is not set
+
+#
+# USB DSL modem support
+#
+
+#
 # USB Gadget Support
 #
 # CONFIG_USB_GADGET is not set
@@ -873,6 +1186,7 @@ CONFIG_DUMMY_CONSOLE=y
 #
 # InfiniBand support
 #
+# CONFIG_INFINIBAND is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
@@ -906,6 +1220,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -917,6 +1232,7 @@ CONFIG_XFS_FS=m
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -949,8 +1265,10 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 #
 CONFIG_PROC_FS=y
 # CONFIG_PROC_KCORE is not set
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_CONFIGFS_FS is not set
@@ -994,7 +1312,6 @@ CONFIG_SUNRPC=y
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -1005,7 +1322,6 @@ CONFIG_SMB_FS=m
 #
 # CONFIG_PARTITION_ADVANCED is not set
 CONFIG_MSDOS_PARTITION=y
-CONFIG_SGI_PARTITION=y
 
 #
 # Native Language Support
@@ -1061,11 +1377,13 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 # CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_CROSSCOMPILE=y
 CONFIG_CMDLINE=""
 
@@ -1079,6 +1397,9 @@ CONFIG_CMDLINE=""
 # Cryptographic options
 #
 CONFIG_CRYPTO=y
+CONFIG_CRYPTO_ALGAPI=m
+CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_MANAGER=m
 # CONFIG_CRYPTO_HMAC is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_MD4 is not set
@@ -1088,6 +1409,8 @@ CONFIG_CRYPTO_SHA1=m
 # CONFIG_CRYPTO_SHA512 is not set
 # CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
+CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_CBC=m
 # CONFIG_CRYPTO_DES is not set
 # CONFIG_CRYPTO_BLOWFISH is not set
 # CONFIG_CRYPTO_TWOFISH is not set
diff --git a/arch/mips/configs/tb0287_defconfig b/arch/mips/configs/tb0287_defconfig
index ad7271b3f266..f7e8194809a1 100644
--- a/arch/mips/configs/tb0287_defconfig
+++ b/arch/mips/configs/tb0287_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18-rc1
-# Thu Jul  6 10:04:21 2006
+# Linux kernel version: 2.6.19-rc2
+# Wed Oct 18 12:57:11 2006
 #
 CONFIG_MIPS=y
 
@@ -25,8 +25,6 @@ CONFIG_MIPS=y
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MIPS_EV64120 is not set
-# CONFIG_MIPS_IVR is not set
-# CONFIG_MIPS_ITE8172 is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
 # CONFIG_MIPS_ATLAS is not set
@@ -72,11 +70,11 @@ CONFIG_TANBAC_TB0287=y
 # CONFIG_VICTOR_MPC30X is not set
 # CONFIG_ZAO_CAPCELLA is not set
 CONFIG_PCI_VR41XX=y
-# CONFIG_VRC4173 is not set
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_TIME=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
@@ -123,8 +121,8 @@ CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_16KB is not set
 # CONFIG_PAGE_SIZE_64KB is not set
 CONFIG_MIPS_MT_DISABLED=y
-# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_MT_SMP is not set
+# CONFIG_MIPS_MT_SMTC is not set
 # CONFIG_MIPS_VPE_LOADER is not set
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_GENERIC_HARDIRQS=y
@@ -169,15 +167,19 @@ CONFIG_LOCALVERSION=""
 CONFIG_LOCALVERSION_AUTO=y
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
+# CONFIG_IPC_NS is not set
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
-CONFIG_SYSCTL=y
+# CONFIG_TASKSTATS is not set
+# CONFIG_UTS_NS is not set
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 # CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
+# CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 # CONFIG_HOTPLUG is not set
@@ -185,12 +187,12 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 CONFIG_BASE_FULL=y
-CONFIG_RT_MUTEXES=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
 CONFIG_SLAB=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_RT_MUTEXES=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_SLOB is not set
@@ -208,6 +210,7 @@ CONFIG_KMOD=y
 #
 # Block layer
 #
+CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
@@ -230,17 +233,16 @@ CONFIG_DEFAULT_IOSCHED="anticipatory"
 #
 CONFIG_HW_HAS_PCI=y
 CONFIG_PCI=y
+# CONFIG_PCI_MULTITHREAD_PROBE is not set
 CONFIG_MMU=y
 
 #
 # PCCARD (PCMCIA/CardBus) support
 #
-# CONFIG_PCCARD is not set
 
 #
 # PCI Hotplug Support
 #
-# CONFIG_HOTPLUG_PCI is not set
 
 #
 # Executable file formats
@@ -263,6 +265,7 @@ CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
+# CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
@@ -291,13 +294,10 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_TUNNEL=m
 CONFIG_INET_XFRM_MODE_TRANSPORT=m
 CONFIG_INET_XFRM_MODE_TUNNEL=m
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 CONFIG_TCP_CONG_ADVANCED=y
-
-#
-# TCP congestion control
-#
 CONFIG_TCP_CONG_BIC=y
 CONFIG_TCP_CONG_CUBIC=m
 CONFIG_TCP_CONG_WESTWOOD=m
@@ -308,7 +308,13 @@ CONFIG_TCP_CONG_HTCP=m
 # CONFIG_TCP_CONG_SCALABLE is not set
 # CONFIG_TCP_CONG_LP is not set
 # CONFIG_TCP_CONG_VENO is not set
-# CONFIG_TCP_CONG_COMPOUND is not set
+CONFIG_DEFAULT_BIC=y
+# CONFIG_DEFAULT_CUBIC is not set
+# CONFIG_DEFAULT_HTCP is not set
+# CONFIG_DEFAULT_VEGAS is not set
+# CONFIG_DEFAULT_WESTWOOD is not set
+# CONFIG_DEFAULT_RENO is not set
+CONFIG_DEFAULT_TCP_CONG="bic"
 # CONFIG_IPV6 is not set
 # CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
@@ -338,7 +344,6 @@ CONFIG_NETWORK_SECMARK=y
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
-# CONFIG_NET_DIVERT is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 
@@ -355,6 +360,7 @@ CONFIG_NETWORK_SECMARK=y
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_IEEE80211 is not set
+CONFIG_FIB_RULES=y
 
 #
 # Device Drivers
@@ -365,7 +371,6 @@ CONFIG_NETWORK_SECMARK=y
 #
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
-# CONFIG_FW_LOADER is not set
 # CONFIG_SYS_HYPERVISOR is not set
 
 #
@@ -403,6 +408,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 # CONFIG_BLK_DEV_INITRD is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
@@ -410,65 +416,14 @@ CONFIG_BLK_DEV_RAM_SIZE=4096
 #
 # ATA/ATAPI/MFM/RLL support
 #
-CONFIG_IDE=y
-CONFIG_BLK_DEV_IDE=y
-
-#
-# Please see Documentation/ide.txt for help/info on IDE drives
-#
-# CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_BLK_DEV_IDEDISK=y
-# CONFIG_IDEDISK_MULTI_MODE is not set
-# CONFIG_BLK_DEV_IDECD is not set
-# CONFIG_BLK_DEV_IDETAPE is not set
-# CONFIG_BLK_DEV_IDEFLOPPY is not set
-# CONFIG_BLK_DEV_IDESCSI is not set
-# CONFIG_IDE_TASK_IOCTL is not set
-
-#
-# IDE chipset support/bugfixes
-#
-CONFIG_IDE_GENERIC=y
-CONFIG_BLK_DEV_IDEPCI=y
-# CONFIG_IDEPCI_SHARE_IRQ is not set
-# CONFIG_BLK_DEV_OFFBOARD is not set
-# CONFIG_BLK_DEV_GENERIC is not set
-# CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_IDEDMA_PCI=y
-# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
-# CONFIG_IDEDMA_PCI_AUTO is not set
-# CONFIG_BLK_DEV_AEC62XX is not set
-# CONFIG_BLK_DEV_ALI15X3 is not set
-# CONFIG_BLK_DEV_AMD74XX is not set
-# CONFIG_BLK_DEV_CMD64X is not set
-# CONFIG_BLK_DEV_TRIFLEX is not set
-# CONFIG_BLK_DEV_CY82C693 is not set
-# CONFIG_BLK_DEV_CS5520 is not set
-# CONFIG_BLK_DEV_CS5530 is not set
-# CONFIG_BLK_DEV_HPT34X is not set
-# CONFIG_BLK_DEV_HPT366 is not set
-# CONFIG_BLK_DEV_SC1200 is not set
-# CONFIG_BLK_DEV_PIIX is not set
-# CONFIG_BLK_DEV_IT821X is not set
-# CONFIG_BLK_DEV_NS87415 is not set
-# CONFIG_BLK_DEV_PDC202XX_OLD is not set
-# CONFIG_BLK_DEV_PDC202XX_NEW is not set
-# CONFIG_BLK_DEV_SVWKS is not set
-CONFIG_BLK_DEV_SIIMAGE=y
-# CONFIG_BLK_DEV_SLC90E66 is not set
-# CONFIG_BLK_DEV_TRM290 is not set
-# CONFIG_BLK_DEV_VIA82CXXX is not set
-# CONFIG_IDE_ARM is not set
-CONFIG_BLK_DEV_IDEDMA=y
-# CONFIG_IDEDMA_IVB is not set
-# CONFIG_IDEDMA_AUTO is not set
-# CONFIG_BLK_DEV_HD is not set
+# CONFIG_IDE is not set
 
 #
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
+# CONFIG_SCSI_NETLINK is not set
 CONFIG_SCSI_PROC_FS=y
 
 #
@@ -489,12 +444,13 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_LOGGING is not set
 
 #
-# SCSI Transport Attributes
+# SCSI Transports
 #
 # CONFIG_SCSI_SPI_ATTRS is not set
 # CONFIG_SCSI_FC_ATTRS is not set
 # CONFIG_SCSI_ISCSI_ATTRS is not set
 # CONFIG_SCSI_SAS_ATTRS is not set
+# CONFIG_SCSI_SAS_LIBSAS is not set
 
 #
 # SCSI low-level drivers
@@ -507,21 +463,24 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
+# CONFIG_SCSI_AIC94XX is not set
 # CONFIG_SCSI_DPT_I2O is not set
+# CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
-# CONFIG_SCSI_SATA is not set
 # CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
+# CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -529,6 +488,59 @@ CONFIG_BLK_DEV_SD=y
 # CONFIG_SCSI_DEBUG is not set
 
 #
+# Serial ATA (prod) and Parallel ATA (experimental) drivers
+#
+CONFIG_ATA=y
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_SX4 is not set
+# CONFIG_SATA_SIL is not set
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_PDC2027X is not set
+CONFIG_PATA_SIL680=y
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
+
+#
 # Multi-device support (RAID and LVM)
 #
 # CONFIG_MD is not set
@@ -632,6 +644,7 @@ CONFIG_R8169=y
 # CONFIG_SK98LIN is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+# CONFIG_QLA3XXX is not set
 
 #
 # Ethernet (10000 Mbit)
@@ -679,6 +692,7 @@ CONFIG_R8169=y
 # Input device support
 #
 CONFIG_INPUT=y
+# CONFIG_INPUT_FF_MEMLESS is not set
 
 #
 # Userland interfaces
@@ -758,7 +772,6 @@ CONFIG_GPIO_VR41XX=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -784,12 +797,12 @@ CONFIG_GPIO_VR41XX=y
 #
 # Misc devices
 #
+# CONFIG_TIFM_CORE is not set
 
 #
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -897,13 +910,13 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
-# CONFIG_USB_STORAGE_ISD200 is not set
 # CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
 # CONFIG_USB_STORAGE_JUMPSHOT is not set
 # CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_KARMA is not set
 # CONFIG_USB_LIBUSUAL is not set
 
 #
@@ -932,6 +945,7 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -963,16 +977,17 @@ CONFIG_USB_MON=y
 #
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
+# CONFIG_USB_ADUTUX is not set
 # CONFIG_USB_AUERSWALD is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
 # CONFIG_USB_LED is not set
-# CONFIG_USB_CY7C63 is not set
+# CONFIG_USB_CYPRESS_CY7C63 is not set
 # CONFIG_USB_CYTHERM is not set
-# CONFIG_USB_PHIDGETKIT is not set
-# CONFIG_USB_PHIDGETSERVO is not set
+# CONFIG_USB_PHIDGET is not set
 # CONFIG_USB_IDMOUSE is not set
+# CONFIG_USB_FTDI_ELAN is not set
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
@@ -1041,6 +1056,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1052,6 +1068,7 @@ CONFIG_XFS_QUOTA=y
 # CONFIG_XFS_SECURITY is not set
 CONFIG_XFS_POSIX_ACL=y
 # CONFIG_XFS_RT is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 CONFIG_ROMFS_FS=m
@@ -1082,8 +1099,10 @@ CONFIG_AUTOFS4_FS=y
 #
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
+CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
 # CONFIG_CONFIGFS_FS is not set
@@ -1123,7 +1142,6 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
 # CONFIG_CIFS is not set
-# CONFIG_CIFS_DEBUG2 is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -1150,11 +1168,13 @@ CONFIG_MSDOS_PARTITION=y
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
+CONFIG_ENABLE_MUST_CHECK=y
 # CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_KERNEL is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_DEBUG_FS is not set
+# CONFIG_HEADERS_CHECK is not set
 CONFIG_CROSSCOMPILE=y
 CONFIG_CMDLINE="mem=64M console=ttyVR0,115200 ip=any root=/dev/nfs"
 
@@ -1170,10 +1190,6 @@ CONFIG_CMDLINE="mem=64M console=ttyVR0,115200 ip=any root=/dev/nfs"
 # CONFIG_CRYPTO is not set
 
 #
-# Hardware crypto devices
-#
-
-#
 # Library routines
 #
 # CONFIG_CRC_CCITT is not set
diff --git a/arch/mips/dec/time.c b/arch/mips/dec/time.c
index 4cf0c06e2414..69e424e9ab6f 100644
--- a/arch/mips/dec/time.c
+++ b/arch/mips/dec/time.c
@@ -160,11 +160,6 @@ static unsigned int dec_ioasic_hpt_read(void)
         return ioasic_read(IO_REG_FCTR);
 }
 
-static void dec_ioasic_hpt_init(unsigned int count)
-{
-        ioasic_write(IO_REG_FCTR, ioasic_read(IO_REG_FCTR) - count);
-}
-
 
 void __init dec_time_init(void)
 {
@@ -174,11 +169,9 @@ void __init dec_time_init(void)
         mips_timer_state = dec_timer_state;
         mips_timer_ack = dec_timer_ack;
 
-        if (!cpu_has_counter && IOASIC) {
+        if (!cpu_has_counter && IOASIC)
                 /* For pre-R4k systems we use the I/O ASIC's counter.  */
                 mips_hpt_read = dec_ioasic_hpt_read;
-                mips_hpt_init = dec_ioasic_hpt_init;
-        }
 
         /* Set up the rate of periodic DS1287 interrupts.  */
         CMOS_WRITE(RTC_REF_CLCK_32KHZ | (16 - __ffs(HZ)), RTC_REG_A);
diff --git a/arch/mips/emma2rh/common/irq_emma2rh.c b/arch/mips/emma2rh/common/irq_emma2rh.c
index 7c930860c921..197ed4c2ba04 100644
--- a/arch/mips/emma2rh/common/irq_emma2rh.c
+++ b/arch/mips/emma2rh/common/irq_emma2rh.c
@@ -97,7 +97,7 @@ void emma2rh_irq_init(u32 irq_base)
                 irq_desc[i].status = IRQ_DISABLED;
                 irq_desc[i].action = NULL;
                 irq_desc[i].depth = 1;
-                irq_desc[i].handler = &emma2rh_irq_controller;
+                irq_desc[i].chip = &emma2rh_irq_controller;
         }
 
         emma2rh_irq_base = irq_base;
diff --git a/arch/mips/emma2rh/markeins/irq_markeins.c b/arch/mips/emma2rh/markeins/irq_markeins.c
index f23ae9fcffa0..0b36eb001e62 100644
--- a/arch/mips/emma2rh/markeins/irq_markeins.c
+++ b/arch/mips/emma2rh/markeins/irq_markeins.c
@@ -86,7 +86,7 @@ void emma2rh_sw_irq_init(u32 irq_base)
                 irq_desc[i].status = IRQ_DISABLED;
                 irq_desc[i].action = NULL;
                 irq_desc[i].depth = 2;
-                irq_desc[i].handler = &emma2rh_sw_irq_controller;
+                irq_desc[i].chip = &emma2rh_sw_irq_controller;
         }
 
         emma2rh_sw_irq_base = irq_base;
@@ -166,7 +166,7 @@ void emma2rh_gpio_irq_init(u32 irq_base)
                 irq_desc[i].status = IRQ_DISABLED;
                 irq_desc[i].action = NULL;
                 irq_desc[i].depth = 2;
-                irq_desc[i].handler = &emma2rh_gpio_irq_controller;
+                irq_desc[i].chip = &emma2rh_gpio_irq_controller;
         }
 
         emma2rh_gpio_irq_base = irq_base;
diff --git a/arch/mips/emma2rh/markeins/platform.c b/arch/mips/emma2rh/markeins/platform.c
index 15cc61df3622..11567702b155 100644
--- a/arch/mips/emma2rh/markeins/platform.c
+++ b/arch/mips/emma2rh/markeins/platform.c
@@ -44,18 +44,45 @@
 #define I2C_EMMA2RH "emma2rh-iic" /* must be in sync with IIC driver */
 
 static struct resource i2c_emma_resources_0[] = {
-        { NULL, EMMA2RH_IRQ_PIIC0, EMMA2RH_IRQ_PIIC0, IORESOURCE_IRQ },
-        { NULL, KSEG1ADDR(EMMA2RH_PIIC0_BASE), KSEG1ADDR(EMMA2RH_PIIC0_BASE + 0x1000), 0 },
+        {
+                .name   = NULL,
+                .start  = EMMA2RH_IRQ_PIIC0,
+                .end    = EMMA2RH_IRQ_PIIC0,
+                .flags  = IORESOURCE_IRQ
+        }, {
+                .name   = NULL,
+                .start  = EMMA2RH_PIIC0_BASE,
+                .end    = EMMA2RH_PIIC0_BASE + 0x1000,
+                .flags  = 0
+        },
 };
 
 struct resource i2c_emma_resources_1[] = {
-        { NULL, EMMA2RH_IRQ_PIIC1, EMMA2RH_IRQ_PIIC1, IORESOURCE_IRQ },
-        { NULL, KSEG1ADDR(EMMA2RH_PIIC1_BASE), KSEG1ADDR(EMMA2RH_PIIC1_BASE + 0x1000), 0 },
+        {
+                .name   = NULL,
+                .start  = EMMA2RH_IRQ_PIIC1,
+                .end    = EMMA2RH_IRQ_PIIC1,
+                .flags  = IORESOURCE_IRQ
+        }, {
+                .name   = NULL,
+                .start  = EMMA2RH_PIIC1_BASE,
+                .end    = EMMA2RH_PIIC1_BASE + 0x1000,
+                .flags  = 0
+        },
 };
 
 struct resource i2c_emma_resources_2[] = {
-        { NULL, EMMA2RH_IRQ_PIIC2, EMMA2RH_IRQ_PIIC2, IORESOURCE_IRQ },
-        { NULL, KSEG1ADDR(EMMA2RH_PIIC2_BASE), KSEG1ADDR(EMMA2RH_PIIC2_BASE + 0x1000), 0 },
+        {
+                .name   = NULL,
+                .start  = EMMA2RH_IRQ_PIIC2,
+                .end    = EMMA2RH_IRQ_PIIC2,
+                .flags  = IORESOURCE_IRQ
+        }, {
+                .name   = NULL,
+                .start  = EMMA2RH_PIIC2_BASE,
+                .end    = EMMA2RH_PIIC2_BASE + 0x1000,
+                .flags  = 0
+        },
 };
 
 struct platform_device i2c_emma_devices[] = {
@@ -83,32 +110,29 @@ struct platform_device i2c_emma_devices[] = {
 #define EMMA2RH_SERIAL_FLAGS UPF_BOOT_AUTOCONF | UPF_SKIP_TEST
 
 static struct  plat_serial8250_port platform_serial_ports[] = {
-       [0] = {
-         .membase = (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR0_BASE + 3),
-         .irq = EMMA2RH_IRQ_PFUR0,
-         .uartclk = EMMA2RH_SERIAL_CLOCK,
-         .regshift = 4,
-         .iotype = UPIO_MEM,
-         .flags = EMMA2RH_SERIAL_FLAGS,
-       },
-       [1] = {
-         .membase = (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR1_BASE + 3),
-         .irq = EMMA2RH_IRQ_PFUR1,
-         .uartclk = EMMA2RH_SERIAL_CLOCK,
-         .regshift = 4,
-         .iotype = UPIO_MEM,
-         .flags = EMMA2RH_SERIAL_FLAGS,
-       },
-       [2] = {
-         .membase = (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR2_BASE + 3),
-         .irq = EMMA2RH_IRQ_PFUR2,
-         .uartclk = EMMA2RH_SERIAL_CLOCK,
-         .regshift = 4,
-         .iotype = UPIO_MEM,
-         .flags = EMMA2RH_SERIAL_FLAGS,
-       },
-       [3] = {
-         .flags = 0,
+        [0] = {
+                .membase= (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR0_BASE + 3),
+                .irq = EMMA2RH_IRQ_PFUR0,
+                .uartclk = EMMA2RH_SERIAL_CLOCK,
+                .regshift = 4,
+                .iotype = UPIO_MEM,
+                .flags = EMMA2RH_SERIAL_FLAGS,
+       }, [1] = {
+                .membase = (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR1_BASE + 3),
+                .irq = EMMA2RH_IRQ_PFUR1,
+                .uartclk = EMMA2RH_SERIAL_CLOCK,
+                .regshift = 4,
+                .iotype = UPIO_MEM,
+                .flags = EMMA2RH_SERIAL_FLAGS,
+       }, [2] = {
+                .membase = (void __iomem*)KSEG1ADDR(EMMA2RH_PFUR2_BASE + 3),
+                .irq = EMMA2RH_IRQ_PFUR2,
+                .uartclk = EMMA2RH_SERIAL_CLOCK,
+                .regshift = 4,
+                .iotype = UPIO_MEM,
+                .flags = EMMA2RH_SERIAL_FLAGS,
+       }, [3] = {
+                .flags = 0,
        },
 };
 
diff --git a/arch/mips/gt64120/common/time.c b/arch/mips/gt64120/common/time.c
index c83ae6acd601..c47eeb768192 100644
--- a/arch/mips/gt64120/common/time.c
+++ b/arch/mips/gt64120/common/time.c
@@ -64,14 +64,14 @@ static irqreturn_t gt64120_irq(int irq, void *dev_id)
  * as *irq (=irq0 in ../kernel/time.c).  We will do our own timer interrupt
  * handling.
  */
-void gt64120_time_init(void)
+void __init plat_timer_setup(struct irqaction *irq)
 {
         static struct irqaction timer;
 
         /* Disable timer first */
         GT_WRITE(GT_TC_CONTROL_OFS, 0);
         /* Load timer value for 100 Hz */
-        GT_WRITE(GT_TC3_OFS, Sys_clock / 100);
+        GT_WRITE(GT_TC3_OFS, Sys_clock / HZ);
 
         /*
          * Create the IRQ structure entry for the timer.  Since we're too early
diff --git a/arch/mips/gt64120/ev64120/setup.c b/arch/mips/gt64120/ev64120/setup.c
index 91c2d3f41617..99c8d42212e2 100644
--- a/arch/mips/gt64120/ev64120/setup.c
+++ b/arch/mips/gt64120/ev64120/setup.c
@@ -68,7 +68,6 @@ unsigned long __init prom_free_prom_memory(void)
  * Initializes basic routines and structures pointers, memory size (as
  * given by the bios and saves the command line.
  */
-extern void gt64120_time_init(void);
 
 void __init plat_mem_setup(void)
 {
@@ -76,7 +75,6 @@ void __init plat_mem_setup(void)
         _machine_halt = galileo_machine_halt;
         pm_power_off = galileo_machine_power_off;
 
-        board_time_init = gt64120_time_init;
         set_io_port_base(KSEG1);
 }
 
diff --git a/arch/mips/gt64120/momenco_ocelot/setup.c b/arch/mips/gt64120/momenco_ocelot/setup.c
index 0e5bbee2d5b7..94f94ebbda6c 100644
--- a/arch/mips/gt64120/momenco_ocelot/setup.c
+++ b/arch/mips/gt64120/momenco_ocelot/setup.c
@@ -70,7 +70,6 @@ extern void momenco_ocelot_restart(char *command);
 extern void momenco_ocelot_halt(void);
 extern void momenco_ocelot_power_off(void);
 
-extern void gt64120_time_init(void);
 extern void momenco_ocelot_irq_setup(void);
 
 static char reset_reason;
@@ -156,8 +155,6 @@ void __init plat_mem_setup(void)
         void (*l3func)(unsigned long)=KSEG1ADDR(&setup_l3cache);
         unsigned int tmpword;
 
-        board_time_init = gt64120_time_init;
-
         _machine_restart = momenco_ocelot_restart;
         _machine_halt = momenco_ocelot_halt;
         pm_power_off = momenco_ocelot_power_off;
diff --git a/arch/mips/jazz/setup.c b/arch/mips/jazz/setup.c
index 6dc4135d6e11..d848f1a07786 100644
--- a/arch/mips/jazz/setup.c
+++ b/arch/mips/jazz/setup.c
@@ -37,7 +37,7 @@ extern void jazz_machine_restart(char *command);
 extern void jazz_machine_halt(void);
 extern void jazz_machine_power_off(void);
 
-void __init plat_time_init(struct irqaction *irq)
+void __init plat_timer_setup(struct irqaction *irq)
 {
         /* set the clock to 100 Hz */
         r4030_write_reg32(JAZZ_TIMER_INTERVAL, 9);
diff --git a/arch/mips/jmr3927/rbhma3100/irq.c b/arch/mips/jmr3927/rbhma3100/irq.c
index 39a0243bed9a..de4a238c28be 100644
--- a/arch/mips/jmr3927/rbhma3100/irq.c
+++ b/arch/mips/jmr3927/rbhma3100/irq.c
@@ -288,6 +288,8 @@ static void tx_branch_likely_bug_fixup(void)
 
 static void jmr3927_spurious(void)
 {
+        struct pt_regs * regs = get_irq_regs();
+
 #ifdef CONFIG_TX_BRANCH_LIKELY_BUG_WORKAROUND
         tx_branch_likely_bug_fixup();
 #endif
@@ -297,6 +299,7 @@ static void jmr3927_spurious(void)
 
 asmlinkage void plat_irq_dispatch(void)
 {
+        struct pt_regs * regs = get_irq_regs();
         int irq;
 
 #ifdef CONFIG_TX_BRANCH_LIKELY_BUG_WORKAROUND
diff --git a/arch/mips/jmr3927/rbhma3100/setup.c b/arch/mips/jmr3927/rbhma3100/setup.c
index 025434054ed0..16e5dfe7aa8a 100644
--- a/arch/mips/jmr3927/rbhma3100/setup.c
+++ b/arch/mips/jmr3927/rbhma3100/setup.c
@@ -170,12 +170,20 @@ static void jmr3927_machine_power_off(void)
         while (1);
 }
 
+static unsigned int jmr3927_hpt_read(void)
+{
+        /* We assume this function is called xtime_lock held. */
+        return jiffies * (JMR3927_TIMER_CLK / HZ) + jmr3927_tmrptr->trr;
+}
+
 #define USE_RTC_DS1742
 #ifdef USE_RTC_DS1742
 extern void rtc_ds1742_init(unsigned long base);
 #endif
 static void __init jmr3927_time_init(void)
 {
+        mips_hpt_read = jmr3927_hpt_read;
+        mips_hpt_frequency = JMR3927_TIMER_CLK;
 #ifdef USE_RTC_DS1742
         if (jmr3927_have_nvram()) {
                 rtc_ds1742_init(JMR3927_IOC_NVRAMB_ADDR);
@@ -183,12 +191,8 @@ static void __init jmr3927_time_init(void)
 #endif
 }
 
-unsigned long jmr3927_do_gettimeoffset(void);
-
 void __init plat_timer_setup(struct irqaction *irq)
 {
-        do_gettimeoffset = jmr3927_do_gettimeoffset;
-
         jmr3927_tmrptr->cpra = JMR3927_TIMER_CLK / HZ;
         jmr3927_tmrptr->itmr = TXx927_TMTITMR_TIIE | TXx927_TMTITMR_TZCE;
         jmr3927_tmrptr->ccdr = JMR3927_TIMER_CCD;
@@ -200,34 +204,6 @@ void __init plat_timer_setup(struct irqaction *irq)
 
 #define USECS_PER_JIFFY (1000000/HZ)
 
-unsigned long jmr3927_do_gettimeoffset(void)
-{
-       unsigned long count;
-       unsigned long res = 0;
-
-       /* MUST read TRR before TISR. */
-       count = jmr3927_tmrptr->trr;
-
-       if (jmr3927_tmrptr->tisr & TXx927_TMTISR_TIIS) {
-               /* timer interrupt is pending.  use Max value. */
-               res = USECS_PER_JIFFY - 1;
-       } else {
-               /* convert to usec */
-               /* res = count / (JMR3927_TIMER_CLK / 1000000); */
-               res = (count << 7) / ((JMR3927_TIMER_CLK << 7) / 1000000);
-
-               /*
-                * Due to possible jiffies inconsistencies, we need to check
-                * the result so that we'll get a timer that is monotonic.
-                */
-               if (res >= USECS_PER_JIFFY)
-                       res = USECS_PER_JIFFY-1;
-       }
-
-       return res;
-}
-
-
 //#undef DO_WRITE_THROUGH
 #define DO_WRITE_THROUGH
 #define DO_ENABLE_CACHE
diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
index e9ce5b3721af..ff88b06f89df 100644
--- a/arch/mips/kernel/asm-offsets.c
+++ b/arch/mips/kernel/asm-offsets.c
@@ -22,7 +22,7 @@
 #define offset(string, ptr, member) \
         __asm__("\n@@@" string "%0" : : "i" (_offset(ptr, member)))
 #define constant(string, member) \
-        __asm__("\n@@@" string "%x0" : : "ri" (member))
+        __asm__("\n@@@" string "%X0" : : "ri" (member))
 #define size(string, size) \
         __asm__("\n@@@" string "%0" : : "i" (sizeof(size)))
 #define linefeed text("")
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index 417c08ac76eb..f10b6a19f8bf 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -83,7 +83,10 @@ FEXPORT(syscall_exit)
 FEXPORT(restore_all)                    # restore full frame
 #ifdef CONFIG_MIPS_MT_SMTC
 /* Detect and execute deferred IPI "interrupts" */
+        LONG_L  s0, TI_REGS($28)
+        LONG_S  sp, TI_REGS($28)
         jal     deferred_smtc_ipi
+        LONG_S  s0, TI_REGS($28)
 /* Re-arm any temporarily masked interrupts not explicitly "acked" */
         mfc0    v0, CP0_TCSTATUS
         ori     v1, v0, TCSTATUS_IXMT
diff --git a/arch/mips/kernel/head.S b/arch/mips/kernel/head.S
index 8c6db0fc72f0..ddc1b71c9378 100644
--- a/arch/mips/kernel/head.S
+++ b/arch/mips/kernel/head.S
@@ -189,7 +189,8 @@ NESTED(kernel_entry, 16, sp)			# kernel entry point
 
         MTC0            zero, CP0_CONTEXT       # clear context register
         PTR_LA          $28, init_thread_union
-        PTR_ADDIU       sp, $28, _THREAD_SIZE - 32
+        PTR_LI          sp, _THREAD_SIZE - 32
+        PTR_ADDU        sp, $28
         set_saved_sp    sp, t0, t1
         PTR_SUBU        sp, 4 * SZREG           # init stack pointer
 
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index dd24434392b6..9b0e49d63d7b 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -26,6 +26,48 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
+static unsigned long irq_map[NR_IRQS / BITS_PER_LONG];
+
+int __devinit allocate_irqno(void)
+{
+        int irq;
+
+again:
+        irq = find_first_zero_bit(irq_map, NR_IRQS);
+
+        if (irq >= NR_IRQS)
+                return -ENOSPC;
+
+        if (test_and_set_bit(irq, irq_map))
+                goto again;
+
+        return irq;
+}
+
+EXPORT_SYMBOL_GPL(allocate_irqno);
+
+/*
+ * Allocate the 16 legacy interrupts for i8259 devices.  This happens early
+ * in the kernel initialization so treating allocation failure as BUG() is
+ * ok.
+ */
+void __init alloc_legacy_irqno(void)
+{
+        int i;
+
+        for (i = 0; i <= 16; i++)
+                BUG_ON(test_and_set_bit(i, irq_map));
+}
+
+void __devinit free_irqno(unsigned int irq)
+{
+        smp_mb__before_clear_bit();
+        clear_bit(irq, irq_map);
+        smp_mb__after_clear_bit();
+}
+
+EXPORT_SYMBOL_GPL(free_irqno);
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 53f4171fc188..7a3ebbeba1f3 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -1055,7 +1055,9 @@ asmlinkage long sys32_newuname(struct new_utsname __user * name)
 asmlinkage int sys32_personality(unsigned long personality)
 {
         int ret;
-        if (current->personality == PER_LINUX32 && personality == PER_LINUX)
+        personality &= 0xffffffff;
+        if (personality(current->personality) == PER_LINUX32 &&
+            personality == PER_LINUX)
                 personality = PER_LINUX32;
         ret = sys_personality(personality);
         if (ret == PER_LINUX32)
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 9f307eb1a31e..ec8209f3a0c6 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -358,10 +358,8 @@ static int __init frame_info_init(void)
         unsigned long size = 0;
 #ifdef CONFIG_KALLSYMS
         unsigned long ofs;
-        char *modname;
-        char namebuf[KSYM_NAME_LEN + 1];
 
-        kallsyms_lookup((unsigned long)schedule, &size, &ofs, &modname, namebuf);
+        kallsyms_lookup_size_offset((unsigned long)schedule, &size, &ofs);
 #endif
         schedule_mfi.func = schedule;
         schedule_mfi.func_size = size;
@@ -403,8 +401,6 @@ unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
 {
         unsigned long stack_page;
         struct mips_frame_info info;
-        char *modname;
-        char namebuf[KSYM_NAME_LEN + 1];
         unsigned long size, ofs;
         int leaf;
         extern void ret_from_irq(void);
@@ -433,7 +429,7 @@ unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
                 }
                 return 0;
         }
-        if (!kallsyms_lookup(pc, &size, &ofs, &modname, namebuf))
+        if (!kallsyms_lookup_size_offset(pc, &size, &ofs))
                 return 0;
         /*
          * Return ra if an exception occured at the first instruction
diff --git a/arch/mips/kernel/r4k_switch.S b/arch/mips/kernel/r4k_switch.S
index d5c8b82fed72..cc566cf12246 100644
--- a/arch/mips/kernel/r4k_switch.S
+++ b/arch/mips/kernel/r4k_switch.S
@@ -85,7 +85,12 @@
         move    $28, a2
         cpu_restore_nonscratch a1
 
+#if (_THREAD_SIZE - 32) < 0x10000
         PTR_ADDIU       t0, $28, _THREAD_SIZE - 32
+#else
+        PTR_LI          t0, _THREAD_SIZE - 32
+        PTR_ADDU        t0, $28
+#endif
         set_saved_sp    t0, t1, t2
 #ifdef CONFIG_MIPS_MT_SMTC
         /* Read-modify-writes of Status must be atomic on a VPE */
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 61362e6fa9ec..a95f37de080e 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -652,7 +652,10 @@ einval:	li	v0, -EINVAL
         sys     sys_vmsplice            4
         sys     sys_move_pages          6
         sys     sys_set_robust_list     2
-        sys     sys_get_robust_list     3
+        sys     sys_get_robust_list     3       /* 4310 */
+        sys     sys_ni_syscall          0
+        sys     sys_getcpu              3
+        sys     sys_epoll_pwait         6
         .endm
 
         /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index 6c7b5ed0ea6e..8fb0f60f657b 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -468,3 +468,6 @@ sys_call_table:
         PTR     sys_move_pages
         PTR     sys_set_robust_list
         PTR     sys_get_robust_list
+        PTR     sys_ni_syscall                  /* 5270 */
+        PTR     sys_getcpu
+        PTR     sys_epoll_pwait
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 6d9f18727ac5..0da5ca2040ff 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -280,7 +280,7 @@ EXPORT(sysn32_call_table)
         PTR     sys_sync
         PTR     sys_acct
         PTR     sys32_settimeofday
-        PTR     sys_mount                       /* 6160 */
+        PTR     compat_sys_mount                /* 6160 */
         PTR     sys_umount
         PTR     sys_swapon
         PTR     sys_swapoff
@@ -394,3 +394,6 @@ EXPORT(sysn32_call_table)
         PTR     sys_move_pages
         PTR     compat_sys_set_robust_list
         PTR     compat_sys_get_robust_list
+        PTR     sys_ni_syscall
+        PTR     sys_getcpu
+        PTR     sys_epoll_pwait
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 2e6d0673163e..b9d00cae8b5f 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -226,7 +226,7 @@ sys_call_table:
         PTR     sys_ni_syscall                  /* was sys_stat */
         PTR     sys_lseek
         PTR     sys_getpid                      /* 4020 */
-        PTR     sys_mount
+        PTR     compat_sys_mount
         PTR     sys_oldumount
         PTR     sys_setuid
         PTR     sys_getuid
@@ -516,4 +516,7 @@ sys_call_table:
         PTR     compat_sys_move_pages
         PTR     compat_sys_set_robust_list
         PTR     compat_sys_get_robust_list      /* 4310 */
+        PTR     sys_ni_syscall
+        PTR     sys_getcpu
+        PTR     sys_epoll_pwait
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index fdbb508661c5..8f6e89697ccf 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -223,7 +223,11 @@ disable:
 
 #else  /* !CONFIG_BLK_DEV_INITRD */
 
-#define init_initrd()           0
+static unsigned long __init init_initrd(void)
+{
+        return 0;
+}
+
 #define finalize_initrd()       do {} while (0)
 
 #endif
diff --git a/arch/mips/kernel/smp-mt.c b/arch/mips/kernel/smp-mt.c
index 3b5f3b632622..2ac19a6cbf68 100644
--- a/arch/mips/kernel/smp-mt.c
+++ b/arch/mips/kernel/smp-mt.c
@@ -140,15 +140,90 @@ static struct irqaction irq_call = {
         .name           = "IPI_call"
 };
 
+static void __init smp_copy_vpe_config(void)
+{
+        write_vpe_c0_status(
+                (read_c0_status() & ~(ST0_IM | ST0_IE | ST0_KSU)) | ST0_CU0);
+
+        /* set config to be the same as vpe0, particularly kseg0 coherency alg */
+        write_vpe_c0_config( read_c0_config());
+
+        /* make sure there are no software interrupts pending */
+        write_vpe_c0_cause(0);
+
+        /* Propagate Config7 */
+        write_vpe_c0_config7(read_c0_config7());
+
+        write_vpe_c0_count(read_c0_count());
+}
+
+static unsigned int __init smp_vpe_init(unsigned int tc, unsigned int mvpconf0,
+        unsigned int ncpu)
+{
+        if (tc > ((mvpconf0 & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT))
+                return ncpu;
+
+        /* Deactivate all but VPE 0 */
+        if (tc != 0) {
+                unsigned long tmp = read_vpe_c0_vpeconf0();
+
+                tmp &= ~VPECONF0_VPA;
+
+                /* master VPE */
+                tmp |= VPECONF0_MVP;
+                write_vpe_c0_vpeconf0(tmp);
+
+                /* Record this as available CPU */
+                cpu_set(tc, phys_cpu_present_map);
+                __cpu_number_map[tc]    = ++ncpu;
+                __cpu_logical_map[ncpu] = tc;
+        }
+
+        /* Disable multi-threading with TC's */
+        write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() & ~VPECONTROL_TE);
+
+        if (tc != 0)
+                smp_copy_vpe_config();
+
+        return ncpu;
+}
+
+static void __init smp_tc_init(unsigned int tc, unsigned int mvpconf0)
+{
+        unsigned long tmp;
+
+        if (!tc)
+                return;
+
+        /* bind a TC to each VPE, May as well put all excess TC's
+           on the last VPE */
+        if (tc >= (((mvpconf0 & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT)+1))
+                write_tc_c0_tcbind(read_tc_c0_tcbind() | ((mvpconf0 & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT));
+        else {
+                write_tc_c0_tcbind(read_tc_c0_tcbind() | tc);
+
+                /* and set XTC */
+                write_vpe_c0_vpeconf0(read_vpe_c0_vpeconf0() | (tc << VPECONF0_XTC_SHIFT));
+        }
+
+        tmp = read_tc_c0_tcstatus();
+
+        /* mark not allocated and not dynamically allocatable */
+        tmp &= ~(TCSTATUS_A | TCSTATUS_DA);
+        tmp |= TCSTATUS_IXMT;           /* interrupt exempt */
+        write_tc_c0_tcstatus(tmp);
+
+        write_tc_c0_tchalt(TCHALT_H);
+}
+
 /*
  * Common setup before any secondaries are started
  * Make sure all CPU's are in a sensible state before we boot any of the
  * secondarys
  */
-void plat_smp_setup(void)
+void __init plat_smp_setup(void)
 {
-        unsigned long val;
-        int i, num;
+        unsigned int mvpconf0, ntc, tc, ncpu = 0;
 
 #ifdef CONFIG_MIPS_MT_FPAFF
         /* If we have an FPU, enroll ourselves in the FPU-full mask */
@@ -167,75 +242,16 @@ void plat_smp_setup(void)
         /* Put MVPE's into 'configuration state' */
         set_c0_mvpcontrol(MVPCONTROL_VPC);
 
-        val = read_c0_mvpconf0();
+        mvpconf0 = read_c0_mvpconf0();
+        ntc = (mvpconf0 & MVPCONF0_PTC) >> MVPCONF0_PTC_SHIFT;
 
         /* we'll always have more TC's than VPE's, so loop setting everything
            to a sensible state */
-        for (i = 0, num = 0; i <= ((val & MVPCONF0_PTC) >> MVPCONF0_PTC_SHIFT); i++) {
-                settc(i);
-
-                /* VPE's */
-                if (i <= ((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT)) {
-
-                        /* deactivate all but vpe0 */
-                        if (i != 0) {
-                                unsigned long tmp = read_vpe_c0_vpeconf0();
-
-                                tmp &= ~VPECONF0_VPA;
-
-                                /* master VPE */
-                                tmp |= VPECONF0_MVP;
-                                write_vpe_c0_vpeconf0(tmp);
-
-                                /* Record this as available CPU */
-                                cpu_set(i, phys_cpu_present_map);
-                                __cpu_number_map[i]     = ++num;
-                                __cpu_logical_map[num]  = i;
-                        }
-
-                        /* disable multi-threading with TC's */
-                        write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() & ~VPECONTROL_TE);
-
-                        if (i != 0) {
-                                write_vpe_c0_status((read_c0_status() & ~(ST0_IM | ST0_IE | ST0_KSU)) | ST0_CU0);
+        for (tc = 0; tc <= ntc; tc++) {
+                settc(tc);
 
-                                /* set config to be the same as vpe0, particularly kseg0 coherency alg */
-                                write_vpe_c0_config( read_c0_config());
-
-                                /* make sure there are no software interrupts pending */
-                                write_vpe_c0_cause(0);
-
-                                /* Propagate Config7 */
-                                write_vpe_c0_config7(read_c0_config7());
-                        }
-
-                }
-
-                /* TC's */
-
-                if (i != 0) {
-                        unsigned long tmp;
-
-                        /* bind a TC to each VPE, May as well put all excess TC's
-                           on the last VPE */
-                        if ( i >= (((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT)+1) )
-                                write_tc_c0_tcbind(read_tc_c0_tcbind() | ((val & MVPCONF0_PVPE) >> MVPCONF0_PVPE_SHIFT) );
-                        else {
-                                write_tc_c0_tcbind( read_tc_c0_tcbind() | i);
-
-                                /* and set XTC */
-                                write_vpe_c0_vpeconf0( read_vpe_c0_vpeconf0() | (i << VPECONF0_XTC_SHIFT));
-                        }
-
-                        tmp = read_tc_c0_tcstatus();
-
-                        /* mark not allocated and not dynamically allocatable */
-                        tmp &= ~(TCSTATUS_A | TCSTATUS_DA);
-                        tmp |= TCSTATUS_IXMT;           /* interrupt exempt */
-                        write_tc_c0_tcstatus(tmp);
-
-                        write_tc_c0_tchalt(TCHALT_H);
-                }
+                smp_tc_init(tc, mvpconf0);
+                ncpu = smp_vpe_init(tc, mvpconf0, ncpu);
         }
 
         /* Release config state */
@@ -243,7 +259,7 @@ void plat_smp_setup(void)
 
         /* We'll wait until starting the secondaries before starting MVPE */
 
-        printk(KERN_INFO "Detected %i available secondary CPU(s)\n", num);
+        printk(KERN_INFO "Detected %i available secondary CPU(s)\n", ncpu);
 }
 
 void __init plat_prepare_cpus(unsigned int max_cpus)
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index 1af3612a1ce8..db80957ada89 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -310,7 +310,7 @@ static void flush_tlb_all_ipi(void *info)
 
 void flush_tlb_all(void)
 {
-        on_each_cpu(flush_tlb_all_ipi, 0, 1, 1);
+        on_each_cpu(flush_tlb_all_ipi, NULL, 1, 1);
 }
 
 static void flush_tlb_mm_ipi(void *mm)
diff --git a/arch/mips/kernel/smtc-asm.S b/arch/mips/kernel/smtc-asm.S
index 1cb9441f1474..921207c4a83c 100644
--- a/arch/mips/kernel/smtc-asm.S
+++ b/arch/mips/kernel/smtc-asm.S
@@ -101,7 +101,9 @@ FEXPORT(__smtc_ipi_vector)
         lw      t0,PT_PADSLOT5(sp)
         /* Argument from sender passed in stack pad slot 4 */
         lw      a0,PT_PADSLOT4(sp)
-        PTR_LA  ra, _ret_from_irq
+        LONG_L  s0, TI_REGS($28)
+        LONG_S  sp, TI_REGS($28)
+        PTR_LA  ra, ret_from_irq
         jr      t0
 
 /*
@@ -119,7 +121,10 @@ LEAF(self_ipi)
         subu    t1,sp,PT_SIZE
         sw      ra,PT_EPC(t1)
         sw      a0,PT_PADSLOT4(t1)
+        LONG_L  s0, TI_REGS($28)
+        LONG_S  sp, TI_REGS($28)
         la      t2,ipi_decode
+        LONG_S  s0, TI_REGS($28)
         sw      t2,PT_PADSLOT5(t1)
         /* Save pre-disable value of TCStatus */
         sw      t0,PT_TCSTATUS(t1)
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index cc1f7474f7d7..3b78caf112f5 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -476,6 +476,7 @@ void mipsmt_prepare_cpus(void)
                         write_vpe_c0_compare(0);
                         /* Propagate Config7 */
                         write_vpe_c0_config7(read_c0_config7());
+                        write_vpe_c0_count(read_c0_count());
                 }
                 /* enable multi-threading within VPE */
                 write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() | VPECONTROL_TE);
diff --git a/arch/mips/kernel/stacktrace.c b/arch/mips/kernel/stacktrace.c
index 4aabe526a68e..a586aba337a7 100644
--- a/arch/mips/kernel/stacktrace.c
+++ b/arch/mips/kernel/stacktrace.c
@@ -57,7 +57,7 @@ static void save_context_stack(struct stack_trace *trace,
                 pc = unwind_stack(task, &sp, pc, &ra);
         } while (pc);
 #else
-        save_raw_context_stack(sp);
+        save_raw_context_stack(trace, sp);
 #endif
 }
 
diff --git a/arch/mips/kernel/time.c b/arch/mips/kernel/time.c
index debe86c2f691..e535f86efa2f 100644
--- a/arch/mips/kernel/time.c
+++ b/arch/mips/kernel/time.c
@@ -11,6 +11,7 @@
  * Free Software Foundation;  either version 2 of the  License, or (at your
  * option) any later version.
  */
+#include <linux/clocksource.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -67,15 +68,9 @@ int (*rtc_mips_set_time)(unsigned long) = null_rtc_set_time;
 int (*rtc_mips_set_mmss)(unsigned long);
 
 
-/* usecs per counter cycle, shifted to left by 32 bits */
-static unsigned int sll32_usecs_per_cycle;
-
 /* how many counter cycles in a jiffy */
 static unsigned long cycles_per_jiffy __read_mostly;
 
-/* Cycle counter value at the previous timer interrupt.. */
-static unsigned int timerhi, timerlo;
-
 /* expirelo is the count value for next CPU timer interrupt */
 static unsigned int expirelo;
 
@@ -93,7 +88,7 @@ static unsigned int null_hpt_read(void)
         return 0;
 }
 
-static void null_hpt_init(unsigned int count)
+static void __init null_hpt_init(void)
 {
         /* nothing */
 }
@@ -128,186 +123,18 @@ static unsigned int c0_hpt_read(void)
         return read_c0_count();
 }
 
-/* For use solely as a high precision timer.  */
-static void c0_hpt_init(unsigned int count)
-{
-        write_c0_count(read_c0_count() - count);
-}
-
 /* For use both as a high precision timer and an interrupt source.  */
-static void c0_hpt_timer_init(unsigned int count)
+static void __init c0_hpt_timer_init(void)
 {
-        count = read_c0_count() - count;
-        expirelo = (count / cycles_per_jiffy + 1) * cycles_per_jiffy;
-        write_c0_count(expirelo - cycles_per_jiffy);
+        expirelo = read_c0_count() + cycles_per_jiffy;
         write_c0_compare(expirelo);
-        write_c0_count(count);
 }
 
 int (*mips_timer_state)(void);
 void (*mips_timer_ack)(void);
 unsigned int (*mips_hpt_read)(void);
-void (*mips_hpt_init)(unsigned int);
-
-/*
- * Gettimeoffset routines.  These routines returns the time duration
- * since last timer interrupt in usecs.
- *
- * If the exact CPU counter frequency is known, use fixed_rate_gettimeoffset.
- * Otherwise use calibrate_gettimeoffset()
- *
- * If the CPU does not have the counter register, you can either supply
- * your own gettimeoffset() routine, or use null_gettimeoffset(), which
- * gives the same resolution as HZ.
- */
-
-static unsigned long null_gettimeoffset(void)
-{
-        return 0;
-}
-
-
-/* The function pointer to one of the gettimeoffset funcs.  */
-unsigned long (*do_gettimeoffset)(void) = null_gettimeoffset;
-
-
-static unsigned long fixed_rate_gettimeoffset(void)
-{
-        u32 count;
-        unsigned long res;
-
-        /* Get last timer tick in absolute kernel time */
-        count = mips_hpt_read();
-
-        /* .. relative to previous jiffy (32 bits is enough) */
-        count -= timerlo;
-
-        __asm__("multu  %1,%2"
-                : "=h" (res)
-                : "r" (count), "r" (sll32_usecs_per_cycle)
-                : "lo", GCC_REG_ACCUM);
-
-        /*
-         * Due to possible jiffies inconsistencies, we need to check
-         * the result so that we'll get a timer that is monotonic.
-         */
-        if (res >= USECS_PER_JIFFY)
-                res = USECS_PER_JIFFY - 1;
-
-        return res;
-}
-
-
-/*
- * Cached "1/(clocks per usec) * 2^32" value.
- * It has to be recalculated once each jiffy.
- */
-static unsigned long cached_quotient;
-
-/* Last jiffy when calibrate_divXX_gettimeoffset() was called. */
-static unsigned long last_jiffies;
-
-/*
- * This is moved from dec/time.c:do_ioasic_gettimeoffset() by Maciej.
- */
-static unsigned long calibrate_div32_gettimeoffset(void)
-{
-        u32 count;
-        unsigned long res, tmp;
-        unsigned long quotient;
-
-        tmp = jiffies;
-
-        quotient = cached_quotient;
-
-        if (last_jiffies != tmp) {
-                last_jiffies = tmp;
-                if (last_jiffies != 0) {
-                        unsigned long r0;
-                        do_div64_32(r0, timerhi, timerlo, tmp);
-                        do_div64_32(quotient, USECS_PER_JIFFY,
-                                    USECS_PER_JIFFY_FRAC, r0);
-                        cached_quotient = quotient;
-                }
-        }
-
-        /* Get last timer tick in absolute kernel time */
-        count = mips_hpt_read();
-
-        /* .. relative to previous jiffy (32 bits is enough) */
-        count -= timerlo;
-
-        __asm__("multu  %1,%2"
-                : "=h" (res)
-                : "r" (count), "r" (quotient)
-                : "lo", GCC_REG_ACCUM);
-
-        /*
-         * Due to possible jiffies inconsistencies, we need to check
-         * the result so that we'll get a timer that is monotonic.
-         */
-        if (res >= USECS_PER_JIFFY)
-                res = USECS_PER_JIFFY - 1;
-
-        return res;
-}
-
-static unsigned long calibrate_div64_gettimeoffset(void)
-{
-        u32 count;
-        unsigned long res, tmp;
-        unsigned long quotient;
-
-        tmp = jiffies;
-
-        quotient = cached_quotient;
-
-        if (last_jiffies != tmp) {
-                last_jiffies = tmp;
-                if (last_jiffies) {
-                        unsigned long r0;
-                        __asm__(".set   push\n\t"
-                                ".set   mips3\n\t"
-                                "lwu    %0,%3\n\t"
-                                "dsll32 %1,%2,0\n\t"
-                                "or     %1,%1,%0\n\t"
-                                "ddivu  $0,%1,%4\n\t"
-                                "mflo   %1\n\t"
-                                "dsll32 %0,%5,0\n\t"
-                                "or     %0,%0,%6\n\t"
-                                "ddivu  $0,%0,%1\n\t"
-                                "mflo   %0\n\t"
-                                ".set   pop"
-                                : "=&r" (quotient), "=&r" (r0)
-                                : "r" (timerhi), "m" (timerlo),
-                                  "r" (tmp), "r" (USECS_PER_JIFFY),
-                                  "r" (USECS_PER_JIFFY_FRAC)
-                                : "hi", "lo", GCC_REG_ACCUM);
-                        cached_quotient = quotient;
-                }
-        }
-
-        /* Get last timer tick in absolute kernel time */
-        count = mips_hpt_read();
-
-        /* .. relative to previous jiffy (32 bits is enough) */
-        count -= timerlo;
-
-        __asm__("multu  %1,%2"
-                : "=h" (res)
-                : "r" (count), "r" (quotient)
-                : "lo", GCC_REG_ACCUM);
-
-        /*
-         * Due to possible jiffies inconsistencies, we need to check
-         * the result so that we'll get a timer that is monotonic.
-         */
-        if (res >= USECS_PER_JIFFY)
-                res = USECS_PER_JIFFY - 1;
-
-        return res;
-}
-
+void (*mips_hpt_init)(void) __initdata = null_hpt_init;
+unsigned int mips_hpt_mask = 0xffffffff;
 
 /* last time when xtime and rtc are sync'ed up */
 static long last_rtc_update;
@@ -334,18 +161,10 @@ void local_timer_interrupt(int irq, void *dev_id)
  */
 irqreturn_t timer_interrupt(int irq, void *dev_id)
 {
-        unsigned long j;
-        unsigned int count;
-
         write_seqlock(&xtime_lock);
 
-        count = mips_hpt_read();
         mips_timer_ack();
 
-        /* Update timerhi/timerlo for intra-jiffy calibration. */
-        timerhi += count < timerlo;                     /* Wrap around */
-        timerlo = count;
-
         /*
          * call the generic timer interrupt handling
          */
@@ -368,47 +187,6 @@ irqreturn_t timer_interrupt(int irq, void *dev_id)
                 }
         }
 
-        /*
-         * If jiffies has overflown in this timer_interrupt, we must
-         * update the timer[hi]/[lo] to make fast gettimeoffset funcs
-         * quotient calc still valid. -arca
-         *
-         * The first timer interrupt comes late as interrupts are
-         * enabled long after timers are initialized.  Therefore the
-         * high precision timer is fast, leading to wrong gettimeoffset()
-         * calculations.  We deal with it by setting it based on the
-         * number of its ticks between the second and the third interrupt.
-         * That is still somewhat imprecise, but it's a good estimate.
-         * --macro
-         */
-        j = jiffies;
-        if (j < 4) {
-                static unsigned int prev_count;
-                static int hpt_initialized;
-
-                switch (j) {
-                case 0:
-                        timerhi = timerlo = 0;
-                        mips_hpt_init(count);
-                        break;
-                case 2:
-                        prev_count = count;
-                        break;
-                case 3:
-                        if (!hpt_initialized) {
-                                unsigned int c3 = 3 * (count - prev_count);
-
-                                timerhi = 0;
-                                timerlo = c3;
-                                mips_hpt_init(count - c3);
-                                hpt_initialized = 1;
-                        }
-                        break;
-                default:
-                        break;
-                }
-        }
-
         write_sequnlock(&xtime_lock);
 
         /*
@@ -476,12 +254,11 @@ asmlinkage void ll_local_timer_interrupt(int irq)
  * 1) board_time_init() -
  *      a) (optional) set up RTC routines,
  *      b) (optional) calibrate and set the mips_hpt_frequency
- *          (only needed if you intended to use fixed_rate_gettimeoffset
- *           or use cpu counter as timer interrupt source)
+ *          (only needed if you intended to use cpu counter as timer interrupt
+ *           source)
  * 2) setup xtime based on rtc_mips_get_time().
- * 3) choose a appropriate gettimeoffset routine.
- * 4) calculate a couple of cached variables for later usage
- * 5) plat_timer_setup() -
+ * 3) calculate a couple of cached variables for later usage
+ * 4) plat_timer_setup() -
  *      a) (optional) over-write any choices made above by time_init().
  *      b) machine specific code should setup the timer irqaction.
  *      c) enable the timer interrupt
@@ -533,13 +310,48 @@ static unsigned int __init calibrate_hpt(void)
         } while (--i);
         hpt_end = mips_hpt_read();
 
-        hpt_count = hpt_end - hpt_start;
+        hpt_count = (hpt_end - hpt_start) & mips_hpt_mask;
         hz = HZ;
         frequency = (u64)hpt_count * (u64)hz;
 
         return frequency >> log_2_loops;
 }
 
+static cycle_t read_mips_hpt(void)
+{
+        return (cycle_t)mips_hpt_read();
+}
+
+static struct clocksource clocksource_mips = {
+        .name           = "MIPS",
+        .read           = read_mips_hpt,
+        .is_continuous  = 1,
+};
+
+static void __init init_mips_clocksource(void)
+{
+        u64 temp;
+        u32 shift;
+
+        if (!mips_hpt_frequency || mips_hpt_read == null_hpt_read)
+                return;
+
+        /* Calclate a somewhat reasonable rating value */
+        clocksource_mips.rating = 200 + mips_hpt_frequency / 10000000;
+        /* Find a shift value */
+        for (shift = 32; shift > 0; shift--) {
+                temp = (u64) NSEC_PER_SEC << shift;
+                do_div(temp, mips_hpt_frequency);
+                if ((temp >> 32) == 0)
+                        break;
+        }
+        clocksource_mips.shift = shift;
+        clocksource_mips.mult = (u32)temp;
+        clocksource_mips.mask = mips_hpt_mask;
+
+        clocksource_register(&clocksource_mips);
+}
+
 void __init time_init(void)
 {
         if (board_time_init)
@@ -555,41 +367,21 @@ void __init time_init(void)
                                 -xtime.tv_sec, -xtime.tv_nsec);
 
         /* Choose appropriate high precision timer routines.  */
-        if (!cpu_has_counter && !mips_hpt_read) {
+        if (!cpu_has_counter && !mips_hpt_read)
                 /* No high precision timer -- sorry.  */
                 mips_hpt_read = null_hpt_read;
-                mips_hpt_init = null_hpt_init;
-        } else if (!mips_hpt_frequency && !mips_timer_state) {
+        else if (!mips_hpt_frequency && !mips_timer_state) {
                 /* A high precision timer of unknown frequency.  */
-                if (!mips_hpt_read) {
+                if (!mips_hpt_read)
                         /* No external high precision timer -- use R4k.  */
                         mips_hpt_read = c0_hpt_read;
-                        mips_hpt_init = c0_hpt_init;
-                }
-
-                if (cpu_has_mips32r1 || cpu_has_mips32r2 ||
-                    (current_cpu_data.isa_level == MIPS_CPU_ISA_I) ||
-                    (current_cpu_data.isa_level == MIPS_CPU_ISA_II))
-                        /*
-                         * We need to calibrate the counter but we don't have
-                         * 64-bit division.
-                         */
-                        do_gettimeoffset = calibrate_div32_gettimeoffset;
-                else
-                        /*
-                         * We need to calibrate the counter but we *do* have
-                         * 64-bit division.
-                         */
-                        do_gettimeoffset = calibrate_div64_gettimeoffset;
         } else {
                 /* We know counter frequency.  Or we can get it.  */
                 if (!mips_hpt_read) {
                         /* No external high precision timer -- use R4k.  */
                         mips_hpt_read = c0_hpt_read;
 
-                        if (mips_timer_state)
-                                mips_hpt_init = c0_hpt_init;
-                        else {
+                        if (!mips_timer_state) {
                                 /* No external timer interrupt -- use R4k.  */
                                 mips_hpt_init = c0_hpt_timer_init;
                                 mips_timer_ack = c0_timer_ack;
@@ -598,16 +390,9 @@ void __init time_init(void)
                 if (!mips_hpt_frequency)
                         mips_hpt_frequency = calibrate_hpt();
 
-                do_gettimeoffset = fixed_rate_gettimeoffset;
-
                 /* Calculate cache parameters.  */
                 cycles_per_jiffy = (mips_hpt_frequency + HZ / 2) / HZ;
 
-                /* sll32_usecs_per_cycle = 10^6 * 2^32 / mips_counter_freq  */
-                do_div64_32(sll32_usecs_per_cycle,
-                            1000000, mips_hpt_frequency / 2,
-                            mips_hpt_frequency);
-
                 /* Report the high precision timer rate for a reference.  */
                 printk("Using %u.%03u MHz high precision timer.\n",
                        ((mips_hpt_frequency + 500) / 1000) / 1000,
@@ -619,7 +404,7 @@ void __init time_init(void)
                 mips_timer_ack = null_timer_ack;
 
         /* This sets up the high precision timer for the first interrupt.  */
-        mips_hpt_init(mips_hpt_read());
+        mips_hpt_init();
 
         /*
          * Call board specific timer interrupt setup.
@@ -633,6 +418,8 @@ void __init time_init(void)
          * is not invoked accidentally.
          */
         plat_timer_setup(&timer_irqaction);
+
+        init_mips_clocksource();
 }
 
 #define FEBRUARY                2
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cce8313ec27d..9fda1b8be3a7 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1111,7 +1111,7 @@ static struct shadow_registers {
 static void mips_srs_init(void)
 {
         shadow_registers.sr_supported = ((read_c0_srsctl() >> 26) & 0x0f) + 1;
-        printk(KERN_INFO "%d MIPSR2 register sets available\n",
+        printk(KERN_INFO "%ld MIPSR2 register sets available\n",
                shadow_registers.sr_supported);
         shadow_registers.sr_allocated = 1;      /* Set 0 used by kernel */
 }
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index 0bb9cd889456..79f0317d84ac 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -50,6 +50,16 @@ SECTIONS
   /* writeable */
   .data : {                     /* Data */
     . = . + DATAOFFSET;         /* for CONFIG_MAPPED_KERNEL */
+    /*
+     * This ALIGN is needed as a workaround for a bug a gcc bug upto 4.1 which
+     * limits the maximum alignment to at most 32kB and results in the following
+     * warning:
+     *
+     *  CC      arch/mips/kernel/init_task.o
+     * arch/mips/kernel/init_task.c:30: warning: alignment of ‘init_thread_union’
+     * is greater than maximum object file alignment.  Using 32768
+     */
+    . = ALIGN(_PAGE_SIZE);
     *(.data.init_task)
 
     *(.data)
@@ -91,13 +101,7 @@ SECTIONS
 
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
 
diff --git a/arch/mips/lib-64/dump_tlb.c b/arch/mips/lib-64/dump_tlb.c
index be8261be679b..594df1a05ecc 100644
--- a/arch/mips/lib-64/dump_tlb.c
+++ b/arch/mips/lib-64/dump_tlb.c
@@ -149,7 +149,7 @@ void dump_list_process(struct task_struct *t, void *address)
         printk("Addr                 == %08lx\n", addr);
         printk("tasks->mm.pgd        == %08lx\n", (unsigned long) t->mm->pgd);
 
-        page_dir = pgd_offset(t->mm, 0);
+        page_dir = pgd_offset(t->mm, 0UL);
         printk("page_dir == %016lx\n", (unsigned long) page_dir);
 
         pgd = pgd_offset(t->mm, addr);
@@ -184,13 +184,13 @@ void dump_list_current(void *address)
         dump_list_process(current, address);
 }
 
-unsigned int vtop(void *address)
+unsigned long vtop(void *address)
 {
         pgd_t   *pgd;
         pud_t   *pud;
         pmd_t   *pmd;
         pte_t   *pte;
-        unsigned int addr, paddr;
+        unsigned long addr, paddr;
 
         addr = (unsigned long) address;
         pgd = pgd_offset(current->mm, addr);
diff --git a/arch/mips/mips-boards/generic/memory.c b/arch/mips/mips-boards/generic/memory.c
index be80c5dd4a0c..eeed944e0f83 100644
--- a/arch/mips/mips-boards/generic/memory.c
+++ b/arch/mips/mips-boards/generic/memory.c
@@ -176,7 +176,7 @@ unsigned long __init prom_free_prom_memory(void)
                 if (boot_mem_map.map[i].type != BOOT_MEM_ROM_DATA)
                         continue;
 
-                addr = boot_mem_map.map[i].addr;
+                addr = PAGE_ALIGN(boot_mem_map.map[i].addr);
                 while (addr < boot_mem_map.map[i].addr
                               + boot_mem_map.map[i].size) {
                         ClearPageReserved(virt_to_page(__va(addr)));
diff --git a/arch/mips/mips-boards/generic/pci.c b/arch/mips/mips-boards/generic/pci.c
index 9337f6c8873a..3192a14698c8 100644
--- a/arch/mips/mips-boards/generic/pci.c
+++ b/arch/mips/mips-boards/generic/pci.c
@@ -90,7 +90,7 @@ static struct pci_controller msc_controller = {
 void __init mips_pcibios_init(void)
 {
         struct pci_controller *controller;
-        unsigned long start, end, map, start1, end1, map1, map2, map3, mask;
+        resource_size_t start, end, map, start1, end1, map1, map2, map3, mask;
 
         switch (mips_revision_corid) {
         case MIPS_REVISION_CORID_QED_RM5261:
diff --git a/arch/mips/mips-boards/generic/time.c b/arch/mips/mips-boards/generic/time.c
index 6f8a9fe7c1e3..d817c60c5ca5 100644
--- a/arch/mips/mips-boards/generic/time.c
+++ b/arch/mips/mips-boards/generic/time.c
@@ -187,7 +187,7 @@ out:
 }
 
 /*
- * Estimate CPU frequency.  Sets mips_counter_frequency as a side-effect
+ * Estimate CPU frequency.  Sets mips_hpt_frequency as a side-effect
  */
 static unsigned int __init estimate_cpu_frequency(void)
 {
@@ -208,7 +208,8 @@ static unsigned int __init estimate_cpu_frequency(void)
                 count = 6000000;
 #endif
 #if defined(CONFIG_MIPS_ATLAS) || defined(CONFIG_MIPS_MALTA)
-        unsigned int flags;
+        unsigned long flags;
+        unsigned int start;
 
         local_irq_save(flags);
 
@@ -217,13 +218,13 @@ static unsigned int __init estimate_cpu_frequency(void)
         while (!(CMOS_READ(RTC_REG_A) & RTC_UIP));
 
         /* Start r4k counter. */
-        write_c0_count(0);
+        start = read_c0_count();
 
         /* Read counter exactly on falling edge of update flag */
         while (CMOS_READ(RTC_REG_A) & RTC_UIP);
         while (!(CMOS_READ(RTC_REG_A) & RTC_UIP));
 
-        count = read_c0_count();
+        count = read_c0_count() - start;
 
         /* restore interrupts */
         local_irq_restore(flags);
diff --git a/arch/mips/mips-boards/malta/malta_int.c b/arch/mips/mips-boards/malta/malta_int.c
index 6244d0e2c7de..90ad5bf3e2f1 100644
--- a/arch/mips/mips-boards/malta/malta_int.c
+++ b/arch/mips/mips-boards/malta/malta_int.c
@@ -32,6 +32,7 @@
 #include <asm/i8259.h>
 #include <asm/irq_cpu.h>
 #include <asm/io.h>
+#include <asm/irq_regs.h>
 #include <asm/mips-boards/malta.h>
 #include <asm/mips-boards/maltaint.h>
 #include <asm/mips-boards/piix4.h>
@@ -131,7 +132,7 @@ static void corehi_irqdispatch(void)
         unsigned int intedge, intsteer, pcicmd, pcibadaddr;
         unsigned int pcimstat, intisr, inten, intpol;
         unsigned int intrcause,datalo,datahi;
-        struct pt_regs *regs;
+        struct pt_regs *regs = get_irq_regs();
 
         printk("CoreHI interrupt, shouldn't happen, so we die here!!!\n");
         printk("epc   : %08lx\nStatus: %08lx\n"
diff --git a/arch/mips/mips-boards/sim/sim_time.c b/arch/mips/mips-boards/sim/sim_time.c
index c566b9bd0427..24a4ed00cc0a 100644
--- a/arch/mips/mips-boards/sim/sim_time.c
+++ b/arch/mips/mips-boards/sim/sim_time.c
@@ -102,7 +102,7 @@ irqreturn_t sim_timer_interrupt(int irq, void *dev_id)
 
 
 /*
- * Estimate CPU frequency.  Sets mips_counter_frequency as a side-effect
+ * Estimate CPU frequency.  Sets mips_hpt_frequency as a side-effect
  */
 static unsigned int __init estimate_cpu_frequency(void)
 {
diff --git a/arch/mips/mm/c-sb1.c b/arch/mips/mm/c-sb1.c
index 5537558f19f7..d0ddb4a768a5 100644
--- a/arch/mips/mm/c-sb1.c
+++ b/arch/mips/mm/c-sb1.c
@@ -49,6 +49,15 @@ static unsigned short dcache_sets;
 static unsigned int icache_range_cutoff;
 static unsigned int dcache_range_cutoff;
 
+static inline void sb1_on_each_cpu(void (*func) (void *info), void *info,
+                                   int retry, int wait)
+{
+        preempt_disable();
+        smp_call_function(func, info, retry, wait);
+        func(info);
+        preempt_enable();
+}
+
 /*
  * The dcache is fully coherent to the system, with one
  * big caveat:  the instruction stream.  In other words,
@@ -226,7 +235,7 @@ static void sb1_flush_cache_page(struct vm_area_struct *vma, unsigned long addr,
         args.vma = vma;
         args.addr = addr;
         args.pfn = pfn;
-        on_each_cpu(sb1_flush_cache_page_ipi, (void *) &args, 1, 1);
+        sb1_on_each_cpu(sb1_flush_cache_page_ipi, (void *) &args, 1, 1);
 }
 #else
 void sb1_flush_cache_page(struct vm_area_struct *vma, unsigned long addr, unsigned long pfn)
@@ -249,7 +258,7 @@ void sb1___flush_cache_all_ipi(void *ignored)
 
 static void sb1___flush_cache_all(void)
 {
-        on_each_cpu(sb1___flush_cache_all_ipi, 0, 1, 1);
+        sb1_on_each_cpu(sb1___flush_cache_all_ipi, 0, 1, 1);
 }
 #else
 void sb1___flush_cache_all(void)
@@ -299,7 +308,7 @@ void sb1_flush_icache_range(unsigned long start, unsigned long end)
 
         args.start = start;
         args.end = end;
-        on_each_cpu(sb1_flush_icache_range_ipi, &args, 1, 1);
+        sb1_on_each_cpu(sb1_flush_icache_range_ipi, &args, 1, 1);
 }
 #else
 void sb1_flush_icache_range(unsigned long start, unsigned long end)
@@ -326,7 +335,7 @@ static void sb1_flush_cache_sigtramp_ipi(void *info)
 
 static void sb1_flush_cache_sigtramp(unsigned long addr)
 {
-        on_each_cpu(sb1_flush_cache_sigtramp_ipi, (void *) addr, 1, 1);
+        sb1_on_each_cpu(sb1_flush_cache_sigtramp_ipi, (void *) addr, 1, 1);
 }
 #else
 void sb1_flush_cache_sigtramp(unsigned long addr)
@@ -444,7 +453,6 @@ static __init void probe_cache_sizes(void)
 void sb1_cache_init(void)
 {
         extern char except_vec2_sb1;
-        extern char handle_vec2_sb1;
 
         /* Special cache error handler for SB1 */
         set_uncached_handler (0x100, &except_vec2_sb1, 0x80);
@@ -497,5 +505,5 @@ void sb1_cache_init(void)
         :
         : "memory");
 
-        flush_cache_all();
+        local_sb1___flush_cache_all();
 }
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 88b72c9a8495..2de4d3c367a2 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -30,11 +30,34 @@
 #include <asm/cachectl.h>
 #include <asm/cpu.h>
 #include <asm/dma.h>
+#include <asm/kmap_types.h>
 #include <asm/mmu_context.h>
 #include <asm/sections.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
 #include <asm/tlb.h>
+#include <asm/fixmap.h>
+
+/* Atomicity and interruptability */
+#ifdef CONFIG_MIPS_MT_SMTC
+
+#include <asm/mipsmtregs.h>
+
+#define ENTER_CRITICAL(flags) \
+        { \
+        unsigned int mvpflags; \
+        local_irq_save(flags);\
+        mvpflags = dvpe()
+#define EXIT_CRITICAL(flags) \
+        evpe(mvpflags); \
+        local_irq_restore(flags); \
+        }
+#else
+
+#define ENTER_CRITICAL(flags) local_irq_save(flags)
+#define EXIT_CRITICAL(flags) local_irq_restore(flags)
+
+#endif /* CONFIG_MIPS_MT_SMTC */
 
 DEFINE_PER_CPU(struct mmu_gather, mmu_gathers);
 
@@ -80,13 +103,142 @@ unsigned long setup_zero_pages(void)
         return 1UL << order;
 }
 
-#ifdef CONFIG_HIGHMEM
-pte_t *kmap_pte;
-pgprot_t kmap_prot;
+/*
+ * These are almost like kmap_atomic / kunmap_atmic except they take an
+ * additional address argument as the hint.
+ */
 
 #define kmap_get_fixmap_pte(vaddr)                                      \
         pte_offset_kernel(pmd_offset(pud_offset(pgd_offset_k(vaddr), (vaddr)), (vaddr)), (vaddr))
 
+#ifdef CONFIG_MIPS_MT_SMTC
+static pte_t *kmap_coherent_pte;
+static void __init kmap_coherent_init(void)
+{
+        unsigned long vaddr;
+
+        /* cache the first coherent kmap pte */
+        vaddr = __fix_to_virt(FIX_CMAP_BEGIN);
+        kmap_coherent_pte = kmap_get_fixmap_pte(vaddr);
+}
+#else
+static inline void kmap_coherent_init(void) {}
+#endif
+
+static inline void *kmap_coherent(struct page *page, unsigned long addr)
+{
+        enum fixed_addresses idx;
+        unsigned long vaddr, flags, entrylo;
+        unsigned long old_ctx;
+        pte_t pte;
+        int tlbidx;
+
+        inc_preempt_count();
+        idx = (addr >> PAGE_SHIFT) & (FIX_N_COLOURS - 1);
+#ifdef CONFIG_MIPS_MT_SMTC
+        idx += FIX_N_COLOURS * smp_processor_id();
+#endif
+        vaddr = __fix_to_virt(FIX_CMAP_END - idx);
+        pte = mk_pte(page, PAGE_KERNEL);
+#if defined(CONFIG_64BIT_PHYS_ADDR) && defined(CONFIG_CPU_MIPS32_R1)
+        entrylo = pte.pte_high;
+#else
+        entrylo = pte_val(pte) >> 6;
+#endif
+
+        ENTER_CRITICAL(flags);
+        old_ctx = read_c0_entryhi();
+        write_c0_entryhi(vaddr & (PAGE_MASK << 1));
+        write_c0_entrylo0(entrylo);
+        write_c0_entrylo1(entrylo);
+#ifdef CONFIG_MIPS_MT_SMTC
+        set_pte(kmap_coherent_pte - (FIX_CMAP_END - idx), pte);
+        /* preload TLB instead of local_flush_tlb_one() */
+        mtc0_tlbw_hazard();
+        tlb_probe();
+        tlb_probe_hazard();
+        tlbidx = read_c0_index();
+        mtc0_tlbw_hazard();
+        if (tlbidx < 0)
+                tlb_write_random();
+        else
+                tlb_write_indexed();
+#else
+        tlbidx = read_c0_wired();
+        write_c0_wired(tlbidx + 1);
+        write_c0_index(tlbidx);
+        mtc0_tlbw_hazard();
+        tlb_write_indexed();
+#endif
+        tlbw_use_hazard();
+        write_c0_entryhi(old_ctx);
+        EXIT_CRITICAL(flags);
+
+        return (void*) vaddr;
+}
+
+#define UNIQUE_ENTRYHI(idx) (CKSEG0 + ((idx) << (PAGE_SHIFT + 1)))
+
+static inline void kunmap_coherent(struct page *page)
+{
+#ifndef CONFIG_MIPS_MT_SMTC
+        unsigned int wired;
+        unsigned long flags, old_ctx;
+
+        ENTER_CRITICAL(flags);
+        old_ctx = read_c0_entryhi();
+        wired = read_c0_wired() - 1;
+        write_c0_wired(wired);
+        write_c0_index(wired);
+        write_c0_entryhi(UNIQUE_ENTRYHI(wired));
+        write_c0_entrylo0(0);
+        write_c0_entrylo1(0);
+        mtc0_tlbw_hazard();
+        tlb_write_indexed();
+        tlbw_use_hazard();
+        write_c0_entryhi(old_ctx);
+        EXIT_CRITICAL(flags);
+#endif
+        dec_preempt_count();
+        preempt_check_resched();
+}
+
+void copy_to_user_page(struct vm_area_struct *vma,
+        struct page *page, unsigned long vaddr, void *dst, const void *src,
+        unsigned long len)
+{
+        if (cpu_has_dc_aliases) {
+                void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+                memcpy(vto, src, len);
+                kunmap_coherent(page);
+        } else
+                memcpy(dst, src, len);
+        if ((vma->vm_flags & VM_EXEC) && !cpu_has_ic_fills_f_dc)
+                flush_cache_page(vma, vaddr, page_to_pfn(page));
+}
+
+EXPORT_SYMBOL(copy_to_user_page);
+
+void copy_from_user_page(struct vm_area_struct *vma,
+        struct page *page, unsigned long vaddr, void *dst, const void *src,
+        unsigned long len)
+{
+        if (cpu_has_dc_aliases) {
+                void *vfrom =
+                        kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+                memcpy(dst, vfrom, len);
+                kunmap_coherent(page);
+        } else
+                memcpy(dst, src, len);
+}
+
+EXPORT_SYMBOL(copy_from_user_page);
+
+
+#ifdef CONFIG_HIGHMEM
+pte_t *kmap_pte;
+pgprot_t kmap_prot;
+
 static void __init kmap_init(void)
 {
         unsigned long kmap_vstart;
@@ -97,11 +249,12 @@ static void __init kmap_init(void)
 
         kmap_prot = PAGE_KERNEL;
 }
+#endif /* CONFIG_HIGHMEM */
 
-#ifdef CONFIG_32BIT
 void __init fixrange_init(unsigned long start, unsigned long end,
         pgd_t *pgd_base)
 {
+#if defined(CONFIG_HIGHMEM) || defined(CONFIG_MIPS_MT_SMTC)
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
@@ -122,7 +275,7 @@ void __init fixrange_init(unsigned long start, unsigned long end,
                         for (; (k < PTRS_PER_PMD) && (vaddr != end); pmd++, k++) {
                                 if (pmd_none(*pmd)) {
                                         pte = (pte_t *) alloc_bootmem_low_pages(PAGE_SIZE);
-                                        set_pmd(pmd, __pmd(pte));
+                                        set_pmd(pmd, __pmd((unsigned long)pte));
                                         if (pte != pte_offset_kernel(pmd, 0))
                                                 BUG();
                                 }
@@ -132,9 +285,8 @@ void __init fixrange_init(unsigned long start, unsigned long end,
                 }
                 j = 0;
         }
+#endif
 }
-#endif /* CONFIG_32BIT */
-#endif /* CONFIG_HIGHMEM */
 
 #ifndef CONFIG_NEED_MULTIPLE_NODES
 extern void pagetable_init(void);
@@ -175,6 +327,7 @@ void __init paging_init(void)
 #ifdef CONFIG_HIGHMEM
         kmap_init();
 #endif
+        kmap_coherent_init();
 
         max_dma = virt_to_phys((char *)MAX_DMA_ADDRESS) >> PAGE_SHIFT;
         low = max_low_pfn;
diff --git a/arch/mips/mm/ioremap.c b/arch/mips/mm/ioremap.c
index 3101d1db5592..cea7d0ea36e4 100644
--- a/arch/mips/mm/ioremap.c
+++ b/arch/mips/mm/ioremap.c
@@ -176,7 +176,7 @@ void __iomem * __ioremap(phys_t phys_addr, phys_t size, unsigned long flags)
 
 #define IS_KSEG1(addr) (((unsigned long)(addr) & ~0x1fffffffUL) == CKSEG1)
 
-void __iounmap(volatile void __iomem *addr)
+void __iounmap(const volatile void __iomem *addr)
 {
         struct vm_struct *p;
 
diff --git a/arch/mips/mm/pg-r4k.c b/arch/mips/mm/pg-r4k.c
index b7c749232ffe..d41fc5885e87 100644
--- a/arch/mips/mm/pg-r4k.c
+++ b/arch/mips/mm/pg-r4k.c
@@ -270,6 +270,20 @@ static inline void build_addiu_a2_a0(unsigned long offset)
         emit_instruction(mi);
 }
 
+static inline void build_addiu_a2(unsigned long offset)
+{
+        union mips_instruction mi;
+
+        BUG_ON(offset > 0x7fff);
+
+        mi.i_format.opcode     = cpu_has_64bit_gp_regs ? daddiu_op : addiu_op;
+        mi.i_format.rs         = 6;             /* $a2 */
+        mi.i_format.rt         = 6;             /* $a2 */
+        mi.i_format.simmediate = offset;
+
+        emit_instruction(mi);
+}
+
 static inline void build_addiu_a1(unsigned long offset)
 {
         union mips_instruction mi;
@@ -333,6 +347,7 @@ static inline void build_jr_ra(void)
 void __init build_clear_page(void)
 {
         unsigned int loop_start;
+        unsigned long off;
 
         epc = (unsigned int *) &clear_page_array;
         instruction_pending = 0;
@@ -369,7 +384,12 @@ void __init build_clear_page(void)
                 }
         }
 
-        build_addiu_a2_a0(PAGE_SIZE - (cpu_has_prefetch ? pref_offset_clear : 0));
+        off = PAGE_SIZE - (cpu_has_prefetch ? pref_offset_clear : 0);
+        if (off > 0x7fff) {
+                build_addiu_a2_a0(off >> 1);
+                build_addiu_a2(off >> 1);
+        } else
+                build_addiu_a2_a0(off);
 
         if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
                 build_insn_word(0x3c01a000);    /* lui     $at, 0xa000  */
@@ -420,12 +440,18 @@ dest = label();
 void __init build_copy_page(void)
 {
         unsigned int loop_start;
+        unsigned long off;
 
         epc = (unsigned int *) &copy_page_array;
         store_offset = load_offset = 0;
         instruction_pending = 0;
 
-        build_addiu_a2_a0(PAGE_SIZE - (cpu_has_prefetch ? pref_offset_copy : 0));
+        off = PAGE_SIZE - (cpu_has_prefetch ? pref_offset_copy : 0);
+        if (off > 0x7fff) {
+                build_addiu_a2_a0(off >> 1);
+                build_addiu_a2(off >> 1);
+        } else
+                build_addiu_a2_a0(off);
 
         if (R4600_V2_HIT_CACHEOP_WAR && cpu_is_r4600_v2_x())
                 build_insn_word(0x3c01a000);    /* lui     $at, 0xa000  */
diff --git a/arch/mips/mm/pgtable-32.c b/arch/mips/mm/pgtable-32.c
index 4bdaa05f485b..4a61e624b0ec 100644
--- a/arch/mips/mm/pgtable-32.c
+++ b/arch/mips/mm/pgtable-32.c
@@ -31,9 +31,10 @@ void pgd_init(unsigned long page)
 
 void __init pagetable_init(void)
 {
-#ifdef CONFIG_HIGHMEM
         unsigned long vaddr;
-        pgd_t *pgd, *pgd_base;
+        pgd_t *pgd_base;
+#ifdef CONFIG_HIGHMEM
+        pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
@@ -44,7 +45,6 @@ void __init pagetable_init(void)
         pgd_init((unsigned long)swapper_pg_dir
                  + sizeof(pgd_t) * USER_PTRS_PER_PGD);
 
-#ifdef CONFIG_HIGHMEM
         pgd_base = swapper_pg_dir;
 
         /*
@@ -53,6 +53,7 @@ void __init pagetable_init(void)
         vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
         fixrange_init(vaddr, 0, pgd_base);
 
+#ifdef CONFIG_HIGHMEM
         /*
          * Permanent kmaps:
          */
diff --git a/arch/mips/mm/pgtable-64.c b/arch/mips/mm/pgtable-64.c
index 44b5e97fff65..8d600d307d5d 100644
--- a/arch/mips/mm/pgtable-64.c
+++ b/arch/mips/mm/pgtable-64.c
@@ -8,6 +8,7 @@
  */
 #include <linux/init.h>
 #include <linux/mm.h>
+#include <asm/fixmap.h>
 #include <asm/pgtable.h>
 
 void pgd_init(unsigned long page)
@@ -52,7 +53,17 @@ void pmd_init(unsigned long addr, unsigned long pagetable)
 
 void __init pagetable_init(void)
 {
+        unsigned long vaddr;
+        pgd_t *pgd_base;
+
         /* Initialize the entire pgd.  */
         pgd_init((unsigned long)swapper_pg_dir);
         pmd_init((unsigned long)invalid_pmd_table, (unsigned long)invalid_pte_table);
+
+        pgd_base = swapper_pg_dir;
+        /*
+         * Fixed mappings:
+         */
+        vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK;
+        fixrange_init(vaddr, 0, pgd_base);
 }
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 6f8b25cfa6f0..fec318a1c8c5 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -102,7 +102,7 @@ enum opcode {
         insn_addu, insn_addiu, insn_and, insn_andi, insn_beq,
         insn_beql, insn_bgez, insn_bgezl, insn_bltz, insn_bltzl,
         insn_bne, insn_daddu, insn_daddiu, insn_dmfc0, insn_dmtc0,
-        insn_dsll, insn_dsll32, insn_dsra, insn_dsrl,
+        insn_dsll, insn_dsll32, insn_dsra, insn_dsrl, insn_dsrl32,
         insn_dsubu, insn_eret, insn_j, insn_jal, insn_jr, insn_ld,
         insn_ll, insn_lld, insn_lui, insn_lw, insn_mfc0, insn_mtc0,
         insn_ori, insn_rfe, insn_sc, insn_scd, insn_sd, insn_sll,
@@ -145,6 +145,7 @@ static __initdata struct insn insn_table[] = {
         { insn_dsll32, M(spec_op,0,0,0,0,dsll32_op), RT | RD | RE },
         { insn_dsra, M(spec_op,0,0,0,0,dsra_op), RT | RD | RE },
         { insn_dsrl, M(spec_op,0,0,0,0,dsrl_op), RT | RD | RE },
+        { insn_dsrl32, M(spec_op,0,0,0,0,dsrl32_op), RT | RD | RE },
         { insn_dsubu, M(spec_op,0,0,0,0,dsubu_op), RS | RT | RD },
         { insn_eret, M(cop0_op,cop_op,0,0,0,eret_op), 0 },
         { insn_j, M(j_op,0,0,0,0,0), JIMM },
@@ -385,6 +386,7 @@ I_u2u1u3(_dsll);
 I_u2u1u3(_dsll32);
 I_u2u1u3(_dsra);
 I_u2u1u3(_dsrl);
+I_u2u1u3(_dsrl32);
 I_u3u1u2(_dsubu);
 I_0(_eret);
 I_u1(_j);
@@ -996,7 +998,12 @@ build_get_pmde64(u32 **p, struct label **l, struct reloc **r,
 #endif
 
         l_vmalloc_done(l, *p);
-        i_dsrl(p, tmp, tmp, PGDIR_SHIFT-3); /* get pgd offset in bytes */
+
+        if (PGDIR_SHIFT - 3 < 32)               /* get pgd offset in bytes */
+                i_dsrl(p, tmp, tmp, PGDIR_SHIFT-3);
+        else
+                i_dsrl32(p, tmp, tmp, PGDIR_SHIFT - 3 - 32);
+
         i_andi(p, tmp, tmp, (PTRS_PER_PGD - 1)<<3);
         i_daddu(p, ptr, ptr, tmp); /* add in pgd offset */
         i_dmfc0(p, tmp, C0_BADVADDR); /* get faulting address */
@@ -1073,7 +1080,7 @@ build_get_pgde32(u32 **p, unsigned int tmp, unsigned int ptr)
 
 static __init void build_adjust_context(u32 **p, unsigned int ctx)
 {
-        unsigned int shift = 4 - (PTE_T_LOG2 + 1);
+        unsigned int shift = 4 - (PTE_T_LOG2 + 1) + PAGE_SHIFT - 12;
         unsigned int mask = (PTRS_PER_PTE / 2 - 1) << (PTE_T_LOG2 + 1);
 
         switch (current_cpu_data.cputype) {
diff --git a/arch/mips/momentum/ocelot_3/Makefile b/arch/mips/momentum/ocelot_3/Makefile
index 8bcea64dd27b..d5a090a85a15 100644
--- a/arch/mips/momentum/ocelot_3/Makefile
+++ b/arch/mips/momentum/ocelot_3/Makefile
@@ -5,4 +5,4 @@
 # removes any old dependencies. DON'T put your own dependencies here
 # unless it's something special (ie not a .c file).
 #
-obj-y    += irq.o prom.o reset.o setup.o
+obj-y    += irq.o platform.o prom.o reset.o setup.o
diff --git a/arch/mips/momentum/ocelot_3/ocelot_3_fpga.h b/arch/mips/momentum/ocelot_3/ocelot_3_fpga.h
index 227e429fe720..5710a9029f1c 100644
--- a/arch/mips/momentum/ocelot_3/ocelot_3_fpga.h
+++ b/arch/mips/momentum/ocelot_3/ocelot_3_fpga.h
@@ -51,7 +51,9 @@
 
 extern unsigned long ocelot_fpga_base;
 
-#define OCELOT_FPGA_WRITE(x, y) writeb(x, ocelot_fpga_base + OCELOT_3_REG_##y)
-#define OCELOT_FPGA_READ(x) readb(ocelot_fpga_base + OCELOT_3_REG_##x)
+#define __FPGA_REG_TO_ADDR(reg)                                         \
+        ((void *) ocelot_fpga_base + OCELOT_3_REG_##reg)
+#define OCELOT_FPGA_WRITE(x, reg) writeb(x, __FPGA_REG_TO_ADDR(reg))
+#define OCELOT_FPGA_READ(reg) readb(__FPGA_REG_TO_ADDR(reg))
 
 #endif
diff --git a/arch/mips/momentum/ocelot_3/platform.c b/arch/mips/momentum/ocelot_3/platform.c
new file mode 100644
index 000000000000..eefe5841fbb2
--- /dev/null
+++ b/arch/mips/momentum/ocelot_3/platform.c
@@ -0,0 +1,235 @@
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/ioport.h>
+#include <linux/mv643xx.h>
+#include <linux/platform_device.h>
+
+#include "ocelot_3_fpga.h"
+
+#if defined(CONFIG_MV643XX_ETH) || defined(CONFIG_MV643XX_ETH_MODULE)
+
+static struct resource mv643xx_eth_shared_resources[] = {
+        [0] = {
+                .name   = "ethernet shared base",
+                .start  = 0xf1000000 + MV643XX_ETH_SHARED_REGS,
+                .end    = 0xf1000000 + MV643XX_ETH_SHARED_REGS +
+                                       MV643XX_ETH_SHARED_REGS_SIZE - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+
+static struct platform_device mv643xx_eth_shared_device = {
+        .name           = MV643XX_ETH_SHARED_NAME,
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(mv643xx_eth_shared_resources),
+        .resource       = mv643xx_eth_shared_resources,
+};
+
+#define MV_SRAM_BASE                    0xfe000000UL
+#define MV_SRAM_SIZE                    (256 * 1024)
+
+#define MV_SRAM_RXRING_SIZE             (MV_SRAM_SIZE / 4)
+#define MV_SRAM_TXRING_SIZE             (MV_SRAM_SIZE / 4)
+
+#define MV_SRAM_BASE_ETH0               MV_SRAM_BASE
+#define MV_SRAM_BASE_ETH1               (MV_SRAM_BASE + (MV_SRAM_SIZE / 2))
+
+#define MV64x60_IRQ_ETH_0 48
+#define MV64x60_IRQ_ETH_1 49
+#define MV64x60_IRQ_ETH_2 50
+
+#ifdef CONFIG_MV643XX_ETH_0
+
+static struct resource mv64x60_eth0_resources[] = {
+        [0] = {
+                .name   = "eth0 irq",
+                .start  = MV64x60_IRQ_ETH_0,
+                .end    = MV64x60_IRQ_ETH_0,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static char eth0_mac_addr[ETH_ALEN];
+
+static struct mv643xx_eth_platform_data eth0_pd = {
+        .mac_addr       = eth0_mac_addr,
+
+        .tx_sram_addr   = MV_SRAM_BASE_ETH0,
+        .tx_sram_size   = MV_SRAM_TXRING_SIZE,
+        .tx_queue_size  = MV_SRAM_TXRING_SIZE / 16,
+
+        .rx_sram_addr   = MV_SRAM_BASE_ETH0 + MV_SRAM_TXRING_SIZE,
+        .rx_sram_size   = MV_SRAM_RXRING_SIZE,
+        .rx_queue_size  = MV_SRAM_RXRING_SIZE / 16,
+};
+
+static struct platform_device eth0_device = {
+        .name           = MV643XX_ETH_NAME,
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(mv64x60_eth0_resources),
+        .resource       = mv64x60_eth0_resources,
+        .dev = {
+                .platform_data = &eth0_pd,
+        },
+};
+#endif /* CONFIG_MV643XX_ETH_0 */
+
+#ifdef CONFIG_MV643XX_ETH_1
+
+static struct resource mv64x60_eth1_resources[] = {
+        [0] = {
+                .name   = "eth1 irq",
+                .start  = MV64x60_IRQ_ETH_1,
+                .end    = MV64x60_IRQ_ETH_1,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static char eth1_mac_addr[ETH_ALEN];
+
+static struct mv643xx_eth_platform_data eth1_pd = {
+        .mac_addr       = eth1_mac_addr,
+
+        .tx_sram_addr   = MV_SRAM_BASE_ETH1,
+        .tx_sram_size   = MV_SRAM_TXRING_SIZE,
+        .tx_queue_size  = MV_SRAM_TXRING_SIZE / 16,
+
+        .rx_sram_addr   = MV_SRAM_BASE_ETH1 + MV_SRAM_TXRING_SIZE,
+        .rx_sram_size   = MV_SRAM_RXRING_SIZE,
+        .rx_queue_size  = MV_SRAM_RXRING_SIZE / 16,
+};
+
+static struct platform_device eth1_device = {
+        .name           = MV643XX_ETH_NAME,
+        .id             = 1,
+        .num_resources  = ARRAY_SIZE(mv64x60_eth1_resources),
+        .resource       = mv64x60_eth1_resources,
+        .dev = {
+                .platform_data = &eth1_pd,
+        },
+};
+#endif /* CONFIG_MV643XX_ETH_1 */
+
+#ifdef CONFIG_MV643XX_ETH_2
+
+static struct resource mv64x60_eth2_resources[] = {
+        [0] = {
+                .name   = "eth2 irq",
+                .start  = MV64x60_IRQ_ETH_2,
+                .end    = MV64x60_IRQ_ETH_2,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static char eth2_mac_addr[ETH_ALEN];
+
+static struct mv643xx_eth_platform_data eth2_pd = {
+        .mac_addr       = eth2_mac_addr,
+};
+
+static struct platform_device eth2_device = {
+        .name           = MV643XX_ETH_NAME,
+        .id             = 1,
+        .num_resources  = ARRAY_SIZE(mv64x60_eth2_resources),
+        .resource       = mv64x60_eth2_resources,
+        .dev = {
+                .platform_data = &eth2_pd,
+        },
+};
+#endif /* CONFIG_MV643XX_ETH_2 */
+
+static struct platform_device *mv643xx_eth_pd_devs[] __initdata = {
+        &mv643xx_eth_shared_device,
+#ifdef CONFIG_MV643XX_ETH_0
+        &eth0_device,
+#endif
+#ifdef CONFIG_MV643XX_ETH_1
+        &eth1_device,
+#endif
+#ifdef CONFIG_MV643XX_ETH_2
+        &eth2_device,
+#endif
+};
+
+static u8 __init exchange_bit(u8 val, u8 cs)
+{
+        /* place the data */
+        OCELOT_FPGA_WRITE((val << 2) | cs, EEPROM_MODE);
+        udelay(1);
+
+        /* turn the clock on */
+        OCELOT_FPGA_WRITE((val << 2) | cs | 0x2, EEPROM_MODE);
+        udelay(1);
+
+        /* turn the clock off and read-strobe */
+        OCELOT_FPGA_WRITE((val << 2) | cs | 0x10, EEPROM_MODE);
+
+        /* return the data */
+        return (OCELOT_FPGA_READ(EEPROM_MODE) >> 3) & 0x1;
+}
+
+static void __init get_mac(char dest[6])
+{
+        u8 read_opcode[12] = {1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        int i,j;
+
+        for (i = 0; i < 12; i++)
+                exchange_bit(read_opcode[i], 1);
+
+        for (j = 0; j < 6; j++) {
+                dest[j] = 0;
+                for (i = 0; i < 8; i++) {
+                        dest[j] <<= 1;
+                        dest[j] |= exchange_bit(0, 1);
+                }
+        }
+
+        /* turn off CS */
+        exchange_bit(0,0);
+}
+
+/*
+ * Copy and increment ethernet MAC address by a small value.
+ *
+ * This is useful for systems where the only one MAC address is stored in
+ * non-volatile memory for multiple ports.
+ */
+static inline void eth_mac_add(unsigned char *dst, unsigned char *src,
+        unsigned int add)
+{
+        int i;
+
+        BUG_ON(add >= 256);
+
+        for (i = ETH_ALEN; i >= 0; i--) {
+                dst[i] = src[i] + add;
+                add = dst[i] < src[i];          /* compute carry */
+        }
+
+        WARN_ON(add);
+}
+
+static int __init mv643xx_eth_add_pds(void)
+{
+        unsigned char mac[ETH_ALEN];
+        int ret;
+
+        get_mac(mac);
+#ifdef CONFIG_MV643XX_ETH_0
+        eth_mac_add(eth1_mac_addr, mac, 0);
+#endif
+#ifdef CONFIG_MV643XX_ETH_1
+        eth_mac_add(eth1_mac_addr, mac, 1);
+#endif
+#ifdef CONFIG_MV643XX_ETH_2
+        eth_mac_add(eth2_mac_addr, mac, 2);
+#endif
+        ret = platform_add_devices(mv643xx_eth_pd_devs,
+                        ARRAY_SIZE(mv643xx_eth_pd_devs));
+
+        return ret;
+}
+
+device_initcall(mv643xx_eth_add_pds);
+
+#endif /* defined(CONFIG_MV643XX_ETH) || defined(CONFIG_MV643XX_ETH_MODULE) */
diff --git a/arch/mips/momentum/ocelot_3/prom.c b/arch/mips/momentum/ocelot_3/prom.c
index 296d945bc248..6ce9b7fdb824 100644
--- a/arch/mips/momentum/ocelot_3/prom.c
+++ b/arch/mips/momentum/ocelot_3/prom.c
@@ -34,64 +34,11 @@ struct callvectors* debug_vectors;
 extern unsigned long marvell_base;
 extern unsigned long cpu_clock;
 
-#ifdef CONFIG_MV643XX_ETH
-extern unsigned char prom_mac_addr_base[6];
-#endif
-
 const char *get_system_type(void)
 {
         return "Momentum Ocelot-3";
 }
 
-#ifdef CONFIG_MV643XX_ETH
-void burn_clocks(void)
-{
-        int i;
-
-        /* this loop should burn at least 1us -- this should be plenty */
-        for (i = 0; i < 0x10000; i++)
-                ;
-}
-
-u8 exchange_bit(u8 val, u8 cs)
-{
-        /* place the data */
-        OCELOT_FPGA_WRITE((val << 2) | cs, EEPROM_MODE);
-        burn_clocks();
-
-        /* turn the clock on */
-        OCELOT_FPGA_WRITE((val << 2) | cs | 0x2, EEPROM_MODE);
-        burn_clocks();
-
-        /* turn the clock off and read-strobe */
-        OCELOT_FPGA_WRITE((val << 2) | cs | 0x10, EEPROM_MODE);
-
-        /* return the data */
-        return ((OCELOT_FPGA_READ(EEPROM_MODE) >> 3) & 0x1);
-}
-
-void get_mac(char dest[6])
-{
-        u8 read_opcode[12] = {1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-        int i,j;
-
-        for (i = 0; i < 12; i++)
-                exchange_bit(read_opcode[i], 1);
-
-        for (j = 0; j < 6; j++) {
-                dest[j] = 0;
-                for (i = 0; i < 8; i++) {
-                        dest[j] <<= 1;
-                        dest[j] |= exchange_bit(0, 1);
-                }
-        }
-
-        /* turn off CS */
-        exchange_bit(0,0);
-}
-#endif
-
-
 #ifdef CONFIG_64BIT
 
 unsigned long signext(unsigned long addr)
@@ -228,11 +175,6 @@ void __init prom_init(void)
         mips_machgroup = MACH_GROUP_MOMENCO;
         mips_machtype = MACH_MOMENCO_OCELOT_3;
 
-#ifdef CONFIG_MV643XX_ETH
-        /* get the base MAC address for on-board ethernet ports */
-        get_mac(prom_mac_addr_base);
-#endif
-
 #ifndef CONFIG_64BIT
         debug_vectors->printf("Booting Linux kernel...\n");
 #endif
diff --git a/arch/mips/momentum/ocelot_3/setup.c b/arch/mips/momentum/ocelot_3/setup.c
index 7d74f8c54129..ff0829f81116 100644
--- a/arch/mips/momentum/ocelot_3/setup.c
+++ b/arch/mips/momentum/ocelot_3/setup.c
@@ -4,7 +4,7 @@
  * BRIEF MODULE DESCRIPTION
  * Momentum Computer Ocelot-3 board dependent boot routines
  *
- * Copyright (C) 1996, 1997, 01, 05  Ralf Baechle
+ * Copyright (C) 1996, 1997, 01, 05 - 06  Ralf Baechle
  * Copyright (C) 2000 RidgeRun, Inc.
  * Copyright (C) 2001 Red Hat, Inc.
  * Copyright (C) 2002 Momentum Computer
diff --git a/arch/mips/momentum/ocelot_c/Makefile b/arch/mips/momentum/ocelot_c/Makefile
index 94802b4db472..d69161aa1675 100644
--- a/arch/mips/momentum/ocelot_c/Makefile
+++ b/arch/mips/momentum/ocelot_c/Makefile
@@ -2,7 +2,7 @@
 # Makefile for Momentum Computer's Ocelot-C and -CS boards.
 #
 
-obj-y                   += cpci-irq.o irq.o prom.o reset.o \
+obj-y                   += cpci-irq.o irq.o platform.o prom.o reset.o \
                            setup.o uart-irq.o
 
 obj-$(CONFIG_KGDB)      += dbg_io.o
diff --git a/arch/mips/momentum/ocelot_c/ocelot_c_fpga.h b/arch/mips/momentum/ocelot_c/ocelot_c_fpga.h
index 7228cd19e5ea..f0f5581dcb50 100644
--- a/arch/mips/momentum/ocelot_c/ocelot_c_fpga.h
+++ b/arch/mips/momentum/ocelot_c/ocelot_c_fpga.h
@@ -53,7 +53,9 @@
 #define OCELOT_C_REG_INTSET             0xe
 #define OCELOT_C_REG_INTCLR             0xf
 
-#define OCELOT_FPGA_WRITE(x, y) writeb(x, OCELOT_C_CS0_ADDR + OCELOT_C_REG_##y)
-#define OCELOT_FPGA_READ(x) readb(OCELOT_C_CS0_ADDR + OCELOT_C_REG_##x)
+#define __FPGA_REG_TO_ADDR(reg)                                         \
+        ((void *) OCELOT_C_CS0_ADDR + OCELOT_C_REG_##reg)
+#define OCELOT_FPGA_WRITE(x, reg) writeb(x, __FPGA_REG_TO_ADDR(reg))
+#define OCELOT_FPGA_READ(reg) readb(__FPGA_REG_TO_ADDR(reg))
 
 #endif
diff --git a/arch/mips/momentum/ocelot_c/platform.c b/arch/mips/momentum/ocelot_c/platform.c
new file mode 100644
index 000000000000..6c495b2f1560
--- /dev/null
+++ b/arch/mips/momentum/ocelot_c/platform.c
@@ -0,0 +1,201 @@
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/ioport.h>
+#include <linux/mv643xx.h>
+#include <linux/platform_device.h>
+
+#include "ocelot_c_fpga.h"
+
+#if defined(CONFIG_MV643XX_ETH) || defined(CONFIG_MV643XX_ETH_MODULE)
+
+static struct resource mv643xx_eth_shared_resources[] = {
+        [0] = {
+                .name   = "ethernet shared base",
+                .start  = 0xf1000000 + MV643XX_ETH_SHARED_REGS,
+                .end    = 0xf1000000 + MV643XX_ETH_SHARED_REGS +
+                                       MV643XX_ETH_SHARED_REGS_SIZE - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+};
+
+static struct platform_device mv643xx_eth_shared_device = {
+        .name           = MV643XX_ETH_SHARED_NAME,
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(mv643xx_eth_shared_resources),
+        .resource       = mv643xx_eth_shared_resources,
+};
+
+#define MV_SRAM_BASE                    0xfe000000UL
+#define MV_SRAM_SIZE                    (256 * 1024)
+
+#define MV_SRAM_RXRING_SIZE             (MV_SRAM_SIZE / 4)
+#define MV_SRAM_TXRING_SIZE             (MV_SRAM_SIZE / 4)
+
+#define MV_SRAM_BASE_ETH0               MV_SRAM_BASE
+#define MV_SRAM_BASE_ETH1               (MV_SRAM_BASE + (MV_SRAM_SIZE / 2))
+
+#define MV64x60_IRQ_ETH_0 48
+#define MV64x60_IRQ_ETH_1 49
+
+#ifdef CONFIG_MV643XX_ETH_0
+
+static struct resource mv64x60_eth0_resources[] = {
+        [0] = {
+                .name   = "eth0 irq",
+                .start  = MV64x60_IRQ_ETH_0,
+                .end    = MV64x60_IRQ_ETH_0,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static char eth0_mac_addr[ETH_ALEN];
+
+static struct mv643xx_eth_platform_data eth0_pd = {
+        .mac_addr       = eth0_mac_addr,
+
+        .tx_sram_addr   = MV_SRAM_BASE_ETH0,
+        .tx_sram_size   = MV_SRAM_TXRING_SIZE,
+        .tx_queue_size  = MV_SRAM_TXRING_SIZE / 16,
+
+        .rx_sram_addr   = MV_SRAM_BASE_ETH0 + MV_SRAM_TXRING_SIZE,
+        .rx_sram_size   = MV_SRAM_RXRING_SIZE,
+        .rx_queue_size  = MV_SRAM_RXRING_SIZE / 16,
+};
+
+static struct platform_device eth0_device = {
+        .name           = MV643XX_ETH_NAME,
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(mv64x60_eth0_resources),
+        .resource       = mv64x60_eth0_resources,
+        .dev = {
+                .platform_data = &eth0_pd,
+        },
+};
+#endif /* CONFIG_MV643XX_ETH_0 */
+
+#ifdef CONFIG_MV643XX_ETH_1
+
+static struct resource mv64x60_eth1_resources[] = {
+        [0] = {
+                .name   = "eth1 irq",
+                .start  = MV64x60_IRQ_ETH_1,
+                .end    = MV64x60_IRQ_ETH_1,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static char eth1_mac_addr[ETH_ALEN];
+
+static struct mv643xx_eth_platform_data eth1_pd = {
+        .mac_addr       = eth1_mac_addr,
+
+        .tx_sram_addr   = MV_SRAM_BASE_ETH1,
+        .tx_sram_size   = MV_SRAM_TXRING_SIZE,
+        .tx_queue_size  = MV_SRAM_TXRING_SIZE / 16,
+
+        .rx_sram_addr   = MV_SRAM_BASE_ETH1 + MV_SRAM_TXRING_SIZE,
+        .rx_sram_size   = MV_SRAM_RXRING_SIZE,
+        .rx_queue_size  = MV_SRAM_RXRING_SIZE / 16,
+};
+
+static struct platform_device eth1_device = {
+        .name           = MV643XX_ETH_NAME,
+        .id             = 1,
+        .num_resources  = ARRAY_SIZE(mv64x60_eth1_resources),
+        .resource       = mv64x60_eth1_resources,
+        .dev = {
+                .platform_data = &eth1_pd,
+        },
+};
+#endif /* CONFIG_MV643XX_ETH_1 */
+
+static struct platform_device *mv643xx_eth_pd_devs[] __initdata = {
+        &mv643xx_eth_shared_device,
+#ifdef CONFIG_MV643XX_ETH_0
+        &eth0_device,
+#endif
+#ifdef CONFIG_MV643XX_ETH_1
+        &eth1_device,
+#endif
+        /* The third port is not wired up on the Ocelot C */
+};
+
+static u8 __init exchange_bit(u8 val, u8 cs)
+{
+        /* place the data */
+        OCELOT_FPGA_WRITE((val << 2) | cs, EEPROM_MODE);
+        udelay(1);
+
+        /* turn the clock on */
+        OCELOT_FPGA_WRITE((val << 2) | cs | 0x2, EEPROM_MODE);
+        udelay(1);
+
+        /* turn the clock off and read-strobe */
+        OCELOT_FPGA_WRITE((val << 2) | cs | 0x10, EEPROM_MODE);
+
+        /* return the data */
+        return (OCELOT_FPGA_READ(EEPROM_MODE) >> 3) & 0x1;
+}
+
+static void __init get_mac(char dest[6])
+{
+        u8 read_opcode[12] = {1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+        int i,j;
+
+        for (i = 0; i < 12; i++)
+                exchange_bit(read_opcode[i], 1);
+
+        for (j = 0; j < 6; j++) {
+                dest[j] = 0;
+                for (i = 0; i < 8; i++) {
+                        dest[j] <<= 1;
+                        dest[j] |= exchange_bit(0, 1);
+                }
+        }
+
+        /* turn off CS */
+        exchange_bit(0,0);
+}
+
+/*
+ * Copy and increment ethernet MAC address by a small value.
+ *
+ * This is useful for systems where the only one MAC address is stored in
+ * non-volatile memory for multiple ports.
+ */
+static inline void eth_mac_add(unsigned char *dst, unsigned char *src,
+        unsigned int add)
+{
+        int i;
+
+        BUG_ON(add >= 256);
+
+        for (i = ETH_ALEN; i >= 0; i--) {
+                dst[i] = src[i] + add;
+                add = dst[i] < src[i];          /* compute carry */
+        }
+
+        WARN_ON(add);
+}
+
+static int __init mv643xx_eth_add_pds(void)
+{
+        unsigned char mac[ETH_ALEN];
+        int ret;
+
+        get_mac(mac);
+#ifdef CONFIG_MV643XX_ETH_0
+        eth_mac_add(eth1_mac_addr, mac, 0);
+#endif
+#ifdef CONFIG_MV643XX_ETH_1
+        eth_mac_add(eth1_mac_addr, mac, 1);
+#endif
+        ret = platform_add_devices(mv643xx_eth_pd_devs,
+                        ARRAY_SIZE(mv643xx_eth_pd_devs));
+
+        return ret;
+}
+
+device_initcall(mv643xx_eth_add_pds);
+
+#endif /* defined(CONFIG_MV643XX_ETH) || defined(CONFIG_MV643XX_ETH_MODULE) */
diff --git a/arch/mips/momentum/ocelot_c/prom.c b/arch/mips/momentum/ocelot_c/prom.c
index 4c50a147f429..d0b77e101d74 100644
--- a/arch/mips/momentum/ocelot_c/prom.c
+++ b/arch/mips/momentum/ocelot_c/prom.c
@@ -29,11 +29,7 @@
 struct callvectors* debug_vectors;
 
 extern unsigned long marvell_base;
-extern unsigned long cpu_clock;
-
-#ifdef CONFIG_MV643XX_ETH
-extern unsigned char prom_mac_addr_base[6];
-#endif
+extern unsigned int cpu_clock;
 
 const char *get_system_type(void)
 {
@@ -44,55 +40,6 @@ const char *get_system_type(void)
 #endif
 }
 
-#ifdef CONFIG_MV643XX_ETH
-static void burn_clocks(void)
-{
-        int i;
-
-        /* this loop should burn at least 1us -- this should be plenty */
-        for (i = 0; i < 0x10000; i++)
-                ;
-}
-
-static u8 exchange_bit(u8 val, u8 cs)
-{
-        /* place the data */
-        OCELOT_FPGA_WRITE((val << 2) | cs, EEPROM_MODE);
-        burn_clocks();
-
-        /* turn the clock on */
-        OCELOT_FPGA_WRITE((val << 2) | cs | 0x2, EEPROM_MODE);
-        burn_clocks();
-
-        /* turn the clock off and read-strobe */
-        OCELOT_FPGA_WRITE((val << 2) | cs | 0x10, EEPROM_MODE);
-
-        /* return the data */
-        return ((OCELOT_FPGA_READ(EEPROM_MODE) >> 3) & 0x1);
-}
-
-void get_mac(char dest[6])
-{
-        u8 read_opcode[12] = {1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
-        int i,j;
-
-        for (i = 0; i < 12; i++)
-                exchange_bit(read_opcode[i], 1);
-
-        for (j = 0; j < 6; j++) {
-                dest[j] = 0;
-                for (i = 0; i < 8; i++) {
-                        dest[j] <<= 1;
-                        dest[j] |= exchange_bit(0, 1);
-                }
-        }
-
-        /* turn off CS */
-        exchange_bit(0,0);
-}
-#endif
-
-
 #ifdef CONFIG_64BIT
 
 unsigned long signext(unsigned long addr)
@@ -226,11 +173,6 @@ void __init prom_init(void)
         mips_machgroup = MACH_GROUP_MOMENCO;
         mips_machtype = MACH_MOMENCO_OCELOT_C;
 
-#ifdef CONFIG_MV643XX_ETH
-        /* get the base MAC address for on-board ethernet ports */
-        get_mac(prom_mac_addr_base);
-#endif
-
 #ifndef CONFIG_64BIT
         debug_vectors->printf("Booting Linux kernel...\n");
 #endif
diff --git a/arch/mips/momentum/ocelot_c/setup.c b/arch/mips/momentum/ocelot_c/setup.c
index 9c0c462af650..0b6b2338cfb4 100644
--- a/arch/mips/momentum/ocelot_c/setup.c
+++ b/arch/mips/momentum/ocelot_c/setup.c
@@ -69,8 +69,7 @@
 #include "ocelot_c_fpga.h"
 
 unsigned long marvell_base;
-extern unsigned long mv64340_sram_base;
-unsigned long cpu_clock;
+unsigned int cpu_clock;
 
 /* These functions are used for rebooting or halting the machine*/
 extern void momenco_ocelot_restart(char *command);
@@ -119,7 +118,6 @@ void PMON_v2_setup(void)
         add_wired_entry(ENTRYLO(0xfe000000), ENTRYLO(0xff000000), 0xfffffffffe000000, PM_16M);
 
         marvell_base = 0xfffffffff4000000;
-        mv64340_sram_base = 0xfffffffffe000000;
 #else
         /* marvell and extra space */
         add_wired_entry(ENTRYLO(0xf4000000), ENTRYLO(0xf4010000), 0xf4000000, PM_64K);
@@ -129,7 +127,6 @@ void PMON_v2_setup(void)
         add_wired_entry(ENTRYLO(0xfe000000), ENTRYLO(0xff000000), 0xfe000000, PM_16M);
 
         marvell_base = 0xf4000000;
-        mv64340_sram_base = 0xfe000000;
 #endif
 }
 
@@ -346,22 +343,20 @@ void __init plat_mem_setup(void)
         }
 }
 
-#ifndef CONFIG_64BIT
-/* This needs to be one of the first initcalls, because no I/O port access
-   can work before this */
+/*
+ * This needs to be one of the first initcalls, because no I/O port access
+ * can work before this
+ */
 static int io_base_ioremap(void)
 {
-        /* we're mapping PCI accesses from 0xc0000000 to 0xf0000000 */
-        void *io_remap_range = ioremap(0xc0000000, 0x30000000);
+        void __iomem * io_remap_range = ioremap(0xc0000000UL, 0x10000);
 
-        if (!io_remap_range) {
+        if (!io_remap_range)
                 panic("Could not ioremap I/O port range");
-        }
-        printk("io_remap_range set at 0x%08x\n", (uint32_t)io_remap_range);
-        set_io_port_base(io_remap_range - 0xc0000000);
+
+        set_io_port_base((unsigned long) io_remap_range);
 
         return 0;
 }
 
 module_init(io_base_ioremap);
-#endif
diff --git a/arch/mips/momentum/ocelot_g/gt-irq.c b/arch/mips/momentum/ocelot_g/gt-irq.c
index 7b5cc6648f7e..e5576bd50fa9 100644
--- a/arch/mips/momentum/ocelot_g/gt-irq.c
+++ b/arch/mips/momentum/ocelot_g/gt-irq.c
@@ -27,7 +27,7 @@ unsigned long bus_clock;
  * be handled and ack'ed differently than other MIPS interrupts.
  */
 
-#if CURRENTLY_UNUSED
+#if 0
 
 struct tq_struct irq_handlers[MAX_CAUSE_REGS][MAX_CAUSE_REG_WIDTH];
 void hook_irq_handler(int int_cause, int bit_num, void *isr_ptr);
@@ -95,7 +95,7 @@ int disable_galileo_irq(int int_cause, int bit_num)
                 return 0;
         return 1;
 }
-#endif                          /*  UNUSED  */
+#endif /* 0 */
 
 /*
  * Interrupt handler for interrupts coming from the Galileo chip via P0_INT#.
@@ -196,7 +196,7 @@ void gt64240_time_init(void)
 
 void gt64240_irq_init(void)
 {
-#if CURRENTLY_UNUSED
+#if 0
         int i, j;
 
         /* Reset irq handlers pointers to NULL */
@@ -208,5 +208,5 @@ void gt64240_irq_init(void)
                         irq_handlers[i][j].data = NULL;
                 }
         }
-#endif
+#endif /* 0 */
 }
diff --git a/arch/mips/momentum/ocelot_g/ocelot_pld.h b/arch/mips/momentum/ocelot_g/ocelot_pld.h
index fcb8275e219d..95e0534026d0 100644
--- a/arch/mips/momentum/ocelot_g/ocelot_pld.h
+++ b/arch/mips/momentum/ocelot_g/ocelot_pld.h
@@ -23,8 +23,8 @@
 #define OCELOT_REG_INTSET (12)
 #define OCELOT_REG_INTCLR (13)
 
-#define OCELOT_PLD_WRITE(x, y) writeb(x, OCELOT_CS0_ADDR + OCELOT_REG_##y)
-#define OCELOT_PLD_READ(x) readb(OCELOT_CS0_ADDR + OCELOT_REG_##x)
-
+#define __PLD_REG_TO_ADDR(reg) ((void *) OCELOT_CS0_ADDR + OCELOT_REG_##reg)
+#define OCELOT_PLD_WRITE(x, reg) writeb(x, __PLD_REG_TO_ADDR(reg))
+#define OCELOT_PLD_READ(reg) readb(__PLD_REG_TO_ADDR(reg))
 
 #endif /* __MOMENCO_OCELOT_PLD_H__ */
diff --git a/arch/mips/momentum/ocelot_g/setup.c b/arch/mips/momentum/ocelot_g/setup.c
index 56ec47039c16..d288f7b01842 100644
--- a/arch/mips/momentum/ocelot_g/setup.c
+++ b/arch/mips/momentum/ocelot_g/setup.c
@@ -57,6 +57,7 @@
 #include <asm/gt64240.h>
 #include <asm/irq.h>
 #include <asm/pci.h>
+#include <asm/pgtable.h>
 #include <asm/processor.h>
 #include <asm/reboot.h>
 #include <linux/bootmem.h>
@@ -160,6 +161,10 @@ static void __init setup_l3cache(unsigned long size)
         printk("Done\n");
 }
 
+void __init plat_timer_setup(struct irqaction *irq)
+{
+}
+
 void __init plat_mem_setup(void)
 {
         void (*l3func)(unsigned long) = (void *) KSEG1ADDR(setup_l3cache);
diff --git a/arch/mips/oprofile/op_impl.h b/arch/mips/oprofile/op_impl.h
index 354e54496406..fa6b4aae7523 100644
--- a/arch/mips/oprofile/op_impl.h
+++ b/arch/mips/oprofile/op_impl.h
@@ -10,8 +10,6 @@
 #ifndef OP_IMPL_H
 #define OP_IMPL_H 1
 
-struct pt_regs;
-
 extern int null_perf_irq(void);
 extern int (*perf_irq)(void);
 
diff --git a/arch/mips/oprofile/op_model_mipsxx.c b/arch/mips/oprofile/op_model_mipsxx.c
index dd0aec9c3ce1..1fb240c57bac 100644
--- a/arch/mips/oprofile/op_model_mipsxx.c
+++ b/arch/mips/oprofile/op_model_mipsxx.c
@@ -31,16 +31,18 @@
 #define M_COUNTER_OVERFLOW              (1UL      << 31)
 
 #ifdef CONFIG_MIPS_MT_SMP
-#define WHAT    (M_TC_EN_VPE | M_PERFCTL_VPEID(smp_processor_id()))
+#define WHAT            (M_TC_EN_VPE | M_PERFCTL_VPEID(smp_processor_id()))
+#define vpe_id()        smp_processor_id()
 #else
-#define WHAT    0
+#define WHAT            0
+#define vpe_id()        smp_processor_id()
 #endif
 
 #define __define_perf_accessors(r, n, np)                               \
                                                                         \
 static inline unsigned int r_c0_ ## r ## n(void)                        \
 {                                                                       \
-        unsigned int cpu = smp_processor_id();                          \
+        unsigned int cpu = vpe_id();                                    \
                                                                         \
         switch (cpu) {                                                  \
         case 0:                                                         \
@@ -55,7 +57,7 @@ static inline unsigned int r_c0_ ## r ## n(void)			\
                                                                         \
 static inline void w_c0_ ## r ## n(unsigned int value)                  \
 {                                                                       \
-        unsigned int cpu = smp_processor_id();                          \
+        unsigned int cpu = vpe_id();                                    \
                                                                         \
         switch (cpu) {                                                  \
         case 0:                                                         \
@@ -218,7 +220,7 @@ static inline int n_counters(void)
 {
         int counters = __n_counters();
 
-#ifndef CONFIG_SMP
+#ifdef CONFIG_MIPS_MT_SMP
         if (current_cpu_data.cputype == CPU_34K)
                 return counters >> 1;
 #endif
diff --git a/arch/mips/oprofile/op_model_rm9000.c b/arch/mips/oprofile/op_model_rm9000.c
index b7063fefa65b..7dc9bf6f1321 100644
--- a/arch/mips/oprofile/op_model_rm9000.c
+++ b/arch/mips/oprofile/op_model_rm9000.c
@@ -80,8 +80,7 @@ static void rm9000_cpu_stop(void *args)
         write_c0_perfcontrol(0);
 }
 
-static irqreturn_t rm9000_perfcount_handler(int irq, void * dev_id,
-        struct pt_regs *regs)
+static irqreturn_t rm9000_perfcount_handler(int irq, void * dev_id)
 {
         unsigned int control = read_c0_perfcontrol();
         uint32_t counter1, counter2;
diff --git a/arch/mips/pci/Makefile b/arch/mips/pci/Makefile
index 3cf0dd4ba548..70cb55b89df6 100644
--- a/arch/mips/pci/Makefile
+++ b/arch/mips/pci/Makefile
@@ -26,7 +26,7 @@ obj-$(CONFIG_DDB5477)		+= fixup-ddb5477.o pci-ddb5477.o ops-ddb5477.o
 obj-$(CONFIG_LASAT)             += pci-lasat.o
 obj-$(CONFIG_MIPS_ATLAS)        += fixup-atlas.o
 obj-$(CONFIG_MIPS_COBALT)       += fixup-cobalt.o
-obj-$(CONFIG_MIPS_EV64120)      += fixup-ev64120.o
+obj-$(CONFIG_MIPS_EV64120)      += pci-ev64120.o
 obj-$(CONFIG_SOC_AU1500)        += fixup-au1000.o ops-au1000.o
 obj-$(CONFIG_SOC_AU1550)        += fixup-au1000.o ops-au1000.o
 obj-$(CONFIG_SOC_PNX8550)       += fixup-pnx8550.o ops-pnx8550.o
diff --git a/arch/mips/pci/fixup-ev64120.c b/arch/mips/pci/fixup-ev64120.c
deleted file mode 100644
index 8dbb90d63f0a..000000000000
--- a/arch/mips/pci/fixup-ev64120.c
+++ /dev/null
@@ -1,34 +0,0 @@
-#include <linux/pci.h>
-#include <linux/init.h>
-
-int pci_range_ck(unsigned char bus, unsigned char dev)
-{
-        if (((bus == 0) || (bus == 1)) && (dev >= 6) && (dev <= 8))
-                return 0;
-
-        return -1;
-}
-
-/*
- * After detecting all agents over the PCI , this function is called
- * in order to give an interrupt number for each PCI device starting
- * from IRQ 20. It does also enables master for each device.
- */
-void __devinit pcibios_fixup_bus(struct pci_bus *bus)
-{
-        unsigned int irq = 20;
-        struct pci_bus *current_bus = bus;
-        struct pci_dev *dev;
-        struct list_head *devices_link;
-
-        list_for_each(devices_link, &(current_bus->devices)) {
-                dev = pci_dev_b(devices_link);
-                if (dev != NULL) {
-                        dev->irq = irq++;
-
-                        /* Assign an interrupt number for the device */
-                        pci_write_config_byte(dev, PCI_INTERRUPT_LINE, irq);
-                        pcibios_set_master(dev);
-                }
-        }
-}
diff --git a/arch/mips/pci/pci-ev64120.c b/arch/mips/pci/pci-ev64120.c
new file mode 100644
index 000000000000..9cd859ef1842
--- /dev/null
+++ b/arch/mips/pci/pci-ev64120.c
@@ -0,0 +1,21 @@
+#include <linux/pci.h>
+
+int __init pcibios_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
+{
+        int irq;
+
+        if (!pin)
+                return 0;
+
+        irq = allocate_irqno();
+        if (irq < 0)
+                return 0;
+
+        return irq;
+}
+
+/* Do platform specific device initialization at pci_enable_device() time */
+int pcibios_plat_dev_init(struct pci_dev *dev)
+{
+        return 0;
+}
diff --git a/arch/mips/philips/pnx8550/common/time.c b/arch/mips/philips/pnx8550/common/time.c
index 0af655b1f330..65c440e8480b 100644
--- a/arch/mips/philips/pnx8550/common/time.c
+++ b/arch/mips/philips/pnx8550/common/time.c
@@ -41,8 +41,8 @@ extern unsigned int mips_hpt_frequency;
  * 1) board_time_init() -
  *      a) (optional) set up RTC routines,
  *      b) (optional) calibrate and set the mips_hpt_frequency
- *          (only needed if you intended to use fixed_rate_gettimeoffset
- *           or use cpu counter as timer interrupt source)
+ *          (only needed if you intended to use cpu counter as timer interrupt
+ *           source)
  */
 
 void pnx8550_time_init(void)
diff --git a/arch/mips/pmc-sierra/yosemite/i2c-yosemite.c b/arch/mips/pmc-sierra/yosemite/i2c-yosemite.c
index 416da22b3bf4..85b14c73c226 100644
--- a/arch/mips/pmc-sierra/yosemite/i2c-yosemite.c
+++ b/arch/mips/pmc-sierra/yosemite/i2c-yosemite.c
@@ -74,7 +74,7 @@ static int titan_i2c_poll(void)
 int titan_i2c_xfer(unsigned int slave_addr, titan_i2c_command * cmd,
                    int size, unsigned int *addr)
 {
-        int loop = 0, bytes, i;
+        int loop, bytes = 0, i;
         unsigned int *write_data, data, *read_data;
         unsigned long reg_val, val;
 
diff --git a/arch/mips/pmc-sierra/yosemite/smp.c b/arch/mips/pmc-sierra/yosemite/smp.c
index 65fa3a23ea5e..3cc0436db6cf 100644
--- a/arch/mips/pmc-sierra/yosemite/smp.c
+++ b/arch/mips/pmc-sierra/yosemite/smp.c
@@ -3,9 +3,7 @@
 
 #include <asm/pmon.h>
 #include <asm/titan_dep.h>
-
-extern unsigned int (*mips_hpt_read)(void);
-extern void (*mips_hpt_init)(unsigned int);
+#include <asm/time.h>
 
 #define LAUNCHSTACK_SIZE 256
 
@@ -101,7 +99,7 @@ void prom_cpus_done(void)
  */
 void prom_init_secondary(void)
 {
-        mips_hpt_init(mips_hpt_read());
+        mips_hpt_init();
 
         set_c0_status(ST0_CO | ST0_IE | ST0_IM);
 }
diff --git a/arch/mips/sgi-ip27/ip27-irq.c b/arch/mips/sgi-ip27/ip27-irq.c
index f01ba1f90770..270ecd3e6b4a 100644
--- a/arch/mips/sgi-ip27/ip27-irq.c
+++ b/arch/mips/sgi-ip27/ip27-irq.c
@@ -354,29 +354,6 @@ static struct irq_chip bridge_irq_type = {
         .end            = end_bridge_irq,
 };
 
-static unsigned long irq_map[NR_IRQS / BITS_PER_LONG];
-
-int allocate_irqno(void)
-{
-        int irq;
-
-again:
-        irq = find_first_zero_bit(irq_map, NR_IRQS);
-
-        if (irq >= NR_IRQS)
-                return -ENOSPC;
-
-        if (test_and_set_bit(irq, irq_map))
-                goto again;
-
-        return irq;
-}
-
-void free_irqno(unsigned int irq)
-{
-        clear_bit(irq, irq_map);
-}
-
 void __devinit register_bridge_irq(unsigned int irq)
 {
         irq_desc[irq].status    = IRQ_DISABLED;
diff --git a/arch/mips/sgi-ip27/ip27-klnuma.c b/arch/mips/sgi-ip27/ip27-klnuma.c
index d777b7d1a9fe..f9f404a8ddad 100644
--- a/arch/mips/sgi-ip27/ip27-klnuma.c
+++ b/arch/mips/sgi-ip27/ip27-klnuma.c
@@ -26,7 +26,7 @@ static cpumask_t ktext_repmask;
  * kernel.  For example, we should never put a copy on a headless node,
  * and we should respect the topology of the machine.
  */
-void __init setup_replication_mask()
+void __init setup_replication_mask(void)
 {
         cnodeid_t       cnode;
 
diff --git a/arch/mips/sgi-ip27/ip27-timer.c b/arch/mips/sgi-ip27/ip27-timer.c
index 4e870fc4469b..5e82a268e3c9 100644
--- a/arch/mips/sgi-ip27/ip27-timer.c
+++ b/arch/mips/sgi-ip27/ip27-timer.c
@@ -134,13 +134,6 @@ again:
         irq_exit();
 }
 
-unsigned long ip27_do_gettimeoffset(void)
-{
-        unsigned long ct_cur1;
-        ct_cur1 = REMOTE_HUB_L(cputonasid(0), PI_RT_COUNT) + CYCLES_PER_JIFFY;
-        return (ct_cur1 - ct_cur[0]) * NSEC_PER_CYCLE / 1000;
-}
-
 /* Includes for ioc3_init().  */
 #include <asm/sn/types.h>
 #include <asm/sn/sn0/addrs.h>
@@ -221,8 +214,6 @@ static struct irqaction rt_irqaction = {
         .name           = "timer"
 };
 
-extern int allocate_irqno(void);
-
 void __init plat_timer_setup(struct irqaction *irq)
 {
         int irqno  = allocate_irqno();
@@ -248,12 +239,17 @@ void __init plat_timer_setup(struct irqaction *irq)
         setup_irq(irqno, &rt_irqaction);
 }
 
+static unsigned int ip27_hpt_read(void)
+{
+        return REMOTE_HUB_L(cputonasid(0), PI_RT_COUNT);
+}
+
 void __init ip27_time_init(void)
 {
+        mips_hpt_read = ip27_hpt_read;
+        mips_hpt_frequency = CYCLES_PER_SEC;
         xtime.tv_sec = get_m48t35_time();
         xtime.tv_nsec = 0;
-
-        do_gettimeoffset = ip27_do_gettimeoffset;
 }
 
 void __init cpu_time_init(void)
diff --git a/arch/mips/sgi-ip32/ip32-reset.c b/arch/mips/sgi-ip32/ip32-reset.c
index fd0932b2d521..db8084411538 100644
--- a/arch/mips/sgi-ip32/ip32-reset.c
+++ b/arch/mips/sgi-ip32/ip32-reset.c
@@ -135,7 +135,7 @@ static inline void ip32_power_button(void)
         add_timer(&power_timer);
 }
 
-static irqreturn_t ip32_rtc_int(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t ip32_rtc_int(int irq, void *dev_id)
 {
         volatile unsigned char reg_c;
 
diff --git a/arch/mips/sibyte/bcm1480/smp.c b/arch/mips/sibyte/bcm1480/smp.c
index 6eac36d1b8c8..bf328277c775 100644
--- a/arch/mips/sibyte/bcm1480/smp.c
+++ b/arch/mips/sibyte/bcm1480/smp.c
@@ -34,21 +34,21 @@ extern void smp_call_function_interrupt(void);
  * independent of board/firmware
  */
 
-static void *mailbox_0_set_regs[] = {
+static volatile void *mailbox_0_set_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
         IOADDR(A_BCM1480_IMR_CPU3_BASE + R_BCM1480_IMR_MAILBOX_0_SET_CPU),
 };
 
-static void *mailbox_0_clear_regs[] = {
+static volatile void *mailbox_0_clear_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
         IOADDR(A_BCM1480_IMR_CPU3_BASE + R_BCM1480_IMR_MAILBOX_0_CLR_CPU),
 };
 
-static void *mailbox_0_regs[] = {
+static volatile void *mailbox_0_regs[] = {
         IOADDR(A_BCM1480_IMR_CPU0_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
         IOADDR(A_BCM1480_IMR_CPU1_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
         IOADDR(A_BCM1480_IMR_CPU2_BASE + R_BCM1480_IMR_MAILBOX_0_CPU),
diff --git a/arch/mips/sibyte/bcm1480/time.c b/arch/mips/sibyte/bcm1480/time.c
index bf12af46132e..e136bde5248e 100644
--- a/arch/mips/sibyte/bcm1480/time.c
+++ b/arch/mips/sibyte/bcm1480/time.c
@@ -47,6 +47,12 @@
 #define IMR_IP3_VAL     K_BCM1480_INT_MAP_I1
 #define IMR_IP4_VAL     K_BCM1480_INT_MAP_I2
 
+#ifdef CONFIG_SIMULATION
+#define BCM1480_HPT_VALUE       50000
+#else
+#define BCM1480_HPT_VALUE       1000000
+#endif
+
 extern int bcm1480_steal_irq(int irq);
 
 void bcm1480_time_init(void)
@@ -59,11 +65,6 @@ void bcm1480_time_init(void)
                 BUG();
         }
 
-        if (!cpu) {
-                /* Use our own gettimeoffset() routine */
-                do_gettimeoffset = bcm1480_gettimeoffset;
-        }
-
         bcm1480_mask_irq(cpu, irq);
 
         /* Map the timer interrupt to ip[4] of this cpu */
@@ -74,11 +75,7 @@ void bcm1480_time_init(void)
         /* Disable the timer and set up the count */
         __raw_writeq(0, IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_CFG)));
         __raw_writeq(
-#ifndef CONFIG_SIMULATION
-                1000000/HZ
-#else
-                50000/HZ
-#endif
+                BCM1480_HPT_VALUE/HZ
                 , IOADDR(A_SCD_TIMER_REGISTER(cpu, R_SCD_TIMER_INIT)));
 
         /* Set the timer running */
@@ -122,16 +119,16 @@ void bcm1480_timer_interrupt(void)
         }
 }
 
-/*
- * We use our own do_gettimeoffset() instead of the generic one,
- * because the generic one does not work for SMP case.
- * In addition, since we use general timer 0 for system time,
- * we can get accurate intra-jiffy offset without calibration.
- */
-unsigned long bcm1480_gettimeoffset(void)
+static unsigned int bcm1480_hpt_read(void)
 {
+        /* We assume this function is called xtime_lock held. */
         unsigned long count =
                 __raw_readq(IOADDR(A_SCD_TIMER_REGISTER(0, R_SCD_TIMER_CNT)));
+        return (jiffies + 1) * (BCM1480_HPT_VALUE / HZ) - count;
+}
 
-        return 1000000/HZ - count;
+void __init bcm1480_hpt_setup(void)
+{
+        mips_hpt_read = bcm1480_hpt_read;
+        mips_hpt_frequency = BCM1480_HPT_VALUE;
 }
diff --git a/arch/mips/sibyte/sb1250/bcm1250_tbprof.c b/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
index 992e0d8dbb67..d1a906e683b2 100644
--- a/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
+++ b/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
@@ -88,7 +88,7 @@ static void arm_tb(void)
         sbp.tb_armed = 1;
 }
 
-static irqreturn_t sbprof_tb_intr(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t sbprof_tb_intr(int irq, void *dev_id)
 {
         int i;
         DBG(printk(DEVNAME ": tb_intr\n"));
@@ -138,7 +138,7 @@ static irqreturn_t sbprof_tb_intr(int irq, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
-static irqreturn_t sbprof_pc_intr(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t sbprof_pc_intr(int irq, void *dev_id)
 {
         printk(DEVNAME ": unexpected pc_intr");
         return IRQ_NONE;
diff --git a/arch/mips/sibyte/sb1250/bus_watcher.c b/arch/mips/sibyte/sb1250/bus_watcher.c
index bb90649fbc48..45274bd3cd8b 100644
--- a/arch/mips/sibyte/sb1250/bus_watcher.c
+++ b/arch/mips/sibyte/sb1250/bus_watcher.c
@@ -171,7 +171,7 @@ static void create_proc_decoder(struct bw_stats_struct *stats)
  * notes: possible re-entry due to multiple sources
  *        should check/indicate saturation
  */
-static irqreturn_t sibyte_bw_int(int irq, void *data, struct pt_regs *regs)
+static irqreturn_t sibyte_bw_int(int irq, void *data)
 {
         struct bw_stats_struct *stats = data;
         unsigned long cntr;
diff --git a/arch/mips/sibyte/sb1250/time.c b/arch/mips/sibyte/sb1250/time.c
index 0ccf1796dd78..bcb74f2c1948 100644
--- a/arch/mips/sibyte/sb1250/time.c
+++ b/arch/mips/sibyte/sb1250/time.c
@@ -47,15 +47,11 @@
 
 #define SB1250_HPT_NUM          3
 #define SB1250_HPT_VALUE        M_SCD_TIMER_CNT /* max value */
-#define SB1250_HPT_SHIFT        ((sizeof(unsigned int)*8)-V_SCD_TIMER_WIDTH)
 
 
 extern int sb1250_steal_irq(int irq);
 
 static unsigned int sb1250_hpt_read(void);
-static void sb1250_hpt_init(unsigned int);
-
-static unsigned int hpt_offset;
 
 void __init sb1250_hpt_setup(void)
 {
@@ -69,13 +65,9 @@ void __init sb1250_hpt_setup(void)
                 __raw_writeq(M_SCD_TIMER_ENABLE | M_SCD_TIMER_MODE_CONTINUOUS,
                              IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_CFG)));
 
-                /*
-                 * we need to fill 32 bits, so just use the upper 23 bits and pretend
-                 * the timer is going 512Mhz instead of 1Mhz
-                 */
-                mips_hpt_frequency = V_SCD_TIMER_FREQ << SB1250_HPT_SHIFT;
-                mips_hpt_init = sb1250_hpt_init;
+                mips_hpt_frequency = V_SCD_TIMER_FREQ;
                 mips_hpt_read = sb1250_hpt_read;
+                mips_hpt_mask = M_SCD_TIMER_INIT;
         }
 }
 
@@ -149,11 +141,7 @@ void sb1250_timer_interrupt(void)
 
 /*
  * The HPT is free running from SB1250_HPT_VALUE down to 0 then starts over
- * again. There's no easy way to set to a specific value so store init value
- * in hpt_offset and subtract each time.
- *
- * Note: Timer isn't full 32bits so shift it into the upper part making
- *       it appear to run at a higher frequency.
+ * again.
  */
 static unsigned int sb1250_hpt_read(void)
 {
@@ -161,13 +149,5 @@ static unsigned int sb1250_hpt_read(void)
 
         count = G_SCD_TIMER_CNT(__raw_readq(IOADDR(A_SCD_TIMER_REGISTER(SB1250_HPT_NUM, R_SCD_TIMER_CNT))));
 
-        count = (SB1250_HPT_VALUE - count) << SB1250_HPT_SHIFT;
-
-        return count - hpt_offset;
-}
-
-static void sb1250_hpt_init(unsigned int count)
-{
-        hpt_offset = count;
-        return;
+        return SB1250_HPT_VALUE - count;
 }
diff --git a/arch/mips/tx4927/common/smsc_fdc37m81x.c b/arch/mips/tx4927/common/smsc_fdc37m81x.c
new file mode 100644
index 000000000000..33f517bc9a08
--- /dev/null
+++ b/arch/mips/tx4927/common/smsc_fdc37m81x.c
@@ -0,0 +1,172 @@
+/*
+ * Interface for smsc fdc48m81x Super IO chip
+ *
+ * Author: MontaVista Software, Inc. source@mvista.com
+ *
+ * 2001-2003 (c) MontaVista Software, Inc. This file is licensed under
+ * the terms of the GNU General Public License version 2. This program
+ * is licensed "as is" without any warranty of any kind, whether express
+ * or implied.
+ *
+ * Copyright 2004 (c) MontaVista Software, Inc.
+ */
+#include <linux/init.h>
+#include <linux/types.h>
+#include <asm/io.h>
+#include <asm/tx4927/smsc_fdc37m81x.h>
+
+#define DEBUG
+
+/* Common Registers */
+#define SMSC_FDC37M81X_CONFIG_INDEX  0x00
+#define SMSC_FDC37M81X_CONFIG_DATA   0x01
+#define SMSC_FDC37M81X_CONF          0x02
+#define SMSC_FDC37M81X_INDEX         0x03
+#define SMSC_FDC37M81X_DNUM          0x07
+#define SMSC_FDC37M81X_DID           0x20
+#define SMSC_FDC37M81X_DREV          0x21
+#define SMSC_FDC37M81X_PCNT          0x22
+#define SMSC_FDC37M81X_PMGT          0x23
+#define SMSC_FDC37M81X_OSC           0x24
+#define SMSC_FDC37M81X_CONFPA0       0x26
+#define SMSC_FDC37M81X_CONFPA1       0x27
+#define SMSC_FDC37M81X_TEST4         0x2B
+#define SMSC_FDC37M81X_TEST5         0x2C
+#define SMSC_FDC37M81X_TEST1         0x2D
+#define SMSC_FDC37M81X_TEST2         0x2E
+#define SMSC_FDC37M81X_TEST3         0x2F
+
+/* Logical device numbers */
+#define SMSC_FDC37M81X_FDD           0x00
+#define SMSC_FDC37M81X_SERIAL1       0x04
+#define SMSC_FDC37M81X_SERIAL2       0x05
+#define SMSC_FDC37M81X_KBD           0x07
+
+/* Logical device Config Registers */
+#define SMSC_FDC37M81X_ACTIVE        0x30
+#define SMSC_FDC37M81X_BASEADDR0     0x60
+#define SMSC_FDC37M81X_BASEADDR1     0x61
+#define SMSC_FDC37M81X_INT           0x70
+#define SMSC_FDC37M81X_INT2          0x72
+#define SMSC_FDC37M81X_MODE          0xF0
+
+/* Chip Config Values */
+#define SMSC_FDC37M81X_CONFIG_ENTER  0x55
+#define SMSC_FDC37M81X_CONFIG_EXIT   0xaa
+#define SMSC_FDC37M81X_CHIP_ID       0x4d
+
+static unsigned long g_smsc_fdc37m81x_base = 0;
+
+static inline unsigned char smsc_fdc37m81x_rd(unsigned char index)
+{
+        outb(index, g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_INDEX);
+
+        return inb(g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_DATA);
+}
+
+static inline void smsc_dc37m81x_wr(unsigned char index, unsigned char data)
+{
+        outb(index, g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_INDEX);
+        outb(data, g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_DATA);
+}
+
+void smsc_fdc37m81x_config_beg(void)
+{
+        if (g_smsc_fdc37m81x_base) {
+                outb(SMSC_FDC37M81X_CONFIG_ENTER,
+                     g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_INDEX);
+        }
+}
+
+void smsc_fdc37m81x_config_end(void)
+{
+        if (g_smsc_fdc37m81x_base)
+                outb(SMSC_FDC37M81X_CONFIG_EXIT,
+                     g_smsc_fdc37m81x_base + SMSC_FDC37M81X_CONFIG_INDEX);
+}
+
+u8 smsc_fdc37m81x_config_get(u8 reg)
+{
+        u8 val = 0;
+
+        if (g_smsc_fdc37m81x_base)
+                val = smsc_fdc37m81x_rd(reg);
+
+        return val;
+}
+
+void smsc_fdc37m81x_config_set(u8 reg, u8 val)
+{
+        if (g_smsc_fdc37m81x_base)
+                smsc_dc37m81x_wr(reg, val);
+}
+
+unsigned long __init smsc_fdc37m81x_init(unsigned long port)
+{
+        const int field = sizeof(unsigned long) * 2;
+        u8 chip_id;
+
+        if (g_smsc_fdc37m81x_base)
+                printk("smsc_fdc37m81x_init() stepping on old base=0x%0*lx\n",
+                       field, g_smsc_fdc37m81x_base);
+
+        g_smsc_fdc37m81x_base = port;
+
+        smsc_fdc37m81x_config_beg();
+
+        chip_id = smsc_fdc37m81x_rd(SMSC_FDC37M81X_DID);
+        if (chip_id == SMSC_FDC37M81X_CHIP_ID)
+                smsc_fdc37m81x_config_end();
+        else {
+                printk("smsc_fdc37m81x_init() unknow chip id 0x%02x\n",
+                       chip_id);
+                g_smsc_fdc37m81x_base = 0;
+        }
+
+        return g_smsc_fdc37m81x_base;
+}
+
+#ifdef DEBUG
+void smsc_fdc37m81x_config_dump_one(char *key, u8 dev, u8 reg)
+{
+        printk("%s: dev=0x%02x reg=0x%02x val=0x%02x\n", key, dev, reg,
+               smsc_fdc37m81x_rd(reg));
+}
+
+void smsc_fdc37m81x_config_dump(void)
+{
+        u8 orig;
+        char *fname = "smsc_fdc37m81x_config_dump()";
+
+        smsc_fdc37m81x_config_beg();
+
+        orig = smsc_fdc37m81x_rd(SMSC_FDC37M81X_DNUM);
+
+        printk("%s: common\n", fname);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_NONE,
+                                       SMSC_FDC37M81X_DNUM);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_NONE,
+                                       SMSC_FDC37M81X_DID);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_NONE,
+                                       SMSC_FDC37M81X_DREV);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_NONE,
+                                       SMSC_FDC37M81X_PCNT);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_NONE,
+                                       SMSC_FDC37M81X_PMGT);
+
+        printk("%s: keyboard\n", fname);
+        smsc_dc37m81x_wr(SMSC_FDC37M81X_DNUM, SMSC_FDC37M81X_KBD);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_KBD,
+                                       SMSC_FDC37M81X_ACTIVE);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_KBD,
+                                       SMSC_FDC37M81X_INT);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_KBD,
+                                       SMSC_FDC37M81X_INT2);
+        smsc_fdc37m81x_config_dump_one(fname, SMSC_FDC37M81X_KBD,
+                                       SMSC_FDC37M81X_LDCR_F0);
+
+        smsc_dc37m81x_wr(SMSC_FDC37M81X_DNUM, orig);
+
+        smsc_fdc37m81x_config_end();
+}
+#endif
diff --git a/arch/mips/tx4927/common/tx4927_setup.c b/arch/mips/tx4927/common/tx4927_setup.c
index 4658b2ae4833..941c441729b0 100644
--- a/arch/mips/tx4927/common/tx4927_setup.c
+++ b/arch/mips/tx4927/common/tx4927_setup.c
@@ -112,8 +112,6 @@ void print_cp0(char *key, int num, char *name, u32 val)
         return;
 }
 
-indent: Standard input:25: Error:Unexpected end of file
-
 void
 dump_cp0(char *key)
 {
diff --git a/arch/mips/tx4938/toshiba_rbtx4938/spi_txx9.c b/arch/mips/tx4938/toshiba_rbtx4938/spi_txx9.c
index b926e6a75c29..08b20cdfd7b3 100644
--- a/arch/mips/tx4938/toshiba_rbtx4938/spi_txx9.c
+++ b/arch/mips/tx4938/toshiba_rbtx4938/spi_txx9.c
@@ -36,14 +36,18 @@ void __init txx9_spi_init(unsigned long base, int (*cs_func)(int chipid, int on)
 
 static DECLARE_WAIT_QUEUE_HEAD(txx9_spi_wait);
 
-static void txx9_spi_interrupt(int irq, void *dev_id)
+static irqreturn_t txx9_spi_interrupt(int irq, void *dev_id)
 {
         /* disable rx intr */
         tx4938_spiptr->cr0 &= ~TXx9_SPCR0_RBSIE;
         wake_up(&txx9_spi_wait);
+
+        return IRQ_HANDLED;
 }
+
 static struct irqaction txx9_spi_action = {
-        txx9_spi_interrupt, 0, 0, "spi", NULL, NULL,
+        .handler        = txx9_spi_interrupt,
+        .name           = "spi",
 };
 
 void __init txx9_spi_irqinit(int irc_irq)
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 6d57553d8ef8..8f6a0b312f7a 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -69,10 +69,6 @@ EXPORT_SYMBOL(memcpy_toio);
 EXPORT_SYMBOL(memcpy_fromio);
 EXPORT_SYMBOL(memset_io);
 
-#include <asm/unistd.h>
-EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_write);
-
 #include <asm/semaphore.h>
 EXPORT_SYMBOL(__up);
 EXPORT_SYMBOL(__down_interruptible);
diff --git a/arch/parisc/kernel/vmlinux.lds.S b/arch/parisc/kernel/vmlinux.lds.S
index b3677fc8eef5..7b943b45f7cd 100644
--- a/arch/parisc/kernel/vmlinux.lds.S
+++ b/arch/parisc/kernel/vmlinux.lds.S
@@ -153,13 +153,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 8b6910465578..0673dbedb241 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -740,7 +740,7 @@ config ARCH_SPARSEMEM_ENABLE
 
 config ARCH_SPARSEMEM_DEFAULT
         def_bool y
-        depends on SMP && PPC_PSERIES
+        depends on (SMP && PPC_PSERIES) || PPC_CELL
 
 config ARCH_POPULATES_NODE_MAP
         def_bool y
@@ -751,6 +751,15 @@ config ARCH_MEMORY_PROBE
         def_bool y
         depends on MEMORY_HOTPLUG
 
+# Some NUMA nodes have memory ranges that span
+# other nodes.  Even though a pfn is valid and
+# between a node's start and end pfns, it may not
+# reside on that node.  See memmap_init_zone()
+# for details.
+config NODES_SPAN_OTHER_NODES
+        def_bool y
+        depends on NEED_MULTIPLE_NODES
+
 config PPC_64K_PAGES
         bool "64k page size"
         depends on PPC64
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 37ddfcab0003..4b2be611f77f 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -115,7 +115,7 @@ endif
 quiet_cmd_wrap  = WRAP    $@
       cmd_wrap  =$(CONFIG_SHELL) $(wrapper) -c -o $@ -p $2 $(CROSSWRAP) vmlinux
 quiet_cmd_wrap_initrd = WRAP    $@
-      cmd_wrap_initrd =$(wrapper) -c -o $@ -p $2 $(CROSSWRAP) \
+      cmd_wrap_initrd =$(CONFIG_SHELL) $(wrapper) -c -o $@ -p $2 $(CROSSWRAP) \
                                 -i $(obj)/ramdisk.image.gz vmlinux
 
 $(obj)/zImage.chrp: vmlinux $(wrapperbits)
diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index eab7318729e9..b5fb1fee76f8 100755
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -179,11 +179,11 @@ if [ -z "$cacheit" ]; then
 fi
 
 if [ -n "$initrd" ]; then
-    addsec $tmp "$initrd" initrd
+    addsec $tmp "$initrd" $isection
 fi
 
 if [ -n "$dtb" ]; then
-    addsec $tmp "$dtb" dtb
+    addsec $tmp "$dtb" .kernel:dtb
 fi
 
 if [ "$platform" != "miboot" ]; then
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 4b6bb3ffe3dc..4be3c6414b04 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -21,6 +21,11 @@ SECTIONS
     __got2_end = .;
   }
 
+  . = ALIGN(8);
+  _dtb_start = .;
+  .kernel:dtb : { *(.kernel:dtb) }
+  _dtb_end = .;
+
   . = ALIGN(4096);
   _vmlinux_start =  .;
   .kernel:vmlinux.strip : { *(.kernel:vmlinux.strip) }
diff --git a/arch/powerpc/configs/cell_defconfig b/arch/powerpc/configs/cell_defconfig
index 892d5dd3254e..0aba06d7d2ec 100644
--- a/arch/powerpc/configs/cell_defconfig
+++ b/arch/powerpc/configs/cell_defconfig
@@ -254,6 +254,7 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+# CONFIG_INET_XFRM_MODE_BEET is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -275,7 +276,9 @@ CONFIG_INET6_XFRM_TUNNEL=m
 CONFIG_INET6_TUNNEL=m
 CONFIG_INET6_XFRM_MODE_TRANSPORT=y
 CONFIG_INET6_XFRM_MODE_TUNNEL=y
+# CONFIG_INET6_XFRM_MODE_BEET is not set
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+# CONFIG_IPV6_SIT is not set
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
@@ -406,6 +409,12 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -738,7 +747,6 @@ CONFIG_GEN_RTC=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -802,6 +810,7 @@ CONFIG_I2C_ALGOBIT=y
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -810,14 +819,9 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_HWMON_VID is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -923,6 +927,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -930,6 +935,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1129,6 +1135,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_FORCED_INLINING is not set
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
diff --git a/arch/powerpc/configs/mpc834x_itx_defconfig b/arch/powerpc/configs/mpc834x_itx_defconfig
index cd3535e1a095..0561b73a918f 100644
--- a/arch/powerpc/configs/mpc834x_itx_defconfig
+++ b/arch/powerpc/configs/mpc834x_itx_defconfig
@@ -1248,7 +1248,7 @@ CONFIG_PARTITION_ADVANCED=y
 # CONFIG_AMIGA_PARTITION is not set
 # CONFIG_ATARI_PARTITION is not set
 # CONFIG_MAC_PARTITION is not set
-# CONFIG_MSDOS_PARTITION is not set
+CONFIG_MSDOS_PARTITION=y
 # CONFIG_LDM_PARTITION is not set
 # CONFIG_SGI_PARTITION is not set
 # CONFIG_ULTRIX_PARTITION is not set
diff --git a/arch/powerpc/configs/pseries_defconfig b/arch/powerpc/configs/pseries_defconfig
index 9828663652e9..d2833c1a1f3d 100644
--- a/arch/powerpc/configs/pseries_defconfig
+++ b/arch/powerpc/configs/pseries_defconfig
@@ -184,6 +184,7 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
 CONFIG_RESOURCES_64BIT=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
+CONFIG_NODES_SPAN_OTHER_NODES=y
 # CONFIG_PPC_64K_PAGES is not set
 CONFIG_SCHED_SMT=y
 CONFIG_PROC_DEVICETREE=y
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index 8b133afbdc20..7af23c43fd4b 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -38,7 +38,6 @@ obj-$(CONFIG_6xx)		+= idle_6xx.o l2cr_6xx.o cpu_setup_6xx.o
 obj-$(CONFIG_TAU)               += tau_6xx.o
 obj32-$(CONFIG_SOFTWARE_SUSPEND) += swsusp_32.o
 obj32-$(CONFIG_MODULES)         += module_32.o
-obj-$(CONFIG_E500)              += perfmon_fsl_booke.o
 
 ifeq ($(CONFIG_PPC_MERGE),y)
 
diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c
index 995fcef156fd..93f21aaf7c8e 100644
--- a/arch/powerpc/kernel/btext.c
+++ b/arch/powerpc/kernel/btext.c
@@ -182,7 +182,7 @@ int btext_initialize(struct device_node *np)
         prop = get_property(np, "linux,bootx-linebytes", NULL);
         if (prop == NULL)
                 prop = get_property(np, "linebytes", NULL);
-        if (prop)
+        if (prop && *prop != 0xffffffffu)
                 pitch = *prop;
         if (pitch == 1)
                 pitch = 0x1000;
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 47a613cdd775..bfd499ee3753 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -18,6 +18,7 @@
 
 #include <asm/oprofile_impl.h>
 #include <asm/cputable.h>
+#include <asm/prom.h>           /* for PTRRELOC on ARCH=ppc */
 
 struct cpu_spec* cur_cpu_spec = NULL;
 EXPORT_SYMBOL(cur_cpu_spec);
@@ -73,7 +74,7 @@ extern void __restore_cpu_ppc970(void);
 #define PPC_FEATURE_SPE_COMP    0
 #endif
 
-struct cpu_spec cpu_specs[] = {
+static struct cpu_spec cpu_specs[] = {
 #ifdef CONFIG_PPC64
         {       /* Power3 */
                 .pvr_mask               = 0xffff0000,
@@ -227,6 +228,21 @@ struct cpu_spec	cpu_specs[] = {
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .platform               = "ppc970",
         },
+        {       /* PPC970GX */
+                .pvr_mask               = 0xffff0000,
+                .pvr_value              = 0x00450000,
+                .cpu_name               = "PPC970GX",
+                .cpu_features           = CPU_FTRS_PPC970,
+                .cpu_user_features      = COMMON_USER_POWER4 |
+                        PPC_FEATURE_HAS_ALTIVEC_COMP,
+                .icache_bsize           = 128,
+                .dcache_bsize           = 128,
+                .num_pmcs               = 8,
+                .cpu_setup              = __setup_cpu_ppc970,
+                .oprofile_cpu_type      = "ppc64/970",
+                .oprofile_type          = PPC_OPROFILE_POWER4,
+                .platform               = "ppc970",
+        },
         {       /* Power5 GR */
                 .pvr_mask               = 0xffff0000,
                 .pvr_value              = 0x003a0000,
@@ -268,7 +284,7 @@ struct cpu_spec	cpu_specs[] = {
                 .cpu_user_features      = COMMON_USER_POWER6,
                 .icache_bsize           = 128,
                 .dcache_bsize           = 128,
-                .num_pmcs               = 8,
+                .num_pmcs               = 6,
                 .oprofile_cpu_type      = "ppc64/power6",
                 .oprofile_type          = PPC_OPROFILE_POWER4,
                 .oprofile_mmcra_sihv    = POWER6_MMCRA_SIHV,
@@ -1152,3 +1168,71 @@ struct cpu_spec	cpu_specs[] = {
 #endif /* !CLASSIC_PPC */
 #endif /* CONFIG_PPC32 */
 };
+
+struct cpu_spec *identify_cpu(unsigned long offset)
+{
+        struct cpu_spec *s = cpu_specs;
+        struct cpu_spec **cur = &cur_cpu_spec;
+        unsigned int pvr = mfspr(SPRN_PVR);
+        int i;
+
+        s = PTRRELOC(s);
+        cur = PTRRELOC(cur);
+
+        if (*cur != NULL)
+                return PTRRELOC(*cur);
+
+        for (i = 0; i < ARRAY_SIZE(cpu_specs); i++,s++)
+                if ((pvr & s->pvr_mask) == s->pvr_value) {
+                        *cur = cpu_specs + i;
+#ifdef CONFIG_PPC64
+                        /* ppc64 expects identify_cpu to also call setup_cpu
+                         * for that processor. I will consolidate that at a
+                         * later time, for now, just use our friend #ifdef.
+                         * we also don't need to PTRRELOC the function pointer
+                         * on ppc64 as we are running at 0 in real mode.
+                         */
+                        if (s->cpu_setup) {
+                                s->cpu_setup(offset, s);
+                        }
+#endif /* CONFIG_PPC64 */
+                        return s;
+                }
+        BUG();
+        return NULL;
+}
+
+void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end)
+{
+        struct fixup_entry {
+                unsigned long   mask;
+                unsigned long   value;
+                long            start_off;
+                long            end_off;
+        } *fcur, *fend;
+
+        fcur = fixup_start;
+        fend = fixup_end;
+
+        for (; fcur < fend; fcur++) {
+                unsigned int *pstart, *pend, *p;
+
+                if ((value & fcur->mask) == fcur->value)
+                        continue;
+
+                /* These PTRRELOCs will disappear once the new scheme for
+                 * modules and vdso is implemented
+                 */
+                pstart = ((unsigned int *)fcur) + (fcur->start_off / 4);
+                pend = ((unsigned int *)fcur) + (fcur->end_off / 4);
+
+                for (p = pstart; p < pend; p++) {
+                        *p = 0x60000000u;
+                        asm volatile ("dcbst 0, %0" : : "r" (p));
+                }
+                asm volatile ("sync" : : : "memory");
+                for (p = pstart; p < pend; p++)
+                        asm volatile ("icbi 0,%0" : : "r" (p));
+                asm volatile ("sync; isync" : : : "memory");
+        }
+}
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 645c7f10fb28..e720729f3e55 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -487,7 +487,7 @@ BEGIN_FTR_SECTION
         rlwimi  r13,r12,16,0x20
         mfcr    r12
         cmpwi   r13,0x2c
-        beq     .do_stab_bolted_pSeries
+        beq     do_stab_bolted_pSeries
         mtcrf   0x80,r12
         mfspr   r12,SPRN_SPRG2
 END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
@@ -600,7 +600,7 @@ system_call_pSeries:
         STD_EXCEPTION_PSERIES(., performance_monitor)
 
         .align  7
-_GLOBAL(do_stab_bolted_pSeries)
+do_stab_bolted_pSeries:
         mtcrf   0x80,r12
         mfspr   r12,SPRN_SPRG2
         EXCEPTION_PROLOG_PSERIES(PACA_EXSLB, .do_stab_bolted)
@@ -1046,7 +1046,7 @@ slb_miss_fault:
         li      r5,0
         std     r4,_DAR(r1)
         std     r5,_DSISR(r1)
-        b       .handle_page_fault
+        b       handle_page_fault
 
 unrecov_user_slb:
         EXCEPTION_PROLOG_COMMON(0x4200, PACA_EXGEN)
@@ -1174,12 +1174,13 @@ program_check_common:
         .globl fp_unavailable_common
 fp_unavailable_common:
         EXCEPTION_PROLOG_COMMON(0x800, PACA_EXGEN)
-        bne     .load_up_fpu            /* if from user, just load it up */
+        bne     1f                      /* if from user, just load it up */
         bl      .save_nvgprs
         addi    r3,r1,STACK_FRAME_OVERHEAD
         ENABLE_INTS
         bl      .kernel_fp_unavailable_exception
         BUG_OPCODE
+1:      b       .load_up_fpu
 
         .align  7
         .globl altivec_unavailable_common
@@ -1279,10 +1280,10 @@ _GLOBAL(do_hash_page)
         std     r4,_DSISR(r1)
 
         andis.  r0,r4,0xa450            /* weird error? */
-        bne-    .handle_page_fault      /* if not, try to insert a HPTE */
+        bne-    handle_page_fault       /* if not, try to insert a HPTE */
 BEGIN_FTR_SECTION
         andis.  r0,r4,0x0020            /* Is it a segment table fault? */
-        bne-    .do_ste_alloc           /* If so handle it */
+        bne-    do_ste_alloc            /* If so handle it */
 END_FTR_SECTION_IFCLR(CPU_FTR_SLB)
 
         /*
@@ -1324,7 +1325,7 @@ BEGIN_FW_FTR_SECTION
          * because ret_from_except_lite will check for and handle pending
          * interrupts if necessary.
          */
-        beq     .ret_from_except_lite
+        beq     13f
         /* For a hash failure, we don't bother re-enabling interrupts */
         ble-    12f
 
@@ -1346,14 +1347,14 @@ BEGIN_FW_FTR_SECTION
 END_FW_FTR_SECTION_IFCLR(FW_FEATURE_ISERIES)
 
 /* Here we have a page fault that hash_page can't handle. */
-_GLOBAL(handle_page_fault)
+handle_page_fault:
         ENABLE_INTS
 11:     ld      r4,_DAR(r1)
         ld      r5,_DSISR(r1)
         addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .do_page_fault
         cmpdi   r3,0
-        beq+    .ret_from_except_lite
+        beq+    13f
         bl      .save_nvgprs
         mr      r5,r3
         addi    r3,r1,STACK_FRAME_OVERHEAD
@@ -1370,12 +1371,14 @@ _GLOBAL(handle_page_fault)
         bl      .low_hash_fault
         b       .ret_from_except
 
+13:     b       .ret_from_except_lite
+
         /* here we have a segment miss */
-_GLOBAL(do_ste_alloc)
+do_ste_alloc:
         bl      .ste_allocate           /* try to insert stab entry */
         cmpdi   r3,0
-        beq+    fast_exception_return
-        b       .handle_page_fault
+        bne-    handle_page_fault
+        b       fast_exception_return
 
 /*
  * r13 points to the PACA, r9 contains the saved CR,
@@ -1580,11 +1583,6 @@ _STATIC(__start_initialization_iSeries)
         li      r0,0
         stdu    r0,-STACK_FRAME_OVERHEAD(r1)
 
-        LOAD_REG_IMMEDIATE(r3,cpu_specs)
-        LOAD_REG_IMMEDIATE(r4,cur_cpu_spec)
-        li      r5,0
-        bl      .identify_cpu
-
         LOAD_REG_IMMEDIATE(r2,__toc_start)
         addi    r2,r2,0x4000
         addi    r2,r2,0x4000
@@ -1646,6 +1644,8 @@ _GLOBAL(__start_initialization_multiplatform)
         cmpwi   r0,0x3c         /* 970FX */
         beq     1f
         cmpwi   r0,0x44         /* 970MP */
+        beq     1f
+        cmpwi   r0,0x45         /* 970GX */
         bne     2f
 1:      bl      .__cpu_preinit_ppc970
 2:
@@ -1964,13 +1964,6 @@ _STATIC(start_here_multiplatform)
         addi    r2,r2,0x4000
         add     r2,r2,r26
 
-        LOAD_REG_IMMEDIATE(r3, cpu_specs)
-        add     r3,r3,r26
-        LOAD_REG_IMMEDIATE(r4,cur_cpu_spec)
-        add     r4,r4,r26
-        mr      r5,r26
-        bl      .identify_cpu
-
         /* Do very early kernel initializations, including initial hash table,
          * stab and slb setup before we turn on relocation.     */
 
@@ -2000,13 +1993,6 @@ _STATIC(start_here_common)
         li      r0,0
         stdu    r0,-STACK_FRAME_OVERHEAD(r1)
 
-        /* Apply the CPUs-specific fixups (nop out sections not relevant
-         * to this CPU
-         */
-        li      r3,0
-        bl      .do_cpu_ftr_fixups
-        bl      .do_fw_ftr_fixups
-
         /* ptr to current */
         LOAD_REG_IMMEDIATE(r4, init_task)
         std     r4,PACACURRENT(r13)
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index f88a2a675d90..ba6b7256084b 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -47,6 +47,17 @@ static int novmerge = 0;
 static int novmerge = 1;
 #endif
 
+static inline unsigned long iommu_num_pages(unsigned long vaddr,
+                                            unsigned long slen)
+{
+        unsigned long npages;
+
+        npages = IOMMU_PAGE_ALIGN(vaddr + slen) - (vaddr & IOMMU_PAGE_MASK);
+        npages >>= IOMMU_PAGE_SHIFT;
+
+        return npages;
+}
+
 static int __init setup_iommu(char *str)
 {
         if (!strcmp(str, "novmerge"))
@@ -178,10 +189,10 @@ static dma_addr_t iommu_alloc(struct iommu_table *tbl, void *page,
         }
 
         entry += tbl->it_offset;        /* Offset into real TCE table */
-        ret = entry << PAGE_SHIFT;      /* Set the return dma address */
+        ret = entry << IOMMU_PAGE_SHIFT;        /* Set the return dma address */
 
         /* Put the TCEs in the HW table */
-        ppc_md.tce_build(tbl, entry, npages, (unsigned long)page & PAGE_MASK,
+        ppc_md.tce_build(tbl, entry, npages, (unsigned long)page & IOMMU_PAGE_MASK,
                          direction);
 
 
@@ -203,7 +214,7 @@ static void __iommu_free(struct iommu_table *tbl, dma_addr_t dma_addr,
         unsigned long entry, free_entry;
         unsigned long i;
 
-        entry = dma_addr >> PAGE_SHIFT;
+        entry = dma_addr >> IOMMU_PAGE_SHIFT;
         free_entry = entry - tbl->it_offset;
 
         if (((free_entry + npages) > tbl->it_size) ||
@@ -270,7 +281,7 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
         /* Init first segment length for backout at failure */
         outs->dma_length = 0;
 
-        DBG("mapping %d elements:\n", nelems);
+        DBG("sg mapping %d elements:\n", nelems);
 
         spin_lock_irqsave(&(tbl->it_lock), flags);
 
@@ -285,9 +296,8 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                 }
                 /* Allocate iommu entries for that segment */
                 vaddr = (unsigned long)page_address(s->page) + s->offset;
-                npages = PAGE_ALIGN(vaddr + slen) - (vaddr & PAGE_MASK);
-                npages >>= PAGE_SHIFT;
-                entry = iommu_range_alloc(tbl, npages, &handle, mask >> PAGE_SHIFT, 0);
+                npages = iommu_num_pages(vaddr, slen);
+                entry = iommu_range_alloc(tbl, npages, &handle, mask >> IOMMU_PAGE_SHIFT, 0);
 
                 DBG("  - vaddr: %lx, size: %lx\n", vaddr, slen);
 
@@ -301,14 +311,14 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
 
                 /* Convert entry to a dma_addr_t */
                 entry += tbl->it_offset;
-                dma_addr = entry << PAGE_SHIFT;
-                dma_addr |= s->offset;
+                dma_addr = entry << IOMMU_PAGE_SHIFT;
+                dma_addr |= (s->offset & ~IOMMU_PAGE_MASK);
 
-                DBG("  - %lx pages, entry: %lx, dma_addr: %lx\n",
+                DBG("  - %lu pages, entry: %lx, dma_addr: %lx\n",
                             npages, entry, dma_addr);
 
                 /* Insert into HW table */
-                ppc_md.tce_build(tbl, entry, npages, vaddr & PAGE_MASK, direction);
+                ppc_md.tce_build(tbl, entry, npages, vaddr & IOMMU_PAGE_MASK, direction);
 
                 /* If we are in an open segment, try merging */
                 if (segstart != s) {
@@ -323,7 +333,7 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                                 DBG("    can't merge, new segment.\n");
                         } else {
                                 outs->dma_length += s->length;
-                                DBG("    merged, new len: %lx\n", outs->dma_length);
+                                DBG("    merged, new len: %ux\n", outs->dma_length);
                         }
                 }
 
@@ -367,9 +377,8 @@ int iommu_map_sg(struct device *dev, struct iommu_table *tbl,
                 if (s->dma_length != 0) {
                         unsigned long vaddr, npages;
 
-                        vaddr = s->dma_address & PAGE_MASK;
-                        npages = (PAGE_ALIGN(s->dma_address + s->dma_length) - vaddr)
-                                >> PAGE_SHIFT;
+                        vaddr = s->dma_address & IOMMU_PAGE_MASK;
+                        npages = iommu_num_pages(s->dma_address, s->dma_length);
                         __iommu_free(tbl, vaddr, npages);
                         s->dma_address = DMA_ERROR_CODE;
                         s->dma_length = 0;
@@ -398,8 +407,7 @@ void iommu_unmap_sg(struct iommu_table *tbl, struct scatterlist *sglist,
 
                 if (sglist->dma_length == 0)
                         break;
-                npages = (PAGE_ALIGN(dma_handle + sglist->dma_length)
-                          - (dma_handle & PAGE_MASK)) >> PAGE_SHIFT;
+                npages = iommu_num_pages(dma_handle,sglist->dma_length);
                 __iommu_free(tbl, dma_handle, npages);
                 sglist++;
         }
@@ -532,12 +540,11 @@ dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
         BUG_ON(direction == DMA_NONE);
 
         uaddr = (unsigned long)vaddr;
-        npages = PAGE_ALIGN(uaddr + size) - (uaddr & PAGE_MASK);
-        npages >>= PAGE_SHIFT;
+        npages = iommu_num_pages(uaddr, size);
 
         if (tbl) {
                 dma_handle = iommu_alloc(tbl, vaddr, npages, direction,
-                                         mask >> PAGE_SHIFT, 0);
+                                         mask >> IOMMU_PAGE_SHIFT, 0);
                 if (dma_handle == DMA_ERROR_CODE) {
                         if (printk_ratelimit())  {
                                 printk(KERN_INFO "iommu_alloc failed, "
@@ -545,7 +552,7 @@ dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
                                                 tbl, vaddr, npages);
                         }
                 } else
-                        dma_handle |= (uaddr & ~PAGE_MASK);
+                        dma_handle |= (uaddr & ~IOMMU_PAGE_MASK);
         }
 
         return dma_handle;
@@ -554,11 +561,14 @@ dma_addr_t iommu_map_single(struct iommu_table *tbl, void *vaddr,
 void iommu_unmap_single(struct iommu_table *tbl, dma_addr_t dma_handle,
                 size_t size, enum dma_data_direction direction)
 {
+        unsigned int npages;
+
         BUG_ON(direction == DMA_NONE);
 
-        if (tbl)
-                iommu_free(tbl, dma_handle, (PAGE_ALIGN(dma_handle + size) -
-                                        (dma_handle & PAGE_MASK)) >> PAGE_SHIFT);
+        if (tbl) {
+                npages = iommu_num_pages(dma_handle, size);
+                iommu_free(tbl, dma_handle, npages);
+        }
 }
 
 /* Allocates a contiguous real buffer and creates mappings over it.
@@ -570,11 +580,11 @@ void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
 {
         void *ret = NULL;
         dma_addr_t mapping;
-        unsigned int npages, order;
+        unsigned int order;
+        unsigned int nio_pages, io_order;
         struct page *page;
 
         size = PAGE_ALIGN(size);
-        npages = size >> PAGE_SHIFT;
         order = get_order(size);
 
         /*
@@ -598,8 +608,10 @@ void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
         memset(ret, 0, size);
 
         /* Set up tces to cover the allocated range */
-        mapping = iommu_alloc(tbl, ret, npages, DMA_BIDIRECTIONAL,
-                              mask >> PAGE_SHIFT, order);
+        nio_pages = size >> IOMMU_PAGE_SHIFT;
+        io_order = get_iommu_order(size);
+        mapping = iommu_alloc(tbl, ret, nio_pages, DMA_BIDIRECTIONAL,
+                              mask >> IOMMU_PAGE_SHIFT, io_order);
         if (mapping == DMA_ERROR_CODE) {
                 free_pages((unsigned long)ret, order);
                 return NULL;
@@ -611,12 +623,13 @@ void *iommu_alloc_coherent(struct iommu_table *tbl, size_t size,
 void iommu_free_coherent(struct iommu_table *tbl, size_t size,
                          void *vaddr, dma_addr_t dma_handle)
 {
-        unsigned int npages;
-
         if (tbl) {
+                unsigned int nio_pages;
+
+                size = PAGE_ALIGN(size);
+                nio_pages = size >> IOMMU_PAGE_SHIFT;
+                iommu_free(tbl, dma_handle, nio_pages);
                 size = PAGE_ALIGN(size);
-                npages = size >> PAGE_SHIFT;
-                iommu_free(tbl, dma_handle, npages);
                 free_pages((unsigned long)vaddr, get_order(size));
         }
 }
diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
index 88fd73fdf048..412bea3cf813 100644
--- a/arch/powerpc/kernel/misc_32.S
+++ b/arch/powerpc/kernel/misc_32.S
@@ -102,80 +102,6 @@ _GLOBAL(reloc_got2)
         blr
 
 /*
- * identify_cpu,
- * called with r3 = data offset and r4 = CPU number
- * doesn't change r3
- */
-_GLOBAL(identify_cpu)
-        addis   r8,r3,cpu_specs@ha
-        addi    r8,r8,cpu_specs@l
-        mfpvr   r7
-1:
-        lwz     r5,CPU_SPEC_PVR_MASK(r8)
-        and     r5,r5,r7
-        lwz     r6,CPU_SPEC_PVR_VALUE(r8)
-        cmplw   0,r6,r5
-        beq     1f
-        addi    r8,r8,CPU_SPEC_ENTRY_SIZE
-        b       1b
-1:
-        addis   r6,r3,cur_cpu_spec@ha
-        addi    r6,r6,cur_cpu_spec@l
-        sub     r8,r8,r3
-        stw     r8,0(r6)
-        blr
-
-/*
- * do_cpu_ftr_fixups - goes through the list of CPU feature fixups
- * and writes nop's over sections of code that don't apply for this cpu.
- * r3 = data offset (not changed)
- */
-_GLOBAL(do_cpu_ftr_fixups)
-        /* Get CPU 0 features */
-        addis   r6,r3,cur_cpu_spec@ha
-        addi    r6,r6,cur_cpu_spec@l
-        lwz     r4,0(r6)
-        add     r4,r4,r3
-        lwz     r4,CPU_SPEC_FEATURES(r4)
-
-        /* Get the fixup table */
-        addis   r6,r3,__start___ftr_fixup@ha
-        addi    r6,r6,__start___ftr_fixup@l
-        addis   r7,r3,__stop___ftr_fixup@ha
-        addi    r7,r7,__stop___ftr_fixup@l
-
-        /* Do the fixup */
-1:      cmplw   0,r6,r7
-        bgelr
-        addi    r6,r6,16
-        lwz     r8,-16(r6)      /* mask */
-        and     r8,r8,r4
-        lwz     r9,-12(r6)      /* value */
-        cmplw   0,r8,r9
-        beq     1b
-        lwz     r8,-8(r6)       /* section begin */
-        lwz     r9,-4(r6)       /* section end */
-        subf.   r9,r8,r9
-        beq     1b
-        /* write nops over the section of code */
-        /* todo: if large section, add a branch at the start of it */
-        srwi    r9,r9,2
-        mtctr   r9
-        add     r8,r8,r3
-        lis     r0,0x60000000@h /* nop */
-3:      stw     r0,0(r8)
-        andi.   r10,r4,CPU_FTR_SPLIT_ID_CACHE@l
-        beq     2f
-        dcbst   0,r8            /* suboptimal, but simpler */
-        sync
-        icbi    0,r8
-2:      addi    r8,r8,4
-        bdnz    3b
-        sync                    /* additional sync needed on g4 */
-        isync
-        b       1b
-
-/*
  * call_setup_cpu - call the setup_cpu function for this cpu
  * r3 = data offset, r24 = cpu number
  *
diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S
index c70e20708a1f..21fd2c662a99 100644
--- a/arch/powerpc/kernel/misc_64.S
+++ b/arch/powerpc/kernel/misc_64.S
@@ -246,130 +246,6 @@ _GLOBAL(__flush_dcache_icache)
         isync
         blr
 
-/*
- * identify_cpu and calls setup_cpu
- * In:  r3 = base of the cpu_specs array
- *      r4 = address of cur_cpu_spec
- *      r5 = relocation offset
- */
-_GLOBAL(identify_cpu)
-        mfpvr   r7
-1:
-        lwz     r8,CPU_SPEC_PVR_MASK(r3)
-        and     r8,r8,r7
-        lwz     r9,CPU_SPEC_PVR_VALUE(r3)
-        cmplw   0,r9,r8
-        beq     1f
-        addi    r3,r3,CPU_SPEC_ENTRY_SIZE
-        b       1b
-1:
-        sub     r0,r3,r5
-        std     r0,0(r4)
-        ld      r4,CPU_SPEC_SETUP(r3)
-        cmpdi   0,r4,0
-        add     r4,r4,r5
-        beqlr
-        ld      r4,0(r4)
-        add     r4,r4,r5
-        mtctr   r4
-        /* Calling convention for cpu setup is r3=offset, r4=cur_cpu_spec */
-        mr      r4,r3
-        mr      r3,r5
-        bctr
-
-/*
- * do_cpu_ftr_fixups - goes through the list of CPU feature fixups
- * and writes nop's over sections of code that don't apply for this cpu.
- * r3 = data offset (not changed)
- */
-_GLOBAL(do_cpu_ftr_fixups)
-        /* Get CPU 0 features */
-        LOAD_REG_IMMEDIATE(r6,cur_cpu_spec)
-        sub     r6,r6,r3
-        ld      r4,0(r6)
-        sub     r4,r4,r3
-        ld      r4,CPU_SPEC_FEATURES(r4)
-        /* Get the fixup table */
-        LOAD_REG_IMMEDIATE(r6,__start___ftr_fixup)
-        sub     r6,r6,r3
-        LOAD_REG_IMMEDIATE(r7,__stop___ftr_fixup)
-        sub     r7,r7,r3
-        /* Do the fixup */
-1:      cmpld   r6,r7
-        bgelr
-        addi    r6,r6,32
-        ld      r8,-32(r6)      /* mask */
-        and     r8,r8,r4
-        ld      r9,-24(r6)      /* value */
-        cmpld   r8,r9
-        beq     1b
-        ld      r8,-16(r6)      /* section begin */
-        ld      r9,-8(r6)       /* section end */
-        subf.   r9,r8,r9
-        beq     1b
-        /* write nops over the section of code */
-        /* todo: if large section, add a branch at the start of it */
-        srwi    r9,r9,2
-        mtctr   r9
-        sub     r8,r8,r3
-        lis     r0,0x60000000@h /* nop */
-3:      stw     r0,0(r8)
-        andi.   r10,r4,CPU_FTR_SPLIT_ID_CACHE@l
-        beq     2f
-        dcbst   0,r8            /* suboptimal, but simpler */
-        sync
-        icbi    0,r8
-2:      addi    r8,r8,4
-        bdnz    3b
-        sync                    /* additional sync needed on g4 */
-        isync
-        b       1b
-
-/*
- * do_fw_ftr_fixups - goes through the list of firmware feature fixups
- * and writes nop's over sections of code that don't apply for this firmware.
- * r3 = data offset (not changed)
- */
-_GLOBAL(do_fw_ftr_fixups)
-        /* Get firmware features */
-        LOAD_REG_IMMEDIATE(r6,powerpc_firmware_features)
-        sub     r6,r6,r3
-        ld      r4,0(r6)
-        /* Get the fixup table */
-        LOAD_REG_IMMEDIATE(r6,__start___fw_ftr_fixup)
-        sub     r6,r6,r3
-        LOAD_REG_IMMEDIATE(r7,__stop___fw_ftr_fixup)
-        sub     r7,r7,r3
-        /* Do the fixup */
-1:      cmpld   r6,r7
-        bgelr
-        addi    r6,r6,32
-        ld      r8,-32(r6)      /* mask */
-        and     r8,r8,r4
-        ld      r9,-24(r6)      /* value */
-        cmpld   r8,r9
-        beq     1b
-        ld      r8,-16(r6)      /* section begin */
-        ld      r9,-8(r6)       /* section end */
-        subf.   r9,r8,r9
-        beq     1b
-        /* write nops over the section of code */
-        /* todo: if large section, add a branch at the start of it */
-        srwi    r9,r9,2
-        mtctr   r9
-        sub     r8,r8,r3
-        lis     r0,0x60000000@h /* nop */
-3:      stw     r0,0(r8)
-BEGIN_FTR_SECTION
-        dcbst   0,r8            /* suboptimal, but simpler */
-        sync
-        icbi    0,r8
-END_FTR_SECTION_IFSET(CPU_FTR_SPLIT_ID_CACHE)
-        addi    r8,r8,4
-        bdnz    3b
-        sync                    /* additional sync needed on g4 */
-        isync
-        b       1b
 
 #if defined(CONFIG_PPC_PMAC) || defined(CONFIG_PPC_MAPLE)
 /*
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
index 92f4e5f64f02..e2c3c6a85f33 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -24,6 +24,8 @@
 #include <linux/kernel.h>
 #include <linux/cache.h>
 
+#include "setup.h"
+
 #if 0
 #define DEBUGP printk
 #else
@@ -269,33 +271,50 @@ int apply_relocate_add(Elf32_Shdr *sechdrs,
         return 0;
 }
 
+static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
+                                    const Elf_Shdr *sechdrs,
+                                    const char *name)
+{
+        char *secstrings;
+        unsigned int i;
+
+        secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+        for (i = 1; i < hdr->e_shnum; i++)
+                if (strcmp(secstrings+sechdrs[i].sh_name, name) == 0)
+                        return &sechdrs[i];
+        return NULL;
+}
+
 int module_finalize(const Elf_Ehdr *hdr,
                     const Elf_Shdr *sechdrs,
                     struct module *me)
 {
-        char *secstrings;
-        unsigned int i;
+        const Elf_Shdr *sect;
 
         me->arch.bug_table = NULL;
         me->arch.num_bugs = 0;
 
         /* Find the __bug_table section, if present */
-        secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
-        for (i = 1; i < hdr->e_shnum; i++) {
-                if (strcmp(secstrings+sechdrs[i].sh_name, "__bug_table"))
-                        continue;
-                me->arch.bug_table = (void *) sechdrs[i].sh_addr;
-                me->arch.num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);
-                break;
+        sect = find_section(hdr, sechdrs, "__bug_table");
+        if (sect != NULL) {
+                me->arch.bug_table = (void *) sect->sh_addr;
+                me->arch.num_bugs = sect->sh_size / sizeof(struct bug_entry);
         }
 
-        /*
+        /*
          * Strictly speaking this should have a spinlock to protect against
          * traversals, but since we only traverse on BUG()s, a spinlock
          * could potentially lead to deadlock and thus be counter-productive.
          */
         list_add(&me->arch.bug_list, &module_bug_list);
 
+        /* Apply feature fixups */
+        sect = find_section(hdr, sechdrs, "__ftr_fixup");
+        if (sect != NULL)
+                do_feature_fixups(cur_cpu_spec->cpu_features,
+                                  (void *)sect->sh_addr,
+                                  (void *)sect->sh_addr + sect->sh_size);
+
         return 0;
 }
 
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index ba34001fca8e..8dd1f0aae5d6 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -22,6 +22,9 @@
 #include <linux/vmalloc.h>
 #include <asm/module.h>
 #include <asm/uaccess.h>
+#include <asm/firmware.h>
+
+#include "setup.h"
 
 /* FIXME: We don't do .init separately.  To do this, we'd need to have
    a separate r2 value in the init and core section, and stub between
@@ -400,6 +403,11 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                                 | (value & 0x03fffffc);
                         break;
 
+                case R_PPC64_REL64:
+                        /* 64 bits relative (used by features fixups) */
+                        *location = value - (unsigned long)location;
+                        break;
+
                 default:
                         printk("%s: Unknown ADD relocation: %lu\n",
                                me->name,
@@ -413,23 +421,33 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 
 LIST_HEAD(module_bug_list);
 
-int module_finalize(const Elf_Ehdr *hdr,
-                const Elf_Shdr *sechdrs, struct module *me)
+static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
+                                    const Elf_Shdr *sechdrs,
+                                    const char *name)
 {
         char *secstrings;
         unsigned int i;
 
+        secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
+        for (i = 1; i < hdr->e_shnum; i++)
+                if (strcmp(secstrings+sechdrs[i].sh_name, name) == 0)
+                        return &sechdrs[i];
+        return NULL;
+}
+
+int module_finalize(const Elf_Ehdr *hdr,
+                const Elf_Shdr *sechdrs, struct module *me)
+{
+        const Elf_Shdr *sect;
+
         me->arch.bug_table = NULL;
         me->arch.num_bugs = 0;
 
         /* Find the __bug_table section, if present */
-        secstrings = (char *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
-        for (i = 1; i < hdr->e_shnum; i++) {
-                if (strcmp(secstrings+sechdrs[i].sh_name, "__bug_table"))
-                        continue;
-                me->arch.bug_table = (void *) sechdrs[i].sh_addr;
-                me->arch.num_bugs = sechdrs[i].sh_size / sizeof(struct bug_entry);
-                break;
+        sect = find_section(hdr, sechdrs, "__bug_table");
+        if (sect != NULL) {
+                me->arch.bug_table = (void *) sect->sh_addr;
+                me->arch.num_bugs = sect->sh_size / sizeof(struct bug_entry);
         }
 
         /*
@@ -439,6 +457,19 @@ int module_finalize(const Elf_Ehdr *hdr,
          */
         list_add(&me->arch.bug_list, &module_bug_list);
 
+        /* Apply feature fixups */
+        sect = find_section(hdr, sechdrs, "__ftr_fixup");
+        if (sect != NULL)
+                do_feature_fixups(cur_cpu_spec->cpu_features,
+                                  (void *)sect->sh_addr,
+                                  (void *)sect->sh_addr + sect->sh_size);
+
+        sect = find_section(hdr, sechdrs, "__fw_ftr_fixup");
+        if (sect != NULL)
+                do_feature_fixups(powerpc_firmware_features,
+                                  (void *)sect->sh_addr,
+                                  (void *)sect->sh_addr + sect->sh_size);
+
         return 0;
 }
 
diff --git a/arch/powerpc/kernel/pci_32.c b/arch/powerpc/kernel/pci_32.c
index 9b49f8691d29..0d9ff72e2852 100644
--- a/arch/powerpc/kernel/pci_32.c
+++ b/arch/powerpc/kernel/pci_32.c
@@ -441,14 +441,14 @@ update_bridge_base(struct pci_bus *bus, int i)
                 end = res->end - off;
                 io_base_lo = (start >> 8) & PCI_IO_RANGE_MASK;
                 io_limit_lo = (end >> 8) & PCI_IO_RANGE_MASK;
-                if (end > 0xffff) {
-                        pci_write_config_word(dev, PCI_IO_BASE_UPPER16,
-                                              start >> 16);
-                        pci_write_config_word(dev, PCI_IO_LIMIT_UPPER16,
-                                              end >> 16);
+                if (end > 0xffff)
                         io_base_lo |= PCI_IO_RANGE_TYPE_32;
-                } else
+                else
                         io_base_lo |= PCI_IO_RANGE_TYPE_16;
+                pci_write_config_word(dev, PCI_IO_BASE_UPPER16,
+                                start >> 16);
+                pci_write_config_word(dev, PCI_IO_LIMIT_UPPER16,
+                                end >> 16);
                 pci_write_config_byte(dev, PCI_IO_BASE, io_base_lo);
                 pci_write_config_byte(dev, PCI_IO_LIMIT, io_limit_lo);
 
diff --git a/arch/powerpc/kernel/pci_64.c b/arch/powerpc/kernel/pci_64.c
index 78d3c0fc8dfb..9bae8a5bf671 100644
--- a/arch/powerpc/kernel/pci_64.c
+++ b/arch/powerpc/kernel/pci_64.c
@@ -199,8 +199,14 @@ struct pci_controller * pcibios_alloc_controller(struct device_node *dev)
         pci_setup_pci_controller(phb);
         phb->arch_data = dev;
         phb->is_dynamic = mem_init_done;
-        if (dev)
-                PHB_SET_NODE(phb, of_node_to_nid(dev));
+        if (dev) {
+                int nid = of_node_to_nid(dev);
+
+                if (nid < 0 || !node_online(nid))
+                        nid = -1;
+
+                PHB_SET_NODE(phb, nid);
+        }
         return phb;
 }
 
diff --git a/arch/powerpc/kernel/perfmon_fsl_booke.c b/arch/powerpc/kernel/perfmon_fsl_booke.c
deleted file mode 100644
index e0dcf2b41fbe..000000000000
--- a/arch/powerpc/kernel/perfmon_fsl_booke.c
+++ /dev/null
@@ -1,221 +0,0 @@
-/* arch/powerpc/kernel/perfmon_fsl_booke.c
- * Freescale Book-E Performance Monitor code
- *
- * Author: Andy Fleming
- * Copyright (c) 2004 Freescale Semiconductor, Inc
- *
- *  This program is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU General Public License
- *  as published by the Free Software Foundation; either version
- *  2 of the License, or (at your option) any later version.
- */
-
-#include <linux/errno.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
-#include <linux/mm.h>
-#include <linux/stddef.h>
-#include <linux/unistd.h>
-#include <linux/ptrace.h>
-#include <linux/slab.h>
-#include <linux/user.h>
-#include <linux/a.out.h>
-#include <linux/interrupt.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/prctl.h>
-
-#include <asm/pgtable.h>
-#include <asm/uaccess.h>
-#include <asm/system.h>
-#include <asm/io.h>
-#include <asm/reg.h>
-#include <asm/xmon.h>
-#include <asm/pmc.h>
-
-static inline u32 get_pmlca(int ctr);
-static inline void set_pmlca(int ctr, u32 pmlca);
-
-static inline u32 get_pmlca(int ctr)
-{
-        u32 pmlca;
-
-        switch (ctr) {
-                case 0:
-                        pmlca = mfpmr(PMRN_PMLCA0);
-                        break;
-                case 1:
-                        pmlca = mfpmr(PMRN_PMLCA1);
-                        break;
-                case 2:
-                        pmlca = mfpmr(PMRN_PMLCA2);
-                        break;
-                case 3:
-                        pmlca = mfpmr(PMRN_PMLCA3);
-                        break;
-                default:
-                        panic("Bad ctr number\n");
-        }
-
-        return pmlca;
-}
-
-static inline void set_pmlca(int ctr, u32 pmlca)
-{
-        switch (ctr) {
-                case 0:
-                        mtpmr(PMRN_PMLCA0, pmlca);
-                        break;
-                case 1:
-                        mtpmr(PMRN_PMLCA1, pmlca);
-                        break;
-                case 2:
-                        mtpmr(PMRN_PMLCA2, pmlca);
-                        break;
-                case 3:
-                        mtpmr(PMRN_PMLCA3, pmlca);
-                        break;
-                default:
-                        panic("Bad ctr number\n");
-        }
-}
-
-void init_pmc_stop(int ctr)
-{
-        u32 pmlca = (PMLCA_FC | PMLCA_FCS | PMLCA_FCU |
-                        PMLCA_FCM1 | PMLCA_FCM0);
-        u32 pmlcb = 0;
-
-        switch (ctr) {
-                case 0:
-                        mtpmr(PMRN_PMLCA0, pmlca);
-                        mtpmr(PMRN_PMLCB0, pmlcb);
-                        break;
-                case 1:
-                        mtpmr(PMRN_PMLCA1, pmlca);
-                        mtpmr(PMRN_PMLCB1, pmlcb);
-                        break;
-                case 2:
-                        mtpmr(PMRN_PMLCA2, pmlca);
-                        mtpmr(PMRN_PMLCB2, pmlcb);
-                        break;
-                case 3:
-                        mtpmr(PMRN_PMLCA3, pmlca);
-                        mtpmr(PMRN_PMLCB3, pmlcb);
-                        break;
-                default:
-                        panic("Bad ctr number!\n");
-        }
-}
-
-void set_pmc_event(int ctr, int event)
-{
-        u32 pmlca;
-
-        pmlca = get_pmlca(ctr);
-
-        pmlca = (pmlca & ~PMLCA_EVENT_MASK) |
-                ((event << PMLCA_EVENT_SHIFT) &
-                 PMLCA_EVENT_MASK);
-
-        set_pmlca(ctr, pmlca);
-}
-
-void set_pmc_user_kernel(int ctr, int user, int kernel)
-{
-        u32 pmlca;
-
-        pmlca = get_pmlca(ctr);
-
-        if(user)
-                pmlca &= ~PMLCA_FCU;
-        else
-                pmlca |= PMLCA_FCU;
-
-        if(kernel)
-                pmlca &= ~PMLCA_FCS;
-        else
-                pmlca |= PMLCA_FCS;
-
-        set_pmlca(ctr, pmlca);
-}
-
-void set_pmc_marked(int ctr, int mark0, int mark1)
-{
-        u32 pmlca = get_pmlca(ctr);
-
-        if(mark0)
-                pmlca &= ~PMLCA_FCM0;
-        else
-                pmlca |= PMLCA_FCM0;
-
-        if(mark1)
-                pmlca &= ~PMLCA_FCM1;
-        else
-                pmlca |= PMLCA_FCM1;
-
-        set_pmlca(ctr, pmlca);
-}
-
-void pmc_start_ctr(int ctr, int enable)
-{
-        u32 pmlca = get_pmlca(ctr);
-
-        pmlca &= ~PMLCA_FC;
-
-        if (enable)
-                pmlca |= PMLCA_CE;
-        else
-                pmlca &= ~PMLCA_CE;
-
-        set_pmlca(ctr, pmlca);
-}
-
-void pmc_start_ctrs(int enable)
-{
-        u32 pmgc0 = mfpmr(PMRN_PMGC0);
-
-        pmgc0 &= ~PMGC0_FAC;
-        pmgc0 |= PMGC0_FCECE;
-
-        if (enable)
-                pmgc0 |= PMGC0_PMIE;
-        else
-                pmgc0 &= ~PMGC0_PMIE;
-
-        mtpmr(PMRN_PMGC0, pmgc0);
-}
-
-void pmc_stop_ctrs(void)
-{
-        u32 pmgc0 = mfpmr(PMRN_PMGC0);
-
-        pmgc0 |= PMGC0_FAC;
-
-        pmgc0 &= ~(PMGC0_PMIE | PMGC0_FCECE);
-
-        mtpmr(PMRN_PMGC0, pmgc0);
-}
-
-void dump_pmcs(void)
-{
-        printk("pmgc0: %x\n", mfpmr(PMRN_PMGC0));
-        printk("pmc\t\tpmlca\t\tpmlcb\n");
-        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC0),
-                        mfpmr(PMRN_PMLCA0), mfpmr(PMRN_PMLCB0));
-        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC1),
-                        mfpmr(PMRN_PMLCA1), mfpmr(PMRN_PMLCB1));
-        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC2),
-                        mfpmr(PMRN_PMLCA2), mfpmr(PMRN_PMLCB2));
-        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC3),
-                        mfpmr(PMRN_PMLCA3), mfpmr(PMRN_PMLCB3));
-}
-
-EXPORT_SYMBOL(init_pmc_stop);
-EXPORT_SYMBOL(set_pmc_event);
-EXPORT_SYMBOL(set_pmc_user_kernel);
-EXPORT_SYMBOL(set_pmc_marked);
-EXPORT_SYMBOL(pmc_start_ctr);
-EXPORT_SYMBOL(pmc_start_ctrs);
-EXPORT_SYMBOL(pmc_stop_ctrs);
-EXPORT_SYMBOL(dump_pmcs);
diff --git a/arch/powerpc/kernel/pmc.c b/arch/powerpc/kernel/pmc.c
index a0a2efadeabf..3d8f6f44641e 100644
--- a/arch/powerpc/kernel/pmc.c
+++ b/arch/powerpc/kernel/pmc.c
@@ -71,7 +71,7 @@ int reserve_pmc_hardware(perf_irq_t new_perf_irq)
         }
 
         pmc_owner_caller = __builtin_return_address(0);
-        perf_irq = new_perf_irq ? : dummy_perf;
+        perf_irq = new_perf_irq ? new_perf_irq : dummy_perf;
 
  out:
         spin_unlock(&pmc_owner_lock);
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 7b2f6452ba72..f3d4dd580dd6 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -341,13 +341,6 @@ struct task_struct *__switch_to(struct task_struct *prev,
 
 static int instructions_to_print = 16;
 
-#ifdef CONFIG_PPC64
-#define BAD_PC(pc)      ((REGION_ID(pc) != KERNEL_REGION_ID) && \
-                         (REGION_ID(pc) != VMALLOC_REGION_ID))
-#else
-#define BAD_PC(pc)      ((pc) < KERNELBASE)
-#endif
-
 static void show_instructions(struct pt_regs *regs)
 {
         int i;
@@ -366,7 +359,8 @@ static void show_instructions(struct pt_regs *regs)
                  * bad address because the pc *should* only be a
                  * kernel address.
                  */
-                if (BAD_PC(pc) || __get_user(instr, (unsigned int __user *)pc)) {
+                if (!__kernel_text_address(pc) ||
+                     __get_user(instr, (unsigned int __user *)pc)) {
                         printk("XXXXXXXX ");
                 } else {
                         if (regs->nip == pc)
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 865b9648d0d5..bdb412d4b748 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -1014,7 +1014,7 @@ EXPORT_SYMBOL(find_all_nodes);
 /** Checks if the given "compat" string matches one of the strings in
  * the device's "compatible" property
  */
-int device_is_compatible(struct device_node *device, const char *compat)
+int device_is_compatible(const struct device_node *device, const char *compat)
 {
         const char* cp;
         int cplen, l;
@@ -1491,7 +1491,8 @@ static int __init prom_reconfig_setup(void)
 __initcall(prom_reconfig_setup);
 #endif
 
-struct property *of_find_property(struct device_node *np, const char *name,
+struct property *of_find_property(const struct device_node *np,
+                                  const char *name,
                                   int *lenp)
 {
         struct property *pp;
@@ -1512,7 +1513,8 @@ struct property *of_find_property(struct device_node *np, const char *name,
  * Find a property with a given name for a given node
  * and return the value.
  */
-const void *get_property(struct device_node *np, const char *name, int *lenp)
+const void *get_property(const struct device_node *np, const char *name,
+                         int *lenp)
 {
         struct property *pp = of_find_property(np,name,lenp);
         return pp ? pp->value : NULL;
diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 1442b63a75da..6f6fc977cb39 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -72,6 +72,10 @@
 #define VALIDATE_BUF_SIZE 4096    
 #define RTAS_MSG_MAXLEN   64
 
+/* Quirk - RTAS requires 4k list length and block size */
+#define RTAS_BLKLIST_LENGTH 4096
+#define RTAS_BLK_SIZE 4096
+
 struct flash_block {
         char *data;
         unsigned long length;
@@ -83,7 +87,7 @@ struct flash_block {
  * into a version/length and translate the pointers
  * to absolute.
  */
-#define FLASH_BLOCKS_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct flash_block))
+#define FLASH_BLOCKS_PER_NODE ((RTAS_BLKLIST_LENGTH - 16) / sizeof(struct flash_block))
 struct flash_block_list {
         unsigned long num_blocks;
         struct flash_block_list *next;
@@ -96,6 +100,9 @@ struct flash_block_list_header { /* just the header of flash_block_list */
 
 static struct flash_block_list_header rtas_firmware_flash_list = {0, NULL};
 
+/* Use slab cache to guarantee 4k alignment */
+static kmem_cache_t *flash_block_cache = NULL;
+
 #define FLASH_BLOCK_LIST_VERSION (1UL)
 
 /* Local copy of the flash block list.
@@ -153,7 +160,7 @@ static int flash_list_valid(struct flash_block_list *flist)
                                 return FLASH_IMG_NULL_DATA;
                         }
                         block_size = f->blocks[i].length;
-                        if (block_size <= 0 || block_size > PAGE_SIZE) {
+                        if (block_size <= 0 || block_size > RTAS_BLK_SIZE) {
                                 return FLASH_IMG_BAD_LEN;
                         }
                         image_size += block_size;
@@ -177,9 +184,9 @@ static void free_flash_list(struct flash_block_list *f)
 
         while (f) {
                 for (i = 0; i < f->num_blocks; i++)
-                        free_page((unsigned long)(f->blocks[i].data));
+                        kmem_cache_free(flash_block_cache, f->blocks[i].data);
                 next = f->next;
-                free_page((unsigned long)f);
+                kmem_cache_free(flash_block_cache, f);
                 f = next;
         }
 }
@@ -278,6 +285,12 @@ static ssize_t rtas_flash_read(struct file *file, char __user *buf,
         return msglen;
 }
 
+/* constructor for flash_block_cache */
+void rtas_block_ctor(void *ptr, kmem_cache_t *cache, unsigned long flags)
+{
+        memset(ptr, 0, RTAS_BLK_SIZE);
+}
+
 /* We could be much more efficient here.  But to keep this function
  * simple we allocate a page to the block list no matter how small the
  * count is.  If the system is low on memory it will be just as well
@@ -302,7 +315,7 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
          * proc file
          */
         if (uf->flist == NULL) {
-                uf->flist = (struct flash_block_list *) get_zeroed_page(GFP_KERNEL);
+                uf->flist = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                 if (!uf->flist)
                         return -ENOMEM;
         }
@@ -313,21 +326,21 @@ static ssize_t rtas_flash_write(struct file *file, const char __user *buffer,
         next_free = fl->num_blocks;
         if (next_free == FLASH_BLOCKS_PER_NODE) {
                 /* Need to allocate another block_list */
-                fl->next = (struct flash_block_list *)get_zeroed_page(GFP_KERNEL);
+                fl->next = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
                 if (!fl->next)
                         return -ENOMEM;
                 fl = fl->next;
                 next_free = 0;
         }
 
-        if (count > PAGE_SIZE)
-                count = PAGE_SIZE;
-        p = (char *)get_zeroed_page(GFP_KERNEL);
+        if (count > RTAS_BLK_SIZE)
+                count = RTAS_BLK_SIZE;
+        p = kmem_cache_alloc(flash_block_cache, GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
         
         if(copy_from_user(p, buffer, count)) {
-                free_page((unsigned long)p);
+                kmem_cache_free(flash_block_cache, p);
                 return -EFAULT;
         }
         fl->blocks[next_free].data = p;
@@ -791,6 +804,16 @@ int __init rtas_flash_init(void)
                 goto cleanup;
 
         rtas_flash_term_hook = rtas_flash_firmware;
+
+        flash_block_cache = kmem_cache_create("rtas_flash_cache",
+                                RTAS_BLK_SIZE, RTAS_BLK_SIZE, 0,
+                                rtas_block_ctor, NULL);
+        if (!flash_block_cache) {
+                printk(KERN_ERR "%s: failed to create block cache\n",
+                                __FUNCTION__);
+                rc = -ENOMEM;
+                goto cleanup;
+        }
         return 0;
 
 cleanup:
@@ -805,6 +828,10 @@ cleanup:
 void __exit rtas_flash_cleanup(void)
 {
         rtas_flash_term_hook = NULL;
+
+        if (flash_block_cache)
+                kmem_cache_destroy(flash_block_cache);
+
         remove_flash_pde(firmware_flash_pde);
         remove_flash_pde(firmware_update_pde);
         remove_flash_pde(validate_pde);
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index 191d0ab09222..a4c2964a3ca6 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -91,6 +91,7 @@ int ucache_bsize;
 unsigned long __init early_init(unsigned long dt_ptr)
 {
         unsigned long offset = reloc_offset();
+        struct cpu_spec *spec;
 
         /* First zero the BSS -- use memset_io, some platforms don't have
          * caches on yet */
@@ -100,8 +101,11 @@ unsigned long __init early_init(unsigned long dt_ptr)
          * Identify the CPU type and fix up code sections
          * that depend on which cpu we have.
          */
-        identify_cpu(offset, 0);
-        do_cpu_ftr_fixups(offset);
+        spec = identify_cpu(offset);
+
+        do_feature_fixups(spec->cpu_features,
+                          PTRRELOC(&__start___ftr_fixup),
+                          PTRRELOC(&__stop___ftr_fixup));
 
         return KERNELBASE + offset;
 }
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 4b2e32eab9dc..16278968dab6 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -170,6 +170,9 @@ void __init setup_paca(int cpu)
 
 void __init early_setup(unsigned long dt_ptr)
 {
+        /* Identify CPU type */
+        identify_cpu(0);
+
         /* Assume we're on cpu 0 for now. Don't write to the paca yet! */
         setup_paca(0);
 
@@ -348,6 +351,14 @@ void __init setup_system(void)
 {
         DBG(" -> setup_system()\n");
 
+        /* Apply the CPUs-specific and firmware specific fixups to kernel
+         * text (nop out sections not relevant to this CPU or this firmware)
+         */
+        do_feature_fixups(cur_cpu_spec->cpu_features,
+                          &__start___ftr_fixup, &__stop___ftr_fixup);
+        do_feature_fixups(powerpc_firmware_features,
+                          &__start___fw_ftr_fixup, &__stop___fw_ftr_fixup);
+
         /*
          * Unflatten the device-tree passed by prom_init or kexec
          */
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 5b59bc18dfe7..46a24de36fec 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -220,11 +220,8 @@ static void account_process_time(struct pt_regs *regs)
  */
 struct cpu_purr_data {
         int     initialized;                    /* thread is running */
-        u64     tb0;                    /* timebase at origin time */
-        u64     purr0;                  /* PURR at origin time */
         u64     tb;                     /* last TB value read */
         u64     purr;                   /* last PURR value read */
-        u64     stolen;                 /* stolen time so far */
         spinlock_t lock;
 };
 
@@ -234,10 +231,8 @@ static void snapshot_tb_and_purr(void *data)
 {
         struct cpu_purr_data *p = &__get_cpu_var(cpu_purr_data);
 
-        p->tb0 = mftb();
-        p->purr0 = mfspr(SPRN_PURR);
-        p->tb = p->tb0;
-        p->purr = 0;
+        p->tb = mftb();
+        p->purr = mfspr(SPRN_PURR);
         wmb();
         p->initialized = 1;
 }
@@ -258,37 +253,24 @@ void snapshot_timebases(void)
 
 void calculate_steal_time(void)
 {
-        u64 tb, purr, t0;
+        u64 tb, purr;
         s64 stolen;
-        struct cpu_purr_data *p0, *pme, *phim;
-        int cpu;
+        struct cpu_purr_data *pme;
 
         if (!cpu_has_feature(CPU_FTR_PURR))
                 return;
-        cpu = smp_processor_id();
-        pme = &per_cpu(cpu_purr_data, cpu);
+        pme = &per_cpu(cpu_purr_data, smp_processor_id());
         if (!pme->initialized)
                 return;         /* this can happen in early boot */
-        p0 = &per_cpu(cpu_purr_data, cpu & ~1);
-        phim = &per_cpu(cpu_purr_data, cpu ^ 1);
-        spin_lock(&p0->lock);
+        spin_lock(&pme->lock);
         tb = mftb();
-        purr = mfspr(SPRN_PURR) - pme->purr0;
-        if (!phim->initialized || !cpu_online(cpu ^ 1)) {
-                stolen = (tb - pme->tb) - (purr - pme->purr);
-        } else {
-                t0 = pme->tb0;
-                if (phim->tb0 < t0)
-                        t0 = phim->tb0;
-                stolen = phim->tb - t0 - phim->purr - purr - p0->stolen;
-        }
-        if (stolen > 0) {
+        purr = mfspr(SPRN_PURR);
+        stolen = (tb - pme->tb) - (purr - pme->purr);
+        if (stolen > 0)
                 account_steal_time(current, stolen);
-                p0->stolen += stolen;
-        }
         pme->tb = tb;
         pme->purr = purr;
-        spin_unlock(&p0->lock);
+        spin_unlock(&pme->lock);
 }
 
 /*
@@ -297,30 +279,17 @@ void calculate_steal_time(void)
  */
 static void snapshot_purr(void)
 {
-        int cpu;
-        u64 purr;
-        struct cpu_purr_data *p0, *pme, *phim;
+        struct cpu_purr_data *pme;
         unsigned long flags;
 
         if (!cpu_has_feature(CPU_FTR_PURR))
                 return;
-        cpu = smp_processor_id();
-        pme = &per_cpu(cpu_purr_data, cpu);
-        p0 = &per_cpu(cpu_purr_data, cpu & ~1);
-        phim = &per_cpu(cpu_purr_data, cpu ^ 1);
-        spin_lock_irqsave(&p0->lock, flags);
-        pme->tb = pme->tb0 = mftb();
-        purr = mfspr(SPRN_PURR);
-        if (!phim->initialized) {
-                pme->purr = 0;
-                pme->purr0 = purr;
-        } else {
-                /* set p->purr and p->purr0 for no change in p0->stolen */
-                pme->purr = phim->tb - phim->tb0 - phim->purr - p0->stolen;
-                pme->purr0 = purr - pme->purr;
-        }
+        pme = &per_cpu(cpu_purr_data, smp_processor_id());
+        spin_lock_irqsave(&pme->lock, flags);
+        pme->tb = mftb();
+        pme->purr = mfspr(SPRN_PURR);
         pme->initialized = 1;
-        spin_unlock_irqrestore(&p0->lock, flags);
+        spin_unlock_irqrestore(&pme->lock, flags);
 }
 
 #endif /* CONFIG_PPC_SPLPAR */
@@ -1045,48 +1014,6 @@ void __init time_init(void)
         set_dec(tb_ticks_per_jiffy);
 }
 
-#ifdef CONFIG_RTC_CLASS
-static int set_rtc_class_time(struct rtc_time *tm)
-{
-        int err;
-        struct class_device *class_dev =
-                rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-        if (class_dev == NULL)
-                return -ENODEV;
-
-        err = rtc_set_time(class_dev, tm);
-
-        rtc_class_close(class_dev);
-
-        return 0;
-}
-
-static void get_rtc_class_time(struct rtc_time *tm)
-{
-        int err;
-        struct class_device *class_dev =
-                rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
-
-        if (class_dev == NULL)
-                return;
-
-        err = rtc_read_time(class_dev, tm);
-
-        rtc_class_close(class_dev);
-
-        return;
-}
-
-int __init rtc_class_hookup(void)
-{
-        ppc_md.get_rtc_time = get_rtc_class_time;
-        ppc_md.set_rtc_time = set_rtc_class_time;
-
-        return 0;
-}
-#endif /* CONFIG_RTC_CLASS */
-
 
 #define FEBRUARY        2
 #define STARTOFTIME     1970
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index d9f10f2fc372..c66b4771ef44 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -843,7 +843,7 @@ void __kprobes program_check_exception(struct pt_regs *regs)
 
 void alignment_exception(struct pt_regs *regs)
 {
-        int fixed = 0;
+        int sig, code, fixed = 0;
 
         /* we don't implement logging of alignment exceptions */
         if (!(current->thread.align_ctl & PR_UNALIGN_SIGBUS))
@@ -857,14 +857,16 @@ void alignment_exception(struct pt_regs *regs)
 
         /* Operand address was bad */
         if (fixed == -EFAULT) {
-                if (user_mode(regs))
-                        _exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
-                else
-                        /* Search exception table */
-                        bad_page_fault(regs, regs->dar, SIGSEGV);
-                return;
+                sig = SIGSEGV;
+                code = SEGV_ACCERR;
+        } else {
+                sig = SIGBUS;
+                code = BUS_ADRALN;
         }
-        _exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+        if (user_mode(regs))
+                _exception(sig, regs, code, regs->dar);
+        else
+                bad_page_fault(regs, regs->dar, sig);
 }
 
 void StackOverflow(struct pt_regs *regs)
@@ -900,14 +902,13 @@ void kernel_fp_unavailable_exception(struct pt_regs *regs)
 
 void altivec_unavailable_exception(struct pt_regs *regs)
 {
-#if !defined(CONFIG_ALTIVEC)
         if (user_mode(regs)) {
                 /* A user program has executed an altivec instruction,
                    but this kernel doesn't support altivec. */
                 _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
                 return;
         }
-#endif
+
         printk(KERN_EMERG "Unrecoverable VMX/Altivec Unavailable Exception "
                         "%lx at %lx\n", regs->trap, regs->nip);
         die("Unrecoverable VMX/Altivec Unavailable Exception", regs, SIGABRT);
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index 1a7e19cdab39..c913ad5cad29 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -36,6 +36,8 @@
 #include <asm/vdso.h>
 #include <asm/vdso_datapage.h>
 
+#include "setup.h"
+
 #undef DEBUG
 
 #ifdef DEBUG
@@ -586,6 +588,43 @@ static __init int vdso_fixup_datapage(struct lib32_elfinfo *v32,
         return 0;
 }
 
+
+static __init int vdso_fixup_features(struct lib32_elfinfo *v32,
+                                      struct lib64_elfinfo *v64)
+{
+        void *start32;
+        unsigned long size32;
+
+#ifdef CONFIG_PPC64
+        void *start64;
+        unsigned long size64;
+
+        start64 = find_section64(v64->hdr, "__ftr_fixup", &size64);
+        if (start64)
+                do_feature_fixups(cur_cpu_spec->cpu_features,
+                                  start64, start64 + size64);
+
+        start64 = find_section64(v64->hdr, "__fw_ftr_fixup", &size64);
+        if (start64)
+                do_feature_fixups(powerpc_firmware_features,
+                                  start64, start64 + size64);
+#endif /* CONFIG_PPC64 */
+
+        start32 = find_section32(v32->hdr, "__ftr_fixup", &size32);
+        if (start32)
+                do_feature_fixups(cur_cpu_spec->cpu_features,
+                                  start32, start32 + size32);
+
+#ifdef CONFIG_PPC64
+        start32 = find_section32(v32->hdr, "__fw_ftr_fixup", &size32);
+        if (start32)
+                do_feature_fixups(powerpc_firmware_features,
+                                  start32, start32 + size32);
+#endif /* CONFIG_PPC64 */
+
+        return 0;
+}
+
 static __init int vdso_fixup_alt_funcs(struct lib32_elfinfo *v32,
                                        struct lib64_elfinfo *v64)
 {
@@ -634,6 +673,9 @@ static __init int vdso_setup(void)
         if (vdso_fixup_datapage(&v32, &v64))
                 return -1;
 
+        if (vdso_fixup_features(&v32, &v64))
+                return -1;
+
         if (vdso_fixup_alt_funcs(&v32, &v64))
                 return -1;
 
@@ -714,6 +756,7 @@ void __init vdso_init(void)
          * Setup the syscall map in the vDOS
          */
         vdso_setup_syscall_map();
+
         /*
          * Initialize the vDSO images in memory, that is do necessary
          * fixups of vDSO symbols, locate trampolines, etc...
diff --git a/arch/powerpc/kernel/vdso32/vdso32.lds.S b/arch/powerpc/kernel/vdso32/vdso32.lds.S
index 6187af2d54c3..26e138c4ce17 100644
--- a/arch/powerpc/kernel/vdso32/vdso32.lds.S
+++ b/arch/powerpc/kernel/vdso32/vdso32.lds.S
@@ -32,6 +32,18 @@ SECTIONS
   PROVIDE (_etext = .);
   PROVIDE (etext = .);
 
+  . = ALIGN(8);
+  __ftr_fixup : {
+    *(__ftr_fixup)
+  }
+
+#ifdef CONFIG_PPC64
+  . = ALIGN(8);
+  __fw_ftr_fixup : {
+    *(__fw_ftr_fixup)
+  }
+#endif
+
   /* Other stuff is appended to the text segment: */
   .rodata               : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
   .rodata1              : { *(.rodata1) }
diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
index 56e76ff5498f..40ffd9b6cef7 100644
--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
+++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
@@ -229,8 +229,10 @@ V_FUNCTION_BEGIN(__do_get_xsec)
         xor     r0,r8,r8                /* create dependency */
         add     r3,r3,r0
 
-        /* Get TB & offset it */
-        mftb    r7
+        /* Get TB & offset it. We use the MFTB macro which will generate
+         * workaround code for Cell.
+         */
+        MFTB(r7)
         ld      r9,CFG_TB_ORIG_STAMP(r3)
         subf    r7,r9,r7
 
diff --git a/arch/powerpc/kernel/vdso64/vdso64.lds.S b/arch/powerpc/kernel/vdso64/vdso64.lds.S
index 4a2b6dc0960c..2d70f35d50b5 100644
--- a/arch/powerpc/kernel/vdso64/vdso64.lds.S
+++ b/arch/powerpc/kernel/vdso64/vdso64.lds.S
@@ -31,6 +31,16 @@ SECTIONS
   PROVIDE (_etext = .);
   PROVIDE (etext = .);
 
+  . = ALIGN(8);
+  __ftr_fixup : {
+    *(__ftr_fixup)
+  }
+
+  . = ALIGN(8);
+  __fw_ftr_fixup : {
+    *(__fw_ftr_fixup)
+  }
+
   /* Other stuff is appended to the text segment: */
   .rodata         : { *(.rodata .rodata.* .gnu.linkonce.r.*) }
   .rodata1        : { *(.rodata1) }
diff --git a/arch/powerpc/kernel/vio.c b/arch/powerpc/kernel/vio.c
index cb87e71eec66..ed007878d1bf 100644
--- a/arch/powerpc/kernel/vio.c
+++ b/arch/powerpc/kernel/vio.c
@@ -92,9 +92,9 @@ static struct iommu_table *vio_build_iommu_table(struct vio_dev *dev)
                                 &tbl->it_index, &offset, &size);
 
                 /* TCE table size - measured in tce entries */
-                tbl->it_size = size >> PAGE_SHIFT;
+                tbl->it_size = size >> IOMMU_PAGE_SHIFT;
                 /* offset for VIO should always be 0 */
-                tbl->it_offset = offset >> PAGE_SHIFT;
+                tbl->it_offset = offset >> IOMMU_PAGE_SHIFT;
                 tbl->it_busno = 0;
                 tbl->it_type = TCE_VB;
 
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index cb0e8d46c3e8..e8342d867536 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -108,13 +108,7 @@ SECTIONS
 
         .initcall.init : {
                 __initcall_start = .;
-                *(.initcall1.init)
-                *(.initcall2.init)
-                *(.initcall3.init)
-                *(.initcall4.init)
-                *(.initcall5.init)
-                *(.initcall6.init)
-                *(.initcall7.init)
+                INITCALLS
                 __initcall_end = .;
                 }
 
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 9590ba780b98..7e8ded051b5b 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -9,6 +9,7 @@
  * 2 of the License, or (at your option) any later version.
  */
 #include <linux/kernel.h>
+#include <linux/kprobes.h>
 #include <linux/ptrace.h>
 #include <asm/sstep.h>
 #include <asm/processor.h>
@@ -25,7 +26,7 @@ extern char system_call_common[];
 /*
  * Determine whether a conditional branch instruction would branch.
  */
-static int branch_taken(unsigned int instr, struct pt_regs *regs)
+static int __kprobes branch_taken(unsigned int instr, struct pt_regs *regs)
 {
         unsigned int bo = (instr >> 21) & 0x1f;
         unsigned int bi;
@@ -51,7 +52,7 @@ static int branch_taken(unsigned int instr, struct pt_regs *regs)
  * or -1 if the instruction is one that should not be stepped,
  * such as an rfid, or a mtmsrd that would clear MSR_RI.
  */
-int emulate_step(struct pt_regs *regs, unsigned int instr)
+int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
 {
         unsigned int opcode, rd;
         unsigned long int imm;
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index 5615acc29527..506d89768d45 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -480,9 +480,6 @@ static int open_high_hpage_areas(struct mm_struct *mm, u16 newareas)
 
         mm->context.high_htlb_areas |= newareas;
 
-        /* update the paca copy of the context struct */
-        get_paca()->context = mm->context;
-
         /* the context change must make it to memory before the flush,
          * so that further SLB misses do the right thing. */
         mb();
@@ -494,11 +491,15 @@ static int open_high_hpage_areas(struct mm_struct *mm, u16 newareas)
         return 0;
 }
 
-int prepare_hugepage_range(unsigned long addr, unsigned long len)
+int prepare_hugepage_range(unsigned long addr, unsigned long len, pgoff_t pgoff)
 {
         int err = 0;
 
-        if ( (addr+len) < addr )
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
+        if (len & ~HPAGE_MASK)
+                return -EINVAL;
+        if (addr & ~HPAGE_MASK)
                 return -EINVAL;
 
         if (addr < 0x100000000UL)
diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
index 16fe027bbc12..d1c0758c5611 100644
--- a/arch/powerpc/mm/mem.c
+++ b/arch/powerpc/mm/mem.c
@@ -307,11 +307,12 @@ void __init paging_init(void)
                top_of_ram, total_ram);
         printk(KERN_DEBUG "Memory hole size: %ldMB\n",
                (top_of_ram - total_ram) >> 20);
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
 #ifdef CONFIG_HIGHMEM
-        max_zone_pfns[0] = total_lowmem >> PAGE_SHIFT;
-        max_zone_pfns[1] = top_of_ram >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_DMA] = total_lowmem >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_HIGHMEM] = top_of_ram >> PAGE_SHIFT;
 #else
-        max_zone_pfns[0] = top_of_ram >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_DMA] = top_of_ram >> PAGE_SHIFT;
 #endif
         free_area_init_nodes(max_zone_pfns);
 }
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 43c272075e1a..9da01dc8cfd9 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -617,9 +617,9 @@ void __init do_init_bootmem(void)
 
 void __init paging_init(void)
 {
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = {
-                                lmb_end_of_DRAM() >> PAGE_SHIFT
-        };
+        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_DMA] = lmb_end_of_DRAM() >> PAGE_SHIFT;
         free_area_init_nodes(max_zone_pfns);
 }
 
diff --git a/arch/powerpc/oprofile/Makefile b/arch/powerpc/oprofile/Makefile
index 3145d610b5b0..0b5df9c96ae0 100644
--- a/arch/powerpc/oprofile/Makefile
+++ b/arch/powerpc/oprofile/Makefile
@@ -13,4 +13,4 @@ DRIVER_OBJS := $(addprefix ../../../drivers/oprofile/, \
 oprofile-y := $(DRIVER_OBJS) common.o backtrace.o
 oprofile-$(CONFIG_PPC64) += op_model_rs64.o op_model_power4.o
 oprofile-$(CONFIG_FSL_BOOKE) += op_model_fsl_booke.o
-oprofile-$(CONFIG_PPC32) += op_model_7450.o
+oprofile-$(CONFIG_6xx) += op_model_7450.o
diff --git a/arch/powerpc/oprofile/common.c b/arch/powerpc/oprofile/common.c
index fd0bbbe7a4de..63bbef3b63f1 100644
--- a/arch/powerpc/oprofile/common.c
+++ b/arch/powerpc/oprofile/common.c
@@ -34,6 +34,11 @@ static void op_handle_interrupt(struct pt_regs *regs)
         model->handle_interrupt(regs, ctr);
 }
 
+static void op_powerpc_cpu_setup(void *dummy)
+{
+        model->cpu_setup(ctr);
+}
+
 static int op_powerpc_setup(void)
 {
         int err;
@@ -47,7 +52,7 @@ static int op_powerpc_setup(void)
         model->reg_setup(ctr, &sys, model->num_counters);
 
         /* Configure the registers on all cpus.  */
-        on_each_cpu(model->cpu_setup, NULL, 0, 1);
+        on_each_cpu(op_powerpc_cpu_setup, NULL, 0, 1);
 
         return 0;
 }
@@ -142,7 +147,8 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
                 case PPC_OPROFILE_POWER4:
                         model = &op_model_power4;
                         break;
-#else
+#endif
+#ifdef CONFIG_6xx
                 case PPC_OPROFILE_G4:
                         model = &op_model_7450;
                         break;
diff --git a/arch/powerpc/oprofile/op_model_7450.c b/arch/powerpc/oprofile/op_model_7450.c
index d8ee3aea83f8..f481c0ed5e67 100644
--- a/arch/powerpc/oprofile/op_model_7450.c
+++ b/arch/powerpc/oprofile/op_model_7450.c
@@ -81,7 +81,7 @@ static void pmc_stop_ctrs(void)
 
 /* Configures the counters on this CPU based on the global
  * settings */
-static void fsl7450_cpu_setup(void *unused)
+static void fsl7450_cpu_setup(struct op_counter_config *ctr)
 {
         /* freeze all counters */
         pmc_stop_ctrs();
diff --git a/arch/powerpc/oprofile/op_model_fsl_booke.c b/arch/powerpc/oprofile/op_model_fsl_booke.c
index e29dede31423..0b3c31f5209e 100644
--- a/arch/powerpc/oprofile/op_model_fsl_booke.c
+++ b/arch/powerpc/oprofile/op_model_fsl_booke.c
@@ -32,42 +32,152 @@ static unsigned long reset_value[OP_MAX_COUNTER];
 static int num_counters;
 static int oprofile_running;
 
-static inline unsigned int ctr_read(unsigned int i)
+static void init_pmc_stop(int ctr)
 {
-        switch(i) {
-                case 0:
-                        return mfpmr(PMRN_PMC0);
-                case 1:
-                        return mfpmr(PMRN_PMC1);
-                case 2:
-                        return mfpmr(PMRN_PMC2);
-                case 3:
-                        return mfpmr(PMRN_PMC3);
-                default:
-                        return 0;
-        }
-}
+        u32 pmlca = (PMLCA_FC | PMLCA_FCS | PMLCA_FCU |
+                        PMLCA_FCM1 | PMLCA_FCM0);
+        u32 pmlcb = 0;
 
-static inline void ctr_write(unsigned int i, unsigned int val)
-{
-        switch(i) {
+        switch (ctr) {
                 case 0:
-                        mtpmr(PMRN_PMC0, val);
+                        mtpmr(PMRN_PMLCA0, pmlca);
+                        mtpmr(PMRN_PMLCB0, pmlcb);
                         break;
                 case 1:
-                        mtpmr(PMRN_PMC1, val);
+                        mtpmr(PMRN_PMLCA1, pmlca);
+                        mtpmr(PMRN_PMLCB1, pmlcb);
                         break;
                 case 2:
-                        mtpmr(PMRN_PMC2, val);
+                        mtpmr(PMRN_PMLCA2, pmlca);
+                        mtpmr(PMRN_PMLCB2, pmlcb);
                         break;
                 case 3:
-                        mtpmr(PMRN_PMC3, val);
+                        mtpmr(PMRN_PMLCA3, pmlca);
+                        mtpmr(PMRN_PMLCB3, pmlcb);
                         break;
                 default:
-                        break;
+                        panic("Bad ctr number!\n");
         }
 }
 
+static void set_pmc_event(int ctr, int event)
+{
+        u32 pmlca;
+
+        pmlca = get_pmlca(ctr);
+
+        pmlca = (pmlca & ~PMLCA_EVENT_MASK) |
+                ((event << PMLCA_EVENT_SHIFT) &
+                 PMLCA_EVENT_MASK);
+
+        set_pmlca(ctr, pmlca);
+}
+
+static void set_pmc_user_kernel(int ctr, int user, int kernel)
+{
+        u32 pmlca;
+
+        pmlca = get_pmlca(ctr);
+
+        if(user)
+                pmlca &= ~PMLCA_FCU;
+        else
+                pmlca |= PMLCA_FCU;
+
+        if(kernel)
+                pmlca &= ~PMLCA_FCS;
+        else
+                pmlca |= PMLCA_FCS;
+
+        set_pmlca(ctr, pmlca);
+}
+
+static void set_pmc_marked(int ctr, int mark0, int mark1)
+{
+        u32 pmlca = get_pmlca(ctr);
+
+        if(mark0)
+                pmlca &= ~PMLCA_FCM0;
+        else
+                pmlca |= PMLCA_FCM0;
+
+        if(mark1)
+                pmlca &= ~PMLCA_FCM1;
+        else
+                pmlca |= PMLCA_FCM1;
+
+        set_pmlca(ctr, pmlca);
+}
+
+static void pmc_start_ctr(int ctr, int enable)
+{
+        u32 pmlca = get_pmlca(ctr);
+
+        pmlca &= ~PMLCA_FC;
+
+        if (enable)
+                pmlca |= PMLCA_CE;
+        else
+                pmlca &= ~PMLCA_CE;
+
+        set_pmlca(ctr, pmlca);
+}
+
+static void pmc_start_ctrs(int enable)
+{
+        u32 pmgc0 = mfpmr(PMRN_PMGC0);
+
+        pmgc0 &= ~PMGC0_FAC;
+        pmgc0 |= PMGC0_FCECE;
+
+        if (enable)
+                pmgc0 |= PMGC0_PMIE;
+        else
+                pmgc0 &= ~PMGC0_PMIE;
+
+        mtpmr(PMRN_PMGC0, pmgc0);
+}
+
+static void pmc_stop_ctrs(void)
+{
+        u32 pmgc0 = mfpmr(PMRN_PMGC0);
+
+        pmgc0 |= PMGC0_FAC;
+
+        pmgc0 &= ~(PMGC0_PMIE | PMGC0_FCECE);
+
+        mtpmr(PMRN_PMGC0, pmgc0);
+}
+
+static void dump_pmcs(void)
+{
+        printk("pmgc0: %x\n", mfpmr(PMRN_PMGC0));
+        printk("pmc\t\tpmlca\t\tpmlcb\n");
+        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC0),
+                        mfpmr(PMRN_PMLCA0), mfpmr(PMRN_PMLCB0));
+        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC1),
+                        mfpmr(PMRN_PMLCA1), mfpmr(PMRN_PMLCB1));
+        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC2),
+                        mfpmr(PMRN_PMLCA2), mfpmr(PMRN_PMLCB2));
+        printk("%8x\t%8x\t%8x\n", mfpmr(PMRN_PMC3),
+                        mfpmr(PMRN_PMLCA3), mfpmr(PMRN_PMLCB3));
+}
+
+static void fsl_booke_cpu_setup(struct op_counter_config *ctr)
+{
+        int i;
+
+        /* freeze all counters */
+        pmc_stop_ctrs();
+
+        for (i = 0;i < num_counters;i++) {
+                init_pmc_stop(i);
+
+                set_pmc_event(i, ctr[i].event);
+
+                set_pmc_user_kernel(i, ctr[i].user, ctr[i].kernel);
+        }
+}
 
 static void fsl_booke_reg_setup(struct op_counter_config *ctr,
                              struct op_system_config *sys,
@@ -77,23 +187,14 @@ static void fsl_booke_reg_setup(struct op_counter_config *ctr,
 
         num_counters = num_ctrs;
 
-        /* freeze all counters */
-        pmc_stop_ctrs();
-
         /* Our counters count up, and "count" refers to
          * how much before the next interrupt, and we interrupt
          * on overflow.  So we calculate the starting value
          * which will give us "count" until overflow.
          * Then we set the events on the enabled counters */
-        for (i = 0; i < num_counters; ++i) {
+        for (i = 0; i < num_counters; ++i)
                 reset_value[i] = 0x80000000UL - ctr[i].count;
 
-                init_pmc_stop(i);
-
-                set_pmc_event(i, ctr[i].event);
-
-                set_pmc_user_kernel(i, ctr[i].user, ctr[i].kernel);
-        }
 }
 
 static void fsl_booke_start(struct op_counter_config *ctr)
@@ -105,8 +206,8 @@ static void fsl_booke_start(struct op_counter_config *ctr)
         for (i = 0; i < num_counters; ++i) {
                 if (ctr[i].enabled) {
                         ctr_write(i, reset_value[i]);
-                        /* Set Each enabled counterd to only
-                         * count when the Mark bit is not set */
+                        /* Set each enabled counter to only
+                         * count when the Mark bit is *not* set */
                         set_pmc_marked(i, 1, 0);
                         pmc_start_ctr(i, 1);
                 } else {
@@ -177,6 +278,7 @@ static void fsl_booke_handle_interrupt(struct pt_regs *regs,
 
 struct op_powerpc_model op_model_fsl_booke = {
         .reg_setup              = fsl_booke_reg_setup,
+        .cpu_setup              = fsl_booke_cpu_setup,
         .start                  = fsl_booke_start,
         .stop                   = fsl_booke_stop,
         .handle_interrupt       = fsl_booke_handle_interrupt,
diff --git a/arch/powerpc/oprofile/op_model_power4.c b/arch/powerpc/oprofile/op_model_power4.c
index 506f6b79f893..356709d515b9 100644
--- a/arch/powerpc/oprofile/op_model_power4.c
+++ b/arch/powerpc/oprofile/op_model_power4.c
@@ -76,13 +76,13 @@ static inline int mmcra_must_set_sample(void)
 {
         if (__is_processor(PV_POWER4) || __is_processor(PV_POWER4p) ||
             __is_processor(PV_970) || __is_processor(PV_970FX) ||
-            __is_processor(PV_970MP))
+            __is_processor(PV_970MP) || __is_processor(PV_970GX))
                 return 1;
 
         return 0;
 }
 
-static void power4_cpu_setup(void *unused)
+static void power4_cpu_setup(struct op_counter_config *ctr)
 {
         unsigned int mmcr0 = mmcr0_val;
         unsigned long mmcra = mmcra_val;
diff --git a/arch/powerpc/oprofile/op_model_rs64.c b/arch/powerpc/oprofile/op_model_rs64.c
index 042f8f4867ad..19c5ee089bc9 100644
--- a/arch/powerpc/oprofile/op_model_rs64.c
+++ b/arch/powerpc/oprofile/op_model_rs64.c
@@ -102,7 +102,7 @@ static void rs64_reg_setup(struct op_counter_config *ctr,
         /* XXX setup user and kernel profiling */
 }
 
-static void rs64_cpu_setup(void *unused)
+static void rs64_cpu_setup(struct op_counter_config *ctr)
 {
         unsigned int mmcr0;
 
diff --git a/arch/powerpc/platforms/83xx/Kconfig b/arch/powerpc/platforms/83xx/Kconfig
index 0975e94ac7c4..7edb6b461382 100644
--- a/arch/powerpc/platforms/83xx/Kconfig
+++ b/arch/powerpc/platforms/83xx/Kconfig
@@ -32,6 +32,13 @@ config MPC834x_ITX
           Be aware that PCI initialization is the bootloader's
           responsiblilty.
 
+config MPC8360E_PB
+        bool "Freescale MPC8360E PB"
+        select DEFAULT_UIMAGE
+        select QUICC_ENGINE
+        help
+          This option enables support for the MPC836x EMDS Processor Board.
+
 endchoice
 
 config PPC_MPC832x
@@ -46,4 +53,10 @@ config MPC834x
         select PPC_INDIRECT_PCI
         default y if MPC834x_SYS || MPC834x_ITX
 
+config PPC_MPC836x
+        bool
+        select PPC_UDBG_16550
+        select PPC_INDIRECT_PCI
+        default y if MPC8360E_PB
+
 endmenu
diff --git a/arch/powerpc/platforms/83xx/Makefile b/arch/powerpc/platforms/83xx/Makefile
index 9387a110d28a..f1aa7e24a938 100644
--- a/arch/powerpc/platforms/83xx/Makefile
+++ b/arch/powerpc/platforms/83xx/Makefile
@@ -5,3 +5,5 @@ obj-y				:= misc.o
 obj-$(CONFIG_PCI)               += pci.o
 obj-$(CONFIG_MPC834x_SYS)       += mpc834x_sys.o
 obj-$(CONFIG_MPC834x_ITX)       += mpc834x_itx.o
+obj-$(CONFIG_MPC8360E_PB)       += mpc8360e_pb.o
+obj-$(CONFIG_MPC832x_MDS)       += mpc832x_mds.o
diff --git a/arch/powerpc/platforms/83xx/mpc832x_mds.c b/arch/powerpc/platforms/83xx/mpc832x_mds.c
index 54dea9d42dc9..a43ac71ab740 100644
--- a/arch/powerpc/platforms/83xx/mpc832x_mds.c
+++ b/arch/powerpc/platforms/83xx/mpc832x_mds.c
@@ -24,6 +24,7 @@
 #include <linux/root_dev.h>
 #include <linux/initrd.h>
 
+#include <asm/of_device.h>
 #include <asm/system.h>
 #include <asm/atomic.h>
 #include <asm/time.h>
@@ -136,6 +137,24 @@ static void __init mpc832x_sys_setup_arch(void)
 #endif
 }
 
+static int __init mpc832x_declare_of_platform_devices(void)
+{
+        struct device_node *np;
+
+        for (np = NULL; (np = of_find_compatible_node(np, "network",
+                                        "ucc_geth")) != NULL;) {
+                int ucc_num;
+                char bus_id[BUS_ID_SIZE];
+
+                ucc_num = *((uint *) get_property(np, "device-id", NULL)) - 1;
+                snprintf(bus_id, BUS_ID_SIZE, "ucc_geth.%u", ucc_num);
+                of_platform_device_create(np, bus_id, NULL);
+        }
+
+        return 0;
+}
+device_initcall(mpc832x_declare_of_platform_devices);
+
 void __init mpc832x_sys_init_IRQ(void)
 {
 
diff --git a/arch/powerpc/platforms/83xx/mpc834x_itx.c b/arch/powerpc/platforms/83xx/mpc834x_itx.c
index 5446bab08eca..e2bcaaf6b329 100644
--- a/arch/powerpc/platforms/83xx/mpc834x_itx.c
+++ b/arch/powerpc/platforms/83xx/mpc834x_itx.c
@@ -108,10 +108,6 @@ static int __init mpc834x_itx_probe(void)
         return 1;
 }
 
-#ifdef CONFIG_RTC_CLASS
-late_initcall(rtc_class_hookup);
-#endif
-
 define_machine(mpc834x_itx) {
         .name                   = "MPC834x ITX",
         .probe                  = mpc834x_itx_probe,
diff --git a/arch/powerpc/platforms/83xx/mpc8360e_pb.c b/arch/powerpc/platforms/83xx/mpc8360e_pb.c
index c0191900fc25..1a523c81c06e 100644
--- a/arch/powerpc/platforms/83xx/mpc8360e_pb.c
+++ b/arch/powerpc/platforms/83xx/mpc8360e_pb.c
@@ -30,6 +30,7 @@
 #include <linux/root_dev.h>
 #include <linux/initrd.h>
 
+#include <asm/of_device.h>
 #include <asm/system.h>
 #include <asm/atomic.h>
 #include <asm/time.h>
@@ -141,6 +142,24 @@ static void __init mpc8360_sys_setup_arch(void)
 #endif
 }
 
+static int __init mpc8360_declare_of_platform_devices(void)
+{
+        struct device_node *np;
+
+        for (np = NULL; (np = of_find_compatible_node(np, "network",
+                                        "ucc_geth")) != NULL;) {
+                int ucc_num;
+                char bus_id[BUS_ID_SIZE];
+
+                ucc_num = *((uint *) get_property(np, "device-id", NULL)) - 1;
+                snprintf(bus_id, BUS_ID_SIZE, "ucc_geth.%u", ucc_num);
+                of_platform_device_create(np, bus_id, NULL);
+        }
+
+        return 0;
+}
+device_initcall(mpc8360_declare_of_platform_devices);
+
 void __init mpc8360_sys_init_IRQ(void)
 {
 
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index ccfd0c4db874..7aa809d5a244 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -655,14 +655,19 @@ static int __init spu_map_interrupts(struct spu *spu, struct device_node *np)
 
         for (i=0; i < 3; i++) {
                 ret = of_irq_map_one(np, i, &oirq);
-                if (ret)
+                if (ret) {
+                        pr_debug("spu_new: failed to get irq %d\n", i);
                         goto err;
-
+                }
                 ret = -EINVAL;
+                pr_debug("  irq %d no 0x%x on %s\n", i, oirq.specifier[0],
+                         oirq.controller->full_name);
                 spu->irqs[i] = irq_create_of_mapping(oirq.controller,
                                         oirq.specifier, oirq.size);
-                if (spu->irqs[i] == NO_IRQ)
+                if (spu->irqs[i] == NO_IRQ) {
+                        pr_debug("spu_new: failed to map it !\n");
                         goto err;
+                }
         }
         return 0;
 
@@ -681,7 +686,7 @@ static int spu_map_resource(struct device_node *node, int nr,
         struct resource resource = { };
         int ret;
 
-        ret = of_address_to_resource(node, 0, &resource);
+        ret = of_address_to_resource(node, nr, &resource);
         if (ret)
                 goto out;
 
@@ -704,22 +709,42 @@ static int __init spu_map_device(struct spu *spu, struct device_node *node)
 
         ret = spu_map_resource(node, 0, (void __iomem**)&spu->local_store,
                                         &spu->local_store_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 0\n",
+                         node->full_name);
                 goto out;
+        }
         ret = spu_map_resource(node, 1, (void __iomem**)&spu->problem,
                                         &spu->problem_phys);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 1\n",
+                         node->full_name);
                 goto out_unmap;
+        }
         ret = spu_map_resource(node, 2, (void __iomem**)&spu->priv2,
                                         NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 2\n",
+                         node->full_name);
                 goto out_unmap;
+        }
 
         if (!firmware_has_feature(FW_FEATURE_LPAR))
                 ret = spu_map_resource(node, 3, (void __iomem**)&spu->priv1,
                                         NULL);
-        if (ret)
+        if (ret) {
+                pr_debug("spu_new: failed to map %s resource 3\n",
+                         node->full_name);
                 goto out_unmap;
+        }
+        pr_debug("spu_new: %s maps:\n", node->full_name);
+        pr_debug("  local store   : 0x%016lx -> 0x%p\n",
+                 spu->local_store_phys, spu->local_store);
+        pr_debug("  problem state : 0x%016lx -> 0x%p\n",
+                 spu->problem_phys, spu->problem);
+        pr_debug("  priv2         :                       0x%p\n", spu->priv2);
+        pr_debug("  priv1         :                       0x%p\n", spu->priv1);
+
         return 0;
 
 out_unmap:
@@ -781,6 +806,17 @@ static int __init create_spu(struct device_node *spe)
         if (!spu)
                 goto out;
 
+        spu->node = find_spu_node_id(spe);
+        if (spu->node >= MAX_NUMNODES) {
+                printk(KERN_WARNING "SPE %s on node %d ignored,"
+                       " node number too big\n", spe->full_name, spu->node);
+                printk(KERN_WARNING "Check if CONFIG_NUMA is enabled.\n");
+                return -ENODEV;
+        }
+        spu->nid = of_node_to_nid(spe);
+        if (spu->nid == -1)
+                spu->nid = 0;
+
         ret = spu_map_device(spu, spe);
         /* try old method */
         if (ret)
@@ -788,10 +824,6 @@ static int __init create_spu(struct device_node *spe)
         if (ret)
                 goto out_free;
 
-        spu->node = find_spu_node_id(spe);
-        spu->nid = of_node_to_nid(spe);
-        if (spu->nid == -1)
-                spu->nid = 0;
         ret = spu_map_interrupts(spu, spe);
         if (ret)
                 ret = spu_map_interrupts_old(spu, spe);
diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
index e0d730045260..533e2723e184 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -246,6 +246,7 @@ static int spufs_cntl_open(struct inode *inode, struct file *file)
 
 static struct file_operations spufs_cntl_fops = {
         .open = spufs_cntl_open,
+        .release = simple_attr_close,
         .read = simple_attr_read,
         .write = simple_attr_write,
         .mmap = spufs_cntl_mmap,
@@ -384,7 +385,7 @@ static ssize_t spufs_mbox_read(struct file *file, char __user *buf,
         udata = (void __user *)buf;
 
         spu_acquire(ctx);
-        for (count = 0; count <= len; count += 4, udata++) {
+        for (count = 0; (count + 4) <= len; count += 4, udata++) {
                 int ret;
                 ret = ctx->ops->mbox_read(ctx, &mbox_data);
                 if (ret == 0)
diff --git a/arch/powerpc/platforms/cell/spufs/hw_ops.c b/arch/powerpc/platforms/cell/spufs/hw_ops.c
index efc452e71ab0..d805ffed892d 100644
--- a/arch/powerpc/platforms/cell/spufs/hw_ops.c
+++ b/arch/powerpc/platforms/cell/spufs/hw_ops.c
@@ -147,7 +147,7 @@ static void spu_hw_signal1_write(struct spu_context *ctx, u32 data)
 
 static u32 spu_hw_signal2_read(struct spu_context *ctx)
 {
-        return in_be32(&ctx->spu->problem->signal_notify1);
+        return in_be32(&ctx->spu->problem->signal_notify2);
 }
 
 static void spu_hw_signal2_write(struct spu_context *ctx, u32 data)
diff --git a/arch/powerpc/platforms/chrp/setup.c b/arch/powerpc/platforms/chrp/setup.c
index cae3d13229b9..49b8dabcbc99 100644
--- a/arch/powerpc/platforms/chrp/setup.c
+++ b/arch/powerpc/platforms/chrp/setup.c
@@ -477,8 +477,10 @@ static void __init chrp_find_8259(void)
                        " address, polling\n");
 
         i8259_init(pic, chrp_int_ack);
-        if (ppc_md.get_irq == NULL)
+        if (ppc_md.get_irq == NULL) {
                 ppc_md.get_irq = i8259_irq;
+                irq_set_default_host(i8259_get_host());
+        }
         if (chrp_mpic != NULL) {
                 cascade_irq = irq_of_parse_and_map(pic, 0);
                 if (cascade_irq == NO_IRQ)
diff --git a/arch/powerpc/platforms/iseries/iommu.c b/arch/powerpc/platforms/iseries/iommu.c
index f4cbbcf8773a..218817d13c5c 100644
--- a/arch/powerpc/platforms/iseries/iommu.c
+++ b/arch/powerpc/platforms/iseries/iommu.c
@@ -43,9 +43,6 @@ static void tce_build_iSeries(struct iommu_table *tbl, long index, long npages,
         u64 rc;
         u64 tce, rpn;
 
-        index <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         while (npages--) {
                 rpn = virt_to_abs(uaddr) >> TCE_SHIFT;
                 tce = (rpn & TCE_RPN_MASK) << TCE_RPN_SHIFT;
@@ -75,9 +72,6 @@ static void tce_free_iSeries(struct iommu_table *tbl, long index, long npages)
 {
         u64 rc;
 
-        npages <<= TCE_PAGE_FACTOR;
-        index <<= TCE_PAGE_FACTOR;
-
         while (npages--) {
                 rc = HvCallXm_setTce((u64)tbl->it_index, (u64)index, 0);
                 if (rc)
@@ -136,10 +130,9 @@ void iommu_table_getparms_iSeries(unsigned long busno,
                 panic("PCI_DMA: parms->size is zero, parms is 0x%p", parms);
 
         /* itc_size is in pages worth of table, it_size is in # of entries */
-        tbl->it_size = ((parms->itc_size * TCE_PAGE_SIZE) /
-                        TCE_ENTRY_SIZE) >> TCE_PAGE_FACTOR;
+        tbl->it_size = (parms->itc_size * TCE_PAGE_SIZE) / TCE_ENTRY_SIZE;
         tbl->it_busno = parms->itc_busno;
-        tbl->it_offset = parms->itc_offset >> TCE_PAGE_FACTOR;
+        tbl->it_offset = parms->itc_offset;
         tbl->it_index = parms->itc_index;
         tbl->it_blocksize = 1;
         tbl->it_type = virtbus ? TCE_VB : TCE_PCI;
diff --git a/arch/powerpc/platforms/iseries/setup.c b/arch/powerpc/platforms/iseries/setup.c
index a0ff7ba7d666..6f73469fd3b0 100644
--- a/arch/powerpc/platforms/iseries/setup.c
+++ b/arch/powerpc/platforms/iseries/setup.c
@@ -694,6 +694,11 @@ void * __init iSeries_early_setup(void)
 {
         unsigned long phys_mem_size;
 
+        /* Identify CPU type. This is done again by the common code later
+         * on but calling this function multiple times is fine.
+         */
+        identify_cpu(0);
+
         powerpc_firmware_features |= FW_FEATURE_ISERIES;
         powerpc_firmware_features |= FW_FEATURE_LPAR;
 
diff --git a/arch/powerpc/platforms/powermac/sleep.S b/arch/powerpc/platforms/powermac/sleep.S
index 1174ca128efa..adee28da353f 100644
--- a/arch/powerpc/platforms/powermac/sleep.S
+++ b/arch/powerpc/platforms/powermac/sleep.S
@@ -45,7 +45,8 @@
         .section .text
         .align  5
 
-#if defined(CONFIG_PM) || defined(CONFIG_CPU_FREQ_PMAC)
+#if defined(CONFIG_PM) || defined(CONFIG_CPU_FREQ_PMAC) || \
+    (defined(CONFIG_HOTPLUG_CPU) && defined(CONFIG_PPC32))
 
 /* This gets called by via-pmu.c late during the sleep process.
  * The PMU was already send the sleep command and will shut us down
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
index d24ba547e53f..556c279a789d 100644
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -57,9 +57,6 @@ static void tce_build_pSeries(struct iommu_table *tbl, long index,
         u64 *tcep;
         u64 rpn;
 
-        index <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         proto_tce = TCE_PCI_READ; // Read allowed
 
         if (direction != DMA_TO_DEVICE)
@@ -82,9 +79,6 @@ static void tce_free_pSeries(struct iommu_table *tbl, long index, long npages)
 {
         u64 *tcep;
 
-        npages <<= TCE_PAGE_FACTOR;
-        index <<= TCE_PAGE_FACTOR;
-
         tcep = ((u64 *)tbl->it_base) + index;
 
         while (npages--)
@@ -95,7 +89,6 @@ static unsigned long tce_get_pseries(struct iommu_table *tbl, long index)
 {
         u64 *tcep;
 
-        index <<= TCE_PAGE_FACTOR;
         tcep = ((u64 *)tbl->it_base) + index;
 
         return *tcep;
@@ -109,9 +102,6 @@ static void tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum,
         u64 proto_tce, tce;
         u64 rpn;
 
-        tcenum <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         rpn = (virt_to_abs(uaddr)) >> TCE_SHIFT;
         proto_tce = TCE_PCI_READ;
         if (direction != DMA_TO_DEVICE)
@@ -146,7 +136,7 @@ static void tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
         u64 rpn;
         long l, limit;
 
-        if (TCE_PAGE_FACTOR == 0 && npages == 1)
+        if (npages == 1)
                 return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr,
                                            direction);
 
@@ -164,9 +154,6 @@ static void tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum,
                 __get_cpu_var(tce_page) = tcep;
         }
 
-        tcenum <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         rpn = (virt_to_abs(uaddr)) >> TCE_SHIFT;
         proto_tce = TCE_PCI_READ;
         if (direction != DMA_TO_DEVICE)
@@ -207,9 +194,6 @@ static void tce_free_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages
 {
         u64 rc;
 
-        tcenum <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         while (npages--) {
                 rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, 0);
 
@@ -229,9 +213,6 @@ static void tce_freemulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long n
 {
         u64 rc;
 
-        tcenum <<= TCE_PAGE_FACTOR;
-        npages <<= TCE_PAGE_FACTOR;
-
         rc = plpar_tce_stuff((u64)tbl->it_index, (u64)tcenum << 12, 0, npages);
 
         if (rc && printk_ratelimit()) {
@@ -248,7 +229,6 @@ static unsigned long tce_get_pSeriesLP(struct iommu_table *tbl, long tcenum)
         u64 rc;
         unsigned long tce_ret;
 
-        tcenum <<= TCE_PAGE_FACTOR;
         rc = plpar_tce_get((u64)tbl->it_index, (u64)tcenum << 12, &tce_ret);
 
         if (rc && printk_ratelimit()) {
@@ -289,7 +269,7 @@ static void iommu_table_setparms(struct pci_controller *phb,
         tbl->it_busno = phb->bus->number;
 
         /* Units of tce entries */
-        tbl->it_offset = phb->dma_window_base_cur >> PAGE_SHIFT;
+        tbl->it_offset = phb->dma_window_base_cur >> IOMMU_PAGE_SHIFT;
 
         /* Test if we are going over 2GB of DMA space */
         if (phb->dma_window_base_cur + phb->dma_window_size > 0x80000000ul) {
@@ -300,7 +280,7 @@ static void iommu_table_setparms(struct pci_controller *phb,
         phb->dma_window_base_cur += phb->dma_window_size;
 
         /* Set the tce table size - measured in entries */
-        tbl->it_size = phb->dma_window_size >> PAGE_SHIFT;
+        tbl->it_size = phb->dma_window_size >> IOMMU_PAGE_SHIFT;
 
         tbl->it_index = 0;
         tbl->it_blocksize = 16;
@@ -325,8 +305,8 @@ static void iommu_table_setparms_lpar(struct pci_controller *phb,
         tbl->it_base   = 0;
         tbl->it_blocksize  = 16;
         tbl->it_type = TCE_PCI;
-        tbl->it_offset = offset >> PAGE_SHIFT;
-        tbl->it_size = size >> PAGE_SHIFT;
+        tbl->it_offset = offset >> IOMMU_PAGE_SHIFT;
+        tbl->it_size = size >> IOMMU_PAGE_SHIFT;
 }
 
 static void iommu_bus_setup_pSeries(struct pci_bus *bus)
@@ -522,8 +502,6 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
         const void *dma_window = NULL;
         struct pci_dn *pci;
 
-        DBG("iommu_dev_setup_pSeriesLP, dev %p (%s)\n", dev, pci_name(dev));
-
         /* dev setup for LPAR is a little tricky, since the device tree might
          * contain the dma-window properties per-device and not neccesarily
          * for the bus. So we need to search upwards in the tree until we
@@ -532,6 +510,9 @@ static void iommu_dev_setup_pSeriesLP(struct pci_dev *dev)
          */
         dn = pci_device_to_OF_node(dev);
 
+        DBG("iommu_dev_setup_pSeriesLP, dev %p (%s) %s\n",
+             dev, pci_name(dev), dn->full_name);
+
         for (pdn = dn; pdn && PCI_DN(pdn) && !PCI_DN(pdn)->iommu_table;
              pdn = pdn->parent) {
                 dma_window = get_property(pdn, "ibm,dma-window", NULL);
diff --git a/arch/powerpc/sysdev/dart.h b/arch/powerpc/sysdev/dart.h
index 1c8817c4835e..ff202edb0591 100644
--- a/arch/powerpc/sysdev/dart.h
+++ b/arch/powerpc/sysdev/dart.h
@@ -72,7 +72,6 @@
 
 #define DART_PAGE_SHIFT         12
 #define DART_PAGE_SIZE          (1 << DART_PAGE_SHIFT)
-#define DART_PAGE_FACTOR        (PAGE_SHIFT - DART_PAGE_SHIFT)
 
 
 #endif /* _POWERPC_SYSDEV_DART_H */
diff --git a/arch/powerpc/sysdev/dart_iommu.c b/arch/powerpc/sysdev/dart_iommu.c
index 03b4477dd7f0..572b7846cc77 100644
--- a/arch/powerpc/sysdev/dart_iommu.c
+++ b/arch/powerpc/sysdev/dart_iommu.c
@@ -156,9 +156,6 @@ static void dart_build(struct iommu_table *tbl, long index,
 
         DBG("dart: build at: %lx, %lx, addr: %x\n", index, npages, uaddr);
 
-        index <<= DART_PAGE_FACTOR;
-        npages <<= DART_PAGE_FACTOR;
-
         dp = ((unsigned int*)tbl->it_base) + index;
 
         /* On U3, all memory is contigous, so we can move this
@@ -199,9 +196,6 @@ static void dart_free(struct iommu_table *tbl, long index, long npages)
 
         DBG("dart: free at: %lx, %lx\n", index, npages);
 
-        index <<= DART_PAGE_FACTOR;
-        npages <<= DART_PAGE_FACTOR;
-
         dp  = ((unsigned int *)tbl->it_base) + index;
 
         while (npages--)
@@ -281,7 +275,7 @@ static void iommu_table_dart_setup(void)
         iommu_table_dart.it_busno = 0;
         iommu_table_dart.it_offset = 0;
         /* it_size is in number of entries */
-        iommu_table_dart.it_size = (dart_tablesize / sizeof(u32)) >> DART_PAGE_FACTOR;
+        iommu_table_dart.it_size = dart_tablesize / sizeof(u32);
 
         /* Initialize the common IOMMU code */
         iommu_table_dart.it_base = (unsigned long)dart_vbase;
diff --git a/arch/powerpc/sysdev/i8259.c b/arch/powerpc/sysdev/i8259.c
index 0450265d73bb..ad87adc975bc 100644
--- a/arch/powerpc/sysdev/i8259.c
+++ b/arch/powerpc/sysdev/i8259.c
@@ -224,6 +224,11 @@ static struct irq_host_ops i8259_host_ops = {
         .xlate = i8259_host_xlate,
 };
 
+struct irq_host *i8259_get_host(void)
+{
+        return i8259_host;
+}
+
 /**
  * i8259_init - Initialize the legacy controller
  * @node: device node of the legacy PIC (can be NULL, but then, it will match
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
index bc4d4a7f9657..746f78c15375 100644
--- a/arch/powerpc/sysdev/ipic.c
+++ b/arch/powerpc/sysdev/ipic.c
@@ -473,9 +473,9 @@ static int ipic_set_irq_type(unsigned int virq, unsigned int flow_type)
         desc->status |= flow_type & IRQ_TYPE_SENSE_MASK;
         if (flow_type & IRQ_TYPE_LEVEL_LOW)  {
                 desc->status |= IRQ_LEVEL;
-                set_irq_handler(virq, handle_level_irq);
+                desc->handle_irq = handle_level_irq;
         } else {
-                set_irq_handler(virq, handle_edge_irq);
+                desc->handle_irq = handle_edge_irq;
         }
 
         /* only EXT IRQ senses are programmable on ipic
diff --git a/arch/powerpc/sysdev/qe_lib/qe.c b/arch/powerpc/sysdev/qe_lib/qe.c
index 2bae632d3ad7..e4223226a7a8 100644
--- a/arch/powerpc/sysdev/qe_lib/qe.c
+++ b/arch/powerpc/sysdev/qe_lib/qe.c
@@ -122,8 +122,7 @@ int qe_issue_cmd(u32 cmd, u32 device, u8 mcn_protocol, u32 cmd_input)
                                 mcn_shift = QE_CR_MCN_NORMAL_SHIFT;
                 }
 
-                out_be32(&qe_immr->cp.cecdr,
-                         immrbar_virt_to_phys((void *)cmd_input));
+                out_be32(&qe_immr->cp.cecdr, cmd_input);
                 out_be32(&qe_immr->cp.cecr,
                          (cmd | QE_CR_FLG | ((u32) device << dev_shift) | (u32)
                           mcn_protocol << mcn_shift));
diff --git a/arch/powerpc/sysdev/qe_lib/ucc.c b/arch/powerpc/sysdev/qe_lib/ucc.c
index 916c9e5df57f..ac12a44d516f 100644
--- a/arch/powerpc/sysdev/qe_lib/ucc.c
+++ b/arch/powerpc/sysdev/qe_lib/ucc.c
@@ -207,6 +207,7 @@ int ucc_set_qe_mux_rxtx(int ucc_num, enum qe_clock clock, enum comm_dir mode)
                 case QE_CLK18:  source = 8; break;
                 case QE_CLK7:   source = 9; break;
                 case QE_CLK8:   source = 10; break;
+                case QE_CLK16:  source = 11; break;
                 default:        source = -1; break;
                 }
                 break;
@@ -222,6 +223,7 @@ int ucc_set_qe_mux_rxtx(int ucc_num, enum qe_clock clock, enum comm_dir mode)
                 case QE_CLK22:  source = 8; break;
                 case QE_CLK7:   source = 9; break;
                 case QE_CLK8:   source = 10; break;
+                case QE_CLK16:  source = 11; break;
                 default:        source = -1; break;
                 }
                 break;
diff --git a/arch/powerpc/sysdev/qe_lib/ucc_fast.c b/arch/powerpc/sysdev/qe_lib/ucc_fast.c
index c2be7348fcbd..75fa3104a43a 100644
--- a/arch/powerpc/sysdev/qe_lib/ucc_fast.c
+++ b/arch/powerpc/sysdev/qe_lib/ucc_fast.c
@@ -163,7 +163,7 @@ int ucc_fast_init(struct ucc_fast_info * uf_info, struct ucc_fast_private ** ucc
 
         /* check if the UCC port number is in range. */
         if ((uf_info->ucc_num < 0) || (uf_info->ucc_num > UCC_MAX_NUM - 1)) {
-                uccf_err("ucc_fast_init: Illagal UCC number!");
+                uccf_err("ucc_fast_init: Illegal UCC number!");
                 return -EINVAL;
         }
 
diff --git a/arch/powerpc/sysdev/qe_lib/ucc_slow.c b/arch/powerpc/sysdev/qe_lib/ucc_slow.c
index 1fb88ef7cf06..a49da6b73ecf 100644
--- a/arch/powerpc/sysdev/qe_lib/ucc_slow.c
+++ b/arch/powerpc/sysdev/qe_lib/ucc_slow.c
@@ -152,7 +152,7 @@ int ucc_slow_init(struct ucc_slow_info * us_info, struct ucc_slow_private ** ucc
 
         /* check if the UCC port number is in range. */
         if ((us_info->ucc_num < 0) || (us_info->ucc_num > UCC_MAX_NUM - 1)) {
-                uccs_err("ucc_slow_init: Illagal UCC number!");
+                uccs_err("ucc_slow_init: Illegal UCC number!");
                 return -EINVAL;
         }
 
diff --git a/arch/powerpc/sysdev/tsi108_dev.c b/arch/powerpc/sysdev/tsi108_dev.c
index 11de090eb901..97f37ef4bbbf 100644
--- a/arch/powerpc/sysdev/tsi108_dev.c
+++ b/arch/powerpc/sysdev/tsi108_dev.c
@@ -48,7 +48,7 @@ phys_addr_t get_csrbase(void)
         tsi = of_find_node_by_type(NULL, "tsi-bridge");
         if (tsi) {
                 unsigned int size;
-                void *prop = get_property(tsi, "reg", &size);
+                const void *prop = get_property(tsi, "reg", &size);
                 tsi108_csr_base = of_translate_address(tsi, prop);
                 of_node_put(tsi);
         };
@@ -79,7 +79,7 @@ static int __init tsi108_eth_of_init(void)
                 hw_info tsi_eth_data;
                 unsigned int *id;
                 unsigned int *phy_id;
-                void *mac_addr;
+                const void *mac_addr;
                 phandle *ph;
 
                 memset(r, 0, sizeof(r));
diff --git a/arch/ppc/boot/simple/relocate.S b/arch/ppc/boot/simple/relocate.S
index 0c021556d78e..1bbbcd2f2bcb 100644
--- a/arch/ppc/boot/simple/relocate.S
+++ b/arch/ppc/boot/simple/relocate.S
@@ -154,8 +154,8 @@ do_relocate_out:
 
 start_ldr:
 /* Clear all of BSS and set up stack for C calls */
-        lis     r3,edata@h
-        ori     r3,r3,edata@l
+        lis     r3,__bss_start@h
+        ori     r3,r3,__bss_start@l
         lis     r4,end@h
         ori     r4,r4,end@l
         subi    r3,r3,4
@@ -163,7 +163,7 @@ start_ldr:
         li      r0,0
 50:     stwu    r0,4(r3)
         cmpw    cr0,r3,r4
-        bne     50b
+        blt     50b
 90:     mr      r9,r1           /* Save old stack pointer (in case it matters) */
         lis     r1,.stack@h
         ori     r1,r1,.stack@l
diff --git a/arch/ppc/kernel/misc.S b/arch/ppc/kernel/misc.S
index 5f6684012ded..d319f9ba2379 100644
--- a/arch/ppc/kernel/misc.S
+++ b/arch/ppc/kernel/misc.S
@@ -110,80 +110,6 @@ _GLOBAL(reloc_got2)
         blr
 
 /*
- * identify_cpu,
- * called with r3 = data offset and r4 = CPU number
- * doesn't change r3
- */
-_GLOBAL(identify_cpu)
-        addis   r8,r3,cpu_specs@ha
-        addi    r8,r8,cpu_specs@l
-        mfpvr   r7
-1:
-        lwz     r5,CPU_SPEC_PVR_MASK(r8)
-        and     r5,r5,r7
-        lwz     r6,CPU_SPEC_PVR_VALUE(r8)
-        cmplw   0,r6,r5
-        beq     1f
-        addi    r8,r8,CPU_SPEC_ENTRY_SIZE
-        b       1b
-1:
-        addis   r6,r3,cur_cpu_spec@ha
-        addi    r6,r6,cur_cpu_spec@l
-        sub     r8,r8,r3
-        stw     r8,0(r6)
-        blr
-
-/*
- * do_cpu_ftr_fixups - goes through the list of CPU feature fixups
- * and writes nop's over sections of code that don't apply for this cpu.
- * r3 = data offset (not changed)
- */
-_GLOBAL(do_cpu_ftr_fixups)
-        /* Get CPU 0 features */
-        addis   r6,r3,cur_cpu_spec@ha
-        addi    r6,r6,cur_cpu_spec@l
-        lwz     r4,0(r6)
-        add     r4,r4,r3
-        lwz     r4,CPU_SPEC_FEATURES(r4)
-
-        /* Get the fixup table */
-        addis   r6,r3,__start___ftr_fixup@ha
-        addi    r6,r6,__start___ftr_fixup@l
-        addis   r7,r3,__stop___ftr_fixup@ha
-        addi    r7,r7,__stop___ftr_fixup@l
-
-        /* Do the fixup */
-1:      cmplw   0,r6,r7
-        bgelr
-        addi    r6,r6,16
-        lwz     r8,-16(r6)      /* mask */
-        and     r8,r8,r4
-        lwz     r9,-12(r6)      /* value */
-        cmplw   0,r8,r9
-        beq     1b
-        lwz     r8,-8(r6)       /* section begin */
-        lwz     r9,-4(r6)       /* section end */
-        subf.   r9,r8,r9
-        beq     1b
-        /* write nops over the section of code */
-        /* todo: if large section, add a branch at the start of it */
-        srwi    r9,r9,2
-        mtctr   r9
-        add     r8,r8,r3
-        lis     r0,0x60000000@h /* nop */
-3:      stw     r0,0(r8)
-        andi.   r10,r4,CPU_FTR_SPLIT_ID_CACHE@l
-        beq     2f
-        dcbst   0,r8            /* suboptimal, but simpler */
-        sync
-        icbi    0,r8
-2:      addi    r8,r8,4
-        bdnz    3b
-        sync                    /* additional sync needed on g4 */
-        isync
-        b       1b
-
-/*
  * call_setup_cpu - call the setup_cpu function for this cpu
  * r3 = data offset, r24 = cpu number
  *
diff --git a/arch/ppc/kernel/setup.c b/arch/ppc/kernel/setup.c
index 75fe13815be2..27faeca2c7a2 100644
--- a/arch/ppc/kernel/setup.c
+++ b/arch/ppc/kernel/setup.c
@@ -38,6 +38,7 @@
 #include <asm/nvram.h>
 #include <asm/xmon.h>
 #include <asm/ocp.h>
+#include <asm/prom.h>
 
 #define USES_PPC_SYS (defined(CONFIG_85xx) || defined(CONFIG_83xx) || \
                       defined(CONFIG_MPC10X_BRIDGE) || defined(CONFIG_8260) || \
@@ -53,8 +54,6 @@
 
 extern void platform_init(unsigned long r3, unsigned long r4,
                 unsigned long r5, unsigned long r6, unsigned long r7);
-extern void identify_cpu(unsigned long offset, unsigned long cpu);
-extern void do_cpu_ftr_fixups(unsigned long offset);
 extern void reloc_got2(unsigned long offset);
 
 extern void ppc6xx_idle(void);
@@ -301,6 +300,7 @@ early_init(int r3, int r4, int r5)
 {
         unsigned long phys;
         unsigned long offset = reloc_offset();
+        struct cpu_spec *spec;
 
         /* Default */
         phys = offset + KERNELBASE;
@@ -313,8 +313,10 @@ early_init(int r3, int r4, int r5)
          * Identify the CPU type and fix up code sections
          * that depend on which cpu we have.
          */
-        identify_cpu(offset, 0);
-        do_cpu_ftr_fixups(offset);
+        spec = identify_cpu(offset);
+        do_feature_fixups(spec->cpu_features,
+                          PTRRELOC(&__start___ftr_fixup),
+                          PTRRELOC(&__stop___ftr_fixup));
 
         return phys;
 }
diff --git a/arch/ppc/kernel/time.c b/arch/ppc/kernel/time.c
index d4b2cf74da6a..18ee851e33e3 100644
--- a/arch/ppc/kernel/time.c
+++ b/arch/ppc/kernel/time.c
@@ -62,6 +62,7 @@
 #include <asm/cache.h>
 #include <asm/8xx_immap.h>
 #include <asm/machdep.h>
+#include <asm/irq_regs.h>
 
 #include <asm/time.h>
 
@@ -129,6 +130,7 @@ void wakeup_decrementer(void)
  */
 void timer_interrupt(struct pt_regs * regs)
 {
+        struct pt_regs *old_regs;
         int next_dec;
         unsigned long cpu = smp_processor_id();
         unsigned jiffy_stamp = last_jiffy_stamp(cpu);
@@ -137,6 +139,7 @@ void timer_interrupt(struct pt_regs * regs)
         if (atomic_read(&ppc_n_lost_interrupts) != 0)
                 do_IRQ(regs);
 
+        old_regs = set_irq_regs(regs);
         irq_enter();
 
         while ((next_dec = tb_ticks_per_jiffy - tb_delta(&jiffy_stamp)) <= 0) {
@@ -188,6 +191,7 @@ void timer_interrupt(struct pt_regs * regs)
                 ppc_md.heartbeat();
 
         irq_exit();
+        set_irq_regs(old_regs);
 }
 
 /*
diff --git a/arch/ppc/kernel/traps.c b/arch/ppc/kernel/traps.c
index aafc8e8893d1..9661a91183b3 100644
--- a/arch/ppc/kernel/traps.c
+++ b/arch/ppc/kernel/traps.c
@@ -708,7 +708,7 @@ void single_step_exception(struct pt_regs *regs)
 
 void alignment_exception(struct pt_regs *regs)
 {
-        int fixed;
+        int sig, code, fixed = 0;
 
         fixed = fix_alignment(regs);
         if (fixed == 1) {
@@ -717,14 +717,16 @@ void alignment_exception(struct pt_regs *regs)
                 return;
         }
         if (fixed == -EFAULT) {
-                /* fixed == -EFAULT means the operand address was bad */
-                if (user_mode(regs))
-                        _exception(SIGSEGV, regs, SEGV_ACCERR, regs->dar);
-                else
-                        bad_page_fault(regs, regs->dar, SIGSEGV);
-                return;
+                sig = SIGSEGV;
+                code = SEGV_ACCERR;
+        } else {
+                sig = SIGBUS;
+                code = BUS_ADRALN;
         }
-        _exception(SIGBUS, regs, BUS_ADRALN, regs->dar);
+        if (user_mode(regs))
+                _exception(sig, regs, code, regs->dar);
+        else
+                bad_page_fault(regs, regs->dar, sig);
 }
 
 void StackOverflow(struct pt_regs *regs)
diff --git a/arch/ppc/kernel/vmlinux.lds.S b/arch/ppc/kernel/vmlinux.lds.S
index 095fd3323323..16e8661e1fec 100644
--- a/arch/ppc/kernel/vmlinux.lds.S
+++ b/arch/ppc/kernel/vmlinux.lds.S
@@ -115,13 +115,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
 
diff --git a/arch/ppc/mm/init.c b/arch/ppc/mm/init.c
index 410200046af1..c374e53ae03a 100644
--- a/arch/ppc/mm/init.c
+++ b/arch/ppc/mm/init.c
@@ -374,11 +374,12 @@ void __init paging_init(void)
         end_pfn = start_pfn + (total_memory >> PAGE_SHIFT);
         add_active_range(0, start_pfn, end_pfn);
 
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
 #ifdef CONFIG_HIGHMEM
-        max_zone_pfns[0] = total_lowmem >> PAGE_SHIFT;
-        max_zone_pfns[1] = total_memory >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_DMA] = total_lowmem >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_HIGHMEM] = total_memory >> PAGE_SHIFT;
 #else
-        max_zone_pfns[0] = total_memory >> PAGE_SHIFT;
+        max_zone_pfns[ZONE_DMA] = total_memory >> PAGE_SHIFT;
 #endif /* CONFIG_HIGHMEM */
         free_area_init_nodes(max_zone_pfns);
 }
diff --git a/arch/ppc/platforms/mpc8272ads_setup.c b/arch/ppc/platforms/mpc8272ads_setup.c
index d7b3a6afa78f..1f9ea36837b1 100644
--- a/arch/ppc/platforms/mpc8272ads_setup.c
+++ b/arch/ppc/platforms/mpc8272ads_setup.c
@@ -196,7 +196,7 @@ static void __init mpc8272ads_fixup_enet_pdata(struct platform_device *pdev,
         bd_t* bi = (void*)__res;
         int fs_no = fsid_fcc1+pdev->id-1;
 
-        if(fs_no > ARRAY_SIZE(mpc82xx_enet_pdata)) {
+        if(fs_no >= ARRAY_SIZE(mpc82xx_enet_pdata)) {
                 return;
         }
 
@@ -222,7 +222,7 @@ static void mpc8272ads_fixup_uart_pdata(struct platform_device *pdev,
         int id = fs_uart_id_scc2fsid(idx);
 
         /* no need to alter anything if console */
-        if ((id <= num) && (!pdev->dev.platform_data)) {
+        if ((id < num) && (!pdev->dev.platform_data)) {
                 pinfo = &mpc8272_uart_pdata[id];
                 pinfo->uart_clk = bd->bi_intfreq;
                 pdev->dev.platform_data = pinfo;
diff --git a/arch/ppc/platforms/mpc866ads_setup.c b/arch/ppc/platforms/mpc866ads_setup.c
index 5f130dca3770..e95d2c111747 100644
--- a/arch/ppc/platforms/mpc866ads_setup.c
+++ b/arch/ppc/platforms/mpc866ads_setup.c
@@ -259,7 +259,7 @@ static void mpc866ads_fixup_enet_pdata(struct platform_device *pdev, int fs_no)
         /* Get pointer to Communication Processor */
         cp = cpmp;
 
-        if(fs_no > ARRAY_SIZE(mpc8xx_enet_pdata)) {
+        if(fs_no >= ARRAY_SIZE(mpc8xx_enet_pdata)) {
                 printk(KERN_ERR"No network-suitable #%d device on bus", fs_no);
                 return;
         }
@@ -305,7 +305,7 @@ static void __init mpc866ads_fixup_uart_pdata(struct platform_device *pdev,
         int id = fs_uart_id_smc2fsid(idx);
 
         /* no need to alter anything if console */
-        if ((id <= num) && (!pdev->dev.platform_data)) {
+        if ((id < num) && (!pdev->dev.platform_data)) {
                 pinfo = &mpc866_uart_pdata[id];
                 pinfo->uart_clk = bd->bi_intfreq;
                 pdev->dev.platform_data = pinfo;
diff --git a/arch/ppc/platforms/mpc885ads_setup.c b/arch/ppc/platforms/mpc885ads_setup.c
index 02293141efb5..f8161f3557f5 100644
--- a/arch/ppc/platforms/mpc885ads_setup.c
+++ b/arch/ppc/platforms/mpc885ads_setup.c
@@ -263,7 +263,7 @@ static void mpc885ads_fixup_enet_pdata(struct platform_device *pdev, int fs_no)
         char *e;
         int i;
 
-        if(fs_no > ARRAY_SIZE(mpc8xx_enet_pdata)) {
+        if(fs_no >= ARRAY_SIZE(mpc8xx_enet_pdata)) {
                 printk(KERN_ERR"No network-suitable #%d device on bus", fs_no);
                 return;
         }
@@ -371,7 +371,7 @@ static void __init mpc885ads_fixup_uart_pdata(struct platform_device *pdev,
         int id = fs_uart_id_smc2fsid(idx);
 
         /* no need to alter anything if console */
-        if ((id <= num) && (!pdev->dev.platform_data)) {
+        if ((id < num) && (!pdev->dev.platform_data)) {
                 pinfo = &mpc885_uart_pdata[id];
                 pinfo->uart_clk = bd->bi_intfreq;
                 pdev->dev.platform_data = pinfo;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 608193cfe43f..245b81bc7157 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -236,9 +236,6 @@ config WARN_STACK_SIZE
           This allows you to specify the maximum frame size a function may
           have without the compiler complaining about it.
 
-config ARCH_POPULATES_NODE_MAP
-        def_bool y
-
 source "mm/Kconfig"
 
 comment "I/O subsystem configuration"
diff --git a/arch/s390/appldata/appldata_base.c b/arch/s390/appldata/appldata_base.c
index 2b1e6c9a6e0e..af1e8fc7d985 100644
--- a/arch/s390/appldata/appldata_base.c
+++ b/arch/s390/appldata/appldata_base.c
@@ -109,7 +109,7 @@ static LIST_HEAD(appldata_ops_list);
  *
  * schedule work and reschedule timer
  */
-static void appldata_timer_function(unsigned long data, struct pt_regs *regs)
+static void appldata_timer_function(unsigned long data)
 {
         P_DEBUG("   -= Timer =-\n");
         P_DEBUG("CPU: %i, expire_count: %i\n", smp_processor_id(),
@@ -310,6 +310,7 @@ appldata_interval_handler(ctl_table *ctl, int write, struct file *filp,
         if (copy_from_user(buf, buffer, len > sizeof(buf) ? sizeof(buf) : len)) {
                 return -EFAULT;
         }
+        interval = 0;
         sscanf(buf, "%i", &interval);
         if (interval <= 0) {
                 P_ERROR("Timer CPU interval has to be > 0!\n");
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index a3257398ea8d..7cd51e73e274 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18
-# Wed Oct  4 19:45:46 2006
+# Linux kernel version: 2.6.19-rc2
+# Wed Oct 18 17:11:10 2006
 #
 CONFIG_MMU=y
 CONFIG_LOCKDEP_SUPPORT=y
@@ -119,7 +119,6 @@ CONFIG_PACK_STACK=y
 CONFIG_CHECK_STACK=y
 CONFIG_STACK_GUARD=256
 # CONFIG_WARN_STACK is not set
-CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
 CONFIG_FLATMEM_MANUAL=y
 # CONFIG_DISCONTIGMEM_MANUAL is not set
@@ -211,6 +210,7 @@ CONFIG_INET6_XFRM_MODE_TRANSPORT=y
 CONFIG_INET6_XFRM_MODE_TUNNEL=y
 CONFIG_INET6_XFRM_MODE_BEET=y
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=y
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
@@ -528,6 +528,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -646,10 +647,6 @@ CONFIG_MSDOS_PARTITION=y
 # CONFIG_NLS is not set
 
 #
-# Distributed Lock Manager
-#
-
-#
 # Instrumentation Support
 #
 
@@ -669,7 +666,6 @@ CONFIG_MAGIC_SYSRQ=y
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_KERNEL=y
 CONFIG_LOG_BUF_SHIFT=17
-# CONFIG_DETECT_SOFTLOCKUP is not set
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
 CONFIG_DEBUG_PREEMPT=y
@@ -690,6 +686,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
+CONFIG_HEADERS_CHECK=y
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 
diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c
index e15e1489aef5..5b33f823863a 100644
--- a/arch/s390/kernel/compat_linux.c
+++ b/arch/s390/kernel/compat_linux.c
@@ -295,6 +295,7 @@ static inline long put_tv32(struct compat_timeval __user *o, struct timeval *i)
  *
  * This is really horribly ugly.
  */
+#ifdef CONFIG_SYSVIPC
 asmlinkage long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
 {
         if (call >> 16)         /* hack for backward compatibility */
@@ -338,6 +339,7 @@ asmlinkage long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
 
         return -ENOSYS;
 }
+#endif
 
 asmlinkage long sys32_truncate64(const char __user * path, unsigned long high, unsigned long low)
 {
@@ -755,7 +757,9 @@ asmlinkage long sys32_sysctl(struct __sysctl_args32 __user *args)
                             put_user(oldlen, (u32 __user *)compat_ptr(tmp.oldlenp)))
                                 error = -EFAULT;
                 }
-                copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
+                if (copy_to_user(args->__unused, tmp.__unused,
+                                 sizeof(tmp.__unused)))
+                        error = -EFAULT;
         }
         return error;
 }
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index d49b876a83bf..861888ab8c13 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -169,12 +169,12 @@ sys32_sigaction(int sig, const struct old_sigaction32 __user *act,
                 compat_old_sigset_t mask;
                 if (!access_ok(VERIFY_READ, act, sizeof(*act)) ||
                     __get_user(sa_handler, &act->sa_handler) ||
-                    __get_user(sa_restorer, &act->sa_restorer))
+                    __get_user(sa_restorer, &act->sa_restorer) ||
+                    __get_user(new_ka.sa.sa_flags, &act->sa_flags) ||
+                    __get_user(mask, &act->sa_mask))
                         return -EFAULT;
                 new_ka.sa.sa_handler = (__sighandler_t) sa_handler;
                 new_ka.sa.sa_restorer = (void (*)(void)) sa_restorer;
-                __get_user(new_ka.sa.sa_flags, &act->sa_flags);
-                __get_user(mask, &act->sa_mask);
                 siginitset(&new_ka.sa.sa_mask, mask);
         }
 
@@ -185,10 +185,10 @@ sys32_sigaction(int sig, const struct old_sigaction32 __user *act,
                 sa_restorer = (unsigned long) old_ka.sa.sa_restorer;
                 if (!access_ok(VERIFY_WRITE, oact, sizeof(*oact)) ||
                     __put_user(sa_handler, &oact->sa_handler) ||
-                    __put_user(sa_restorer, &oact->sa_restorer))
+                    __put_user(sa_restorer, &oact->sa_restorer) ||
+                    __put_user(old_ka.sa.sa_flags, &oact->sa_flags) ||
+                    __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask))
                         return -EFAULT;
-                __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
-                __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
         }
 
         return ret;
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index cb0efae6802f..71e54ef0931e 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1664,4 +1664,4 @@ sys_getcpu_wrapper:
         llgtr   %r2,%r2                 # unsigned *
         llgtr   %r3,%r3                 # unsigned *
         llgtr   %r4,%r4                 # struct getcpu_cache *
-        jg      sys_tee
+        jg      sys_getcpu
diff --git a/arch/s390/kernel/s390_ext.c b/arch/s390/kernel/s390_ext.c
index c49ab8c784d2..4faf96f8a834 100644
--- a/arch/s390/kernel/s390_ext.c
+++ b/arch/s390/kernel/s390_ext.c
@@ -117,8 +117,8 @@ void do_extint(struct pt_regs *regs, unsigned short code)
         int index;
         struct pt_regs *old_regs;
 
-        irq_enter();
         old_regs = set_irq_regs(regs);
+        irq_enter();
         asm volatile ("mc 0,0");
         if (S390_lowcore.int_clock >= S390_lowcore.jiffy_timer)
                 /**
@@ -134,8 +134,8 @@ void do_extint(struct pt_regs *regs, unsigned short code)
                                 p->handler(code);
                 }
         }
-        set_irq_regs(old_regs);
         irq_exit();
+        set_irq_regs(old_regs);
 }
 
 EXPORT_SYMBOL(register_external_interrupt);
diff --git a/arch/s390/kernel/s390_ksyms.c b/arch/s390/kernel/s390_ksyms.c
index 9f19e833a562..90b5ef529eb7 100644
--- a/arch/s390/kernel/s390_ksyms.c
+++ b/arch/s390/kernel/s390_ksyms.c
@@ -51,4 +51,3 @@ EXPORT_SYMBOL(csum_fold);
 EXPORT_SYMBOL(console_mode);
 EXPORT_SYMBOL(console_devno);
 EXPORT_SYMBOL(console_irq);
-EXPORT_SYMBOL(sys_wait4);
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 49f2b68e32b1..2aa13e8e000a 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -70,6 +70,7 @@ struct {
 #define CHUNK_READ_WRITE 0
 #define CHUNK_READ_ONLY 1
 volatile int __cpu_logical_map[NR_CPUS]; /* logical cpu to cpu address */
+unsigned long __initdata zholes_size[MAX_NR_ZONES];
 static unsigned long __initdata memory_end;
 
 /*
@@ -357,6 +358,21 @@ void machine_power_off(void)
  */
 void (*pm_power_off)(void) = machine_power_off;
 
+static void __init
+add_memory_hole(unsigned long start, unsigned long end)
+{
+        unsigned long dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
+
+        if (end <= dma_pfn)
+                zholes_size[ZONE_DMA] += end - start + 1;
+        else if (start > dma_pfn)
+                zholes_size[ZONE_NORMAL] += end - start + 1;
+        else {
+                zholes_size[ZONE_DMA] += dma_pfn - start + 1;
+                zholes_size[ZONE_NORMAL] += end - dma_pfn;
+        }
+}
+
 static int __init early_parse_mem(char *p)
 {
         memory_end = memparse(p, &p);
@@ -434,7 +450,7 @@ setup_lowcore(void)
                 lc->extended_save_area_addr = (__u32)
                         __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0);
                 /* enable extended save area */
-                ctl_set_bit(14, 29);
+                __ctl_set_bit(14, 29);
         }
 #endif
         set_prefix((u32)(unsigned long) lc);
@@ -478,6 +494,7 @@ setup_memory(void)
 {
         unsigned long bootmap_size;
         unsigned long start_pfn, end_pfn, init_pfn;
+        unsigned long last_rw_end;
         int i;
 
         /*
@@ -533,27 +550,39 @@ setup_memory(void)
         /*
          * Register RAM areas with the bootmem allocator.
          */
+        last_rw_end = start_pfn;
 
         for (i = 0; i < MEMORY_CHUNKS && memory_chunk[i].size > 0; i++) {
-                unsigned long start_chunk, end_chunk, pfn;
+                unsigned long start_chunk, end_chunk;
 
                 if (memory_chunk[i].type != CHUNK_READ_WRITE)
                         continue;
-                start_chunk = PFN_DOWN(memory_chunk[i].addr);
-                end_chunk = start_chunk + PFN_DOWN(memory_chunk[i].size) - 1;
-                end_chunk = min(end_chunk, end_pfn);
-                if (start_chunk >= end_chunk)
-                        continue;
-                add_active_range(0, start_chunk, end_chunk);
-                pfn = max(start_chunk, start_pfn);
-                for (; pfn <= end_chunk; pfn++)
-                        page_set_storage_key(PFN_PHYS(pfn), PAGE_DEFAULT_KEY);
+                start_chunk = (memory_chunk[i].addr + PAGE_SIZE - 1);
+                start_chunk >>= PAGE_SHIFT;
+                end_chunk = (memory_chunk[i].addr + memory_chunk[i].size);
+                end_chunk >>= PAGE_SHIFT;
+                if (start_chunk < start_pfn)
+                        start_chunk = start_pfn;
+                if (end_chunk > end_pfn)
+                        end_chunk = end_pfn;
+                if (start_chunk < end_chunk) {
+                        /* Initialize storage key for RAM pages */
+                        for (init_pfn = start_chunk ; init_pfn < end_chunk;
+                             init_pfn++)
+                                page_set_storage_key(init_pfn << PAGE_SHIFT,
+                                                     PAGE_DEFAULT_KEY);
+                        free_bootmem(start_chunk << PAGE_SHIFT,
+                                     (end_chunk - start_chunk) << PAGE_SHIFT);
+                        if (last_rw_end < start_chunk)
+                                add_memory_hole(last_rw_end, start_chunk - 1);
+                        last_rw_end = end_chunk;
+                }
         }
 
         psw_set_key(PAGE_DEFAULT_KEY);
 
-        free_bootmem_with_active_regions(0, max_pfn);
-        reserve_bootmem(0, PFN_PHYS(start_pfn));
+        if (last_rw_end < end_pfn - 1)
+                add_memory_hole(last_rw_end, end_pfn - 1);
 
         /*
          * Reserve the bootmem bitmap itself as well. We do this in two
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index 4392a77cbae8..4c8a7954ef48 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -80,10 +80,10 @@ sys_sigaction(int sig, const struct old_sigaction __user *act,
                 old_sigset_t mask;
                 if (!access_ok(VERIFY_READ, act, sizeof(*act)) ||
                     __get_user(new_ka.sa.sa_handler, &act->sa_handler) ||
-                    __get_user(new_ka.sa.sa_restorer, &act->sa_restorer))
+                    __get_user(new_ka.sa.sa_restorer, &act->sa_restorer) ||
+                    __get_user(new_ka.sa.sa_flags, &act->sa_flags) ||
+                    __get_user(mask, &act->sa_mask))
                         return -EFAULT;
-                __get_user(new_ka.sa.sa_flags, &act->sa_flags);
-                __get_user(mask, &act->sa_mask);
                 siginitset(&new_ka.sa.sa_mask, mask);
         }
 
@@ -92,10 +92,10 @@ sys_sigaction(int sig, const struct old_sigaction __user *act,
         if (!ret && oact) {
                 if (!access_ok(VERIFY_WRITE, oact, sizeof(*oact)) ||
                     __put_user(old_ka.sa.sa_handler, &oact->sa_handler) ||
-                    __put_user(old_ka.sa.sa_restorer, &oact->sa_restorer))
+                    __put_user(old_ka.sa.sa_restorer, &oact->sa_restorer) ||
+                    __put_user(old_ka.sa.sa_flags, &oact->sa_flags) ||
+                    __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask))
                         return -EFAULT;
-                __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
-                __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
         }
 
         return ret;
diff --git a/arch/s390/kernel/stacktrace.c b/arch/s390/kernel/stacktrace.c
index d9428a0fc8fb..0d14a4789bf2 100644
--- a/arch/s390/kernel/stacktrace.c
+++ b/arch/s390/kernel/stacktrace.c
@@ -62,27 +62,26 @@ static inline unsigned long save_context_stack(struct stack_trace *trace,
 void save_stack_trace(struct stack_trace *trace, struct task_struct *task)
 {
         register unsigned long sp asm ("15");
-        unsigned long orig_sp;
+        unsigned long orig_sp, new_sp;
 
-        sp &= PSW_ADDR_INSN;
-        orig_sp = sp;
+        orig_sp = sp & PSW_ADDR_INSN;
 
-        sp = save_context_stack(trace, &trace->skip, sp,
+        new_sp = save_context_stack(trace, &trace->skip, orig_sp,
                                 S390_lowcore.panic_stack - PAGE_SIZE,
                                 S390_lowcore.panic_stack);
-        if ((sp != orig_sp) && !trace->all_contexts)
+        if ((new_sp != orig_sp) && !trace->all_contexts)
                 return;
-        sp = save_context_stack(trace, &trace->skip, sp,
+        new_sp = save_context_stack(trace, &trace->skip, new_sp,
                                 S390_lowcore.async_stack - ASYNC_SIZE,
                                 S390_lowcore.async_stack);
-        if ((sp != orig_sp) && !trace->all_contexts)
+        if ((new_sp != orig_sp) && !trace->all_contexts)
                 return;
         if (task)
-                save_context_stack(trace, &trace->skip, sp,
+                save_context_stack(trace, &trace->skip, new_sp,
                                    (unsigned long) task_stack_page(task),
                                    (unsigned long) task_stack_page(task) + THREAD_SIZE);
         else
-                save_context_stack(trace, &trace->skip, sp,
+                save_context_stack(trace, &trace->skip, new_sp,
                                    S390_lowcore.thread_info,
                                    S390_lowcore.thread_info + THREAD_SIZE);
         return;
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index e59baec56520..a4ceae3dbcf1 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -320,3 +320,4 @@ SYSCALL(sys_tee,sys_tee,sys_tee_wrapper)
 SYSCALL(sys_vmsplice,sys_vmsplice,compat_sys_vmsplice_wrapper)
 NI_SYSCALL                                                      /* 310 sys_move_pages */
 SYSCALL(sys_getcpu,sys_getcpu,sys_getcpu_wrapper)
+SYSCALL(sys_epoll_pwait,sys_epoll_pwait,sys_ni_syscall)
diff --git a/arch/s390/kernel/traps.c b/arch/s390/kernel/traps.c
index 66375a5e3d12..92ecffbc8d82 100644
--- a/arch/s390/kernel/traps.c
+++ b/arch/s390/kernel/traps.c
@@ -462,7 +462,8 @@ asmlinkage void illegal_op(struct pt_regs * regs, long interruption_code)
                 local_irq_enable();
 
         if (regs->psw.mask & PSW_MASK_PSTATE) {
-                get_user(*((__u16 *) opcode), (__u16 __user *) location);
+                if (get_user(*((__u16 *) opcode), (__u16 __user *) location))
+                        return;
                 if (*((__u16 *) opcode) == S390_BREAKPOINT_U16) {
                         if (current->ptrace & PT_PTRACED)
                                 force_sig(SIGTRAP, current);
@@ -470,20 +471,25 @@ asmlinkage void illegal_op(struct pt_regs * regs, long interruption_code)
                                 signal = SIGILL;
 #ifdef CONFIG_MATHEMU
                 } else if (opcode[0] == 0xb3) {
-                        get_user(*((__u16 *) (opcode+2)), location+1);
+                        if (get_user(*((__u16 *) (opcode+2)), location+1))
+                                return;
                         signal = math_emu_b3(opcode, regs);
                 } else if (opcode[0] == 0xed) {
-                        get_user(*((__u32 *) (opcode+2)),
-                                 (__u32 __user *)(location+1));
+                        if (get_user(*((__u32 *) (opcode+2)),
+                                     (__u32 __user *)(location+1)))
+                                return;
                         signal = math_emu_ed(opcode, regs);
                 } else if (*((__u16 *) opcode) == 0xb299) {
-                        get_user(*((__u16 *) (opcode+2)), location+1);
+                        if (get_user(*((__u16 *) (opcode+2)), location+1))
+                                return;
                         signal = math_emu_srnm(opcode, regs);
                 } else if (*((__u16 *) opcode) == 0xb29c) {
-                        get_user(*((__u16 *) (opcode+2)), location+1);
+                        if (get_user(*((__u16 *) (opcode+2)), location+1))
+                                return;
                         signal = math_emu_stfpc(opcode, regs);
                 } else if (*((__u16 *) opcode) == 0xb29d) {
-                        get_user(*((__u16 *) (opcode+2)), location+1);
+                        if (get_user(*((__u16 *) (opcode+2)), location+1))
+                                return;
                         signal = math_emu_lfpc(opcode, regs);
 #endif
                 } else
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index af9e69a03011..fe0f2e97ba7b 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -83,13 +83,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
index 1d7d3938b2b1..21baaf5496d6 100644
--- a/arch/s390/kernel/vtime.c
+++ b/arch/s390/kernel/vtime.c
@@ -209,11 +209,11 @@ static void list_add_sorted(struct vtimer_list *timer, struct list_head *head)
  * Do the callback functions of expired vtimer events.
  * Called from within the interrupt handler.
  */
-static void do_callbacks(struct list_head *cb_list, struct pt_regs *regs)
+static void do_callbacks(struct list_head *cb_list)
 {
         struct vtimer_queue *vt_list;
         struct vtimer_list *event, *tmp;
-        void (*fn)(unsigned long, struct pt_regs*);
+        void (*fn)(unsigned long);
         unsigned long data;
 
         if (list_empty(cb_list))
@@ -224,7 +224,7 @@ static void do_callbacks(struct list_head *cb_list, struct pt_regs *regs)
         list_for_each_entry_safe(event, tmp, cb_list, entry) {
                 fn = event->function;
                 data = event->data;
-                fn(data, regs);
+                fn(data);
 
                 if (!event->interval)
                         /* delete one shot timer */
@@ -275,7 +275,7 @@ static void do_cpu_timer_interrupt(__u16 error_code)
                 list_move_tail(&event->entry, &cb_list);
         }
         spin_unlock(&vt_list->lock);
-        do_callbacks(&cb_list, get_irq_regs());
+        do_callbacks(&cb_list);
 
         /* next event is first in list */
         spin_lock(&vt_list->lock);
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index d99891718709..e1881c31b1cb 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -84,6 +84,7 @@ void show_mem(void)
         printk("%d pages swap cached\n",cached);
 }
 
+extern unsigned long __initdata zholes_size[];
 /*
  * paging_init() sets up the page tables
  */
@@ -100,15 +101,16 @@ void __init paging_init(void)
         unsigned long pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) | _KERNSEG_TABLE;
         static const int ssm_mask = 0x04000000L;
         unsigned long ro_start_pfn, ro_end_pfn;
-        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        unsigned long zones_size[MAX_NR_ZONES];
 
         ro_start_pfn = PFN_DOWN((unsigned long)&__start_rodata);
         ro_end_pfn = PFN_UP((unsigned long)&__end_rodata);
 
-        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
-        max_zone_pfns[ZONE_DMA] = max_low_pfn;
-        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
-        free_area_init_nodes(max_zone_pfns);
+        memset(zones_size, 0, sizeof(zones_size));
+        zones_size[ZONE_DMA] = max_low_pfn;
+        free_area_init_node(0, &contig_page_data, zones_size,
+                            __pa(PAGE_OFFSET) >> PAGE_SHIFT,
+                            zholes_size);
 
         /* unmap whole virtual address space */
         
@@ -168,16 +170,26 @@ void __init paging_init(void)
         unsigned long pgdir_k = (__pa(swapper_pg_dir) & PAGE_MASK) |
           _KERN_REGION_TABLE;
         static const int ssm_mask = 0x04000000L;
+        unsigned long zones_size[MAX_NR_ZONES];
+        unsigned long dma_pfn, high_pfn;
         unsigned long ro_start_pfn, ro_end_pfn;
-        unsigned long max_zone_pfns[MAX_NR_ZONES];
 
+        memset(zones_size, 0, sizeof(zones_size));
+        dma_pfn = MAX_DMA_ADDRESS >> PAGE_SHIFT;
+        high_pfn = max_low_pfn;
         ro_start_pfn = PFN_DOWN((unsigned long)&__start_rodata);
         ro_end_pfn = PFN_UP((unsigned long)&__end_rodata);
 
-        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
-        max_zone_pfns[ZONE_DMA] = PFN_DOWN(MAX_DMA_ADDRESS);
-        max_zone_pfns[ZONE_NORMAL] = max_low_pfn;
-        free_area_init_nodes(max_zone_pfns);
+        if (dma_pfn > high_pfn)
+                zones_size[ZONE_DMA] = high_pfn;
+        else {
+                zones_size[ZONE_DMA] = dma_pfn;
+                zones_size[ZONE_NORMAL] = high_pfn - dma_pfn;
+        }
+
+        /* Initialize mem_map[].  */
+        free_area_init_node(0, &contig_page_data, zones_size,
+                            __pa(PAGE_OFFSET) >> PAGE_SHIFT, zholes_size);
 
         /*
          * map whole physical memory to virtual memory (identity mapping) 
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index f6a0c4436168..6a461d4caeff 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -45,6 +45,9 @@ config GENERIC_CALIBRATE_DELAY
 config GENERIC_IOMAP
         bool
 
+config GENERIC_TIME
+        def_bool n
+
 config ARCH_MAY_HAVE_PC_FDC
         bool
 
@@ -357,6 +360,7 @@ config CPU_HAS_SR_RB
 endmenu
 
 menu "Timer support"
+depends on !GENERIC_TIME
 
 config SH_TMU
         bool "TMU timer support"
diff --git a/arch/sh/boards/hp6xx/hp6xx_apm.c b/arch/sh/boards/hp6xx/hp6xx_apm.c
index 75f91aaae077..d146cdaa0b8b 100644
--- a/arch/sh/boards/hp6xx/hp6xx_apm.c
+++ b/arch/sh/boards/hp6xx/hp6xx_apm.c
@@ -14,7 +14,7 @@
 #include <asm/io.h>
 #include <asm/apm.h>
 #include <asm/adc.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 
 #define SH7709_PGDR                     0xa400012c
 
@@ -83,7 +83,7 @@ static int hp6x0_apm_get_info(char *buf, char **start, off_t fpos, int length)
         return p - buf;
 }
 
-static irqreturn_t hp6x0_apm_interrupt(int irq, void *dev, struct pt_regs *regs)
+static irqreturn_t hp6x0_apm_interrupt(int irq, void *dev)
 {
         if (!apm_suspended)
                 apm_queue_event(APM_USER_SUSPEND);
@@ -96,7 +96,7 @@ static int __init hp6x0_apm_init(void)
         int ret;
 
         ret = request_irq(HP680_BTN_IRQ, hp6x0_apm_interrupt,
-                          SA_INTERRUPT, MODNAME, 0);
+                          IRQF_DISABLED, MODNAME, 0);
         if (unlikely(ret < 0)) {
                 printk(KERN_ERR MODNAME ": IRQ %d request failed\n",
                        HP680_BTN_IRQ);
diff --git a/arch/sh/boards/hp6xx/pm.c b/arch/sh/boards/hp6xx/pm.c
index 83d327212064..d1947732fb3e 100644
--- a/arch/sh/boards/hp6xx/pm.c
+++ b/arch/sh/boards/hp6xx/pm.c
@@ -12,7 +12,7 @@
 #include <linux/time.h>
 #include <asm/io.h>
 #include <asm/hd64461.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 #include <asm/cpu/dac.h>
 #include <asm/pm.h>
 
diff --git a/arch/sh/boards/hp6xx/setup.c b/arch/sh/boards/hp6xx/setup.c
index 2d3a5b4faf58..b5a96649ed26 100644
--- a/arch/sh/boards/hp6xx/setup.c
+++ b/arch/sh/boards/hp6xx/setup.c
@@ -13,7 +13,7 @@
 #include <asm/hd64461.h>
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 #include <asm/cpu/dac.h>
 
 #define SCPCR   0xa4000116
diff --git a/arch/sh/boards/landisk/landisk_pwb.c b/arch/sh/boards/landisk/landisk_pwb.c
index 0b7bee1a9ca5..e62524978160 100644
--- a/arch/sh/boards/landisk/landisk_pwb.c
+++ b/arch/sh/boards/landisk/landisk_pwb.c
@@ -135,7 +135,7 @@ static int swdrv_write(struct file *filp, const char *buff, size_t count,
         return count;
 }
 
-static irqreturn_t sw_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t sw_interrupt(int irq, void *dev_id)
 {
         landisk_btn = (0x0ff & (~ctrl_inb(PA_STATUS)));
         disable_irq(IRQ_BUTTON);
diff --git a/arch/sh/boards/mpc1211/setup.c b/arch/sh/boards/mpc1211/setup.c
index 01c10fa5c058..7c3d1d304157 100644
--- a/arch/sh/boards/mpc1211/setup.c
+++ b/arch/sh/boards/mpc1211/setup.c
@@ -69,7 +69,6 @@ static void __init pci_write_config(unsigned long busNo,
 
 static unsigned char m_irq_mask = 0xfb;
 static unsigned char s_irq_mask = 0xff;
-volatile unsigned long irq_err_count;
 
 static void disable_mpc1211_irq(unsigned int irq)
 {
@@ -118,7 +117,7 @@ static void mask_and_ack_mpc1211(unsigned int irq)
         if(irq < 8) {
                 if(m_irq_mask & (1<<irq)){
                   if(!mpc1211_irq_real(irq)){
-                    irq_err_count++;
+                    atomic_inc(&irq_err_count)
                     printk("spurious 8259A interrupt: IRQ %x\n",irq);
                    }
                 } else {
@@ -131,7 +130,7 @@ static void mask_and_ack_mpc1211(unsigned int irq)
         } else {
                 if(s_irq_mask & (1<<(irq - 8))){
                   if(!mpc1211_irq_real(irq)){
-                    irq_err_count++;
+                    atomic_inc(&irq_err_count);
                     printk("spurious 8259A interrupt: IRQ %x\n",irq);
                   }
                 } else {
diff --git a/arch/sh/boards/renesas/hs7751rvoip/io.c b/arch/sh/boards/renesas/hs7751rvoip/io.c
index 51f3f6574210..bb9aa0d62852 100644
--- a/arch/sh/boards/renesas/hs7751rvoip/io.c
+++ b/arch/sh/boards/renesas/hs7751rvoip/io.c
@@ -15,7 +15,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <asm/io.h>
-#include <asm/hs7751rvoip/hs7751rvoip.h>
+#include <asm/hs7751rvoip.h>
 #include <asm/addrspace.h>
 
 extern void *area6_io8_base;    /* Area 6 8bit I/O Base address */
diff --git a/arch/sh/boards/renesas/hs7751rvoip/irq.c b/arch/sh/boards/renesas/hs7751rvoip/irq.c
index c617b188258a..943f93aa6052 100644
--- a/arch/sh/boards/renesas/hs7751rvoip/irq.c
+++ b/arch/sh/boards/renesas/hs7751rvoip/irq.c
@@ -14,7 +14,7 @@
 #include <linux/irq.h>
 #include <asm/io.h>
 #include <asm/irq.h>
-#include <asm/hs7751rvoip/hs7751rvoip.h>
+#include <asm/hs7751rvoip.h>
 
 static int mask_pos[] = {8, 9, 10, 11, 12, 13, 0, 1, 2, 3, 4, 5, 6, 7};
 
diff --git a/arch/sh/boards/renesas/hs7751rvoip/setup.c b/arch/sh/boards/renesas/hs7751rvoip/setup.c
index 0414c15c3458..f7d0e304d899 100644
--- a/arch/sh/boards/renesas/hs7751rvoip/setup.c
+++ b/arch/sh/boards/renesas/hs7751rvoip/setup.c
@@ -10,22 +10,21 @@
 #include <linux/init.h>
 #include <linux/irq.h>
 #include <linux/mm.h>
-#include <linux/vmalloc.h>
-#include <linux/hdreg.h>
-#include <linux/ide.h>
 #include <linux/pm.h>
+#include <asm/hs7751rvoip.h>
 #include <asm/io.h>
-#include <asm/hs7751rvoip/hs7751rvoip.h>
 #include <asm/machvec.h>
-#include <asm/rtc.h>
-#include <asm/irq.h>
 
-static void __init hs7751rvoip_init_irq(void)
-{
+static struct ipr_data hs77501rvoip_ipr_map[] = {
 #if defined(CONFIG_HS7751RVOIP_CODEC)
-        make_ipr_irq(DMTE0_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-        make_ipr_irq(DMTE1_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
+        { DMTE0_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE1_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
 #endif
+};
+
+static void __init hs7751rvoip_init_irq(void)
+{
+        make_ipr_irq(hs77501rvoip_ipr_map, ARRAY_SIZE(hs77501rvoip_ipr_map));
 
         init_hs7751rvoip_IRQ();
 }
diff --git a/arch/sh/boards/renesas/r7780rp/io.c b/arch/sh/boards/renesas/r7780rp/io.c
index db92d6e6ae99..311ccccba718 100644
--- a/arch/sh/boards/renesas/r7780rp/io.c
+++ b/arch/sh/boards/renesas/r7780rp/io.c
@@ -11,7 +11,7 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <asm/r7780rp/r7780rp.h>
+#include <asm/r7780rp.h>
 #include <asm/addrspace.h>
 #include <asm/io.h>
 
diff --git a/arch/sh/boards/renesas/r7780rp/irq.c b/arch/sh/boards/renesas/r7780rp/irq.c
index 2d960e9a3143..aa15ec5bc69e 100644
--- a/arch/sh/boards/renesas/r7780rp/irq.c
+++ b/arch/sh/boards/renesas/r7780rp/irq.c
@@ -1,18 +1,17 @@
 /*
- * linux/arch/sh/boards/renesas/r7780rp/irq.c
- *
- * Copyright (C) 2000  Kazumoto Kojima
- *
  * Renesas Solutions Highlander R7780RP-1 Support.
  *
- * Modified for R7780RP-1 by
- * Atom Create Engineering Co., Ltd. 2002.
+ * Copyright (C) 2002  Atom Create Engineering Co., Ltd.
+ * Copyright (C) 2006  Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
  */
 #include <linux/init.h>
 #include <linux/irq.h>
-#include <asm/io.h>
-#include <asm/irq.h>
-#include <asm/r7780rp/r7780rp.h>
+#include <linux/io.h>
+#include <asm/r7780rp.h>
 
 #ifdef CONFIG_SH_R7780MP
 static int mask_pos[] = {12, 11, 9, 14, 15, 8, 13, 6, 5, 4, 3, 2, 0, 0, 1, 0};
@@ -20,71 +19,26 @@ static int mask_pos[] = {12, 11, 9, 14, 15, 8, 13, 6, 5, 4, 3, 2, 0, 0, 1, 0};
 static int mask_pos[] = {15, 14, 13, 12, 11, 10, 9, 8, 7, 5, 6, 4, 0, 1, 2, 0};
 #endif
 
-static void enable_r7780rp_irq(unsigned int irq);
-static void disable_r7780rp_irq(unsigned int irq);
-
-/* shutdown is same as "disable" */
-#define shutdown_r7780rp_irq disable_r7780rp_irq
-
-static void ack_r7780rp_irq(unsigned int irq);
-static void end_r7780rp_irq(unsigned int irq);
-
-static unsigned int startup_r7780rp_irq(unsigned int irq)
-{
-        enable_r7780rp_irq(irq);
-        return 0; /* never anything pending */
-}
-
-static void disable_r7780rp_irq(unsigned int irq)
-{
-        unsigned short val;
-        unsigned short mask = 0xffff ^ (0x0001 << mask_pos[irq]);
-
-        /* Set the priority in IPR to 0 */
-        val = ctrl_inw(IRLCNTR1);
-        val &= mask;
-        ctrl_outw(val, IRLCNTR1);
-}
-
 static void enable_r7780rp_irq(unsigned int irq)
 {
-        unsigned short val;
-        unsigned short value = (0x0001 << mask_pos[irq]);
-
         /* Set priority in IPR back to original value */
-        val = ctrl_inw(IRLCNTR1);
-        val |= value;
-        ctrl_outw(val, IRLCNTR1);
-}
-
-static void ack_r7780rp_irq(unsigned int irq)
-{
-        disable_r7780rp_irq(irq);
+        ctrl_outw(ctrl_inw(IRLCNTR1) | (1 << mask_pos[irq]), IRLCNTR1);
 }
 
-static void end_r7780rp_irq(unsigned int irq)
+static void disable_r7780rp_irq(unsigned int irq)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
-                enable_r7780rp_irq(irq);
+        /* Set the priority in IPR to 0 */
+        ctrl_outw(ctrl_inw(IRLCNTR1) & (0xffff ^ (1 << mask_pos[irq])),
+                  IRLCNTR1);
 }
 
-static struct hw_interrupt_type r7780rp_irq_type = {
-        .typename = "R7780RP-IRQ",
-        .startup = startup_r7780rp_irq,
-        .shutdown = shutdown_r7780rp_irq,
-        .enable = enable_r7780rp_irq,
-        .disable = disable_r7780rp_irq,
-        .ack = ack_r7780rp_irq,
-        .end = end_r7780rp_irq,
+static struct irq_chip r7780rp_irq_chip __read_mostly = {
+        .name           = "R7780RP",
+        .mask           = disable_r7780rp_irq,
+        .unmask         = enable_r7780rp_irq,
+        .mask_ack       = disable_r7780rp_irq,
 };
 
-static void make_r7780rp_irq(unsigned int irq)
-{
-        disable_irq_nosync(irq);
-        irq_desc[irq].chip = &r7780rp_irq_type;
-        disable_r7780rp_irq(irq);
-}
-
 /*
  * Initialize IRQ setting
  */
@@ -92,24 +46,10 @@ void __init init_r7780rp_IRQ(void)
 {
         int i;
 
-        /* IRL0=PCI Slot #A
-         * IRL1=PCI Slot #B
-         * IRL2=PCI Slot #C
-         * IRL3=PCI Slot #D
-         * IRL4=CF Card
-         * IRL5=CF Card Insert
-         * IRL6=M66596
-         * IRL7=SD Card
-         * IRL8=Touch Panel
-         * IRL9=SCI
-         * IRL10=Serial
-         * IRL11=Extention #A
-         * IRL11=Extention #B
-         * IRL12=Debug LAN
-         * IRL13=Push Switch
-         * IRL14=ZiggBee IO
-         */
-
-        for (i=0; i<15; i++)
-                make_r7780rp_irq(i);
+        for (i = 0; i < 15; i++) {
+                disable_irq_nosync(i);
+                set_irq_chip_and_handler_name(i, &r7780rp_irq_chip,
+                                              handle_level_irq, "level");
+                enable_r7780rp_irq(i);
+        }
 }
diff --git a/arch/sh/boards/renesas/r7780rp/setup.c b/arch/sh/boards/renesas/r7780rp/setup.c
index b941aa0aa34e..c331caeb694b 100644
--- a/arch/sh/boards/renesas/r7780rp/setup.c
+++ b/arch/sh/boards/renesas/r7780rp/setup.c
@@ -13,7 +13,7 @@
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <asm/machvec.h>
-#include <asm/r7780rp/r7780rp.h>
+#include <asm/r7780rp.h>
 #include <asm/clock.h>
 #include <asm/io.h>
 
diff --git a/arch/sh/boards/renesas/rts7751r2d/io.c b/arch/sh/boards/renesas/rts7751r2d/io.c
index 135aa0b5e62d..f2507a804979 100644
--- a/arch/sh/boards/renesas/rts7751r2d/io.c
+++ b/arch/sh/boards/renesas/rts7751r2d/io.c
@@ -11,8 +11,8 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/pci.h>
-#include <asm/rts7751r2d/rts7751r2d.h>
-#include <asm/io.h>
+#include <linux/io.h>
+#include <asm/rts7751r2d.h>
 #include <asm/addrspace.h>
 
 /*
diff --git a/arch/sh/boards/renesas/rts7751r2d/irq.c b/arch/sh/boards/renesas/rts7751r2d/irq.c
index c915e7a3693a..cb0eb20d1b43 100644
--- a/arch/sh/boards/renesas/rts7751r2d/irq.c
+++ b/arch/sh/boards/renesas/rts7751r2d/irq.c
@@ -8,12 +8,10 @@
  * Modified for RTS7751R2D by
  * Atom Create Engineering Co., Ltd. 2002.
  */
-
 #include <linux/init.h>
 #include <linux/irq.h>
-#include <asm/io.h>
-#include <asm/irq.h>
-#include <asm/rts7751r2d/rts7751r2d.h>
+#include <linux/io.h>
+#include <asm/rts7751r2d.h>
 
 #if defined(CONFIG_RTS7751R2D_REV11)
 static int mask_pos[] = {11, 9, 8, 12, 10, 6, 5, 4, 7, 14, 13, 0, 0, 0, 0};
diff --git a/arch/sh/boards/renesas/rts7751r2d/led.c b/arch/sh/boards/renesas/rts7751r2d/led.c
index a7ce66c1e4f0..509f548bdce0 100644
--- a/arch/sh/boards/renesas/rts7751r2d/led.c
+++ b/arch/sh/boards/renesas/rts7751r2d/led.c
@@ -8,13 +8,9 @@
  *
  * This file contains Renesas Technology Sales RTS7751R2D specific LED code.
  */
-
-#include <asm/io.h>
-#include <asm/rts7751r2d/rts7751r2d.h>
-
-#ifdef CONFIG_HEARTBEAT
-
+#include <linux/io.h>
 #include <linux/sched.h>
+#include <asm/rts7751r2d.h>
 
 /* Cycle the LED's in the clasic Knightriger/Sun pattern */
 void heartbeat_rts7751r2d(void)
@@ -46,10 +42,3 @@ void heartbeat_rts7751r2d(void)
         else
                 bit--;
 }
-#endif /* CONFIG_HEARTBEAT */
-
-void rts7751r2d_led(unsigned short value)
-{
-        ctrl_outw(value, PA_OUTPORT);
-}
-
diff --git a/arch/sh/boards/renesas/rts7751r2d/setup.c b/arch/sh/boards/renesas/rts7751r2d/setup.c
index 20597a6e6702..5c042d35ec91 100644
--- a/arch/sh/boards/renesas/rts7751r2d/setup.c
+++ b/arch/sh/boards/renesas/rts7751r2d/setup.c
@@ -12,9 +12,9 @@
 #include <linux/platform_device.h>
 #include <linux/serial_8250.h>
 #include <linux/pm.h>
-#include <asm/io.h>
 #include <asm/machvec.h>
 #include <asm/mach/rts7751r2d.h>
+#include <asm/io.h>
 #include <asm/voyagergx.h>
 
 extern void heartbeat_rts7751r2d(void);
diff --git a/arch/sh/boards/renesas/sh7710voipgw/setup.c b/arch/sh/boards/renesas/sh7710voipgw/setup.c
index e57e7afab8c6..180810b12107 100644
--- a/arch/sh/boards/renesas/sh7710voipgw/setup.c
+++ b/arch/sh/boards/renesas/sh7710voipgw/setup.c
@@ -13,6 +13,51 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 
+static struct ipr_data sh7710voipgw_ipr_map[] = {
+        { TIMER2_IRQ, TIMER2_IPR_ADDR, TIMER2_IPR_POS, TIMER2_PRIORITY },
+        { WDT_IRQ, WDT_IPR_ADDR, WDT_IPR_POS, WDT_PRIORITY },
+
+        /* SCIF0 */
+        { SCIF0_ERI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY },
+        { SCIF0_RXI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY },
+        { SCIF0_BRI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY },
+        { SCIF0_TXI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY },
+
+        /* DMAC-1 */
+        { DMTE0_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE1_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE2_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE3_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+
+        /* DMAC-2 */
+        { DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY },
+        { DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY },
+
+        /* IPSEC */
+        { IPSEC_IRQ, IPSEC_IPR_ADDR, IPSEC_IPR_POS, IPSEC_PRIORITY },
+
+        /* EDMAC */
+        { EDMAC0_IRQ, EDMAC0_IPR_ADDR, EDMAC0_IPR_POS, EDMAC0_PRIORITY },
+        { EDMAC1_IRQ, EDMAC1_IPR_ADDR, EDMAC1_IPR_POS, EDMAC1_PRIORITY },
+        { EDMAC2_IRQ, EDMAC2_IPR_ADDR, EDMAC2_IPR_POS, EDMAC2_PRIORITY },
+
+        /* SIOF0 */
+        { SIOF0_ERI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { SIOF0_TXI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { SIOF0_RXI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { SIOF0_CCI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+
+        /* SIOF1 */
+        { SIOF1_ERI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS, SIOF1_PRIORITY },
+        { SIOF1_TXI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS, SIOF1_PRIORITY },
+        { SIOF1_RXI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS, SIOF1_PRIORITY },
+        { SIOF1_CCI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS, SIOF1_PRIORITY },
+
+        /* SLIC IRQ's */
+        { IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, IRQ1_PRIORITY },
+        { IRQ2_IRQ, IRQ2_IPR_ADDR, IRQ2_IPR_POS, IRQ2_PRIORITY },
+};
+
 /*
  * Initialize IRQ setting
  */
@@ -37,65 +82,7 @@ static void __init sh7710voipgw_init_irq(void)
          */
         ctrl_outw(0x2aa, INTC_ICR1);
 
-        /* Now make IPR interrupts */
-        make_ipr_irq(TIMER2_IRQ, TIMER2_IPR_ADDR,
-                        TIMER2_IPR_POS, TIMER2_PRIORITY);
-        make_ipr_irq(WDT_IRQ, WDT_IPR_ADDR, WDT_IPR_POS, WDT_PRIORITY);
-
-        /* SCIF0 */
-        make_ipr_irq(SCIF0_ERI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS,
-                        SCIF0_PRIORITY);
-        make_ipr_irq(SCIF0_RXI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS,
-                        SCIF0_PRIORITY);
-        make_ipr_irq(SCIF0_BRI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS,
-                        SCIF0_PRIORITY);
-        make_ipr_irq(SCIF0_TXI_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS,
-                        SCIF0_PRIORITY);
-
-        /* DMAC-1 */
-        make_ipr_irq(DMTE0_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-        make_ipr_irq(DMTE1_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-        make_ipr_irq(DMTE2_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-        make_ipr_irq(DMTE3_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-
-        /* DMAC-2 */
-        make_ipr_irq(DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY);
-        make_ipr_irq(DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY);
-
-        /* IPSEC */
-        make_ipr_irq(IPSEC_IRQ, IPSEC_IPR_ADDR, IPSEC_IPR_POS, IPSEC_PRIORITY);
-
-        /* EDMAC */
-        make_ipr_irq(EDMAC0_IRQ, EDMAC0_IPR_ADDR, EDMAC0_IPR_POS,
-                        EDMAC0_PRIORITY);
-        make_ipr_irq(EDMAC1_IRQ, EDMAC1_IPR_ADDR, EDMAC1_IPR_POS,
-                        EDMAC1_PRIORITY);
-        make_ipr_irq(EDMAC2_IRQ, EDMAC2_IPR_ADDR, EDMAC2_IPR_POS,
-                        EDMAC2_PRIORITY);
-
-        /* SIOF0 */
-        make_ipr_irq(SIOF0_ERI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS,
-                        SIOF0_PRIORITY);
-        make_ipr_irq(SIOF0_TXI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS,
-                        SIOF0_PRIORITY);
-        make_ipr_irq(SIOF0_RXI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS,
-                        SIOF0_PRIORITY);
-        make_ipr_irq(SIOF0_CCI_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS,
-                        SIOF0_PRIORITY);
-
-        /* SIOF1 */
-        make_ipr_irq(SIOF1_ERI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS,
-                        SIOF1_PRIORITY);
-        make_ipr_irq(SIOF1_TXI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS,
-                        SIOF1_PRIORITY);
-        make_ipr_irq(SIOF1_RXI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS,
-                        SIOF1_PRIORITY);
-        make_ipr_irq(SIOF1_CCI_IRQ, SIOF1_IPR_ADDR, SIOF1_IPR_POS,
-                        SIOF1_PRIORITY);
-
-        /* SLIC IRQ's */
-        make_ipr_irq(IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, IRQ1_PRIORITY);
-        make_ipr_irq(IRQ2_IRQ, IRQ2_IPR_ADDR, IRQ2_IPR_POS, IRQ2_PRIORITY);
+        make_ipr_irq(sh7710voipgw_ipr_map, ARRAY_SIZE(sh7710voipgw_ipr_map));
 }
 
 /*
diff --git a/arch/sh/boards/se/7300/irq.c b/arch/sh/boards/se/7300/irq.c
index ad1034f98a29..1279d776d60f 100644
--- a/arch/sh/boards/se/7300/irq.c
+++ b/arch/sh/boards/se/7300/irq.c
@@ -13,6 +13,17 @@
 #include <asm/io.h>
 #include <asm/se7300.h>
 
+static struct ipr_data se7300_ipr_map[] = {
+        /* PC_IRQ[0-3] -> IRQ0 (32) */
+        { IRQ0_IRQ, IRQ0_IPR_ADDR, IRQ0_IPR_POS, 0x0f - IRQ0_IRQ },
+        /* A_IRQ[0-3] -> IRQ1 (33) */
+        { IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, 0x0f - IRQ1_IRQ },
+        { SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { VIO_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+};
+
 /*
  * Initialize IRQ setting
  */
@@ -23,14 +34,7 @@ init_7300se_IRQ(void)
         ctrl_outw(0xa000, INTC_ICR1);           /* IRQ mode; IRQ0,1 enable.    */
         ctrl_outw(0x0000, PORT_PFCR);           /* use F for IRQ[3:0] and SIU. */
 
-        /* PC_IRQ[0-3] -> IRQ0 (32) */
-        make_ipr_irq(IRQ0_IRQ, IRQ0_IPR_ADDR, IRQ0_IPR_POS, 0x0f - IRQ0_IRQ);
-        /* A_IRQ[0-3] -> IRQ1 (33) */
-        make_ipr_irq(IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, 0x0f - IRQ1_IRQ);
-        make_ipr_irq(SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY);
-        make_ipr_irq(DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(VIO_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
+        make_ipr_irq(se7300_ipr_map, ARRAY_SIZE(se7300_ipr_map));
 
         ctrl_outw(0x2000, PA_MRSHPC + 0x0c);    /* mrshpc irq enable */
 }
diff --git a/arch/sh/boards/se/73180/irq.c b/arch/sh/boards/se/73180/irq.c
index 2c62b8ea350e..e7200c56bb45 100644
--- a/arch/sh/boards/se/73180/irq.c
+++ b/arch/sh/boards/se/73180/irq.c
@@ -87,13 +87,38 @@ shmse_irq_demux(int irq)
         return irq;
 }
 
+static struct ipr_data se73180_siof0_ipr_map[] = {
+        { SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+};
+static struct ipr_data se73180_vpu_ipr_map[] = {
+        { VPU_IRQ, VPU_IPR_ADDR, VPU_IPR_POS, 8 },
+};
+static struct ipr_data se73180_other_ipr_map[] = {
+        { DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY },
+        { IIC0_ALI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_TACKI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_WAITI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_DTEI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { SIU_IRQ, SIU_IPR_ADDR, SIU_IPR_POS, SIU_PRIORITY },
+
+        /* VIO interrupt */
+        { CEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+        { BEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+        { VEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+
+        { LCDC_IRQ, LCDC_IPR_ADDR, LCDC_IPR_POS, LCDC_PRIORITY },
+};
+
 /*
  * Initialize IRQ setting
  */
 void __init
 init_73180se_IRQ(void)
 {
-        make_ipr_irq(SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY);
+        make_ipr_irq(se73180_siof0_ipr_map, ARRAY_SIZE(se73180_siof0_ipr_map));
 
         ctrl_outw(0x2000, 0xb03fffec);  /* mrshpc irq enable */
         ctrl_outw(0x2000, 0xb07fffec);  /* mrshpc irq enable */
@@ -101,27 +126,11 @@ init_73180se_IRQ(void)
         ctrl_outw(2 << ((7 - 5) * 2), INTC_ICR1);       /* low-level irq */
         make_intreq_irq(10);
 
-        make_ipr_irq(VPU_IRQ, VPU_IPR_ADDR, VPU_IPR_POS, 8);
+        make_ipr_irq(se73180_vpu_ipr_map, ARRAY_SIZE(se73180_vpu_ipr_map));
 
         ctrl_outb(0x0f, INTC_IMCR5);    /* enable SCIF IRQ */
 
-        make_ipr_irq(DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY);
-        make_ipr_irq(IIC0_ALI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY);
-        make_ipr_irq(IIC0_TACKI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS,
-                     IIC0_PRIORITY);
-        make_ipr_irq(IIC0_WAITI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS,
-                     IIC0_PRIORITY);
-        make_ipr_irq(IIC0_DTEI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY);
-        make_ipr_irq(SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY);
-        make_ipr_irq(SIU_IRQ, SIU_IPR_ADDR, SIU_IPR_POS, SIU_PRIORITY);
-
-        /* VIO interrupt */
-        make_ipr_irq(CEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
-        make_ipr_irq(BEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
-        make_ipr_irq(VEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
+        make_ipr_irq(se73180_other_ipr_map, ARRAY_SIZE(se73180_other_ipr_map));
 
-        make_ipr_irq(LCDC_IRQ, LCDC_IPR_ADDR, LCDC_IPR_POS, LCDC_PRIORITY);
         ctrl_outw(0x2000, PA_MRSHPC + 0x0c);    /* mrshpc irq enable */
 }
diff --git a/arch/sh/boards/se/7343/irq.c b/arch/sh/boards/se/7343/irq.c
index 288b62f59419..360153ecc55b 100644
--- a/arch/sh/boards/se/7343/irq.c
+++ b/arch/sh/boards/se/7343/irq.c
@@ -102,6 +102,51 @@ shmse_irq_demux(int irq)
 static struct irqaction irq5 = { no_action, 0, CPU_MASK_NONE, "IRQ5-cascade",
                                 NULL, NULL};
 
+static struct ipr_data se7343_irq5_ipr_map[] = {
+        { IRQ5_IRQ, IRQ5_IPR_ADDR+2, IRQ5_IPR_POS, IRQ5_PRIORITY },
+};
+static struct ipr_data se7343_siof0_vpu_ipr_map[] = {
+        { SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+        { VPU_IRQ, VPU_IPR_ADDR, VPU_IPR_POS, 8 },
+};
+static struct ipr_data se7343_other_ipr_map[] = {
+        { DMTE0_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE1_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY },
+        { DMTE5_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY },
+
+        /* I2C block */
+        { IIC0_ALI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_TACKI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_WAITI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+        { IIC0_DTEI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY },
+
+        { IIC1_ALI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY },
+        { IIC1_TACKI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY },
+        { IIC1_WAITI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY },
+        { IIC1_DTEI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY },
+
+        /* SIOF */
+        { SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY },
+
+        /* SIU */
+        { SIU_IRQ, SIU_IPR_ADDR, SIU_IPR_POS, SIU_PRIORITY },
+
+        /* VIO interrupt */
+        { CEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+        { BEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+        { VEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
+
+        /*MFI interrupt*/
+
+        { MFI_IRQ, MFI_IPR_ADDR, MFI_IPR_POS, MFI_PRIORITY },
+
+        /* LCD controller */
+        { LCDC_IRQ, LCDC_IPR_ADDR, LCDC_IPR_POS, LCDC_PRIORITY },
+};
+
 /*
  * Initialize IRQ setting
  */
@@ -138,54 +183,17 @@ init_7343se_IRQ(void)
         /* Setup all external interrupts to be active low */
         ctrl_outw(0xaaaa, INTC_ICR1);
 
-        make_ipr_irq(IRQ5_IRQ, IRQ5_IPR_ADDR+2, IRQ5_IPR_POS, IRQ5_PRIORITY);
+        make_ipr_irq(se7343_irq5_ipr_map, ARRAY_SIZE(se7343_irq5_ipr_map));
+
         setup_irq(IRQ5_IRQ, &irq5);
         /* Set port control to use IRQ5 */
         *(u16 *)0xA4050108 &= ~0xc;
 
-        make_ipr_irq(SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY);
-        make_ipr_irq(VPU_IRQ, VPU_IPR_ADDR, VPU_IPR_POS, 8);
+        make_ipr_irq(se7343_siof0_vpu_ipr_map, ARRAY_SIZE(se7343_siof0_vpu_ipr_map));
 
         ctrl_outb(0x0f, INTC_IMCR5);    /* enable SCIF IRQ */
 
-        make_ipr_irq(DMTE0_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE1_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE4_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY);
-        make_ipr_irq(DMTE5_IRQ, DMA2_IPR_ADDR, DMA2_IPR_POS, DMA2_PRIORITY);
-
-        /* I2C block */
-        make_ipr_irq(IIC0_ALI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY);
-        make_ipr_irq(IIC0_TACKI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS,
-                     IIC0_PRIORITY);
-        make_ipr_irq(IIC0_WAITI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS,
-                     IIC0_PRIORITY);
-        make_ipr_irq(IIC0_DTEI_IRQ, IIC0_IPR_ADDR, IIC0_IPR_POS, IIC0_PRIORITY);
-
-        make_ipr_irq(IIC1_ALI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY);
-        make_ipr_irq(IIC1_TACKI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS,
-                     IIC1_PRIORITY);
-        make_ipr_irq(IIC1_WAITI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS,
-                     IIC1_PRIORITY);
-        make_ipr_irq(IIC1_DTEI_IRQ, IIC1_IPR_ADDR, IIC1_IPR_POS, IIC1_PRIORITY);
-
-        /* SIOF */
-        make_ipr_irq(SIOF0_IRQ, SIOF0_IPR_ADDR, SIOF0_IPR_POS, SIOF0_PRIORITY);
+        make_ipr_irq(se7343_other_ipr_map, ARRAY_SIZE(se7343_other_ipr_map));
 
-        /* SIU */
-        make_ipr_irq(SIU_IRQ, SIU_IPR_ADDR, SIU_IPR_POS, SIU_PRIORITY);
-
-        /* VIO interrupt */
-        make_ipr_irq(CEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
-        make_ipr_irq(BEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
-        make_ipr_irq(VEU_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
-
-        /*MFI interrupt*/
-
-        make_ipr_irq(MFI_IRQ, MFI_IPR_ADDR, MFI_IPR_POS, MFI_PRIORITY);
-
-        /* LCD controller */
-        make_ipr_irq(LCDC_IRQ, LCDC_IPR_ADDR, LCDC_IPR_POS, LCDC_PRIORITY);
         ctrl_outw(0x2000, PA_MRSHPC + 0x0c);    /* mrshpc irq enable */
 }
diff --git a/arch/sh/boards/se/770x/irq.c b/arch/sh/boards/se/770x/irq.c
index cff6700bbafd..fcd7cd7fa05f 100644
--- a/arch/sh/boards/se/770x/irq.c
+++ b/arch/sh/boards/se/770x/irq.c
@@ -13,6 +13,48 @@
 #include <asm/io.h>
 #include <asm/se.h>
 
+static struct ipr_data se770x_ipr_map[] = {
+#if defined(CONFIG_CPU_SUBTYPE_SH7705)
+        /* This is default value */
+        { 0xf-0x2, BCR_ILCRA, 2, 0x2 },
+        { 0xf-0xa, BCR_ILCRA, 1, 0xa },
+        { 0xf-0x5, BCR_ILCRB, 0, 0x5 },
+        { 0xf-0x8, BCR_ILCRC, 1, 0x8 },
+        { 0xf-0xc, BCR_ILCRC, 0, 0xc },
+        { 0xf-0xe, BCR_ILCRD, 3, 0xe },
+        { 0xf-0x3, BCR_ILCRD, 1, 0x3 }, /* LAN */
+        { 0xf-0xd, BCR_ILCRE, 2, 0xd },
+        { 0xf-0x9, BCR_ILCRE, 1, 0x9 },
+        { 0xf-0x1, BCR_ILCRE, 0, 0x1 },
+        { 0xf-0xf, BCR_ILCRF, 3, 0xf },
+        { 0xf-0xb, BCR_ILCRF, 1, 0xb },
+        { 0xf-0x7, BCR_ILCRG, 3, 0x7 },
+        { 0xf-0x6, BCR_ILCRG, 2, 0x6 },
+        { 0xf-0x4, BCR_ILCRG, 1, 0x4 },
+#else
+        { 14, BCR_ILCRA, 2, 0x0f-14 },
+        { 12, BCR_ILCRA, 1, 0x0f-12 },
+        {  8, BCR_ILCRB, 1, 0x0f- 8 },
+        {  6, BCR_ILCRC, 3, 0x0f- 6 },
+        {  5, BCR_ILCRC, 2, 0x0f- 5 },
+        {  4, BCR_ILCRC, 1, 0x0f- 4 },
+        {  3, BCR_ILCRC, 0, 0x0f- 3 },
+        {  1, BCR_ILCRD, 3, 0x0f- 1 },
+
+        { 10, BCR_ILCRD, 1, 0x0f-10 }, /* LAN */
+
+        {  0, BCR_ILCRE, 3, 0x0f- 0 }, /* PCIRQ3 */
+        { 11, BCR_ILCRE, 2, 0x0f-11 }, /* PCIRQ2 */
+        {  9, BCR_ILCRE, 1, 0x0f- 9 }, /* PCIRQ1 */
+        {  7, BCR_ILCRE, 0, 0x0f- 7 }, /* PCIRQ0 */
+
+        /* #2, #13 are allocated for SLOT IRQ #1 and #2 (for now) */
+        /* NOTE: #2 and #13 are not used on PC */
+        { 13, BCR_ILCRG, 1, 0x0f-13 }, /* SLOTIRQ2 */
+        {  2, BCR_ILCRG, 0, 0x0f- 2 }, /* SLOTIRQ1 */
+#endif
+};
+
 /*
  * Initialize IRQ setting
  */
@@ -38,42 +80,6 @@ void __init init_se_IRQ(void)
         ctrl_outw(0, BCR_ILCRE);
         ctrl_outw(0, BCR_ILCRF);
         ctrl_outw(0, BCR_ILCRG);
-        /* This is default value */
-        make_ipr_irq(0xf-0x2, BCR_ILCRA, 2, 0x2);
-        make_ipr_irq(0xf-0xa, BCR_ILCRA, 1, 0xa);
-        make_ipr_irq(0xf-0x5, BCR_ILCRB, 0, 0x5);
-        make_ipr_irq(0xf-0x8, BCR_ILCRC, 1, 0x8);
-        make_ipr_irq(0xf-0xc, BCR_ILCRC, 0, 0xc);
-        make_ipr_irq(0xf-0xe, BCR_ILCRD, 3, 0xe);
-        make_ipr_irq(0xf-0x3, BCR_ILCRD, 1, 0x3); /* LAN */
-        make_ipr_irq(0xf-0xd, BCR_ILCRE, 2, 0xd);
-        make_ipr_irq(0xf-0x9, BCR_ILCRE, 1, 0x9);
-        make_ipr_irq(0xf-0x1, BCR_ILCRE, 0, 0x1);
-        make_ipr_irq(0xf-0xf, BCR_ILCRF, 3, 0xf);
-        make_ipr_irq(0xf-0xb, BCR_ILCRF, 1, 0xb);
-        make_ipr_irq(0xf-0x7, BCR_ILCRG, 3, 0x7);
-        make_ipr_irq(0xf-0x6, BCR_ILCRG, 2, 0x6);
-        make_ipr_irq(0xf-0x4, BCR_ILCRG, 1, 0x4);
-#else
-        make_ipr_irq(14, BCR_ILCRA, 2, 0x0f-14);
-        make_ipr_irq(12, BCR_ILCRA, 1, 0x0f-12);
-        make_ipr_irq( 8, BCR_ILCRB, 1, 0x0f- 8);
-        make_ipr_irq( 6, BCR_ILCRC, 3, 0x0f- 6);
-        make_ipr_irq( 5, BCR_ILCRC, 2, 0x0f- 5);
-        make_ipr_irq( 4, BCR_ILCRC, 1, 0x0f- 4);
-        make_ipr_irq( 3, BCR_ILCRC, 0, 0x0f- 3);
-        make_ipr_irq( 1, BCR_ILCRD, 3, 0x0f- 1);
-
-        make_ipr_irq(10, BCR_ILCRD, 1, 0x0f-10); /* LAN */
-
-        make_ipr_irq( 0, BCR_ILCRE, 3, 0x0f- 0); /* PCIRQ3 */
-        make_ipr_irq(11, BCR_ILCRE, 2, 0x0f-11); /* PCIRQ2 */
-        make_ipr_irq( 9, BCR_ILCRE, 1, 0x0f- 9); /* PCIRQ1 */
-        make_ipr_irq( 7, BCR_ILCRE, 0, 0x0f- 7); /* PCIRQ0 */
-
-        /* #2, #13 are allocated for SLOT IRQ #1 and #2 (for now) */
-        /* NOTE: #2 and #13 are not used on PC */
-        make_ipr_irq(13, BCR_ILCRG, 1, 0x0f-13); /* SLOTIRQ2 */
-        make_ipr_irq( 2, BCR_ILCRG, 0, 0x0f- 2); /* SLOTIRQ1 */
 #endif
+        make_ipr_irq(se770x_ipr_map, ARRAY_SIZE(se770x_ipr_map));
 }
diff --git a/arch/sh/boards/se/7751/irq.c b/arch/sh/boards/se/7751/irq.c
index c607b0a48479..e4c63a48296c 100644
--- a/arch/sh/boards/se/7751/irq.c
+++ b/arch/sh/boards/se/7751/irq.c
@@ -14,53 +14,50 @@
 #include <asm/irq.h>
 #include <asm/se7751.h>
 
-/*
- * Initialize IRQ setting
- */
-void __init init_7751se_IRQ(void)
-{
-
+static struct ipr_data se7751_ipr_map[] = {
   /* Leave old Solution Engine code in for reference. */
 #if defined(CONFIG_SH_SOLUTION_ENGINE)
-        /*
-         * Super I/O (Just mimic PC):
-         *  1: keyboard
-         *  3: serial 0
-         *  4: serial 1
-         *  5: printer
-         *  6: floppy
-         *  8: rtc
-         * 12: mouse
-         * 14: ide0
-         */
-        make_ipr_irq(14, BCR_ILCRA, 2, 0x0f-14);
-        make_ipr_irq(12, BCR_ILCRA, 1, 0x0f-12);
-        make_ipr_irq( 8, BCR_ILCRB, 1, 0x0f- 8);
-        make_ipr_irq( 6, BCR_ILCRC, 3, 0x0f- 6);
-        make_ipr_irq( 5, BCR_ILCRC, 2, 0x0f- 5);
-        make_ipr_irq( 4, BCR_ILCRC, 1, 0x0f- 4);
-        make_ipr_irq( 3, BCR_ILCRC, 0, 0x0f- 3);
-        make_ipr_irq( 1, BCR_ILCRD, 3, 0x0f- 1);
-
-        make_ipr_irq(10, BCR_ILCRD, 1, 0x0f-10); /* LAN */
-
-        make_ipr_irq( 0, BCR_ILCRE, 3, 0x0f- 0); /* PCIRQ3 */
-        make_ipr_irq(11, BCR_ILCRE, 2, 0x0f-11); /* PCIRQ2 */
-        make_ipr_irq( 9, BCR_ILCRE, 1, 0x0f- 9); /* PCIRQ1 */
-        make_ipr_irq( 7, BCR_ILCRE, 0, 0x0f- 7); /* PCIRQ0 */
-
-        /* #2, #13 are allocated for SLOT IRQ #1 and #2 (for now) */
-        /* NOTE: #2 and #13 are not used on PC */
-        make_ipr_irq(13, BCR_ILCRG, 1, 0x0f-13); /* SLOTIRQ2 */
-        make_ipr_irq( 2, BCR_ILCRG, 0, 0x0f- 2); /* SLOTIRQ1 */
-
+        /*
+         * Super I/O (Just mimic PC):
+         *  1: keyboard
+         *  3: serial 0
+         *  4: serial 1
+         *  5: printer
+         *  6: floppy
+         *  8: rtc
+         * 12: mouse
+         * 14: ide0
+         */
+        { 14, BCR_ILCRA, 2, 0x0f-14 },
+        { 12, BCR_ILCRA, 1, 0x0f-12 },
+        {  8, BCR_ILCRB, 1, 0x0f- 8 },
+        {  6, BCR_ILCRC, 3, 0x0f- 6 },
+        {  5, BCR_ILCRC, 2, 0x0f- 5 },
+        {  4, BCR_ILCRC, 1, 0x0f- 4 },
+        {  3, BCR_ILCRC, 0, 0x0f- 3 },
+        {  1, BCR_ILCRD, 3, 0x0f- 1 },
+
+        { 10, BCR_ILCRD, 1, 0x0f-10 }, /* LAN */
+
+        {  0, BCR_ILCRE, 3, 0x0f- 0 }, /* PCIRQ3 */
+        { 11, BCR_ILCRE, 2, 0x0f-11 }, /* PCIRQ2 */
+        {  9, BCR_ILCRE, 1, 0x0f- 9 }, /* PCIRQ1 */
+        {  7, BCR_ILCRE, 0, 0x0f- 7 }, /* PCIRQ0 */
+
+        /* #2, #13 are allocated for SLOT IRQ #1 and #2 (for now) */
+        /* NOTE: #2 and #13 are not used on PC */
+        { 13, BCR_ILCRG, 1, 0x0f-13 }, /* SLOTIRQ2 */
+        {  2, BCR_ILCRG, 0, 0x0f- 2 }, /* SLOTIRQ1 */
 #elif defined(CONFIG_SH_7751_SOLUTION_ENGINE)
-
-        make_ipr_irq(13, BCR_ILCRD, 3, 2);
-
-        /* Add additional calls to make_ipr_irq() as drivers are added
-         * and tested.
-         */
+        { 13, BCR_ILCRD, 3, 2 },
+        /* Add additional entries here as drivers are added and tested. */
 #endif
+};
 
+/*
+ * Initialize IRQ setting
+ */
+void __init init_7751se_IRQ(void)
+{
+        make_ipr_irq(se7751_ipr_map, ARRAY_SIZE(se7751_ipr_map));
 }
diff --git a/arch/sh/boards/sh03/setup.c b/arch/sh/boards/sh03/setup.c
index 137e2ba9243e..5ad1e19771be 100644
--- a/arch/sh/boards/sh03/setup.c
+++ b/arch/sh/boards/sh03/setup.c
@@ -14,14 +14,17 @@
 #include <asm/sh03/sh03.h>
 #include <asm/addrspace.h>
 
+static struct ipr_data sh03_ipr_map[] = {
+        { IRL0_IRQ, IRL0_IPR_ADDR, IRL0_IPR_POS, IRL0_PRIORITY },
+        { IRL1_IRQ, IRL1_IPR_ADDR, IRL1_IPR_POS, IRL1_PRIORITY },
+        { IRL2_IRQ, IRL2_IPR_ADDR, IRL2_IPR_POS, IRL2_PRIORITY },
+        { IRL3_IRQ, IRL3_IPR_ADDR, IRL3_IPR_POS, IRL3_PRIORITY },
+};
+
 static void __init init_sh03_IRQ(void)
 {
         ctrl_outw(ctrl_inw(INTC_ICR) | INTC_ICR_IRLM, INTC_ICR);
-
-        make_ipr_irq(IRL0_IRQ, IRL0_IPR_ADDR, IRL0_IPR_POS, IRL0_PRIORITY);
-        make_ipr_irq(IRL1_IRQ, IRL1_IPR_ADDR, IRL1_IPR_POS, IRL1_PRIORITY);
-        make_ipr_irq(IRL2_IRQ, IRL2_IPR_ADDR, IRL2_IPR_POS, IRL2_PRIORITY);
-        make_ipr_irq(IRL3_IRQ, IRL3_IPR_ADDR, IRL3_IPR_POS, IRL3_PRIORITY);
+        make_ipr_irq(sh03_ipr_map, ARRAY_SIZE(sh03_ipr_map));
 }
 
 extern void *cf_io_base;
diff --git a/arch/sh/boards/shmin/setup.c b/arch/sh/boards/shmin/setup.c
index 2f0c19706cf9..a31a1d1e2681 100644
--- a/arch/sh/boards/shmin/setup.c
+++ b/arch/sh/boards/shmin/setup.c
@@ -7,7 +7,7 @@
  */
 #include <linux/init.h>
 #include <asm/machvec.h>
-#include <asm/shmin/shmin.h>
+#include <asm/shmin.h>
 #include <asm/clock.h>
 #include <asm/irq.h>
 #include <asm/io.h>
diff --git a/arch/sh/boards/snapgear/setup.c b/arch/sh/boards/snapgear/setup.c
index f5e98c56b530..650fb3645947 100644
--- a/arch/sh/boards/snapgear/setup.c
+++ b/arch/sh/boards/snapgear/setup.c
@@ -33,7 +33,7 @@ extern void pcibios_init(void);
  * EraseConfig handling functions
  */
 
-static irqreturn_t eraseconfig_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t eraseconfig_interrupt(int irq, void *dev_id)
 {
         volatile char dummy __attribute__((unused)) = * (volatile char *) 0xb8000000;
 
@@ -68,6 +68,13 @@ module_init(eraseconfig_init);
  * IRL3 = crypto
  */
 
+static struct ipr_data snapgear_ipr_map[] = {
+        make_ipr_irq(IRL0_IRQ, IRL0_IPR_ADDR, IRL0_IPR_POS, IRL0_PRIORITY);
+        make_ipr_irq(IRL1_IRQ, IRL1_IPR_ADDR, IRL1_IPR_POS, IRL1_PRIORITY);
+        make_ipr_irq(IRL2_IRQ, IRL2_IPR_ADDR, IRL2_IPR_POS, IRL2_PRIORITY);
+        make_ipr_irq(IRL3_IRQ, IRL3_IPR_ADDR, IRL3_IPR_POS, IRL3_PRIORITY);
+};
+
 static void __init init_snapgear_IRQ(void)
 {
         /* enable individual interrupt mode for externals */
@@ -75,10 +82,7 @@ static void __init init_snapgear_IRQ(void)
 
         printk("Setup SnapGear IRQ/IPR ...\n");
 
-        make_ipr_irq(IRL0_IRQ, IRL0_IPR_ADDR, IRL0_IPR_POS, IRL0_PRIORITY);
-        make_ipr_irq(IRL1_IRQ, IRL1_IPR_ADDR, IRL1_IPR_POS, IRL1_PRIORITY);
-        make_ipr_irq(IRL2_IRQ, IRL2_IPR_ADDR, IRL2_IPR_POS, IRL2_PRIORITY);
-        make_ipr_irq(IRL3_IRQ, IRL3_IPR_ADDR, IRL3_IPR_POS, IRL3_PRIORITY);
+        make_ipr_irq(snapgear_ipr_map, ARRAY_SIZE(snapgear_ipr_map));
 }
 
 /*
diff --git a/arch/sh/boards/titan/setup.c b/arch/sh/boards/titan/setup.c
index 52b66d8b8d2a..a6046d93758b 100644
--- a/arch/sh/boards/titan/setup.c
+++ b/arch/sh/boards/titan/setup.c
@@ -9,15 +9,19 @@
 
 extern void __init pcibios_init_platform(void);
 
+static struct ipr_data titan_ipr_map[] = {
+        { TITAN_IRQ_WAN,        IRL0_IPR_ADDR,  IRL0_IPR_POS,   IRL0_PRIORITY },
+        { TITAN_IRQ_LAN,        IRL1_IPR_ADDR,  IRL1_IPR_POS,   IRL1_PRIORITY },
+        { TITAN_IRQ_MPCIA,      IRL2_IPR_ADDR,  IRL2_IPR_POS,   IRL2_PRIORITY },
+        { TITAN_IRQ_USB,        IRL3_IPR_ADDR,  IRL3_IPR_POS,   IRL3_PRIORITY },
+};
+
 static void __init init_titan_irq(void)
 {
         /* enable individual interrupt mode for externals */
         ctrl_outw(ctrl_inw(INTC_ICR) | INTC_ICR_IRLM, INTC_ICR);
 
-        make_ipr_irq( TITAN_IRQ_WAN,   IRL0_IPR_ADDR, IRL0_IPR_POS, IRL0_PRIORITY); /* PCIRQ0 */
-        make_ipr_irq( TITAN_IRQ_LAN,   IRL1_IPR_ADDR, IRL1_IPR_POS, IRL1_PRIORITY); /* PCIRQ1 */
-        make_ipr_irq( TITAN_IRQ_MPCIA, IRL2_IPR_ADDR, IRL2_IPR_POS, IRL2_PRIORITY); /* PCIRQ2 */
-        make_ipr_irq( TITAN_IRQ_USB,   IRL3_IPR_ADDR, IRL3_IPR_POS, IRL3_PRIORITY); /* PCIRQ3 */
+        make_ipr_irq(titan_ipr_map, ARRAY_SIZE(titan_ipr_map));
 }
 
 struct sh_machine_vector mv_titan __initmv = {
diff --git a/arch/sh/cchips/hd6446x/hd64461/setup.c b/arch/sh/cchips/hd6446x/hd64461/setup.c
index 38f1e8171a3a..4d49b5cbcc13 100644
--- a/arch/sh/cchips/hd6446x/hd64461/setup.c
+++ b/arch/sh/cchips/hd6446x/hd64461/setup.c
@@ -71,7 +71,7 @@ static struct hw_interrupt_type hd64461_irq_type = {
         .end            = end_hd64461_irq,
 };
 
-static irqreturn_t hd64461_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t hd64461_interrupt(int irq, void *dev_id)
 {
         printk(KERN_INFO
                "HD64461: spurious interrupt, nirr: 0x%x nimr: 0x%x\n",
diff --git a/arch/sh/cchips/hd6446x/hd64465/gpio.c b/arch/sh/cchips/hd6446x/hd64465/gpio.c
index 72320d02d69a..43431855ec86 100644
--- a/arch/sh/cchips/hd6446x/hd64465/gpio.c
+++ b/arch/sh/cchips/hd6446x/hd64465/gpio.c
@@ -85,7 +85,7 @@ static struct {
     void *dev;
 } handlers[GPIO_NPORTS * 8];
 
-static irqreturn_t hd64465_gpio_interrupt(int irq, void *dev, struct pt_regs *regs)
+static irqreturn_t hd64465_gpio_interrupt(int irq, void *dev)
 {
         unsigned short port, pin, isr, mask, portpin;
         
diff --git a/arch/sh/cchips/hd6446x/hd64465/setup.c b/arch/sh/cchips/hd6446x/hd64465/setup.c
index 30573d3e1966..d126e1f30dee 100644
--- a/arch/sh/cchips/hd6446x/hd64465/setup.c
+++ b/arch/sh/cchips/hd6446x/hd64465/setup.c
@@ -84,7 +84,7 @@ static struct hw_interrupt_type hd64465_irq_type = {
 };
 
 
-static irqreturn_t hd64465_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t hd64465_interrupt(int irq, void *dev_id)
 {
         printk(KERN_INFO
                "HD64465: spurious interrupt, nirr: 0x%x nimr: 0x%x\n",
diff --git a/arch/sh/cchips/voyagergx/irq.c b/arch/sh/cchips/voyagergx/irq.c
index 392c8b12ce36..f7ea700d05ae 100644
--- a/arch/sh/cchips/voyagergx/irq.c
+++ b/arch/sh/cchips/voyagergx/irq.c
@@ -17,29 +17,18 @@
 
     Copyright 2003 (c) Lineo uSolutions,Inc.
 */
-/* -------------------------------------------------------------------- */
-
-#undef DEBUG
-
-#include <linux/sched.h>
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/param.h>
-#include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
-#include <linux/irq.h>
-
-#include <asm/io.h>
-#include <asm/irq.h>
+#include <linux/io.h>
 #include <asm/voyagergx.h>
+#include <asm/rts7751r2d.h>
 
 static void disable_voyagergx_irq(unsigned int irq)
 {
         unsigned long val;
         unsigned long mask = 1 << (irq - VOYAGER_IRQ_BASE);
 
-        pr_debug("disable_voyagergx_irq(%d): mask=%x\n", irq, mask);
+        pr_debug("disable_voyagergx_irq(%d): mask=%lx\n", irq, mask);
         val = inl(VOYAGER_INT_MASK);
         val &= ~mask;
         outl(val, VOYAGER_INT_MASK);
@@ -50,7 +39,7 @@ static void enable_voyagergx_irq(unsigned int irq)
         unsigned long val;
         unsigned long mask = 1 << (irq - VOYAGER_IRQ_BASE);
 
-        pr_debug("disable_voyagergx_irq(%d): mask=%x\n", irq, mask);
+        pr_debug("disable_voyagergx_irq(%d): mask=%lx\n", irq, mask);
         val = inl(VOYAGER_INT_MASK);
         val |= mask;
         outl(val, VOYAGER_INT_MASK);
@@ -88,8 +77,7 @@ static struct hw_interrupt_type voyagergx_irq_type = {
         .end = end_voyagergx_irq,
 };
 
-static irqreturn_t voyagergx_interrupt(int irq, void *dev_id,
-                                      struct pt_regs *regs)
+static irqreturn_t voyagergx_interrupt(int irq, void *dev_id)
 {
         printk(KERN_INFO
                "VoyagerGX: spurious interrupt, status: 0x%x\n",
@@ -138,7 +126,7 @@ int voyagergx_irq_demux(int irq)
                 } else {
                         printk("Unexpected IRQ irq = %d status = 0x%08lx\n", irq, val);
                 }
-                pr_debug("voyagergx_irq_demux %d \n", i);
+                pr_debug("voyagergx_irq_demux %ld\n", i);
 #else
                 for (bit = 1, i = 0 ; i < VOYAGER_IRQ_NUM ; bit <<= 1, i++)
                         if (val & bit)
@@ -186,4 +174,3 @@ void __init setup_voyagergx_irq(void)
 
         setup_irq(IRQ_VOYAGER, &irq0);
 }
-
diff --git a/arch/sh/configs/r7780rp_defconfig b/arch/sh/configs/r7780rp_defconfig
index 2470364948e7..34e2046c3213 100644
--- a/arch/sh/configs/r7780rp_defconfig
+++ b/arch/sh/configs/r7780rp_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18
-# Tue Oct  3 11:32:47 2006
+# Linux kernel version: 2.6.19-rc3
+# Tue Oct 31 12:32:06 2006
 #
 CONFIG_SUPERH=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
@@ -10,6 +10,7 @@ CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_TIME is not set
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
@@ -178,7 +179,7 @@ CONFIG_MMU=y
 CONFIG_PAGE_OFFSET=0x80000000
 CONFIG_MEMORY_START=0x08000000
 CONFIG_MEMORY_SIZE=0x08000000
-CONFIG_32BIT=y
+# CONFIG_32BIT is not set
 CONFIG_VSYSCALL=y
 CONFIG_HUGETLB_PAGE_SIZE_64K=y
 # CONFIG_HUGETLB_PAGE_SIZE_1MB is not set
@@ -229,9 +230,7 @@ CONFIG_SH_PCLK_FREQ=32000000
 #
 # DMA support
 #
-CONFIG_SH_DMA=y
-CONFIG_NR_ONCHIP_DMA_CHANNELS=6
-# CONFIG_NR_DMA_CHANNELS_BOOL is not set
+# CONFIG_SH_DMA is not set
 
 #
 # Companion Chips
@@ -259,7 +258,7 @@ CONFIG_ZERO_PAGE_OFFSET=0x00001000
 CONFIG_BOOT_LINK_OFFSET=0x00800000
 # CONFIG_UBC_WAKEUP is not set
 CONFIG_CMDLINE_BOOL=y
-CONFIG_CMDLINE="mem=128M console=ttySC0,115200 root=/dev/hda1"
+CONFIG_CMDLINE="mem=128M console=ttySC0,115200 root=/dev/sda1"
 
 #
 # Bus options
@@ -336,6 +335,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -441,76 +441,28 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
-CONFIG_IDE=m
-CONFIG_IDE_MAX_HWIFS=4
-CONFIG_BLK_DEV_IDE=m
-
-#
-# Please see Documentation/ide.txt for help/info on IDE drives
-#
-CONFIG_BLK_DEV_IDE_SATA=y
-CONFIG_BLK_DEV_IDEDISK=m
-CONFIG_IDEDISK_MULTI_MODE=y
-# CONFIG_BLK_DEV_IDECD is not set
-# CONFIG_BLK_DEV_IDETAPE is not set
-# CONFIG_BLK_DEV_IDEFLOPPY is not set
-CONFIG_BLK_DEV_IDESCSI=m
-# CONFIG_IDE_TASK_IOCTL is not set
-
-#
-# IDE chipset support/bugfixes
-#
-CONFIG_IDE_GENERIC=m
-CONFIG_BLK_DEV_IDEPCI=y
-CONFIG_IDEPCI_SHARE_IRQ=y
-# CONFIG_BLK_DEV_OFFBOARD is not set
-CONFIG_BLK_DEV_GENERIC=m
-# CONFIG_BLK_DEV_OPTI621 is not set
-CONFIG_BLK_DEV_IDEDMA_PCI=y
-# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
-CONFIG_IDEDMA_PCI_AUTO=y
-# CONFIG_IDEDMA_ONLYDISK is not set
-CONFIG_BLK_DEV_AEC62XX=m
-# CONFIG_BLK_DEV_ALI15X3 is not set
-# CONFIG_BLK_DEV_AMD74XX is not set
-# CONFIG_BLK_DEV_CMD64X is not set
-# CONFIG_BLK_DEV_TRIFLEX is not set
-# CONFIG_BLK_DEV_CY82C693 is not set
-# CONFIG_BLK_DEV_CS5520 is not set
-# CONFIG_BLK_DEV_CS5530 is not set
-# CONFIG_BLK_DEV_HPT34X is not set
-# CONFIG_BLK_DEV_HPT366 is not set
-# CONFIG_BLK_DEV_SC1200 is not set
-# CONFIG_BLK_DEV_PIIX is not set
-# CONFIG_BLK_DEV_IT821X is not set
-# CONFIG_BLK_DEV_NS87415 is not set
-# CONFIG_BLK_DEV_PDC202XX_OLD is not set
-CONFIG_BLK_DEV_PDC202XX_NEW=m
-# CONFIG_BLK_DEV_SVWKS is not set
-CONFIG_BLK_DEV_SIIMAGE=m
-# CONFIG_BLK_DEV_SLC90E66 is not set
-# CONFIG_BLK_DEV_TRM290 is not set
-# CONFIG_BLK_DEV_VIA82CXXX is not set
-# CONFIG_IDE_ARM is not set
-CONFIG_BLK_DEV_IDEDMA=y
-# CONFIG_IDEDMA_IVB is not set
-CONFIG_IDEDMA_AUTO=y
-# CONFIG_BLK_DEV_HD is not set
+# CONFIG_IDE is not set
 
 #
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
-CONFIG_SCSI=m
+CONFIG_SCSI=y
 # CONFIG_SCSI_NETLINK is not set
 CONFIG_SCSI_PROC_FS=y
 
 #
 # SCSI support type (disk, tape, CD-ROM)
 #
-CONFIG_BLK_DEV_SD=m
+CONFIG_BLK_DEV_SD=y
 # CONFIG_CHR_DEV_ST is not set
 # CONFIG_CHR_DEV_OSST is not set
 # CONFIG_BLK_DEV_SR is not set
@@ -561,6 +513,7 @@ CONFIG_CHR_DEV_SG=m
 # CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -570,7 +523,55 @@ CONFIG_CHR_DEV_SG=m
 #
 # Serial ATA (prod) and Parallel ATA (experimental) drivers
 #
-# CONFIG_ATA is not set
+CONFIG_ATA=y
+# CONFIG_SATA_AHCI is not set
+# CONFIG_SATA_SVW is not set
+# CONFIG_ATA_PIIX is not set
+# CONFIG_SATA_MV is not set
+# CONFIG_SATA_NV is not set
+# CONFIG_PDC_ADMA is not set
+# CONFIG_SATA_QSTOR is not set
+# CONFIG_SATA_PROMISE is not set
+# CONFIG_SATA_SX4 is not set
+CONFIG_SATA_SIL=y
+# CONFIG_SATA_SIL24 is not set
+# CONFIG_SATA_SIS is not set
+# CONFIG_SATA_ULI is not set
+# CONFIG_SATA_VIA is not set
+# CONFIG_SATA_VITESSE is not set
+# CONFIG_PATA_ALI is not set
+# CONFIG_PATA_AMD is not set
+# CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATIIXP is not set
+# CONFIG_PATA_CMD64X is not set
+# CONFIG_PATA_CS5520 is not set
+# CONFIG_PATA_CS5530 is not set
+# CONFIG_PATA_CYPRESS is not set
+# CONFIG_PATA_EFAR is not set
+# CONFIG_ATA_GENERIC is not set
+# CONFIG_PATA_HPT366 is not set
+# CONFIG_PATA_HPT37X is not set
+# CONFIG_PATA_HPT3X2N is not set
+# CONFIG_PATA_HPT3X3 is not set
+# CONFIG_PATA_IT821X is not set
+# CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_TRIFLEX is not set
+# CONFIG_PATA_MPIIX is not set
+# CONFIG_PATA_OLDPIIX is not set
+# CONFIG_PATA_NETCELL is not set
+# CONFIG_PATA_NS87410 is not set
+# CONFIG_PATA_OPTI is not set
+# CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC_OLD is not set
+# CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RZ1000 is not set
+# CONFIG_PATA_SC1200 is not set
+# CONFIG_PATA_SERVERWORKS is not set
+# CONFIG_PATA_PDC2027X is not set
+# CONFIG_PATA_SIL680 is not set
+# CONFIG_PATA_SIS is not set
+# CONFIG_PATA_VIA is not set
+# CONFIG_PATA_WINBOND is not set
 
 #
 # Multi-device support (RAID and LVM)
@@ -840,7 +841,6 @@ CONFIG_HW_RANDOM=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -856,6 +856,7 @@ CONFIG_HW_RANDOM=y
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -868,14 +869,9 @@ CONFIG_HWMON=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -959,7 +955,29 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 #
 # Real Time Clock
 #
-# CONFIG_RTC_CLASS is not set
+CONFIG_RTC_LIB=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_HCTOSYS=y
+CONFIG_RTC_HCTOSYS_DEVICE="rtc0"
+# CONFIG_RTC_DEBUG is not set
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=y
+CONFIG_RTC_INTF_PROC=y
+CONFIG_RTC_INTF_DEV=y
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+
+#
+# RTC drivers
+#
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+CONFIG_RTC_DRV_SH=y
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_V3020 is not set
 
 #
 # DMA Engine support
@@ -984,6 +1002,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 # CONFIG_EXT3_FS_POSIX_ACL is not set
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -991,6 +1010,7 @@ CONFIG_FS_MBCACHE=y
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 CONFIG_MINIX_FS=y
 # CONFIG_ROMFS_FS is not set
@@ -1027,7 +1047,8 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
+CONFIG_TMPFS=y
+# CONFIG_TMPFS_POSIX_ACL is not set
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 CONFIG_RAMFS=y
@@ -1159,6 +1180,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_LIST is not set
 CONFIG_FRAME_POINTER=y
 CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_SH_STANDARD_BIOS is not set
 # CONFIG_EARLY_SCIF_CONSOLE is not set
@@ -1178,9 +1200,9 @@ CONFIG_FORCED_INLINING=y
 #
 CONFIG_CRYPTO=y
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_BLKCIPHER=m
+CONFIG_CRYPTO_BLKCIPHER=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_MANAGER=m
+CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_HMAC=y
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_MD4 is not set
@@ -1191,7 +1213,7 @@ CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_WP512 is not set
 # CONFIG_CRYPTO_TGR192 is not set
 CONFIG_CRYPTO_ECB=m
-CONFIG_CRYPTO_CBC=m
+CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_DES=y
 # CONFIG_CRYPTO_BLOWFISH is not set
 # CONFIG_CRYPTO_TWOFISH is not set
diff --git a/arch/sh/configs/titan_defconfig b/arch/sh/configs/titan_defconfig
index 5e8175461138..41049cf14b79 100644
--- a/arch/sh/configs/titan_defconfig
+++ b/arch/sh/configs/titan_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.18
-# Tue Oct  3 12:59:14 2006
+# Linux kernel version: 2.6.19-rc3
+# Mon Oct 30 18:04:49 2006
 #
 CONFIG_SUPERH=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
@@ -10,6 +10,7 @@ CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
+# CONFIG_GENERIC_TIME is not set
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
 #
@@ -23,7 +24,7 @@ CONFIG_INIT_ENV_ARG_LIMIT=32
 # General setup
 #
 CONFIG_LOCALVERSION=""
-CONFIG_LOCALVERSION_AUTO=y
+# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 # CONFIG_IPC_NS is not set
@@ -236,8 +237,8 @@ CONFIG_HZ_250=y
 CONFIG_HZ=250
 # CONFIG_KEXEC is not set
 # CONFIG_SMP is not set
-CONFIG_PREEMPT_NONE=y
-# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT_NONE is not set
+CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
 
 #
@@ -247,7 +248,7 @@ CONFIG_ZERO_PAGE_OFFSET=0x00001000
 CONFIG_BOOT_LINK_OFFSET=0x009e0000
 # CONFIG_UBC_WAKEUP is not set
 CONFIG_CMDLINE_BOOL=y
-CONFIG_CMDLINE="console=ttySC1,38400N81 root=/dev/nfs ip=:::::eth1:autoconf"
+CONFIG_CMDLINE="console=ttySC1,38400N81 root=/dev/nfs ip=:::::eth1:autoconf rw"
 
 #
 # Bus options
@@ -334,6 +335,7 @@ CONFIG_INET_XFRM_TUNNEL=y
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_XFRM_MODE_TRANSPORT=y
 CONFIG_INET_XFRM_MODE_TUNNEL=y
+CONFIG_INET_XFRM_MODE_BEET=y
 CONFIG_INET_DIAG=m
 CONFIG_INET_TCP_DIAG=m
 # CONFIG_TCP_CONG_ADVANCED is not set
@@ -355,9 +357,10 @@ CONFIG_INET6_XFRM_TUNNEL=y
 CONFIG_INET6_TUNNEL=y
 CONFIG_INET6_XFRM_MODE_TRANSPORT=y
 CONFIG_INET6_XFRM_MODE_TUNNEL=y
+CONFIG_INET6_XFRM_MODE_BEET=y
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=m
 CONFIG_IPV6_TUNNEL=y
-# CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_NETWORK_SECMARK is not set
 CONFIG_NETFILTER=y
@@ -714,6 +717,12 @@ CONFIG_BLK_DEV_INITRD=y
 CONFIG_ATA_OVER_ETH=m
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 # CONFIG_IDE is not set
@@ -778,9 +787,9 @@ CONFIG_CHR_DEV_SG=m
 # CONFIG_SCSI_INIA100 is not set
 # CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
-# CONFIG_SCSI_IPR is not set
 # CONFIG_SCSI_QLOGIC_1280 is not set
 # CONFIG_SCSI_QLA_FC is not set
+# CONFIG_SCSI_QLA_ISCSI is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -1095,7 +1104,6 @@ CONFIG_HW_RANDOM=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -1124,14 +1132,9 @@ CONFIG_HWMON=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
-# Misc devices
-#
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
-CONFIG_VIDEO_V4L2=y
 
 #
 # Digital Video Broadcasting Devices
@@ -1177,9 +1180,9 @@ CONFIG_USB_DEVICEFS=y
 # USB Host Controller Drivers
 #
 CONFIG_USB_EHCI_HCD=y
-# CONFIG_USB_EHCI_SPLIT_ISO is not set
-# CONFIG_USB_EHCI_ROOT_HUB_TT is not set
-# CONFIG_USB_EHCI_TT_NEWSCHED is not set
+CONFIG_USB_EHCI_SPLIT_ISO=y
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_TT_NEWSCHED=y
 # CONFIG_USB_ISP116X_HCD is not set
 CONFIG_USB_OHCI_HCD=y
 # CONFIG_USB_OHCI_BIG_ENDIAN is not set
@@ -1235,7 +1238,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
-# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -1246,11 +1248,20 @@ CONFIG_USB_STORAGE=y
 #
 # USB Network Adapters
 #
-# CONFIG_USB_CATC is not set
-# CONFIG_USB_KAWETH is not set
-# CONFIG_USB_PEGASUS is not set
-# CONFIG_USB_RTL8150 is not set
-# CONFIG_USB_USBNET is not set
+CONFIG_USB_CATC=m
+CONFIG_USB_KAWETH=m
+CONFIG_USB_PEGASUS=m
+CONFIG_USB_RTL8150=m
+CONFIG_USB_USBNET=m
+CONFIG_USB_NET_AX8817X=m
+CONFIG_USB_NET_CDCETHER=m
+# CONFIG_USB_NET_GL620A is not set
+CONFIG_USB_NET_NET1080=m
+CONFIG_USB_NET_PLUSB=m
+# CONFIG_USB_NET_MCS7830 is not set
+# CONFIG_USB_NET_RNDIS_HOST is not set
+# CONFIG_USB_NET_CDC_SUBSET is not set
+CONFIG_USB_NET_ZAURUS=m
 CONFIG_USB_MON=y
 
 #
@@ -1285,6 +1296,7 @@ CONFIG_USB_SERIAL_ARK3116=m
 # CONFIG_USB_SERIAL_KLSI is not set
 # CONFIG_USB_SERIAL_KOBIL_SCT is not set
 # CONFIG_USB_SERIAL_MCT_U232 is not set
+# CONFIG_USB_SERIAL_MOS7720 is not set
 # CONFIG_USB_SERIAL_MOS7840 is not set
 # CONFIG_USB_SERIAL_NAVMAN is not set
 CONFIG_USB_SERIAL_PL2303=m
@@ -1316,6 +1328,7 @@ CONFIG_USB_SERIAL_PL2303=m
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1357,7 +1370,26 @@ CONFIG_USB_SERIAL_PL2303=m
 #
 # Real Time Clock
 #
-# CONFIG_RTC_CLASS is not set
+CONFIG_RTC_LIB=m
+CONFIG_RTC_CLASS=m
+
+#
+# RTC interfaces
+#
+CONFIG_RTC_INTF_SYSFS=m
+CONFIG_RTC_INTF_PROC=m
+CONFIG_RTC_INTF_DEV=m
+# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set
+
+#
+# RTC drivers
+#
+# CONFIG_RTC_DRV_DS1553 is not set
+# CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_M48T86 is not set
+CONFIG_RTC_DRV_SH=m
+# CONFIG_RTC_DRV_TEST is not set
+# CONFIG_RTC_DRV_V3020 is not set
 
 #
 # DMA Engine support
@@ -1380,8 +1412,12 @@ CONFIG_EXT2_FS=y
 # CONFIG_EXT2_FS_XIP is not set
 CONFIG_EXT3_FS=y
 # CONFIG_EXT3_FS_XATTR is not set
+CONFIG_EXT4DEV_FS=m
+# CONFIG_EXT4DEV_FS_XATTR is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
+CONFIG_JBD2=m
+# CONFIG_JBD2_DEBUG is not set
 CONFIG_REISERFS_FS=m
 # CONFIG_REISERFS_CHECK is not set
 # CONFIG_REISERFS_PROC_INFO is not set
@@ -1393,9 +1429,10 @@ CONFIG_XFS_FS=m
 # CONFIG_XFS_SECURITY is not set
 # CONFIG_XFS_POSIX_ACL is not set
 # CONFIG_XFS_RT is not set
+# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_MINIX_FS is not set
-# CONFIG_ROMFS_FS is not set
+CONFIG_ROMFS_FS=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
@@ -1480,7 +1517,12 @@ CONFIG_SUNRPC=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
-# CONFIG_CIFS is not set
+CONFIG_CIFS=m
+# CONFIG_CIFS_STATS is not set
+CONFIG_CIFS_WEAK_PW_HASH=y
+# CONFIG_CIFS_XATTR is not set
+# CONFIG_CIFS_DEBUG2 is not set
+# CONFIG_CIFS_EXPERIMENTAL is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
@@ -1583,9 +1625,10 @@ CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_FORCED_INLINING is not set
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_SH_STANDARD_BIOS is not set
-CONFIG_EARLY_SCIF_CONSOLE=y
+# CONFIG_EARLY_SCIF_CONSOLE is not set
 # CONFIG_EARLY_PRINTK is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
@@ -1605,7 +1648,7 @@ CONFIG_CRYPTO=y
 CONFIG_CRYPTO_ALGAPI=y
 CONFIG_CRYPTO_BLKCIPHER=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_MANAGER=m
+CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_MD4=m
@@ -1615,7 +1658,7 @@ CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
 CONFIG_CRYPTO_WP512=m
 CONFIG_CRYPTO_TGR192=m
-CONFIG_CRYPTO_ECB=m
+CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_BLOWFISH=m
diff --git a/arch/sh/drivers/dma/dma-g2.c b/arch/sh/drivers/dma/dma-g2.c
index 9cb070924180..0caf11bb7e27 100644
--- a/arch/sh/drivers/dma/dma-g2.c
+++ b/arch/sh/drivers/dma/dma-g2.c
@@ -51,7 +51,7 @@ static volatile struct g2_dma_info *g2_dma = (volatile struct g2_dma_info *)0xa0
         ((g2_dma->channel[i].size - \
           g2_dma->status[i].size) & 0x0fffffff)
 
-static irqreturn_t g2_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t g2_dma_interrupt(int irq, void *dev_id)
 {
         int i;
 
diff --git a/arch/sh/drivers/dma/dma-pvr2.c b/arch/sh/drivers/dma/dma-pvr2.c
index c1b6bc23c107..838fad566eaf 100644
--- a/arch/sh/drivers/dma/dma-pvr2.c
+++ b/arch/sh/drivers/dma/dma-pvr2.c
@@ -21,7 +21,7 @@
 static unsigned int xfer_complete;
 static int count;
 
-static irqreturn_t pvr2_dma_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t pvr2_dma_interrupt(int irq, void *dev_id)
 {
         if (get_dma_residue(PVR2_CASCADE_CHAN)) {
                 printk(KERN_WARNING "DMA: SH DMAC did not complete transfer "
diff --git a/arch/sh/drivers/dma/dma-sh.c b/arch/sh/drivers/dma/dma-sh.c
index cbbe8bce3d67..660786013350 100644
--- a/arch/sh/drivers/dma/dma-sh.c
+++ b/arch/sh/drivers/dma/dma-sh.c
@@ -19,23 +19,34 @@
 #include <asm/io.h>
 #include "dma-sh.h"
 
-static inline unsigned int get_dmte_irq(unsigned int chan)
-{
-        unsigned int irq = 0;
 
+
+#ifdef CONFIG_CPU_SH4
+static struct ipr_data dmae_ipr_map[] = {
+        { DMAE_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+};
+#endif
+static struct ipr_data dmte_ipr_map[] = {
         /*
          * Normally we could just do DMTE0_IRQ + chan outright, though in the
          * case of the 7751R, the DMTE IRQs for channels > 4 start right above
          * the SCIF
          */
-        if (chan < 4) {
-                irq = DMTE0_IRQ + chan;
-        } else {
-#ifdef DMTE4_IRQ
-                irq = DMTE4_IRQ + chan - 4;
-#endif
-        }
+        { DMTE0_IRQ + 0, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE0_IRQ + 1, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE0_IRQ + 2, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE0_IRQ + 3, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE4_IRQ + 0, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE4_IRQ + 1, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE4_IRQ + 2, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+        { DMTE4_IRQ + 3, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY },
+};
 
+static inline unsigned int get_dmte_irq(unsigned int chan)
+{
+        unsigned int irq = 0;
+        if (chan < ARRAY_SIZE(dmte_ipr_map))
+                irq = dmte_ipr_map[chan].irq;
         return irq;
 }
 
@@ -60,9 +71,9 @@ static inline unsigned int calc_xmit_shift(struct dma_channel *chan)
  * Besides that it needs to waken any waiting process, which should handle
  * setting up the next transfer.
  */
-static irqreturn_t dma_tei(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t dma_tei(int irq, void *dev_id)
 {
-        struct dma_channel *chan = (struct dma_channel *)dev_id;
+        struct dma_channel *chan = dev_id;
         u32 chcr;
 
         chcr = ctrl_inl(CHCR[chan->chan]);
@@ -228,7 +239,7 @@ static inline int dmaor_reset(void)
 }
 
 #if defined(CONFIG_CPU_SH4)
-static irqreturn_t dma_err(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t dma_err(int irq, void *dummy)
 {
         dmaor_reset();
         disable_irq(irq);
@@ -258,17 +269,16 @@ static int __init sh_dmac_init(void)
         int i;
 
 #ifdef CONFIG_CPU_SH4
-        make_ipr_irq(DMAE_IRQ, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
+        make_ipr_irq(dmae_ipr_map, ARRAY_SIZE(dmae_ipr_map));
         i = request_irq(DMAE_IRQ, dma_err, IRQF_DISABLED, "DMAC Address Error", 0);
         if (unlikely(i < 0))
                 return i;
 #endif
 
-        for (i = 0; i < info->nr_channels; i++) {
-                int irq = get_dmte_irq(i);
-
-                make_ipr_irq(irq, DMA_IPR_ADDR, DMA_IPR_POS, DMA_PRIORITY);
-        }
+        i = info->nr_channels;
+        if (i > ARRAY_SIZE(dmte_ipr_map))
+                i = ARRAY_SIZE(dmte_ipr_map);
+        make_ipr_irq(dmte_ipr_map, i);
 
         /*
          * Initialize DMAOR, and clean up any error flags that may have
diff --git a/arch/sh/drivers/pci/ops-r7780rp.c b/arch/sh/drivers/pci/ops-r7780rp.c
index 6e3ba9c65b40..eeea1577e112 100644
--- a/arch/sh/drivers/pci/ops-r7780rp.c
+++ b/arch/sh/drivers/pci/ops-r7780rp.c
@@ -13,7 +13,7 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
-#include <asm/r7780rp/r7780rp.h>
+#include <asm/r7780rp.h>
 #include <asm/io.h>
 #include "pci-sh4.h"
 
diff --git a/arch/sh/drivers/pci/ops-rts7751r2d.c b/arch/sh/drivers/pci/ops-rts7751r2d.c
index b68824c8b81e..4a518d948049 100644
--- a/arch/sh/drivers/pci/ops-rts7751r2d.c
+++ b/arch/sh/drivers/pci/ops-rts7751r2d.c
@@ -10,28 +10,24 @@
  *
  * PCI initialization for the Renesas SH7751R RTS7751R2D board
  */
-
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/init.h>
-#include <linux/delay.h>
 #include <linux/pci.h>
-#include <linux/module.h>
-#include <asm/rts7751r2d/rts7751r2d.h>
-#include <asm/io.h>
+#include <linux/io.h>
+#include <asm/rts7751r2d.h>
 #include "pci-sh4.h"
 
+static u8 rts7751r2d_irq_tab[] __initdata = {
+        IRQ_PCISLOT1,
+        IRQ_PCISLOT2,
+        IRQ_PCMCIA,
+        IRQ_PCIETH,
+};
+
 int __init pcibios_map_platform_irq(struct pci_dev *pdev, u8 slot, u8 pin)
 {
-        switch (slot) {
-        case 0: return IRQ_PCISLOT1;    /* PCI Extend slot #1 */
-        case 1: return IRQ_PCISLOT2;    /* PCI Extend slot #2 */
-        case 2: return IRQ_PCMCIA;      /* PCI Cardbus Bridge */
-        case 3: return IRQ_PCIETH;      /* Realtek Ethernet controller */
-        default:
-                printk("PCI: Bad IRQ mapping request for slot %d\n", slot);
-                return -1;
-        }
+        return rts7751r2d_irq_tab[slot];
 }
 
 static struct resource sh7751_io_resource = {
diff --git a/arch/sh/drivers/pci/pci-sh7751.c b/arch/sh/drivers/pci/pci-sh7751.c
index dbe837884983..85e1ee2e2e7b 100644
--- a/arch/sh/drivers/pci/pci-sh7751.c
+++ b/arch/sh/drivers/pci/pci-sh7751.c
@@ -155,7 +155,7 @@ int __init sh7751_pcic_init(struct sh4_pci_address_map *map)
          */
         pr_debug("PCI: Mapping IO address 0x%x - 0x%x to base 0x%x\n",
                  PCIBIOS_MIN_IO, (64 << 10),
-                 SH4_PCI_IO_BASE + PCIBIOS_MIN_IO);
+                 SH7751_PCI_IO_BASE + PCIBIOS_MIN_IO);
 
         /*
          * XXX: For now, leave this board-specific. In the event we have other
@@ -163,7 +163,7 @@ int __init sh7751_pcic_init(struct sh4_pci_address_map *map)
          */
 #ifdef CONFIG_SH_BIGSUR
         bigsur_port_map(PCIBIOS_MIN_IO, (64 << 10),
-                        SH4_PCI_IO_BASE + PCIBIOS_MIN_IO, 0);
+                        SH7751_PCI_IO_BASE + PCIBIOS_MIN_IO, 0);
 #endif
 
         /* Make sure the MSB's of IO window are set to access PCI space
diff --git a/arch/sh/drivers/pci/pci-st40.c b/arch/sh/drivers/pci/pci-st40.c
index 4ab5ea6b35fb..efecb3d5995c 100644
--- a/arch/sh/drivers/pci/pci-st40.c
+++ b/arch/sh/drivers/pci/pci-st40.c
@@ -161,7 +161,7 @@ static char * pci_commands[16]={
         "Memory Write-and-Invalidate"
 };
 
-static irqreturn_t st40_pci_irq(int irq, void *dev_instance, struct pt_regs *regs)
+static irqreturn_t st40_pci_irq(int irq, void *dev_instance)
 {
         unsigned pci_int, pci_air, pci_cir, pci_aint;
         static int count=0;
diff --git a/arch/sh/kernel/cpu/irq/intc2.c b/arch/sh/kernel/cpu/irq/intc2.c
index e30e4b7aa70e..74ca576a7ce5 100644
--- a/arch/sh/kernel/cpu/irq/intc2.c
+++ b/arch/sh/kernel/cpu/irq/intc2.c
@@ -10,93 +10,31 @@
  * These are the "new Hitachi style" interrupts, as present on the
  * Hitachi 7751, the STM ST40 STB1, SH7760, and SH7780.
  */
-
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/irq.h>
+#include <linux/io.h>
 #include <asm/system.h>
-#include <asm/io.h>
-#include <asm/machvec.h>
-
-struct intc2_data {
-        unsigned char msk_offset;
-        unsigned char msk_shift;
-
-        int (*clear_irq) (int);
-};
-
-static struct intc2_data intc2_data[NR_INTC2_IRQS];
-
-static void enable_intc2_irq(unsigned int irq);
-static void disable_intc2_irq(unsigned int irq);
-
-/* shutdown is same as "disable" */
-#define shutdown_intc2_irq disable_intc2_irq
-
-static void mask_and_ack_intc2(unsigned int);
-static void end_intc2_irq(unsigned int irq);
-
-static unsigned int startup_intc2_irq(unsigned int irq)
-{
-        enable_intc2_irq(irq);
-        return 0; /* never anything pending */
-}
-
-static struct hw_interrupt_type intc2_irq_type = {
-        .typename       = "INTC2-IRQ",
-        .startup        = startup_intc2_irq,
-        .shutdown       = shutdown_intc2_irq,
-        .enable         = enable_intc2_irq,
-        .disable        = disable_intc2_irq,
-        .ack            = mask_and_ack_intc2,
-        .end            = end_intc2_irq
-};
 
 static void disable_intc2_irq(unsigned int irq)
 {
-        int irq_offset = irq - INTC2_FIRST_IRQ;
-        int msk_shift, msk_offset;
-
-        /* Sanity check */
-        if (unlikely(irq_offset < 0 || irq_offset >= NR_INTC2_IRQS))
-                return;
-
-        msk_shift = intc2_data[irq_offset].msk_shift;
-        msk_offset = intc2_data[irq_offset].msk_offset;
-
-        ctrl_outl(1 << msk_shift,
-                  INTC2_BASE + INTC2_INTMSK_OFFSET + msk_offset);
+        struct intc2_data *p = get_irq_chip_data(irq);
+        ctrl_outl(1 << p->msk_shift,
+                  INTC2_BASE + INTC2_INTMSK_OFFSET + p->msk_offset);
 }
 
 static void enable_intc2_irq(unsigned int irq)
 {
-        int irq_offset = irq - INTC2_FIRST_IRQ;
-        int msk_shift, msk_offset;
-
-        /* Sanity check */
-        if (unlikely(irq_offset < 0 || irq_offset >= NR_INTC2_IRQS))
-                return;
-
-        msk_shift = intc2_data[irq_offset].msk_shift;
-        msk_offset = intc2_data[irq_offset].msk_offset;
-
-        ctrl_outl(1 << msk_shift,
-                  INTC2_BASE + INTC2_INTMSKCLR_OFFSET + msk_offset);
+        struct intc2_data *p = get_irq_chip_data(irq);
+        ctrl_outl(1 << p->msk_shift,
+                  INTC2_BASE + INTC2_INTMSKCLR_OFFSET + p->msk_offset);
 }
 
-static void mask_and_ack_intc2(unsigned int irq)
-{
-        disable_intc2_irq(irq);
-}
-
-static void end_intc2_irq(unsigned int irq)
-{
-        if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
-                enable_intc2_irq(irq);
-
-        if (unlikely(intc2_data[irq - INTC2_FIRST_IRQ].clear_irq))
-                intc2_data[irq - INTC2_FIRST_IRQ].clear_irq(irq);
-}
+static struct irq_chip intc2_irq_chip = {
+        .name           = "INTC2",
+        .mask           = disable_intc2_irq,
+        .unmask         = enable_intc2_irq,
+        .mask_ack       = disable_intc2_irq,
+};
 
 /*
  * Setup an INTC2 style interrupt.
@@ -106,179 +44,36 @@ static void end_intc2_irq(unsigned int irq)
  *    PIO1 which is INTPRI00[19,16] and INTMSK00[13]
  * would be:               ^     ^             ^  ^
  *                         |     |             |  |
- *    make_intc2_irq(84,   0,   16,            0, 13);
+ *     { 84,               0,   16,            0, 13 },
+ *
+ * in the intc2_data table.
  */
-void make_intc2_irq(unsigned int irq,
-                    unsigned int ipr_offset, unsigned int ipr_shift,
-                    unsigned int msk_offset, unsigned int msk_shift,
-                    unsigned int priority)
+void make_intc2_irq(struct intc2_data *table, unsigned int nr_irqs)
 {
-        int irq_offset = irq - INTC2_FIRST_IRQ;
-        unsigned int flags;
-        unsigned long ipr;
-
-        if (unlikely(irq_offset < 0 || irq_offset >= NR_INTC2_IRQS))
-                return;
-
-        disable_irq_nosync(irq);
-
-        /* Fill the data we need */
-        intc2_data[irq_offset].msk_offset = msk_offset;
-        intc2_data[irq_offset].msk_shift  = msk_shift;
-        intc2_data[irq_offset].clear_irq = NULL;
-
-        /* Set the priority level */
-        local_irq_save(flags);
-
-        ipr = ctrl_inl(INTC2_BASE + INTC2_INTPRI_OFFSET + ipr_offset);
-        ipr &= ~(0xf << ipr_shift);
-        ipr |= priority << ipr_shift;
-        ctrl_outl(ipr, INTC2_BASE + INTC2_INTPRI_OFFSET + ipr_offset);
-
-        local_irq_restore(flags);
+        int i;
 
-        irq_desc[irq].chip = &intc2_irq_type;
+        for (i = 0; i < nr_irqs; i++) {
+                unsigned long ipr, flags;
+                struct intc2_data *p = table + i;
 
-        disable_intc2_irq(irq);
-}
+                disable_irq_nosync(p->irq);
 
-static struct intc2_init {
-        unsigned short irq;
-        unsigned char ipr_offset, ipr_shift;
-        unsigned char msk_offset, msk_shift;
-        unsigned char priority;
-} intc2_init_data[]  __initdata = {
-#if defined(CONFIG_CPU_SUBTYPE_ST40)
-        {64,  0,  0, 0,  0, 13},        /* PCI serr */
-        {65,  0,  4, 0,  1, 13},        /* PCI err */
-        {66,  0,  4, 0,  2, 13},        /* PCI ad */
-        {67,  0,  4, 0,  3, 13},        /* PCI pwd down */
-        {72,  0,  8, 0,  5, 13},        /* DMAC INT0 */
-        {73,  0,  8, 0,  6, 13},        /* DMAC INT1 */
-        {74,  0,  8, 0,  7, 13},        /* DMAC INT2 */
-        {75,  0,  8, 0,  8, 13},        /* DMAC INT3 */
-        {76,  0,  8, 0,  9, 13},        /* DMAC INT4 */
-        {78,  0,  8, 0, 11, 13},        /* DMAC ERR */
-        {80,  0, 12, 0, 12, 13},        /* PIO0 */
-        {84,  0, 16, 0, 13, 13},        /* PIO1 */
-        {88,  0, 20, 0, 14, 13},        /* PIO2 */
-        {112, 4,  0, 4,  0, 13},        /* Mailbox */
- #ifdef CONFIG_CPU_SUBTYPE_ST40GX1
-        {116, 4,  4, 4,  4, 13},        /* SSC0 */
-        {120, 4,  8, 4,  8, 13},        /* IR Blaster */
-        {124, 4, 12, 4, 12, 13},        /* USB host */
-        {128, 4, 16, 4, 16, 13},        /* Video processor BLITTER */
-        {132, 4, 20, 4, 20, 13},        /* UART0 */
-        {134, 4, 20, 4, 22, 13},        /* UART2 */
-        {136, 4, 24, 4, 24, 13},        /* IO_PIO0 */
-        {140, 4, 28, 4, 28, 13},        /* EMPI */
-        {144, 8,  0, 8,  0, 13},        /* MAFE */
-        {148, 8,  4, 8,  4, 13},        /* PWM */
-        {152, 8,  8, 8,  8, 13},        /* SSC1 */
-        {156, 8, 12, 8, 12, 13},        /* IO_PIO1 */
-        {160, 8, 16, 8, 16, 13},        /* USB target */
-        {164, 8, 20, 8, 20, 13},        /* UART1 */
-        {168, 8, 24, 8, 24, 13},        /* Teletext */
-        {172, 8, 28, 8, 28, 13},        /* VideoSync VTG */
-        {173, 8, 28, 8, 29, 13},        /* VideoSync DVP0 */
-        {174, 8, 28, 8, 30, 13},        /* VideoSync DVP1 */
-#endif
-#elif defined(CONFIG_CPU_SUBTYPE_SH7760)
-/*
- * SH7760 INTC2-Style interrupts, vectors IRQ48-111 INTEVT 0x800-0xFE0
- */
-        /* INTPRIO0 | INTMSK0 */
-        {48,  0, 28, 0, 31,  3},        /* IRQ 4 */
-        {49,  0, 24, 0, 30,  3},        /* IRQ 3 */
-        {50,  0, 20, 0, 29,  3},        /* IRQ 2 */
-        {51,  0, 16, 0, 28,  3},        /* IRQ 1 */
-        /* 52-55 (INTEVT 0x880-0x8E0) unused/reserved */
-        /* INTPRIO4 | INTMSK0 */
-        {56,  4, 28, 0, 25,  3},        /* HCAN2_CHAN0 */
-        {57,  4, 24, 0, 24,  3},        /* HCAN2_CHAN1 */
-        {58,  4, 20, 0, 23,  3},        /* I2S_CHAN0   */
-        {59,  4, 16, 0, 22,  3},        /* I2S_CHAN1   */
-        {60,  4, 12, 0, 21,  3},        /* AC97_CHAN0  */
-        {61,  4,  8, 0, 20,  3},        /* AC97_CHAN1  */
-        {62,  4,  4, 0, 19,  3},        /* I2C_CHAN0   */
-        {63,  4,  0, 0, 18,  3},        /* I2C_CHAN1   */
-        /* INTPRIO8 | INTMSK0 */
-        {52,  8, 16, 0, 11,  3},        /* SCIF0_ERI_IRQ */
-        {53,  8, 16, 0, 10,  3},        /* SCIF0_RXI_IRQ */
-        {54,  8, 16, 0,  9,  3},        /* SCIF0_BRI_IRQ */
-        {55,  8, 16, 0,  8,  3},        /* SCIF0_TXI_IRQ */
-        {64,  8, 28, 0, 17,  3},        /* USBHI_IRQ */
-        {65,  8, 24, 0, 16,  3},        /* LCDC      */
-        /* 66, 67 unused */
-        {68,  8, 20, 0, 14, 13},        /* DMABRGI0_IRQ */
-        {69,  8, 20, 0, 13, 13},        /* DMABRGI1_IRQ */
-        {70,  8, 20, 0, 12, 13},        /* DMABRGI2_IRQ */
-        /* 71 unused */
-        {72,  8, 12, 0,  7,  3},        /* SCIF1_ERI_IRQ */
-        {73,  8, 12, 0,  6,  3},        /* SCIF1_RXI_IRQ */
-        {74,  8, 12, 0,  5,  3},        /* SCIF1_BRI_IRQ */
-        {75,  8, 12, 0,  4,  3},        /* SCIF1_TXI_IRQ */
-        {76,  8,  8, 0,  3,  3},        /* SCIF2_ERI_IRQ */
-        {77,  8,  8, 0,  2,  3},        /* SCIF2_RXI_IRQ */
-        {78,  8,  8, 0,  1,  3},        /* SCIF2_BRI_IRQ */
-        {79,  8,  8, 0,  0,  3},        /* SCIF2_TXI_IRQ */
-        /*          | INTMSK4 */
-        {80,  8,  4, 4, 23,  3},        /* SIM_ERI */
-        {81,  8,  4, 4, 22,  3},        /* SIM_RXI */
-        {82,  8,  4, 4, 21,  3},        /* SIM_TXI */
-        {83,  8,  4, 4, 20,  3},        /* SIM_TEI */
-        {84,  8,  0, 4, 19,  3},        /* HSPII */
-        /* INTPRIOC | INTMSK4 */
-        /* 85-87 unused/reserved */
-        {88, 12, 20, 4, 18,  3},        /* MMCI0 */
-        {89, 12, 20, 4, 17,  3},        /* MMCI1 */
-        {90, 12, 20, 4, 16,  3},        /* MMCI2 */
-        {91, 12, 20, 4, 15,  3},        /* MMCI3 */
-        {92, 12, 12, 4,  6,  3},        /* MFI (unsure, bug? in my 7760 manual*/
-        /* 93-107 reserved/undocumented */
-        {108,12,  4, 4,  1,  3},        /* ADC  */
-        {109,12,  0, 4,  0,  3},        /* CMTI */
-        /* 110-111 reserved/unused */
-#elif defined(CONFIG_CPU_SUBTYPE_SH7780)
-        { TIMER_IRQ, 0, 24, 0, INTC_TMU0_MSK, 2},
-        { 21, 1, 0, 0, INTC_RTC_MSK, TIMER_PRIORITY },
-        { 22, 1, 1, 0, INTC_RTC_MSK, TIMER_PRIORITY },
-        { 23, 1, 2, 0, INTC_RTC_MSK, TIMER_PRIORITY },
-        { SCIF0_ERI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
-        { SCIF0_RXI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
-        { SCIF0_BRI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
-        { SCIF0_TXI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
+                /* Set the priority level */
+                local_irq_save(flags);
 
-        { SCIF1_ERI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
-        { SCIF1_RXI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
-        { SCIF1_BRI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
-        { SCIF1_TXI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
+                ipr = ctrl_inl(INTC2_BASE + INTC2_INTPRI_OFFSET +
+                               p->ipr_offset);
+                ipr &= ~(0xf << p->ipr_shift);
+                ipr |= p->priority << p->ipr_shift;
+                ctrl_outl(ipr, INTC2_BASE + INTC2_INTPRI_OFFSET +
+                          p->ipr_offset);
 
-        { PCIC0_IRQ, 0x10,  8, 0, INTC_PCIC0_MSK, PCIC0_PRIORITY },
-        { PCIC1_IRQ, 0x10,  0, 0, INTC_PCIC1_MSK, PCIC1_PRIORITY },
-        { PCIC2_IRQ, 0x14, 24, 0, INTC_PCIC2_MSK, PCIC2_PRIORITY },
-        { PCIC3_IRQ, 0x14, 16, 0, INTC_PCIC3_MSK, PCIC3_PRIORITY },
-        { PCIC4_IRQ, 0x14,  8, 0, INTC_PCIC4_MSK, PCIC4_PRIORITY },
-#endif
-};
+                local_irq_restore(flags);
 
-void __init init_IRQ_intc2(void)
-{
-        int i;
+                set_irq_chip_and_handler_name(p->irq, &intc2_irq_chip,
+                                              handle_level_irq, "level");
+                set_irq_chip_data(p->irq, p);
 
-        for (i = 0; i < ARRAY_SIZE(intc2_init_data); i++) {
-                struct intc2_init *p = intc2_init_data + i;
-                make_intc2_irq(p->irq, p->ipr_offset, p->ipr_shift,
-                               p-> msk_offset, p->msk_shift, p->priority);
+                enable_intc2_irq(p->irq);
         }
 }
-
-/* Adds a termination callback to the interrupt */
-void intc2_add_clear_irq(int irq, int (*fn)(int))
-{
-        if (unlikely(irq < INTC2_FIRST_IRQ))
-                return;
-
-        intc2_data[irq - INTC2_FIRST_IRQ].clear_irq = fn;
-}
-
diff --git a/arch/sh/kernel/cpu/irq/ipr.c b/arch/sh/kernel/cpu/irq/ipr.c
index f785822cd5de..a0089563cbfc 100644
--- a/arch/sh/kernel/cpu/irq/ipr.c
+++ b/arch/sh/kernel/cpu/irq/ipr.c
@@ -1,11 +1,10 @@
 /*
- * arch/sh/kernel/cpu/irq/ipr.c
+ * Interrupt handling for IPR-based IRQ.
  *
  * Copyright (C) 1999  Niibe Yutaka & Takeshi Yaegashi
  * Copyright (C) 2000  Kazumoto Kojima
- * Copyright (C) 2003 Takashi Kusuda <kusuda-takashi@hitachi-ul.co.jp>
- *
- * Interrupt handling for IPR-based IRQ.
+ * Copyright (C) 2003  Takashi Kusuda <kusuda-takashi@hitachi-ul.co.jp>
+ * Copyright (C) 2006  Paul Mundt
  *
  * Supported system:
  *      On-chip supporting modules (TMU, RTC, etc.).
@@ -13,151 +12,92 @@
  *      Hitachi SolutionEngine external I/O:
  *              MS7709SE01, MS7709ASE01, and MS7750SE01
  *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
  */
-
 #include <linux/init.h>
 #include <linux/irq.h>
 #include <linux/module.h>
-
 #include <asm/system.h>
 #include <asm/io.h>
 #include <asm/machvec.h>
 
-struct ipr_data {
-        unsigned int addr;      /* Address of Interrupt Priority Register */
-        int shift;              /* Shifts of the 16-bit data */
-        int priority;           /* The priority */
-};
-static struct ipr_data ipr_data[NR_IRQS];
-
-static void enable_ipr_irq(unsigned int irq);
-static void disable_ipr_irq(unsigned int irq);
-
-/* shutdown is same as "disable" */
-#define shutdown_ipr_irq disable_ipr_irq
-
-static void mask_and_ack_ipr(unsigned int);
-static void end_ipr_irq(unsigned int irq);
-
-static unsigned int startup_ipr_irq(unsigned int irq)
-{
-        enable_ipr_irq(irq);
-        return 0; /* never anything pending */
-}
-
-static struct hw_interrupt_type ipr_irq_type = {
-        .typename = "IPR-IRQ",
-        .startup = startup_ipr_irq,
-        .shutdown = shutdown_ipr_irq,
-        .enable = enable_ipr_irq,
-        .disable = disable_ipr_irq,
-        .ack = mask_and_ack_ipr,
-        .end = end_ipr_irq
-};
 
 static void disable_ipr_irq(unsigned int irq)
 {
-        unsigned long val;
-        unsigned int addr = ipr_data[irq].addr;
-        unsigned short mask = 0xffff ^ (0x0f << ipr_data[irq].shift);
-
+        struct ipr_data *p = get_irq_chip_data(irq);
+        int shift = p->shift*4;
         /* Set the priority in IPR to 0 */
-        val = ctrl_inw(addr);
-        val &= mask;
-        ctrl_outw(val, addr);
+        ctrl_outw(ctrl_inw(p->addr) & (0xffff ^ (0xf << shift)), p->addr);
 }
 
 static void enable_ipr_irq(unsigned int irq)
 {
-        unsigned long val;
-        unsigned int addr = ipr_data[irq].addr;
-        int priority = ipr_data[irq].priority;
-        unsigned short value = (priority << ipr_data[irq].shift);
-
+        struct ipr_data *p = get_irq_chip_data(irq);
+        int shift = p->shift*4;
         /* Set priority in IPR back to original value */
-        val = ctrl_inw(addr);
-        val |= value;
-        ctrl_outw(val, addr);
+        ctrl_outw(ctrl_inw(p->addr) | (p->priority << shift), p->addr);
 }
 
-static void mask_and_ack_ipr(unsigned int irq)
-{
-        disable_ipr_irq(irq);
-
-#if defined(CONFIG_CPU_SUBTYPE_SH7707) || defined(CONFIG_CPU_SUBTYPE_SH7709) || \
-    defined(CONFIG_CPU_SUBTYPE_SH7706) || \
-    defined(CONFIG_CPU_SUBTYPE_SH7300) || defined(CONFIG_CPU_SUBTYPE_SH7705)
-        /* This is needed when we use edge triggered setting */
-        /* XXX: Is it really needed? */
-        if (IRQ0_IRQ <= irq && irq <= IRQ5_IRQ) {
-                /* Clear external interrupt request */
-                int a = ctrl_inb(INTC_IRR0);
-                a &= ~(1 << (irq - IRQ0_IRQ));
-                ctrl_outb(a, INTC_IRR0);
-        }
-#endif
-}
+static struct irq_chip ipr_irq_chip = {
+        .name           = "IPR",
+        .mask           = disable_ipr_irq,
+        .unmask         = enable_ipr_irq,
+        .mask_ack       = disable_ipr_irq,
+};
 
-static void end_ipr_irq(unsigned int irq)
+void make_ipr_irq(struct ipr_data *table, unsigned int nr_irqs)
 {
-        if (!(irq_desc[irq].status & (IRQ_DISABLED|IRQ_INPROGRESS)))
+        int i;
+
+        for (i = 0; i < nr_irqs; i++) {
+                unsigned int irq = table[i].irq;
+                disable_irq_nosync(irq);
+                set_irq_chip_and_handler_name(irq, &ipr_irq_chip,
+                                      handle_level_irq, "level");
+                set_irq_chip_data(irq, &table[i]);
                 enable_ipr_irq(irq);
+        }
 }
+EXPORT_SYMBOL(make_ipr_irq);
 
-void make_ipr_irq(unsigned int irq, unsigned int addr, int pos, int priority)
-{
-        disable_irq_nosync(irq);
-        ipr_data[irq].addr = addr;
-        ipr_data[irq].shift = pos*4; /* POSition (0-3) x 4 means shift */
-        ipr_data[irq].priority = priority;
-
-        irq_desc[irq].chip = &ipr_irq_type;
-        disable_ipr_irq(irq);
-}
-
-void __init init_IRQ(void)
-{
+static struct ipr_data sys_ipr_map[] = {
 #ifndef CONFIG_CPU_SUBTYPE_SH7780
-        make_ipr_irq(TIMER_IRQ, TIMER_IPR_ADDR, TIMER_IPR_POS, TIMER_PRIORITY);
-        make_ipr_irq(TIMER1_IRQ, TIMER1_IPR_ADDR, TIMER1_IPR_POS, TIMER1_PRIORITY);
+        { TIMER_IRQ, TIMER_IPR_ADDR, TIMER_IPR_POS, TIMER_PRIORITY },
+        { TIMER1_IRQ, TIMER1_IPR_ADDR, TIMER1_IPR_POS, TIMER1_PRIORITY },
 #ifdef RTC_IRQ
-        make_ipr_irq(RTC_IRQ, RTC_IPR_ADDR, RTC_IPR_POS, RTC_PRIORITY);
+        { RTC_IRQ, RTC_IPR_ADDR, RTC_IPR_POS, RTC_PRIORITY },
 #endif
-
 #ifdef SCI_ERI_IRQ
-        make_ipr_irq(SCI_ERI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY);
-        make_ipr_irq(SCI_RXI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY);
-        make_ipr_irq(SCI_TXI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY);
+        { SCI_ERI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY },
+        { SCI_RXI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY },
+        { SCI_TXI_IRQ, SCI_IPR_ADDR, SCI_IPR_POS, SCI_PRIORITY },
 #endif
-
 #ifdef SCIF1_ERI_IRQ
-        make_ipr_irq(SCIF1_ERI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY);
-        make_ipr_irq(SCIF1_RXI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY);
-        make_ipr_irq(SCIF1_BRI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY);
-        make_ipr_irq(SCIF1_TXI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY);
+        { SCIF1_ERI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY },
+        { SCIF1_RXI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY },
+        { SCIF1_BRI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY },
+        { SCIF1_TXI_IRQ, SCIF1_IPR_ADDR, SCIF1_IPR_POS, SCIF1_PRIORITY },
 #endif
-
 #if defined(CONFIG_CPU_SUBTYPE_SH7300)
-        make_ipr_irq(SCIF0_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY);
-        make_ipr_irq(DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY);
-        make_ipr_irq(VIO_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY);
+        { SCIF0_IRQ, SCIF0_IPR_ADDR, SCIF0_IPR_POS, SCIF0_PRIORITY },
+        { DMTE2_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { DMTE3_IRQ, DMA1_IPR_ADDR, DMA1_IPR_POS, DMA1_PRIORITY },
+        { VIO_IRQ, VIO_IPR_ADDR, VIO_IPR_POS, VIO_PRIORITY },
 #endif
-
 #ifdef SCIF_ERI_IRQ
-        make_ipr_irq(SCIF_ERI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY);
-        make_ipr_irq(SCIF_RXI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY);
-        make_ipr_irq(SCIF_BRI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY);
-        make_ipr_irq(SCIF_TXI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY);
+        { SCIF_ERI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY },
+        { SCIF_RXI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY },
+        { SCIF_BRI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY },
+        { SCIF_TXI_IRQ, SCIF_IPR_ADDR, SCIF_IPR_POS, SCIF_PRIORITY },
 #endif
-
 #ifdef IRDA_ERI_IRQ
-        make_ipr_irq(IRDA_ERI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY);
-        make_ipr_irq(IRDA_RXI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY);
-        make_ipr_irq(IRDA_BRI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY);
-        make_ipr_irq(IRDA_TXI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY);
+        { IRDA_ERI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY },
+        { IRDA_RXI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY },
+        { IRDA_BRI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY },
+        { IRDA_TXI_IRQ, IRDA_IPR_ADDR, IRDA_IPR_POS, IRDA_PRIORITY },
 #endif
-
 #if defined(CONFIG_CPU_SUBTYPE_SH7707) || defined(CONFIG_CPU_SUBTYPE_SH7709) || \
     defined(CONFIG_CPU_SUBTYPE_SH7706) || \
     defined(CONFIG_CPU_SUBTYPE_SH7300) || defined(CONFIG_CPU_SUBTYPE_SH7705)
@@ -171,14 +111,19 @@ void __init init_IRQ(void)
          * You should set corresponding bits of PFC to "00"
          * to enable these interrupts.
          */
-        make_ipr_irq(IRQ0_IRQ, IRQ0_IPR_ADDR, IRQ0_IPR_POS, IRQ0_PRIORITY);
-        make_ipr_irq(IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, IRQ1_PRIORITY);
-        make_ipr_irq(IRQ2_IRQ, IRQ2_IPR_ADDR, IRQ2_IPR_POS, IRQ2_PRIORITY);
-        make_ipr_irq(IRQ3_IRQ, IRQ3_IPR_ADDR, IRQ3_IPR_POS, IRQ3_PRIORITY);
-        make_ipr_irq(IRQ4_IRQ, IRQ4_IPR_ADDR, IRQ4_IPR_POS, IRQ4_PRIORITY);
-        make_ipr_irq(IRQ5_IRQ, IRQ5_IPR_ADDR, IRQ5_IPR_POS, IRQ5_PRIORITY);
+        { IRQ0_IRQ, IRQ0_IPR_ADDR, IRQ0_IPR_POS, IRQ0_PRIORITY },
+        { IRQ1_IRQ, IRQ1_IPR_ADDR, IRQ1_IPR_POS, IRQ1_PRIORITY },
+        { IRQ2_IRQ, IRQ2_IPR_ADDR, IRQ2_IPR_POS, IRQ2_PRIORITY },
+        { IRQ3_IRQ, IRQ3_IPR_ADDR, IRQ3_IPR_POS, IRQ3_PRIORITY },
+        { IRQ4_IRQ, IRQ4_IPR_ADDR, IRQ4_IPR_POS, IRQ4_PRIORITY },
+        { IRQ5_IRQ, IRQ5_IPR_ADDR, IRQ5_IPR_POS, IRQ5_PRIORITY },
 #endif
 #endif
+};
+
+void __init init_IRQ(void)
+{
+        make_ipr_irq(sys_ipr_map, ARRAY_SIZE(sys_ipr_map));
 
 #ifdef CONFIG_CPU_HAS_PINT_IRQ
         init_IRQ_pint();
@@ -200,5 +145,3 @@ int ipr_irq_demux(int irq)
         return irq;
 }
 #endif
-
-EXPORT_SYMBOL(make_ipr_irq);
diff --git a/arch/sh/kernel/cpu/irq/pint.c b/arch/sh/kernel/cpu/irq/pint.c
index 17f47b373d6e..f60007783a21 100644
--- a/arch/sh/kernel/cpu/irq/pint.c
+++ b/arch/sh/kernel/cpu/irq/pint.c
@@ -84,12 +84,16 @@ void make_pint_irq(unsigned int irq)
         disable_pint_irq(irq);
 }
 
+static struct ipr_data pint_ipr_map[] = {
+        { PINT0_IRQ, PINT0_IPR_ADDR, PINT0_IPR_POS, PINT0_PRIORITY },
+        { PINT8_IRQ, PINT8_IPR_ADDR, PINT8_IPR_POS, PINT8_PRIORITY },
+};
+
 void __init init_IRQ_pint(void)
 {
         int i;
 
-        make_ipr_irq(PINT0_IRQ, PINT0_IPR_ADDR, PINT0_IPR_POS, PINT0_PRIORITY);
-        make_ipr_irq(PINT8_IRQ, PINT8_IPR_ADDR, PINT8_IPR_POS, PINT8_PRIORITY);
+        make_ipr_irq(pint_ipr_map, ARRAY_SIZE(pint_ipr_map));
 
         enable_irq(PINT0_IRQ);
         enable_irq(PINT8_IRQ);
diff --git a/arch/sh/kernel/cpu/sh3/ex.S b/arch/sh/kernel/cpu/sh3/ex.S
index 44daf44833f9..ba3082d640b5 100644
--- a/arch/sh/kernel/cpu/sh3/ex.S
+++ b/arch/sh/kernel/cpu/sh3/ex.S
@@ -4,7 +4,7 @@
  *  The SH-3 exception vector table.
 
  *  Copyright (C) 1999, 2000, 2002  Niibe Yutaka
- *  Copyright (C) 2003  Paul Mundt
+ *  Copyright (C) 2003 - 2006  Paul Mundt
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file "COPYING" in the main directory of this archive
@@ -49,198 +49,10 @@ ENTRY(nmi_slot)
 #endif
 ENTRY(user_break_point_trap)
         .long   break_point_trap        /* 1E0 */
-ENTRY(interrupt_table)
-        ! external hardware
-        .long   do_IRQ  ! 0000          /* 200 */
-        .long   do_IRQ  ! 0001
-        .long   do_IRQ  ! 0010
-        .long   do_IRQ  ! 0011
-        .long   do_IRQ  ! 0100
-        .long   do_IRQ  ! 0101
-        .long   do_IRQ  ! 0110
-        .long   do_IRQ  ! 0111
-        .long   do_IRQ  ! 1000          /* 300 */
-        .long   do_IRQ  ! 1001
-        .long   do_IRQ  ! 1010
-        .long   do_IRQ  ! 1011
-        .long   do_IRQ  ! 1100
-        .long   do_IRQ  ! 1101
-        .long   do_IRQ  ! 1110
-        .long   exception_error         
-        ! Internal hardware
-        .long   do_IRQ  ! TMU0 tuni0    /* 400 */
-        .long   do_IRQ  ! TMU1 tuni1
-        .long   do_IRQ  ! TMU2 tuni2
-        .long   do_IRQ  !      ticpi2
-        .long   do_IRQ  ! RTC  ati
-        .long   do_IRQ  !      pri
-        .long   do_IRQ  !      cui
-        .long   do_IRQ  ! SCI  eri
-        .long   do_IRQ  !      rxi      /* 500 */
-        .long   do_IRQ  !      txi
-        .long   do_IRQ  !      tei
-        .long   do_IRQ  ! WDT  iti      /* 560 */
-        .long   do_IRQ  ! REF  rcmi
-        .long   do_IRQ  !      rovi
-        .long   do_IRQ                  
-        .long   do_IRQ                  /* 5E0 */
-#if  defined(CONFIG_CPU_SUBTYPE_SH7707) || \
-     defined(CONFIG_CPU_SUBTYPE_SH7709) || \
-     defined(CONFIG_CPU_SUBTYPE_SH7706) || \
-     defined(CONFIG_CPU_SUBTYPE_SH7300) || \
-     defined(CONFIG_CPU_SUBTYPE_SH7705) || \
-     defined(CONFIG_CPU_SUBTYPE_SH7710)
-        .long   do_IRQ  ! 32 IRQ  irq0  /* 600 */
-        .long   do_IRQ  ! 33      irq1
-        .long   do_IRQ  ! 34      irq2
-        .long   do_IRQ  ! 35      irq3
-        .long   do_IRQ  ! 36      irq4
-        .long   do_IRQ  ! 37      irq5
-        .long   do_IRQ  ! 38
-        .long   do_IRQ  ! 39
-        .long   do_IRQ  ! 40 PINT pint0-7       /* 700 */
-        .long   do_IRQ  ! 41      pint8-15
-        .long   do_IRQ  ! 42
-        .long   do_IRQ  ! 43
-        .long   do_IRQ  ! 44
-        .long   do_IRQ  ! 45    
-        .long   do_IRQ  ! 46
-        .long   do_IRQ  ! 47
-        .long   do_IRQ  ! 48 DMAC dei0  /* 800 */
-        .long   do_IRQ  ! 49      dei1
-        .long   do_IRQ  ! 50      dei2
-        .long   do_IRQ  ! 51      dei3
-        .long   do_IRQ  ! 52 IrDA eri1
-        .long   do_IRQ  ! 53      rxi1
-        .long   do_IRQ  ! 54      bri1
-        .long   do_IRQ  ! 55      txi1
-        .long   do_IRQ  ! 56 SCIF eri2
-        .long   do_IRQ  ! 57      rxi2
-        .long   do_IRQ  ! 58      bri2
-        .long   do_IRQ  ! 59      txi2
-        .long   do_IRQ  ! 60 ADC  adi   /* 980 */
-#if defined(CONFIG_CPU_SUBTYPE_SH7705)
-        .long   exception_none  ! 61    /* 9A0 */
-        .long   exception_none  ! 62
-        .long   exception_none  ! 63
-        .long   exception_none  ! 64    /* A00 */
-        .long   do_IRQ  ! 65 USB  usi0
-        .long   do_IRQ  ! 66      usi1
-        .long   exception_none  ! 67
-        .long   exception_none  ! 68
-        .long   exception_none  ! 69
-        .long   exception_none  ! 70
-        .long   exception_none  ! 71
-        .long   exception_none  ! 72    /* B00 */
-        .long   exception_none  ! 73
-        .long   exception_none  ! 74
-        .long   exception_none  ! 75
-        .long   exception_none  ! 76
-        .long   exception_none  ! 77
-        .long   exception_none  ! 78
-        .long   exception_none  ! 79
-        .long   do_IRQ  ! 80 TPU0 tpi0  /* C00 */
-        .long   do_IRQ  ! 81 TPU1 tpi1
-        .long   exception_none  ! 82
-        .long   exception_none  ! 83
-        .long   do_IRQ  ! 84 TPU2 tpi2
-        .long   do_IRQ  ! 85 TPU3 tpi3  /* CA0 */
-#endif
-#if defined(CONFIG_CPU_SUBTYPE_SH7707) || defined(CONFIG_CPU_SUBTYPE_SH7300)
-        .long   do_IRQ  ! 61 LCDC lcdi  /* 9A0 */
-        .long   do_IRQ  ! 62 PCC  pcc0i
-        .long   do_IRQ  ! 63      pcc1i /* 9E0 */
-#endif
-#if defined(CONFIG_CPU_SUBTYPE_SH7710)
-        .long   exception_none  ! 61    /* 9A0 */
-        .long   exception_none  ! 62
-        .long   exception_none  ! 63
-        .long   exception_none  ! 64    /* A00 */
-        .long   exception_none  ! 65
-        .long   exception_none  ! 66
-        .long   exception_none  ! 67
-        .long   exception_none  ! 68
-        .long   exception_none  ! 69
-        .long   exception_none  ! 70
-        .long   exception_none  ! 71
-        .long   exception_none  ! 72    /* B00 */
-        .long   exception_none  ! 73
-        .long   exception_none  ! 74
-        .long   exception_none  ! 75
-        .long   do_IRQ  ! 76 DMAC2 dei4 /* B80 */
-        .long   do_IRQ  ! 77 DMAC2 dei5
-        .long   exception_none  ! 78
-        .long   do_IRQ  ! 79 IPSEC ipseci /* BE0 */
-        .long   do_IRQ  ! 80 EDMAC eint0 /* C00 */
-        .long   do_IRQ  ! 81 EDMAC eint1
-        .long   do_IRQ  ! 82 EDMAC eint2
-        .long   exception_none  ! 83    /* C60 */
-        .long   exception_none  ! 84
-        .long   exception_none  ! 85
-        .long   exception_none  ! 86
-        .long   exception_none  ! 87
-        .long   exception_none  ! 88    /* D00 */
-        .long   exception_none  ! 89
-        .long   exception_none  ! 90
-        .long   exception_none  ! 91
-        .long   exception_none  ! 92
-        .long   exception_none  ! 93
-        .long   exception_none  ! 94
-        .long   exception_none  ! 95
-        .long   do_IRQ  ! 96 SIOF eri0  /* E00 */
-        .long   do_IRQ  ! 97      txi0
-        .long   do_IRQ  ! 98      rxi0
-        .long   do_IRQ  ! 99      cci0
-        .long   do_IRQ  ! 100     eri1  /* E80 */
-        .long   do_IRQ  ! 101     txi1
-        .long   do_IRQ  ! 102     rxi2
-        .long   do_IRQ  ! 103     cci3
-#endif
-#if defined(CONFIG_CPU_SUBTYPE_SH7300)
-        .long   do_IRQ  ! 64
-        .long   do_IRQ  ! 65
-        .long   do_IRQ  ! 66
-        .long   do_IRQ  ! 67
-        .long   do_IRQ  ! 68
-        .long   do_IRQ  ! 69
-        .long   do_IRQ  ! 70
-        .long   do_IRQ  ! 71
-        .long   do_IRQ  ! 72
-        .long   do_IRQ  ! 73
-        .long   do_IRQ  ! 74
-        .long   do_IRQ  ! 75
-        .long   do_IRQ  ! 76
-        .long   do_IRQ  ! 77
-        .long   do_IRQ  ! 78
-        .long   do_IRQ  ! 79
-        .long   do_IRQ  ! 80 SCIF0(SH7300)
-        .long   do_IRQ  ! 81
-        .long   do_IRQ  ! 82
-        .long   do_IRQ  ! 83
-        .long   do_IRQ  ! 84
-        .long   do_IRQ  ! 85
-        .long   do_IRQ  ! 86
-        .long   do_IRQ  ! 87
-        .long   do_IRQ  ! 88
-        .long   do_IRQ  ! 89
-        .long   do_IRQ  ! 90
-        .long   do_IRQ  ! 91
-        .long   do_IRQ  ! 92
-        .long   do_IRQ  ! 93
-        .long   do_IRQ  ! 94
-        .long   do_IRQ  ! 95
-        .long   do_IRQ  ! 96
-        .long   do_IRQ  ! 97
-        .long   do_IRQ  ! 98
-        .long   do_IRQ  ! 99
-        .long   do_IRQ  ! 100
-        .long   do_IRQ  ! 101
-        .long   do_IRQ  ! 102
-        .long   do_IRQ  ! 103
-        .long   do_IRQ  ! 104
-        .long   do_IRQ  ! 105
-        .long   do_IRQ  ! 106
-        .long   do_IRQ  ! 107
-        .long   do_IRQ  ! 108
-#endif
-#endif
+
+        /*
+         * Pad the remainder of the table out, exceptions residing in far
+         * away offsets can be manually inserted in to their appropriate
+         * location via set_exception_table_{evt,vec}().
+         */
+        .balign 4096,0,4096
diff --git a/arch/sh/kernel/cpu/sh4/ex.S b/arch/sh/kernel/cpu/sh4/ex.S
index 7146893a6cca..ac8ab57413cc 100644
--- a/arch/sh/kernel/cpu/sh4/ex.S
+++ b/arch/sh/kernel/cpu/sh4/ex.S
@@ -4,7 +4,7 @@
  *  The SH-4 exception vector table.
 
  *  Copyright (C) 1999, 2000, 2002  Niibe Yutaka
- *  Copyright (C) 2003  Paul Mundt
+ *  Copyright (C) 2003 - 2006  Paul Mundt
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file "COPYING" in the main directory of this archive
@@ -53,503 +53,10 @@ ENTRY(nmi_slot)
 #endif
 ENTRY(user_break_point_trap)
         .long   break_point_trap        /* 1E0 */
-ENTRY(interrupt_table)
-        ! external hardware
-        .long   do_IRQ  ! 0000          /* 200 */
-        .long   do_IRQ  ! 0001
-        .long   do_IRQ  ! 0010
-        .long   do_IRQ  ! 0011
-        .long   do_IRQ  ! 0100
-        .long   do_IRQ  ! 0101
-        .long   do_IRQ  ! 0110
-        .long   do_IRQ  ! 0111
-        .long   do_IRQ  ! 1000          /* 300 */
-        .long   do_IRQ  ! 1001
-        .long   do_IRQ  ! 1010
-        .long   do_IRQ  ! 1011
-        .long   do_IRQ  ! 1100
-        .long   do_IRQ  ! 1101
-        .long   do_IRQ  ! 1110
-        .long   exception_error         
-        ! Internal hardware
-#ifndef CONFIG_CPU_SUBTYPE_SH7780
-        .long   do_IRQ  ! TMU0 tuni0    /* 400 */
-        .long   do_IRQ  ! TMU1 tuni1
-        .long   do_IRQ  ! TMU2 tuni2
-        .long   do_IRQ  !      ticpi2
-#if  defined(CONFIG_CPU_SUBTYPE_SH7760)
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error                 /* 500 */
-        .long   exception_error
-        .long   exception_error
-#else
-        .long   do_IRQ  ! RTC  ati
-        .long   do_IRQ  !      pri
-        .long   do_IRQ  !      cui
-        .long   do_IRQ  ! SCI  eri
-        .long   do_IRQ  !      rxi      /* 500 */
-        .long   do_IRQ  !      txi
-        .long   do_IRQ  !      tei
-#endif
-        .long   do_IRQ  ! WDT  iti      /* 560 */
-        .long   do_IRQ  ! REF  rcmi
-        .long   do_IRQ  !      rovi
-        .long   do_IRQ                  
-        .long   do_IRQ                  /* 5E0 */
-        .long   do_IRQ  ! 32 Hitachi UDI        /* 600 */
-        .long   do_IRQ  ! 33 GPIO
-        .long   do_IRQ  ! 34 DMAC dmte0
-        .long   do_IRQ  ! 35      dmte1
-        .long   do_IRQ  ! 36      dmte2
-        .long   do_IRQ  ! 37      dmte3
-        .long   do_IRQ  ! 38      dmae
-        .long   exception_error                 ! 39    /* 6E0 */
-#if defined(CONFIG_CPU_SUBTYPE_SH7760)
-        .long   exception_error                         /* 700 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error                         /* 760 */
-#else
-        .long   do_IRQ  ! 40 SCIF eri           /* 700 */
-        .long   do_IRQ  ! 41      rxi
-        .long   do_IRQ  ! 42      bri
-        .long   do_IRQ  ! 43      txi
-#endif
-#if CONFIG_NR_ONCHIP_DMA_CHANNELS == 8
-        .long   do_IRQ  ! 44 DMAC dmte4         /* 780 */
-        .long   do_IRQ  ! 45      dmte5
-        .long   do_IRQ  ! 46      dmte6
-        .long   do_IRQ  ! 47      dmte7         /* 7E0 */
-#elif defined(CONFIG_CPU_SUBTYPE_SH7343)
-        .long   do_IRQ  ! 44 IIC1 ali           /* 780 */
-        .long   do_IRQ  ! 45      tacki
-        .long   do_IRQ  ! 46      waiti
-        .long   do_IRQ  ! 47      dtei          /* 7E0 */
-        .long   do_IRQ  ! 48 DMAC dei0          /* 800 */
-        .long   do_IRQ  ! 49      dei1          /* 820 */
-#else
-        .long   exception_error                 ! 44    /* 780 */
-        .long   exception_error                 ! 45
-        .long   exception_error                 ! 46
-        .long   exception_error                 ! 47
-#endif
-#if defined(CONFIG_SH_FPU)
-        .long   do_fpu_state_restore    ! 48    /* 800 */
-        .long   do_fpu_state_restore    ! 49    /* 820 */
-#elif !defined(CONFIG_CPU_SUBTYPE_SH7343) && \
-      !defined(CONFIG_CPU_SUBTYPE_SH73180)
-        .long   exception_error
-        .long   exception_error
-#endif
-#if defined(CONFIG_CPU_SUBTYPE_SH7751)
-        .long   exception_error                 /* 840 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error                 /* 900 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! PCI serr      /* A00 */
-        .long   do_IRQ  !     dma3
-        .long   do_IRQ  !     dma2
-        .long   do_IRQ  !     dma1
-        .long   do_IRQ  !     dma0
-        .long   do_IRQ  !     pwon
-        .long   do_IRQ  !     pwdwn
-        .long   do_IRQ  !     err
-        .long   do_IRQ  ! TMU3 tuni3    /* B00 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! TMU4 tuni4    /* B80 */
-#elif defined(CONFIG_CPU_SUBTYPE_SH7760)
-        .long   do_IRQ  ! IRQ   irq6    /* 840 */
-        .long   do_IRQ  !       irq7
-        .long   do_IRQ  ! SCIF  eri0
-        .long   do_IRQ  !       rxi0
-        .long   do_IRQ  !       bri0
-        .long   do_IRQ  !       txi0
-        .long   do_IRQ  ! HCAN2 cani0   /* 900 */
-        .long   do_IRQ  !       cani1
-        .long   do_IRQ  ! SSI   ssii0
-        .long   do_IRQ  !       ssii1
-        .long   do_IRQ  ! HAC   haci0
-        .long   do_IRQ  !       haci1
-        .long   do_IRQ  ! IIC   iici0
-        .long   do_IRQ  !       iici1
-        .long   do_IRQ  ! USB   usbi    /* A00 */
-        .long   do_IRQ  ! LCDC  vint
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! DMABRG dmabrgi0
-        .long   do_IRQ  !        dmabrgi1
-        .long   do_IRQ  !        dmabrgi2
-        .long   exception_error
-        .long   do_IRQ  ! SCIF  eri1    /* B00 */
-        .long   do_IRQ  !       rxi1
-        .long   do_IRQ  !       bri1
-        .long   do_IRQ  !       txi1
-        .long   do_IRQ  !       eri2
-        .long   do_IRQ  !       rxi2
-        .long   do_IRQ  !       bri2
-        .long   do_IRQ  !       txi2
-        .long   do_IRQ  ! SIM   simeri  /* C00 */
-        .long   do_IRQ  !       simrxi
-        .long   do_IRQ  !       simtxi
-        .long   do_IRQ  !       simtei
-        .long   do_IRQ  ! HSPI  spii
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! MMCIF mmci0   /* D00 */
-        .long   do_IRQ  !       mmci1
-        .long   do_IRQ  !       mmci2
-        .long   do_IRQ  !       mmci3
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error                 /* E00 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! MFI   mfii
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error                 /* F00 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! ADC   adi
-        .long   do_IRQ  ! CMT   cmti    /* FA0 */
-#elif defined(CONFIG_CPU_SUBTYPE_SH73180) || defined(CONFIG_CPU_SUBTYPE_SH7343)
-        .long   do_IRQ  !  50 0x840
-        .long   do_IRQ  !  51 0x860
-        .long   do_IRQ  !  52 0x880
-        .long   do_IRQ  !  53 0x8a0
-        .long   do_IRQ  !  54 0x8c0
-        .long   do_IRQ  !  55 0x8e0
-        .long   do_IRQ  !  56 0x900
-        .long   do_IRQ  !  57 0x920
-        .long   do_IRQ  !  58 0x940
-        .long   do_IRQ  !  59 0x960
-        .long   do_IRQ  !  60 0x980
-        .long   do_IRQ  !  61 0x9a0
-        .long   do_IRQ  !  62 0x9c0
-        .long   do_IRQ  !  63 0x9e0
-        .long   do_IRQ  !  64 0xa00
-        .long   do_IRQ  !  65 0xa20
-        .long   do_IRQ  !  66 0xa40
-        .long   do_IRQ  !  67 0xa60
-        .long   do_IRQ  !  68 0xa80
-        .long   do_IRQ  !  69 0xaa0
-        .long   do_IRQ  !  70 0xac0
-        .long   do_IRQ  !  71 0xae0
-        .long   do_IRQ  !  72 0xb00
-        .long   do_IRQ  !  73 0xb20
-        .long   do_IRQ  !  74 0xb40
-        .long   do_IRQ  !  75 0xb60
-        .long   do_IRQ  !  76 0xb80
-        .long   do_IRQ  !  77 0xba0
-        .long   do_IRQ  !  78 0xbc0
-        .long   do_IRQ  !  79 0xbe0
-        .long   do_IRQ  !  80 0xc00
-        .long   do_IRQ  !  81 0xc20
-        .long   do_IRQ  !  82 0xc40
-        .long   do_IRQ  !  83 0xc60
-        .long   do_IRQ  !  84 0xc80
-        .long   do_IRQ  !  85 0xca0
-        .long   do_IRQ  !  86 0xcc0
-        .long   do_IRQ  !  87 0xce0
-        .long   do_IRQ  !  88 0xd00
-        .long   do_IRQ  !  89 0xd20
-        .long   do_IRQ  !  90 0xd40
-        .long   do_IRQ  !  91 0xd60
-        .long   do_IRQ  !  92 0xd80
-        .long   do_IRQ  !  93 0xda0
-        .long   do_IRQ  !  94 0xdc0
-        .long   do_IRQ  !  95 0xde0
-        .long   do_IRQ  !  96 0xe00
-        .long   do_IRQ  !  97 0xe20
-        .long   do_IRQ  !  98 0xe40
-        .long   do_IRQ  !  99 0xe60
-        .long   do_IRQ  ! 100 0xe80
-        .long   do_IRQ  ! 101 0xea0
-        .long   do_IRQ  ! 102 0xec0
-        .long   do_IRQ  ! 103 0xee0
-        .long   do_IRQ  ! 104 0xf00
-        .long   do_IRQ  ! 105 0xf20
-        .long   do_IRQ  ! 106 0xf40
-        .long   do_IRQ  ! 107 0xf60
-        .long   do_IRQ  ! 108 0xf80
-#elif defined(CONFIG_CPU_SUBTYPE_ST40STB1)
-        .long   exception_error                 !  50 0x840
-        .long   exception_error                 !  51 0x860
-        .long   exception_error                 !  52 0x880
-        .long   exception_error                 !  53 0x8a0
-        .long   exception_error                 !  54 0x8c0
-        .long   exception_error                 !  55 0x8e0
-        .long   exception_error                 !  56 0x900
-        .long   exception_error                 !  57 0x920
-        .long   exception_error                 !  58 0x940
-        .long   exception_error                 !  59 0x960
-        .long   exception_error                 !  60 0x980
-        .long   exception_error                 !  61 0x9a0
-        .long   exception_error                 !  62 0x9c0
-        .long   exception_error                 !  63 0x9e0
-        .long   do_IRQ  !  64 0xa00 PCI serr
-        .long   do_IRQ  !  65 0xa20     err
-        .long   do_IRQ  !  66 0xa40     ad
-        .long   do_IRQ  !  67 0xa60     pwr_dwn
-        .long   exception_error                 !  68 0xa80
-        .long   exception_error                 !  69 0xaa0
-        .long   exception_error                 !  70 0xac0
-        .long   exception_error                 !  71 0xae0
-        .long   do_IRQ  !  72 0xb00 DMA INT0
-        .long   do_IRQ  !  73 0xb20     INT1
-        .long   do_IRQ  !  74 0xb40     INT2
-        .long   do_IRQ  !  75 0xb60     INT3
-        .long   do_IRQ  !  76 0xb80     INT4
-        .long   exception_error                 !  77 0xba0
-        .long   do_IRQ  !  78 0xbc0 DMA ERR
-        .long   exception_error                 !  79 0xbe0
-        .long   do_IRQ  !  80 0xc00 PIO0
-        .long   do_IRQ  !  81 0xc20 PIO1
-        .long   do_IRQ  !  82 0xc40 PIO2
-        .long   exception_error                 !  83 0xc60
-        .long   exception_error                 !  84 0xc80
-        .long   exception_error                 !  85 0xca0
-        .long   exception_error                 !  86 0xcc0
-        .long   exception_error                 !  87 0xce0
-        .long   exception_error                 !  88 0xd00
-        .long   exception_error                 !  89 0xd20
-        .long   exception_error                 !  90 0xd40
-        .long   exception_error                 !  91 0xd60
-        .long   exception_error                 !  92 0xd80
-        .long   exception_error                 !  93 0xda0
-        .long   exception_error                 !  94 0xdc0
-        .long   exception_error                 !  95 0xde0
-        .long   exception_error                 !  96 0xe00
-        .long   exception_error                 !  97 0xe20
-        .long   exception_error                 !  98 0xe40
-        .long   exception_error                 !  99 0xe60
-        .long   exception_error                 ! 100 0xe80
-        .long   exception_error                 ! 101 0xea0
-        .long   exception_error                 ! 102 0xec0
-        .long   exception_error                 ! 103 0xee0
-        .long   exception_error                 ! 104 0xf00
-        .long   exception_error                 ! 105 0xf20
-        .long   exception_error                 ! 106 0xf40
-        .long   exception_error                 ! 107 0xf60
-        .long   exception_error                 ! 108 0xf80
-        .long   exception_error                 ! 109 0xfa0
-        .long   exception_error                 ! 110 0xfc0
-        .long   exception_error                 ! 111 0xfe0
-        .long   do_IRQ  ! 112 0x1000 Mailbox
-        .long   exception_error                 ! 113 0x1020
-        .long   exception_error                 ! 114 0x1040
-        .long   exception_error                 ! 115 0x1060
-        .long   exception_error                 ! 116 0x1080
-        .long   exception_error                 ! 117 0x10a0
-        .long   exception_error                 ! 118 0x10c0
-        .long   exception_error                 ! 119 0x10e0
-        .long   exception_error                 ! 120 0x1100
-        .long   exception_error                 ! 121 0x1120
-        .long   exception_error                 ! 122 0x1140
-        .long   exception_error                 ! 123 0x1160
-        .long   exception_error                 ! 124 0x1180
-        .long   exception_error                 ! 125 0x11a0
-        .long   exception_error                 ! 126 0x11c0
-        .long   exception_error                 ! 127 0x11e0
-        .long   exception_error                 ! 128 0x1200
-        .long   exception_error                 ! 129 0x1220
-        .long   exception_error                 ! 130 0x1240
-        .long   exception_error                 ! 131 0x1260
-        .long   exception_error                 ! 132 0x1280
-        .long   exception_error                 ! 133 0x12a0
-        .long   exception_error                 ! 134 0x12c0
-        .long   exception_error                 ! 135 0x12e0
-        .long   exception_error                 ! 136 0x1300
-        .long   exception_error                 ! 137 0x1320
-        .long   exception_error                 ! 138 0x1340
-        .long   exception_error                 ! 139 0x1360
-        .long   do_IRQ  ! 140 0x1380 EMPI INV_ADDR
-        .long   exception_error                 ! 141 0x13a0
-        .long   exception_error                 ! 142 0x13c0
-        .long   exception_error                 ! 143 0x13e0
-#elif defined(CONFIG_CPU_SUBTYPE_SH7770)
-        .long   do_IRQ  !  50 0x840
-        .long   do_IRQ  !  51 0x860
-        .long   do_IRQ  !  52 0x880
-        .long   do_IRQ  !  53 0x8a0
-        .long   do_IRQ  !  54 0x8c0
-        .long   do_IRQ  !  55 0x8e0
-        .long   do_IRQ  !  56 0x900
-        .long   do_IRQ  !  57 0x920
-        .long   do_IRQ  !  58 0x940
-        .long   do_IRQ  !  59 0x960
-        .long   do_IRQ  !  60 0x980
-        .long   do_IRQ  !  61 0x9a0
-        .long   do_IRQ  !  62 0x9c0
-        .long   do_IRQ  !  63 0x9e0
-        .long   do_IRQ  !  64 0xa00
-        .long   do_IRQ  !  65 0xa20
-        .long   do_IRQ  !  66 0xa4d
-        .long   do_IRQ  !  67 0xa60
-        .long   do_IRQ  !  68 0xa80
-        .long   do_IRQ  !  69 0xaa0
-        .long   do_IRQ  !  70 0xac0
-        .long   do_IRQ  !  71 0xae0
-        .long   do_IRQ  !  72 0xb00
-        .long   do_IRQ  !  73 0xb20
-        .long   do_IRQ  !  74 0xb40
-        .long   do_IRQ  !  75 0xb60
-        .long   do_IRQ  !  76 0xb80
-        .long   do_IRQ  !  77 0xba0
-        .long   do_IRQ  !  78 0xbc0
-        .long   do_IRQ  !  79 0xbe0
-        .long   do_IRQ  !  80 0xc00
-        .long   do_IRQ  !  81 0xc20
-        .long   do_IRQ  !  82 0xc40
-        .long   do_IRQ  !  83 0xc60
-        .long   do_IRQ  !  84 0xc80
-        .long   do_IRQ  !  85 0xca0
-        .long   do_IRQ  !  86 0xcc0
-        .long   do_IRQ  !  87 0xce0
-        .long   do_IRQ  !  88 0xd00
-        .long   do_IRQ  !  89 0xd20
-        .long   do_IRQ  !  90 0xd40
-        .long   do_IRQ  !  91 0xd60
-        .long   do_IRQ  !  92 0xd80
-        .long   do_IRQ  !  93 0xda0
-        .long   do_IRQ  !  94 0xdc0
-        .long   do_IRQ  !  95 0xde0
-        .long   do_IRQ  !  96 0xe00
-        .long   do_IRQ  !  97 0xe20
-        .long   do_IRQ  !  98 0xe40
-        .long   do_IRQ  !  99 0xe60
-        .long   do_IRQ  ! 100 0xe80
-        .long   do_IRQ  ! 101 0xea0
-        .long   do_IRQ  ! 102 0xec0
-        .long   do_IRQ  ! 103 0xee0
-        .long   do_IRQ  ! 104 0xf00
-        .long   do_IRQ  ! 105 0xf20
-        .long   do_IRQ  ! 106 0xf40
-        .long   do_IRQ  ! 107 0xf60
-        .long   do_IRQ  ! 108 0xf80
-#endif
-#else
-        .long   exception_error         /* 400 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! RTC   ati
-        .long   do_IRQ  !       pri
-        .long   do_IRQ  !       cui
-        .long   exception_error
-        .long   exception_error         /* 500 */
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! WDT   iti     /* 560 */
-        .long   do_IRQ  ! TMU-ch0
-        .long   do_IRQ  ! TMU-ch1
-        .long   do_IRQ  ! TMU-ch2
-        .long   do_IRQ  ! ticpi2        /* 5E0 */
-        .long   do_IRQ  ! 32 Hitachi UDI        /* 600 */
-        .long   exception_error
-        .long   do_IRQ  ! 34 DMAC dmte0
-        .long   do_IRQ  ! 35      dmte1
-        .long   do_IRQ  ! 36      dmte2
-        .long   do_IRQ  ! 37      dmte3
-        .long   do_IRQ  ! 38      dmae
-        .long   exception_error                 ! 39    /* 6E0 */
-        .long   do_IRQ  ! 40 SCIF-ch0 eri               /* 700 */
-        .long   do_IRQ  ! 41          rxi
-        .long   do_IRQ  ! 42          bri
-        .long   do_IRQ  ! 43          txi
-        .long   do_IRQ  ! 44 DMAC dmte4         /* 780 */
-        .long   do_IRQ  ! 45      dmte5
-        .long   do_IRQ  ! 46      dmte6
-        .long   do_IRQ  ! 47      dmte7         /* 7E0 */
-#if defined(CONFIG_SH_FPU)
-        .long   do_fpu_state_restore    ! 48    /* 800 */
-        .long   do_fpu_state_restore    ! 49    /* 820 */
-#else
-        .long   exception_error
-        .long   exception_error
-#endif
-        .long   exception_error                 /* 840 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! 56 CMT        /* 900 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! 60 HAC
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! PCI serr      /* A00 */
-        .long   do_IRQ  !     INTA
-        .long   do_IRQ  !     INTB
-        .long   do_IRQ  !     INTC
-        .long   do_IRQ  !     INTD
-        .long   do_IRQ  !     err
-        .long   do_IRQ  !     pwd3
-        .long   do_IRQ  !     pwd2
-        .long   do_IRQ  !     pwd1      /* B00 */
-        .long   do_IRQ  !     pwd0
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! SCIF-ch1 eri  /* B80 */
-        .long   do_IRQ  !          rxi
-        .long   do_IRQ  !          bri
-        .long   do_IRQ  !          txi
-        .long   do_IRQ  ! SIOF          /* C00 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! HSPI          /* C80 */
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! MMCIF fatat   /* D00 */
-        .long   do_IRQ  !       tran
-        .long   do_IRQ  !       err
-        .long   do_IRQ  !       frdy
-        .long   do_IRQ  ! DMAC dmint8   /* D80 */
-        .long   do_IRQ  !      dmint9
-        .long   do_IRQ  !      dmint10
-        .long   do_IRQ  !      dmint11
-        .long   do_IRQ  ! TMU-ch3       /* E00 */
-        .long   do_IRQ  ! TMU-ch4
-        .long   do_IRQ  ! TMU-ch5
-        .long   exception_error
-        .long   do_IRQ  ! SSI
-        .long   exception_error
-        .long   exception_error
-        .long   exception_error
-        .long   do_IRQ  ! FLCTL flste   /* F00 */
-        .long   do_IRQ  !       fltend
-        .long   do_IRQ  !       fltrq0
-        .long   do_IRQ  !       fltrq1
-        .long   do_IRQ  ! GPIO gpioi0   /* F80 */
-        .long   do_IRQ  !      gpioi1
-        .long   do_IRQ  !      gpioi2
-        .long   do_IRQ  !      gpioi3
-#endif
 
+        /*
+         * Pad the remainder of the table out, exceptions residing in far
+         * away offsets can be manually inserted in to their appropriate
+         * location via set_exception_table_{evt,vec}().
+         */
+        .balign 4096,0,4096
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7760.c b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
index 97f1c9af35d6..07e5377bf550 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7760.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7760.c
@@ -51,3 +51,66 @@ static int __init sh7760_devices_setup(void)
                                     ARRAY_SIZE(sh7760_devices));
 }
 __initcall(sh7760_devices_setup);
+
+/*
+ * SH7760 INTC2-Style interrupts, vectors IRQ48-111 INTEVT 0x800-0xFE0
+ */
+static struct intc2_data intc2_irq_table[] = {
+        /* INTPRIO0 | INTMSK0 */
+        {48,  0, 28, 0, 31,  3},        /* IRQ 4 */
+        {49,  0, 24, 0, 30,  3},        /* IRQ 3 */
+        {50,  0, 20, 0, 29,  3},        /* IRQ 2 */
+        {51,  0, 16, 0, 28,  3},        /* IRQ 1 */
+        /* 52-55 (INTEVT 0x880-0x8E0) unused/reserved */
+        /* INTPRIO4 | INTMSK0 */
+        {56,  4, 28, 0, 25,  3},        /* HCAN2_CHAN0 */
+        {57,  4, 24, 0, 24,  3},        /* HCAN2_CHAN1 */
+        {58,  4, 20, 0, 23,  3},        /* I2S_CHAN0   */
+        {59,  4, 16, 0, 22,  3},        /* I2S_CHAN1   */
+        {60,  4, 12, 0, 21,  3},        /* AC97_CHAN0  */
+        {61,  4,  8, 0, 20,  3},        /* AC97_CHAN1  */
+        {62,  4,  4, 0, 19,  3},        /* I2C_CHAN0   */
+        {63,  4,  0, 0, 18,  3},        /* I2C_CHAN1   */
+        /* INTPRIO8 | INTMSK0 */
+        {52,  8, 16, 0, 11,  3},        /* SCIF0_ERI_IRQ */
+        {53,  8, 16, 0, 10,  3},        /* SCIF0_RXI_IRQ */
+        {54,  8, 16, 0,  9,  3},        /* SCIF0_BRI_IRQ */
+        {55,  8, 16, 0,  8,  3},        /* SCIF0_TXI_IRQ */
+        {64,  8, 28, 0, 17,  3},        /* USBHI_IRQ */
+        {65,  8, 24, 0, 16,  3},        /* LCDC      */
+        /* 66, 67 unused */
+        {68,  8, 20, 0, 14, 13},        /* DMABRGI0_IRQ */
+        {69,  8, 20, 0, 13, 13},        /* DMABRGI1_IRQ */
+        {70,  8, 20, 0, 12, 13},        /* DMABRGI2_IRQ */
+        /* 71 unused */
+        {72,  8, 12, 0,  7,  3},        /* SCIF1_ERI_IRQ */
+        {73,  8, 12, 0,  6,  3},        /* SCIF1_RXI_IRQ */
+        {74,  8, 12, 0,  5,  3},        /* SCIF1_BRI_IRQ */
+        {75,  8, 12, 0,  4,  3},        /* SCIF1_TXI_IRQ */
+        {76,  8,  8, 0,  3,  3},        /* SCIF2_ERI_IRQ */
+        {77,  8,  8, 0,  2,  3},        /* SCIF2_RXI_IRQ */
+        {78,  8,  8, 0,  1,  3},        /* SCIF2_BRI_IRQ */
+        {79,  8,  8, 0,  0,  3},        /* SCIF2_TXI_IRQ */
+        /*          | INTMSK4 */
+        {80,  8,  4, 4, 23,  3},        /* SIM_ERI */
+        {81,  8,  4, 4, 22,  3},        /* SIM_RXI */
+        {82,  8,  4, 4, 21,  3},        /* SIM_TXI */
+        {83,  8,  4, 4, 20,  3},        /* SIM_TEI */
+        {84,  8,  0, 4, 19,  3},        /* HSPII */
+        /* INTPRIOC | INTMSK4 */
+        /* 85-87 unused/reserved */
+        {88, 12, 20, 4, 18,  3},        /* MMCI0 */
+        {89, 12, 20, 4, 17,  3},        /* MMCI1 */
+        {90, 12, 20, 4, 16,  3},        /* MMCI2 */
+        {91, 12, 20, 4, 15,  3},        /* MMCI3 */
+        {92, 12, 12, 4,  6,  3},        /* MFI (unsure, bug? in my 7760 manual*/
+        /* 93-107 reserved/undocumented */
+        {108,12,  4, 4,  1,  3},        /* ADC  */
+        {109,12,  0, 4,  0,  3},        /* CMTI */
+        /* 110-111 reserved/unused */
+};
+
+void __init init_IRQ_intc2(void)
+{
+        make_intc2_irq(intc2_irq_table, ARRAY_SIZE(intc2_irq_table));
+}
diff --git a/arch/sh/kernel/cpu/sh4/setup-sh7780.c b/arch/sh/kernel/cpu/sh4/setup-sh7780.c
index 72493f259edc..814ddb226531 100644
--- a/arch/sh/kernel/cpu/sh4/setup-sh7780.c
+++ b/arch/sh/kernel/cpu/sh4/setup-sh7780.c
@@ -77,3 +77,30 @@ static int __init sh7780_devices_setup(void)
                                     ARRAY_SIZE(sh7780_devices));
 }
 __initcall(sh7780_devices_setup);
+
+static struct intc2_data intc2_irq_table[] = {
+        { TIMER_IRQ, 0, 24, 0, INTC_TMU0_MSK, 2 },
+        { 21, 1, 0, 0, INTC_RTC_MSK, TIMER_PRIORITY },
+        { 22, 1, 1, 0, INTC_RTC_MSK, TIMER_PRIORITY },
+        { 23, 1, 2, 0, INTC_RTC_MSK, TIMER_PRIORITY },
+        { SCIF0_ERI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
+        { SCIF0_RXI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
+        { SCIF0_BRI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
+        { SCIF0_TXI_IRQ, 8, 24, 0, INTC_SCIF0_MSK, SCIF0_PRIORITY },
+
+        { SCIF1_ERI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
+        { SCIF1_RXI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
+        { SCIF1_BRI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
+        { SCIF1_TXI_IRQ, 8, 16, 0, INTC_SCIF1_MSK, SCIF1_PRIORITY },
+
+        { PCIC0_IRQ, 0x10,  8, 0, INTC_PCIC0_MSK, PCIC0_PRIORITY },
+        { PCIC1_IRQ, 0x10,  0, 0, INTC_PCIC1_MSK, PCIC1_PRIORITY },
+        { PCIC2_IRQ, 0x14, 24, 0, INTC_PCIC2_MSK, PCIC2_PRIORITY },
+        { PCIC3_IRQ, 0x14, 16, 0, INTC_PCIC3_MSK, PCIC3_PRIORITY },
+        { PCIC4_IRQ, 0x14,  8, 0, INTC_PCIC4_MSK, PCIC4_PRIORITY },
+};
+
+void __init init_IRQ_intc2(void)
+{
+        make_intc2_irq(intc2_irq_table, ARRAY_SIZE(intc2_irq_table));
+}
diff --git a/arch/sh/kernel/entry.S b/arch/sh/kernel/entry.S
index 97c571fbcdf1..39aaefb2d83f 100644
--- a/arch/sh/kernel/entry.S
+++ b/arch/sh/kernel/entry.S
@@ -1,9 +1,8 @@
-/* $Id: entry.S,v 1.37 2004/06/11 13:02:46 doyu Exp $
- *
+/*
  *  linux/arch/sh/entry.S
  *
  *  Copyright (C) 1999, 2000, 2002  Niibe Yutaka
- *  Copyright (C) 2003  Paul Mundt
+ *  Copyright (C) 2003 - 2006  Paul Mundt
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file "COPYING" in the main directory of this archive
@@ -78,7 +77,6 @@ OFF_TRA	=  (16*4+6*4)
 #define k3      r3
 #define k4      r4
 
-#define k_ex_code       r2_bank /* r2_bank1 */
 #define g_imask         r6      /* r6_bank1 */
 #define k_g_imask       r6_bank /* r6_bank1 */
 #define current         r7      /* r7_bank1 */
@@ -691,7 +689,7 @@ interrupt:
 0:
 #endif /* defined(CONFIG_KGDB_NMI) */
         bra     handle_exception
-         mov.l  @k2, k2
+         mov    #-1, k2         ! interrupt exception marker
 
         .align  2
 1:      .long   EXPEVT
@@ -717,8 +715,7 @@ ENTRY(handle_exception)
         add     current, k1
         mov     k1, r15         ! change to kernel stack
         !
-1:      mov     #-1, k4
-        mov.l   2f, k1
+1:      mov.l   2f, k1
         !
 #ifdef CONFIG_SH_DSP
         mov.l   r2, @-r15               ! Save r2, we need another reg
@@ -763,6 +760,8 @@ skip_save:
 #endif
         ! Save the user registers on the stack.
         mov.l   k2, @-r15       ! EXPEVT
+
+        mov     #-1, k4
         mov.l   k4, @-r15       ! set TRA (default: -1)
         !
         sts.l   macl, @-r15
@@ -797,8 +796,21 @@ skip_save:
         mov.l   r2, @-r15
         mov.l   r1, @-r15
         mov.l   r0, @-r15
-        ! Then, dispatch to the handler, according to the exception code.
-        stc     k_ex_code, r8
+
+        /*
+         * This gets a bit tricky.. in the INTEVT case we don't want to use
+         * the VBR offset as a destination in the jump call table, since all
+         * of the destinations are the same. In this case, (interrupt) sets
+         * a marker in r2 (now r2_bank since SR.RB changed), which we check
+         * to determine the exception type. For all other exceptions, we
+         * forcibly read EXPEVT from memory and fix up the jump address, in
+         * the interrupt exception case we jump to do_IRQ() and defer the
+         * INTEVT read until there. As a bonus, we can also clean up the SR.RB
+         * checks that do_IRQ() was doing..
+         */
+        stc     r2_bank, r8
+        cmp/pz  r8
+        bf      interrupt_exception
         shlr2   r8
         shlr    r8
         mov.l   4f, r9
@@ -806,6 +818,8 @@ skip_save:
         mov.l   @r9, r9
         jmp     @r9
          nop
+        rts
+         nop
 
         .align  2
 1:      .long   0x00001000      ! DSP=1
@@ -813,8 +827,17 @@ skip_save:
 3:      .long   0xcfffffff      ! RB=0, BL=0
 4:      .long   exception_handling_table
 
+interrupt_exception:
+        mov.l   1f, r9
+        jmp     @r9
+         nop
+        rts
+         nop
+
+        .align 2
+1:      .long   do_IRQ
+
         .align  2
 ENTRY(exception_none)
         rts
          nop
-
diff --git a/arch/sh/kernel/irq.c b/arch/sh/kernel/irq.c
index c7ebd6aec951..944128ce9706 100644
--- a/arch/sh/kernel/irq.c
+++ b/arch/sh/kernel/irq.c
@@ -11,12 +11,15 @@
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
 #include <linux/seq_file.h>
+#include <linux/io.h>
 #include <asm/irq.h>
 #include <asm/processor.h>
 #include <asm/uaccess.h>
 #include <asm/thread_info.h>
 #include <asm/cpu/mmu_context.h>
 
+atomic_t irq_err_count;
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves, it doesn't deserve
@@ -24,6 +27,7 @@
  */
 void ack_bad_irq(unsigned int irq)
 {
+        atomic_inc(&irq_err_count);
         printk("unexpected IRQ trap at vector %02x\n", irq);
 }
 
@@ -47,8 +51,10 @@ int show_interrupts(struct seq_file *p, void *v)
                 if (!action)
                         goto unlock;
                 seq_printf(p, "%3d: ",i);
-                seq_printf(p, "%10u ", kstat_irqs(i));
-                seq_printf(p, " %14s", irq_desc[i].chip->typename);
+                for_each_online_cpu(j)
+                        seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
+                seq_printf(p, " %14s", irq_desc[i].chip->name);
+                seq_printf(p, "-%-8s", irq_desc[i].name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
@@ -56,7 +62,9 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_putc(p, '\n');
 unlock:
                 spin_unlock_irqrestore(&irq_desc[i].lock, flags);
-        }
+        } else if (i == NR_IRQS)
+                seq_printf(p, "Err: %10u\n", atomic_read(&irq_err_count));
+
         return 0;
 }
 #endif
@@ -78,7 +86,8 @@ asmlinkage int do_IRQ(unsigned long r4, unsigned long r5,
                       unsigned long r6, unsigned long r7,
                       struct pt_regs regs)
 {
-        int irq = r4;
+        struct pt_regs *old_regs = set_irq_regs(&regs);
+        int irq;
 #ifdef CONFIG_4KSTACKS
         union irq_ctx *curctx, *irqctx;
 #endif
@@ -102,20 +111,9 @@ asmlinkage int do_IRQ(unsigned long r4, unsigned long r5,
 #endif
 
 #ifdef CONFIG_CPU_HAS_INTEVT
-        __asm__ __volatile__ (
-#ifdef CONFIG_CPU_HAS_SR_RB
-                "stc    r2_bank, %0\n\t"
+        irq = (ctrl_inl(INTEVT) >> 5) - 16;
 #else
-                "mov.l  @%1, %0\n\t"
-#endif
-                "shlr2  %0\n\t"
-                "shlr2  %0\n\t"
-                "shlr   %0\n\t"
-                "add    #-16, %0\n\t"
-                : "=z" (irq), "=r" (r4)
-                : "1" (INTEVT)
-                : "memory"
-        );
+        irq = r4;
 #endif
 
         irq = irq_demux(irq);
@@ -139,25 +137,25 @@ asmlinkage int do_IRQ(unsigned long r4, unsigned long r5,
 
                 __asm__ __volatile__ (
                         "mov    %0, r4          \n"
-                        "mov    %1, r5          \n"
                         "mov    r15, r9         \n"
-                        "jsr    @%2             \n"
+                        "jsr    @%1             \n"
                         /* swith to the irq stack */
-                        " mov   %3, r15         \n"
+                        " mov   %2, r15         \n"
                         /* restore the stack (ring zero) */
                         "mov    r9, r15         \n"
                         : /* no outputs */
-                        : "r" (irq), "r" (&regs), "r" (__do_IRQ), "r" (isp)
+                        : "r" (irq), "r" (generic_handle_irq), "r" (isp)
                         /* XXX: A somewhat excessive clobber list? -PFM */
                         : "memory", "r0", "r1", "r2", "r3", "r4",
                           "r5", "r6", "r7", "r8", "t", "pr"
                 );
         } else
 #endif
-                __do_IRQ(irq, &regs);
+                generic_handle_irq(irq);
 
         irq_exit();
 
+        set_irq_regs(old_regs);
         return 1;
 }
 
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index 0b1d5dd7a93b..a52b13ac6b7f 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -5,6 +5,7 @@
  *  Copyright (C) 1995  Linus Torvalds
  *
  *  SuperH version:  Copyright (C) 1999, 2000  Niibe Yutaka & Kaz Kojima
+ *                   Copyright (C) 2006 Lineo Solutions Inc. support SH4A UBC
  */
 
 /*
@@ -104,7 +105,7 @@ void show_regs(struct pt_regs * regs)
 {
         printk("\n");
         printk("Pid : %d, Comm: %20s\n", current->pid, current->comm);
-        print_symbol("PC is at %s\n", regs->pc);
+        print_symbol("PC is at %s\n", instruction_pointer(regs));
         printk("PC  : %08lx SP  : %08lx SR  : %08lx ",
                regs->pc, regs->regs[15], regs->sr);
 #ifdef CONFIG_MMU
@@ -129,15 +130,7 @@ void show_regs(struct pt_regs * regs)
         printk("MACH: %08lx MACL: %08lx GBR : %08lx PR  : %08lx\n",
                regs->mach, regs->macl, regs->gbr, regs->pr);
 
-        /*
-         * If we're in kernel mode, dump the stack too..
-         */
-        if (!user_mode(regs)) {
-                extern void show_task(unsigned long *sp);
-                unsigned long sp = regs->regs[15];
-
-                show_task((unsigned long *)sp);
-        }
+        show_trace(NULL, (unsigned long *)regs->regs[15], regs);
 }
 
 /*
@@ -290,6 +283,24 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long usp,
 static void
 ubc_set_tracing(int asid, unsigned long pc)
 {
+#if defined(CONFIG_CPU_SH4A)
+        unsigned long val;
+
+        val = (UBC_CBR_ID_INST | UBC_CBR_RW_READ | UBC_CBR_CE);
+        val |= (UBC_CBR_AIE | UBC_CBR_AIV_SET(asid));
+
+        ctrl_outl(val, UBC_CBR0);
+        ctrl_outl(pc,  UBC_CAR0);
+        ctrl_outl(0x0, UBC_CAMR0);
+        ctrl_outl(0x0, UBC_CBCR);
+
+        val = (UBC_CRR_RES | UBC_CRR_PCB | UBC_CRR_BIE);
+        ctrl_outl(val, UBC_CRR0);
+
+        /* Read UBC register that we writed last. For chekking UBC Register changed */
+        val = ctrl_inl(UBC_CRR0);
+
+#else   /* CONFIG_CPU_SH4A */
         ctrl_outl(pc, UBC_BARA);
 
 #ifdef CONFIG_MMU
@@ -307,6 +318,7 @@ ubc_set_tracing(int asid, unsigned long pc)
                 ctrl_outw(BBR_INST | BBR_READ, UBC_BBRA);
                 ctrl_outw(BRCR_PCBA, UBC_BRCR);
         }
+#endif  /* CONFIG_CPU_SH4A */
 }
 
 /*
@@ -359,8 +371,13 @@ struct task_struct *__switch_to(struct task_struct *prev, struct task_struct *ne
 #endif
                 ubc_set_tracing(asid, next->thread.ubc_pc);
         } else {
+#if defined(CONFIG_CPU_SH4A)
+                ctrl_outl(UBC_CBR_INIT, UBC_CBR0);
+                ctrl_outl(UBC_CRR_INIT, UBC_CRR0);
+#else
                 ctrl_outw(0, UBC_BBRA);
                 ctrl_outw(0, UBC_BBRB);
+#endif
         }
 
         return prev;
@@ -460,8 +477,13 @@ asmlinkage void break_point_trap(unsigned long r4, unsigned long r5,
                                  struct pt_regs regs)
 {
         /* Clear tracing.  */
+#if defined(CONFIG_CPU_SH4A)
+        ctrl_outl(UBC_CBR_INIT, UBC_CBR0);
+        ctrl_outl(UBC_CRR_INIT, UBC_CRR0);
+#else
         ctrl_outw(0, UBC_BBRA);
         ctrl_outw(0, UBC_BBRB);
+#endif
         current->thread.ubc_pc = 0;
         ubc_usercnt -= 1;
 
diff --git a/arch/sh/kernel/syscalls.S b/arch/sh/kernel/syscalls.S
index 768334e95075..ca81976e9e34 100644
--- a/arch/sh/kernel/syscalls.S
+++ b/arch/sh/kernel/syscalls.S
@@ -351,3 +351,6 @@ ENTRY(sys_call_table)
         .long sys_sync_file_range
         .long sys_tee                   /* 315 */
         .long sys_vmsplice
+        .long sys_move_pages
+        .long sys_getcpu
+        .long sys_epoll_pwait
diff --git a/arch/sh/kernel/time.c b/arch/sh/kernel/time.c
index 450c68f1df05..57e708d7b52d 100644
--- a/arch/sh/kernel/time.c
+++ b/arch/sh/kernel/time.c
@@ -47,6 +47,7 @@ unsigned long long __attribute__ ((weak)) sched_clock(void)
         return (unsigned long long)jiffies * (1000000000 / HZ);
 }
 
+#ifndef CONFIG_GENERIC_TIME
 void do_gettimeofday(struct timeval *tv)
 {
         unsigned long seq;
@@ -99,6 +100,7 @@ int do_settimeofday(struct timespec *tv)
         return 0;
 }
 EXPORT_SYMBOL(do_settimeofday);
+#endif /* !CONFIG_GENERIC_TIME */
 
 /* last time the RTC clock got updated */
 static long last_rtc_update;
@@ -107,13 +109,14 @@ static long last_rtc_update;
  * handle_timer_tick() needs to keep up the real-time clock,
  * as well as call the "do_timer()" routine every clocktick
  */
-void handle_timer_tick(struct pt_regs *regs)
+void handle_timer_tick(void)
 {
         do_timer(1);
 #ifndef CONFIG_SMP
-        update_process_times(user_mode(regs));
+        update_process_times(user_mode(get_irq_regs()));
 #endif
-        profile_tick(CPU_PROFILING, regs);
+        if (current->pid)
+                profile_tick(CPU_PROFILING);
 
 #ifdef CONFIG_HEARTBEAT
         if (sh_mv.mv_heartbeat != NULL)
diff --git a/arch/sh/kernel/timers/timer-tmu.c b/arch/sh/kernel/timers/timer-tmu.c
index 205816fcf0da..24927015dc31 100644
--- a/arch/sh/kernel/timers/timer-tmu.c
+++ b/arch/sh/kernel/timers/timer-tmu.c
@@ -80,8 +80,7 @@ static unsigned long tmu_timer_get_offset(void)
         return count;
 }
 
-static irqreturn_t tmu_timer_interrupt(int irq, void *dev_id,
-                                       struct pt_regs *regs)
+static irqreturn_t tmu_timer_interrupt(int irq, void *dummy)
 {
         unsigned long timer_status;
 
@@ -98,7 +97,7 @@ static irqreturn_t tmu_timer_interrupt(int irq, void *dev_id,
          * locally disabled. -arca
          */
         write_seqlock(&xtime_lock);
-        handle_timer_tick(regs);
+        handle_timer_tick();
         write_sequnlock(&xtime_lock);
 
         return IRQ_HANDLED;
@@ -111,60 +110,6 @@ static struct irqaction tmu_irq = {
         .mask           = CPU_MASK_NONE,
 };
 
-/*
- * Hah!  We'll see if this works (switching from usecs to nsecs).
- */
-static unsigned long tmu_timer_get_frequency(void)
-{
-        u32 freq;
-        struct timespec ts1, ts2;
-        unsigned long diff_nsec;
-        unsigned long factor;
-
-        /* Setup the timer:  We don't want to generate interrupts, just
-         * have it count down at its natural rate.
-         */
-        ctrl_outb(0, TMU_TSTR);
-#if !defined(CONFIG_CPU_SUBTYPE_SH7300) && !defined(CONFIG_CPU_SUBTYPE_SH7760)
-        ctrl_outb(TMU_TOCR_INIT, TMU_TOCR);
-#endif
-        ctrl_outw(TMU0_TCR_CALIB, TMU0_TCR);
-        ctrl_outl(0xffffffff, TMU0_TCOR);
-        ctrl_outl(0xffffffff, TMU0_TCNT);
-
-        rtc_sh_get_time(&ts2);
-
-        do {
-                rtc_sh_get_time(&ts1);
-        } while (ts1.tv_nsec == ts2.tv_nsec && ts1.tv_sec == ts2.tv_sec);
-
-        /* actually start the timer */
-        ctrl_outb(TMU_TSTR_INIT, TMU_TSTR);
-
-        do {
-                rtc_sh_get_time(&ts2);
-        } while (ts1.tv_nsec == ts2.tv_nsec && ts1.tv_sec == ts2.tv_sec);
-
-        freq = 0xffffffff - ctrl_inl(TMU0_TCNT);
-        if (ts2.tv_nsec < ts1.tv_nsec) {
-                ts2.tv_nsec += 1000000000;
-                ts2.tv_sec--;
-        }
-
-        diff_nsec = (ts2.tv_sec - ts1.tv_sec) * 1000000000 + (ts2.tv_nsec - ts1.tv_nsec);
-
-        /* this should work well if the RTC has a precision of n Hz, where
-         * n is an integer.  I don't think we have to worry about the other
-         * cases. */
-        factor = (1000000000 + diff_nsec/2) / diff_nsec;
-
-        if (factor * diff_nsec > 1100000000 ||
-            factor * diff_nsec <  900000000)
-                panic("weird RTC (diff_nsec %ld)", diff_nsec);
-
-        return freq * factor;
-}
-
 static void tmu_clk_init(struct clk *clk)
 {
         u8 divisor = TMU0_TCR_INIT & 0x7;
@@ -232,12 +177,12 @@ struct sys_timer_ops tmu_timer_ops = {
         .init           = tmu_timer_init,
         .start          = tmu_timer_start,
         .stop           = tmu_timer_stop,
-        .get_frequency  = tmu_timer_get_frequency,
+#ifndef CONFIG_GENERIC_TIME
         .get_offset     = tmu_timer_get_offset,
+#endif
 };
 
 struct sys_timer tmu_timer = {
         .name   = "tmu",
         .ops    = &tmu_timer_ops,
 };
-
diff --git a/arch/sh/kernel/traps.c b/arch/sh/kernel/traps.c
index c2c597e09482..53dfa55f3156 100644
--- a/arch/sh/kernel/traps.c
+++ b/arch/sh/kernel/traps.c
@@ -1,38 +1,25 @@
-/* $Id: traps.c,v 1.17 2004/05/02 01:46:30 sugioka Exp $
- *
- *  linux/arch/sh/traps.c
+/*
+ * 'traps.c' handles hardware traps and faults after we have saved some
+ * state in 'entry.S'.
  *
  *  SuperH version: Copyright (C) 1999 Niibe Yutaka
  *                  Copyright (C) 2000 Philipp Rumpf
  *                  Copyright (C) 2000 David Howells
- *                  Copyright (C) 2002, 2003 Paul Mundt
- */
-
-/*
- * 'Traps.c' handles hardware traps and faults after we have saved some
- * state in 'entry.S'.
+ *                  Copyright (C) 2002 - 2006 Paul Mundt
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
  */
-#include <linux/sched.h>
 #include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/errno.h>
 #include <linux/ptrace.h>
-#include <linux/timer.h>
-#include <linux/mm.h>
-#include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/init.h>
-#include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/module.h>
 #include <linux/kallsyms.h>
-
+#include <linux/io.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
-#include <asm/io.h>
-#include <asm/atomic.h>
-#include <asm/processor.h>
-#include <asm/sections.h>
 
 #ifdef CONFIG_SH_KGDB
 #include <asm/kgdb.h>
@@ -53,13 +40,32 @@
 #define TRAP_ILLEGAL_SLOT_INST  13
 #endif
 
-/*
- * These constants are for searching for possible module text
- * segments.  VMALLOC_OFFSET comes from mm/vmalloc.c; MODULE_RANGE is
- * a guess of how much space is likely to be vmalloced.
- */
-#define VMALLOC_OFFSET (8*1024*1024)
-#define MODULE_RANGE (8*1024*1024)
+static void dump_mem(const char *str, unsigned long bottom, unsigned long top)
+{
+        unsigned long p;
+        int i;
+
+        printk("%s(0x%08lx to 0x%08lx)\n", str, bottom, top);
+
+        for (p = bottom & ~31; p < top; ) {
+                printk("%04lx: ", p & 0xffff);
+
+                for (i = 0; i < 8; i++, p += 4) {
+                        unsigned int val;
+
+                        if (p < bottom || p >= top)
+                                printk("         ");
+                        else {
+                                if (__get_user(val, (unsigned int __user *)p)) {
+                                        printk("\n");
+                                        return;
+                                }
+                                printk("%08x ", val);
+                        }
+                }
+                printk("\n");
+        }
+}
 
 DEFINE_SPINLOCK(die_lock);
 
@@ -69,14 +75,28 @@ void die(const char * str, struct pt_regs * regs, long err)
 
         console_verbose();
         spin_lock_irq(&die_lock);
+        bust_spinlocks(1);
+
         printk("%s: %04lx [#%d]\n", str, err & 0xffff, ++die_counter);
+
         CHK_REMOTE_DEBUG(regs);
+        print_modules();
         show_regs(regs);
+
+        printk("Process: %s (pid: %d, stack limit = %p)\n",
+               current->comm, current->pid, task_stack_page(current) + 1);
+
+        if (!user_mode(regs) || in_interrupt())
+                dump_mem("Stack: ", regs->regs[15], THREAD_SIZE +
+                         (unsigned long)task_stack_page(current));
+
+        bust_spinlocks(0);
         spin_unlock_irq(&die_lock);
         do_exit(SIGSEGV);
 }
 
-static inline void die_if_kernel(const char * str, struct pt_regs * regs, long err)
+static inline void die_if_kernel(const char *str, struct pt_regs *regs,
+                                 long err)
 {
         if (!user_mode(regs))
                 die(str, regs, err);
@@ -93,8 +113,7 @@ static int handle_unaligned_notify_count = 10;
  */
 static int die_if_no_fixup(const char * str, struct pt_regs * regs, long err)
 {
-        if (!user_mode(regs))
-        {
+        if (!user_mode(regs)) {
                 const struct exception_table_entry *fixup;
                 fixup = search_exception_tables(regs->pc);
                 if (fixup) {
@@ -550,7 +569,10 @@ int is_dsp_inst(struct pt_regs *regs)
 #define is_dsp_inst(regs)       (0)
 #endif /* CONFIG_SH_DSP */
 
-extern int do_fpu_inst(unsigned short, struct pt_regs*);
+/* arch/sh/kernel/cpu/sh4/fpu.c */
+extern int do_fpu_inst(unsigned short, struct pt_regs *);
+extern asmlinkage void do_fpu_state_restore(unsigned long r4, unsigned long r5,
+                unsigned long r6, unsigned long r7, struct pt_regs regs);
 
 asmlinkage void do_reserved_inst(unsigned long r4, unsigned long r5,
                                 unsigned long r6, unsigned long r7,
@@ -709,14 +731,20 @@ void __init per_cpu_trap_init(void)
                      : "memory");
 }
 
-void __init trap_init(void)
+void *set_exception_table_vec(unsigned int vec, void *handler)
 {
         extern void *exception_handling_table[];
+        void *old_handler;
+        
+        old_handler = exception_handling_table[vec];
+        exception_handling_table[vec] = handler;
+        return old_handler;
+}
 
-        exception_handling_table[TRAP_RESERVED_INST]
-                = (void *)do_reserved_inst;
-        exception_handling_table[TRAP_ILLEGAL_SLOT_INST]
-                = (void *)do_illegal_slot_inst;
+void __init trap_init(void)
+{
+        set_exception_table_vec(TRAP_RESERVED_INST, do_reserved_inst);
+        set_exception_table_vec(TRAP_ILLEGAL_SLOT_INST, do_illegal_slot_inst);
 
 #if defined(CONFIG_CPU_SH4) && !defined(CONFIG_SH_FPU) || \
     defined(CONFIG_SH_FPU_EMU)
@@ -725,61 +753,54 @@ void __init trap_init(void)
          * reserved. They'll be handled in the math-emu case, or faulted on
          * otherwise.
          */
-        /* entry 64 corresponds to EXPEVT=0x800 */
-        exception_handling_table[64] = (void *)do_reserved_inst;
-        exception_handling_table[65] = (void *)do_illegal_slot_inst;
+        set_exception_table_evt(0x800, do_reserved_inst);
+        set_exception_table_evt(0x820, do_illegal_slot_inst);
+#elif defined(CONFIG_SH_FPU)
+        set_exception_table_evt(0x800, do_fpu_state_restore);
+        set_exception_table_evt(0x820, do_fpu_state_restore);
 #endif
                 
         /* Setup VBR for boot cpu */
         per_cpu_trap_init();
 }
 
-void show_stack(struct task_struct *tsk, unsigned long *sp)
+void show_trace(struct task_struct *tsk, unsigned long *sp,
+                struct pt_regs *regs)
 {
-        unsigned long *stack, addr;
-        unsigned long module_start = VMALLOC_START;
-        unsigned long module_end = VMALLOC_END;
-        int i = 1;
-
-        if (!tsk)
-                tsk = current;
-        if (tsk == current)
-                sp = (unsigned long *)current_stack_pointer;
-        else
-                sp = (unsigned long *)tsk->thread.sp;
+        unsigned long addr;
 
-        stack = sp;
+        if (regs && user_mode(regs))
+                return;
 
         printk("\nCall trace: ");
 #ifdef CONFIG_KALLSYMS
         printk("\n");
 #endif
 
-        while (!kstack_end(stack)) {
-                addr = *stack++;
-                if (((addr >= (unsigned long)_text) &&
-                     (addr <= (unsigned long)_etext)) ||
-                    ((addr >= module_start) && (addr <= module_end))) {
-                        /*
-                         * For 80-columns display, 6 entry is maximum.
-                         * NOTE: '[<8c00abcd>] ' consumes 13 columns .
-                         */
-#ifndef CONFIG_KALLSYMS
-                        if (i && ((i % 6) == 0))
-                                printk("\n       ");
-#endif
-                        printk("[<%08lx>] ", addr);
-                        print_symbol("%s\n", addr);
-                        i++;
-                }
+        while (!kstack_end(sp)) {
+                addr = *sp++;
+                if (kernel_text_address(addr))
+                        print_ip_sym(addr);
         }
 
         printk("\n");
 }
 
-void show_task(unsigned long *sp)
+void show_stack(struct task_struct *tsk, unsigned long *sp)
 {
-        show_stack(NULL, sp);
+        unsigned long stack;
+
+        if (!tsk)
+                tsk = current;
+        if (tsk == current)
+                sp = (unsigned long *)current_stack_pointer;
+        else
+                sp = (unsigned long *)tsk->thread.sp;
+
+        stack = (unsigned long)sp;
+        dump_mem("Stack: ", stack, THREAD_SIZE +
+                 (unsigned long)task_stack_page(tsk));
+        show_trace(tsk, sp, NULL);
 }
 
 void dump_stack(void)
diff --git a/arch/sh/kernel/vmlinux.lds.S b/arch/sh/kernel/vmlinux.lds.S
index 5eb930918186..77b4026d5688 100644
--- a/arch/sh/kernel/vmlinux.lds.S
+++ b/arch/sh/kernel/vmlinux.lds.S
@@ -76,13 +76,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/sh/mm/consistent.c b/arch/sh/mm/consistent.c
index c81e6b67ad30..38c82d890ffd 100644
--- a/arch/sh/mm/consistent.c
+++ b/arch/sh/mm/consistent.c
@@ -28,6 +28,7 @@ void *consistent_alloc(gfp_t gfp, size_t size, dma_addr_t *handle)
         split_page(page, order);
 
         ret = page_address(page);
+        memset(ret, 0, size);
         *handle = virt_to_phys(ret);
 
         /*
diff --git a/arch/sh64/kernel/vmlinux.lds.S b/arch/sh64/kernel/vmlinux.lds.S
index a8fcc3a71585..95c4d753e357 100644
--- a/arch/sh64/kernel/vmlinux.lds.S
+++ b/arch/sh64/kernel/vmlinux.lds.S
@@ -108,13 +108,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : C_PHYS(.initcall.init) {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 9431e967aa45..2f96610a83e9 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -289,6 +289,13 @@ endmenu
 
 source "fs/Kconfig"
 
+menu "Instrumentation Support"
+        depends on EXPERIMENTAL
+
+source "arch/sparc/oprofile/Kconfig"
+
+endmenu
+
 source "arch/sparc/Kconfig.debug"
 
 source "security/Kconfig"
diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
index 4cdbb2d59ed0..f33c3817f014 100644
--- a/arch/sparc/Makefile
+++ b/arch/sparc/Makefile
@@ -30,6 +30,8 @@ HEAD_Y := $(head-y)
 core-y += arch/sparc/kernel/ arch/sparc/mm/ arch/sparc/math-emu/
 libs-y += arch/sparc/prom/ arch/sparc/lib/
 
+drivers-$(CONFIG_OPROFILE)      += arch/sparc/oprofile/
+
 # Export what is needed by arch/sparc/boot/Makefile
 # Renaming is done to avoid confusing pattern matching rules in 2.5.45 (multy-)
 INIT_Y          := $(patsubst %/, %/built-in.o, $(init-y))
diff --git a/arch/sparc/kernel/ebus.c b/arch/sparc/kernel/ebus.c
index 75ac24d229b1..ba58c3a061fd 100644
--- a/arch/sparc/kernel/ebus.c
+++ b/arch/sparc/kernel/ebus.c
@@ -237,12 +237,12 @@ void __init fill_ebus_device(struct device_node *dp, struct linux_ebus_device *d
         dev->ofdev.node = dp;
         dev->ofdev.dev.parent = &dev->bus->ofdev.dev;
         dev->ofdev.dev.bus = &ebus_bus_type;
-        strcpy(dev->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(dev->ofdev.dev.bus_id, "ebus[%08x]", dp->node);
 
         /* Register with core */
         if (of_device_register(&dev->ofdev) != 0)
                 printk(KERN_DEBUG "ebus: device registration error for %s!\n",
-                       dev->ofdev.dev.bus_id);
+                       dp->path_component_name);
 
         if ((dp = dp->child) != NULL) {
                 dev->children = (struct linux_ebus_child *)
@@ -332,12 +332,12 @@ void __init ebus_init(void)
                 ebus->ofdev.node = dp;
                 ebus->ofdev.dev.parent = &pdev->dev;
                 ebus->ofdev.dev.bus = &ebus_bus_type;
-                strcpy(ebus->ofdev.dev.bus_id, dp->path_component_name);
+                sprintf(ebus->ofdev.dev.bus_id, "ebus%d", num_ebus);
 
                 /* Register with core */
                 if (of_device_register(&ebus->ofdev) != 0)
                         printk(KERN_DEBUG "ebus: device registration error for %s!\n",
-                               ebus->ofdev.dev.bus_id);
+                               dp->path_component_name);
 
 
                 nd = dp->child;
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index a4edff4c3be3..831f540251f8 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -32,13 +32,12 @@
 #include <asm/mxcc.h>
 #include <asm/thread_info.h>
 #include <asm/param.h>
+#include <asm/unistd.h>
 
 #include <asm/asmmacro.h>
 
 #define curptr      g6
 
-#define NR_SYSCALLS 300      /* Each OS is different... */
-
 /* These are just handy. */
 #define _SV     save    %sp, -STACKFRAME_SZ, %sp
 #define _RS     restore 
diff --git a/arch/sparc/kernel/irq.c b/arch/sparc/kernel/irq.c
index b3b6680a2a30..c8cb211b9072 100644
--- a/arch/sparc/kernel/irq.c
+++ b/arch/sparc/kernel/irq.c
@@ -351,7 +351,7 @@ void handler_irq(int irq, struct pt_regs * regs)
 }
 
 #ifdef CONFIG_BLK_DEV_FD
-extern void floppy_interrupt(int irq, void *dev_id)
+extern void floppy_interrupt(int irq, void *dev_id);
 
 void sparc_floppy_irq(int irq, void *dev_id, struct pt_regs *regs)
 {
diff --git a/arch/sparc/kernel/of_device.c b/arch/sparc/kernel/of_device.c
index 74bef2a2d37f..46200c43ffb1 100644
--- a/arch/sparc/kernel/of_device.c
+++ b/arch/sparc/kernel/of_device.c
@@ -651,7 +651,7 @@ build_resources:
         if (!parent)
                 strcpy(op->dev.bus_id, "root");
         else
-                strcpy(op->dev.bus_id, dp->path_component_name);
+                sprintf(op->dev.bus_id, "%08x", dp->node);
 
         if (of_device_register(op)) {
                 printk("%s: Could not register of device.\n",
diff --git a/arch/sparc/kernel/pcic.c b/arch/sparc/kernel/pcic.c
index b4e50ae323bf..207f1b6eef53 100644
--- a/arch/sparc/kernel/pcic.c
+++ b/arch/sparc/kernel/pcic.c
@@ -34,6 +34,7 @@
 #include <asm/pcic.h>
 #include <asm/timer.h>
 #include <asm/uaccess.h>
+#include <asm/irq_regs.h>
 
 
 unsigned int pcic_pin_to_irq(unsigned int pin, char *name);
diff --git a/arch/sparc/kernel/setup.c b/arch/sparc/kernel/setup.c
index 0251cab4708b..383526ad94fc 100644
--- a/arch/sparc/kernel/setup.c
+++ b/arch/sparc/kernel/setup.c
@@ -103,7 +103,6 @@ void prom_sync_me(void)
 
 unsigned int boot_flags __initdata = 0;
 #define BOOTME_DEBUG  0x1
-#define BOOTME_SINGLE 0x2
 
 /* Exported for mm/init.c:paging_init. */
 unsigned long cmdline_memory_size __initdata = 0;
@@ -121,16 +120,6 @@ static struct console prom_debug_console = {
         .index =        -1,
 };
 
-int obp_system_intr(void)
-{
-        if (boot_flags & BOOTME_DEBUG) {
-                printk("OBP: system interrupted\n");
-                prom_halt();
-                return 1;
-        }
-        return 0;
-}
-
 /* 
  * Process kernel command line switches that are specific to the
  * SPARC or that require special low-level processing.
@@ -142,7 +131,6 @@ static void __init process_switch(char c)
                 boot_flags |= BOOTME_DEBUG;
                 break;
         case 's':
-                boot_flags |= BOOTME_SINGLE;
                 break;
         case 'h':
                 prom_printf("boot_flags_init: Halt!\n");
diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
index 10df38eeae08..ea75ca569052 100644
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -78,7 +78,7 @@ sys_call_table:
 /*285*/ .long sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*290*/ .long sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
 /*295*/ .long sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
-/*300*/ .long sys_set_robust_list, sys_get_robust_list
+/*300*/ .long sys_set_robust_list, sys_get_robust_list, sys_migrate_pages
 
 #ifdef CONFIG_SUNOS_EMUL
         /* Now the SunOS syscall table. */
@@ -190,6 +190,7 @@ sunos_sys_table:
 /*290*/ .long sunos_nosys, sunos_nosys, sunos_nosys
         .long sunos_nosys, sunos_nosys, sunos_nosys
         .long sunos_nosys, sunos_nosys, sunos_nosys
-        .long sunos_nosys, sunos_nosys, sunos_nosys
+        .long sunos_nosys
+/*300*/ .long sunos_nosys, sunos_nosys, sunos_nosys
 
 #endif
diff --git a/arch/sparc/kernel/time.c b/arch/sparc/kernel/time.c
index 7dcd1a16c6e4..6c7aa51b590f 100644
--- a/arch/sparc/kernel/time.c
+++ b/arch/sparc/kernel/time.c
@@ -95,6 +95,8 @@ unsigned long profile_pc(struct pt_regs *regs)
         return pc;
 }
 
+EXPORT_SYMBOL(profile_pc);
+
 __volatile__ unsigned int *master_l10_counter;
 __volatile__ unsigned int *master_l10_limit;
 
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index 346c19a949fd..5cc5ff7f8824 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -36,11 +36,11 @@ SECTIONS
 
   . = ALIGN(4096);
   __init_begin = .;
+  _sinittext = .;
   .init.text : { 
-        _sinittext = .;
         *(.init.text)
-        _einittext = .;
   }
+  _einittext = .;
   __init_text_end = .;
   .init.data : { *(.init.data) }
   . = ALIGN(16);
@@ -49,13 +49,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index b27a506309ee..0df7121cef07 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -402,7 +402,7 @@ void srmmu_nocache_calcsize(void)
         srmmu_nocache_end = SRMMU_NOCACHE_VADDR + srmmu_nocache_size;
 }
 
-void srmmu_nocache_init(void)
+void __init srmmu_nocache_init(void)
 {
         unsigned int bitmap_bits;
         pgd_t *pgd;
diff --git a/arch/sparc/oprofile/Kconfig b/arch/sparc/oprofile/Kconfig
new file mode 100644
index 000000000000..d8a84088471a
--- /dev/null
+++ b/arch/sparc/oprofile/Kconfig
@@ -0,0 +1,17 @@
+config PROFILING
+        bool "Profiling support (EXPERIMENTAL)"
+        help
+          Say Y here to enable the extended profiling support mechanisms used
+          by profilers such as OProfile.
+          
+
+config OPROFILE
+        tristate "OProfile system profiling (EXPERIMENTAL)"
+        depends on PROFILING
+        help
+          OProfile is a profiling system capable of profiling the
+          whole system, include the kernel, kernel modules, libraries,
+          and applications.
+
+          If unsure, say N.
+
diff --git a/arch/sparc/oprofile/Makefile b/arch/sparc/oprofile/Makefile
new file mode 100644
index 000000000000..e9feca1ca28b
--- /dev/null
+++ b/arch/sparc/oprofile/Makefile
@@ -0,0 +1,9 @@
+obj-$(CONFIG_OPROFILE) += oprofile.o
+
+DRIVER_OBJS = $(addprefix ../../../drivers/oprofile/, \
+                oprof.o cpu_buffer.o buffer_sync.o \
+                event_buffer.o oprofile_files.o \
+                oprofilefs.o oprofile_stats.o \
+                timer_int.o )
+
+oprofile-y                              := $(DRIVER_OBJS) init.o
diff --git a/arch/sparc/oprofile/init.c b/arch/sparc/oprofile/init.c
new file mode 100644
index 000000000000..9ab815b95b5a
--- /dev/null
+++ b/arch/sparc/oprofile/init.c
@@ -0,0 +1,23 @@
+/**
+ * @file init.c
+ *
+ * @remark Copyright 2002 OProfile authors
+ * @remark Read the file COPYING
+ *
+ * @author John Levon <levon@movementarian.org>
+ */
+
+#include <linux/kernel.h>
+#include <linux/oprofile.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+ 
+int __init oprofile_arch_init(struct oprofile_operations * ops)
+{
+        return -ENODEV;
+}
+
+
+void oprofile_arch_exit(void)
+{
+}
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index dcae559879ae..2f4612fa81f2 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-rc1
-# Thu Oct  5 02:08:41 2006
+# Linux kernel version: 2.6.19-rc2
+# Tue Oct 17 19:29:20 2006
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -217,6 +217,7 @@ CONFIG_INET6_XFRM_MODE_TRANSPORT=m
 CONFIG_INET6_XFRM_MODE_TUNNEL=m
 CONFIG_INET6_XFRM_MODE_BEET=m
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=m
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
@@ -334,6 +335,12 @@ CONFIG_CDROM_PKTCDVD_WCACHE=y
 CONFIG_ATA_OVER_ETH=m
 
 #
+# Misc devices
+#
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -728,7 +735,6 @@ CONFIG_RTC=y
 # TPM devices
 #
 # CONFIG_TCG_TPM is not set
-# CONFIG_TELCLOCK is not set
 
 #
 # I2C support
@@ -842,11 +848,6 @@ CONFIG_HWMON=y
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
-# Misc devices
-#
-# CONFIG_TIFM_CORE is not set
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1104,7 +1105,6 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
-# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -1150,6 +1150,7 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1234,6 +1235,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 CONFIG_EXT3_FS_SECURITY=y
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1362,10 +1364,6 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_UTF8 is not set
 
 #
-# Distributed Lock Manager
-#
-
-#
 # Instrumentation Support
 #
 CONFIG_PROFILING=y
@@ -1399,6 +1397,7 @@ CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
diff --git a/arch/sparc64/kernel/central.c b/arch/sparc64/kernel/central.c
index b66336db00ee..e724c54af029 100644
--- a/arch/sparc64/kernel/central.c
+++ b/arch/sparc64/kernel/central.c
@@ -126,6 +126,10 @@ static void probe_other_fhcs(void)
                 int board;
                 u32 tmp;
 
+                if (dp->parent &&
+                    dp->parent->parent != NULL)
+                        continue;
+
                 fhc = (struct linux_fhc *)
                         central_alloc_bootmem(sizeof(struct linux_fhc));
                 if (fhc == NULL)
diff --git a/arch/sparc64/kernel/ebus.c b/arch/sparc64/kernel/ebus.c
index 2df25c2b4071..35bf895fdeee 100644
--- a/arch/sparc64/kernel/ebus.c
+++ b/arch/sparc64/kernel/ebus.c
@@ -389,12 +389,12 @@ static void __init fill_ebus_device(struct device_node *dp, struct linux_ebus_de
         dev->ofdev.node = dp;
         dev->ofdev.dev.parent = &dev->bus->ofdev.dev;
         dev->ofdev.dev.bus = &ebus_bus_type;
-        strcpy(dev->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(dev->ofdev.dev.bus_id, "ebus[%08x]", dp->node);
 
         /* Register with core */
         if (of_device_register(&dev->ofdev) != 0)
                 printk(KERN_DEBUG "ebus: device registration error for %s!\n",
-                       dev->ofdev.dev.bus_id);
+                       dp->path_component_name);
 
         dp = dp->child;
         if (dp) {
@@ -494,12 +494,12 @@ void __init ebus_init(void)
                 ebus->ofdev.node = dp;
                 ebus->ofdev.dev.parent = &pdev->dev;
                 ebus->ofdev.dev.bus = &ebus_bus_type;
-                strcpy(ebus->ofdev.dev.bus_id, dp->path_component_name);
+                sprintf(ebus->ofdev.dev.bus_id, "ebus%d", num_ebus);
 
                 /* Register with core */
                 if (of_device_register(&ebus->ofdev) != 0)
                         printk(KERN_DEBUG "ebus: device registration error for %s!\n",
-                               ebus->ofdev.dev.bus_id);
+                               dp->path_component_name);
 
 
                 child = dp->child;
diff --git a/arch/sparc64/kernel/entry.S b/arch/sparc64/kernel/entry.S
index 0aaa35fc5a9c..6f28bec0a9bf 100644
--- a/arch/sparc64/kernel/entry.S
+++ b/arch/sparc64/kernel/entry.S
@@ -22,11 +22,10 @@
 #include <asm/auxio.h>
 #include <asm/sfafsr.h>
 #include <asm/pil.h>
+#include <asm/unistd.h>
 
 #define curptr      g6
 
-#define NR_SYSCALLS 300      /* Each OS is different... */
-
         .text
         .align          32
 
diff --git a/arch/sparc64/kernel/isa.c b/arch/sparc64/kernel/isa.c
index 0f3aec72ef5f..f028e68b23f2 100644
--- a/arch/sparc64/kernel/isa.c
+++ b/arch/sparc64/kernel/isa.c
@@ -115,12 +115,12 @@ static void __init isa_fill_devices(struct sparc_isa_bridge *isa_br)
                 isa_dev->ofdev.node = dp;
                 isa_dev->ofdev.dev.parent = &isa_br->ofdev.dev;
                 isa_dev->ofdev.dev.bus = &isa_bus_type;
-                strcpy(isa_dev->ofdev.dev.bus_id, dp->path_component_name);
+                sprintf(isa_dev->ofdev.dev.bus_id, "isa[%08x]", dp->node);
 
                 /* Register with core */
                 if (of_device_register(&isa_dev->ofdev) != 0) {
                         printk(KERN_DEBUG "isa: device registration error for %s!\n",
-                               isa_dev->ofdev.dev.bus_id);
+                               dp->path_component_name);
                         kfree(isa_dev);
                         goto next_sibling;
                 }
@@ -191,12 +191,12 @@ void __init isa_init(void)
                 isa_br->ofdev.node = dp;
                 isa_br->ofdev.dev.parent = &pdev->dev;
                 isa_br->ofdev.dev.bus = &isa_bus_type;
-                strcpy(isa_br->ofdev.dev.bus_id, dp->path_component_name);
+                sprintf(isa_br->ofdev.dev.bus_id, "isa%d", index);
 
                 /* Register with core */
                 if (of_device_register(&isa_br->ofdev) != 0) {
                         printk(KERN_DEBUG "isa: device registration error for %s!\n",
-                               isa_br->ofdev.dev.bus_id);
+                               dp->path_component_name);
                         kfree(isa_br);
                         return;
                 }
diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c
index d822c7c18e1f..8cc14fc6b6f1 100644
--- a/arch/sparc64/kernel/of_device.c
+++ b/arch/sparc64/kernel/of_device.c
@@ -131,8 +131,13 @@ static int of_device_resume(struct device * dev)
 void __iomem *of_ioremap(struct resource *res, unsigned long offset, unsigned long size, char *name)
 {
         unsigned long ret = res->start + offset;
+        struct resource *r;
 
-        if (!request_region(ret, size, name))
+        if (res->flags & IORESOURCE_MEM)
+                r = request_mem_region(ret, size, name);
+        else
+                r = request_region(ret, size, name);
+        if (!r)
                 ret = 0;
 
         return (void __iomem *) ret;
@@ -397,16 +402,22 @@ static void of_bus_sbus_count_cells(struct device_node *child,
                 *sizec = 1;
 }
 
-static int of_bus_sbus_map(u32 *addr, const u32 *range, int na, int ns, int pna)
-{
-        return of_bus_default_map(addr, range, na, ns, pna);
-}
-
-static unsigned int of_bus_sbus_get_flags(u32 *addr)
+/*
+ * FHC/Central bus specific translator.
+ *
+ * This is just needed to hard-code the address and size cell
+ * counts.  'fhc' and 'central' nodes lack the #address-cells and
+ * #size-cells properties, and if you walk to the root on such
+ * Enterprise boxes all you'll get is a #size-cells of 2 which is
+ * not what we want to use.
+ */
+static int of_bus_fhc_match(struct device_node *np)
 {
-        return IORESOURCE_MEM;
+        return !strcmp(np->name, "fhc") ||
+                !strcmp(np->name, "central");
 }
 
+#define of_bus_fhc_count_cells of_bus_sbus_count_cells
 
 /*
  * Array of bus specific translators
@@ -428,8 +439,17 @@ static struct of_bus of_busses[] = {
                 .addr_prop_name = "reg",
                 .match = of_bus_sbus_match,
                 .count_cells = of_bus_sbus_count_cells,
-                .map = of_bus_sbus_map,
-                .get_flags = of_bus_sbus_get_flags,
+                .map = of_bus_default_map,
+                .get_flags = of_bus_default_get_flags,
+        },
+        /* FHC */
+        {
+                .name = "fhc",
+                .addr_prop_name = "reg",
+                .match = of_bus_fhc_match,
+                .count_cells = of_bus_fhc_count_cells,
+                .map = of_bus_default_map,
+                .get_flags = of_bus_default_get_flags,
         },
         /* Default */
         {
@@ -841,7 +861,7 @@ static struct of_device * __init scan_one_device(struct device_node *dp,
         if (!parent)
                 strcpy(op->dev.bus_id, "root");
         else
-                sprintf(op->dev.bus_id, "%s@%08x", dp->name, dp->node);
+                sprintf(op->dev.bus_id, "%08x", dp->node);
 
         if (of_device_register(op)) {
                 printk("%s: Could not register of device.\n",
diff --git a/arch/sparc64/kernel/pci_common.c b/arch/sparc64/kernel/pci_common.c
index 7a59cc72c844..827ae30aa497 100644
--- a/arch/sparc64/kernel/pci_common.c
+++ b/arch/sparc64/kernel/pci_common.c
@@ -330,19 +330,6 @@ __init get_device_resource(struct linux_prom_pci_registers *ap,
         return res;
 }
 
-static int __init pdev_resource_collisions_expected(struct pci_dev *pdev)
-{
-        if (pdev->vendor != PCI_VENDOR_ID_SUN)
-                return 0;
-
-        if (pdev->device == PCI_DEVICE_ID_SUN_RIO_EBUS ||
-            pdev->device == PCI_DEVICE_ID_SUN_RIO_1394 ||
-            pdev->device == PCI_DEVICE_ID_SUN_RIO_USB)
-                return 1;
-
-        return 0;
-}
-
 static void __init pdev_record_assignments(struct pci_pbm_info *pbm,
                                            struct pci_dev *pdev)
 {
@@ -400,19 +387,23 @@ static void __init pdev_record_assignments(struct pci_pbm_info *pbm,
                 pbm->parent->resource_adjust(pdev, res, root);
 
                 if (request_resource(root, res) < 0) {
+                        int rnum;
+
                         /* OK, there is some conflict.  But this is fine
                          * since we'll reassign it in the fixup pass.
                          *
-                         * We notify the user that OBP made an error if it
-                         * is a case we don't expect.
+                         * Do not print the warning for ROM resources
+                         * as such a conflict is quite common and
+                         * harmless as the ROM bar is disabled.
                          */
-                        if (!pdev_resource_collisions_expected(pdev)) {
-                                printk(KERN_ERR "PCI: Address space collision on region %ld "
+                        rnum = (res - &pdev->resource[0]);
+                        if (rnum != PCI_ROM_RESOURCE)
+                                printk(KERN_ERR "PCI: Resource collision, "
+                                       "region %d "
                                        "[%016lx:%016lx] of device %s\n",
-                                       (res - &pdev->resource[0]),
+                                       rnum,
                                        res->start, res->end,
                                        pci_name(pdev));
-                        }
                 }
         }
 }
diff --git a/arch/sparc64/kernel/pci_iommu.c b/arch/sparc64/kernel/pci_iommu.c
index 82e5455134c6..2e7f1427088a 100644
--- a/arch/sparc64/kernel/pci_iommu.c
+++ b/arch/sparc64/kernel/pci_iommu.c
@@ -281,7 +281,7 @@ static void pci_4u_free_consistent(struct pci_dev *pdev, size_t size, void *cpu,
 
         spin_lock_irqsave(&iommu->lock, flags);
 
-        free_npages(iommu, dvma, npages);
+        free_npages(iommu, dvma - iommu->page_table_map_base, npages);
 
         spin_unlock_irqrestore(&iommu->lock, flags);
 
diff --git a/arch/sparc64/kernel/pci_sabre.c b/arch/sparc64/kernel/pci_sabre.c
index 6ec569828c29..94bb681f2323 100644
--- a/arch/sparc64/kernel/pci_sabre.c
+++ b/arch/sparc64/kernel/pci_sabre.c
@@ -1196,7 +1196,7 @@ static void pbm_register_toplevel_resources(struct pci_controller_info *p,
                                             &pbm->mem_space);
 }
 
-static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp, u32 dma_begin)
+static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp, u32 dma_start, u32 dma_end)
 {
         struct pci_pbm_info *pbm;
         struct device_node *node;
@@ -1261,6 +1261,8 @@ static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp
                 node = node->sibling;
         }
         if (simbas_found == 0) {
+                struct resource *rp;
+
                 /* No APBs underneath, probably this is a hummingbird
                  * system.
                  */
@@ -1302,8 +1304,10 @@ static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp
                 pbm->io_space.end   = pbm->io_space.start + (1UL << 24) - 1UL;
                 pbm->io_space.flags = IORESOURCE_IO;
 
-                pbm->mem_space.start = p->pbm_A.controller_regs + SABRE_MEMSPACE;
-                pbm->mem_space.end   = pbm->mem_space.start + (unsigned long)dma_begin - 1UL;
+                pbm->mem_space.start =
+                        (p->pbm_A.controller_regs + SABRE_MEMSPACE);
+                pbm->mem_space.end =
+                        (pbm->mem_space.start + ((1UL << 32UL) - 1UL));
                 pbm->mem_space.flags = IORESOURCE_MEM;
 
                 if (request_resource(&ioport_resource, &pbm->io_space) < 0) {
@@ -1315,6 +1319,17 @@ static void sabre_pbm_init(struct pci_controller_info *p, struct device_node *dp
                         prom_halt();
                 }
 
+                rp = kmalloc(sizeof(*rp), GFP_KERNEL);
+                if (!rp) {
+                        prom_printf("Cannot allocate IOMMU resource.\n");
+                        prom_halt();
+                }
+                rp->name = "IOMMU";
+                rp->start = pbm->mem_space.start + (unsigned long) dma_start;
+                rp->end = pbm->mem_space.start + (unsigned long) dma_end - 1UL;
+                rp->flags = IORESOURCE_BUSY;
+                request_resource(&pbm->mem_space, rp);
+
                 pci_register_legacy_regions(&pbm->io_space,
                                             &pbm->mem_space);
         }
@@ -1450,5 +1465,5 @@ void sabre_init(struct device_node *dp, char *model_name)
         /*
          * Look for APB underneath.
          */
-        sabre_pbm_init(p, dp, vdma[0]);
+        sabre_pbm_init(p, dp, vdma[0], vdma[0] + vdma[1]);
 }
diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c
index e21cd6afa709..0917c24c4f08 100644
--- a/arch/sparc64/kernel/prom.c
+++ b/arch/sparc64/kernel/prom.c
@@ -793,7 +793,7 @@ static unsigned int schizo_irq_build(struct device_node *dp,
         return virt_irq;
 }
 
-static void schizo_irq_trans_init(struct device_node *dp)
+static void __schizo_irq_trans_init(struct device_node *dp, int is_tomatillo)
 {
         struct linux_prom64_registers *regs;
         struct schizo_irq_data *irq_data;
@@ -807,11 +807,24 @@ static void schizo_irq_trans_init(struct device_node *dp)
         dp->irq_trans->data = irq_data;
 
         irq_data->pbm_regs = regs[0].phys_addr;
-        irq_data->sync_reg = regs[3].phys_addr + 0x1a18UL;
+        if (is_tomatillo)
+                irq_data->sync_reg = regs[3].phys_addr + 0x1a18UL;
+        else
+                irq_data->sync_reg = 0UL;
         irq_data->portid = of_getintprop_default(dp, "portid", 0);
         irq_data->chip_version = of_getintprop_default(dp, "version#", 0);
 }
 
+static void schizo_irq_trans_init(struct device_node *dp)
+{
+        __schizo_irq_trans_init(dp, 0);
+}
+
+static void tomatillo_irq_trans_init(struct device_node *dp)
+{
+        __schizo_irq_trans_init(dp, 1);
+}
+
 static unsigned int pci_sun4v_irq_build(struct device_node *dp,
                                         unsigned int devino,
                                         void *_data)
@@ -1050,8 +1063,8 @@ static struct irq_trans pci_irq_trans_table[] = {
         { "pci108e,8001", schizo_irq_trans_init },
         { "SUNW,schizo+", schizo_irq_trans_init },
         { "pci108e,8002", schizo_irq_trans_init },
-        { "SUNW,tomatillo", schizo_irq_trans_init },
-        { "pci108e,a801", schizo_irq_trans_init },
+        { "SUNW,tomatillo", tomatillo_irq_trans_init },
+        { "pci108e,a801", tomatillo_irq_trans_init },
         { "SUNW,sun4v-pci", pci_sun4v_irq_trans_init },
 };
 #endif
@@ -1079,23 +1092,22 @@ static void sun4v_vdev_irq_trans_init(struct device_node *dp)
 
 static void irq_trans_init(struct device_node *dp)
 {
-        const char *model;
 #ifdef CONFIG_PCI
+        const char *model;
         int i;
 #endif
 
+#ifdef CONFIG_PCI
         model = of_get_property(dp, "model", NULL);
         if (!model)
                 model = of_get_property(dp, "compatible", NULL);
-        if (!model)
-                return;
-
-#ifdef CONFIG_PCI
-        for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
-                struct irq_trans *t = &pci_irq_trans_table[i];
+        if (model) {
+                for (i = 0; i < ARRAY_SIZE(pci_irq_trans_table); i++) {
+                        struct irq_trans *t = &pci_irq_trans_table[i];
 
-                if (!strcmp(model, t->name))
-                        return t->init(dp);
+                        if (!strcmp(model, t->name))
+                                return t->init(dp);
+                }
         }
 #endif
 #ifdef CONFIG_SBUS
@@ -1103,8 +1115,9 @@ static void irq_trans_init(struct device_node *dp)
             !strcmp(dp->name, "sbi"))
                 return sbus_irq_trans_init(dp);
 #endif
-        if (!strcmp(dp->name, "central"))
-                return central_irq_trans_init(dp->child);
+        if (!strcmp(dp->name, "fhc") &&
+            !strcmp(dp->parent->name, "central"))
+                return central_irq_trans_init(dp);
         if (!strcmp(dp->name, "virtual-devices"))
                 return sun4v_vdev_irq_trans_init(dp);
 }
@@ -1516,7 +1529,7 @@ static char * __init get_one_property(phandle node, const char *name)
         return buf;
 }
 
-static struct device_node * __init create_node(phandle node)
+static struct device_node * __init create_node(phandle node, struct device_node *parent)
 {
         struct device_node *dp;
 
@@ -1525,6 +1538,7 @@ static struct device_node * __init create_node(phandle node)
 
         dp = prom_early_alloc(sizeof(*dp));
         dp->unique_id = unique_id++;
+        dp->parent = parent;
 
         kref_init(&dp->kref);
 
@@ -1543,12 +1557,11 @@ static struct device_node * __init build_tree(struct device_node *parent, phandl
 {
         struct device_node *dp;
 
-        dp = create_node(node);
+        dp = create_node(node, parent);
         if (dp) {
                 *(*nextp) = dp;
                 *nextp = &dp->allnext;
 
-                dp->parent = parent;
                 dp->path_component_name = build_path_component(dp);
                 dp->full_name = build_full_name(dp);
 
@@ -1564,7 +1577,7 @@ void __init prom_build_devicetree(void)
 {
         struct device_node **nextp;
 
-        allnodes = create_node(prom_root_node);
+        allnodes = create_node(prom_root_node, NULL);
         allnodes->path_component_name = "";
         allnodes->full_name = "/";
 
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 958287448cfe..bf033b31d437 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -74,7 +74,6 @@ prom_console_write(struct console *con, const char *s, unsigned n)
 
 unsigned int boot_flags = 0;
 #define BOOTME_DEBUG  0x1
-#define BOOTME_SINGLE 0x2
 
 /* Exported for mm/init.c:paging_init. */
 unsigned long cmdline_memory_size = 0;
@@ -91,16 +90,6 @@ void kernel_enter_debugger(void)
 {
 }
 
-int obp_system_intr(void)
-{
-        if (boot_flags & BOOTME_DEBUG) {
-                printk("OBP: system interrupted\n");
-                prom_halt();
-                return 1;
-        }
-        return 0;
-}
-
 /* 
  * Process kernel command line switches that are specific to the
  * SPARC or that require special low-level processing.
@@ -112,7 +101,6 @@ static void __init process_switch(char c)
                 boot_flags |= BOOTME_DEBUG;
                 break;
         case 's':
-                boot_flags |= BOOTME_SINGLE;
                 break;
         case 'h':
                 prom_printf("boot_flags_init: Halt!\n");
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index 419a63fca172..9a8026797ac0 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -79,7 +79,7 @@ sys_call_table32:
         .word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
 /*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
         .word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
-/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list
+/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list, compat_sys_migrate_pages
 
 #endif /* CONFIG_COMPAT */
 
@@ -149,7 +149,7 @@ sys_call_table:
         .word sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
 /*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
         .word sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
-/*300*/ .word sys_set_robust_list, sys_get_robust_list
+/*300*/ .word sys_set_robust_list, sys_get_robust_list, sys_migrate_pages
 
 #if defined(CONFIG_SUNOS_EMUL) || defined(CONFIG_SOLARIS_EMUL) || \
     defined(CONFIG_SOLARIS_EMUL_MODULE)
@@ -262,5 +262,7 @@ sunos_sys_table:
 /*290*/ .word sunos_nosys, sunos_nosys, sunos_nosys
         .word sunos_nosys, sunos_nosys, sunos_nosys
         .word sunos_nosys, sunos_nosys, sunos_nosys
-        .word sunos_nosys, sunos_nosys, sunos_nosys
+        .word sunos_nosys
+/*300*/ .word sunos_nosys, sunos_nosys, sunos_nosys
+
 #endif
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index 68420e2dad0e..fe1796c939c3 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -87,6 +87,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p)
                        i + 1,
                        p->trapstack[i].tstate, p->trapstack[i].tpc,
                        p->trapstack[i].tnpc, p->trapstack[i].tt);
+                print_symbol("TRAPLOG: TPC<%s>\n", p->trapstack[i].tpc);
         }
 }
 
@@ -1134,6 +1135,9 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
         printk("%s" "ERROR(%d): TPC[%lx] TNPC[%lx] O7[%lx] TSTATE[%lx]\n",
                (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
                regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
+        printk("%s" "ERROR(%d): ",
+               (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
+        print_symbol("TPC<%s>\n", regs->tpc);
         printk("%s" "ERROR(%d): M_SYND(%lx),  E_SYND(%lx)%s%s\n",
                (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
                (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
@@ -1741,6 +1745,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
                        smp_processor_id(),
                        (type & 0x1) ? 'I' : 'D',
                        regs->tpc);
+                print_symbol(KERN_EMERG "TPC<%s>\n", regs->tpc);
                 panic("Irrecoverable Cheetah+ parity error.");
         }
 
@@ -1748,6 +1753,7 @@ void cheetah_plus_parity_error(int type, struct pt_regs *regs)
                smp_processor_id(),
                (type & 0x1) ? 'I' : 'D',
                regs->tpc);
+        print_symbol(KERN_WARNING "TPC<%s>\n", regs->tpc);
 }
 
 struct sun4v_error_entry {
@@ -1946,6 +1952,7 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
 
         printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
                regs->tpc, tl);
+        print_symbol(KERN_EMERG "SUN4V-ITLB: TPC<%s>\n", regs->tpc);
         printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
                "pte[%lx] error[%lx]\n",
                sun4v_err_itlb_vaddr, sun4v_err_itlb_ctx,
@@ -1966,6 +1973,7 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
 
         printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
                regs->tpc, tl);
+        print_symbol(KERN_EMERG "SUN4V-DTLB: TPC<%s>\n", regs->tpc);
         printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
                "pte[%lx] error[%lx]\n",
                sun4v_err_dtlb_vaddr, sun4v_err_dtlb_ctx,
diff --git a/arch/sparc64/kernel/vmlinux.lds.S b/arch/sparc64/kernel/vmlinux.lds.S
index b097379a49a8..bd9de8c2a2aa 100644
--- a/arch/sparc64/kernel/vmlinux.lds.S
+++ b/arch/sparc64/kernel/vmlinux.lds.S
@@ -57,13 +57,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/um/Kconfig b/arch/um/Kconfig
index d75307589d74..5ac1f2963ae3 100644
--- a/arch/um/Kconfig
+++ b/arch/um/Kconfig
@@ -1,3 +1,8 @@
+config DEFCONFIG_LIST
+        string
+        option defconfig_list
+        default "arch/$ARCH/defconfig"
+
 # UML uses the generic IRQ sugsystem
 config GENERIC_HARDIRQS
         bool
@@ -25,6 +30,19 @@ config PCI
 config PCMCIA
         bool
 
+# Yet to do!
+config TRACE_IRQFLAGS_SUPPORT
+        bool
+        default n
+
+config LOCKDEP_SUPPORT
+        bool
+        default y
+
+config STACKTRACE_SUPPORT
+        bool
+        default y
+
 config GENERIC_CALIBRATE_DELAY
         bool
         default y
@@ -37,13 +55,16 @@ config IRQ_RELEASE_METHOD
 menu "UML-specific options"
 
 config MODE_TT
-        bool "Tracing thread support"
+        bool "Tracing thread support (DEPRECATED)"
         default n
+        depends on BROKEN
         help
         This option controls whether tracing thread support is compiled
-        into UML.  This option is largely obsolete, given that skas0 provides
+        into UML. This option is largely obsolete, given that skas0 provides
         skas security and performance without needing to patch the host.
-        It is safe to say 'N' here.
+        It is safe to say 'N' here; saying 'Y' may cause additional problems
+        with the resulting binary even if you run UML in SKAS mode, and running
+        in TT mode is strongly *NOT RECOMMENDED*.
 
 config STATIC_LINK
         bool "Force a static link"
@@ -56,6 +77,9 @@ config STATIC_LINK
         for use in a chroot jail.  So, if you intend to run UML inside a
         chroot, and you disable CONFIG_MODE_TT, you probably want to say Y
         here.
+        Additionally, this option enables using higher memory spaces (up to
+        2.75G) for UML - disabling CONFIG_MODE_TT and enabling this option leads
+        to best results for this.
 
 config KERNEL_HALF_GIGS
         int "Kernel address space size (in .5G units)"
@@ -72,10 +96,13 @@ config MODE_SKAS
         default y
         help
         This option controls whether skas (separate kernel address space)
-        support is compiled in.  If you have applied the skas patch to the
-        host, then you certainly want to say Y here (and consider saying N
-        to CONFIG_MODE_TT).  Otherwise, it is safe to say Y.  Disabling this
-        option will shrink the UML binary slightly.
+        support is compiled in.
+        Unless you have specific needs to use TT mode (which applies almost only
+        to developers), you should say Y here.
+        SKAS mode will make use of the SKAS3 patch if it is applied on the host
+        (and your UML will run in SKAS3 mode), but if no SKAS patch is applied
+        on the host it will run in SKAS0 mode, which is anyway faster than TT
+        mode.
 
 source "arch/um/Kconfig.arch"
 source "mm/Kconfig"
diff --git a/arch/um/Kconfig.char b/arch/um/Kconfig.char
index 62d87b71179b..e03e40c7aac3 100644
--- a/arch/um/Kconfig.char
+++ b/arch/um/Kconfig.char
@@ -190,6 +190,11 @@ config HOSTAUDIO
         tristate
         default UML_SOUND
 
+#It is selected elsewhere, so kconfig would warn without this.
+config HW_RANDOM
+        tristate
+        default n
+
 config UML_RANDOM
         tristate "Hardware random number generator"
         help
diff --git a/arch/um/Kconfig.i386 b/arch/um/Kconfig.i386
index f6eb72d117b9..f191a550a079 100644
--- a/arch/um/Kconfig.i386
+++ b/arch/um/Kconfig.i386
@@ -16,23 +16,42 @@ config SEMAPHORE_SLEEPERS
         bool
         default y
 
-config HOST_2G_2G
-        bool "2G/2G host address space split"
-        default n
-        help
-        This is needed when the host on which you run has a 2G/2G memory
-        split, instead of the customary 3G/1G.
-
-        Note that to enable such a host
-        configuration, which makes sense only in some cases, you need special
-        host patches.
-
-        So, if you do not know what to do here, say 'N'.
+choice
+        prompt "Host memory split"
+        default HOST_VMSPLIT_3G
+        ---help---
+           This is needed when the host kernel on which you run has a non-default
+           (like 2G/2G) memory split, instead of the customary 3G/1G. If you did
+           not recompile your own kernel but use the default distro's one, you can
+           safely accept the "Default split" option.
+
+           It can be enabled on recent (>=2.6.16-rc2) vanilla kernels via
+           CONFIG_VM_SPLIT_*, or on previous kernels with special patches (-ck
+           patchset by Con Kolivas, or other ones) - option names match closely the
+           host CONFIG_VM_SPLIT_* ones.
+
+           A lower setting (where 1G/3G is lowest and 3G/1G is higher) will
+           tolerate even more "normal" host kernels, but an higher setting will be
+           stricter.
+
+           So, if you do not know what to do here, say 'Default split'.
+
+        config HOST_VMSPLIT_3G
+                bool "Default split (3G/1G user/kernel host split)"
+        config HOST_VMSPLIT_3G_OPT
+                bool "3G/1G user/kernel host split (for full 1G low memory)"
+        config HOST_VMSPLIT_2G
+                bool "2G/2G user/kernel host split"
+        config HOST_VMSPLIT_1G
+                bool "1G/3G user/kernel host split"
+endchoice
 
 config TOP_ADDR
-        hex
-        default 0xc0000000 if !HOST_2G_2G
-        default 0x80000000 if HOST_2G_2G
+        hex
+        default 0xB0000000 if HOST_VMSPLIT_3G_OPT
+        default 0x78000000 if HOST_VMSPLIT_2G
+        default 0x40000000 if HOST_VMSPLIT_1G
+        default 0xC0000000
 
 config 3_LEVEL_PGTABLES
         bool "Three-level pagetables (EXPERIMENTAL)"
diff --git a/arch/um/Makefile b/arch/um/Makefile
index c8016a98483b..5d5ed726faa0 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -64,9 +64,14 @@ CFLAGS += $(CFLAGS-y) -D__arch_um__ -DSUBARCH=\"$(SUBARCH)\"	\
 
 AFLAGS += $(ARCH_INCLUDE)
 
-USER_CFLAGS := $(patsubst -I%,,$(CFLAGS))
-USER_CFLAGS := $(patsubst -D__KERNEL__,,$(USER_CFLAGS)) $(ARCH_INCLUDE) \
-        $(MODE_INCLUDE) -D_FILE_OFFSET_BITS=64
+USER_CFLAGS = $(patsubst $(KERNEL_DEFINES),,$(patsubst -D__KERNEL__,,\
+        $(patsubst -I%,,$(CFLAGS)))) $(ARCH_INCLUDE) $(MODE_INCLUDE) \
+        -D_FILE_OFFSET_BITS=64
+
+include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
+
+#This will adjust *FLAGS accordingly to the platform.
+include $(srctree)/$(ARCH_DIR)/Makefile-os-$(OS)
 
 # -Derrno=kernel_errno - This turns all kernel references to errno into
 # kernel_errno to separate them from the libc errno.  This allows -fno-common
@@ -74,15 +79,11 @@ USER_CFLAGS := $(patsubst -D__KERNEL__,,$(USER_CFLAGS)) $(ARCH_INCLUDE) \
 # errnos.
 # These apply to kernelspace only.
 
-CFLAGS += -Derrno=kernel_errno -Dsigprocmask=kernel_sigprocmask \
-        -Dmktime=kernel_mktime
+KERNEL_DEFINES = -Derrno=kernel_errno -Dsigprocmask=kernel_sigprocmask \
+        -Dmktime=kernel_mktime $(ARCH_KERNEL_DEFINES)
+CFLAGS += $(KERNEL_DEFINES)
 CFLAGS += $(call cc-option,-fno-unit-at-a-time,)
 
-include $(srctree)/$(ARCH_DIR)/Makefile-$(SUBARCH)
-
-#This will adjust *FLAGS accordingly to the platform.
-include $(srctree)/$(ARCH_DIR)/Makefile-os-$(OS)
-
 # These are needed for clean and mrproper, since in that case .config is not
 # included; the values here are meaningless
 
diff --git a/arch/um/Makefile-i386 b/arch/um/Makefile-i386
index b65ca115ef77..c9f1c5b24c9a 100644
--- a/arch/um/Makefile-i386
+++ b/arch/um/Makefile-i386
@@ -16,7 +16,6 @@ OBJCOPYFLAGS  		:= -O binary -R .note -R .comment -S
 ifeq ("$(origin SUBARCH)", "command line")
 ifneq ("$(shell uname -m | sed -e s/i.86/i386/)", "$(SUBARCH)")
 CFLAGS                  += $(call cc-option,-m32)
-USER_CFLAGS             += $(call cc-option,-m32)
 AFLAGS                  += $(call cc-option,-m32)
 LINK-y                  += $(call cc-option,-m32)
 UML_OBJCOPYFLAGS        += -F $(ELF_FORMAT)
@@ -25,7 +24,7 @@ export LDFLAGS HOSTCFLAGS HOSTLDFLAGS UML_OBJCOPYFLAGS
 endif
 endif
 
-CFLAGS += -U__$(SUBARCH)__ -U$(SUBARCH)
+ARCH_KERNEL_DEFINES += -U__$(SUBARCH)__ -U$(SUBARCH)
 
 # First of all, tune CFLAGS for the specific CPU. This actually sets cflags-y.
 include $(srctree)/arch/i386/Makefile.cpu
@@ -38,4 +37,3 @@ cflags-y += $(call cc-option,-mpreferred-stack-boundary=2)
 cflags-y += -ffreestanding
 
 CFLAGS += $(cflags-y)
-USER_CFLAGS += $(cflags-y)
diff --git a/arch/um/Makefile-x86_64 b/arch/um/Makefile-x86_64
index 11154b6773ec..69ecea63fdae 100644
--- a/arch/um/Makefile-x86_64
+++ b/arch/um/Makefile-x86_64
@@ -1,15 +1,15 @@
 # Copyright 2003 - 2004 Pathscale, Inc
 # Released under the GPL
 
-core-y += arch/um/sys-x86_64/
+core-y += arch/um/sys-x86_64/ arch/x86_64/crypto/
 START := 0x60000000
 
-_extra_flags_ = -fno-builtin -m64 -mcmodel=kernel
+_extra_flags_ = -fno-builtin -m64
 
 #We #undef __x86_64__ for kernelspace, not for userspace where
 #it's needed for headers to work!
-CFLAGS += -U__$(SUBARCH)__ $(_extra_flags_)
-USER_CFLAGS += $(_extra_flags_)
+ARCH_KERNEL_DEFINES = -U__$(SUBARCH)__
+CFLAGS += $(_extra_flags_)
 
 CHECKFLAGS  += -m64
 AFLAGS += -m64
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index 7a5b4afde692..c6a308464acb 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -5,6 +5,7 @@
 #include "user_util.h"
 #include "os.h"
 #include "user.h"
+#include "um_malloc.h"
 
 static inline void *cow_malloc(int size)
 {
diff --git a/arch/um/drivers/daemon_user.c b/arch/um/drivers/daemon_user.c
index 77954ea77043..310af0f1e49e 100644
--- a/arch/um/drivers/daemon_user.c
+++ b/arch/um/drivers/daemon_user.c
@@ -17,6 +17,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/fd.c b/arch/um/drivers/fd.c
index 108b7dafbd0e..218aa0e9b792 100644
--- a/arch/um/drivers/fd.c
+++ b/arch/um/drivers/fd.c
@@ -12,6 +12,7 @@
 #include "user_util.h"
 #include "chan_user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct fd_chan {
         int fd;
diff --git a/arch/um/drivers/mcast_user.c b/arch/um/drivers/mcast_user.c
index 4d2bd39a85bc..8138f5ea1bf7 100644
--- a/arch/um/drivers/mcast_user.c
+++ b/arch/um/drivers/mcast_user.c
@@ -23,6 +23,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index d08bd036ccb8..7b172160fe04 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -79,7 +79,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id)
         /* long to avoid size mismatch warnings from gcc */
         long fd;
         struct mconsole_entry *new;
-        struct mc_request req;
+        static struct mc_request req;   /* that's OK */
 
         fd = (long) dev_id;
         while (mconsole_get_request(fd, &req)){
@@ -91,6 +91,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id)
                                 mconsole_reply(&req, "Out of memory", 1, 0);
                         else {
                                 new->request = req;
+                                new->request.regs = get_irq_regs()->regs;
                                 list_add(&new->list, &mc_requests);
                         }
                 }
@@ -314,9 +315,21 @@ void mconsole_stop(struct mc_request *req)
 {
         deactivate_fd(req->originating_fd, MCONSOLE_IRQ);
         os_set_fd_block(req->originating_fd, 1);
-        mconsole_reply(req, "", 0, 0);
-        while(mconsole_get_request(req->originating_fd, req)){
-                if(req->cmd->handler == mconsole_go) break;
+        mconsole_reply(req, "stopped", 0, 0);
+        while (mconsole_get_request(req->originating_fd, req)) {
+                if (req->cmd->handler == mconsole_go)
+                        break;
+                if (req->cmd->handler == mconsole_stop) {
+                        mconsole_reply(req, "Already stopped", 1, 0);
+                        continue;
+                }
+                if (req->cmd->handler == mconsole_sysrq) {
+                        struct pt_regs *old_regs;
+                        old_regs = set_irq_regs((struct pt_regs *)&req->regs);
+                        mconsole_sysrq(req);
+                        set_irq_regs(old_regs);
+                        continue;
+                }
                 (*req->cmd->handler)(req);
         }
         os_set_fd_block(req->originating_fd, 0);
@@ -673,9 +686,7 @@ static void with_console(struct mc_request *req, void (*proc)(void *),
 static void sysrq_proc(void *arg)
 {
         char *op = arg;
-        struct pt_regs *old_regs = set_irq_regs(&current->thread.regs);
         handle_sysrq(*op, NULL);
-        set_irq_regs(old_regs);
 }
 
 void mconsole_sysrq(struct mc_request *req)
diff --git a/arch/um/drivers/mconsole_user.c b/arch/um/drivers/mconsole_user.c
index 17068eb746c0..75aef6f7ef6e 100644
--- a/arch/um/drivers/mconsole_user.c
+++ b/arch/um/drivers/mconsole_user.c
@@ -14,6 +14,7 @@
 #include <sys/un.h>
 #include <unistd.h>
 #include "user.h"
+#include "sysdep/ptrace.h"
 #include "mconsole.h"
 #include "umid.h"
 #include "user_util.h"
diff --git a/arch/um/drivers/mmapper_kern.c b/arch/um/drivers/mmapper_kern.c
index 9a3b5daf6250..df3516e47d4d 100644
--- a/arch/um/drivers/mmapper_kern.c
+++ b/arch/um/drivers/mmapper_kern.c
@@ -95,7 +95,8 @@ static const struct file_operations mmapper_fops = {
         .release        = mmapper_release,
 };
 
-static const struct miscdevice mmapper_dev = {
+/* No locking needed - only used (and modified) by below initcall and exitcall. */
+static struct miscdevice mmapper_dev = {
         .minor          = MISC_DYNAMIC_MINOR,
         .name           = "mmapper",
         .fops           = &mmapper_fops
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index f3a3f8a29c7a..0ffd7ac295d4 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -18,6 +18,7 @@
 #include "kern_util.h"
 #include "net_user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 int tap_open_common(void *dev, char *gate_addr)
 {
diff --git a/arch/um/drivers/pcap_user.c b/arch/um/drivers/pcap_user.c
index 2ef641ded960..11921a7baa7b 100644
--- a/arch/um/drivers/pcap_user.c
+++ b/arch/um/drivers/pcap_user.c
@@ -12,6 +12,7 @@
 #include "net_user.h"
 #include "pcap_user.h"
 #include "user.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET (ETH_MAX_PACKET + ETH_HEADER_OTHER)
 
diff --git a/arch/um/drivers/port_user.c b/arch/um/drivers/port_user.c
index f2e8fc42ecc2..bc6afaf74c1a 100644
--- a/arch/um/drivers/port_user.c
+++ b/arch/um/drivers/port_user.c
@@ -19,6 +19,7 @@
 #include "chan_user.h"
 #include "port.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct port_chan {
         int raw;
diff --git a/arch/um/drivers/pty.c b/arch/um/drivers/pty.c
index abec620e8380..829a5eca8c07 100644
--- a/arch/um/drivers/pty.c
+++ b/arch/um/drivers/pty.c
@@ -13,6 +13,7 @@
 #include "user_util.h"
 #include "kern_util.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct pty_chan {
         void (*announce)(char *dev_name, int dev);
diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c
index 8460285c69a5..7eddacc53b6e 100644
--- a/arch/um/drivers/slip_user.c
+++ b/arch/um/drivers/slip_user.c
@@ -15,6 +15,7 @@
 #include "slip.h"
 #include "slip_common.h"
 #include "os.h"
+#include "um_malloc.h"
 
 void slip_user_init(void *data, void *dev)
 {
diff --git a/arch/um/drivers/tty.c b/arch/um/drivers/tty.c
index 11de3ac1eb5c..d95d64309eaf 100644
--- a/arch/um/drivers/tty.c
+++ b/arch/um/drivers/tty.c
@@ -11,6 +11,7 @@
 #include "user_util.h"
 #include "user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 struct tty_chan {
         char *dev;
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index bc458f57921b..49c047b75cc5 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -106,10 +106,15 @@ static inline void ubd_set_bit(__u64 bit, unsigned char *data)
 
 #define DRIVER_NAME "uml-blkdev"
 
+/* Can be taken in interrupt context, and is passed to the block layer to lock
+ * the request queue. Kernel side code knows that. */
 static DEFINE_SPINLOCK(ubd_io_lock);
-static DEFINE_SPINLOCK(ubd_lock);
 
-static void (*do_ubd)(void);
+static DEFINE_MUTEX(ubd_lock);
+
+/* XXX - this made sense in 2.4 days, now it's only used as a boolean, and
+ * probably it doesn't make sense even for that. */
+static int do_ubd;
 
 static int ubd_open(struct inode * inode, struct file * filp);
 static int ubd_release(struct inode * inode, struct file * file);
@@ -117,7 +122,7 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
                      unsigned int cmd, unsigned long arg);
 static int ubd_getgeo(struct block_device *bdev, struct hd_geometry *geo);
 
-#define MAX_DEV (8)
+#define MAX_DEV (16)
 
 static struct block_device_operations ubd_blops = {
         .owner          = THIS_MODULE,
@@ -150,8 +155,9 @@ static struct gendisk *fake_gendisk[MAX_DEV];
 static struct openflags global_openflags = OPEN_FLAGS;
 
 struct cow {
-        /* This is the backing file, actually */
+        /* backing file name */
         char *file;
+        /* backing file fd */
         int fd;
         unsigned long *bitmap;
         unsigned long bitmap_len;
@@ -160,14 +166,16 @@ struct cow {
 };
 
 struct ubd {
+        /* name (and fd, below) of the file opened for writing, either the
+         * backing or the cow file. */
         char *file;
         int count;
         int fd;
         __u64 size;
         struct openflags boot_openflags;
         struct openflags openflags;
-        int shared;
-        int no_cow;
+        unsigned shared:1;
+        unsigned no_cow:1;
         struct cow cow;
         struct platform_device pdev;
 };
@@ -192,18 +200,7 @@ struct ubd {
         .cow =                  DEFAULT_COW, \
 }
 
-struct ubd ubd_dev[MAX_DEV] = { [ 0 ... MAX_DEV - 1 ] = DEFAULT_UBD };
-
-static int ubd0_init(void)
-{
-        struct ubd *dev = &ubd_dev[0];
-
-        if(dev->file == NULL)
-                dev->file = "root_fs";
-        return(0);
-}
-
-__initcall(ubd0_init);
+struct ubd ubd_devs[MAX_DEV] = { [ 0 ... MAX_DEV - 1 ] = DEFAULT_UBD };
 
 /* Only changed by fake_ide_setup which is a setup */
 static int fake_ide = 0;
@@ -277,7 +274,7 @@ static int parse_unit(char **ptr)
                         return(-1);
                 *ptr = end;
         }
-        else if (('a' <= *str) && (*str <= 'h')) {
+        else if (('a' <= *str) && (*str <= 'z')) {
                 n = *str - 'a';
                 str++;
                 *ptr = str;
@@ -285,9 +282,13 @@ static int parse_unit(char **ptr)
         return(n);
 }
 
+/* If *index_out == -1 at exit, the passed option was a general one;
+ * otherwise, the str pointer is used (and owned) inside ubd_devs array, so it
+ * should not be freed on exit.
+ */
 static int ubd_setup_common(char *str, int *index_out)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         struct openflags flags = global_openflags;
         char *backing_file;
         int n, err, i;
@@ -311,7 +312,7 @@ static int ubd_setup_common(char *str, int *index_out)
                 }
 
                 err = 1;
-                spin_lock(&ubd_lock);
+                mutex_lock(&ubd_lock);
                 if(fake_major != MAJOR_NR){
                         printk(KERN_ERR "Can't assign a fake major twice\n");
                         goto out1;
@@ -323,7 +324,7 @@ static int ubd_setup_common(char *str, int *index_out)
                        major);
                 err = 0;
         out1:
-                spin_unlock(&ubd_lock);
+                mutex_unlock(&ubd_lock);
                 return(err);
         }
 
@@ -340,10 +341,10 @@ static int ubd_setup_common(char *str, int *index_out)
         }
 
         err = 1;
-        spin_lock(&ubd_lock);
+        mutex_lock(&ubd_lock);
 
-        dev = &ubd_dev[n];
-        if(dev->file != NULL){
+        ubd_dev = &ubd_devs[n];
+        if(ubd_dev->file != NULL){
                 printk(KERN_ERR "ubd_setup : device already configured\n");
                 goto out;
         }
@@ -360,10 +361,10 @@ static int ubd_setup_common(char *str, int *index_out)
                         flags.s = 1;
                         break;
                 case 'd':
-                        dev->no_cow = 1;
+                        ubd_dev->no_cow = 1;
                         break;
                 case 'c':
-                        dev->shared = 1;
+                        ubd_dev->shared = 1;
                         break;
                 case '=':
                         str++;
@@ -390,7 +391,7 @@ break_loop:
         }
 
         if(backing_file){
-                if(dev->no_cow)
+                if(ubd_dev->no_cow)
                         printk(KERN_ERR "Can't specify both 'd' and a "
                                "cow file\n");
                 else {
@@ -398,11 +399,11 @@ break_loop:
                         backing_file++;
                 }
         }
-        dev->file = str;
-        dev->cow.file = backing_file;
-        dev->boot_openflags = flags;
+        ubd_dev->file = str;
+        ubd_dev->cow.file = backing_file;
+        ubd_dev->boot_openflags = flags;
 out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return(err);
 }
 
@@ -472,8 +473,9 @@ int thread_fd = -1;
 
 /* Changed by ubd_handler, which is serialized because interrupts only
  * happen on CPU 0.
+ * XXX: currently unused.
  */
-int intr_count = 0;
+static int intr_count = 0;
 
 /* call ubd_finish if you need to serialize */
 static void __ubd_finish(struct request *req, int error)
@@ -493,6 +495,8 @@ static void __ubd_finish(struct request *req, int error)
         end_request(req, 1);
 }
 
+/* Callable only from interrupt context - otherwise you need to do
+ * spin_lock_irq()/spin_lock_irqsave() */
 static inline void ubd_finish(struct request *req, int error)
 {
         spin_lock(&ubd_io_lock);
@@ -500,14 +504,15 @@ static inline void ubd_finish(struct request *req, int error)
         spin_unlock(&ubd_io_lock);
 }
 
-/* Called without ubd_io_lock held */
+/* XXX - move this inside ubd_intr. */
+/* Called without ubd_io_lock held, and only in interrupt context. */
 static void ubd_handler(void)
 {
         struct io_thread_req req;
         struct request *rq = elv_next_request(ubd_queue);
         int n;
 
-        do_ubd = NULL;
+        do_ubd = 0;
         intr_count++;
         n = os_read_file(thread_fd, &req, sizeof(req));
         if(n != sizeof(req)){
@@ -521,7 +526,9 @@ static void ubd_handler(void)
 
         ubd_finish(rq, req.error);
         reactivate_fd(thread_fd, UBD_IRQ);      
+        spin_lock(&ubd_io_lock);
         do_ubd_request(ubd_queue);
+        spin_unlock(&ubd_io_lock);
 }
 
 static irqreturn_t ubd_intr(int irq, void *dev)
@@ -541,87 +548,90 @@ void kill_io_thread(void)
 
 __uml_exitcall(kill_io_thread);
 
-static int ubd_file_size(struct ubd *dev, __u64 *size_out)
+static inline int ubd_file_size(struct ubd *ubd_dev, __u64 *size_out)
 {
         char *file;
 
-        file = dev->cow.file ? dev->cow.file : dev->file;
+        file = ubd_dev->cow.file ? ubd_dev->cow.file : ubd_dev->file;
         return(os_file_size(file, size_out));
 }
 
-static void ubd_close(struct ubd *dev)
+static void ubd_close_dev(struct ubd *ubd_dev)
 {
-        os_close_file(dev->fd);
-        if(dev->cow.file == NULL)
+        os_close_file(ubd_dev->fd);
+        if(ubd_dev->cow.file == NULL)
                 return;
 
-        os_close_file(dev->cow.fd);
-        vfree(dev->cow.bitmap);
-        dev->cow.bitmap = NULL;
+        os_close_file(ubd_dev->cow.fd);
+        vfree(ubd_dev->cow.bitmap);
+        ubd_dev->cow.bitmap = NULL;
 }
 
-static int ubd_open_dev(struct ubd *dev)
+static int ubd_open_dev(struct ubd *ubd_dev)
 {
         struct openflags flags;
         char **back_ptr;
         int err, create_cow, *create_ptr;
+        int fd;
 
-        dev->openflags = dev->boot_openflags;
+        ubd_dev->openflags = ubd_dev->boot_openflags;
         create_cow = 0;
-        create_ptr = (dev->cow.file != NULL) ? &create_cow : NULL;
-        back_ptr = dev->no_cow ? NULL : &dev->cow.file;
-        dev->fd = open_ubd_file(dev->file, &dev->openflags, dev->shared,
-                                back_ptr, &dev->cow.bitmap_offset,
-                                &dev->cow.bitmap_len, &dev->cow.data_offset,
+        create_ptr = (ubd_dev->cow.file != NULL) ? &create_cow : NULL;
+        back_ptr = ubd_dev->no_cow ? NULL : &ubd_dev->cow.file;
+
+        fd = open_ubd_file(ubd_dev->file, &ubd_dev->openflags, ubd_dev->shared,
+                                back_ptr, &ubd_dev->cow.bitmap_offset,
+                                &ubd_dev->cow.bitmap_len, &ubd_dev->cow.data_offset,
                                 create_ptr);
 
-        if((dev->fd == -ENOENT) && create_cow){
-                dev->fd = create_cow_file(dev->file, dev->cow.file,
-                                          dev->openflags, 1 << 9, PAGE_SIZE,
-                                          &dev->cow.bitmap_offset,
-                                          &dev->cow.bitmap_len,
-                                          &dev->cow.data_offset);
-                if(dev->fd >= 0){
+        if((fd == -ENOENT) && create_cow){
+                fd = create_cow_file(ubd_dev->file, ubd_dev->cow.file,
+                                          ubd_dev->openflags, 1 << 9, PAGE_SIZE,
+                                          &ubd_dev->cow.bitmap_offset,
+                                          &ubd_dev->cow.bitmap_len,
+                                          &ubd_dev->cow.data_offset);
+                if(fd >= 0){
                         printk(KERN_INFO "Creating \"%s\" as COW file for "
-                               "\"%s\"\n", dev->file, dev->cow.file);
+                               "\"%s\"\n", ubd_dev->file, ubd_dev->cow.file);
                 }
         }
 
-        if(dev->fd < 0){
-                printk("Failed to open '%s', errno = %d\n", dev->file,
-                       -dev->fd);
-                return(dev->fd);
+        if(fd < 0){
+                printk("Failed to open '%s', errno = %d\n", ubd_dev->file,
+                       -fd);
+                return fd;
         }
+        ubd_dev->fd = fd;
 
-        if(dev->cow.file != NULL){
+        if(ubd_dev->cow.file != NULL){
                 err = -ENOMEM;
-                dev->cow.bitmap = (void *) vmalloc(dev->cow.bitmap_len);
-                if(dev->cow.bitmap == NULL){
+                ubd_dev->cow.bitmap = (void *) vmalloc(ubd_dev->cow.bitmap_len);
+                if(ubd_dev->cow.bitmap == NULL){
                         printk(KERN_ERR "Failed to vmalloc COW bitmap\n");
                         goto error;
                 }
                 flush_tlb_kernel_vm();
 
-                err = read_cow_bitmap(dev->fd, dev->cow.bitmap,
-                                      dev->cow.bitmap_offset,
-                                      dev->cow.bitmap_len);
+                err = read_cow_bitmap(ubd_dev->fd, ubd_dev->cow.bitmap,
+                                      ubd_dev->cow.bitmap_offset,
+                                      ubd_dev->cow.bitmap_len);
                 if(err < 0)
                         goto error;
 
-                flags = dev->openflags;
+                flags = ubd_dev->openflags;
                 flags.w = 0;
-                err = open_ubd_file(dev->cow.file, &flags, dev->shared, NULL,
+                err = open_ubd_file(ubd_dev->cow.file, &flags, ubd_dev->shared, NULL,
                                     NULL, NULL, NULL, NULL);
                 if(err < 0) goto error;
-                dev->cow.fd = err;
+                ubd_dev->cow.fd = err;
         }
         return(0);
  error:
-        os_close_file(dev->fd);
+        os_close_file(ubd_dev->fd);
         return(err);
 }
 
-static int ubd_new_disk(int major, u64 size, int unit,
+static int ubd_disk_register(int major, u64 size, int unit,
                         struct gendisk **disk_out)
                         
 {
@@ -642,13 +652,13 @@ static int ubd_new_disk(int major, u64 size, int unit,
 
         /* sysfs register (not for ide fake devices) */
         if (major == MAJOR_NR) {
-                ubd_dev[unit].pdev.id   = unit;
-                ubd_dev[unit].pdev.name = DRIVER_NAME;
-                platform_device_register(&ubd_dev[unit].pdev);
-                disk->driverfs_dev = &ubd_dev[unit].pdev.dev;
+                ubd_devs[unit].pdev.id   = unit;
+                ubd_devs[unit].pdev.name = DRIVER_NAME;
+                platform_device_register(&ubd_devs[unit].pdev);
+                disk->driverfs_dev = &ubd_devs[unit].pdev.dev;
         }
 
-        disk->private_data = &ubd_dev[unit];
+        disk->private_data = &ubd_devs[unit];
         disk->queue = ubd_queue;
         add_disk(disk);
 
@@ -660,25 +670,25 @@ static int ubd_new_disk(int major, u64 size, int unit,
 
 static int ubd_add(int n)
 {
-        struct ubd *dev = &ubd_dev[n];
+        struct ubd *ubd_dev = &ubd_devs[n];
         int err;
 
         err = -ENODEV;
-        if(dev->file == NULL)
+        if(ubd_dev->file == NULL)
                 goto out;
 
-        err = ubd_file_size(dev, &dev->size);
+        err = ubd_file_size(ubd_dev, &ubd_dev->size);
         if(err < 0)
                 goto out;
 
-        dev->size = ROUND_BLOCK(dev->size);
+        ubd_dev->size = ROUND_BLOCK(ubd_dev->size);
 
-        err = ubd_new_disk(MAJOR_NR, dev->size, n, &ubd_gendisk[n]);
+        err = ubd_disk_register(MAJOR_NR, ubd_dev->size, n, &ubd_gendisk[n]);
         if(err)
                 goto out;
 
         if(fake_major != MAJOR_NR)
-                ubd_new_disk(fake_major, dev->size, n,
+                ubd_disk_register(fake_major, ubd_dev->size, n,
                              &fake_gendisk[n]);
 
         /* perhaps this should also be under the "if (fake_major)" above */
@@ -693,32 +703,41 @@ out:
 
 static int ubd_config(char *str)
 {
-        int n, err;
+        int n, ret;
 
         str = kstrdup(str, GFP_KERNEL);
-        if(str == NULL){
+        if (str == NULL) {
                 printk(KERN_ERR "ubd_config failed to strdup string\n");
-                return(1);
+                ret = 1;
+                goto out;
         }
-        err = ubd_setup_common(str, &n);
-        if(err){
-                kfree(str);
-                return(-1);
+        ret = ubd_setup_common(str, &n);
+        if (ret) {
+                ret = -1;
+                goto err_free;
+        }
+        if (n == -1) {
+                ret = 0;
+                goto err_free;
         }
-        if(n == -1) return(0);
 
-        spin_lock(&ubd_lock);
-        err = ubd_add(n);
-        if(err)
-                ubd_dev[n].file = NULL;
-        spin_unlock(&ubd_lock);
+        mutex_lock(&ubd_lock);
+        ret = ubd_add(n);
+        if (ret)
+                ubd_devs[n].file = NULL;
+        mutex_unlock(&ubd_lock);
 
-        return(err);
+out:
+        return ret;
+
+err_free:
+        kfree(str);
+        goto out;
 }
 
 static int ubd_get_config(char *name, char *str, int size, char **error_out)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         int n, len = 0;
 
         n = parse_unit(&name);
@@ -727,24 +746,24 @@ static int ubd_get_config(char *name, char *str, int size, char **error_out)
                 return(-1);
         }
 
-        dev = &ubd_dev[n];
-        spin_lock(&ubd_lock);
+        ubd_dev = &ubd_devs[n];
+        mutex_lock(&ubd_lock);
 
-        if(dev->file == NULL){
+        if(ubd_dev->file == NULL){
                 CONFIG_CHUNK(str, size, len, "", 1);
                 goto out;
         }
 
-        CONFIG_CHUNK(str, size, len, dev->file, 0);
+        CONFIG_CHUNK(str, size, len, ubd_dev->file, 0);
 
-        if(dev->cow.file != NULL){
+        if(ubd_dev->cow.file != NULL){
                 CONFIG_CHUNK(str, size, len, ",", 0);
-                CONFIG_CHUNK(str, size, len, dev->cow.file, 1);
+                CONFIG_CHUNK(str, size, len, ubd_dev->cow.file, 1);
         }
         else CONFIG_CHUNK(str, size, len, "", 1);
 
  out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return(len);
 }
 
@@ -760,22 +779,22 @@ static int ubd_id(char **str, int *start_out, int *end_out)
 
 static int ubd_remove(int n)
 {
-        struct ubd *dev;
+        struct ubd *ubd_dev;
         int err = -ENODEV;
 
-        spin_lock(&ubd_lock);
+        mutex_lock(&ubd_lock);
 
         if(ubd_gendisk[n] == NULL)
                 goto out;
 
-        dev = &ubd_dev[n];
+        ubd_dev = &ubd_devs[n];
 
-        if(dev->file == NULL)
+        if(ubd_dev->file == NULL)
                 goto out;
 
         /* you cannot remove a open disk */
         err = -EBUSY;
-        if(dev->count > 0)
+        if(ubd_dev->count > 0)
                 goto out;
 
         del_gendisk(ubd_gendisk[n]);
@@ -788,14 +807,15 @@ static int ubd_remove(int n)
                 fake_gendisk[n] = NULL;
         }
 
-        platform_device_unregister(&dev->pdev);
-        *dev = ((struct ubd) DEFAULT_UBD);
+        platform_device_unregister(&ubd_dev->pdev);
+        *ubd_dev = ((struct ubd) DEFAULT_UBD);
         err = 0;
 out:
-        spin_unlock(&ubd_lock);
+        mutex_unlock(&ubd_lock);
         return err;
 }
 
+/* All these are called by mconsole in process context and without ubd-specific locks. */
 static struct mc_device ubd_mc = {
         .name           = "ubd",
         .config         = ubd_config,
@@ -804,7 +824,7 @@ static struct mc_device ubd_mc = {
         .remove         = ubd_remove,
 };
 
-static int ubd_mc_init(void)
+static int __init ubd_mc_init(void)
 {
         mconsole_register_dev(&ubd_mc);
         return 0;
@@ -812,13 +832,24 @@ static int ubd_mc_init(void)
 
 __initcall(ubd_mc_init);
 
+static int __init ubd0_init(void)
+{
+        struct ubd *ubd_dev = &ubd_devs[0];
+
+        if(ubd_dev->file == NULL)
+                ubd_dev->file = "root_fs";
+        return(0);
+}
+
+__initcall(ubd0_init);
+
 static struct platform_driver ubd_driver = {
         .driver = {
                 .name  = DRIVER_NAME,
         },
 };
 
-int ubd_init(void)
+static int __init ubd_init(void)
 {
         int i;
 
@@ -846,7 +877,7 @@ int ubd_init(void)
 
 late_initcall(ubd_init);
 
-int ubd_driver_init(void){
+static int __init ubd_driver_init(void){
         unsigned long stack;
         int err;
 
@@ -867,7 +898,7 @@ int ubd_driver_init(void){
                 return(0);
         }
         err = um_request_irq(UBD_IRQ, thread_fd, IRQ_READ, ubd_intr,
-                             IRQF_DISABLED, "ubd", ubd_dev);
+                             IRQF_DISABLED, "ubd", ubd_devs);
         if(err != 0)
                 printk(KERN_ERR "um_request_irq failed - errno = %d\n", -err);
         return 0;
@@ -878,24 +909,24 @@ device_initcall(ubd_driver_init);
 static int ubd_open(struct inode *inode, struct file *filp)
 {
         struct gendisk *disk = inode->i_bdev->bd_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
         int err = 0;
 
-        if(dev->count == 0){
-                err = ubd_open_dev(dev);
+        if(ubd_dev->count == 0){
+                err = ubd_open_dev(ubd_dev);
                 if(err){
                         printk(KERN_ERR "%s: Can't open \"%s\": errno = %d\n",
-                               disk->disk_name, dev->file, -err);
+                               disk->disk_name, ubd_dev->file, -err);
                         goto out;
                 }
         }
-        dev->count++;
-        set_disk_ro(disk, !dev->openflags.w);
+        ubd_dev->count++;
+        set_disk_ro(disk, !ubd_dev->openflags.w);
 
         /* This should no more be needed. And it didn't work anyway to exclude
          * read-write remounting of filesystems.*/
-        /*if((filp->f_mode & FMODE_WRITE) && !dev->openflags.w){
-                if(--dev->count == 0) ubd_close(dev);
+        /*if((filp->f_mode & FMODE_WRITE) && !ubd_dev->openflags.w){
+                if(--ubd_dev->count == 0) ubd_close_dev(ubd_dev);
                 err = -EROFS;
         }*/
  out:
@@ -905,10 +936,10 @@ static int ubd_open(struct inode *inode, struct file *filp)
 static int ubd_release(struct inode * inode, struct file * file)
 {
         struct gendisk *disk = inode->i_bdev->bd_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
 
-        if(--dev->count == 0)
-                ubd_close(dev);
+        if(--ubd_dev->count == 0)
+                ubd_close_dev(ubd_dev);
         return(0);
 }
 
@@ -976,12 +1007,12 @@ static void cowify_req(struct io_thread_req *req, unsigned long *bitmap,
 static int prepare_request(struct request *req, struct io_thread_req *io_req)
 {
         struct gendisk *disk = req->rq_disk;
-        struct ubd *dev = disk->private_data;
+        struct ubd *ubd_dev = disk->private_data;
         __u64 offset;
         int len;
 
         /* This should be impossible now */
-        if((rq_data_dir(req) == WRITE) && !dev->openflags.w){
+        if((rq_data_dir(req) == WRITE) && !ubd_dev->openflags.w){
                 printk("Write attempted on readonly ubd device %s\n",
                        disk->disk_name);
                 end_request(req, 0);
@@ -991,8 +1022,8 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
         offset = ((__u64) req->sector) << 9;
         len = req->current_nr_sectors << 9;
 
-        io_req->fds[0] = (dev->cow.file != NULL) ? dev->cow.fd : dev->fd;
-        io_req->fds[1] = dev->fd;
+        io_req->fds[0] = (ubd_dev->cow.file != NULL) ? ubd_dev->cow.fd : ubd_dev->fd;
+        io_req->fds[1] = ubd_dev->fd;
         io_req->cow_offset = -1;
         io_req->offset = offset;
         io_req->length = len;
@@ -1001,13 +1032,13 @@ static int prepare_request(struct request *req, struct io_thread_req *io_req)
 
         io_req->op = (rq_data_dir(req) == READ) ? UBD_READ : UBD_WRITE;
         io_req->offsets[0] = 0;
-        io_req->offsets[1] = dev->cow.data_offset;
+        io_req->offsets[1] = ubd_dev->cow.data_offset;
         io_req->buffer = req->buffer;
         io_req->sectorsize = 1 << 9;
 
-        if(dev->cow.file != NULL)
-                cowify_req(io_req, dev->cow.bitmap, dev->cow.bitmap_offset,
-                           dev->cow.bitmap_len);
+        if(ubd_dev->cow.file != NULL)
+                cowify_req(io_req, ubd_dev->cow.bitmap, ubd_dev->cow.bitmap_offset,
+                           ubd_dev->cow.bitmap_len);
 
         return(0);
 }
@@ -1033,7 +1064,7 @@ static void do_ubd_request(request_queue_t *q)
                         return;
                 err = prepare_request(req, &io_req);
                 if(!err){
-                        do_ubd = ubd_handler;
+                        do_ubd = 1;
                         n = os_write_file(thread_fd, (char *) &io_req,
                                          sizeof(io_req));
                         if(n != sizeof(io_req))
@@ -1045,18 +1076,18 @@ static void do_ubd_request(request_queue_t *q)
 
 static int ubd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct ubd *dev = bdev->bd_disk->private_data;
+        struct ubd *ubd_dev = bdev->bd_disk->private_data;
 
         geo->heads = 128;
         geo->sectors = 32;
-        geo->cylinders = dev->size / (128 * 32 * 512);
+        geo->cylinders = ubd_dev->size / (128 * 32 * 512);
         return 0;
 }
 
 static int ubd_ioctl(struct inode * inode, struct file * file,
                      unsigned int cmd, unsigned long arg)
 {
-        struct ubd *dev = inode->i_bdev->bd_disk->private_data;
+        struct ubd *ubd_dev = inode->i_bdev->bd_disk->private_data;
         struct hd_driveid ubd_id = {
                 .cyls           = 0,
                 .heads          = 128,
@@ -1066,7 +1097,7 @@ static int ubd_ioctl(struct inode * inode, struct file * file,
         switch (cmd) {
                 struct cdrom_volctrl volume;
         case HDIO_GET_IDENTITY:
-                ubd_id.cyls = dev->size / (128 * 32 * 512);
+                ubd_id.cyls = ubd_dev->size / (128 * 32 * 512);
                 if(copy_to_user((char __user *) arg, (char *) &ubd_id,
                                  sizeof(ubd_id)))
                         return(-EFAULT);
@@ -1353,8 +1384,8 @@ void do_io(struct io_thread_req *req)
  */
 int kernel_fd = -1;
 
-/* Only changed by the io thread */
-int io_count = 0;
+/* Only changed by the io thread. XXX: currently unused. */
+static int io_count = 0;
 
 int io_thread(void *arg)
 {
diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c
index 386f8b952982..850221d9b4c9 100644
--- a/arch/um/drivers/xterm.c
+++ b/arch/um/drivers/xterm.c
@@ -136,8 +136,6 @@ int xterm_open(int input, int output, int primary, void *d,
                 return(pid);
         }
 
-        if(data->stack == 0) free_stack(stack, 0);
-
         if (data->direct_rcv) {
                 new = os_rcv_fd(fd, &data->helper_pid);
         } else {
diff --git a/arch/um/include/common-offsets.h b/arch/um/include/common-offsets.h
index 356390d1f8b9..461175f8b1d9 100644
--- a/arch/um/include/common-offsets.h
+++ b/arch/um/include/common-offsets.h
@@ -1,9 +1,16 @@
 /* for use by sys-$SUBARCH/kernel-offsets.c */
 
+DEFINE(KERNEL_MADV_REMOVE, MADV_REMOVE);
+#ifdef CONFIG_MODE_TT
+OFFSET(HOST_TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
+#endif
+
 OFFSET(HOST_TASK_REGS, task_struct, thread.regs);
 OFFSET(HOST_TASK_PID, task_struct, pid);
+
 DEFINE(UM_KERN_PAGE_SIZE, PAGE_SIZE);
 DEFINE(UM_NSEC_PER_SEC, NSEC_PER_SEC);
+
 DEFINE_STR(UM_KERN_EMERG, KERN_EMERG);
 DEFINE_STR(UM_KERN_ALERT, KERN_ALERT);
 DEFINE_STR(UM_KERN_CRIT, KERN_CRIT);
@@ -12,6 +19,10 @@ DEFINE_STR(UM_KERN_WARNING, KERN_WARNING);
 DEFINE_STR(UM_KERN_NOTICE, KERN_NOTICE);
 DEFINE_STR(UM_KERN_INFO, KERN_INFO);
 DEFINE_STR(UM_KERN_DEBUG, KERN_DEBUG);
+
 DEFINE(UM_ELF_CLASS, ELF_CLASS);
 DEFINE(UM_ELFCLASS32, ELFCLASS32);
 DEFINE(UM_ELFCLASS64, ELFCLASS64);
+
+/* For crypto assembler code. */
+DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index 59cfa9e0cad0..cec9fcc57bf5 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -6,7 +6,6 @@
 #ifndef __KERN_UTIL_H__
 #define __KERN_UTIL_H__
 
-#include "linux/threads.h"
 #include "sysdep/ptrace.h"
 #include "sysdep/faultinfo.h"
 
diff --git a/arch/um/include/longjmp.h b/arch/um/include/longjmp.h
index e93c6d3e893b..e860bc5848e0 100644
--- a/arch/um/include/longjmp.h
+++ b/arch/um/include/longjmp.h
@@ -12,7 +12,8 @@ extern void longjmp(jmp_buf, int);
 } while(0)
 
 #define UML_SETJMP(buf) ({ \
-        int n, enable;     \
+        int n;     \
+        volatile int enable;    \
         enable = get_signals(); \
         n = setjmp(*buf); \
         if(n != 0) \
diff --git a/arch/um/include/mconsole.h b/arch/um/include/mconsole.h
index 58f67d391105..2666815b6af5 100644
--- a/arch/um/include/mconsole.h
+++ b/arch/um/include/mconsole.h
@@ -61,6 +61,7 @@ struct mc_request
 
         struct mconsole_request request;
         struct mconsole_command *cmd;
+        union uml_pt_regs regs;
 };
 
 extern char mconsole_socket_name[];
diff --git a/arch/um/include/mconsole_kern.h b/arch/um/include/mconsole_kern.h
index d0b690197fd7..1ea6d928e1cd 100644
--- a/arch/um/include/mconsole_kern.h
+++ b/arch/um/include/mconsole_kern.h
@@ -14,6 +14,7 @@ struct mconsole_entry {
         struct mc_request request;
 };
 
+/* All these methods are called in process context. */
 struct mc_device {
         struct list_head list;
         char *name;
diff --git a/arch/um/include/os.h b/arch/um/include/os.h
index 120ca21a513a..6516f6dca96d 100644
--- a/arch/um/include/os.h
+++ b/arch/um/include/os.h
@@ -201,6 +201,7 @@ extern int os_getpgrp(void);
 
 #ifdef UML_CONFIG_MODE_TT
 extern void init_new_thread_stack(void *sig_stack, void (*usr1_handler)(int));
+extern void stop(void);
 #endif
 extern void init_new_thread_signals(void);
 extern int run_kernel_thread(int (*fn)(void *), void *arg, void **jmp_ptr);
diff --git a/arch/um/include/sysdep-i386/barrier.h b/arch/um/include/sysdep-i386/barrier.h
new file mode 100644
index 000000000000..b58d52c5b2f4
--- /dev/null
+++ b/arch/um/include/sysdep-i386/barrier.h
@@ -0,0 +1,9 @@
+#ifndef __SYSDEP_I386_BARRIER_H
+#define __SYSDEP_I386_BARRIER_H
+
+/* Copied from include/asm-i386 for use by userspace.  i386 has the option
+ * of using mfence, but I'm just using this, which works everywhere, for now.
+ */
+#define mb() asm volatile("lock; addl $0,0(%esp)")
+
+#endif
diff --git a/arch/um/include/sysdep-i386/kernel-offsets.h b/arch/um/include/sysdep-i386/kernel-offsets.h
index 2c13de321f2f..97ec9d894d75 100644
--- a/arch/um/include/sysdep-i386/kernel-offsets.h
+++ b/arch/um/include/sysdep-i386/kernel-offsets.h
@@ -1,6 +1,7 @@
 #include <linux/stddef.h>
 #include <linux/sched.h>
 #include <linux/elf.h>
+#include <linux/crypto.h>
 #include <asm/mman.h>
 
 #define DEFINE(sym, val) \
@@ -17,9 +18,5 @@
 void foo(void)
 {
         OFFSET(HOST_TASK_DEBUGREGS, task_struct, thread.arch.debugregs);
-        DEFINE(KERNEL_MADV_REMOVE, MADV_REMOVE);
-#ifdef CONFIG_MODE_TT
-        OFFSET(HOST_TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
-#endif
 #include <common-offsets.h>
 }
diff --git a/arch/um/include/sysdep-x86_64/barrier.h b/arch/um/include/sysdep-x86_64/barrier.h
new file mode 100644
index 000000000000..7b610befdc8f
--- /dev/null
+++ b/arch/um/include/sysdep-x86_64/barrier.h
@@ -0,0 +1,7 @@
+#ifndef __SYSDEP_X86_64_BARRIER_H
+#define __SYSDEP_X86_64_BARRIER_H
+
+/* Copied from include/asm-x86_64 for use by userspace. */
+#define mb()    asm volatile("mfence":::"memory")
+
+#endif
diff --git a/arch/um/include/sysdep-x86_64/kernel-offsets.h b/arch/um/include/sysdep-x86_64/kernel-offsets.h
index 91d129fb3930..a307237b7964 100644
--- a/arch/um/include/sysdep-x86_64/kernel-offsets.h
+++ b/arch/um/include/sysdep-x86_64/kernel-offsets.h
@@ -2,6 +2,7 @@
 #include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/elf.h>
+#include <linux/crypto.h>
 #include <asm/page.h>
 #include <asm/mman.h>
 
@@ -18,9 +19,5 @@
 
 void foo(void)
 {
-        DEFINE(KERNEL_MADV_REMOVE, MADV_REMOVE);
-#ifdef CONFIG_MODE_TT
-        OFFSET(HOST_TASK_EXTERN_PID, task_struct, thread.mode.tt.extern_pid);
-#endif
 #include <common-offsets.h>
 }
diff --git a/arch/um/include/um_malloc.h b/arch/um/include/um_malloc.h
new file mode 100644
index 000000000000..0363a9b53f8d
--- /dev/null
+++ b/arch/um/include/um_malloc.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) 2005 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
+ * Licensed under the GPL
+ */
+
+#ifndef __UM_MALLOC_H__
+#define __UM_MALLOC_H__
+
+extern void *um_kmalloc(int size);
+extern void *um_kmalloc_atomic(int size);
+extern void kfree(const void *ptr);
+
+extern void *um_vmalloc(int size);
+extern void *um_vmalloc_atomic(int size);
+extern void vfree(void *ptr);
+
+#endif /* __UM_MALLOC_H__ */
diff --git a/arch/um/include/user.h b/arch/um/include/user.h
index 39f8c8801076..acadce3f271f 100644
--- a/arch/um/include/user.h
+++ b/arch/um/include/user.h
@@ -11,17 +11,11 @@ extern void panic(const char *fmt, ...)
 extern int printk(const char *fmt, ...)
         __attribute__ ((format (printf, 1, 2)));
 extern void schedule(void);
-extern void *um_kmalloc(int size);
-extern void *um_kmalloc_atomic(int size);
-extern void kfree(void *ptr);
 extern int in_aton(char *str);
 extern int open_gdb_chan(void);
 /* These use size_t, however unsigned long is correct on both i386 and x86_64. */
 extern unsigned long strlcpy(char *, const char *, unsigned long);
 extern unsigned long strlcat(char *, const char *, unsigned long);
-extern void *um_vmalloc(int size);
-extern void *um_vmalloc_atomic(int size);
-extern void vfree(void *ptr);
 
 #endif
 
diff --git a/arch/um/include/user_util.h b/arch/um/include/user_util.h
index 802d7842514d..06625fefef33 100644
--- a/arch/um/include/user_util.h
+++ b/arch/um/include/user_util.h
@@ -52,7 +52,6 @@ extern int linux_main(int argc, char **argv);
 extern void set_cmdline(char *cmd);
 extern void input_cb(void (*proc)(void *), void *arg, int arg_len);
 extern int get_pty(void);
-extern void *um_kmalloc(int size);
 extern int switcheroo(int fd, int prot, void *from, void *to, int size);
 extern void do_exec(int old_pid, int new_pid);
 extern void tracer_panic(char *msg, ...)
diff --git a/arch/um/kernel/dyn.lds.S b/arch/um/kernel/dyn.lds.S
index 68ed24df5c8f..e36f92b463ce 100644
--- a/arch/um/kernel/dyn.lds.S
+++ b/arch/um/kernel/dyn.lds.S
@@ -14,6 +14,7 @@ SECTIONS
    * is remapped.*/
   __binary_start = .;
   . = ALIGN(4096);              /* Init code and data */
+  _text = .;
   _stext = .;
   __init_begin = .;
   .init.text : {
diff --git a/arch/um/kernel/irq.c b/arch/um/kernel/irq.c
index ef259569fd8c..5c1e611f628d 100644
--- a/arch/um/kernel/irq.c
+++ b/arch/um/kernel/irq.c
@@ -31,6 +31,7 @@
 #include "irq_kern.h"
 #include "os.h"
 #include "sigio.h"
+#include "um_malloc.h"
 #include "misc_constants.h"
 
 /*
diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c
index fe6c64abda5b..348b272bb766 100644
--- a/arch/um/kernel/process.c
+++ b/arch/um/kernel/process.c
@@ -46,6 +46,7 @@
 #include "mode.h"
 #include "mode_kern.h"
 #include "choose-mode.h"
+#include "um_malloc.h"
 
 /* This is a per-cpu array.  A processor only modifies its entry and it only
  * cares about its entry, so it's OK if another processor is modifying its
diff --git a/arch/um/kernel/skas/mmu.c b/arch/um/kernel/skas/mmu.c
index c17eddcf89b3..2c6d090a2e87 100644
--- a/arch/um/kernel/skas/mmu.c
+++ b/arch/um/kernel/skas/mmu.c
@@ -60,10 +60,7 @@ static int init_stub_pte(struct mm_struct *mm, unsigned long proc,
 #endif
 
         *pte = mk_pte(virt_to_page(kernel), __pgprot(_PAGE_PRESENT));
-        /* This is wrong for the code page, but it doesn't matter since the
-         * stub is mapped by hand with the correct permissions.
-         */
-        *pte = pte_mkwrite(*pte);
+        *pte = pte_mkread(*pte);
         return(0);
 
  out_pmd:
diff --git a/arch/um/kernel/tt/tracer.c b/arch/um/kernel/tt/tracer.c
index 9882342206ec..b9195355075a 100644
--- a/arch/um/kernel/tt/tracer.c
+++ b/arch/um/kernel/tt/tracer.c
@@ -176,7 +176,6 @@ struct {
 int signal_index[32];
 int nsignals = 0;
 int debug_trace = 0;
-extern int io_nsignals, io_count, intr_count;
 
 extern void signal_usr1(int sig);
 
diff --git a/arch/um/kernel/tt/uaccess_user.c b/arch/um/kernel/tt/uaccess_user.c
index 6c92bbccb49c..ed1abcf4d057 100644
--- a/arch/um/kernel/tt/uaccess_user.c
+++ b/arch/um/kernel/tt/uaccess_user.c
@@ -4,13 +4,13 @@
  * Licensed under the GPL
  */
 
-#include <setjmp.h>
 #include <string.h>
 #include "user_util.h"
 #include "uml_uaccess.h"
 #include "task.h"
 #include "kern_util.h"
 #include "os.h"
+#include "longjmp.h"
 
 int __do_copy_from_user(void *to, const void *from, int n,
                         void **fault_addr, void **fault_catcher)
@@ -80,10 +80,10 @@ int __do_strnlen_user(const char *str, unsigned long n,
         struct tt_regs save = TASK_REGS(get_current())->tt;
         int ret;
         unsigned long *faddrp = (unsigned long *)fault_addr;
-        sigjmp_buf jbuf;
+        jmp_buf jbuf;
 
         *fault_catcher = &jbuf;
-        if(sigsetjmp(jbuf, 1) == 0)
+        if(UML_SETJMP(&jbuf) == 0)
                 ret = strlen(str) + 1;
         else ret = *faddrp - (unsigned long) str;
 
diff --git a/arch/um/kernel/uml.lds.S b/arch/um/kernel/uml.lds.S
index 8eca47a6ff08..f6301274cf3c 100644
--- a/arch/um/kernel/uml.lds.S
+++ b/arch/um/kernel/uml.lds.S
@@ -25,6 +25,7 @@ SECTIONS
   . = ALIGN(4096);              /* Init code and data */
 #endif
 
+  _text = .;
   _stext = .;
   __init_begin = .;
   .init.text : {
diff --git a/arch/um/os-Linux/drivers/ethertap_user.c b/arch/um/os-Linux/drivers/ethertap_user.c
index f559bdf746e6..863981ba1468 100644
--- a/arch/um/os-Linux/drivers/ethertap_user.c
+++ b/arch/um/os-Linux/drivers/ethertap_user.c
@@ -20,6 +20,7 @@
 #include "net_user.h"
 #include "etap.h"
 #include "os.h"
+#include "um_malloc.h"
 
 #define MAX_PACKET ETH_MAX_PACKET
 
diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index cd15b9df5b5c..d13299cfa318 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c
@@ -35,22 +35,23 @@ static int helper_child(void *arg)
         char **argv = data->argv;
         int errval;
 
-        if(helper_pause){
+        if (helper_pause){
                 signal(SIGHUP, helper_hup);
                 pause();
         }
-        if(data->pre_exec != NULL)
+        if (data->pre_exec != NULL)
                 (*data->pre_exec)(data->pre_data);
         execvp(argv[0], argv);
         errval = -errno;
         printk("helper_child - execve of '%s' failed - errno = %d\n", argv[0], errno);
         os_write_file(data->fd, &errval, sizeof(errval));
         kill(os_getpid(), SIGKILL);
-        return(0);
+        return 0;
 }
 
 /* Returns either the pid of the child process we run or -E* on failure.
- * XXX The alloc_stack here breaks if this is called in the tracing thread */
+ * XXX The alloc_stack here breaks if this is called in the tracing thread, so
+ * we need to receive a preallocated stack (a local buffer is ok). */
 int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
                unsigned long *stack_out)
 {
@@ -58,20 +59,21 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         unsigned long stack, sp;
         int pid, fds[2], ret, n;
 
-        if((stack_out != NULL) && (*stack_out != 0))
+        if ((stack_out != NULL) && (*stack_out != 0))
                 stack = *stack_out;
-        else stack = alloc_stack(0, __cant_sleep());
-        if(stack == 0)
+        else
+                stack = alloc_stack(0, __cant_sleep());
+        if (stack == 0)
                 return -ENOMEM;
 
         ret = os_pipe(fds, 1, 0);
-        if(ret < 0){
+        if (ret < 0) {
                 printk("run_helper : pipe failed, ret = %d\n", -ret);
                 goto out_free;
         }
 
         ret = os_set_exec_close(fds[1], 1);
-        if(ret < 0){
+        if (ret < 0) {
                 printk("run_helper : setting FD_CLOEXEC failed, ret = %d\n",
                        -ret);
                 goto out_close;
@@ -83,7 +85,7 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         data.argv = argv;
         data.fd = fds[1];
         pid = clone(helper_child, (void *) sp, CLONE_VM | SIGCHLD, &data);
-        if(pid < 0){
+        if (pid < 0) {
                 ret = -errno;
                 printk("run_helper : clone failed, errno = %d\n", errno);
                 goto out_close;
@@ -95,10 +97,10 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         /* Read the errno value from the child, if the exec failed, or get 0 if
          * the exec succeeded because the pipe fd was set as close-on-exec. */
         n = os_read_file(fds[0], &ret, sizeof(ret));
-        if(n == 0)
+        if (n == 0) {
                 ret = pid;
-        else {
-                if(n < 0){
+        } else {
+                if (n < 0) {
                         printk("run_helper : read on pipe failed, ret = %d\n",
                                -n);
                         ret = n;
@@ -112,10 +114,9 @@ out_close:
                 close(fds[1]);
         close(fds[0]);
 out_free:
-        if(stack_out == NULL)
+        if ((stack_out == NULL) || (*stack_out == 0))
                 free_stack(stack, 0);
-        else *stack_out = stack;
-        return(ret);
+        return ret;
 }
 
 int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
@@ -125,31 +126,32 @@ int run_helper_thread(int (*proc)(void *), void *arg, unsigned int flags,
         int pid, status, err;
 
         stack = alloc_stack(stack_order, __cant_sleep());
-        if(stack == 0) return(-ENOMEM);
+        if (stack == 0)
+                return -ENOMEM;
 
         sp = stack + (page_size() << stack_order) - sizeof(void *);
         pid = clone(proc, (void *) sp, flags | SIGCHLD, arg);
-        if(pid < 0){
+        if (pid < 0) {
                 err = -errno;
                 printk("run_helper_thread : clone failed, errno = %d\n",
                        errno);
                 return err;
         }
-        if(stack_out == NULL){
+        if (stack_out == NULL) {
                 CATCH_EINTR(pid = waitpid(pid, &status, 0));
-                if(pid < 0){
+                if (pid < 0) {
                         err = -errno;
                         printk("run_helper_thread - wait failed, errno = %d\n",
                                errno);
                         pid = err;
                 }
-                if(!WIFEXITED(status) || (WEXITSTATUS(status) != 0))
+                if (!WIFEXITED(status) || (WEXITSTATUS(status) != 0))
                         printk("run_helper_thread - thread returned status "
                                "0x%x\n", status);
                 free_stack(stack, stack_order);
-        }
-        else *stack_out = stack;
-        return(pid);
+        } else
+                *stack_out = stack;
+        return pid;
 }
 
 int helper_wait(int pid)
@@ -157,9 +159,9 @@ int helper_wait(int pid)
         int ret;
 
         CATCH_EINTR(ret = waitpid(pid, NULL, WNOHANG));
-        if(ret < 0){
+        if (ret < 0) {
                 ret = -errno;
                 printk("helper_wait : waitpid failed, errno = %d\n", errno);
         }
-        return(ret);
+        return ret;
 }
diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c
index a97206df5b52..d46b818c1311 100644
--- a/arch/um/os-Linux/irq.c
+++ b/arch/um/os-Linux/irq.c
@@ -18,6 +18,7 @@
 #include "sigio.h"
 #include "irq_user.h"
 #include "os.h"
+#include "um_malloc.h"
 
 static struct pollfd *pollfds = NULL;
 static int pollfds_num = 0;
diff --git a/arch/um/os-Linux/main.c b/arch/um/os-Linux/main.c
index d1c5670787dc..685feaab65d2 100644
--- a/arch/um/os-Linux/main.c
+++ b/arch/um/os-Linux/main.c
@@ -23,6 +23,7 @@
 #include "choose-mode.h"
 #include "uml-config.h"
 #include "os.h"
+#include "um_malloc.h"
 
 /* Set in set_stklim, which is called from main and __wrap_malloc.
  * __wrap_malloc only calls it if main hasn't started.
diff --git a/arch/um/os-Linux/process.c b/arch/um/os-Linux/process.c
index 51f0893640a6..c692a192957a 100644
--- a/arch/um/os-Linux/process.c
+++ b/arch/um/os-Linux/process.c
@@ -7,7 +7,6 @@
 #include <stdio.h>
 #include <errno.h>
 #include <signal.h>
-#include <linux/unistd.h>
 #include <sys/mman.h>
 #include <sys/wait.h>
 #include <sys/mman.h>
diff --git a/arch/um/os-Linux/sigio.c b/arch/um/os-Linux/sigio.c
index f6457765b17d..925a65240cfe 100644
--- a/arch/um/os-Linux/sigio.c
+++ b/arch/um/os-Linux/sigio.c
@@ -19,6 +19,7 @@
 #include "user_util.h"
 #include "sigio.h"
 #include "os.h"
+#include "um_malloc.h"
 
 /* Protected by sigio_lock(), also used by sigio_cleanup, which is an
  * exitcall.
diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c
index 6b81739279d1..b897e8592d77 100644
--- a/arch/um/os-Linux/signal.c
+++ b/arch/um/os-Linux/signal.c
@@ -15,6 +15,7 @@
 #include "user.h"
 #include "signal_kern.h"
 #include "sysdep/sigcontext.h"
+#include "sysdep/barrier.h"
 #include "sigcontext.h"
 #include "mode.h"
 #include "os.h"
@@ -34,8 +35,12 @@
 #define SIGALRM_BIT 2
 #define SIGALRM_MASK (1 << SIGALRM_BIT)
 
-static int signals_enabled = 1;
-static int pending = 0;
+/* These are used by both the signal handlers and
+ * block/unblock_signals.  I don't want modifications cached in a
+ * register - they must go straight to memory.
+ */
+static volatile int signals_enabled = 1;
+static volatile int pending = 0;
 
 void sig_handler(int sig, struct sigcontext *sc)
 {
@@ -152,6 +157,12 @@ int change_sig(int signal, int on)
 void block_signals(void)
 {
         signals_enabled = 0;
+        /* This must return with signals disabled, so this barrier
+         * ensures that writes are flushed out before the return.
+         * This might matter if gcc figures out how to inline this and
+         * decides to shuffle this code into the caller.
+         */
+        mb();
 }
 
 void unblock_signals(void)
@@ -171,9 +182,23 @@ void unblock_signals(void)
                  */
                 signals_enabled = 1;
 
+                /* Setting signals_enabled and reading pending must
+                 * happen in this order.
+                 */
+                mb();
+
                 save_pending = pending;
-                if(save_pending == 0)
+                if(save_pending == 0){
+                        /* This must return with signals enabled, so
+                         * this barrier ensures that writes are
+                         * flushed out before the return.  This might
+                         * matter if gcc figures out how to inline
+                         * this (unlikely, given its size) and decides
+                         * to shuffle this code into the caller.
+                         */
+                        mb();
                         return;
+                }
 
                 pending = 0;
 
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index cb9ab54146cc..9b34fe65949a 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -14,7 +14,7 @@
 #include <sys/mman.h>
 #include <sys/user.h>
 #include <sys/time.h>
-#include <asm/unistd.h>
+#include <sys/syscall.h>
 #include <asm/types.h>
 #include "user.h"
 #include "sysdep/ptrace.h"
diff --git a/arch/um/os-Linux/sys-i386/tls.c b/arch/um/os-Linux/sys-i386/tls.c
index 6e945ab45843..256532034c62 100644
--- a/arch/um/os-Linux/sys-i386/tls.c
+++ b/arch/um/os-Linux/sys-i386/tls.c
@@ -1,6 +1,9 @@
 #include <errno.h>
 #include <linux/unistd.h>
+
 #include <sys/syscall.h>
+#include <unistd.h>
+
 #include "sysdep/tls.h"
 #include "user_util.h"
 
diff --git a/arch/um/os-Linux/time.c b/arch/um/os-Linux/time.c
index 38be096e750f..2115b8beb541 100644
--- a/arch/um/os-Linux/time.c
+++ b/arch/um/os-Linux/time.c
@@ -16,6 +16,7 @@
 #include "process.h"
 #include "kern_constants.h"
 #include "os.h"
+#include "uml-config.h"
 
 int set_interval(int is_virtual)
 {
@@ -30,7 +31,7 @@ int set_interval(int is_virtual)
         return 0;
 }
 
-#ifdef CONFIG_MODE_TT
+#ifdef UML_CONFIG_MODE_TT
 void enable_timer(void)
 {
         set_interval(1);
diff --git a/arch/um/os-Linux/tls.c b/arch/um/os-Linux/tls.c
index a2de2580b8af..16215b990804 100644
--- a/arch/um/os-Linux/tls.c
+++ b/arch/um/os-Linux/tls.c
@@ -1,4 +1,5 @@
 #include <errno.h>
+#include <unistd.h>
 #include <sys/ptrace.h>
 #include <sys/syscall.h>
 #include <asm/ldt.h>
diff --git a/arch/um/os-Linux/tt.c b/arch/um/os-Linux/tt.c
index 5461a065bbb9..3dc3a02d6263 100644
--- a/arch/um/os-Linux/tt.c
+++ b/arch/um/os-Linux/tt.c
@@ -10,7 +10,6 @@
 #include <errno.h>
 #include <stdarg.h>
 #include <stdlib.h>
-#include <setjmp.h>
 #include <sys/time.h>
 #include <sys/ptrace.h>
 #include <linux/ptrace.h>
diff --git a/arch/um/os-Linux/util.c b/arch/um/os-Linux/util.c
index 3f5b1514e8a7..56b8a50e8bc2 100644
--- a/arch/um/os-Linux/util.c
+++ b/arch/um/os-Linux/util.c
@@ -80,11 +80,18 @@ void setup_machinename(char *machine_out)
         struct utsname host;
 
         uname(&host);
-#if defined(UML_CONFIG_UML_X86) && !defined(UML_CONFIG_64BIT)
+#ifdef UML_CONFIG_UML_X86
+# ifndef UML_CONFIG_64BIT
         if (!strcmp(host.machine, "x86_64")) {
                 strcpy(machine_out, "i686");
                 return;
         }
+# else
+        if (!strcmp(host.machine, "i686")) {
+                strcpy(machine_out, "x86_64");
+                return;
+        }
+# endif
 #endif
         strcpy(machine_out, host.machine);
 }
diff --git a/arch/um/sys-i386/unmap.c b/arch/um/sys-i386/unmap.c
index 8e55cd5d3d07..1b0ad0e4adcd 100644
--- a/arch/um/sys-i386/unmap.c
+++ b/arch/um/sys-i386/unmap.c
@@ -5,17 +5,20 @@
 
 #include <linux/mman.h>
 #include <asm/unistd.h>
-#include <sys/syscall.h>
 
+static int errno;
+
+static inline _syscall2(int,munmap,void *,start,size_t,len)
+static inline _syscall6(void *,mmap2,void *,addr,size_t,len,int,prot,int,flags,int,fd,off_t,offset)
 int switcheroo(int fd, int prot, void *from, void *to, int size)
 {
-        if (syscall(__NR_munmap, to, size) < 0){
+        if(munmap(to, size) < 0){
                 return(-1);
         }
-        if (syscall(__NR_mmap2, to, size, prot, MAP_SHARED | MAP_FIXED, fd, 0) == (void*) -1 ){
+        if(mmap2(to, size, prot, MAP_SHARED | MAP_FIXED, fd, 0) == (void*) -1 ){
                 return(-1);
         }
-        if (syscall(__NR_munmap, from, size) < 0){
+        if(munmap(from, size) < 0){
                 return(-1);
         }
         return(0);
diff --git a/arch/um/sys-x86_64/ksyms.c b/arch/um/sys-x86_64/ksyms.c
index 859273808203..12c593607c59 100644
--- a/arch/um/sys-x86_64/ksyms.c
+++ b/arch/um/sys-x86_64/ksyms.c
@@ -14,6 +14,3 @@ EXPORT_SYMBOL(__up_wakeup);
 
 /*XXX: we need them because they would be exported by x86_64 */
 EXPORT_SYMBOL(__memcpy);
-
-/* Networking helper routines. */
-EXPORT_SYMBOL(ip_compute_csum);
diff --git a/arch/um/sys-x86_64/stub_segv.c b/arch/um/sys-x86_64/stub_segv.c
index 1c967026c957..652fa34c2cd3 100644
--- a/arch/um/sys-x86_64/stub_segv.c
+++ b/arch/um/sys-x86_64/stub_segv.c
@@ -5,7 +5,6 @@
 
 #include <stddef.h>
 #include <signal.h>
-#include <linux/compiler.h>
 #include <asm/unistd.h>
 #include "uml-config.h"
 #include "sysdep/sigcontext.h"
diff --git a/arch/um/sys-x86_64/unmap.c b/arch/um/sys-x86_64/unmap.c
index 57c9286a701b..f4a4bffd8a18 100644
--- a/arch/um/sys-x86_64/unmap.c
+++ b/arch/um/sys-x86_64/unmap.c
@@ -5,17 +5,20 @@
 
 #include <linux/mman.h>
 #include <asm/unistd.h>
-#include <sys/syscall.h>
 
+static int errno;
+
+static inline _syscall2(int,munmap,void *,start,size_t,len)
+static inline _syscall6(void *,mmap,void *,addr,size_t,len,int,prot,int,flags,int,fd,off_t,offset)
 int switcheroo(int fd, int prot, void *from, void *to, int size)
 {
-        if (syscall(__NR_munmap, to, size) < 0){
+        if(munmap(to, size) < 0){
                 return(-1);
         }
-        if (syscall(__NR_mmap, to, size, prot, MAP_SHARED | MAP_FIXED, fd, 0) == (void*) -1){
+        if(mmap(to, size, prot, MAP_SHARED | MAP_FIXED, fd, 0) == (void*) -1){
                 return(-1);
         }
-        if (syscall(__NR_munmap, from, size) < 0){
+        if(munmap(from, size) < 0){
                 return(-1);
         }
         return(0);
diff --git a/arch/v850/kernel/vmlinux.lds.S b/arch/v850/kernel/vmlinux.lds.S
index 63399219cd9f..88d087f527c9 100644
--- a/arch/v850/kernel/vmlinux.lds.S
+++ b/arch/v850/kernel/vmlinux.lds.S
@@ -140,13 +140,7 @@
                 ___setup_end = . ;                                            \
                 ___initcall_start = . ;                                       \
                         *(.initcall.init)                                     \
-                        *(.initcall1.init)                                    \
-                        *(.initcall2.init)                                    \
-                        *(.initcall3.init)                                    \
-                        *(.initcall4.init)                                    \
-                        *(.initcall5.init)                                    \
-                        *(.initcall6.init)                                    \
-                        *(.initcall7.init)                                    \
+                        INITCALLS                                             \
                 . = ALIGN (4) ;                                               \
                 ___initcall_end = . ;                                         \
                 ___con_initcall_start = .;                                    \
diff --git a/arch/x86_64/Makefile b/arch/x86_64/Makefile
index 1c0f18d4f887..6e38d4daeed7 100644
--- a/arch/x86_64/Makefile
+++ b/arch/x86_64/Makefile
@@ -54,6 +54,10 @@ endif
 cflags-y += $(call cc-option,-funit-at-a-time)
 # prevent gcc from generating any FP code by mistake
 cflags-y += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
+# this works around some issues with generating unwind tables in older gccs
+# newer gccs do it by default
+cflags-y += -maccumulate-outgoing-args
+
 # do binutils support CFI?
 cflags-y += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
@@ -62,8 +66,8 @@ AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_endproc,-DCONFIG_AS_CFI=1,)
 cflags-y += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
 AFLAGS += $(call as-instr,.cfi_startproc\n.cfi_signal_frame\n.cfi_endproc,-DCONFIG_AS_CFI_SIGNAL_FRAME=1,)
 
-cflags-$(CONFIG_CC_STACKPROTECTOR) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh $(CC) -fstack-protector )
-cflags-$(CONFIG_CC_STACKPROTECTOR_ALL) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh $(CC) -fstack-protector-all )
+cflags-$(CONFIG_CC_STACKPROTECTOR) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh "$(CC)" -fstack-protector )
+cflags-$(CONFIG_CC_STACKPROTECTOR_ALL) += $(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh "$(CC)" -fstack-protector-all )
 
 CFLAGS += $(cflags-y)
 CFLAGS_KERNEL += $(cflags-kernel-y)
diff --git a/arch/x86_64/boot/setup.S b/arch/x86_64/boot/setup.S
index c3bfd223ab49..770940cc0108 100644
--- a/arch/x86_64/boot/setup.S
+++ b/arch/x86_64/boot/setup.S
@@ -836,13 +836,12 @@ gdt:
         .word   0x9200                          # data read/write
         .word   0x00CF                          # granularity = 4096, 386
                                                 #  (+5th nibble of limit)
+gdt_end:
 idt_48:
         .word   0                               # idt limit = 0
         .word   0, 0                            # idt base = 0L
 gdt_48:
-        .word   0x8000                          # gdt limit=2048,
-                                                #  256 GDT entries
-
+        .word   gdt_end-gdt-1                   # gdt limit
         .word   0, 0                            # gdt base (filled in later)
 
 # Include video setup & detection code
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 47bfba6e9dc4..0f5d44e86be5 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.19-rc1
-# Thu Oct  5 13:04:43 2006
+# Linux kernel version: 2.6.19-rc2-git4
+# Sat Oct 21 03:38:52 2006
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -335,8 +335,8 @@ CONFIG_IPV6=y
 # CONFIG_INET6_XFRM_MODE_TUNNEL is not set
 # CONFIG_INET6_XFRM_MODE_BEET is not set
 # CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION is not set
+CONFIG_IPV6_SIT=y
 # CONFIG_IPV6_TUNNEL is not set
-# CONFIG_IPV6_SUBTREES is not set
 # CONFIG_IPV6_MULTIPLE_TABLES is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
@@ -438,6 +438,13 @@ CONFIG_BLK_DEV_INITRD=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
+# Misc devices
+#
+# CONFIG_IBM_ASM is not set
+# CONFIG_SGI_IOC4 is not set
+# CONFIG_TIFM_CORE is not set
+
+#
 # ATA/ATAPI/MFM/RLL support
 #
 CONFIG_IDE=y
@@ -1008,6 +1015,7 @@ CONFIG_I2C_ISA=m
 #
 # Dallas's 1-wire bus
 #
+# CONFIG_W1 is not set
 
 #
 # Hardware Monitoring support
@@ -1059,12 +1067,6 @@ CONFIG_SENSORS_SMSC47B397=m
 # CONFIG_HWMON_DEBUG_CHIP is not set
 
 #
-# Misc devices
-#
-# CONFIG_IBM_ASM is not set
-# CONFIG_TIFM_CORE is not set
-
-#
 # Multimedia devices
 #
 # CONFIG_VIDEO_DEV is not set
@@ -1196,7 +1198,6 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_ATI_REMOTE2 is not set
 # CONFIG_USB_KEYSPAN_REMOTE is not set
 # CONFIG_USB_APPLETOUCH is not set
-# CONFIG_USB_TRANCEVIBRATOR is not set
 
 #
 # USB Imaging devices
@@ -1242,6 +1243,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_APPLEDISPLAY is not set
 # CONFIG_USB_SISUSBVGA is not set
 # CONFIG_USB_LD is not set
+# CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_TEST is not set
 
 #
@@ -1318,6 +1320,7 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 # CONFIG_EXT3_FS_SECURITY is not set
+# CONFIG_EXT4DEV_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
@@ -1341,6 +1344,7 @@ CONFIG_DNOTIFY=y
 # CONFIG_AUTOFS_FS is not set
 CONFIG_AUTOFS4_FS=y
 # CONFIG_FUSE_FS is not set
+CONFIG_GENERIC_ACL=y
 
 #
 # CD-ROM/DVD Filesystems
@@ -1418,7 +1422,6 @@ CONFIG_SUNRPC=y
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
 # CONFIG_9P_FS is not set
-CONFIG_GENERIC_ACL=y
 
 #
 # Partition Types
@@ -1471,10 +1474,6 @@ CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 
 #
-# Distributed Lock Manager
-#
-
-#
 # Instrumentation Support
 #
 CONFIG_PROFILING=y
@@ -1512,6 +1511,7 @@ CONFIG_DEBUG_FS=y
 CONFIG_UNWIND_INFO=y
 CONFIG_STACK_UNWIND=y
 # CONFIG_FORCED_INLINING is not set
+# CONFIG_HEADERS_CHECK is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_LKDTM is not set
 # CONFIG_DEBUG_RODATA is not set
diff --git a/arch/x86_64/ia32/ia32_signal.c b/arch/x86_64/ia32/ia32_signal.c
index a6ba9951e86c..0e0a266d976f 100644
--- a/arch/x86_64/ia32/ia32_signal.c
+++ b/arch/x86_64/ia32/ia32_signal.c
@@ -579,6 +579,11 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         regs->rsp = (unsigned long) frame;
         regs->rip = (unsigned long) ka->sa.sa_handler;
 
+        /* Make -mregparm=3 work */
+        regs->rax = sig;
+        regs->rdx = (unsigned long) &frame->info;
+        regs->rcx = (unsigned long) &frame->uc;
+
         asm volatile("movl %0,%%ds" :: "r" (__USER32_DS)); 
         asm volatile("movl %0,%%es" :: "r" (__USER32_DS)); 
         
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index 3a7561d4703e..04566fe5de49 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -244,6 +244,8 @@ asmlinkage long sys32_ptrace(long request, u32 pid, u32 addr, u32 data)
         case PTRACE_DETACH:
         case PTRACE_SYSCALL:
         case PTRACE_SETOPTIONS:
+        case PTRACE_SET_THREAD_AREA:
+        case PTRACE_GET_THREAD_AREA:
                 return sys_ptrace(request, pid, addr, data); 
 
         default:
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index b3f0908668ec..6fe191c58084 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -54,13 +54,13 @@ static inline int bad_addr(unsigned long *addrp, unsigned long size)
 
         /* various gunk below that needed for SMP startup */
         if (addr < 0x8000) { 
-                *addrp = 0x8000;
+                *addrp = PAGE_ALIGN(0x8000);
                 return 1; 
         }
 
         /* direct mapping tables of the kernel */
         if (last >= table_start<<PAGE_SHIFT && addr < table_end<<PAGE_SHIFT) { 
-                *addrp = table_end << PAGE_SHIFT; 
+                *addrp = PAGE_ALIGN(table_end << PAGE_SHIFT);
                 return 1;
         } 
 
@@ -68,18 +68,18 @@ static inline int bad_addr(unsigned long *addrp, unsigned long size)
 #ifdef CONFIG_BLK_DEV_INITRD
         if (LOADER_TYPE && INITRD_START && last >= INITRD_START && 
             addr < INITRD_START+INITRD_SIZE) { 
-                *addrp = INITRD_START + INITRD_SIZE; 
+                *addrp = PAGE_ALIGN(INITRD_START + INITRD_SIZE);
                 return 1;
         } 
 #endif
         /* kernel code */
-        if (last >= __pa_symbol(&_text) && last < __pa_symbol(&_end)) {
-                *addrp = __pa_symbol(&_end);
+        if (last >= __pa_symbol(&_text) && addr < __pa_symbol(&_end)) {
+                *addrp = PAGE_ALIGN(__pa_symbol(&_end));
                 return 1;
         }
 
         if (last >= ebda_addr && addr < ebda_addr + ebda_size) {
-                *addrp = ebda_addr + ebda_size;
+                *addrp = PAGE_ALIGN(ebda_addr + ebda_size);
                 return 1;
         }
 
@@ -152,7 +152,7 @@ unsigned long __init find_e820_area(unsigned long start, unsigned long end, unsi
                         continue; 
                 while (bad_addr(&addr, size) && addr+size <= ei->addr+ei->size)
                         ;
-                last = addr + size;
+                last = PAGE_ALIGN(addr) + size;
                 if (last > ei->addr + ei->size)
                         continue;
                 if (last > end) 
@@ -278,7 +278,7 @@ e820_register_active_regions(int nid, unsigned long start_pfn,
                                                                 >> PAGE_SHIFT;
 
                 /* Skip map entries smaller than a page */
-                if (ei_startpfn > ei_endpfn)
+                if (ei_startpfn >= ei_endpfn)
                         continue;
 
                 /* Check if end_pfn_map should be updated */
@@ -594,7 +594,9 @@ static int __init parse_memmap_opt(char *p)
                  * size before original memory map is
                  * reset.
                  */
+                e820_register_active_regions(0, 0, -1UL);
                 saved_max_pfn = e820_end_of_ram();
+                remove_all_active_ranges();
 #endif
                 end_pfn_map = 0;
                 e820.nr_map = 0;
diff --git a/arch/x86_64/kernel/early-quirks.c b/arch/x86_64/kernel/early-quirks.c
index 208e38a372c1..68273bff58cc 100644
--- a/arch/x86_64/kernel/early-quirks.c
+++ b/arch/x86_64/kernel/early-quirks.c
@@ -45,7 +45,13 @@ static void nvidia_bugs(void)
         /*
          * All timer overrides on Nvidia are
          * wrong unless HPET is enabled.
+         * Unfortunately that's not true on many Asus boards.
+         * We don't know yet how to detect this automatically, but
+         * at least allow a command line override.
          */
+        if (acpi_use_timer_override)
+                return;
+
         nvidia_hpet_detected = 0;
         acpi_table_parse(ACPI_HPET, nvidia_hpet_check);
         if (nvidia_hpet_detected == 0) {
@@ -53,6 +59,8 @@ static void nvidia_bugs(void)
                 printk(KERN_INFO "Nvidia board "
                        "detected. Ignoring ACPI "
                        "timer override.\n");
+                printk(KERN_INFO "If you got timer trouble "
+                        "try acpi_use_timer_override\n");
         }
 #endif
         /* RED-PEN skip them on mptables too? */
@@ -61,10 +69,11 @@ static void nvidia_bugs(void)
 
 static void ati_bugs(void)
 {
-#if 1 /* for testing */
-        printk("ATI board detected\n");
-#endif
-        /* No bugs right now */
+        if (timer_over_8254 == 1) {
+                timer_over_8254 = 0;
+                printk(KERN_INFO
+                "ATI board detected. Disabling timer routing over 8254.\n");
+        }
 }
 
 struct chipset {
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index 38a7b2d528e2..7d401b00d822 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -315,6 +315,8 @@ tracesys:
         LOAD_ARGS ARGOFFSET  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
         cmpq $__NR_syscall_max,%rax
+        movq $-ENOSYS,%rcx
+        cmova %rcx,%rax
         ja  1f
         movq %r10,%rcx  /* fixup for C */
         call *sys_call_table(,%rax,8)
@@ -535,8 +537,6 @@ END(stub_rt_sigreturn)
 1:      incl    %gs:pda_irqcount
         cmoveq %gs:pda_irqstackptr,%rsp
         push    %rbp                    # backlink for old unwinder
-        CFI_ADJUST_CFA_OFFSET 8
-        CFI_REL_OFFSET rbp,0
         /*
          * We entered an interrupt context - irqs are off:
          */
@@ -980,11 +980,6 @@ ENTRY(kernel_thread)
         call do_fork
         movq %rax,RAX(%rsp)
         xorl %edi,%edi
-        test %rax,%rax
-        jnz  1f
-        /* terminate stack in child */
-        movq %rdi,RIP(%rsp)
-1:
 
         /*
          * It isn't worth to check for reschedule here,
@@ -1176,7 +1171,6 @@ ENTRY(call_softirq)
         incl %gs:pda_irqcount
         cmove %gs:pda_irqstackptr,%rsp
         push  %rbp                      # backlink for old unwinder
-        CFI_ADJUST_CFA_OFFSET    8
         call __do_softirq
         leaveq
         CFI_DEF_CFA_REGISTER    rsp
diff --git a/arch/x86_64/kernel/genapic_flat.c b/arch/x86_64/kernel/genapic_flat.c
index 0dfc223c1839..7c01db8fa9d1 100644
--- a/arch/x86_64/kernel/genapic_flat.c
+++ b/arch/x86_64/kernel/genapic_flat.c
@@ -153,7 +153,7 @@ struct genapic apic_flat =  {
 
 static cpumask_t physflat_target_cpus(void)
 {
-        return cpumask_of_cpu(0);
+        return cpu_online_map;
 }
 
 static cpumask_t physflat_vector_allocation_domain(int cpu)
diff --git a/arch/x86_64/kernel/i8259.c b/arch/x86_64/kernel/i8259.c
index 0612a33bb896..c4ef801b765b 100644
--- a/arch/x86_64/kernel/i8259.c
+++ b/arch/x86_64/kernel/i8259.c
@@ -178,7 +178,8 @@ void make_8259A_irq(unsigned int irq)
 {
         disable_irq_nosync(irq);
         io_apic_irqs &= ~(1<<irq);
-        set_irq_chip_and_handler(irq, &i8259A_chip, handle_level_irq);
+        set_irq_chip_and_handler_name(irq, &i8259A_chip, handle_level_irq,
+                                      "XT");
         enable_irq(irq);
 }
 
@@ -431,8 +432,8 @@ void __init init_ISA_irqs (void)
                         /*
                          * 16 old-style INTA-cycle interrupts:
                          */
-                        set_irq_chip_and_handler(i, &i8259A_chip,
-                                                 handle_level_irq);
+                        set_irq_chip_and_handler_name(i, &i8259A_chip,
+                                                      handle_level_irq, "XT");
                 } else {
                         /*
                          * 'high' PCI IRQs filled in on demand
diff --git a/arch/x86_64/kernel/io_apic.c b/arch/x86_64/kernel/io_apic.c
index 771bcf77daf2..14654e682411 100644
--- a/arch/x86_64/kernel/io_apic.c
+++ b/arch/x86_64/kernel/io_apic.c
@@ -57,13 +57,13 @@ static int no_timer_check;
 
 static int disable_timer_pin_1 __initdata;
 
-int timer_over_8254 __initdata = 0;
+int timer_over_8254 __initdata = 1;
 
 /* Where if anywhere is the i8259 connect in external int mode */
 static struct { int pin, apic; } ioapic_i8259 = { -1, -1 };
 
 static DEFINE_SPINLOCK(ioapic_lock);
-static DEFINE_SPINLOCK(vector_lock);
+DEFINE_SPINLOCK(vector_lock);
 
 /*
  * # of IRQ routing registers
@@ -88,6 +88,52 @@ static struct irq_pin_list {
         short apic, pin, next;
 } irq_2_pin[PIN_MAP_SIZE];
 
+struct io_apic {
+        unsigned int index;
+        unsigned int unused[3];
+        unsigned int data;
+};
+
+static __attribute_const__ struct io_apic __iomem *io_apic_base(int idx)
+{
+        return (void __iomem *) __fix_to_virt(FIX_IO_APIC_BASE_0 + idx)
+                + (mp_ioapics[idx].mpc_apicaddr & ~PAGE_MASK);
+}
+
+static inline unsigned int io_apic_read(unsigned int apic, unsigned int reg)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        writel(reg, &io_apic->index);
+        return readl(&io_apic->data);
+}
+
+static inline void io_apic_write(unsigned int apic, unsigned int reg, unsigned int value)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        writel(reg, &io_apic->index);
+        writel(value, &io_apic->data);
+}
+
+/*
+ * Re-write a value: to be used for read-modify-write
+ * cycles where the read already set up the index register.
+ */
+static inline void io_apic_modify(unsigned int apic, unsigned int value)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        writel(value, &io_apic->data);
+}
+
+/*
+ * Synchronize the IO-APIC and the CPU by doing
+ * a dummy read from the IO-APIC
+ */
+static inline void io_apic_sync(unsigned int apic)
+{
+        struct io_apic __iomem *io_apic = io_apic_base(apic);
+        readl(&io_apic->data);
+}
+
 #define __DO_ACTION(R, ACTION, FINAL)                                   \
                                                                         \
 {                                                                       \
@@ -126,12 +172,34 @@ static struct IO_APIC_route_entry ioapic_read_entry(int apic, int pin)
         return eu.entry;
 }
 
+/*
+ * When we write a new IO APIC routing entry, we need to write the high
+ * word first! If the mask bit in the low word is clear, we will enable
+ * the interrupt, and we need to make sure the entry is fully populated
+ * before that happens.
+ */
 static void ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
 {
         unsigned long flags;
         union entry_union eu;
         eu.entry = e;
         spin_lock_irqsave(&ioapic_lock, flags);
+        io_apic_write(apic, 0x11 + 2*pin, eu.w2);
+        io_apic_write(apic, 0x10 + 2*pin, eu.w1);
+        spin_unlock_irqrestore(&ioapic_lock, flags);
+}
+
+/*
+ * When we mask an IO APIC routing entry, we need to write the low
+ * word first, in order to set the mask bit before we change the
+ * high bits!
+ */
+static void ioapic_mask_entry(int apic, int pin)
+{
+        unsigned long flags;
+        union entry_union eu = { .entry.mask = 1 };
+
+        spin_lock_irqsave(&ioapic_lock, flags);
         io_apic_write(apic, 0x10 + 2*pin, eu.w1);
         io_apic_write(apic, 0x11 + 2*pin, eu.w2);
         spin_unlock_irqrestore(&ioapic_lock, flags);
@@ -256,9 +324,7 @@ static void clear_IO_APIC_pin(unsigned int apic, unsigned int pin)
         /*
          * Disable it in the IO-APIC irq-routing table:
          */
-        memset(&entry, 0, sizeof(entry));
-        entry.mask = 1;
-        ioapic_write_entry(apic, pin, entry);
+        ioapic_mask_entry(apic, pin);
 }
 
 static void clear_IO_APIC (void)
@@ -612,15 +678,15 @@ static int __assign_irq_vector(int irq, cpumask_t mask, cpumask_t *result)
          * Also, we've got to be careful not to trash gate
          * 0x80, because int 0x80 is hm, kind of importantish. ;)
          */
-        static struct {
-                int vector;
-                int offset;
-        } pos[NR_CPUS] = { [ 0 ... NR_CPUS - 1] = {FIRST_DEVICE_VECTOR, 0} };
+        static int current_vector = FIRST_DEVICE_VECTOR, current_offset = 0;
         int old_vector = -1;
         int cpu;
 
         BUG_ON((unsigned)irq >= NR_IRQ_VECTORS);
 
+        /* Only try and allocate irqs on cpus that are present */
+        cpus_and(mask, mask, cpu_online_map);
+
         if (irq_vector[irq] > 0)
                 old_vector = irq_vector[irq];
         if (old_vector > 0) {
@@ -630,15 +696,15 @@ static int __assign_irq_vector(int irq, cpumask_t mask, cpumask_t *result)
         }
 
         for_each_cpu_mask(cpu, mask) {
-                cpumask_t domain;
-                int first, new_cpu;
+                cpumask_t domain, new_mask;
+                int new_cpu;
                 int vector, offset;
 
                 domain = vector_allocation_domain(cpu);
-                first = first_cpu(domain);
+                cpus_and(new_mask, domain, cpu_online_map);
 
-                vector = pos[first].vector;
-                offset = pos[first].offset;
+                vector = current_vector;
+                offset = current_offset;
 next:
                 vector += 8;
                 if (vector >= FIRST_SYSTEM_VECTOR) {
@@ -646,24 +712,24 @@ next:
                         offset = (offset + 1) % 8;
                         vector = FIRST_DEVICE_VECTOR + offset;
                 }
-                if (unlikely(pos[first].vector == vector))
+                if (unlikely(current_vector == vector))
                         continue;
                 if (vector == IA32_SYSCALL_VECTOR)
                         goto next;
-                for_each_cpu_mask(new_cpu, domain)
-                        if (per_cpu(vector_irq, cpu)[vector] != -1)
+                for_each_cpu_mask(new_cpu, new_mask)
+                        if (per_cpu(vector_irq, new_cpu)[vector] != -1)
                                 goto next;
                 /* Found one! */
-                for_each_cpu_mask(new_cpu, domain) {
-                        pos[cpu].vector = vector;
-                        pos[cpu].offset = offset;
-                }
+                current_vector = vector;
+                current_offset = offset;
                 if (old_vector >= 0) {
+                        cpumask_t old_mask;
                         int old_cpu;
-                        for_each_cpu_mask(old_cpu, domain)
+                        cpus_and(old_mask, irq_domain[irq], cpu_online_map);
+                        for_each_cpu_mask(old_cpu, old_mask)
                                 per_cpu(vector_irq, old_cpu)[old_vector] = -1;
                 }
-                for_each_cpu_mask(new_cpu, domain)
+                for_each_cpu_mask(new_cpu, new_mask)
                         per_cpu(vector_irq, new_cpu)[vector] = irq;
                 irq_vector[irq] = vector;
                 irq_domain[irq] = domain;
@@ -684,6 +750,32 @@ static int assign_irq_vector(int irq, cpumask_t mask, cpumask_t *result)
         return vector;
 }
 
+void __setup_vector_irq(int cpu)
+{
+        /* Initialize vector_irq on a new cpu */
+        /* This function must be called with vector_lock held */
+        unsigned long flags;
+        int irq, vector;
+
+
+        /* Mark the inuse vectors */
+        for (irq = 0; irq < NR_IRQ_VECTORS; ++irq) {
+                if (!cpu_isset(cpu, irq_domain[irq]))
+                        continue;
+                vector = irq_vector[irq];
+                per_cpu(vector_irq, cpu)[vector] = irq;
+        }
+        /* Mark the free vectors */
+        for (vector = 0; vector < NR_VECTORS; ++vector) {
+                irq = per_cpu(vector_irq, cpu)[vector];
+                if (irq < 0)
+                        continue;
+                if (!cpu_isset(cpu, irq_domain[irq]))
+                        per_cpu(vector_irq, cpu)[vector] = -1;
+        }
+}
+
+
 extern void (*interrupt[NR_IRQS])(void);
 
 static struct irq_chip ioapic_chip;
@@ -696,11 +788,13 @@ static void ioapic_register_intr(int irq, int vector, unsigned long trigger)
 {
         if ((trigger == IOAPIC_AUTO && IO_APIC_irq_trigger(irq)) ||
                         trigger == IOAPIC_LEVEL)
-                set_irq_chip_and_handler(irq, &ioapic_chip,
-                                         handle_fasteoi_irq);
-        else
-                set_irq_chip_and_handler(irq, &ioapic_chip,
-                                         handle_edge_irq);
+                set_irq_chip_and_handler_name(irq, &ioapic_chip,
+                                              handle_fasteoi_irq, "fasteoi");
+        else {
+                irq_desc[irq].status |= IRQ_DELAYED_DISABLE;
+                set_irq_chip_and_handler_name(irq, &ioapic_chip,
+                                              handle_edge_irq, "edge");
+        }
 }
 
 static void __init setup_IO_APIC_irqs(void)
@@ -806,7 +900,7 @@ static void __init setup_ExtINT_IRQ0_pin(unsigned int apic, unsigned int pin, in
          * The timer IRQ doesn't have to know that behind the
          * scene we have a 8259A-master in AEOI mode ...
          */
-        set_irq_chip_and_handler(0, &ioapic_chip, handle_edge_irq);
+        set_irq_chip_and_handler_name(0, &ioapic_chip, handle_edge_irq, "edge");
 
         /*
          * Add it to the IO-APIC irq-routing table:
@@ -1255,12 +1349,15 @@ static int ioapic_retrigger_irq(unsigned int irq)
 {
         cpumask_t mask;
         unsigned vector;
+        unsigned long flags;
 
+        spin_lock_irqsave(&vector_lock, flags);
         vector = irq_vector[irq];
         cpus_clear(mask);
-        cpu_set(vector >> 8, mask);
+        cpu_set(first_cpu(irq_domain[irq]), mask);
 
-        send_IPI_mask(mask, vector & 0xff);
+        send_IPI_mask(mask, vector);
+        spin_unlock_irqrestore(&vector_lock, flags);
 
         return 1;
 }
@@ -1839,7 +1936,7 @@ int arch_setup_msi_irq(unsigned int irq, struct pci_dev *dev)
 
         write_msi_msg(irq, &msg);
 
-        set_irq_chip_and_handler(irq, &msi_chip, handle_edge_irq);
+        set_irq_chip_and_handler_name(irq, &msi_chip, handle_edge_irq, "edge");
 
         return 0;
 }
@@ -1860,18 +1957,16 @@ void arch_teardown_msi_irq(unsigned int irq)
 
 static void target_ht_irq(unsigned int irq, unsigned int dest, u8 vector)
 {
-        u32 low, high;
-        low  = read_ht_irq_low(irq);
-        high = read_ht_irq_high(irq);
+        struct ht_irq_msg msg;
+        fetch_ht_irq_msg(irq, &msg);
 
-        low  &= ~(HT_IRQ_LOW_VECTOR_MASK | HT_IRQ_LOW_DEST_ID_MASK);
-        high &= ~(HT_IRQ_HIGH_DEST_ID_MASK);
+        msg.address_lo &= ~(HT_IRQ_LOW_VECTOR_MASK | HT_IRQ_LOW_DEST_ID_MASK);
+        msg.address_hi &= ~(HT_IRQ_HIGH_DEST_ID_MASK);
 
-        low  |= HT_IRQ_LOW_VECTOR(vector) | HT_IRQ_LOW_DEST_ID(dest);
-        high |= HT_IRQ_HIGH_DEST_ID(dest);
+        msg.address_lo |= HT_IRQ_LOW_VECTOR(vector) | HT_IRQ_LOW_DEST_ID(dest);
+        msg.address_hi |= HT_IRQ_HIGH_DEST_ID(dest);
 
-        write_ht_irq_low(irq, low);
-        write_ht_irq_high(irq, high);
+        write_ht_irq_msg(irq, &msg);
 }
 
 static void set_ht_irq_affinity(unsigned int irq, cpumask_t mask)
@@ -1892,12 +1987,12 @@ static void set_ht_irq_affinity(unsigned int irq, cpumask_t mask)
 
         dest = cpu_mask_to_apicid(tmp);
 
-        target_ht_irq(irq, dest, vector & 0xff);
+        target_ht_irq(irq, dest, vector);
         set_native_irq_info(irq, mask);
 }
 #endif
 
-static struct hw_interrupt_type ht_irq_chip = {
+static struct irq_chip ht_irq_chip = {
         .name           = "PCI-HT",
         .mask           = mask_ht_irq,
         .unmask         = unmask_ht_irq,
@@ -1915,14 +2010,15 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
 
         vector = assign_irq_vector(irq, TARGET_CPUS, &tmp);
         if (vector >= 0) {
-                u32 low, high;
+                struct ht_irq_msg msg;
                 unsigned dest;
 
                 dest = cpu_mask_to_apicid(tmp);
 
-                high =  HT_IRQ_HIGH_DEST_ID(dest);
+                msg.address_hi = HT_IRQ_HIGH_DEST_ID(dest);
 
-                low =   HT_IRQ_LOW_BASE |
+                msg.address_lo =
+                        HT_IRQ_LOW_BASE |
                         HT_IRQ_LOW_DEST_ID(dest) |
                         HT_IRQ_LOW_VECTOR(vector) |
                         ((INT_DEST_MODE == 0) ?
@@ -1931,12 +2027,13 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
                         HT_IRQ_LOW_RQEOI_EDGE |
                         ((INT_DELIVERY_MODE != dest_LowestPrio) ?
                                 HT_IRQ_LOW_MT_FIXED :
-                                HT_IRQ_LOW_MT_ARBITRATED);
+                                HT_IRQ_LOW_MT_ARBITRATED) |
+                        HT_IRQ_LOW_IRQ_MASKED;
 
-                write_ht_irq_low(irq, low);
-                write_ht_irq_high(irq, high);
+                write_ht_irq_msg(irq, &msg);
 
-                set_irq_chip_and_handler(irq, &ht_irq_chip, handle_edge_irq);
+                set_irq_chip_and_handler_name(irq, &ht_irq_chip,
+                                              handle_edge_irq, "edge");
         }
         return vector;
 }
diff --git a/arch/x86_64/kernel/irq.c b/arch/x86_64/kernel/irq.c
index dff68eb2b787..e46c55856d40 100644
--- a/arch/x86_64/kernel/irq.c
+++ b/arch/x86_64/kernel/irq.c
@@ -75,7 +75,7 @@ int show_interrupts(struct seq_file *p, void *v)
                         seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
 #endif
                 seq_printf(p, " %8s", irq_desc[i].chip->name);
-                seq_printf(p, "-%s", handle_irq_name(irq_desc[i].handle_irq));
+                seq_printf(p, "-%-8s", irq_desc[i].name);
 
                 seq_printf(p, "  %s", action->name);
                 for (action=action->next; action; action = action->next)
diff --git a/arch/x86_64/kernel/pci-calgary.c b/arch/x86_64/kernel/pci-calgary.c
index b3296cc2f2f2..37a770859e71 100644
--- a/arch/x86_64/kernel/pci-calgary.c
+++ b/arch/x86_64/kernel/pci-calgary.c
@@ -52,7 +52,8 @@
 #define ONE_BASED_CHASSIS_NUM   1
 
 /* register offsets inside the host bridge space */
-#define PHB_CSR_OFFSET          0x0110
+#define CALGARY_CONFIG_REG      0x0108
+#define PHB_CSR_OFFSET          0x0110 /* Channel Status */
 #define PHB_PLSSR_OFFSET        0x0120
 #define PHB_CONFIG_RW_OFFSET    0x0160
 #define PHB_IOBASE_BAR_LOW      0x0170
@@ -83,6 +84,8 @@
 #define TAR_VALID               0x0000000000000008UL
 /* CSR (Channel/DMA Status Register) */
 #define CSR_AGENT_MASK          0xffe0ffff
+/* CCR (Calgary Configuration Register) */
+#define CCR_2SEC_TIMEOUT        0x000000000000000EUL
 
 #define MAX_NUM_OF_PHBS         8 /* how many PHBs in total? */
 #define MAX_NUM_CHASSIS         8 /* max number of chassis */
@@ -732,6 +735,38 @@ static void calgary_watchdog(unsigned long data)
         }
 }
 
+static void __init calgary_increase_split_completion_timeout(void __iomem *bbar,
+        unsigned char busnum)
+{
+        u64 val64;
+        void __iomem *target;
+        unsigned long phb_shift = -1;
+        u64 mask;
+
+        switch (busno_to_phbid(busnum)) {
+        case 0: phb_shift = (63 - 19);
+                break;
+        case 1: phb_shift = (63 - 23);
+                break;
+        case 2: phb_shift = (63 - 27);
+                break;
+        case 3: phb_shift = (63 - 35);
+                break;
+        default:
+                BUG_ON(busno_to_phbid(busnum));
+        }
+
+        target = calgary_reg(bbar, CALGARY_CONFIG_REG);
+        val64 = be64_to_cpu(readq(target));
+
+        /* zero out this PHB's timer bits */
+        mask = ~(0xFUL << phb_shift);
+        val64 &= mask;
+        val64 |= (CCR_2SEC_TIMEOUT << phb_shift);
+        writeq(cpu_to_be64(val64), target);
+        readq(target); /* flush */
+}
+
 static void __init calgary_enable_translation(struct pci_dev *dev)
 {
         u32 val32;
@@ -756,6 +791,13 @@ static void __init calgary_enable_translation(struct pci_dev *dev)
         writel(cpu_to_be32(val32), target);
         readl(target); /* flush */
 
+        /*
+         * Give split completion a longer timeout on bus 1 for aic94xx
+         * http://bugzilla.kernel.org/show_bug.cgi?id=7180
+         */
+        if (busnum == 1)
+                calgary_increase_split_completion_timeout(bbar, busnum);
+
         init_timer(&tbl->watchdog_timer);
         tbl->watchdog_timer.function = &calgary_watchdog;
         tbl->watchdog_timer.data = (unsigned long)dev;
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 5e95b257ee26..7451a4c43c16 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -88,9 +88,8 @@ void enter_idle(void)
 
 static void __exit_idle(void)
 {
-        if (read_pda(isidle) == 0)
+        if (test_and_clear_bit_pda(0, isidle) == 0)
                 return;
-        write_pda(isidle, 0);
         atomic_notifier_call_chain(&idle_notifier, IDLE_END, NULL);
 }
 
@@ -145,7 +144,7 @@ static void poll_idle (void)
 void cpu_idle_wait(void)
 {
         unsigned int cpu, this_cpu = get_cpu();
-        cpumask_t map;
+        cpumask_t map, tmp = current->cpus_allowed;
 
         set_cpus_allowed(current, cpumask_of_cpu(this_cpu));
         put_cpu();
@@ -168,6 +167,8 @@ void cpu_idle_wait(void)
                 }
                 cpus_and(map, map, cpu_online_map);
         } while (!cpus_empty(map));
+
+        set_cpus_allowed(current, tmp);
 }
 EXPORT_SYMBOL_GPL(cpu_idle_wait);
 
@@ -238,20 +239,28 @@ void cpu_idle (void)
  * We execute MONITOR against need_resched and enter optimized wait state
  * through MWAIT. Whenever someone changes need_resched, we would be woken
  * up from MWAIT (without an IPI).
+ *
+ * New with Core Duo processors, MWAIT can take some hints based on CPU
+ * capability.
  */
-static void mwait_idle(void)
+void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
 {
-        local_irq_enable();
-
-        while (!need_resched()) {
+        if (!need_resched()) {
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
-                if (need_resched())
-                        break;
-                __mwait(0, 0);
+                if (!need_resched())
+                        __mwait(eax, ecx);
         }
 }
 
+/* Default MONITOR/MWAIT with no hints, used for default C1 state */
+static void mwait_idle(void)
+{
+        local_irq_enable();
+        while (!need_resched())
+                mwait_idle_with_hints(0,0);
+}
+
 void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
 {
         static int printed;
diff --git a/arch/x86_64/kernel/smp.c b/arch/x86_64/kernel/smp.c
index 4f67697f5036..9f74c883568c 100644
--- a/arch/x86_64/kernel/smp.c
+++ b/arch/x86_64/kernel/smp.c
@@ -376,9 +376,8 @@ int smp_call_function_single (int cpu, void (*func) (void *info), void *info,
         /* prevent preemption and reschedule on another processor */
         int me = get_cpu();
         if (cpu == me) {
-                WARN_ON(1);
                 put_cpu();
-                return -EBUSY;
+                return 0;
         }
         spin_lock_bh(&call_lock);
         __smp_call_function_single(cpu, func, info, nonatomic, wait);
diff --git a/arch/x86_64/kernel/smpboot.c b/arch/x86_64/kernel/smpboot.c
index 7b7a6870288a..62c2e747af58 100644
--- a/arch/x86_64/kernel/smpboot.c
+++ b/arch/x86_64/kernel/smpboot.c
@@ -581,12 +581,16 @@ void __cpuinit start_secondary(void)
          * smp_call_function().
          */
         lock_ipi_call_lock();
+        spin_lock(&vector_lock);
 
+        /* Setup the per cpu irq handling data structures */
+        __setup_vector_irq(smp_processor_id());
         /*
          * Allow the master to continue.
          */
         cpu_set(smp_processor_id(), cpu_online_map);
         per_cpu(cpu_state, smp_processor_id()) = CPU_ONLINE;
+        spin_unlock(&vector_lock);
         unlock_ipi_call_lock();
 
         cpu_idle();
@@ -799,7 +803,6 @@ static int __cpuinit do_boot_cpu(int cpu, int apicid)
                                 cpu, node);
         }
 
-
         alternatives_smp_switch(1);
 
         c_idle.idle = get_idle_for_cpu(cpu);
@@ -1246,8 +1249,10 @@ int __cpu_disable(void)
         local_irq_disable();
         remove_siblinginfo(cpu);
 
+        spin_lock(&vector_lock);
         /* It's now safe to remove this processor from the online map */
         cpu_clear(cpu, cpu_online_map);
+        spin_unlock(&vector_lock);
         remove_cpu_from_maps();
         fixup_irqs(cpu_online_map);
         return 0;
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index 1ba5a442ac32..e3ef544d2cfb 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -876,15 +876,6 @@ static struct irqaction irq0 = {
         timer_interrupt, IRQF_DISABLED, CPU_MASK_NONE, "timer", NULL, NULL
 };
 
-static int __cpuinit
-time_cpu_notifier(struct notifier_block *nb, unsigned long action, void *hcpu)
-{
-        unsigned cpu = (unsigned long) hcpu;
-        if (action == CPU_ONLINE)
-                vsyscall_set_cpu(cpu);
-        return NOTIFY_DONE;
-}
-
 void __init time_init(void)
 {
         if (nohpet)
@@ -925,8 +916,6 @@ void __init time_init(void)
         vxtime.last_tsc = get_cycles_sync();
         set_cyc2ns_scale(cpu_khz);
         setup_irq(0, &irq0);
-        hotcpu_notifier(time_cpu_notifier, 0);
-        time_cpu_notifier(NULL, CPU_ONLINE, (void *)(long)smp_processor_id());
 
 #ifndef CONFIG_SMP
         time_init_gtod();
@@ -948,7 +937,7 @@ __cpuinit int unsynchronized_tsc(void)
         if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL) {
 #ifdef CONFIG_ACPI
                 /* But TSC doesn't tick in C3 so don't use it there */
-                if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 100)
+                if (acpi_fadt.length > 0 && acpi_fadt.plvl3_lat < 1000)
                         return 1;
 #endif
                 return 0;
diff --git a/arch/x86_64/kernel/traps.c b/arch/x86_64/kernel/traps.c
index 7819022a8db5..a153d0a01b72 100644
--- a/arch/x86_64/kernel/traps.c
+++ b/arch/x86_64/kernel/traps.c
@@ -290,6 +290,12 @@ void dump_trace(struct task_struct *tsk, struct pt_regs *regs, unsigned long * s
                 if (tsk && tsk != current)
                         stack = (unsigned long *)tsk->thread.rsp;
         }
+        /*
+         * Align the stack pointer on word boundary, later loops
+         * rely on that (and corruption / debug info bugs can cause
+         * unaligned values here):
+         */
+        stack = (unsigned long *)((unsigned long)stack & ~(sizeof(long)-1));
 
         /*
          * Print function call entries within a stack. 'cond' is the
diff --git a/arch/x86_64/kernel/vmlinux.lds.S b/arch/x86_64/kernel/vmlinux.lds.S
index b9df2ab6529f..d9534e750d4f 100644
--- a/arch/x86_64/kernel/vmlinux.lds.S
+++ b/arch/x86_64/kernel/vmlinux.lds.S
@@ -17,6 +17,7 @@ PHDRS {
         text PT_LOAD FLAGS(5);  /* R_E */
         data PT_LOAD FLAGS(7);  /* RWE */
         user PT_LOAD FLAGS(7);  /* RWE */
+        data.init PT_LOAD FLAGS(7);     /* RWE */
         note PT_NOTE FLAGS(4);  /* R__ */
 }
 SECTIONS
@@ -59,6 +60,7 @@ SECTIONS
   }
 #endif
 
+  . = ALIGN(PAGE_SIZE);        /* Align data segment to page size boundary */
                                 /* Data */
   .data : AT(ADDR(.data) - LOAD_OFFSET) {
         *(.data)
@@ -131,7 +133,7 @@ SECTIONS
   . = ALIGN(8192);              /* init_task */
   .data.init_task : AT(ADDR(.data.init_task) - LOAD_OFFSET) {
         *(.data.init_task)
-  } :data
+  }:data.init
 
   . = ALIGN(4096);
   .data.page_aligned : AT(ADDR(.data.page_aligned) - LOAD_OFFSET) {
@@ -174,13 +176,7 @@ SECTIONS
   __setup_end = .;
   __initcall_start = .;
   .initcall.init : AT(ADDR(.initcall.init) - LOAD_OFFSET) {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
   __con_initcall_start = .;
diff --git a/arch/x86_64/kernel/vsmp.c b/arch/x86_64/kernel/vsmp.c
index 044e852bd25e..414caf0c5f9a 100644
--- a/arch/x86_64/kernel/vsmp.c
+++ b/arch/x86_64/kernel/vsmp.c
@@ -14,6 +14,7 @@
 #include <linux/pci_ids.h>
 #include <linux/pci_regs.h>
 #include <asm/pci-direct.h>
+#include <asm/io.h>
 
 static int __init vsmp_init(void)
 {
diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c
index a98b460af6a1..92546c1526f1 100644
--- a/arch/x86_64/kernel/vsyscall.c
+++ b/arch/x86_64/kernel/vsyscall.c
@@ -27,6 +27,9 @@
 #include <linux/jiffies.h>
 #include <linux/sysctl.h>
 #include <linux/getcpu.h>
+#include <linux/cpu.h>
+#include <linux/smp.h>
+#include <linux/notifier.h>
 
 #include <asm/vsyscall.h>
 #include <asm/pgtable.h>
@@ -243,32 +246,17 @@ static ctl_table kernel_root_table2[] = {
 
 #endif
 
-static void __cpuinit write_rdtscp_cb(void *info)
-{
-        write_rdtscp_aux((unsigned long)info);
-}
-
-void __cpuinit vsyscall_set_cpu(int cpu)
+/* Assume __initcall executes before all user space. Hopefully kmod
+   doesn't violate that. We'll find out if it does. */
+static void __cpuinit vsyscall_set_cpu(int cpu)
 {
         unsigned long *d;
         unsigned long node = 0;
 #ifdef CONFIG_NUMA
         node = cpu_to_node[cpu];
 #endif
-        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP)) {
-                void *info = (void *)((node << 12) | cpu);
-                /* Can happen on preemptive kernel */
-                if (get_cpu() == cpu)
-                        write_rdtscp_cb(info);
-#ifdef CONFIG_SMP
-                else {
-                        /* the notifier is unfortunately not executed on the
-                           target CPU */
-                        smp_call_function_single(cpu,write_rdtscp_cb,info,0,1);
-                }
-#endif
-                put_cpu();
-        }
+        if (cpu_has(&cpu_data[cpu], X86_FEATURE_RDTSCP))
+                write_rdtscp_aux((node << 12) | cpu);
 
         /* Store cpu number in limit so that it can be loaded quickly
            in user space in vgetcpu.
@@ -280,6 +268,23 @@ void __cpuinit vsyscall_set_cpu(int cpu)
         *d |= (node >> 4) << 48;
 }
 
+static void __cpuinit cpu_vsyscall_init(void *arg)
+{
+        /* preemption should be already off */
+        vsyscall_set_cpu(raw_smp_processor_id());
+}
+
+#ifdef CONFIG_HOTPLUG_CPU
+static int __cpuinit
+cpu_vsyscall_notifier(struct notifier_block *n, unsigned long action, void *arg)
+{
+        long cpu = (long)arg;
+        if (action == CPU_ONLINE)
+                smp_call_function_single(cpu, cpu_vsyscall_init, NULL, 0, 1);
+        return NOTIFY_DONE;
+}
+#endif
+
 static void __init map_vsyscall(void)
 {
         extern char __vsyscall_0;
@@ -299,6 +304,8 @@ static int __init vsyscall_init(void)
 #ifdef CONFIG_SYSCTL
         register_sysctl_table(kernel_root_table2, 0);
 #endif
+        on_each_cpu(cpu_vsyscall_init, NULL, 0, 1);
+        hotcpu_notifier(cpu_vsyscall_notifier, 0);
         return 0;
 }
 
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index 19c72520a868..4c0c00ef3ca7 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -406,9 +406,12 @@ void __cpuinit zap_low_mappings(int cpu)
 #ifndef CONFIG_NUMA
 void __init paging_init(void)
 {
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = {MAX_DMA_PFN,
-                                                        MAX_DMA32_PFN,
-                                                        end_pfn};
+        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_DMA] = MAX_DMA_PFN;
+        max_zone_pfns[ZONE_DMA32] = MAX_DMA32_PFN;
+        max_zone_pfns[ZONE_NORMAL] = end_pfn;
+
         memory_present(0, 0, end_pfn);
         sparse_init();
         free_area_init_nodes(max_zone_pfns);
@@ -493,7 +496,7 @@ int remove_memory(u64 start, u64 size)
 }
 EXPORT_SYMBOL_GPL(remove_memory);
 
-#ifndef CONFIG_ACPI_NUMA
+#if !defined(CONFIG_ACPI_NUMA) && defined(CONFIG_NUMA)
 int memory_add_physaddr_to_nid(u64 start)
 {
         return 0;
@@ -501,13 +504,6 @@ int memory_add_physaddr_to_nid(u64 start)
 EXPORT_SYMBOL_GPL(memory_add_physaddr_to_nid);
 #endif
 
-#ifndef CONFIG_ACPI_NUMA
-int memory_add_physaddr_to_nid(u64 start)
-{
-        return 0;
-}
-#endif
-
 #endif /* CONFIG_MEMORY_HOTPLUG */
 
 #ifdef CONFIG_MEMORY_HOTPLUG_RESERVE
@@ -652,9 +648,22 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 
 void __init reserve_bootmem_generic(unsigned long phys, unsigned len) 
 { 
-        /* Should check here against the e820 map to avoid double free */ 
 #ifdef CONFIG_NUMA
         int nid = phys_to_nid(phys);
+#endif
+        unsigned long pfn = phys >> PAGE_SHIFT;
+        if (pfn >= end_pfn) {
+                /* This can happen with kdump kernels when accessing firmware
+                   tables. */
+                if (pfn < end_pfn_map)
+                        return;
+                printk(KERN_ERR "reserve_bootmem: illegal reserve %lx %u\n",
+                                phys, len);
+                return;
+        }
+
+        /* Should check here against the e820 map to avoid double free */
+#ifdef CONFIG_NUMA
         reserve_bootmem_node(NODE_DATA(nid), phys, len);
 #else                   
         reserve_bootmem(phys, len);    
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index 829a008bd39b..2ee2e003606c 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -338,9 +338,11 @@ static void __init arch_sparse_init(void)
 void __init paging_init(void)
 { 
         int i;
-        unsigned long max_zone_pfns[MAX_NR_ZONES] = { MAX_DMA_PFN,
-                MAX_DMA32_PFN,
-                end_pfn};
+        unsigned long max_zone_pfns[MAX_NR_ZONES];
+        memset(max_zone_pfns, 0, sizeof(max_zone_pfns));
+        max_zone_pfns[ZONE_DMA] = MAX_DMA_PFN;
+        max_zone_pfns[ZONE_DMA32] = MAX_DMA32_PFN;
+        max_zone_pfns[ZONE_NORMAL] = end_pfn;
 
         arch_sparse_init();
 
diff --git a/arch/x86_64/mm/srat.c b/arch/x86_64/mm/srat.c
index 3cc0544e25f5..1087e150a218 100644
--- a/arch/x86_64/mm/srat.c
+++ b/arch/x86_64/mm/srat.c
@@ -207,7 +207,7 @@ static inline int save_add_info(void)
         return hotadd_percent > 0;
 }
 #else
-int update_end_of_memory(unsigned long end) {return 0;}
+int update_end_of_memory(unsigned long end) {return -1;}
 static int hotadd_enough_memory(struct bootnode *nd) {return 1;}
 #ifdef CONFIG_MEMORY_HOTPLUG_SPARSE
 static inline int save_add_info(void) {return 1;}
@@ -337,7 +337,7 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
         push_node_boundaries(node, nd->start >> PAGE_SHIFT,
                                                 nd->end >> PAGE_SHIFT);
 
-        if (ma->flags.hot_pluggable && !reserve_hotadd(node, start, end) < 0) {
+        if (ma->flags.hot_pluggable && (reserve_hotadd(node, start, end) < 0)) {
                 /* Ignore hotadd region. Undo damage */
                 printk(KERN_NOTICE "SRAT: Hotplug region ignored\n");
                 *nd = oldnode;
diff --git a/arch/x86_64/pci/Makefile b/arch/x86_64/pci/Makefile
index 1eb18f421edf..149aba05a5b8 100644
--- a/arch/x86_64/pci/Makefile
+++ b/arch/x86_64/pci/Makefile
@@ -3,7 +3,7 @@
 #
 # Reuse the i386 PCI subsystem
 #
-CFLAGS += -Iarch/i386/pci
+EXTRA_CFLAGS += -Iarch/i386/pci
 
 obj-y           := i386.o
 obj-$(CONFIG_PCI_DIRECT)+= direct.o
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 7732f4254d21..f8b6b2800a62 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -163,37 +163,6 @@ static __init void unreachable_devices(void)
         }
 }
 
-static __init void pci_mmcfg_insert_resources(void)
-{
-#define PCI_MMCFG_RESOURCE_NAME_LEN 19
-        int i;
-        struct resource *res;
-        char *names;
-        unsigned num_buses;
-
-        res = kcalloc(PCI_MMCFG_RESOURCE_NAME_LEN + sizeof(*res),
-                        pci_mmcfg_config_num, GFP_KERNEL);
-
-        if (!res) {
-                printk(KERN_ERR "PCI: Unable to allocate MMCONFIG resources\n");
-                return;
-        }
-
-        names = (void *)&res[pci_mmcfg_config_num];
-        for (i = 0; i < pci_mmcfg_config_num; i++, res++) {
-                num_buses = pci_mmcfg_config[i].end_bus_number -
-                    pci_mmcfg_config[i].start_bus_number + 1;
-                res->name = names;
-                snprintf(names, PCI_MMCFG_RESOURCE_NAME_LEN, "PCI MMCONFIG %u",
-                        pci_mmcfg_config[i].pci_segment_group_number);
-                res->start = pci_mmcfg_config[i].base_address;
-                res->end = res->start + (num_buses << 20) - 1;
-                res->flags = IORESOURCE_MEM | IORESOURCE_BUSY;
-                insert_resource(&iomem_resource, res);
-                names += PCI_MMCFG_RESOURCE_NAME_LEN;
-        }
-}
-
 void __init pci_mmcfg_init(int type)
 {
         int i;
@@ -220,7 +189,7 @@ void __init pci_mmcfg_init(int type)
 
         pci_mmcfg_virt = kmalloc(sizeof(*pci_mmcfg_virt) * pci_mmcfg_config_num, GFP_KERNEL);
         if (pci_mmcfg_virt == NULL) {
-                printk("PCI: Can not allocate memory for mmconfig structures\n");
+                printk(KERN_ERR "PCI: Can not allocate memory for mmconfig structures\n");
                 return;
         }
         for (i = 0; i < pci_mmcfg_config_num; ++i) {
@@ -228,7 +197,8 @@ void __init pci_mmcfg_init(int type)
                 pci_mmcfg_virt[i].virt = ioremap_nocache(pci_mmcfg_config[i].base_address,
                                                          MMCONFIG_APER_MAX);
                 if (!pci_mmcfg_virt[i].virt) {
-                        printk("PCI: Cannot map mmconfig aperture for segment %d\n",
+                        printk(KERN_ERR "PCI: Cannot map mmconfig aperture for "
+                                        "segment %d\n",
                                pci_mmcfg_config[i].pci_segment_group_number);
                         return;
                 }
@@ -236,7 +206,6 @@ void __init pci_mmcfg_init(int type)
         }
 
         unreachable_devices();
-        pci_mmcfg_insert_resources();
 
         raw_pci_ops = &pci_mmcfg;
         pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S
index ab6cdbd5eb68..cfe75f528725 100644
--- a/arch/xtensa/kernel/vmlinux.lds.S
+++ b/arch/xtensa/kernel/vmlinux.lds.S
@@ -184,13 +184,7 @@ SECTIONS
 
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init)
-        *(.initcall2.init)
-        *(.initcall3.init)
-        *(.initcall4.init)
-        *(.initcall5.init)
-        *(.initcall6.init)
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
 
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index d3d76136f53a..1d9c3c70a9a0 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -456,6 +456,9 @@ static void cfq_add_rq_rb(struct request *rq)
          */
         while ((__alias = elv_rb_add(&cfqq->sort_list, rq)) != NULL)
                 cfq_dispatch_insert(cfqd->queue, __alias);
+
+        if (!cfq_cfqq_on_rr(cfqq))
+                cfq_add_cfqq_rr(cfqd, cfqq);
 }
 
 static inline void
@@ -1215,11 +1218,12 @@ static inline void changed_ioprio(struct cfq_io_context *cic)
 {
         struct cfq_data *cfqd = cic->key;
         struct cfq_queue *cfqq;
+        unsigned long flags;
 
         if (unlikely(!cfqd))
                 return;
 
-        spin_lock(cfqd->queue->queue_lock);
+        spin_lock_irqsave(cfqd->queue->queue_lock, flags);
 
         cfqq = cic->cfqq[ASYNC];
         if (cfqq) {
@@ -1236,7 +1240,7 @@ static inline void changed_ioprio(struct cfq_io_context *cic)
         if (cfqq)
                 cfq_mark_cfqq_prio_changed(cfqq);
 
-        spin_unlock(cfqd->queue->queue_lock);
+        spin_unlock_irqrestore(cfqd->queue->queue_lock, flags);
 }
 
 static void cfq_ioc_set_ioprio(struct io_context *ioc)
@@ -1362,6 +1366,7 @@ cfq_cic_link(struct cfq_data *cfqd, struct io_context *ioc,
         struct rb_node **p;
         struct rb_node *parent;
         struct cfq_io_context *__cic;
+        unsigned long flags;
         void *k;
 
         cic->ioc = ioc;
@@ -1391,9 +1396,9 @@ restart:
         rb_link_node(&cic->rb_node, parent, p);
         rb_insert_color(&cic->rb_node, &ioc->cic_root);
 
-        spin_lock_irq(cfqd->queue->queue_lock);
+        spin_lock_irqsave(cfqd->queue->queue_lock, flags);
         list_add(&cic->queue_list, &cfqd->cic_list);
-        spin_unlock_irq(cfqd->queue->queue_lock);
+        spin_unlock_irqrestore(cfqd->queue->queue_lock, flags);
 }
 
 /*
@@ -1650,9 +1655,6 @@ static void cfq_insert_request(request_queue_t *q, struct request *rq)
 
         cfq_add_rq_rb(rq);
 
-        if (!cfq_cfqq_on_rr(cfqq))
-                cfq_add_cfqq_rr(cfqd, cfqq);
-
         list_add_tail(&rq->queuelist, &cfqq->fifo);
 
         cfq_rq_enqueued(cfqd, cfqq, rq);
diff --git a/block/elevator.c b/block/elevator.c
index 487dd3da8853..8ccd163254b8 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -93,21 +93,18 @@ static inline int elv_try_merge(struct request *__rq, struct bio *bio)
 
 static struct elevator_type *elevator_find(const char *name)
 {
-        struct elevator_type *e = NULL;
+        struct elevator_type *e;
         struct list_head *entry;
 
         list_for_each(entry, &elv_list) {
-                struct elevator_type *__e;
 
-                __e = list_entry(entry, struct elevator_type, list);
+                e = list_entry(entry, struct elevator_type, list);
 
-                if (!strcmp(__e->elevator_name, name)) {
-                        e = __e;
-                        break;
-                }
+                if (!strcmp(e->elevator_name, name))
+                        return e;
         }
 
-        return e;
+        return NULL;
 }
 
 static void elevator_put(struct elevator_type *e)
@@ -1088,7 +1085,7 @@ ssize_t elv_iosched_show(request_queue_t *q, char *name)
         struct list_head *entry;
         int len = 0;
 
-        spin_lock_irq(q->queue_lock);
+        spin_lock_irq(&elv_list_lock);
         list_for_each(entry, &elv_list) {
                 struct elevator_type *__e;
 
@@ -1098,7 +1095,7 @@ ssize_t elv_iosched_show(request_queue_t *q, char *name)
                 else
                         len += sprintf(name+len, "%s ", __e->elevator_name);
         }
-        spin_unlock_irq(q->queue_lock);
+        spin_unlock_irq(&elv_list_lock);
 
         len += sprintf(len+name, "\n");
         return len;
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index c847e17e5caa..9eaee6640535 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -56,11 +56,6 @@ static kmem_cache_t *requestq_cachep;
  */
 static kmem_cache_t *iocontext_cachep;
 
-static wait_queue_head_t congestion_wqh[2] = {
-                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[0]),
-                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[1])
-        };
-
 /*
  * Controlling structure to kblockd
  */
@@ -112,35 +107,6 @@ static void blk_queue_congestion_threshold(struct request_queue *q)
         q->nr_congestion_off = nr;
 }
 
-/*
- * A queue has just exitted congestion.  Note this in the global counter of
- * congested queues, and wake up anyone who was waiting for requests to be
- * put back.
- */
-static void clear_queue_congested(request_queue_t *q, int rw)
-{
-        enum bdi_state bit;
-        wait_queue_head_t *wqh = &congestion_wqh[rw];
-
-        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
-        clear_bit(bit, &q->backing_dev_info.state);
-        smp_mb__after_clear_bit();
-        if (waitqueue_active(wqh))
-                wake_up(wqh);
-}
-
-/*
- * A queue has just entered congestion.  Flag that in the queue's VM-visible
- * state flags and increment the global gounter of congested queues.
- */
-static void set_queue_congested(request_queue_t *q, int rw)
-{
-        enum bdi_state bit;
-
-        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
-        set_bit(bit, &q->backing_dev_info.state);
-}
-
 /**
  * blk_get_backing_dev_info - get the address of a queue's backing_dev_info
  * @bdev:       device
@@ -159,7 +125,6 @@ struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev)
                 ret = &q->backing_dev_info;
         return ret;
 }
-
 EXPORT_SYMBOL(blk_get_backing_dev_info);
 
 void blk_queue_activity_fn(request_queue_t *q, activity_fn *fn, void *data)
@@ -167,7 +132,6 @@ void blk_queue_activity_fn(request_queue_t *q, activity_fn *fn, void *data)
         q->activity_fn = fn;
         q->activity_data = data;
 }
-
 EXPORT_SYMBOL(blk_queue_activity_fn);
 
 /**
@@ -2067,7 +2031,7 @@ static void __freed_request(request_queue_t *q, int rw)
         struct request_list *rl = &q->rq;
 
         if (rl->count[rw] < queue_congestion_off_threshold(q))
-                clear_queue_congested(q, rw);
+                blk_clear_queue_congested(q, rw);
 
         if (rl->count[rw] + 1 <= q->nr_requests) {
                 if (waitqueue_active(&rl->wait[rw]))
@@ -2137,7 +2101,7 @@ static struct request *get_request(request_queue_t *q, int rw, struct bio *bio,
                                 }
                         }
                 }
-                set_queue_congested(q, rw);
+                blk_set_queue_congested(q, rw);
         }
 
         /*
@@ -2755,41 +2719,6 @@ void blk_end_sync_rq(struct request *rq, int error)
 }
 EXPORT_SYMBOL(blk_end_sync_rq);
 
-/**
- * blk_congestion_wait - wait for a queue to become uncongested
- * @rw: READ or WRITE
- * @timeout: timeout in jiffies
- *
- * Waits for up to @timeout jiffies for a queue (any queue) to exit congestion.
- * If no queues are congested then just wait for the next request to be
- * returned.
- */
-long blk_congestion_wait(int rw, long timeout)
-{
-        long ret;
-        DEFINE_WAIT(wait);
-        wait_queue_head_t *wqh = &congestion_wqh[rw];
-
-        prepare_to_wait(wqh, &wait, TASK_UNINTERRUPTIBLE);
-        ret = io_schedule_timeout(timeout);
-        finish_wait(wqh, &wait);
-        return ret;
-}
-
-EXPORT_SYMBOL(blk_congestion_wait);
-
-/**
- * blk_congestion_end - wake up sleepers on a congestion queue
- * @rw: READ or WRITE
- */
-void blk_congestion_end(int rw)
-{
-        wait_queue_head_t *wqh = &congestion_wqh[rw];
-
-        if (waitqueue_active(wqh))
-                wake_up(wqh);
-}
-
 /*
  * Has to be called with the request spinlock acquired
  */
@@ -3070,6 +2999,7 @@ void generic_make_request(struct bio *bio)
 {
         request_queue_t *q;
         sector_t maxsector;
+        sector_t old_sector;
         int ret, nr_sectors = bio_sectors(bio);
         dev_t old_dev;
 
@@ -3098,7 +3028,7 @@ void generic_make_request(struct bio *bio)
          * NOTE: we don't repeat the blk_size check for each new device.
          * Stacking drivers are expected to know what they are doing.
          */
-        maxsector = -1;
+        old_sector = -1;
         old_dev = 0;
         do {
                 char b[BDEVNAME_SIZE];
@@ -3132,15 +3062,31 @@ end_io:
                  */
                 blk_partition_remap(bio);
 
-                if (maxsector != -1)
+                if (old_sector != -1)
                         blk_add_trace_remap(q, bio, old_dev, bio->bi_sector, 
-                                            maxsector);
+                                            old_sector);
 
                 blk_add_trace_bio(q, bio, BLK_TA_QUEUE);
 
-                maxsector = bio->bi_sector;
+                old_sector = bio->bi_sector;
                 old_dev = bio->bi_bdev->bd_dev;
 
+                maxsector = bio->bi_bdev->bd_inode->i_size >> 9;
+                if (maxsector) {
+                        sector_t sector = bio->bi_sector;
+
+                        if (maxsector < nr_sectors ||
+                                        maxsector - nr_sectors < sector) {
+                                /*
+                                 * This may well happen - partitions are not
+                                 * checked to make sure they are within the size
+                                 * of the whole device.
+                                 */
+                                handle_bad_sector(bio);
+                                goto end_io;
+                        }
+                }
+
                 ret = q->make_request_fn(q, bio);
         } while (ret);
 }
@@ -3765,14 +3711,14 @@ queue_requests_store(struct request_queue *q, const char *page, size_t count)
         blk_queue_congestion_threshold(q);
 
         if (rl->count[READ] >= queue_congestion_on_threshold(q))
-                set_queue_congested(q, READ);
+                blk_set_queue_congested(q, READ);
         else if (rl->count[READ] < queue_congestion_off_threshold(q))
-                clear_queue_congested(q, READ);
+                blk_clear_queue_congested(q, READ);
 
         if (rl->count[WRITE] >= queue_congestion_on_threshold(q))
-                set_queue_congested(q, WRITE);
+                blk_set_queue_congested(q, WRITE);
         else if (rl->count[WRITE] < queue_congestion_off_threshold(q))
-                clear_queue_congested(q, WRITE);
+                blk_clear_queue_congested(q, WRITE);
 
         if (rl->count[READ] >= q->nr_requests) {
                 blk_set_queue_full(q, READ);
diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
index ac63964b7242..dcd9c71fe8d3 100644
--- a/block/scsi_ioctl.c
+++ b/block/scsi_ioctl.c
@@ -246,10 +246,10 @@ static int sg_io(struct file *file, request_queue_t *q,
                 switch (hdr->dxfer_direction) {
                 default:
                         return -EINVAL;
-                case SG_DXFER_TO_FROM_DEV:
                 case SG_DXFER_TO_DEV:
                         writing = 1;
                         break;
+                case SG_DXFER_TO_FROM_DEV:
                 case SG_DXFER_FROM_DEV:
                         break;
                 }
@@ -286,9 +286,8 @@ static int sg_io(struct file *file, request_queue_t *q,
          * fill in request structure
          */
         rq->cmd_len = hdr->cmd_len;
+        memset(rq->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
         memcpy(rq->cmd, cmd, hdr->cmd_len);
-        if (sizeof(rq->cmd) != hdr->cmd_len)
-                memset(rq->cmd + hdr->cmd_len, 0, sizeof(rq->cmd) - hdr->cmd_len);
 
         memset(sense, 0, sizeof(sense));
         rq->sense = sense;
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 1e2f39c21180..cbae8392ce11 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -27,7 +27,6 @@ config CRYPTO_HASH
 config CRYPTO_MANAGER
         tristate "Cryptographic algorithm manager"
         select CRYPTO_ALGAPI
-        default m
         help
           Create default cryptographic template instantiations such as
           cbc(aes).
@@ -35,6 +34,7 @@ config CRYPTO_MANAGER
 config CRYPTO_HMAC
         tristate "HMAC support"
         select CRYPTO_HASH
+        select CRYPTO_MANAGER
         help
           HMAC: Keyed-Hashing for Message Authentication (RFC2104).
           This is required for IPSec.
@@ -131,6 +131,7 @@ config CRYPTO_TGR192
 config CRYPTO_ECB
         tristate "ECB support"
         select CRYPTO_BLKCIPHER
+        select CRYPTO_MANAGER
         default m
         help
           ECB: Electronic CodeBook mode
@@ -140,6 +141,7 @@ config CRYPTO_ECB
 config CRYPTO_CBC
         tristate "CBC support"
         select CRYPTO_BLKCIPHER
+        select CRYPTO_MANAGER
         default m
         help
           CBC: Cipher Block Chaining mode
diff --git a/crypto/api.c b/crypto/api.c
index 2e84d4b54790..4fb7fa45cb0d 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -331,7 +331,7 @@ struct crypto_tfm *__crypto_alloc_tfm(struct crypto_alg *alg, u32 flags)
         tfm_size = sizeof(*tfm) + crypto_ctxsize(alg, flags);
         tfm = kzalloc(tfm_size, GFP_KERNEL);
         if (tfm == NULL)
-                goto out;
+                goto out_err;
 
         tfm->__crt_alg = alg;
 
@@ -355,6 +355,7 @@ cra_init_failed:
         crypto_exit_ops(tfm);
 out_free_tfm:
         kfree(tfm);
+out_err:
         tfm = ERR_PTR(err);
 out:
         return tfm;
@@ -414,14 +415,14 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
                 struct crypto_alg *alg;
 
                 alg = crypto_alg_mod_lookup(alg_name, type, mask);
-                err = PTR_ERR(alg);
-                tfm = ERR_PTR(err);
-                if (IS_ERR(alg))
+                if (IS_ERR(alg)) {
+                        err = PTR_ERR(alg);
                         goto err;
+                }
 
                 tfm = __crypto_alloc_tfm(alg, 0);
                 if (!IS_ERR(tfm))
-                        break;
+                        return tfm;
 
                 crypto_mod_put(alg);
                 err = PTR_ERR(tfm);
@@ -433,9 +434,9 @@ err:
                         err = -EINTR;
                         break;
                 }
-        };
+        }
 
-        return tfm;
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(crypto_alloc_base);
  
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 263e86ddc1a4..f39463418904 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -14,6 +14,10 @@ source "drivers/pnp/Kconfig"
 
 source "drivers/block/Kconfig"
 
+# misc before ide - BLK_DEV_SGIIOC4 depends on SGI_IOC4
+
+source "drivers/misc/Kconfig"
+
 source "drivers/ide/Kconfig"
 
 source "drivers/scsi/Kconfig"
@@ -52,8 +56,6 @@ source "drivers/w1/Kconfig"
 
 source "drivers/hwmon/Kconfig"
 
-source "drivers/misc/Kconfig"
-
 source "drivers/mfd/Kconfig"
 
 source "drivers/media/Kconfig"
diff --git a/drivers/acpi/acpi_memhotplug.c b/drivers/acpi/acpi_memhotplug.c
index 98099de59b45..6bcd9e8e7bcb 100644
--- a/drivers/acpi/acpi_memhotplug.c
+++ b/drivers/acpi/acpi_memhotplug.c
@@ -85,6 +85,8 @@ struct acpi_memory_device {
         struct list_head res_list;
 };
 
+static int acpi_hotmem_initialized;
+
 static acpi_status
 acpi_memory_get_resource(struct acpi_resource *resource, void *context)
 {
@@ -414,7 +416,7 @@ static int acpi_memory_device_add(struct acpi_device *device)
         /* Set the device state */
         mem_device->state = MEMORY_POWER_ON_STATE;
 
-        printk(KERN_INFO "%s \n", acpi_device_name(device));
+        printk(KERN_DEBUG "%s \n", acpi_device_name(device));
 
         return result;
 }
@@ -438,6 +440,15 @@ static int acpi_memory_device_start (struct acpi_device *device)
         struct acpi_memory_device *mem_device;
         int result = 0;
 
+        /*
+         * Early boot code has recognized memory area by EFI/E820.
+         * If DSDT shows these memory devices on boot, hotplug is not necessary
+         * for them. So, it just returns until completion of this driver's
+         * start up.
+         */
+        if (!acpi_hotmem_initialized)
+                return 0;
+
         mem_device = acpi_driver_data(device);
 
         if (!acpi_memory_check_device(mem_device)) {
@@ -537,6 +548,7 @@ static int __init acpi_memory_device_init(void)
                 return -ENODEV;
         }
 
+        acpi_hotmem_initialized = 1;
         return 0;
 }
 
diff --git a/drivers/acpi/asus_acpi.c b/drivers/acpi/asus_acpi.c
index e9ee4c52a5f6..c7ac9297a204 100644
--- a/drivers/acpi/asus_acpi.c
+++ b/drivers/acpi/asus_acpi.c
@@ -138,6 +138,7 @@ struct asus_hotk {
                 S2x,            //S200 (J1 reported), Victor MP-XP7210
                 W1N,            //W1000N
                 W5A,            //W5A
+                W3V,            //W3030V
                 xxN,            //M2400N, M3700N, M5200N, M6800N, S1300N, S5200N
                 //(Centrino)
                 END_MODEL
@@ -376,6 +377,17 @@ static struct model_data model_conf[END_MODEL] = {
          .display_get = "\\ADVG"},
 
         {
+         .name = "W3V",
+         .mt_mled = "MLED",
+         .mt_wled = "WLED",
+         .mt_lcd_switch = xxN_PREFIX "_Q10",
+         .lcd_status = "\\BKLT",
+         .brightness_set = "SPLV",
+         .brightness_get = "GPLV",
+         .display_set = "SDSP",
+         .display_get = "\\INFB"},
+
+       {
          .name = "xxN",
          .mt_mled = "MLED",
 /* WLED present, but not controlled by ACPI */
@@ -555,11 +567,11 @@ static int
 write_led(const char __user * buffer, unsigned long count,
           char *ledname, int ledmask, int invert)
 {
-        int value;
+        int rv, value;
         int led_out = 0;
 
-        count = parse_arg(buffer, count, &value);
-        if (count > 0)
+        rv = parse_arg(buffer, count, &value);
+        if (rv > 0)
                 led_out = value ? 1 : 0;
 
         hotk->status =
@@ -572,7 +584,7 @@ write_led(const char __user * buffer, unsigned long count,
                 printk(KERN_WARNING "Asus ACPI: LED (%s) write failed\n",
                        ledname);
 
-        return count;
+        return rv;
 }
 
 /*
@@ -607,20 +619,18 @@ static int
 proc_write_ledd(struct file *file, const char __user * buffer,
                 unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
 
-        count = parse_arg(buffer, count, &value);
-        if (count > 0) {
+        rv = parse_arg(buffer, count, &value);
+        if (rv > 0) {
                 if (!write_acpi_int
                     (hotk->handle, hotk->methods->mt_ledd, value, NULL))
                         printk(KERN_WARNING
                                "Asus ACPI: LED display write failed\n");
                 else
                         hotk->ledd_status = (u32) value;
-        } else if (count < 0)
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
-
-        return count;
+        }
+        return rv;
 }
 
 /*
@@ -761,12 +771,12 @@ static int
 proc_write_lcd(struct file *file, const char __user * buffer,
                unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
 
-        count = parse_arg(buffer, count, &value);
-        if (count > 0)
+        rv = parse_arg(buffer, count, &value);
+        if (rv > 0)
                 set_lcd_state(value);
-        return count;
+        return rv;
 }
 
 static int read_brightness(void)
@@ -830,18 +840,15 @@ static int
 proc_write_brn(struct file *file, const char __user * buffer,
                unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
 
-        count = parse_arg(buffer, count, &value);
-        if (count > 0) {
+        rv = parse_arg(buffer, count, &value);
+        if (rv > 0) {
                 value = (0 < value) ? ((15 < value) ? 15 : value) : 0;
                 /* 0 <= value <= 15 */
                 set_brightness(value);
-        } else if (count < 0) {
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
         }
-
-        return count;
+        return rv;
 }
 
 static void set_display(int value)
@@ -880,15 +887,12 @@ static int
 proc_write_disp(struct file *file, const char __user * buffer,
                 unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
 
-        count = parse_arg(buffer, count, &value);
-        if (count > 0)
+        rv = parse_arg(buffer, count, &value);
+        if (rv > 0)
                 set_display(value);
-        else if (count < 0)
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
-
-        return count;
+        return rv;
 }
 
 typedef int (proc_readfunc) (char *page, char **start, off_t off, int count,
@@ -1097,6 +1101,8 @@ static int asus_model_match(char *model)
                 return A4G;
         else if (strncmp(model, "W1N", 3) == 0)
                 return W1N;
+        else if (strncmp(model, "W3V", 3) == 0)
+                return W3V;
         else if (strncmp(model, "W5A", 3) == 0)
                 return W5A;
         else
@@ -1200,9 +1206,10 @@ static int asus_hotk_get_info(void)
                 hotk->methods->mt_wled = NULL;
         /* L5D's WLED is not controlled by ACPI */
         else if (strncmp(string, "M2N", 3) == 0 ||
+                 strncmp(string, "W3V", 3) == 0 ||
                  strncmp(string, "S1N", 3) == 0)
                 hotk->methods->mt_wled = "WLED";
-        /* M2N and S1N have a usable WLED */
+        /* M2N, S1N and W3V have a usable WLED */
         else if (asus_info) {
                 if (strncmp(asus_info->oem_table_id, "L1", 2) == 0)
                         hotk->methods->mled_status = NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 9810e2a55d0a..026e40755cdd 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -64,6 +64,7 @@ extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
 
 static int acpi_battery_add(struct acpi_device *device);
 static int acpi_battery_remove(struct acpi_device *device, int type);
+static int acpi_battery_resume(struct acpi_device *device, int status);
 
 static struct acpi_driver acpi_battery_driver = {
         .name = ACPI_BATTERY_DRIVER_NAME,
@@ -71,6 +72,7 @@ static struct acpi_driver acpi_battery_driver = {
         .ids = ACPI_BATTERY_HID,
         .ops = {
                 .add = acpi_battery_add,
+                .resume = acpi_battery_resume,
                 .remove = acpi_battery_remove,
                 },
 };
@@ -753,6 +755,18 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
         return 0;
 }
 
+/* this is needed to learn about changes made in suspended state */
+static int acpi_battery_resume(struct acpi_device *device, int state)
+{
+        struct acpi_battery *battery;
+
+        if (!device)
+                return -EINVAL;
+
+        battery = device->driver_data;
+        return acpi_battery_check(battery);
+}
+
 static int __init acpi_battery_init(void)
 {
         int result;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index e5d796362854..e6d4b084dca2 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -45,206 +45,143 @@ ACPI_MODULE_NAME("acpi_ec")
 #define ACPI_EC_DRIVER_NAME             "ACPI Embedded Controller Driver"
 #define ACPI_EC_DEVICE_NAME             "Embedded Controller"
 #define ACPI_EC_FILE_INFO               "info"
+
+/* EC status register */
 #define ACPI_EC_FLAG_OBF        0x01    /* Output buffer full */
 #define ACPI_EC_FLAG_IBF        0x02    /* Input buffer full */
 #define ACPI_EC_FLAG_BURST      0x10    /* burst mode */
 #define ACPI_EC_FLAG_SCI        0x20    /* EC-SCI occurred */
-#define ACPI_EC_EVENT_OBF       0x01    /* Output buffer full */
-#define ACPI_EC_EVENT_IBE       0x02    /* Input buffer empty */
-#define ACPI_EC_DELAY           50      /* Wait 50ms max. during EC ops */
-#define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
-#define ACPI_EC_UDELAY         100      /* Poll @ 100us increments */
-#define ACPI_EC_UDELAY_COUNT   1000     /* Wait 10ms max. during EC ops */
+
+/* EC commands */
 #define ACPI_EC_COMMAND_READ    0x80
 #define ACPI_EC_COMMAND_WRITE   0x81
 #define ACPI_EC_BURST_ENABLE    0x82
 #define ACPI_EC_BURST_DISABLE   0x83
 #define ACPI_EC_COMMAND_QUERY   0x84
-#define EC_POLL                 0xFF
-#define EC_INTR                 0x00
+
+/* EC events */
+enum {
+        ACPI_EC_EVENT_OBF_1 = 1,        /* Output buffer full */
+        ACPI_EC_EVENT_IBF_0,            /* Input buffer empty */
+};
+
+#define ACPI_EC_DELAY           50      /* Wait 50ms max. during EC ops */
+#define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
+#define ACPI_EC_UDELAY         100      /* Poll @ 100us increments */
+#define ACPI_EC_UDELAY_COUNT   1000     /* Wait 10ms max. during EC ops */
+
+enum {
+        EC_INTR = 1,    /* Output buffer full */
+        EC_POLL,        /* Input buffer empty */
+};
+
 static int acpi_ec_remove(struct acpi_device *device, int type);
 static int acpi_ec_start(struct acpi_device *device);
 static int acpi_ec_stop(struct acpi_device *device, int type);
-static int acpi_ec_intr_add(struct acpi_device *device);
-static int acpi_ec_poll_add(struct acpi_device *device);
+static int acpi_ec_add(struct acpi_device *device);
 
 static struct acpi_driver acpi_ec_driver = {
         .name = ACPI_EC_DRIVER_NAME,
         .class = ACPI_EC_CLASS,
         .ids = ACPI_EC_HID,
         .ops = {
-                .add = acpi_ec_intr_add,
+                .add = acpi_ec_add,
                 .remove = acpi_ec_remove,
                 .start = acpi_ec_start,
                 .stop = acpi_ec_stop,
                 },
 };
-union acpi_ec {
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-        } common;
-
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-                unsigned int expect_event;
-                atomic_t leaving_burst; /* 0 : No, 1 : Yes, 2: abort */
-                atomic_t pending_gpe;
-                struct semaphore sem;
-                wait_queue_head_t wait;
-        } intr;
-
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-                struct semaphore sem;
-        } poll;
-};
 
-static int acpi_ec_poll_wait(union acpi_ec *ec, u8 event);
-static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event);
-static int acpi_ec_poll_read(union acpi_ec *ec, u8 address, u32 * data);
-static int acpi_ec_intr_read(union acpi_ec *ec, u8 address, u32 * data);
-static int acpi_ec_poll_write(union acpi_ec *ec, u8 address, u8 data);
-static int acpi_ec_intr_write(union acpi_ec *ec, u8 address, u8 data);
-static int acpi_ec_poll_query(union acpi_ec *ec, u32 * data);
-static int acpi_ec_intr_query(union acpi_ec *ec, u32 * data);
-static void acpi_ec_gpe_poll_query(void *ec_cxt);
-static void acpi_ec_gpe_intr_query(void *ec_cxt);
-static u32 acpi_ec_gpe_poll_handler(void *data);
-static u32 acpi_ec_gpe_intr_handler(void *data);
-static acpi_status __init
-acpi_fake_ecdt_poll_callback(acpi_handle handle,
-                                u32 Level, void *context, void **retval);
-
-static acpi_status __init
-acpi_fake_ecdt_intr_callback(acpi_handle handle,
-                              u32 Level, void *context, void **retval);
-
-static int __init acpi_ec_poll_get_real_ecdt(void);
-static int __init acpi_ec_intr_get_real_ecdt(void);
 /* If we find an EC via the ECDT, we need to keep a ptr to its context */
-static union acpi_ec *ec_ecdt;
+struct acpi_ec {
+        acpi_handle handle;
+        unsigned long uid;
+        unsigned long gpe_bit;
+        unsigned long command_addr;
+        unsigned long data_addr;
+        unsigned long global_lock;
+        struct semaphore sem;
+        unsigned int expect_event;
+        atomic_t leaving_burst; /* 0 : No, 1 : Yes, 2: abort */
+        wait_queue_head_t wait;
+} *ec_ecdt;
 
 /* External interfaces use first EC only, so remember */
 static struct acpi_device *first_ec;
-static int acpi_ec_poll_mode = EC_INTR;
+static int acpi_ec_mode = EC_INTR;
 
 /* --------------------------------------------------------------------------
                              Transaction Management
    -------------------------------------------------------------------------- */
 
-static u32 acpi_ec_read_status(union acpi_ec *ec)
+static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 {
-        u32 status = 0;
-
-        acpi_hw_low_level_read(8, &status, &ec->common.status_addr);
-        return status;
+        return inb(ec->command_addr);
 }
 
-static int acpi_ec_wait(union acpi_ec *ec, u8 event)
+static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_wait(ec, event);
-        else
-                return acpi_ec_intr_wait(ec, event);
+        return inb(ec->data_addr);
 }
 
-static int acpi_ec_poll_wait(union acpi_ec *ec, u8 event)
+static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
 {
-        u32 acpi_ec_status = 0;
-        u32 i = ACPI_EC_UDELAY_COUNT;
+        outb(command, ec->command_addr);
+}
 
-        if (!ec)
-                return -EINVAL;
+static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
+{
+        outb(data, ec->data_addr);
+}
 
-        /* Poll the EC status register waiting for the event to occur. */
+static int acpi_ec_check_status(u8 status, u8 event)
+{
         switch (event) {
-        case ACPI_EC_EVENT_OBF:
-                do {
-                        acpi_hw_low_level_read(8, &acpi_ec_status,
-                                               &ec->common.status_addr);
-                        if (acpi_ec_status & ACPI_EC_FLAG_OBF)
-                                return 0;
-                        udelay(ACPI_EC_UDELAY);
-                } while (--i > 0);
+        case ACPI_EC_EVENT_OBF_1:
+                if (status & ACPI_EC_FLAG_OBF)
+                        return 1;
                 break;
-        case ACPI_EC_EVENT_IBE:
-                do {
-                        acpi_hw_low_level_read(8, &acpi_ec_status,
-                                               &ec->common.status_addr);
-                        if (!(acpi_ec_status & ACPI_EC_FLAG_IBF))
-                                return 0;
-                        udelay(ACPI_EC_UDELAY);
-                } while (--i > 0);
+        case ACPI_EC_EVENT_IBF_0:
+                if (!(status & ACPI_EC_FLAG_IBF))
+                        return 1;
                 break;
         default:
-                return -EINVAL;
+                break;
         }
 
-        return -ETIME;
+        return 0;
 }
-static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event)
-{
-        int result = 0;
-
 
-        ec->intr.expect_event = event;
-        smp_mb();
+static int acpi_ec_wait(struct acpi_ec *ec, u8 event)
+{
+        int i = (acpi_ec_mode == EC_POLL) ? ACPI_EC_UDELAY_COUNT : 0;
+        long time_left;
 
-        switch (event) {
-        case ACPI_EC_EVENT_IBE:
-                if (~acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) {
-                        ec->intr.expect_event = 0;
-                        return 0;
-                }
-                break;
-        default:
-                break;
+        ec->expect_event = event;
+        if (acpi_ec_check_status(acpi_ec_read_status(ec), event)) {
+                ec->expect_event = 0;
+                return 0;
         }
 
-        result = wait_event_timeout(ec->intr.wait,
-                                    !ec->intr.expect_event,
+        do {
+                if (acpi_ec_mode == EC_POLL) {
+                        udelay(ACPI_EC_UDELAY);
+                } else {
+                        time_left = wait_event_timeout(ec->wait,
+                                    !ec->expect_event,
                                     msecs_to_jiffies(ACPI_EC_DELAY));
-
-        ec->intr.expect_event = 0;
-        smp_mb();
-
-        /*
-         * Verify that the event in question has actually happened by
-         * querying EC status. Do the check even if operation timed-out
-         * to make sure that we did not miss interrupt.
-         */
-        switch (event) {
-        case ACPI_EC_EVENT_OBF:
-                if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
+                        if (time_left > 0) {
+                                ec->expect_event = 0;
+                                return 0;
+                        }
+                }
+                if (acpi_ec_check_status(acpi_ec_read_status(ec), event)) {
+                        ec->expect_event = 0;
                         return 0;
-                break;
+                }
+        } while (--i > 0);
 
-        case ACPI_EC_EVENT_IBE:
-                if (~acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
-                        return 0;
-                break;
-        }
+        ec->expect_event = 0;
 
         return -ETIME;
 }
@@ -254,272 +191,150 @@ static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event)
  * Note: samsung nv5000 doesn't work with ec burst mode.
  * http://bugzilla.kernel.org/show_bug.cgi?id=4980
  */
-int acpi_ec_enter_burst_mode(union acpi_ec *ec)
+int acpi_ec_enter_burst_mode(struct acpi_ec *ec)
 {
-        u32 tmp = 0;
-        int status = 0;
+        u8 tmp = 0;
+        u8 status = 0;
 
 
         status = acpi_ec_read_status(ec);
         if (status != -EINVAL && !(status & ACPI_EC_FLAG_BURST)) {
-                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
                 if (status)
                         goto end;
-                acpi_hw_low_level_write(8, ACPI_EC_BURST_ENABLE,
-                                        &ec->common.command_addr);
-                status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-                acpi_hw_low_level_read(8, &tmp, &ec->common.data_addr);
+                acpi_ec_write_cmd(ec, ACPI_EC_BURST_ENABLE);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1);
+                tmp = acpi_ec_read_data(ec);
                 if (tmp != 0x90) {      /* Burst ACK byte */
                         return -EINVAL;
                 }
         }
 
-        atomic_set(&ec->intr.leaving_burst, 0);
+        atomic_set(&ec->leaving_burst, 0);
         return 0;
-      end:
-        ACPI_EXCEPTION ((AE_INFO, status, "EC wait, burst mode");
+  end:
+        ACPI_EXCEPTION((AE_INFO, status, "EC wait, burst mode"));
         return -1;
 }
 
-int acpi_ec_leave_burst_mode(union acpi_ec *ec)
+int acpi_ec_leave_burst_mode(struct acpi_ec *ec)
 {
-        int status = 0;
+        u8 status = 0;
 
 
         status = acpi_ec_read_status(ec);
         if (status != -EINVAL && (status & ACPI_EC_FLAG_BURST)){
-                status = acpi_ec_wait(ec, ACPI_EC_FLAG_IBF);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
                 if(status)
                         goto end;
-                acpi_hw_low_level_write(8, ACPI_EC_BURST_DISABLE, &ec->common.command_addr);
-                acpi_ec_wait(ec, ACPI_EC_FLAG_IBF);
-        } 
-        atomic_set(&ec->intr.leaving_burst, 1);
+                acpi_ec_write_cmd(ec, ACPI_EC_BURST_DISABLE);
+                acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+        }
+        atomic_set(&ec->leaving_burst, 1);
         return 0;
-end:
-        ACPI_EXCEPTION((AE_INFO, status, "EC leave burst mode");
+  end:
+        ACPI_EXCEPTION((AE_INFO, status, "EC leave burst mode"));
         return -1;
 }
 #endif /* ACPI_FUTURE_USAGE */
 
-static int acpi_ec_read(union acpi_ec *ec, u8 address, u32 * data)
-{
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_read(ec, address, data);
-        else
-                return acpi_ec_intr_read(ec, address, data);
-}
-static int acpi_ec_write(union acpi_ec *ec, u8 address, u8 data)
-{
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_write(ec, address, data);
-        else
-                return acpi_ec_intr_write(ec, address, data);
-}
-static int acpi_ec_poll_read(union acpi_ec *ec, u8 address, u32 * data)
+static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
+                                        const u8 *wdata, unsigned wdata_len,
+                                        u8 *rdata, unsigned rdata_len)
 {
-        acpi_status status = AE_OK;
-        int result = 0;
-        u32 glk = 0;
+        int result;
 
+        acpi_ec_write_cmd(ec, command);
 
-        if (!ec || !data)
-                return -EINVAL;
-
-        *data = 0;
-
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
+        for (; wdata_len > 0; wdata_len --) {
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+                if (result)
+                        return result;
+                acpi_ec_write_data(ec, *(wdata++));
         }
 
-        if (down_interruptible(&ec->poll.sem)) {
-                result = -ERESTARTSYS;
-                goto end_nosem;
+        if (command == ACPI_EC_COMMAND_WRITE) {
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+                if (result)
+                        return result;
         }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_READ,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (result)
-                goto end;
-
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Read [%02x] from address [%02x]\n",
-                          *data, address));
-
-      end:
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-
-        return result;
-}
-
-static int acpi_ec_poll_write(union acpi_ec *ec, u8 address, u8 data)
-{
-        int result = 0;
-        acpi_status status = AE_OK;
-        u32 glk = 0;
 
+        for (; rdata_len > 0; rdata_len --) {
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1);
+                if (result)
+                        return result;
 
-        if (!ec)
-                return -EINVAL;
-
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-
-        if (down_interruptible(&ec->poll.sem)) {
-                result = -ERESTARTSYS;
-                goto end_nosem;
+                *(rdata++) = acpi_ec_read_data(ec);
         }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_WRITE,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-
-        acpi_hw_low_level_write(8, data, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Wrote [%02x] to address [%02x]\n",
-                          data, address));
-
-      end:
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-
-        return result;
+        return 0;
 }
 
-static int acpi_ec_intr_read(union acpi_ec *ec, u8 address, u32 * data)
+static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
+                                const u8 *wdata, unsigned wdata_len,
+                                u8 *rdata, unsigned rdata_len)
 {
-        int status = 0;
+        int status;
         u32 glk;
 
-
-        if (!ec || !data)
+        if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
                 return -EINVAL;
 
-        *data = 0;
+        if (rdata)
+                memset(rdata, 0, rdata_len);
 
-        if (ec->common.global_lock) {
+        if (ec->global_lock) {
                 status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
                 if (ACPI_FAILURE(status))
                         return -ENODEV;
         }
+        down(&ec->sem);
 
-        WARN_ON(in_interrupt());
-        down(&ec->intr.sem);
-
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
+        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
         if (status) {
                 printk(KERN_DEBUG PREFIX "read EC, IB not empty\n");
                 goto end;
         }
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_READ,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "read EC, IB not empty\n");
-        }
 
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "read EC, OB not full\n");
-                goto end;
-        }
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Read [%02x] from address [%02x]\n",
-                          *data, address));
+        status = acpi_ec_transaction_unlocked(ec, command,
+                                              wdata, wdata_len,
+                                              rdata, rdata_len);
 
-      end:
-        up(&ec->intr.sem);
+end:
+        up(&ec->sem);
 
-        if (ec->common.global_lock)
+        if (ec->global_lock)
                 acpi_release_global_lock(glk);
 
         return status;
 }
 
-static int acpi_ec_intr_write(union acpi_ec *ec, u8 address, u8 data)
+static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
 {
-        int status = 0;
-        u32 glk;
-
-
-        if (!ec)
-                return -EINVAL;
-
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-
-        WARN_ON(in_interrupt());
-        down(&ec->intr.sem);
-
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_WRITE,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-
-        acpi_hw_low_level_write(8, data, &ec->common.data_addr);
+        int result;
+        u8 d;
 
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Wrote [%02x] to address [%02x]\n",
-                          data, address));
-
-        up(&ec->intr.sem);
-
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
+        result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
+                                     &address, 1, &d, 1);
+        *data = d;
+        return result;
+}
 
-        return status;
+static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
+{
+        u8 wdata[2] = { address, data };
+        return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
+                                   wdata, 2, NULL, 0);
 }
 
 /*
  * Externally callable EC access functions. For now, assume 1 EC only
  */
-int ec_read(u8 addr, u8 * val)
+int ec_read(u8 addr, u8 *val)
 {
-        union acpi_ec *ec;
+        struct acpi_ec *ec;
         int err;
-        u32 temp_data;
+        u8 temp_data;
 
         if (!first_ec)
                 return -ENODEV;
@@ -539,7 +354,7 @@ EXPORT_SYMBOL(ec_read);
 
 int ec_write(u8 addr, u8 val)
 {
-        union acpi_ec *ec;
+        struct acpi_ec *ec;
         int err;
 
         if (!first_ec)
@@ -554,255 +369,106 @@ int ec_write(u8 addr, u8 val)
 
 EXPORT_SYMBOL(ec_write);
 
-static int acpi_ec_query(union acpi_ec *ec, u32 * data)
-{
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_query(ec, data);
-        else
-                return acpi_ec_intr_query(ec, data);
-}
-static int acpi_ec_poll_query(union acpi_ec *ec, u32 * data)
+extern int ec_transaction(u8 command,
+                          const u8 *wdata, unsigned wdata_len,
+                          u8 *rdata, unsigned rdata_len)
 {
-        int result = 0;
-        acpi_status status = AE_OK;
-        u32 glk = 0;
-
-
-        if (!ec || !data)
-                return -EINVAL;
-
-        *data = 0;
-
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
+        struct acpi_ec *ec;
 
-        /*
-         * Query the EC to find out which _Qxx method we need to evaluate.
-         * Note that successful completion of the query causes the ACPI_EC_SCI
-         * bit to be cleared (and thus clearing the interrupt source).
-         */
-        if (down_interruptible(&ec->poll.sem)) {
-                result = -ERESTARTSYS;
-                goto end_nosem;
-        }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_QUERY,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (result)
-                goto end;
-
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        if (!*data)
-                result = -ENODATA;
+        if (!first_ec)
+                return -ENODEV;
 
-      end:
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
+        ec = acpi_driver_data(first_ec);
 
-        return result;
+        return acpi_ec_transaction(ec, command, wdata,
+                                   wdata_len, rdata, rdata_len);
 }
-static int acpi_ec_intr_query(union acpi_ec *ec, u32 * data)
-{
-        int status = 0;
-        u32 glk;
-
 
-        if (!ec || !data)
-                return -EINVAL;
-        *data = 0;
-
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
+EXPORT_SYMBOL(ec_transaction);
 
-        down(&ec->intr.sem);
+static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
+{
+        int result;
+        u8 d;
 
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "query EC, IB not empty\n");
-                goto end;
-        }
-        /*
-         * Query the EC to find out which _Qxx method we need to evaluate.
-         * Note that successful completion of the query causes the ACPI_EC_SCI
-         * bit to be cleared (and thus clearing the interrupt source).
-         */
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_QUERY,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "query EC, OB not full\n");
-                goto end;
-        }
+        if (!ec || !data)
+                return -EINVAL;
 
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        if (!*data)
-                status = -ENODATA;
+        /*
+         * Query the EC to find out which _Qxx method we need to evaluate.
+         * Note that successful completion of the query causes the ACPI_EC_SCI
+         * bit to be cleared (and thus clearing the interrupt source).
+         */
 
-      end:
-        up(&ec->intr.sem);
+        result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1);
+        if (result)
+                return result;
 
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
+        if (!d)
+                return -ENODATA;
 
-        return status;
+        *data = d;
+        return 0;
 }
 
 /* --------------------------------------------------------------------------
                                 Event Management
    -------------------------------------------------------------------------- */
 
-union acpi_ec_query_data {
+struct acpi_ec_query_data {
         acpi_handle handle;
         u8 data;
 };
 
 static void acpi_ec_gpe_query(void *ec_cxt)
 {
-        if (acpi_ec_poll_mode)
-                acpi_ec_gpe_poll_query(ec_cxt);
-        else
-                acpi_ec_gpe_intr_query(ec_cxt);
-}
-
-static void acpi_ec_gpe_poll_query(void *ec_cxt)
-{
-        union acpi_ec *ec = (union acpi_ec *)ec_cxt;
-        u32 value = 0;
-        static char object_name[5] = { '_', 'Q', '0', '0', '\0' };
-        const char hex[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-                '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
-        };
-
+        struct acpi_ec *ec = (struct acpi_ec *)ec_cxt;
+        u8 value = 0;
+        static char object_name[8];
 
-        if (!ec_cxt)
+        if (!ec)
                 goto end;
 
-        if (down_interruptible (&ec->poll.sem)) {
-                return;
-        }
-        acpi_hw_low_level_read(8, &value, &ec->common.command_addr);
-        up(&ec->poll.sem);
-
-        /* TBD: Implement asynch events!
-         * NOTE: All we care about are EC-SCI's.  Other EC events are
-         * handled via polling (yuck!).  This is because some systems
-         * treat EC-SCIs as level (versus EDGE!) triggered, preventing
-         *  a purely interrupt-driven approach (grumble, grumble).
-         */
+        value = acpi_ec_read_status(ec);
+
         if (!(value & ACPI_EC_FLAG_SCI))
                 goto end;
 
         if (acpi_ec_query(ec, &value))
                 goto end;
 
-        object_name[2] = hex[((value >> 4) & 0x0F)];
-        object_name[3] = hex[(value & 0x0F)];
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s\n", object_name));
+        snprintf(object_name, 8, "_Q%2.2X", value);
 
-        acpi_evaluate_object(ec->common.handle, object_name, NULL, NULL);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s", object_name));
 
-      end:
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
-}
-static void acpi_ec_gpe_intr_query(void *ec_cxt)
-{
-        union acpi_ec *ec = (union acpi_ec *)ec_cxt;
-        u32 value;
-        int result = -ENODATA;
-        static char object_name[5] = { '_', 'Q', '0', '0', '\0' };
-        const char hex[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-                '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
-        };
+        acpi_evaluate_object(ec->handle, object_name, NULL, NULL);
 
-
-        if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_SCI)
-                result = acpi_ec_query(ec, &value);
-
-        if (result)
-                goto end;
-
-        object_name[2] = hex[((value >> 4) & 0x0F)];
-        object_name[3] = hex[(value & 0x0F)];
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s\n", object_name));
-
-        acpi_evaluate_object(ec->common.handle, object_name, NULL, NULL);
       end:
-        atomic_dec(&ec->intr.pending_gpe);
-        return;
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
 }
 
 static u32 acpi_ec_gpe_handler(void *data)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_ec_gpe_poll_handler(data);
-        else
-                return acpi_ec_gpe_intr_handler(data);
-}
-static u32 acpi_ec_gpe_poll_handler(void *data)
-{
         acpi_status status = AE_OK;
-        union acpi_ec *ec = (union acpi_ec *)data;
-
-        if (!ec)
-                return ACPI_INTERRUPT_NOT_HANDLED;
-
-        acpi_disable_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
-
-        status = acpi_os_execute(OSL_EC_POLL_HANDLER, acpi_ec_gpe_query, ec);
-
-        if (status == AE_OK)
-                return ACPI_INTERRUPT_HANDLED;
-        else
-                return ACPI_INTERRUPT_NOT_HANDLED;
-}
-static u32 acpi_ec_gpe_intr_handler(void *data)
-{
-        acpi_status status = AE_OK;
-        u32 value;
-        union acpi_ec *ec = (union acpi_ec *)data;
-
-        if (!ec)
-                return ACPI_INTERRUPT_NOT_HANDLED;
+        u8 value;
+        struct acpi_ec *ec = (struct acpi_ec *)data;
 
-        acpi_clear_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
+        acpi_clear_gpe(NULL, ec->gpe_bit, ACPI_ISR);
         value = acpi_ec_read_status(ec);
 
-        switch (ec->intr.expect_event) {
-        case ACPI_EC_EVENT_OBF:
-                if (!(value & ACPI_EC_FLAG_OBF))
-                        break;
-                ec->intr.expect_event = 0;
-                wake_up(&ec->intr.wait);
-                break;
-        case ACPI_EC_EVENT_IBE:
-                if ((value & ACPI_EC_FLAG_IBF))
-                        break;
-                ec->intr.expect_event = 0;
-                wake_up(&ec->intr.wait);
-                break;
-        default:
-                break;
+        if (acpi_ec_mode == EC_INTR) {
+                if (acpi_ec_check_status(value, ec->expect_event)) {
+                        ec->expect_event = 0;
+                        wake_up(&ec->wait);
+                }
         }
 
         if (value & ACPI_EC_FLAG_SCI) {
-                atomic_add(1, &ec->intr.pending_gpe);
-                status = acpi_os_execute(OSL_EC_BURST_HANDLER,
-                                                     acpi_ec_gpe_query, ec);
+                status = acpi_os_execute(OSL_EC_BURST_HANDLER, acpi_ec_gpe_query, ec);
                 return status == AE_OK ?
                     ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
         }
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_ISR);
         return status == AE_OK ?
             ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
 }
@@ -833,7 +499,7 @@ acpi_ec_space_handler(u32 function,
                       void *handler_context, void *region_context)
 {
         int result = 0;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
         u64 temp = *value;
         acpi_integer f_v = 0;
         int i = 0;
@@ -843,18 +509,16 @@ acpi_ec_space_handler(u32 function,
                 return AE_BAD_PARAMETER;
 
         if (bit_width != 8 && acpi_strict) {
-                printk(KERN_WARNING PREFIX
-                       "acpi_ec_space_handler: bit_width should be 8\n");
                 return AE_BAD_PARAMETER;
         }
 
-        ec = (union acpi_ec *)handler_context;
+        ec = (struct acpi_ec *)handler_context;
 
       next_byte:
         switch (function) {
         case ACPI_READ:
                 temp = 0;
-                result = acpi_ec_read(ec, (u8) address, (u32 *) & temp);
+                result = acpi_ec_read(ec, (u8) address, (u8 *) &temp);
                 break;
         case ACPI_WRITE:
                 result = acpi_ec_write(ec, (u8) address, (u8) temp);
@@ -905,20 +569,20 @@ static struct proc_dir_entry *acpi_ec_dir;
 
 static int acpi_ec_read_info(struct seq_file *seq, void *offset)
 {
-        union acpi_ec *ec = (union acpi_ec *)seq->private;
+        struct acpi_ec *ec = (struct acpi_ec *)seq->private;
 
 
         if (!ec)
                 goto end;
 
         seq_printf(seq, "gpe bit:                 0x%02x\n",
-                   (u32) ec->common.gpe_bit);
+                   (u32) ec->gpe_bit);
         seq_printf(seq, "ports:                   0x%02x, 0x%02x\n",
-                   (u32) ec->common.status_addr.address,
-                   (u32) ec->common.data_addr.address);
+                   (u32) ec->command_addr,
+                   (u32) ec->data_addr);
         seq_printf(seq, "use global lock:         %s\n",
-                   ec->common.global_lock ? "yes" : "no");
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
+                   ec->global_lock ? "yes" : "no");
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
 
       end:
         return 0;
@@ -929,7 +593,7 @@ static int acpi_ec_info_open_fs(struct inode *inode, struct file *file)
         return single_open(file, acpi_ec_read_info, PDE(inode)->data);
 }
 
-static const struct file_operations acpi_ec_info_ops = {
+static struct file_operations acpi_ec_info_ops = {
         .open = acpi_ec_info_open_fs,
         .read = seq_read,
         .llseek = seq_lseek,
@@ -978,101 +642,35 @@ static int acpi_ec_remove_fs(struct acpi_device *device)
                                Driver Interface
    -------------------------------------------------------------------------- */
 
-static int acpi_ec_poll_add(struct acpi_device *device)
+static int acpi_ec_add(struct acpi_device *device)
 {
         int result = 0;
         acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
 
 
         if (!device)
                 return -EINVAL;
 
-        ec = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
         if (!ec)
                 return -ENOMEM;
-        memset(ec, 0, sizeof(union acpi_ec));
-
-        ec->common.handle = device->handle;
-        ec->common.uid = -1;
-        init_MUTEX(&ec->poll.sem);
-        strcpy(acpi_device_name(device), ACPI_EC_DEVICE_NAME);
-        strcpy(acpi_device_class(device), ACPI_EC_CLASS);
-        acpi_driver_data(device) = ec;
-
-        /* Use the global lock for all EC transactions? */
-        acpi_evaluate_integer(ec->common.handle, "_GLK", NULL,
-                              &ec->common.global_lock);
-
-        /* XXX we don't test uids, because on some boxes ecdt uid = 0, see:
-           http://bugzilla.kernel.org/show_bug.cgi?id=6111 */
-        if (ec_ecdt) {
-                acpi_remove_address_space_handler(ACPI_ROOT_OBJECT,
-                                                  ACPI_ADR_SPACE_EC,
-                                                  &acpi_ec_space_handler);
-
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
-                                        &acpi_ec_gpe_handler);
-
-                kfree(ec_ecdt);
+        memset(ec, 0, sizeof(struct acpi_ec));
+
+        ec->handle = device->handle;
+        ec->uid = -1;
+        init_MUTEX(&ec->sem);
+        if (acpi_ec_mode == EC_INTR) {
+                atomic_set(&ec->leaving_burst, 1);
+                init_waitqueue_head(&ec->wait);
         }
-
-        /* Get GPE bit assignment (EC events). */
-        /* TODO: Add support for _GPE returning a package */
-        status =
-            acpi_evaluate_integer(ec->common.handle, "_GPE", NULL,
-                                  &ec->common.gpe_bit);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Obtaining GPE bit"));
-                result = -ENODEV;
-                goto end;
-        }
-
-        result = acpi_ec_add_fs(device);
-        if (result)
-                goto end;
-
-        printk(KERN_INFO PREFIX "%s [%s] (gpe %d) polling mode.\n",
-               acpi_device_name(device), acpi_device_bid(device),
-               (u32) ec->common.gpe_bit);
-
-        if (!first_ec)
-                first_ec = device;
-
-      end:
-        if (result)
-                kfree(ec);
-
-        return result;
-}
-static int acpi_ec_intr_add(struct acpi_device *device)
-{
-        int result = 0;
-        acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
-
-
-        if (!device)
-                return -EINVAL;
-
-        ec = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
-        if (!ec)
-                return -ENOMEM;
-        memset(ec, 0, sizeof(union acpi_ec));
-
-        ec->common.handle = device->handle;
-        ec->common.uid = -1;
-        atomic_set(&ec->intr.pending_gpe, 0);
-        atomic_set(&ec->intr.leaving_burst, 1);
-        init_MUTEX(&ec->intr.sem);
-        init_waitqueue_head(&ec->intr.wait);
         strcpy(acpi_device_name(device), ACPI_EC_DEVICE_NAME);
         strcpy(acpi_device_class(device), ACPI_EC_CLASS);
         acpi_driver_data(device) = ec;
 
         /* Use the global lock for all EC transactions? */
-        acpi_evaluate_integer(ec->common.handle, "_GLK", NULL,
-                              &ec->common.global_lock);
+        acpi_evaluate_integer(ec->handle, "_GLK", NULL,
+                              &ec->global_lock);
 
         /* XXX we don't test uids, because on some boxes ecdt uid = 0, see:
            http://bugzilla.kernel.org/show_bug.cgi?id=6111 */
@@ -1081,7 +679,7 @@ static int acpi_ec_intr_add(struct acpi_device *device)
                                                   ACPI_ADR_SPACE_EC,
                                                   &acpi_ec_space_handler);
 
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                         &acpi_ec_gpe_handler);
 
                 kfree(ec_ecdt);
@@ -1090,10 +688,10 @@ static int acpi_ec_intr_add(struct acpi_device *device)
         /* Get GPE bit assignment (EC events). */
         /* TODO: Add support for _GPE returning a package */
         status =
-            acpi_evaluate_integer(ec->common.handle, "_GPE", NULL,
-                                  &ec->common.gpe_bit);
+            acpi_evaluate_integer(ec->handle, "_GPE", NULL,
+                                  &ec->gpe_bit);
         if (ACPI_FAILURE(status)) {
-                printk(KERN_ERR PREFIX "Obtaining GPE bit assignment\n");
+                ACPI_EXCEPTION((AE_INFO, status, "Obtaining GPE bit assignment"));
                 result = -ENODEV;
                 goto end;
         }
@@ -1102,14 +700,14 @@ static int acpi_ec_intr_add(struct acpi_device *device)
         if (result)
                 goto end;
 
-        printk(KERN_INFO PREFIX "%s [%s] (gpe %d) interrupt mode.\n",
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "%s [%s] (gpe %d) interrupt mode.",
                acpi_device_name(device), acpi_device_bid(device),
-               (u32) ec->common.gpe_bit);
+               (u32) ec->gpe_bit));
 
         if (!first_ec)
                 first_ec = device;
 
-      end:
+  end:
         if (result)
                 kfree(ec);
 
@@ -1118,7 +716,7 @@ static int acpi_ec_intr_add(struct acpi_device *device)
 
 static int acpi_ec_remove(struct acpi_device *device, int type)
 {
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
 
 
         if (!device)
@@ -1136,8 +734,7 @@ static int acpi_ec_remove(struct acpi_device *device, int type)
 static acpi_status
 acpi_ec_io_ports(struct acpi_resource *resource, void *context)
 {
-        union acpi_ec *ec = (union acpi_ec *)context;
-        struct acpi_generic_address *addr;
+        struct acpi_ec *ec = (struct acpi_ec *)context;
 
         if (resource->type != ACPI_RESOURCE_TYPE_IO) {
                 return AE_OK;
@@ -1148,26 +745,21 @@ acpi_ec_io_ports(struct acpi_resource *resource, void *context)
          * the second address region returned is the status/command
          * port.
          */
-        if (ec->common.data_addr.register_bit_width == 0) {
-                addr = &ec->common.data_addr;
-        } else if (ec->common.command_addr.register_bit_width == 0) {
-                addr = &ec->common.command_addr;
+        if (ec->data_addr == 0) {
+                ec->data_addr = resource->data.io.minimum;
+        } else if (ec->command_addr == 0) {
+                ec->command_addr = resource->data.io.minimum;
         } else {
                 return AE_CTRL_TERMINATE;
         }
 
-        addr->address_space_id = ACPI_ADR_SPACE_SYSTEM_IO;
-        addr->register_bit_width = 8;
-        addr->register_bit_offset = 0;
-        addr->address = resource->data.io.minimum;
-
         return AE_OK;
 }
 
 static int acpi_ec_start(struct acpi_device *device)
 {
         acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
 
 
         if (!device)
@@ -1181,39 +773,35 @@ static int acpi_ec_start(struct acpi_device *device)
         /*
          * Get I/O port addresses. Convert to GAS format.
          */
-        status = acpi_walk_resources(ec->common.handle, METHOD_NAME__CRS,
+        status = acpi_walk_resources(ec->handle, METHOD_NAME__CRS,
                                      acpi_ec_io_ports, ec);
-        if (ACPI_FAILURE(status)
-            || ec->common.command_addr.register_bit_width == 0) {
-                printk(KERN_ERR PREFIX "Error getting I/O port addresses\n");
+        if (ACPI_FAILURE(status) || ec->command_addr == 0) {
+                ACPI_EXCEPTION((AE_INFO, status,
+                                "Error getting I/O port addresses"));
                 return -ENODEV;
         }
 
-        ec->common.status_addr = ec->common.command_addr;
-
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "gpe=0x%02x, ports=0x%2x,0x%2x\n",
-                          (u32) ec->common.gpe_bit,
-                          (u32) ec->common.command_addr.address,
-                          (u32) ec->common.data_addr.address));
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "gpe=0x%02lx, ports=0x%2lx,0x%2lx",
+                          ec->gpe_bit, ec->command_addr, ec->data_addr));
 
         /*
          * Install GPE handler
          */
-        status = acpi_install_gpe_handler(NULL, ec->common.gpe_bit,
+        status = acpi_install_gpe_handler(NULL, ec->gpe_bit,
                                           ACPI_GPE_EDGE_TRIGGERED,
                                           &acpi_ec_gpe_handler, ec);
         if (ACPI_FAILURE(status)) {
                 return -ENODEV;
         }
-        acpi_set_gpe_type(NULL, ec->common.gpe_bit, ACPI_GPE_TYPE_RUNTIME);
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
+        acpi_set_gpe_type(NULL, ec->gpe_bit, ACPI_GPE_TYPE_RUNTIME);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
 
-        status = acpi_install_address_space_handler(ec->common.handle,
+        status = acpi_install_address_space_handler(ec->handle,
                                                     ACPI_ADR_SPACE_EC,
                                                     &acpi_ec_space_handler,
                                                     &acpi_ec_space_setup, ec);
         if (ACPI_FAILURE(status)) {
-                acpi_remove_gpe_handler(NULL, ec->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec->gpe_bit,
                                         &acpi_ec_gpe_handler);
                 return -ENODEV;
         }
@@ -1224,7 +812,7 @@ static int acpi_ec_start(struct acpi_device *device)
 static int acpi_ec_stop(struct acpi_device *device, int type)
 {
         acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
 
 
         if (!device)
@@ -1232,14 +820,14 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
 
         ec = acpi_driver_data(device);
 
-        status = acpi_remove_address_space_handler(ec->common.handle,
+        status = acpi_remove_address_space_handler(ec->handle,
                                                    ACPI_ADR_SPACE_EC,
                                                    &acpi_ec_space_handler);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
         status =
-            acpi_remove_gpe_handler(NULL, ec->common.gpe_bit,
+            acpi_remove_gpe_handler(NULL, ec->gpe_bit,
                                     &acpi_ec_gpe_handler);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
@@ -1251,76 +839,30 @@ static acpi_status __init
 acpi_fake_ecdt_callback(acpi_handle handle,
                         u32 Level, void *context, void **retval)
 {
-
-        if (acpi_ec_poll_mode)
-                return acpi_fake_ecdt_poll_callback(handle,
-                                                       Level, context, retval);
-        else
-                return acpi_fake_ecdt_intr_callback(handle,
-                                                     Level, context, retval);
-}
-
-static acpi_status __init
-acpi_fake_ecdt_poll_callback(acpi_handle handle,
-                                u32 Level, void *context, void **retval)
-{
-        acpi_status status;
-
-        status = acpi_walk_resources(handle, METHOD_NAME__CRS,
-                                     acpi_ec_io_ports, ec_ecdt);
-        if (ACPI_FAILURE(status))
-                return status;
-        ec_ecdt->common.status_addr = ec_ecdt->common.command_addr;
-
-        ec_ecdt->common.uid = -1;
-        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->common.uid);
-
-        status =
-            acpi_evaluate_integer(handle, "_GPE", NULL,
-                                  &ec_ecdt->common.gpe_bit);
-        if (ACPI_FAILURE(status))
-                return status;
-        init_MUTEX(&ec_ecdt->poll.sem);
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.handle = handle;
-
-        printk(KERN_INFO PREFIX "GPE=0x%02x, ports=0x%2x, 0x%2x\n",
-               (u32) ec_ecdt->common.gpe_bit,
-               (u32) ec_ecdt->common.command_addr.address,
-               (u32) ec_ecdt->common.data_addr.address);
-
-        return AE_CTRL_TERMINATE;
-}
-
-static acpi_status __init
-acpi_fake_ecdt_intr_callback(acpi_handle handle,
-                              u32 Level, void *context, void **retval)
-{
         acpi_status status;
 
-        init_MUTEX(&ec_ecdt->intr.sem);
-        init_waitqueue_head(&ec_ecdt->intr.wait);
+        init_MUTEX(&ec_ecdt->sem);
+        if (acpi_ec_mode == EC_INTR) {
+                init_waitqueue_head(&ec_ecdt->wait);
+        }
         status = acpi_walk_resources(handle, METHOD_NAME__CRS,
                                      acpi_ec_io_ports, ec_ecdt);
         if (ACPI_FAILURE(status))
                 return status;
-        ec_ecdt->common.status_addr = ec_ecdt->common.command_addr;
 
-        ec_ecdt->common.uid = -1;
-        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->common.uid);
+        ec_ecdt->uid = -1;
+        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->uid);
 
         status =
             acpi_evaluate_integer(handle, "_GPE", NULL,
-                                  &ec_ecdt->common.gpe_bit);
+                                  &ec_ecdt->gpe_bit);
         if (ACPI_FAILURE(status))
                 return status;
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.handle = handle;
+        ec_ecdt->global_lock = TRUE;
+        ec_ecdt->handle = handle;
 
-        printk(KERN_INFO PREFIX "GPE=0x%02x, ports=0x%2x, 0x%2x\n",
-               (u32) ec_ecdt->common.gpe_bit,
-               (u32) ec_ecdt->common.command_addr.address,
-               (u32) ec_ecdt->common.data_addr.address);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "GPE=0x%02lx, ports=0x%2lx, 0x%2lx",
+               ec_ecdt->gpe_bit, ec_ecdt->command_addr, ec_ecdt->data_addr));
 
         return AE_CTRL_TERMINATE;
 }
@@ -1340,14 +882,14 @@ static int __init acpi_ec_fake_ecdt(void)
         acpi_status status;
         int ret = 0;
 
-        printk(KERN_INFO PREFIX "Try to make an fake ECDT\n");
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Try to make an fake ECDT"));
 
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec_ecdt = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
         if (!ec_ecdt) {
                 ret = -ENOMEM;
                 goto error;
         }
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
+        memset(ec_ecdt, 0, sizeof(struct acpi_ec));
 
         status = acpi_get_devices(ACPI_EC_HID,
                                   acpi_fake_ecdt_callback, NULL, NULL);
@@ -1355,24 +897,16 @@ static int __init acpi_ec_fake_ecdt(void)
                 kfree(ec_ecdt);
                 ec_ecdt = NULL;
                 ret = -ENODEV;
+                ACPI_EXCEPTION((AE_INFO, status, "Can't make an fake ECDT"));
                 goto error;
         }
         return 0;
-      error:
-        printk(KERN_ERR PREFIX "Can't make an fake ECDT\n");
+  error:
         return ret;
 }
 
 static int __init acpi_ec_get_real_ecdt(void)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_get_real_ecdt();
-        else
-                return acpi_ec_intr_get_real_ecdt();
-}
-
-static int __init acpi_ec_poll_get_real_ecdt(void)
-{
         acpi_status status;
         struct acpi_table_ecdt *ecdt_ptr;
 
@@ -1382,80 +916,36 @@ static int __init acpi_ec_poll_get_real_ecdt(void)
         if (ACPI_FAILURE(status))
                 return -ENODEV;
 
-        printk(KERN_INFO PREFIX "Found ECDT\n");
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Found ECDT"));
 
         /*
          * Generate a temporary ec context to use until the namespace is scanned
          */
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec_ecdt = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
         if (!ec_ecdt)
                 return -ENOMEM;
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
-
-        ec_ecdt->common.command_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.status_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.data_addr = ecdt_ptr->ec_data;
-        ec_ecdt->common.gpe_bit = ecdt_ptr->gpe_bit;
-        init_MUTEX(&ec_ecdt->poll.sem);
-        /* use the GL just to be safe */
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.uid = ecdt_ptr->uid;
+        memset(ec_ecdt, 0, sizeof(struct acpi_ec));
 
-        status =
-            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->common.handle);
-        if (ACPI_FAILURE(status)) {
-                goto error;
+        init_MUTEX(&ec_ecdt->sem);
+        if (acpi_ec_mode == EC_INTR) {
+                init_waitqueue_head(&ec_ecdt->wait);
         }
-
-        return 0;
-      error:
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
-        kfree(ec_ecdt);
-        ec_ecdt = NULL;
-
-        return -ENODEV;
-}
-
-static int __init acpi_ec_intr_get_real_ecdt(void)
-{
-        acpi_status status;
-        struct acpi_table_ecdt *ecdt_ptr;
-
-        status = acpi_get_firmware_table("ECDT", 1, ACPI_LOGICAL_ADDRESSING,
-                                         (struct acpi_table_header **)
-                                         &ecdt_ptr);
-        if (ACPI_FAILURE(status))
-                return -ENODEV;
-
-        printk(KERN_INFO PREFIX "Found ECDT\n");
-
-        /*
-         * Generate a temporary ec context to use until the namespace is scanned
-         */
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
-        if (!ec_ecdt)
-                return -ENOMEM;
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
-
-        init_MUTEX(&ec_ecdt->intr.sem);
-        init_waitqueue_head(&ec_ecdt->intr.wait);
-        ec_ecdt->common.command_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.status_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.data_addr = ecdt_ptr->ec_data;
-        ec_ecdt->common.gpe_bit = ecdt_ptr->gpe_bit;
+        ec_ecdt->command_addr = ecdt_ptr->ec_control.address;
+        ec_ecdt->data_addr = ecdt_ptr->ec_data.address;
+        ec_ecdt->gpe_bit = ecdt_ptr->gpe_bit;
         /* use the GL just to be safe */
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.uid = ecdt_ptr->uid;
+        ec_ecdt->global_lock = TRUE;
+        ec_ecdt->uid = ecdt_ptr->uid;
 
         status =
-            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->common.handle);
+            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->handle);
         if (ACPI_FAILURE(status)) {
                 goto error;
         }
 
         return 0;
-      error:
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
+  error:
+        ACPI_EXCEPTION((AE_INFO, status, "Could not use ECDT"));
         kfree(ec_ecdt);
         ec_ecdt = NULL;
 
@@ -1480,14 +970,14 @@ int __init acpi_ec_ecdt_probe(void)
         /*
          * Install GPE handler
          */
-        status = acpi_install_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+        status = acpi_install_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                           ACPI_GPE_EDGE_TRIGGERED,
                                           &acpi_ec_gpe_handler, ec_ecdt);
         if (ACPI_FAILURE(status)) {
                 goto error;
         }
-        acpi_set_gpe_type(NULL, ec_ecdt->common.gpe_bit, ACPI_GPE_TYPE_RUNTIME);
-        acpi_enable_gpe(NULL, ec_ecdt->common.gpe_bit, ACPI_NOT_ISR);
+        acpi_set_gpe_type(NULL, ec_ecdt->gpe_bit, ACPI_GPE_TYPE_RUNTIME);
+        acpi_enable_gpe(NULL, ec_ecdt->gpe_bit, ACPI_NOT_ISR);
 
         status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT,
                                                     ACPI_ADR_SPACE_EC,
@@ -1495,7 +985,7 @@ int __init acpi_ec_ecdt_probe(void)
                                                     &acpi_ec_space_setup,
                                                     ec_ecdt);
         if (ACPI_FAILURE(status)) {
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                         &acpi_ec_gpe_handler);
                 goto error;
         }
@@ -1503,7 +993,7 @@ int __init acpi_ec_ecdt_probe(void)
         return 0;
 
       error:
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
+        ACPI_EXCEPTION((AE_INFO, status, "Could not use ECDT"));
         kfree(ec_ecdt);
         ec_ecdt = NULL;
 
@@ -1562,13 +1052,13 @@ static int __init acpi_ec_set_intr_mode(char *str)
                 return 0;
 
         if (intr) {
-                acpi_ec_poll_mode = EC_INTR;
-                acpi_ec_driver.ops.add = acpi_ec_intr_add;
+                acpi_ec_mode = EC_INTR;
         } else {
-                acpi_ec_poll_mode = EC_POLL;
-                acpi_ec_driver.ops.add = acpi_ec_poll_add;
+                acpi_ec_mode = EC_POLL;
         }
-        printk(KERN_INFO PREFIX "EC %s mode.\n", intr ? "interrupt" : "polling");
+        acpi_ec_driver.ops.add = acpi_ec_add;
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "EC %s mode.\n", intr ? "interrupt" : "polling"));
+
         return 1;
 }
 
diff --git a/drivers/acpi/events/evmisc.c b/drivers/acpi/events/evmisc.c
index 6eef4efddcf6..ee2a10bf9077 100644
--- a/drivers/acpi/events/evmisc.c
+++ b/drivers/acpi/events/evmisc.c
@@ -342,20 +342,8 @@ static u32 acpi_ev_global_lock_handler(void *context)
         if (acquired) {
 
                 /* Got the lock, now wake all threads waiting for it */
-
                 acpi_gbl_global_lock_acquired = TRUE;
-
-                /* Run the Global Lock thread which will signal all waiting threads */
-
-                status =
-                    acpi_os_execute(OSL_GLOBAL_LOCK_HANDLER,
-                                    acpi_ev_global_lock_thread, context);
-                if (ACPI_FAILURE(status)) {
-                        ACPI_EXCEPTION((AE_INFO, status,
-                                        "Could not queue Global Lock thread"));
-
-                        return (ACPI_INTERRUPT_NOT_HANDLED);
-                }
+                acpi_ev_global_lock_thread(context);
         }
 
         return (ACPI_INTERRUPT_HANDLED);
diff --git a/drivers/acpi/events/evrgnini.c b/drivers/acpi/events/evrgnini.c
index 5b3c7a85eb9a..203d1359190a 100644
--- a/drivers/acpi/events/evrgnini.c
+++ b/drivers/acpi/events/evrgnini.c
@@ -225,13 +225,12 @@ acpi_ev_pci_config_region_setup(acpi_handle handle,
                                 if (!
                                     (ACPI_STRNCMP
                                      (object_hID.value, PCI_ROOT_HID_STRING,
-                                      sizeof(PCI_ROOT_HID_STRING))
-                                     ||
-                                     !(ACPI_STRNCMP
-                                       (object_hID.value,
-                                        PCI_EXPRESS_ROOT_HID_STRING,
-                                        sizeof(PCI_EXPRESS_ROOT_HID_STRING)))))
-                                {
+                                      sizeof(PCI_ROOT_HID_STRING)))
+                                    ||
+                                    !(ACPI_STRNCMP
+                                      (object_hID.value,
+                                       PCI_EXPRESS_ROOT_HID_STRING,
+                                       sizeof(PCI_EXPRESS_ROOT_HID_STRING)))) {
 
                                         /* Install a handler for this PCI root bridge */
 
diff --git a/drivers/acpi/ibm_acpi.c b/drivers/acpi/ibm_acpi.c
index 15fc12482ba0..003a9876c968 100644
--- a/drivers/acpi/ibm_acpi.c
+++ b/drivers/acpi/ibm_acpi.c
@@ -1702,13 +1702,11 @@ static struct ibm_struct ibms[] = {
          .name = "brightness",
          .read = brightness_read,
          .write = brightness_write,
-         .experimental = 1,
          },
         {
          .name = "volume",
          .read = volume_read,
          .write = volume_write,
-         .experimental = 1,
          },
         {
          .name = "fan",
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index ec6b7f9ede34..2e17ec75af03 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -48,6 +48,12 @@ ACPI_MODULE_NAME("acpi_motherboard")
  * the io ports if they really know they can use it, while
  * still preventing hotplug PCI devices from using it.
  */
+
+/*
+ * When CONFIG_PNP is enabled, pnp/system.c binds to PNP0C01
+ * and PNP0C02, redundant with acpi_reserve_io_ranges().
+ * But acpi_reserve_io_ranges() is necessary for !CONFIG_PNP.
+ */
 static acpi_status acpi_reserve_io_ranges(struct acpi_resource *res, void *data)
 {
         struct resource *requested_res = NULL;
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 7f3e7e77e794..d53bd9878ca2 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -307,7 +307,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
         if (!link || !irq)
                 return -EINVAL;
 
-        resource = kmalloc(sizeof(*resource) + 1, GFP_ATOMIC);
+        resource = kmalloc(sizeof(*resource) + 1, irqs_disabled() ? GFP_ATOMIC: GFP_KERNEL);
         if (!resource)
                 return -ENOMEM;
 
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fec225d1b6b7..fe67a8af520e 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -216,10 +216,8 @@ static int acpi_power_off_device(acpi_handle handle)
 {
         int result = 0;
         acpi_status status = AE_OK;
-        struct acpi_device *device = NULL;
         struct acpi_power_resource *resource = NULL;
 
-
         result = acpi_power_get_context(handle, &resource);
         if (result)
                 return result;
@@ -230,13 +228,13 @@ static int acpi_power_off_device(acpi_handle handle)
         if (resource->references) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                   "Resource [%s] is still in use, dereferencing\n",
-                                  device->pnp.bus_id));
+                                  resource->device->pnp.bus_id));
                 return 0;
         }
 
         if (resource->state == ACPI_POWER_RESOURCE_STATE_OFF) {
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] already off\n",
-                                  device->pnp.bus_id));
+                                  resource->device->pnp.bus_id));
                 return 0;
         }
 
@@ -251,8 +249,7 @@ static int acpi_power_off_device(acpi_handle handle)
                 return -ENOEXEC;
 
         /* Update the power resource's _device_ power state */
-        device = resource->device;
-        device->power.state = ACPI_STATE_D3;
+        resource->device->power.state = ACPI_STATE_D3;
 
         ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] turned off\n",
                           resource->name));
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index b13d64415b7a..1908e0d20222 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -519,7 +519,7 @@ static int acpi_processor_get_info(struct acpi_processor *pr)
 
 static void *processor_device_array[NR_CPUS];
 
-static int acpi_processor_start(struct acpi_device *device)
+static int __cpuinit acpi_processor_start(struct acpi_device *device)
 {
         int result = 0;
         acpi_status status = AE_OK;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0a395fca843b..65b3f056ad89 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -219,6 +219,23 @@ static void acpi_safe_halt(void)
 
 static atomic_t c3_cpu_count;
 
+/* Common C-state entry for C2, C3, .. */
+static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
+{
+        if (cstate->space_id == ACPI_CSTATE_FFH) {
+                /* Call into architectural FFH based C-state */
+                acpi_processor_ffh_cstate_enter(cstate);
+        } else {
+                int unused;
+                /* IO port based C-state */
+                inb(cstate->address);
+                /* Dummy wait op - must do something useless after P_LVL2 read
+                   because chipsets cannot guarantee that STPCLK# signal
+                   gets asserted in time to freeze execution properly. */
+                unused = inl(acpi_fadt.xpm_tmr_blk.address);
+        }
+}
+
 static void acpi_processor_idle(void)
 {
         struct acpi_processor *pr = NULL;
@@ -361,11 +378,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_fadt.xpm_tmr_blk.address);
                 /* Invoke C2 */
-                inb(cx->address);
-                /* Dummy wait op - must do something useless after P_LVL2 read
-                   because chipsets cannot guarantee that STPCLK# signal
-                   gets asserted in time to freeze execution properly. */
-                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
+                acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_fadt.xpm_tmr_blk.address);
 
@@ -401,9 +414,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_fadt.xpm_tmr_blk.address);
                 /* Invoke C3 */
-                inb(cx->address);
-                /* Dummy wait op (see above) */
-                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
+                acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_fadt.xpm_tmr_blk.address);
                 if (pr->flags.bm_check) {
@@ -628,20 +639,16 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
         return 0;
 }
 
-static int acpi_processor_get_power_info_default_c1(struct acpi_processor *pr)
+static int acpi_processor_get_power_info_default(struct acpi_processor *pr)
 {
-
-        /* Zero initialize all the C-states info. */
-        memset(pr->power.states, 0, sizeof(pr->power.states));
-
-        /* set the first C-State to C1 */
-        pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
-
-        /* the C0 state only exists as a filler in our array,
-         * and all processors need to support C1 */
+        if (!pr->power.states[ACPI_STATE_C1].valid) {
+                /* set the first C-State to C1 */
+                /* all processors need to support C1 */
+                pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
+                pr->power.states[ACPI_STATE_C1].valid = 1;
+        }
+        /* the C0 state only exists as a filler in our array */
         pr->power.states[ACPI_STATE_C0].valid = 1;
-        pr->power.states[ACPI_STATE_C1].valid = 1;
-
         return 0;
 }
 
@@ -658,12 +665,7 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
         if (nocst)
                 return -ENODEV;
 
-        current_count = 1;
-
-        /* Zero initialize C2 onwards and prepare for fresh CST lookup */
-        for (i = 2; i < ACPI_PROCESSOR_MAX_POWER; i++)
-                memset(&(pr->power.states[i]), 0, 
-                                sizeof(struct acpi_processor_cx));
+        current_count = 0;
 
         status = acpi_evaluate_object(pr->handle, "_CST", NULL, &buffer);
         if (ACPI_FAILURE(status)) {
@@ -718,22 +720,39 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
                     (reg->space_id != ACPI_ADR_SPACE_FIXED_HARDWARE))
                         continue;
 
-                cx.address = (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) ?
-                    0 : reg->address;
-
                 /* There should be an easy way to extract an integer... */
                 obj = (union acpi_object *)&(element->package.elements[1]);
                 if (obj->type != ACPI_TYPE_INTEGER)
                         continue;
 
                 cx.type = obj->integer.value;
-
-                if ((cx.type != ACPI_STATE_C1) &&
-                    (reg->space_id != ACPI_ADR_SPACE_SYSTEM_IO))
-                        continue;
-
-                if ((cx.type < ACPI_STATE_C2) || (cx.type > ACPI_STATE_C3))
-                        continue;
+                /*
+                 * Some buggy BIOSes won't list C1 in _CST -
+                 * Let acpi_processor_get_power_info_default() handle them later
+                 */
+                if (i == 1 && cx.type != ACPI_STATE_C1)
+                        current_count++;
+
+                cx.address = reg->address;
+                cx.index = current_count + 1;
+
+                cx.space_id = ACPI_CSTATE_SYSTEMIO;
+                if (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
+                        if (acpi_processor_ffh_cstate_probe
+                                        (pr->id, &cx, reg) == 0) {
+                                cx.space_id = ACPI_CSTATE_FFH;
+                        } else if (cx.type != ACPI_STATE_C1) {
+                                /*
+                                 * C1 is a special case where FIXED_HARDWARE
+                                 * can be handled in non-MWAIT way as well.
+                                 * In that case, save this _CST entry info.
+                                 * That is, we retain space_id of SYSTEM_IO for
+                                 * halt based C1.
+                                 * Otherwise, ignore this info and continue.
+                                 */
+                                continue;
+                        }
+                }
 
                 obj = (union acpi_object *)&(element->package.elements[2]);
                 if (obj->type != ACPI_TYPE_INTEGER)
@@ -938,11 +957,17 @@ static int acpi_processor_get_power_info(struct acpi_processor *pr)
         /* NOTE: the idle thread may not be running while calling
          * this function */
 
-        /* Adding C1 state */
-        acpi_processor_get_power_info_default_c1(pr);
+        /* Zero initialize all the C-states info. */
+        memset(pr->power.states, 0, sizeof(pr->power.states));
+
         result = acpi_processor_get_power_info_cst(pr);
         if (result == -ENODEV)
-                acpi_processor_get_power_info_fadt(pr);
+                result = acpi_processor_get_power_info_fadt(pr);
+
+        if (result)
+                return result;
+
+        acpi_processor_get_power_info_default(pr);
 
         pr->power.count = acpi_processor_power_verify(pr);
 
@@ -1083,6 +1108,7 @@ static const struct file_operations acpi_processor_power_fops = {
         .release = single_release,
 };
 
+#ifdef CONFIG_SMP
 static void smp_callback(void *v)
 {
         /* we already woke the CPU up, nothing more to do */
@@ -1104,8 +1130,9 @@ static int acpi_processor_latency_notify(struct notifier_block *b,
 static struct notifier_block acpi_processor_latency_notifier = {
         .notifier_call = acpi_processor_latency_notify,
 };
+#endif
 
-int acpi_processor_power_init(struct acpi_processor *pr,
+int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                               struct acpi_device *device)
 {
         acpi_status status = 0;
@@ -1121,7 +1148,9 @@ int acpi_processor_power_init(struct acpi_processor *pr,
                                "ACPI: processor limited to max C-state %d\n",
                                max_cstate);
                 first_run++;
+#ifdef CONFIG_SMP
                 register_latency_notifier(&acpi_processor_latency_notifier);
+#endif
         }
 
         if (!pr)
@@ -1193,7 +1222,9 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
                  * copies of pm_idle before proceeding.
                  */
                 cpu_idle_wait();
+#ifdef CONFIG_SMP
                 unregister_latency_notifier(&acpi_processor_latency_notifier);
+#endif
         }
 
         return 0;
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index 62bef0b3b614..8908a975e575 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -98,11 +98,11 @@ static int update_info_mode = UPDATE_INFO_MODE;
 static int update_time = UPDATE_TIME;
 static int update_time2 = UPDATE_TIME2;
 
-module_param(capacity_mode, int, CAPACITY_UNIT);
-module_param(update_mode, int, UPDATE_MODE);
-module_param(update_info_mode, int, UPDATE_INFO_MODE);
-module_param(update_time, int, UPDATE_TIME);
-module_param(update_time2, int, UPDATE_TIME2);
+module_param(capacity_mode, int, 0);
+module_param(update_mode, int, 0);
+module_param(update_info_mode, int, 0);
+module_param(update_time, int, 0);
+module_param(update_time2, int, 0);
 
 static int acpi_sbs_add(struct acpi_device *device);
 static int acpi_sbs_remove(struct acpi_device *device, int type);
@@ -1685,10 +1685,16 @@ static int acpi_sbs_add(struct acpi_device *device)
 
 int acpi_sbs_remove(struct acpi_device *device, int type)
 {
-        struct acpi_sbs *sbs = (struct acpi_sbs *)acpi_driver_data(device);
+        struct acpi_sbs *sbs = NULL;
         int id;
 
-        if (!device || !sbs) {
+        if (!device) {
+                return -EINVAL;
+        }
+
+        sbs = (struct acpi_sbs *)acpi_driver_data(device);
+
+        if (!sbs) {
                 return -EINVAL;
         }
 
diff --git a/drivers/acpi/tables/tbget.c b/drivers/acpi/tables/tbget.c
index 7856db759af0..11e2d4454e05 100644
--- a/drivers/acpi/tables/tbget.c
+++ b/drivers/acpi/tables/tbget.c
@@ -324,7 +324,7 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
 
         if (header->length < sizeof(struct acpi_table_header)) {
                 ACPI_ERROR((AE_INFO,
-                            "Table length (%X) is smaller than minimum (%X)",
+                            "Table length (%X) is smaller than minimum (%zX)",
                             header->length, sizeof(struct acpi_table_header)));
 
                 return_ACPI_STATUS(AE_INVALID_TABLE_LENGTH);
diff --git a/drivers/acpi/tables/tbrsdt.c b/drivers/acpi/tables/tbrsdt.c
index 0ad3dbb9ebca..86a5fca9b739 100644
--- a/drivers/acpi/tables/tbrsdt.c
+++ b/drivers/acpi/tables/tbrsdt.c
@@ -187,7 +187,7 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
 
         if (table_ptr->length < sizeof(struct acpi_table_header)) {
                 ACPI_ERROR((AE_INFO,
-                            "RSDT/XSDT length (%X) is smaller than minimum (%X)",
+                            "RSDT/XSDT length (%X) is smaller than minimum (%zX)",
                             table_ptr->length,
                             sizeof(struct acpi_table_header)));
 
diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
index 3f4aa0c99ee4..03f6338acc8f 100644
--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@@ -6,6 +6,7 @@ menu "Serial ATA (prod) and Parallel ATA (experimental) drivers"
 
 config ATA
         tristate "ATA device support"
+        depends on BLOCK
         depends on !(M32R || M68K) || BROKEN
         depends on !SUN4 || BROKEN
         select SCSI
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 25929123ffff..234197e57e9e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -334,6 +334,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(NVIDIA, 0x044d), board_ahci },            /* MCP65 */
         { PCI_VDEVICE(NVIDIA, 0x044e), board_ahci },            /* MCP65 */
         { PCI_VDEVICE(NVIDIA, 0x044f), board_ahci },            /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x0554), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0555), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0556), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0557), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0558), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0559), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x055a), board_ahci },            /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x055b), board_ahci },            /* MCP67 */
 
         /* SiS */
         { PCI_VDEVICE(SI, 0x1184), board_ahci }, /* SiS 966 */
@@ -736,8 +744,7 @@ static int ahci_softreset(struct ata_port *ap, unsigned int *class)
         }
 
         /* check BUSY/DRQ, perform Command List Override if necessary */
-        ahci_tf_read(ap, &tf);
-        if (tf.command & (ATA_BUSY | ATA_DRQ)) {
+        if (ahci_check_status(ap) & (ATA_BUSY | ATA_DRQ)) {
                 rc = ahci_clo(ap);
 
                 if (rc == -EOPNOTSUPP) {
@@ -1041,7 +1048,7 @@ static void ahci_host_intr(struct ata_port *ap)
         /* hmmm... a spurious interupt */
 
         /* some devices send D2H reg with I bit set during NCQ command phase */
-        if (ap->sactive && status & PORT_IRQ_D2H_REG_FIS)
+        if (ap->sactive && (status & PORT_IRQ_D2H_REG_FIS))
                 return;
 
         /* ignore interim PIO setup fis interrupts */
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 5719704eb0ee..720174d628fa 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -126,8 +126,7 @@ enum {
         ich6_sata               = 7,
         ich6_sata_ahci          = 8,
         ich6m_sata_ahci         = 9,
-        ich7m_sata_ahci         = 10,
-        ich8_sata_ahci          = 11,
+        ich8_sata_ahci          = 10,
 
         /* constants for mapping table */
         P0                      = 0,  /* port 0 */
@@ -227,7 +226,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* 82801GB/GR/GH (ICH7, identical to ICH6) */
         { 0x8086, 0x27c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
         /* 2801GBM/GHM (ICH7M, identical to ICH6M) */
-        { 0x8086, 0x27c4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich7m_sata_ahci },
+        { 0x8086, 0x27c4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6m_sata_ahci },
         /* Enterprise Southbridge 2 (where's the datasheet?) */
         { 0x8086, 0x2680, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich6_sata_ahci },
         /* SATA Controller 1 IDE (ICH8, no datasheet yet) */
@@ -399,23 +398,10 @@ static const struct piix_map_db ich6m_map_db = {
         .mask = 0x3,
         .port_enable = 0x5,
         .present_shift = 4,
-        .map = {
-                /* PM   PS   SM   SS       MAP */
-                {  P0,  P2,  RV,  RV }, /* 00b */
-                {  RV,  RV,  RV,  RV },
-                {  P0,  P2, IDE, IDE }, /* 10b */
-                {  RV,  RV,  RV,  RV },
-        },
-};
-
-static const struct piix_map_db ich7m_map_db = {
-        .mask = 0x3,
-        .port_enable = 0x5,
-        .present_shift = 4,
 
         /* Map 01b isn't specified in the doc but some notebooks use
-         * it anyway.  ATM, the only case spotted carries subsystem ID
-         * 1025:0107.  This is the only difference from ich6m.
+         * it anyway.  MAP 01b have been spotted on both ICH6M and
+         * ICH7M.
          */
         .map = {
                 /* PM   PS   SM   SS       MAP */
@@ -432,9 +418,9 @@ static const struct piix_map_db ich8_map_db = {
         .present_shift = 8,
         .map = {
                 /* PM   PS   SM   SS       MAP */
-                {  P0,  NA,  P1,  NA }, /* 00b (hardwired) */
+                {  P0,  P2,  P1,  P3 }, /* 00b (hardwired when in AHCI) */
                 {  RV,  RV,  RV,  RV },
-                {  RV,  RV,  RV,  RV }, /* 10b (never) */
+                {  IDE,  IDE,  NA,  NA }, /* 10b (IDE mode) */
                 {  RV,  RV,  RV,  RV },
         },
 };
@@ -445,7 +431,6 @@ static const struct piix_map_db *piix_map_db_table[] = {
         [ich6_sata]             = &ich6_map_db,
         [ich6_sata_ahci]        = &ich6_map_db,
         [ich6m_sata_ahci]       = &ich6m_map_db,
-        [ich7m_sata_ahci]       = &ich7m_map_db,
         [ich8_sata_ahci]        = &ich8_map_db,
 };
 
@@ -556,19 +541,7 @@ static struct ata_port_info piix_port_info[] = {
                 .port_ops       = &piix_sata_ops,
         },
 
-        /* ich7m_sata_ahci: 10 */
-        {
-                .sht            = &piix_sht,
-                .flags          = ATA_FLAG_SATA |
-                                  PIIX_FLAG_CHECKINTR | PIIX_FLAG_SCR |
-                                  PIIX_FLAG_AHCI,
-                .pio_mask       = 0x1f, /* pio0-4 */
-                .mwdma_mask     = 0x07, /* mwdma0-2 */
-                .udma_mask      = 0x7f, /* udma0-6 */
-                .port_ops       = &piix_sata_ops,
-        },
-
-        /* ich8_sata_ahci: 11 */
+        /* ich8_sata_ahci: 10 */
         {
                 .sht            = &piix_sht,
                 .flags          = ATA_FLAG_SATA |
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 77138a39eb04..915a55a6cc14 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -870,7 +870,11 @@ static unsigned int ata_id_xfermask(const u16 *id)
                  * the PIO timing number for the maximum. Turn it into
                  * a mask.
                  */
-                pio_mask = (2 << (id[ATA_ID_OLD_PIO_MODES] & 0xFF)) - 1 ;
+                u8 mode = id[ATA_ID_OLD_PIO_MODES] & 0xFF;
+                if (mode < 5)   /* Valid PIO range */
+                        pio_mask = (2 << mode) - 1;
+                else
+                        pio_mask = 1;
 
                 /* But wait.. there's more. Design your standards by
                  * committee and you too can get a free iordy field to
@@ -5953,7 +5957,7 @@ static void __exit ata_exit(void)
         destroy_workqueue(ata_aux_wq);
 }
 
-module_init(ata_init);
+subsys_initcall(ata_init);
 module_exit(ata_exit);
 
 static unsigned long ratelimit_time;
@@ -6118,7 +6122,6 @@ EXPORT_SYMBOL_GPL(ata_std_prereset);
 EXPORT_SYMBOL_GPL(ata_std_softreset);
 EXPORT_SYMBOL_GPL(sata_std_hardreset);
 EXPORT_SYMBOL_GPL(ata_std_postreset);
-EXPORT_SYMBOL_GPL(ata_dev_revalidate);
 EXPORT_SYMBOL_GPL(ata_dev_classify);
 EXPORT_SYMBOL_GPL(ata_dev_pair);
 EXPORT_SYMBOL_GPL(ata_port_disable);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index b0d0cc41f3e8..5c1fc467fc7f 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -164,10 +164,10 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
 {
         int rc = 0;
         u8 scsi_cmd[MAX_COMMAND_SIZE];
-        u8 args[4], *argbuf = NULL;
+        u8 args[4], *argbuf = NULL, *sensebuf = NULL;
         int argsize = 0;
-        struct scsi_sense_hdr sshdr;
         enum dma_data_direction data_dir;
+        int cmd_result;
 
         if (arg == NULL)
                 return -EINVAL;
@@ -175,6 +175,10 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
         if (copy_from_user(args, arg, sizeof(args)))
                 return -EFAULT;
 
+        sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
+        if (!sensebuf)
+                return -ENOMEM;
+
         memset(scsi_cmd, 0, sizeof(scsi_cmd));
 
         if (args[3]) {
@@ -191,7 +195,7 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
                 data_dir = DMA_FROM_DEVICE;
         } else {
                 scsi_cmd[1]  = (3 << 1); /* Non-data */
-                /* scsi_cmd[2] is already 0 -- no off.line, cc, or data xfer */
+                scsi_cmd[2]  = 0x20;     /* cc but no off.line or data xfer */
                 data_dir = DMA_NONE;
         }
 
@@ -210,18 +214,46 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
 
         /* Good values for timeout and retries?  Values below
            from scsi_ioctl_send_command() for default case... */
-        if (scsi_execute_req(scsidev, scsi_cmd, data_dir, argbuf, argsize,
-                             &sshdr, (10*HZ), 5)) {
+        cmd_result = scsi_execute(scsidev, scsi_cmd, data_dir, argbuf, argsize,
+                                  sensebuf, (10*HZ), 5, 0);
+
+        if (driver_byte(cmd_result) == DRIVER_SENSE) {/* sense data available */
+                u8 *desc = sensebuf + 8;
+                cmd_result &= ~(0xFF<<24); /* DRIVER_SENSE is not an error */
+
+                /* If we set cc then ATA pass-through will cause a
+                 * check condition even if no error. Filter that. */
+                if (cmd_result & SAM_STAT_CHECK_CONDITION) {
+                        struct scsi_sense_hdr sshdr;
+                        scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
+                                              &sshdr);
+                        if (sshdr.sense_key==0 &&
+                            sshdr.asc==0 && sshdr.ascq==0)
+                                cmd_result &= ~SAM_STAT_CHECK_CONDITION;
+                }
+
+                /* Send userspace a few ATA registers (same as drivers/ide) */
+                if (sensebuf[0] == 0x72 &&     /* format is "descriptor" */
+                    desc[0] == 0x09 ) {        /* code is "ATA Descriptor" */
+                        args[0] = desc[13];    /* status */
+                        args[1] = desc[3];     /* error */
+                        args[2] = desc[5];     /* sector count (0:7) */
+                        if (copy_to_user(arg, args, sizeof(args)))
+                                rc = -EFAULT;
+                }
+        }
+
+
+        if (cmd_result) {
                 rc = -EIO;
                 goto error;
         }
 
-        /* Need code to retrieve data from check condition? */
-
         if ((argbuf)
          && copy_to_user(arg + sizeof(args), argbuf, argsize))
                 rc = -EFAULT;
 error:
+        kfree(sensebuf);
         kfree(argbuf);
         return rc;
 }
@@ -1580,9 +1612,9 @@ early_finish:
 
 err_did:
         ata_qc_free(qc);
-err_mem:
         cmd->result = (DID_ERROR << 16);
         done(cmd);
+err_mem:
         DPRINTK("EXIT - internal\n");
         return 0;
 
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 06daaa3736a2..7645f2b30ccf 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -981,6 +981,15 @@ int ata_pci_init_one (struct pci_dev *pdev, struct ata_port_info **port_info,
                 mask = (1 << 2) | (1 << 0);
                 if ((tmp8 & mask) != mask)
                         legacy_mode = (1 << 3);
+#if defined(CONFIG_NO_ATA_LEGACY)
+                /* Some platforms with PCI limits cannot address compat
+                   port space. In that case we punt if their firmware has
+                   left a device in compatibility mode */
+                if (legacy_mode) {
+                        printk(KERN_ERR "ata: Compatibility mode ATA is not supported on this platform, skipping.\n");
+                        return -EOPNOTSUPP;
+                }
+#endif
         }
 
         rc = pci_request_regions(pdev, DRV_NAME);
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index a5ecb71390a9..0ed263be652a 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -53,6 +53,7 @@ extern unsigned ata_exec_internal(struct ata_device *dev,
 extern unsigned int ata_do_simple_cmd(struct ata_device *dev, u8 cmd);
 extern int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
                            int post_reset, u16 *id);
+extern int ata_dev_revalidate(struct ata_device *dev, int post_reset);
 extern int ata_dev_configure(struct ata_device *dev, int print_info);
 extern int sata_down_spd_limit(struct ata_port *ap);
 extern int sata_set_spd_needed(struct ata_port *ap);
diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
index 29234c897118..5c47a9e0e0ca 100644
--- a/drivers/ata/pata_amd.c
+++ b/drivers/ata/pata_amd.c
@@ -677,6 +677,8 @@ static const struct pci_device_id amd[] = {
         { PCI_VDEVICE(NVIDIA,   PCI_DEVICE_ID_NVIDIA_NFORCE_MCP51_IDE), 8 },
         { PCI_VDEVICE(NVIDIA,   PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE), 8 },
         { PCI_VDEVICE(NVIDIA,   PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_IDE), 8 },
+        { PCI_VDEVICE(NVIDIA,   PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_IDE), 8 },
+        { PCI_VDEVICE(NVIDIA,   PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE), 8 },
         { PCI_VDEVICE(AMD,      PCI_DEVICE_ID_AMD_CS5536_IDE),          9 },
 
         { },
diff --git a/drivers/ata/pata_artop.c b/drivers/ata/pata_artop.c
index 690828eb5226..96a098020a8f 100644
--- a/drivers/ata/pata_artop.c
+++ b/drivers/ata/pata_artop.c
@@ -92,7 +92,7 @@ static int artop6260_pre_reset(struct ata_port *ap)
                 return -ENOENT;
 
         pci_read_config_byte(pdev, 0x49, &tmp);
-        if (tmp & (1 >> ap->port_no))
+        if (tmp & (1 << ap->port_no))
                 ap->cbl = ATA_CBL_PATA40;
         else
                 ap->cbl = ATA_CBL_PATA80;
diff --git a/drivers/ata/pata_hpt37x.c b/drivers/ata/pata_hpt37x.c
index 7350443948c1..fce3fcdc7e79 100644
--- a/drivers/ata/pata_hpt37x.c
+++ b/drivers/ata/pata_hpt37x.c
@@ -25,7 +25,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME        "pata_hpt37x"
-#define DRV_VERSION     "0.5"
+#define DRV_VERSION     "0.5.1"
 
 struct hpt_clock {
         u8      xfer_speed;
@@ -453,7 +453,13 @@ static int hpt37x_pre_reset(struct ata_port *ap)
 {
         u8 scr2, ata66;
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
-
+        static const struct pci_bits hpt37x_enable_bits[] = {
+                { 0x50, 1, 0x04, 0x04 },
+                { 0x54, 1, 0x04, 0x04 }
+        };
+        if (!pci_test_config_bits(pdev, &hpt37x_enable_bits[ap->port_no]))
+                return -ENOENT;
+                
         pci_read_config_byte(pdev, 0x5B, &scr2);
         pci_write_config_byte(pdev, 0x5B, scr2 & ~0x01);
         /* Cable register now active */
@@ -488,10 +494,17 @@ static void hpt37x_error_handler(struct ata_port *ap)
 
 static int hpt374_pre_reset(struct ata_port *ap)
 {
+        static const struct pci_bits hpt37x_enable_bits[] = {
+                { 0x50, 1, 0x04, 0x04 },
+                { 0x54, 1, 0x04, 0x04 }
+        };
         u16 mcr3, mcr6;
         u8 ata66;
-
         struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+
+        if (!pci_test_config_bits(pdev, &hpt37x_enable_bits[ap->port_no]))
+                return -ENOENT;
+                
         /* Do the extra channel work */
         pci_read_config_word(pdev, 0x52, &mcr3);
         pci_read_config_word(pdev, 0x56, &mcr6);
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 7977f471d5e9..2c3cc0ccc606 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -141,7 +141,7 @@ static void qdi_data_xfer(struct ata_device *adev, unsigned char *buf, unsigned
                                 memcpy(&pad, buf + buflen - slop, slop);
                                 outl(le32_to_cpu(pad), ap->ioaddr.data_addr);
                         } else {
-                                pad = cpu_to_le16(inl(ap->ioaddr.data_addr));
+                                pad = cpu_to_le32(inl(ap->ioaddr.data_addr));
                                 memcpy(buf + buflen - slop, &pad, slop);
                         }
                 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 323b60710806..d65ebfd7c7b2 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -117,10 +117,14 @@ static const struct pci_device_id nv_pci_tbl[] = {
         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA), GENERIC },
         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA2), GENERIC },
         { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_SATA3), GENERIC },
-        { PCI_VDEVICE(NVIDIA, 0x045c), GENERIC },
-        { PCI_VDEVICE(NVIDIA, 0x045d), GENERIC },
-        { PCI_VDEVICE(NVIDIA, 0x045e), GENERIC },
-        { PCI_VDEVICE(NVIDIA, 0x045f), GENERIC },
+        { PCI_VDEVICE(NVIDIA, 0x045c), GENERIC }, /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045d), GENERIC }, /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045e), GENERIC }, /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x045f), GENERIC }, /* MCP65 */
+        { PCI_VDEVICE(NVIDIA, 0x0550), GENERIC }, /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0551), GENERIC }, /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0552), GENERIC }, /* MCP67 */
+        { PCI_VDEVICE(NVIDIA, 0x0553), GENERIC }, /* MCP67 */
         { PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
                 PCI_ANY_ID, PCI_ANY_ID,
                 PCI_CLASS_STORAGE_IDE<<8, 0xffff00, GENERIC },
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 8bcdfa64667c..72eda5160fad 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -260,6 +260,7 @@ static const struct pci_device_id pdc_ata_pci_tbl[] = {
 #if 0
         { PCI_VDEVICE(PROMISE, 0x3570), board_20771 },
 #endif
+        { PCI_VDEVICE(PROMISE, 0x3577), board_20771 },
 
         { }     /* terminate list */
 };
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index 0738f52463a9..9d1235ba06b1 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -240,7 +240,7 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         struct ata_probe_ent *probe_ent = NULL;
         int rc;
         u32 genctl;
-        struct ata_port_info *ppi[2];
+        struct ata_port_info pi = sis_port_info, *ppi[2] = { &pi, &pi };
         int pci_dev_busy = 0;
         u8 pmr;
         u8 port2_start;
@@ -265,27 +265,20 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto err_out_regions;
 
-        ppi[0] = ppi[1] = &sis_port_info;
-        probe_ent = ata_pci_init_native_mode(pdev, ppi, ATA_PORT_PRIMARY | ATA_PORT_SECONDARY);
-        if (!probe_ent) {
-                rc = -ENOMEM;
-                goto err_out_regions;
-        }
-
         /* check and see if the SCRs are in IO space or PCI cfg space */
         pci_read_config_dword(pdev, SIS_GENCTL, &genctl);
         if ((genctl & GENCTL_IOMAPPED_SCR) == 0)
-                probe_ent->port_flags |= SIS_FLAG_CFGSCR;
+                pi.flags |= SIS_FLAG_CFGSCR;
 
         /* if hardware thinks SCRs are in IO space, but there are
          * no IO resources assigned, change to PCI cfg space.
          */
-        if ((!(probe_ent->port_flags & SIS_FLAG_CFGSCR)) &&
+        if ((!(pi.flags & SIS_FLAG_CFGSCR)) &&
             ((pci_resource_start(pdev, SIS_SCR_PCI_BAR) == 0) ||
              (pci_resource_len(pdev, SIS_SCR_PCI_BAR) < 128))) {
                 genctl &= ~GENCTL_IOMAPPED_SCR;
                 pci_write_config_dword(pdev, SIS_GENCTL, genctl);
-                probe_ent->port_flags |= SIS_FLAG_CFGSCR;
+                pi.flags |= SIS_FLAG_CFGSCR;
         }
 
         pci_read_config_byte(pdev, SIS_PMR, &pmr);
@@ -306,6 +299,12 @@ static int sis_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                 port2_start = 0x20;
         }
 
+        probe_ent = ata_pci_init_native_mode(pdev, ppi, ATA_PORT_PRIMARY | ATA_PORT_SECONDARY);
+        if (!probe_ent) {
+                rc = -ENOMEM;
+                goto err_out_regions;
+        }
+
         if (!(probe_ent->port_flags & SIS_FLAG_CFGSCR)) {
                 probe_ent->port[0].scr_addr =
                         pci_resource_start(pdev, SIS_SCR_PCI_BAR);
diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c
index f4455a1efe2d..1c7f19aecc25 100644
--- a/drivers/ata/sata_via.c
+++ b/drivers/ata/sata_via.c
@@ -230,7 +230,7 @@ static int vt6420_prereset(struct ata_port *ap)
         int online;
 
         /* don't do any SCR stuff if we're not loading */
-        if (!ATA_PFLAG_LOADING)
+        if (!(ap->pflags & ATA_PFLAG_LOADING))
                 goto skip_scr;
 
         /* Resume phy.  This is the old resume sequence from
diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
index 323592de047b..9fffa7af6db1 100644
--- a/drivers/atm/ambassador.c
+++ b/drivers/atm/ambassador.c
@@ -2452,8 +2452,8 @@ static int __init amb_module_init (void)
 static void __exit amb_module_exit (void)
 {
   PRINTD (DBG_FLOW|DBG_INIT, "cleanup_module");
-  
-  return pci_unregister_driver(&amb_driver);
+
+  pci_unregister_driver(&amb_driver);
 }
 
 module_init(amb_module_init);
diff --git a/drivers/atm/firestream.c b/drivers/atm/firestream.c
index 40ab9b65fae9..697ad82f6634 100644
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@@ -1002,6 +1002,10 @@ static int fs_open(struct atm_vcc *atm_vcc)
                                         r = ROUND_UP;
                                 }
                                 error = make_rate (pcr, r, &tmc0, NULL);
+                                if (error) {
+                                        kfree(tc);
+                                        return error;
+                                }
                         }
                         fs_dprintk (FS_DEBUG_OPEN, "pcr = %d.\n", pcr);
                 }
diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c
index f59349206dd2..4dc10105d610 100644
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -1789,7 +1789,7 @@ static inline void CLOCK_IT (const hrz_dev *dev, u32 ctrl)
         WRITE_IT_WAIT(dev, ctrl | SEEPROM_SK);
 }
 
-static u16 __init read_bia (const hrz_dev * dev, u16 addr)
+static u16 __devinit read_bia (const hrz_dev * dev, u16 addr)
 {
   u32 ctrl = rd_regl (dev, CONTROL_0_REG);
   
@@ -2932,8 +2932,8 @@ static int __init hrz_module_init (void) {
 
 static void __exit hrz_module_exit (void) {
   PRINTD (DBG_FLOW, "cleanup_module");
-  
-  return pci_unregister_driver(&hrz_driver);
+
+  pci_unregister_driver(&hrz_driver);
 }
 
 module_init(hrz_module_init);
diff --git a/drivers/atm/nicstar.c b/drivers/atm/nicstar.c
index 632ede552761..bd0904594805 100644
--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -2759,7 +2759,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
 {
    ns_dev *card;
    pool_levels pl;
-   int btype;
+   long btype;
    unsigned long flags;
 
    card = dev->dev_data;
@@ -2859,7 +2859,7 @@ static int ns_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
       case NS_ADJBUFLEV:
          if (!capable(CAP_NET_ADMIN))
             return -EPERM;
-         btype = (int) arg;     /* an int is the same size as a pointer */
+         btype = (long) arg;    /* a long is the same size as a pointer or bigger */
          switch (btype)
          {
             case NS_BUFTYPE_SMALL:
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 0b4e22436935..1429f3a2629e 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -37,8 +37,8 @@ config DEBUG_DRIVER
 
           If you are unsure about this, say N here.
 
-endmenu
-
 config SYS_HYPERVISOR
         bool
         default n
+
+endmenu
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 12173d16bea7..7d8a7ce73fb3 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -372,19 +372,30 @@ int bus_add_device(struct device * dev)
                 pr_debug("bus %s: add device %s\n", bus->name, dev->bus_id);
                 error = device_add_attrs(bus, dev);
                 if (error)
-                        goto out;
+                        goto out_put;
                 error = sysfs_create_link(&bus->devices.kobj,
                                                 &dev->kobj, dev->bus_id);
                 if (error)
-                        goto out;
+                        goto out_id;
                 error = sysfs_create_link(&dev->kobj,
                                 &dev->bus->subsys.kset.kobj, "subsystem");
                 if (error)
-                        goto out;
+                        goto out_subsys;
                 error = sysfs_create_link(&dev->kobj,
                                 &dev->bus->subsys.kset.kobj, "bus");
+                if (error)
+                        goto out_deprecated;
         }
-out:
+        return 0;
+
+out_deprecated:
+        sysfs_remove_link(&dev->kobj, "subsystem");
+out_subsys:
+        sysfs_remove_link(&bus->devices.kobj, dev->bus_id);
+out_id:
+        device_remove_attrs(bus, dev);
+out_put:
+        put_bus(dev->bus);
         return error;
 }
 
@@ -428,8 +439,10 @@ void bus_remove_device(struct device * dev)
                 sysfs_remove_link(&dev->kobj, "bus");
                 sysfs_remove_link(&dev->bus->devices.kobj, dev->bus_id);
                 device_remove_attrs(dev->bus, dev);
-                dev->is_registered = 0;
-                klist_del(&dev->knode_bus);
+                if (dev->is_registered) {
+                        dev->is_registered = 0;
+                        klist_del(&dev->knode_bus);
+                }
                 pr_debug("bus %s: remove device %s\n", dev->bus->name, dev->bus_id);
                 device_release_driver(dev);
                 put_bus(dev->bus);
@@ -505,34 +518,36 @@ int bus_add_driver(struct device_driver *drv)
         struct bus_type * bus = get_bus(drv->bus);
         int error = 0;
 
-        if (bus) {
-                pr_debug("bus %s: add driver %s\n", bus->name, drv->name);
-                error = kobject_set_name(&drv->kobj, "%s", drv->name);
-                if (error)
-                        goto out_put_bus;
-                drv->kobj.kset = &bus->drivers;
-                if ((error = kobject_register(&drv->kobj)))
-                        goto out_put_bus;
-
-                error = driver_attach(drv);
-                if (error)
-                        goto out_unregister;
-                klist_add_tail(&drv->knode_bus, &bus->klist_drivers);
-                module_add_driver(drv->owner, drv);
-
-                error = driver_add_attrs(bus, drv);
-                if (error) {
-                        /* How the hell do we get out of this pickle? Give up */
-                        printk(KERN_ERR "%s: driver_add_attrs(%s) failed\n",
-                                __FUNCTION__, drv->name);
-                }
-                error = add_bind_files(drv);
-                if (error) {
-                        /* Ditto */
-                        printk(KERN_ERR "%s: add_bind_files(%s) failed\n",
-                                __FUNCTION__, drv->name);
-                }
+        if (!bus)
+                return 0;
+
+        pr_debug("bus %s: add driver %s\n", bus->name, drv->name);
+        error = kobject_set_name(&drv->kobj, "%s", drv->name);
+        if (error)
+                goto out_put_bus;
+        drv->kobj.kset = &bus->drivers;
+        if ((error = kobject_register(&drv->kobj)))
+                goto out_put_bus;
+
+        error = driver_attach(drv);
+        if (error)
+                goto out_unregister;
+        klist_add_tail(&drv->knode_bus, &bus->klist_drivers);
+        module_add_driver(drv->owner, drv);
+
+        error = driver_add_attrs(bus, drv);
+        if (error) {
+                /* How the hell do we get out of this pickle? Give up */
+                printk(KERN_ERR "%s: driver_add_attrs(%s) failed\n",
+                        __FUNCTION__, drv->name);
         }
+        error = add_bind_files(drv);
+        if (error) {
+                /* Ditto */
+                printk(KERN_ERR "%s: add_bind_files(%s) failed\n",
+                        __FUNCTION__, drv->name);
+        }
+
         return error;
 out_unregister:
         kobject_unregister(&drv->kobj);
@@ -552,16 +567,17 @@ out_put_bus:
 
 void bus_remove_driver(struct device_driver * drv)
 {
-        if (drv->bus) {
-                remove_bind_files(drv);
-                driver_remove_attrs(drv->bus, drv);
-                klist_remove(&drv->knode_bus);
-                pr_debug("bus %s: remove driver %s\n", drv->bus->name, drv->name);
-                driver_detach(drv);
-                module_remove_driver(drv);
-                kobject_unregister(&drv->kobj);
-                put_bus(drv->bus);
-        }
+        if (!drv->bus)
+                return;
+
+        remove_bind_files(drv);
+        driver_remove_attrs(drv->bus, drv);
+        klist_remove(&drv->knode_bus);
+        pr_debug("bus %s: remove driver %s\n", drv->bus->name, drv->name);
+        driver_detach(drv);
+        module_remove_driver(drv);
+        kobject_unregister(&drv->kobj);
+        put_bus(drv->bus);
 }
 
 
@@ -732,11 +748,15 @@ int bus_register(struct bus_type * bus)
 
         klist_init(&bus->klist_devices, klist_devices_get, klist_devices_put);
         klist_init(&bus->klist_drivers, NULL, NULL);
-        bus_add_attrs(bus);
+        retval = bus_add_attrs(bus);
+        if (retval)
+                goto bus_attrs_fail;
 
         pr_debug("bus type '%s' registered\n", bus->name);
         return 0;
 
+bus_attrs_fail:
+        kset_unregister(&bus->drivers);
 bus_drivers_fail:
         kset_unregister(&bus->devices);
 bus_devices_fail:
diff --git a/drivers/base/class.c b/drivers/base/class.c
index b32b77ff2dcd..0ff267a248db 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -562,7 +562,10 @@ int class_device_add(struct class_device *class_dev)
                 goto out2;
 
         /* add the needed attributes to this device */
-        sysfs_create_link(&class_dev->kobj, &parent_class->subsys.kset.kobj, "subsystem");
+        error = sysfs_create_link(&class_dev->kobj,
+                                  &parent_class->subsys.kset.kobj, "subsystem");
+        if (error)
+                goto out3;
         class_dev->uevent_attr.attr.name = "uevent";
         class_dev->uevent_attr.attr.mode = S_IWUSR;
         class_dev->uevent_attr.attr.owner = parent_class->owner;
diff --git a/drivers/base/core.c b/drivers/base/core.c
index b224bb43ff63..68ad11af22b4 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -44,7 +44,7 @@ const char *dev_driver_string(struct device *dev)
         return dev->driver ? dev->driver->name :
                         (dev->bus ? dev->bus->name : "");
 }
-EXPORT_SYMBOL_GPL(dev_driver_string);
+EXPORT_SYMBOL(dev_driver_string);
 
 #define to_dev(obj) container_of(obj, struct device, kobj)
 #define to_dev_attr(_attr) container_of(_attr, struct device_attribute, attr)
@@ -433,14 +433,16 @@ int device_add(struct device *dev)
         if (dev->driver)
                 dev->uevent_attr.attr.owner = dev->driver->owner;
         dev->uevent_attr.store = store_uevent;
-        device_create_file(dev, &dev->uevent_attr);
+        error = device_create_file(dev, &dev->uevent_attr);
+        if (error)
+                goto attrError;
 
         if (MAJOR(dev->devt)) {
                 struct device_attribute *attr;
                 attr = kzalloc(sizeof(*attr), GFP_KERNEL);
                 if (!attr) {
                         error = -ENOMEM;
-                        goto PMError;
+                        goto ueventattrError;
                 }
                 attr->attr.name = "dev";
                 attr->attr.mode = S_IRUGO;
@@ -450,7 +452,7 @@ int device_add(struct device *dev)
                 error = device_create_file(dev, attr);
                 if (error) {
                         kfree(attr);
-                        goto attrError;
+                        goto ueventattrError;
                 }
 
                 dev->devt_attr = attr;
@@ -477,7 +479,8 @@ int device_add(struct device *dev)
         if ((error = bus_add_device(dev)))
                 goto BusError;
         kobject_uevent(&dev->kobj, KOBJ_ADD);
-        bus_attach_device(dev);
+        if ((error = bus_attach_device(dev)))
+                goto AttachError;
         if (parent)
                 klist_add_tail(&dev->knode_parent, &parent->klist_children);
 
@@ -496,6 +499,8 @@ int device_add(struct device *dev)
         kfree(class_name);
         put_device(dev);
         return error;
+ AttachError:
+        bus_remove_device(dev);
  BusError:
         device_pm_remove(dev);
  PMError:
@@ -507,6 +512,8 @@ int device_add(struct device *dev)
                 device_remove_file(dev, dev->devt_attr);
                 kfree(dev->devt_attr);
         }
+ ueventattrError:
+        device_remove_file(dev, &dev->uevent_attr);
  attrError:
         kobject_uevent(&dev->kobj, KOBJ_REMOVE);
         kobject_del(&dev->kobj);
@@ -805,8 +812,10 @@ int device_rename(struct device *dev, char *new_name)
 
         if (dev->class) {
                 old_symlink_name = kmalloc(BUS_ID_SIZE, GFP_KERNEL);
-                if (!old_symlink_name)
-                        return -ENOMEM;
+                if (!old_symlink_name) {
+                        error = -ENOMEM;
+                        goto out_free_old_class;
+                }
                 strlcpy(old_symlink_name, dev->bus_id, BUS_ID_SIZE);
         }
 
@@ -830,9 +839,10 @@ int device_rename(struct device *dev, char *new_name)
         }
         put_device(dev);
 
-        kfree(old_class_name);
         kfree(new_class_name);
         kfree(old_symlink_name);
+ out_free_old_class:
+        kfree(old_class_name);
 
         return error;
 }
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index b5f43c3e44fa..c5d6bb4290ad 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -18,6 +18,7 @@
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/kthread.h>
+#include <linux/wait.h>
 
 #include "base.h"
 #include "power/power.h"
@@ -70,6 +71,8 @@ struct stupid_thread_structure {
 };
 
 static atomic_t probe_count = ATOMIC_INIT(0);
+static DECLARE_WAIT_QUEUE_HEAD(probe_waitqueue);
+
 static int really_probe(void *void_data)
 {
         struct stupid_thread_structure *data = void_data;
@@ -121,6 +124,7 @@ probe_failed:
 done:
         kfree(data);
         atomic_dec(&probe_count);
+        wake_up(&probe_waitqueue);
         return ret;
 }
 
@@ -171,6 +175,8 @@ int driver_probe_device(struct device_driver * drv, struct device * dev)
                  drv->bus->name, dev->bus_id, drv->name);
 
         data = kmalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
         data->drv = drv;
         data->dev = dev;
 
@@ -178,7 +184,7 @@ int driver_probe_device(struct device_driver * drv, struct device * dev)
                 probe_task = kthread_run(really_probe, data,
                                          "probe-%s", dev->bus_id);
                 if (IS_ERR(probe_task))
-                        ret = PTR_ERR(probe_task);
+                        ret = really_probe(data);
         } else
                 ret = really_probe(data);
 
@@ -335,6 +341,32 @@ void driver_detach(struct device_driver * drv)
         }
 }
 
+#ifdef CONFIG_PCI_MULTITHREAD_PROBE
+static int __init wait_for_probes(void)
+{
+        DEFINE_WAIT(wait);
+
+        printk(KERN_INFO "%s: waiting for %d threads\n", __FUNCTION__,
+                        atomic_read(&probe_count));
+        if (!atomic_read(&probe_count))
+                return 0;
+        while (atomic_read(&probe_count)) {
+                prepare_to_wait(&probe_waitqueue, &wait, TASK_UNINTERRUPTIBLE);
+                if (atomic_read(&probe_count))
+                        schedule();
+        }
+        finish_wait(&probe_waitqueue, &wait);
+        return 0;
+}
+
+core_initcall_sync(wait_for_probes);
+postcore_initcall_sync(wait_for_probes);
+arch_initcall_sync(wait_for_probes);
+subsys_initcall_sync(wait_for_probes);
+fs_initcall_sync(wait_for_probes);
+device_initcall_sync(wait_for_probes);
+late_initcall_sync(wait_for_probes);
+#endif
 
 EXPORT_SYMBOL_GPL(device_bind_driver);
 EXPORT_SYMBOL_GPL(device_release_driver);
diff --git a/drivers/base/dmapool.c b/drivers/base/dmapool.c
index 33c5cce1560b..b2efbd4cf710 100644
--- a/drivers/base/dmapool.c
+++ b/drivers/base/dmapool.c
@@ -141,11 +141,20 @@ dma_pool_create (const char *name, struct device *dev,
         init_waitqueue_head (&retval->waitq);
 
         if (dev) {
+                int ret;
+
                 down (&pools_lock);
                 if (list_empty (&dev->dma_pools))
-                        device_create_file (dev, &dev_attr_pools);
+                        ret = device_create_file (dev, &dev_attr_pools);
+                else
+                        ret = 0;
                 /* note:  not currently insisting "name" be unique */
-                list_add (&retval->pools, &dev->dma_pools);
+                if (!ret)
+                        list_add (&retval->pools, &dev->dma_pools);
+                else {
+                        kfree(retval);
+                        retval = NULL;
+                }
                 up (&pools_lock);
         } else
                 INIT_LIST_HEAD (&retval->pools);
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index 3ef9d514b916..28dccb730af9 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -97,8 +97,7 @@ static struct attribute_group topology_attr_group = {
 /* Add/Remove cpu_topology interface for CPU device */
 static int __cpuinit topology_add_dev(struct sys_device * sys_dev)
 {
-        sysfs_create_group(&sys_dev->kobj, &topology_attr_group);
-        return 0;
+        return sysfs_create_group(&sys_dev->kobj, &topology_attr_group);
 }
 
 static int __cpuinit topology_remove_dev(struct sys_device * sys_dev)
diff --git a/drivers/block/DAC960.h b/drivers/block/DAC960.h
index cec539e601fe..6148073532b2 100644
--- a/drivers/block/DAC960.h
+++ b/drivers/block/DAC960.h
@@ -4379,8 +4379,8 @@ static inline void DAC960_P_To_PD_TranslateEnquiry(void *Enquiry)
 static inline void DAC960_P_To_PD_TranslateDeviceState(void *DeviceState)
 {
   memcpy(DeviceState + 2, DeviceState + 3, 1);
-  memcpy(DeviceState + 4, DeviceState + 5, 2);
-  memcpy(DeviceState + 6, DeviceState + 8, 4);
+  memmove(DeviceState + 4, DeviceState + 5, 2);
+  memmove(DeviceState + 6, DeviceState + 8, 4);
 }
 
 static inline
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 5d254b714509..5d6562171533 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1709,10 +1709,13 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
         return get_disk(unit[drive].gendisk);
 }
 
-int __init amiga_floppy_init(void)
+static int __init amiga_floppy_init(void)
 {
         int i, ret;
 
+        if (!MACH_IS_AMIGA)
+                return -ENXIO;
+
         if (!AMIGAHW_PRESENT(AMI_FLOPPY))
                 return -ENXIO;
 
@@ -1809,15 +1812,9 @@ out_blkdev:
         return ret;
 }
 
+module_init(amiga_floppy_init);
 #ifdef MODULE
 
-int init_module(void)
-{
-        if (!MACH_IS_AMIGA)
-                return -ENXIO;
-        return amiga_floppy_init();
-}
-
 #if 0 /* not safe to unload */
 void cleanup_module(void)
 {
diff --git a/drivers/block/aoe/aoe.h b/drivers/block/aoe/aoe.h
index 6eebcb7be97e..6d111228cfac 100644
--- a/drivers/block/aoe/aoe.h
+++ b/drivers/block/aoe/aoe.h
@@ -1,5 +1,5 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
-#define VERSION "22"
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
+#define VERSION "32"
 #define AOE_MAJOR 152
 #define DEVICE_NAME "aoe"
 
@@ -65,7 +65,7 @@ struct aoe_atahdr {
 struct aoe_cfghdr {
         __be16 bufcnt;
         __be16 fwver;
-        unsigned char res;
+        unsigned char scnt;
         unsigned char aoeccmd;
         unsigned char cslen[2];
 };
@@ -78,12 +78,14 @@ enum {
         DEVFL_GDALLOC = (1<<4), /* need to alloc gendisk */
         DEVFL_PAUSE = (1<<5),
         DEVFL_NEWSIZE = (1<<6), /* need to update dev size in block layer */
+        DEVFL_MAXBCNT = (1<<7), /* d->maxbcnt is not changeable */
+        DEVFL_KICKME = (1<<8),
 
         BUFFL_FAIL = 1,
 };
 
 enum {
-        MAXATADATA = 1024,
+        DEFAULTBCNT = 2 * 512,  /* 2 sectors */
         NPERSHELF = 16,         /* number of slots per shelf address */
         FREETAG = -1,
         MIN_BUFS = 8,
@@ -107,11 +109,9 @@ struct frame {
         ulong waited;
         struct buf *buf;
         char *bufaddr;
-        int writedatalen;
-        int ndata;
-
-        /* largest possible */
-        unsigned char data[sizeof(struct aoe_hdr) + sizeof(struct aoe_atahdr)];
+        ulong bcnt;
+        sector_t lba;
+        struct sk_buff *skb;
 };
 
 struct aoedev {
@@ -121,9 +121,12 @@ struct aoedev {
         ulong sysminor;
         ulong aoemajor;
         ulong aoeminor;
-        ulong nopen;            /* (bd_openers isn't available without sleeping) */
-        ulong rttavg;           /* round trip average of requests/responses */
+        u16 nopen;              /* (bd_openers isn't available without sleeping) */
+        u16 lasttag;            /* last tag sent */
+        u16 rttavg;             /* round trip average of requests/responses */
+        u16 mintimer;
         u16 fw_ver;             /* version of blade's firmware */
+        u16 maxbcnt;
         struct work_struct work;/* disk create work struct */
         struct gendisk *gd;
         request_queue_t blkq;
@@ -137,8 +140,8 @@ struct aoedev {
         mempool_t *bufpool;     /* for deadlock-free Buf allocation */
         struct list_head bufq;  /* queue of bios to work on */
         struct buf *inprocess;  /* the one we're currently working on */
-        ulong lasttag;          /* last tag sent */
-        ulong nframes;          /* number of frames below */
+        ushort lostjumbo;
+        ushort nframes;         /* number of frames below */
         struct frame *frames;
 };
 
@@ -157,6 +160,7 @@ void aoecmd_cfg(ushort aoemajor, unsigned char aoeminor);
 void aoecmd_ata_rsp(struct sk_buff *);
 void aoecmd_cfg_rsp(struct sk_buff *);
 void aoecmd_sleepwork(void *vp);
+struct sk_buff *new_skb(ulong);
 
 int aoedev_init(void);
 void aoedev_exit(void);
diff --git a/drivers/block/aoe/aoeblk.c b/drivers/block/aoe/aoeblk.c
index 393b86a3dbf8..aa25f8b09fe3 100644
--- a/drivers/block/aoe/aoeblk.c
+++ b/drivers/block/aoe/aoeblk.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoeblk.c
  * block device routines
@@ -14,7 +14,6 @@
 
 static kmem_cache_t *buf_pool_cache;
 
-/* add attributes for our block devices in sysfs */
 static ssize_t aoedisk_show_state(struct gendisk * disk, char *page)
 {
         struct aoedev *d = disk->private_data;
@@ -64,21 +63,27 @@ static struct disk_attribute disk_attr_fwver = {
         .show = aoedisk_show_fwver
 };
 
-static void
+static struct attribute *aoe_attrs[] = {
+        &disk_attr_state.attr,
+        &disk_attr_mac.attr,
+        &disk_attr_netif.attr,
+        &disk_attr_fwver.attr,
+        NULL
+};
+
+static const struct attribute_group attr_group = {
+        .attrs = aoe_attrs,
+};
+
+static int
 aoedisk_add_sysfs(struct aoedev *d)
 {
-        sysfs_create_file(&d->gd->kobj, &disk_attr_state.attr);
-        sysfs_create_file(&d->gd->kobj, &disk_attr_mac.attr);
-        sysfs_create_file(&d->gd->kobj, &disk_attr_netif.attr);
-        sysfs_create_file(&d->gd->kobj, &disk_attr_fwver.attr);
+        return sysfs_create_group(&d->gd->kobj, &attr_group);
 }
 void
 aoedisk_rm_sysfs(struct aoedev *d)
 {
-        sysfs_remove_link(&d->gd->kobj, "state");
-        sysfs_remove_link(&d->gd->kobj, "mac");
-        sysfs_remove_link(&d->gd->kobj, "netif");
-        sysfs_remove_link(&d->gd->kobj, "firmware-version");
+        sysfs_remove_group(&d->gd->kobj, &attr_group);
 }
 
 static int
@@ -132,8 +137,7 @@ aoeblk_make_request(request_queue_t *q, struct bio *bio)
         d = bio->bi_bdev->bd_disk->private_data;
         buf = mempool_alloc(d->bufpool, GFP_NOIO);
         if (buf == NULL) {
-                printk(KERN_INFO "aoe: aoeblk_make_request: buf allocation "
-                        "failure\n");
+                printk(KERN_INFO "aoe: buf allocation failure\n");
                 bio_endio(bio, bio->bi_size, -ENOMEM);
                 return 0;
         }
@@ -143,14 +147,15 @@ aoeblk_make_request(request_queue_t *q, struct bio *bio)
         buf->bio = bio;
         buf->resid = bio->bi_size;
         buf->sector = bio->bi_sector;
-        buf->bv = buf->bio->bi_io_vec;
+        buf->bv = &bio->bi_io_vec[bio->bi_idx];
+        WARN_ON(buf->bv->bv_len == 0);
         buf->bv_resid = buf->bv->bv_len;
         buf->bufaddr = page_address(buf->bv->bv_page) + buf->bv->bv_offset;
 
         spin_lock_irqsave(&d->lock, flags);
 
         if ((d->flags & DEVFL_UP) == 0) {
-                printk(KERN_INFO "aoe: aoeblk_make_request: device %ld.%ld is not up\n",
+                printk(KERN_INFO "aoe: device %ld.%ld is not up\n",
                         d->aoemajor, d->aoeminor);
                 spin_unlock_irqrestore(&d->lock, flags);
                 mempool_free(buf, d->bufpool);
@@ -176,7 +181,7 @@ aoeblk_getgeo(struct block_device *bdev, struct hd_geometry *geo)
         struct aoedev *d = bdev->bd_disk->private_data;
 
         if ((d->flags & DEVFL_UP) == 0) {
-                printk(KERN_ERR "aoe: aoeblk_ioctl: disk not up\n");
+                printk(KERN_ERR "aoe: disk not up\n");
                 return -ENODEV;
         }
 
@@ -203,8 +208,8 @@ aoeblk_gdalloc(void *vp)
 
         gd = alloc_disk(AOE_PARTITIONS);
         if (gd == NULL) {
-                printk(KERN_ERR "aoe: aoeblk_gdalloc: cannot allocate disk "
-                        "structure for %ld.%ld\n", d->aoemajor, d->aoeminor);
+                printk(KERN_ERR "aoe: cannot allocate disk structure for %ld.%ld\n",
+                        d->aoemajor, d->aoeminor);
                 spin_lock_irqsave(&d->lock, flags);
                 d->flags &= ~DEVFL_GDALLOC;
                 spin_unlock_irqrestore(&d->lock, flags);
@@ -213,8 +218,8 @@ aoeblk_gdalloc(void *vp)
 
         d->bufpool = mempool_create_slab_pool(MIN_BUFS, buf_pool_cache);
         if (d->bufpool == NULL) {
-                printk(KERN_ERR "aoe: aoeblk_gdalloc: cannot allocate bufpool "
-                        "for %ld.%ld\n", d->aoemajor, d->aoeminor);
+                printk(KERN_ERR "aoe: cannot allocate bufpool for %ld.%ld\n",
+                        d->aoemajor, d->aoeminor);
                 put_disk(gd);
                 spin_lock_irqsave(&d->lock, flags);
                 d->flags &= ~DEVFL_GDALLOC;
diff --git a/drivers/block/aoe/aoechr.c b/drivers/block/aoe/aoechr.c
index 1bc1cf9603f1..e22b4c9520a9 100644
--- a/drivers/block/aoe/aoechr.c
+++ b/drivers/block/aoe/aoechr.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoechr.c
  * AoE character device driver
@@ -15,7 +15,6 @@ enum {
         MINOR_INTERFACES,
         MINOR_REVALIDATE,
         MSGSZ = 2048,
-        NARGS = 10,
         NMSG = 100,             /* message backlog to retain */
 };
 
@@ -56,9 +55,8 @@ static int
 interfaces(const char __user *str, size_t size)
 {
         if (set_aoe_iflist(str, size)) {
-                printk(KERN_CRIT
-                       "%s: could not set interface list: %s\n",
-                       __FUNCTION__, "too many interfaces");
+                printk(KERN_ERR
+                        "aoe: could not set interface list: too many interfaces\n");
                 return -EINVAL;
         }
         return 0;
@@ -81,8 +79,7 @@ revalidate(const char __user *str, size_t size)
         /* should be e%d.%d format */
         n = sscanf(buf, "e%d.%d", &major, &minor);
         if (n != 2) {
-                printk(KERN_ERR "aoe: %s: invalid device specification\n",
-                        __FUNCTION__);
+                printk(KERN_ERR "aoe: invalid device specification\n");
                 return -EINVAL;
         }
         d = aoedev_by_aoeaddr(major, minor);
@@ -90,6 +87,7 @@ revalidate(const char __user *str, size_t size)
                 return -EINVAL;
 
         spin_lock_irqsave(&d->lock, flags);
+        d->flags &= ~DEVFL_MAXBCNT;
         d->flags |= DEVFL_PAUSE;
         spin_unlock_irqrestore(&d->lock, flags);
         aoecmd_cfg(major, minor);
@@ -116,7 +114,7 @@ bail:		spin_unlock_irqrestore(&emsgs_lock, flags);
 
         mp = kmalloc(n, GFP_ATOMIC);
         if (mp == NULL) {
-                printk(KERN_CRIT "aoe: aoechr_error: allocation failure, len=%ld\n", n);
+                printk(KERN_ERR "aoe: allocation failure, len=%ld\n", n);
                 goto bail;
         }
 
@@ -141,7 +139,7 @@ aoechr_write(struct file *filp, const char __user *buf, size_t cnt, loff_t *offp
 
         switch ((unsigned long) filp->private_data) {
         default:
-                printk(KERN_INFO "aoe: aoechr_write: can't write to that file.\n");
+                printk(KERN_INFO "aoe: can't write to that file.\n");
                 break;
         case MINOR_DISCOVER:
                 ret = discover();
@@ -250,7 +248,7 @@ aoechr_init(void)
 
         n = register_chrdev(AOE_MAJOR, "aoechr", &aoe_fops);
         if (n < 0) { 
-                printk(KERN_ERR "aoe: aoechr_init: can't register char device\n");
+                printk(KERN_ERR "aoe: can't register char device\n");
                 return n;
         }
         sema_init(&emsgs_sema, 0);
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 39da28d344fe..8a13b1af8bab 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoecmd.c
  * Filesystem request handling methods
@@ -15,17 +15,19 @@
 #define TIMERTICK (HZ / 10)
 #define MINTIMER (2 * TIMERTICK)
 #define MAXTIMER (HZ << 1)
-#define MAXWAIT (60 * 3)        /* After MAXWAIT seconds, give up and fail dev */
 
-static struct sk_buff *
-new_skb(struct net_device *if_dev, ulong len)
+static int aoe_deadsecs = 60 * 3;
+module_param(aoe_deadsecs, int, 0644);
+MODULE_PARM_DESC(aoe_deadsecs, "After aoe_deadsecs seconds, give up and fail dev.");
+
+struct sk_buff *
+new_skb(ulong len)
 {
         struct sk_buff *skb;
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb) {
                 skb->nh.raw = skb->mac.raw = skb->data;
-                skb->dev = if_dev;
                 skb->protocol = __constant_htons(ETH_P_AOE);
                 skb->priority = 0;
                 skb_put(skb, len);
@@ -40,29 +42,6 @@ new_skb(struct net_device *if_dev, ulong len)
         return skb;
 }
 
-static struct sk_buff *
-skb_prepare(struct aoedev *d, struct frame *f)
-{
-        struct sk_buff *skb;
-        char *p;
-
-        skb = new_skb(d->ifp, f->ndata + f->writedatalen);
-        if (!skb) {
-                printk(KERN_INFO "aoe: skb_prepare: failure to allocate skb\n");
-                return NULL;
-        }
-
-        p = skb->mac.raw;
-        memcpy(p, f->data, f->ndata);
-
-        if (f->writedatalen) {
-                p += sizeof(struct aoe_hdr) + sizeof(struct aoe_atahdr);
-                memcpy(p, f->bufaddr, f->writedatalen);
-        }
-
-        return skb;
-}
-
 static struct frame *
 getframe(struct aoedev *d, int tag)
 {
@@ -107,6 +86,17 @@ aoehdr_atainit(struct aoedev *d, struct aoe_hdr *h)
         return host_tag;
 }
 
+static inline void
+put_lba(struct aoe_atahdr *ah, sector_t lba)
+{
+        ah->lba0 = lba;
+        ah->lba1 = lba >>= 8;
+        ah->lba2 = lba >>= 8;
+        ah->lba3 = lba >>= 8;
+        ah->lba4 = lba >>= 8;
+        ah->lba5 = lba >>= 8;
+}
+
 static void
 aoecmd_ata_rw(struct aoedev *d, struct frame *f)
 {
@@ -125,29 +115,27 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
 
         sector = buf->sector;
         bcnt = buf->bv_resid;
-        if (bcnt > MAXATADATA)
-                bcnt = MAXATADATA;
+        if (bcnt > d->maxbcnt)
+                bcnt = d->maxbcnt;
 
         /* initialize the headers & frame */
-        h = (struct aoe_hdr *) f->data;
+        skb = f->skb;
+        h = (struct aoe_hdr *) skb->mac.raw;
         ah = (struct aoe_atahdr *) (h+1);
-        f->ndata = sizeof *h + sizeof *ah;
-        memset(h, 0, f->ndata);
+        skb->len = sizeof *h + sizeof *ah;
+        memset(h, 0, ETH_ZLEN);
         f->tag = aoehdr_atainit(d, h);
         f->waited = 0;
         f->buf = buf;
         f->bufaddr = buf->bufaddr;
+        f->bcnt = bcnt;
+        f->lba = sector;
 
         /* set up ata header */
         ah->scnt = bcnt >> 9;
-        ah->lba0 = sector;
-        ah->lba1 = sector >>= 8;
-        ah->lba2 = sector >>= 8;
-        ah->lba3 = sector >>= 8;
+        put_lba(ah, sector);
         if (d->flags & DEVFL_EXT) {
                 ah->aflags |= AOEAFL_EXT;
-                ah->lba4 = sector >>= 8;
-                ah->lba5 = sector >>= 8;
         } else {
                 extbit = 0;
                 ah->lba3 &= 0x0f;
@@ -155,11 +143,14 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
         }
 
         if (bio_data_dir(buf->bio) == WRITE) {
+                skb_fill_page_desc(skb, 0, virt_to_page(f->bufaddr),
+                        offset_in_page(f->bufaddr), bcnt);
                 ah->aflags |= AOEAFL_WRITE;
-                f->writedatalen = bcnt;
+                skb->len += bcnt;
+                skb->data_len = bcnt;
         } else {
+                skb->len = ETH_ZLEN;
                 writebit = 0;
-                f->writedatalen = 0;
         }
 
         ah->cmdstat = WIN_READ | writebit | extbit;
@@ -168,26 +159,27 @@ aoecmd_ata_rw(struct aoedev *d, struct frame *f)
         buf->nframesout += 1;
         buf->bufaddr += bcnt;
         buf->bv_resid -= bcnt;
-/* printk(KERN_INFO "aoe: bv_resid=%ld\n", buf->bv_resid); */
+/* printk(KERN_DEBUG "aoe: bv_resid=%ld\n", buf->bv_resid); */
         buf->resid -= bcnt;
         buf->sector += bcnt >> 9;
         if (buf->resid == 0) {
                 d->inprocess = NULL;
         } else if (buf->bv_resid == 0) {
                 buf->bv++;
+                WARN_ON(buf->bv->bv_len == 0);
                 buf->bv_resid = buf->bv->bv_len;
                 buf->bufaddr = page_address(buf->bv->bv_page) + buf->bv->bv_offset;
         }
 
-        skb = skb_prepare(d, f);
-        if (skb) {
-                skb->next = NULL;
-                if (d->sendq_hd)
-                        d->sendq_tl->next = skb;
-                else
-                        d->sendq_hd = skb;
-                d->sendq_tl = skb;
-        }
+        skb->dev = d->ifp;
+        skb = skb_clone(skb, GFP_ATOMIC);
+        if (skb == NULL)
+                return;
+        if (d->sendq_hd)
+                d->sendq_tl->next = skb;
+        else
+                d->sendq_hd = skb;
+        d->sendq_tl = skb;
 }
 
 /* some callers cannot sleep, and they can call this function,
@@ -209,11 +201,12 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff **tail)
                 if (!is_aoe_netif(ifp))
                         continue;
 
-                skb = new_skb(ifp, sizeof *h + sizeof *ch);
+                skb = new_skb(sizeof *h + sizeof *ch);
                 if (skb == NULL) {
-                        printk(KERN_INFO "aoe: aoecmd_cfg: skb alloc failure\n");
+                        printk(KERN_INFO "aoe: skb alloc failure\n");
                         continue;
                 }
+                skb->dev = ifp;
                 if (sl_tail == NULL)
                         sl_tail = skb;
                 h = (struct aoe_hdr *) skb->mac.raw;
@@ -237,6 +230,29 @@ aoecmd_cfg_pkts(ushort aoemajor, unsigned char aoeminor, struct sk_buff **tail)
         return sl;
 }
 
+static struct frame *
+freeframe(struct aoedev *d)
+{
+        struct frame *f, *e;
+        int n = 0;
+
+        f = d->frames;
+        e = f + d->nframes;
+        for (; f<e; f++) {
+                if (f->tag != FREETAG)
+                        continue;
+                if (atomic_read(&skb_shinfo(f->skb)->dataref) == 1) {
+                        skb_shinfo(f->skb)->nr_frags = f->skb->data_len = 0;
+                        return f;
+                }
+                n++;
+        }
+        if (n == d->nframes)    /* wait for network layer */
+                d->flags |= DEVFL_KICKME;
+
+        return NULL;
+}
+
 /* enters with d->lock held */
 void
 aoecmd_work(struct aoedev *d)
@@ -252,7 +268,7 @@ aoecmd_work(struct aoedev *d)
         }
 
 loop:
-        f = getframe(d, FREETAG);
+        f = freeframe(d);
         if (f == NULL)
                 return;
         if (d->inprocess == NULL) {
@@ -260,7 +276,7 @@ loop:
                         return;
                 buf = container_of(d->bufq.next, struct buf, bufs);
                 list_del(d->bufq.next);
-/*printk(KERN_INFO "aoecmd_work: bi_size=%ld\n", buf->bio->bi_size); */
+/*printk(KERN_DEBUG "aoe: bi_size=%ld\n", buf->bio->bi_size); */
                 d->inprocess = buf;
         }
         aoecmd_ata_rw(d, f);
@@ -272,6 +288,7 @@ rexmit(struct aoedev *d, struct frame *f)
 {
         struct sk_buff *skb;
         struct aoe_hdr *h;
+        struct aoe_atahdr *ah;
         char buf[128];
         u32 n;
 
@@ -283,21 +300,41 @@ rexmit(struct aoedev *d, struct frame *f)
                 d->aoemajor, d->aoeminor, f->tag, jiffies, n);
         aoechr_error(buf);
 
-        h = (struct aoe_hdr *) f->data;
+        skb = f->skb;
+        h = (struct aoe_hdr *) skb->mac.raw;
+        ah = (struct aoe_atahdr *) (h+1);
         f->tag = n;
         h->tag = cpu_to_be32(n);
         memcpy(h->dst, d->addr, sizeof h->dst);
         memcpy(h->src, d->ifp->dev_addr, sizeof h->src);
 
-        skb = skb_prepare(d, f);
-        if (skb) {
-                skb->next = NULL;
-                if (d->sendq_hd)
-                        d->sendq_tl->next = skb;
-                else
-                        d->sendq_hd = skb;
-                d->sendq_tl = skb;
+        n = DEFAULTBCNT / 512;
+        if (ah->scnt > n) {
+                ah->scnt = n;
+                if (ah->aflags & AOEAFL_WRITE) {
+                        skb_fill_page_desc(skb, 0, virt_to_page(f->bufaddr),
+                                offset_in_page(f->bufaddr), DEFAULTBCNT);
+                        skb->len = sizeof *h + sizeof *ah + DEFAULTBCNT;
+                        skb->data_len = DEFAULTBCNT;
+                }
+                if (++d->lostjumbo > (d->nframes << 1))
+                if (d->maxbcnt != DEFAULTBCNT) {
+                        printk(KERN_INFO "aoe: e%ld.%ld: too many lost jumbo on %s - using 1KB frames.\n",
+                                d->aoemajor, d->aoeminor, d->ifp->name);
+                        d->maxbcnt = DEFAULTBCNT;
+                        d->flags |= DEVFL_MAXBCNT;
+                }
         }
+
+        skb->dev = d->ifp;
+        skb = skb_clone(skb, GFP_ATOMIC);
+        if (skb == NULL)
+                return;
+        if (d->sendq_hd)
+                d->sendq_tl->next = skb;
+        else
+                d->sendq_hd = skb;
+        d->sendq_tl = skb;
 }
 
 static int
@@ -340,13 +377,17 @@ rexmit_timer(ulong vp)
                 if (f->tag != FREETAG && tsince(f->tag) >= timeout) {
                         n = f->waited += timeout;
                         n /= HZ;
-                        if (n > MAXWAIT) { /* waited too long.  device failure. */
+                        if (n > aoe_deadsecs) { /* waited too long for response */
                                 aoedev_downdev(d);
                                 break;
                         }
                         rexmit(d, f);
                 }
         }
+        if (d->flags & DEVFL_KICKME) {
+                d->flags &= ~DEVFL_KICKME;
+                aoecmd_work(d);
+        }
 
         sl = d->sendq_hd;
         d->sendq_hd = d->sendq_tl = NULL;
@@ -431,8 +472,8 @@ ataid_complete(struct aoedev *d, unsigned char *id)
         }
 
         if (d->ssize != ssize)
-                printk(KERN_INFO "aoe: %012llx e%lu.%lu v%04x has %llu "
-                        "sectors\n", (unsigned long long)mac_addr(d->addr),
+                printk(KERN_INFO "aoe: %012llx e%lu.%lu v%04x has %llu sectors\n",
+                        (unsigned long long)mac_addr(d->addr),
                         d->aoemajor, d->aoeminor,
                         d->fw_ver, (long long)ssize);
         d->ssize = ssize;
@@ -442,11 +483,9 @@ ataid_complete(struct aoedev *d, unsigned char *id)
                 d->flags |= DEVFL_NEWSIZE;
         } else {
                 if (d->flags & DEVFL_GDALLOC) {
-                        printk(KERN_INFO "aoe: %s: %s e%lu.%lu, %s\n",
-                               __FUNCTION__,
-                               "can't schedule work for",
+                        printk(KERN_ERR "aoe: can't schedule work for e%lu.%lu, %s\n",
                                d->aoemajor, d->aoeminor,
-                               "it's already on! (This really shouldn't happen).\n");
+                               "it's already on!  This shouldn't happen.\n");
                         return;
                 }
                 d->flags |= DEVFL_GDALLOC;
@@ -460,8 +499,15 @@ calc_rttavg(struct aoedev *d, int rtt)
         register long n;
 
         n = rtt;
-        if (n < MINTIMER)
-                n = MINTIMER;
+        if (n < 0) {
+                n = -rtt;
+                if (n < MINTIMER)
+                        n = MINTIMER;
+                else if (n > MAXTIMER)
+                        n = MAXTIMER;
+                d->mintimer += (n - d->mintimer) >> 1;
+        } else if (n < d->mintimer)
+                n = d->mintimer;
         else if (n > MAXTIMER)
                 n = MAXTIMER;
 
@@ -474,7 +520,7 @@ void
 aoecmd_ata_rsp(struct sk_buff *skb)
 {
         struct aoedev *d;
-        struct aoe_hdr *hin;
+        struct aoe_hdr *hin, *hout;
         struct aoe_atahdr *ahin, *ahout;
         struct frame *f;
         struct buf *buf;
@@ -497,8 +543,10 @@ aoecmd_ata_rsp(struct sk_buff *skb)
 
         spin_lock_irqsave(&d->lock, flags);
 
-        f = getframe(d, be32_to_cpu(hin->tag));
+        n = be32_to_cpu(hin->tag);
+        f = getframe(d, n);
         if (f == NULL) {
+                calc_rttavg(d, -tsince(n));
                 spin_unlock_irqrestore(&d->lock, flags);
                 snprintf(ebuf, sizeof ebuf,
                         "%15s e%d.%d    tag=%08x@%08lx\n",
@@ -514,26 +562,27 @@ aoecmd_ata_rsp(struct sk_buff *skb)
         calc_rttavg(d, tsince(f->tag));
 
         ahin = (struct aoe_atahdr *) (hin+1);
-        ahout = (struct aoe_atahdr *) (f->data + sizeof(struct aoe_hdr));
+        hout = (struct aoe_hdr *) f->skb->mac.raw;
+        ahout = (struct aoe_atahdr *) (hout+1);
         buf = f->buf;
 
         if (ahout->cmdstat == WIN_IDENTIFY)
                 d->flags &= ~DEVFL_PAUSE;
         if (ahin->cmdstat & 0xa9) {     /* these bits cleared on success */
-                printk(KERN_CRIT "aoe: aoecmd_ata_rsp: ata error cmd=%2.2Xh "
-                        "stat=%2.2Xh from e%ld.%ld\n", 
+                printk(KERN_ERR
+                        "aoe: ata error cmd=%2.2Xh stat=%2.2Xh from e%ld.%ld\n",
                         ahout->cmdstat, ahin->cmdstat,
                         d->aoemajor, d->aoeminor);
                 if (buf)
                         buf->flags |= BUFFL_FAIL;
         } else {
+                n = ahout->scnt << 9;
                 switch (ahout->cmdstat) {
                 case WIN_READ:
                 case WIN_READ_EXT:
-                        n = ahout->scnt << 9;
                         if (skb->len - sizeof *hin - sizeof *ahin < n) {
-                                printk(KERN_CRIT "aoe: aoecmd_ata_rsp: runt "
-                                        "ata data size in read.  skb->len=%d\n",
+                                printk(KERN_ERR
+                                        "aoe: runt data size in read.  skb->len=%d\n",
                                         skb->len);
                                 /* fail frame f?  just returning will rexmit. */
                                 spin_unlock_irqrestore(&d->lock, flags);
@@ -542,22 +591,49 @@ aoecmd_ata_rsp(struct sk_buff *skb)
                         memcpy(f->bufaddr, ahin+1, n);
                 case WIN_WRITE:
                 case WIN_WRITE_EXT:
+                        if (f->bcnt -= n) {
+                                skb = f->skb;
+                                f->bufaddr += n;
+                                put_lba(ahout, f->lba += ahout->scnt);
+                                n = f->bcnt;
+                                if (n > DEFAULTBCNT)
+                                        n = DEFAULTBCNT;
+                                ahout->scnt = n >> 9;
+                                if (ahout->aflags & AOEAFL_WRITE) {
+                                        skb_fill_page_desc(skb, 0,
+                                                virt_to_page(f->bufaddr),
+                                                offset_in_page(f->bufaddr), n);
+                                        skb->len = sizeof *hout + sizeof *ahout + n;
+                                        skb->data_len = n;
+                                }
+                                f->tag = newtag(d);
+                                hout->tag = cpu_to_be32(f->tag);
+                                skb->dev = d->ifp;
+                                skb = skb_clone(skb, GFP_ATOMIC);
+                                spin_unlock_irqrestore(&d->lock, flags);
+                                if (skb)
+                                        aoenet_xmit(skb);
+                                return;
+                        }
+                        if (n > DEFAULTBCNT)
+                                d->lostjumbo = 0;
                         break;
                 case WIN_IDENTIFY:
                         if (skb->len - sizeof *hin - sizeof *ahin < 512) {
-                                printk(KERN_INFO "aoe: aoecmd_ata_rsp: runt data size "
-                                        "in ataid.  skb->len=%d\n", skb->len);
+                                printk(KERN_INFO
+                                        "aoe: runt data size in ataid.  skb->len=%d\n",
+                                        skb->len);
                                 spin_unlock_irqrestore(&d->lock, flags);
                                 return;
                         }
                         ataid_complete(d, (char *) (ahin+1));
                         break;
                 default:
-                        printk(KERN_INFO "aoe: aoecmd_ata_rsp: unrecognized "
-                               "outbound ata command %2.2Xh for %d.%d\n", 
-                               ahout->cmdstat,
-                               be16_to_cpu(hin->major),
-                               hin->minor);
+                        printk(KERN_INFO
+                                "aoe: unrecognized ata command %2.2Xh for %d.%d\n",
+                                ahout->cmdstat,
+                                be16_to_cpu(hin->major),
+                                hin->minor);
                 }
         }
 
@@ -612,33 +688,32 @@ aoecmd_ata_id(struct aoedev *d)
         struct frame *f;
         struct sk_buff *skb;
 
-        f = getframe(d, FREETAG);
+        f = freeframe(d);
         if (f == NULL) {
-                printk(KERN_CRIT "aoe: aoecmd_ata_id: can't get a frame.  "
-                        "This shouldn't happen.\n");
+                printk(KERN_ERR "aoe: can't get a frame. This shouldn't happen.\n");
                 return NULL;
         }
 
         /* initialize the headers & frame */
-        h = (struct aoe_hdr *) f->data;
+        skb = f->skb;
+        h = (struct aoe_hdr *) skb->mac.raw;
         ah = (struct aoe_atahdr *) (h+1);
-        f->ndata = sizeof *h + sizeof *ah;
-        memset(h, 0, f->ndata);
+        skb->len = ETH_ZLEN;
+        memset(h, 0, ETH_ZLEN);
         f->tag = aoehdr_atainit(d, h);
         f->waited = 0;
-        f->writedatalen = 0;
 
         /* set up ata header */
         ah->scnt = 1;
         ah->cmdstat = WIN_IDENTIFY;
         ah->lba3 = 0xa0;
 
-        skb = skb_prepare(d, f);
+        skb->dev = d->ifp;
 
         d->rttavg = MAXTIMER;
         d->timer.function = rexmit_timer;
 
-        return skb;
+        return skb_clone(skb, GFP_ATOMIC);
 }
  
 void
@@ -648,9 +723,9 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
         struct aoe_hdr *h;
         struct aoe_cfghdr *ch;
         ulong flags, sysminor, aoemajor;
-        u16 bufcnt;
         struct sk_buff *sl;
         enum { MAXFRAMES = 16 };
+        u16 n;
 
         h = (struct aoe_hdr *) skb->mac.raw;
         ch = (struct aoe_cfghdr *) (h+1);
@@ -661,26 +736,25 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
          */
         aoemajor = be16_to_cpu(h->major);
         if (aoemajor == 0xfff) {
-                printk(KERN_CRIT "aoe: aoecmd_cfg_rsp: Warning: shelf "
-                        "address is all ones.  Check shelf dip switches\n");
+                printk(KERN_ERR "aoe: Warning: shelf address is all ones.  "
+                        "Check shelf dip switches.\n");
                 return;
         }
 
         sysminor = SYSMINOR(aoemajor, h->minor);
         if (sysminor * AOE_PARTITIONS + AOE_PARTITIONS > MINORMASK) {
-                printk(KERN_INFO
-                        "aoe: e%ld.%d: minor number too large\n", 
+                printk(KERN_INFO "aoe: e%ld.%d: minor number too large\n",
                         aoemajor, (int) h->minor);
                 return;
         }
 
-        bufcnt = be16_to_cpu(ch->bufcnt);
-        if (bufcnt > MAXFRAMES) /* keep it reasonable */
-                bufcnt = MAXFRAMES;
+        n = be16_to_cpu(ch->bufcnt);
+        if (n > MAXFRAMES)      /* keep it reasonable */
+                n = MAXFRAMES;
 
-        d = aoedev_by_sysminor_m(sysminor, bufcnt);
+        d = aoedev_by_sysminor_m(sysminor, n);
         if (d == NULL) {
-                printk(KERN_INFO "aoe: aoecmd_cfg_rsp: device sysminor_m failure\n");
+                printk(KERN_INFO "aoe: device sysminor_m failure\n");
                 return;
         }
 
@@ -689,6 +763,20 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
         /* permit device to migrate mac and network interface */
         d->ifp = skb->dev;
         memcpy(d->addr, h->src, sizeof d->addr);
+        if (!(d->flags & DEVFL_MAXBCNT)) {
+                n = d->ifp->mtu;
+                n -= sizeof (struct aoe_hdr) + sizeof (struct aoe_atahdr);
+                n /= 512;
+                if (n > ch->scnt)
+                        n = ch->scnt;
+                n = n ? n * 512 : DEFAULTBCNT;
+                if (n != d->maxbcnt) {
+                        printk(KERN_INFO
+                                "aoe: e%ld.%ld: setting %d byte data frames on %s\n",
+                                d->aoemajor, d->aoeminor, n, d->ifp->name);
+                        d->maxbcnt = n;
+                }
+        }
 
         /* don't change users' perspective */
         if (d->nopen && !(d->flags & DEVFL_PAUSE)) {
@@ -696,6 +784,7 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
                 return;
         }
         d->flags |= DEVFL_PAUSE;        /* force pause */
+        d->mintimer = MINTIMER;
         d->fw_ver = be16_to_cpu(ch->fwver);
 
         /* check for already outstanding ataid */
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index ed4258a62df5..6125921bbec4 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoedev.c
  * AoE device utility functions; maintains device list.
@@ -20,11 +20,8 @@ aoedev_isbusy(struct aoedev *d)
         f = d->frames;
         e = f + d->nframes;
         do {
-                if (f->tag != FREETAG) {
-                        printk(KERN_DEBUG "aoe: %ld.%ld isbusy\n",
-                                d->aoemajor, d->aoeminor);
+                if (f->tag != FREETAG)
                         return 1;
-                }
         } while (++f < e);
 
         return 0;
@@ -66,22 +63,32 @@ aoedev_newdev(ulong nframes)
         struct frame *f, *e;
 
         d = kzalloc(sizeof *d, GFP_ATOMIC);
-        if (d == NULL)
-                return NULL;
         f = kcalloc(nframes, sizeof *f, GFP_ATOMIC);
-        if (f == NULL) {
-                kfree(d);
+        switch (!d || !f) {
+        case 0:
+                d->nframes = nframes;
+                d->frames = f;
+                e = f + nframes;
+                for (; f<e; f++) {
+                        f->tag = FREETAG;
+                        f->skb = new_skb(ETH_ZLEN);
+                        if (!f->skb)
+                                break;
+                }
+                if (f == e)
+                        break;
+                while (f > d->frames) {
+                        f--;
+                        dev_kfree_skb(f->skb);
+                }
+        default:
+                if (f)
+                        kfree(f);
+                if (d)
+                        kfree(d);
                 return NULL;
         }
-
         INIT_WORK(&d->work, aoecmd_sleepwork, d);
-
-        d->nframes = nframes;
-        d->frames = f;
-        e = f + nframes;
-        for (; f<e; f++)
-                f->tag = FREETAG;
-
         spin_lock_init(&d->lock);
         init_timer(&d->timer);
         d->timer.data = (ulong) d;
@@ -114,6 +121,7 @@ aoedev_downdev(struct aoedev *d)
                         mempool_free(buf, d->bufpool);
                         bio_endio(bio, bio->bi_size, -EIO);
                 }
+                skb_shinfo(f->skb)->nr_frags = f->skb->data_len = 0;
         }
         d->inprocess = NULL;
 
@@ -148,7 +156,7 @@ aoedev_by_sysminor_m(ulong sysminor, ulong bufcnt)
                 d = aoedev_newdev(bufcnt);
                 if (d == NULL) {
                         spin_unlock_irqrestore(&devlist_lock, flags);
-                        printk(KERN_INFO "aoe: aoedev_set: aoedev_newdev failure.\n");
+                        printk(KERN_INFO "aoe: aoedev_newdev failure.\n");
                         return NULL;
                 }
                 d->sysminor = sysminor;
@@ -163,11 +171,19 @@ aoedev_by_sysminor_m(ulong sysminor, ulong bufcnt)
 static void
 aoedev_freedev(struct aoedev *d)
 {
+        struct frame *f, *e;
+
         if (d->gd) {
                 aoedisk_rm_sysfs(d);
                 del_gendisk(d->gd);
                 put_disk(d->gd);
         }
+        f = d->frames;
+        e = f + d->nframes;
+        for (; f<e; f++) {
+                skb_shinfo(f->skb)->nr_frags = 0;
+                dev_kfree_skb(f->skb);
+        }
         kfree(d->frames);
         if (d->bufpool)
                 mempool_destroy(d->bufpool);
diff --git a/drivers/block/aoe/aoemain.c b/drivers/block/aoe/aoemain.c
index de08491ebe66..a04b7d613299 100644
--- a/drivers/block/aoe/aoemain.c
+++ b/drivers/block/aoe/aoemain.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoemain.c
  * Module initialization routines, discover timer
@@ -84,13 +84,11 @@ aoe_init(void)
                 goto net_fail;
         ret = register_blkdev(AOE_MAJOR, DEVICE_NAME);
         if (ret < 0) {
-                printk(KERN_ERR "aoe: aoeblk_init: can't register major\n");
+                printk(KERN_ERR "aoe: can't register major\n");
                 goto blkreg_fail;
         }
 
-        printk(KERN_INFO
-               "aoe: aoe_init: AoE v%s initialised.\n",
-               VERSION);
+        printk(KERN_INFO "aoe: AoE v%s initialised.\n", VERSION);
         discover_timer(TINIT);
         return 0;
 
@@ -103,7 +101,7 @@ aoe_init(void)
  chr_fail:
         aoedev_exit();
         
-        printk(KERN_INFO "aoe: aoe_init: initialisation failure.\n");
+        printk(KERN_INFO "aoe: initialisation failure.\n");
         return ret;
 }
 
diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
index c1434ed11880..9626e0f5da9d 100644
--- a/drivers/block/aoe/aoenet.c
+++ b/drivers/block/aoe/aoenet.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2004 Coraid, Inc.  See COPYING for GPL terms. */
+/* Copyright (c) 2006 Coraid, Inc.  See COPYING for GPL terms. */
 /*
  * aoenet.c
  * Ethernet portion of AoE driver
@@ -74,7 +74,7 @@ set_aoe_iflist(const char __user *user_str, size_t size)
                 return -EINVAL;
 
         if (copy_from_user(aoe_iflist, user_str, size)) {
-                printk(KERN_INFO "aoe: %s: copy from user failed\n", __FUNCTION__);
+                printk(KERN_INFO "aoe: copy from user failed\n");
                 return -EFAULT;
         }
         aoe_iflist[size] = 0x00;
@@ -132,8 +132,7 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
                 if (n > NECODES)
                         n = 0;
                 if (net_ratelimit())
-                        printk(KERN_ERR "aoe: aoenet_rcv: error packet from %d.%d; "
-                               "ecode=%d '%s'\n",
+                        printk(KERN_ERR "aoe: error packet from %d.%d; ecode=%d '%s'\n",
                                be16_to_cpu(h->major), h->minor, 
                                h->err, aoe_errlist[n]);
                 goto exit;
@@ -147,7 +146,7 @@ aoenet_rcv(struct sk_buff *skb, struct net_device *ifp, struct packet_type *pt,
                 aoecmd_cfg_rsp(skb);
                 break;
         default:
-                printk(KERN_INFO "aoe: aoenet_rcv: unknown cmd %d\n", h->cmd);
+                printk(KERN_INFO "aoe: unknown cmd %d\n", h->cmd);
         }
 exit:
         dev_kfree_skb(skb);
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index dcccaf2782f3..4105c3bf3476 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -1300,6 +1300,12 @@ static void cciss_softirq_done(struct request *rq)
 
         complete_buffers(rq->bio, rq->errors);
 
+        if (blk_fs_request(rq)) {
+                const int rw = rq_data_dir(rq);
+
+                disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+        }
+
 #ifdef CCISS_DEBUG
         printk("Done with %p\n", rq);
 #endif                          /* CCISS_DEBUG */
@@ -1923,7 +1929,6 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
 {
         int return_code;
         unsigned long t;
-        unsigned long rem;
 
         memset(inq_buff, 0, sizeof(InquiryData_struct));
         if (withirq)
@@ -1939,26 +1944,23 @@ static void cciss_geometry_inquiry(int ctlr, int logvol,
                         printk(KERN_WARNING
                                "cciss: reading geometry failed, volume "
                                "does not support reading geometry\n");
-                        drv->block_size = block_size;
-                        drv->nr_blocks = total_size;
                         drv->heads = 255;
                         drv->sectors = 32;      // Sectors per track
-                        t = drv->heads * drv->sectors;
-                        drv->cylinders = total_size;
-                        rem = do_div(drv->cylinders, t);
                 } else {
-                        drv->block_size = block_size;
-                        drv->nr_blocks = total_size;
                         drv->heads = inq_buff->data_byte[6];
                         drv->sectors = inq_buff->data_byte[7];
                         drv->cylinders = (inq_buff->data_byte[4] & 0xff) << 8;
                         drv->cylinders += inq_buff->data_byte[5];
                         drv->raid_level = inq_buff->data_byte[8];
-                        t = drv->heads * drv->sectors;
-                        if (t > 1) {
-                                drv->cylinders = total_size;
-                                rem = do_div(drv->cylinders, t);
-                        }
+                }
+                drv->block_size = block_size;
+                drv->nr_blocks = total_size;
+                t = drv->heads * drv->sectors;
+                if (t > 1) {
+                        unsigned rem = sector_div(total_size, t);
+                        if (rem)
+                                total_size++;
+                        drv->cylinders = total_size;
                 }
         } else {                /* Get geometry failed */
                 printk(KERN_WARNING "cciss: reading geometry failed\n");
@@ -1996,8 +1998,8 @@ cciss_read_capacity(int ctlr, int logvol, int withirq, sector_t *total_size,
                 *block_size = BLOCK_SIZE;
         }
         if (*total_size != (__u32) 0)
-                printk(KERN_INFO "      blocks= %lld block_size= %d\n",
-                *total_size, *block_size);
+                printk(KERN_INFO "      blocks= %llu block_size= %d\n",
+                (unsigned long long)*total_size, *block_size);
         kfree(buf);
         return;
 }
@@ -2031,8 +2033,8 @@ cciss_read_capacity_16(int ctlr, int logvol, int withirq, sector_t *total_size,
                 *total_size = 0;
                 *block_size = BLOCK_SIZE;
         }
-        printk(KERN_INFO "      blocks= %lld block_size= %d\n",
-               *total_size, *block_size);
+        printk(KERN_INFO "      blocks= %llu block_size= %d\n",
+               (unsigned long long)*total_size, *block_size);
         kfree(buf);
         return;
 }
diff --git a/drivers/block/cpqarray.c b/drivers/block/cpqarray.c
index 570d2f049323..d5f519ebbc08 100644
--- a/drivers/block/cpqarray.c
+++ b/drivers/block/cpqarray.c
@@ -998,6 +998,7 @@ static inline void complete_buffers(struct bio *bio, int ok)
  */
 static inline void complete_command(cmdlist_t *cmd, int timeout)
 {
+        struct request *rq = cmd->rq;
         int ok=1;
         int i, ddir;
 
@@ -1029,12 +1030,18 @@ static inline void complete_command(cmdlist_t *cmd, int timeout)
                 pci_unmap_page(hba[cmd->ctlr]->pci_dev, cmd->req.sg[i].addr,
                                 cmd->req.sg[i].size, ddir);
 
-        complete_buffers(cmd->rq->bio, ok);
+        complete_buffers(rq->bio, ok);
 
-        add_disk_randomness(cmd->rq->rq_disk);
+        if (blk_fs_request(rq)) {
+                const int rw = rq_data_dir(rq);
 
-        DBGPX(printk("Done with %p\n", cmd->rq););
-        end_that_request_last(cmd->rq, ok ? 1 : -EIO);
+                disk_stat_add(rq->rq_disk, sectors[rw], rq->nr_sectors);
+        }
+
+        add_disk_randomness(rq->rq_disk);
+
+        DBGPX(printk("Done with %p\n", rq););
+        end_that_request_last(rq, ok ? 1 : -EIO);
 }
 
 /*
diff --git a/drivers/block/rd.c b/drivers/block/rd.c
index a3f64bfe6b58..485aa87e9bcd 100644
--- a/drivers/block/rd.c
+++ b/drivers/block/rd.c
@@ -432,6 +432,12 @@ static int __init rd_init(void)
                 rd_disks[i] = alloc_disk(1);
                 if (!rd_disks[i])
                         goto out;
+
+                rd_queue[i] = blk_alloc_queue(GFP_KERNEL);
+                if (!rd_queue[i]) {
+                        put_disk(rd_disks[i]);
+                        goto out;
+                }
         }
 
         if (register_blkdev(RAMDISK_MAJOR, "ramdisk")) {
@@ -442,10 +448,6 @@ static int __init rd_init(void)
         for (i = 0; i < CONFIG_BLK_DEV_RAM_COUNT; i++) {
                 struct gendisk *disk = rd_disks[i];
 
-                rd_queue[i] = blk_alloc_queue(GFP_KERNEL);
-                if (!rd_queue[i])
-                        goto out_queue;
-
                 blk_queue_make_request(rd_queue[i], &rd_make_request);
                 blk_queue_hardsect_size(rd_queue[i], rd_blocksize);
 
@@ -466,8 +468,6 @@ static int __init rd_init(void)
                 CONFIG_BLK_DEV_RAM_COUNT, rd_size, rd_blocksize);
 
         return 0;
-out_queue:
-        unregister_blkdev(RAMDISK_MAJOR, "ramdisk");
 out:
         while (i--) {
                 put_disk(rd_disks[i]);
diff --git a/drivers/block/xd.c b/drivers/block/xd.c
index 10cc38783bdf..0d97b7eb818a 100644
--- a/drivers/block/xd.c
+++ b/drivers/block/xd.c
@@ -48,9 +48,9 @@
 #include <linux/blkdev.h>
 #include <linux/blkpg.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/dma.h>
 
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 82ddbdd7bd4b..7cc2685ca84a 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -329,7 +329,7 @@ static struct kobject *z2_find(dev_t dev, int *part, void *data)
 
 static struct request_queue *z2_queue;
 
-int __init 
+static int __init 
 z2_init(void)
 {
     int ret;
@@ -370,26 +370,7 @@ err:
     return ret;
 }
 
-#if defined(MODULE)
-
-MODULE_LICENSE("GPL");
-
-int
-init_module( void )
-{
-    int error;
-    
-    error = z2_init();
-    if ( error == 0 )
-    {
-        printk( KERN_INFO DEVICE_NAME ": loaded as module\n" );
-    }
-    
-    return error;
-}
-
-void
-cleanup_module( void )
+static void __exit z2_exit(void)
 {
     int i, j;
     blk_unregister_region(MKDEV(Z2RAM_MAJOR, 0), 256);
@@ -425,4 +406,7 @@ cleanup_module( void )
 
     return;
 } 
-#endif
+
+module_init(z2_init);
+module_exit(z2_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 67cdda43f229..516751754aa9 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -29,7 +29,6 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/timer.h>
 
 #include <linux/device.h>
 #include <linux/firmware.h>
@@ -43,7 +42,7 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "1.0"
+#define VERSION "1.1"
 
 static int ignore = 0;
 
@@ -72,7 +71,7 @@ struct bcm203x_data {
 
         unsigned long           state;
 
-        struct timer_list       timer;
+        struct work_struct      work;
 
         struct urb              *urb;
         unsigned char           *buffer;
@@ -105,7 +104,7 @@ static void bcm203x_complete(struct urb *urb)
 
                 data->state = BCM203X_SELECT_MEMORY;
 
-                mod_timer(&data->timer, jiffies + (HZ / 10));
+                schedule_work(&data->work);
                 break;
 
         case BCM203X_SELECT_MEMORY:
@@ -158,9 +157,9 @@ static void bcm203x_complete(struct urb *urb)
         }
 }
 
-static void bcm203x_timer(unsigned long user_data)
+static void bcm203x_work(void *user_data)
 {
-        struct bcm203x_data *data = (struct bcm203x_data *) user_data;
+        struct bcm203x_data *data = user_data;
 
         if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
                 BT_ERR("Can't submit URB");
@@ -247,13 +246,11 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
 
         release_firmware(firmware);
 
-        init_timer(&data->timer);
-        data->timer.function = bcm203x_timer;
-        data->timer.data = (unsigned long) data;
+        INIT_WORK(&data->work, bcm203x_work, (void *) data);
 
         usb_set_intfdata(intf, data);
 
-        mod_timer(&data->timer, jiffies + HZ);
+        schedule_work(&data->work);
 
         return 0;
 }
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 845b8680032a..cbc07250b898 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -282,7 +282,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
                 clear_bit(ready_bit, &(info->tx_state));
 
                 if (bt_cb(skb)->pkt_type & 0x80) {
-                        DECLARE_WAIT_QUEUE_HEAD(wq);
+                        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
                         DEFINE_WAIT(wait);
 
                         unsigned char baud_reg;
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index e7c800f4c3ad..07eafbc5dc3a 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -711,6 +711,7 @@ static void dtl1_release(struct pcmcia_device *link)
 
 static struct pcmcia_device_id dtl1_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("Nokia Mobile Phones", "DTL-1", 0xe1bfdd64, 0xe168480d),
+        PCMCIA_DEVICE_PROD_ID12("Nokia Mobile Phones", "DTL-4", 0xe1bfdd64, 0x9102bc82),
         PCMCIA_DEVICE_PROD_ID12("Socket", "CF", 0xb38bcc2e, 0x44ebf863),
         PCMCIA_DEVICE_PROD_ID12("Socket", "CF+ Personal Network Card", 0xb38bcc2e, 0xe732bae3),
         PCMCIA_DEVICE_NULL
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 7565642a007a..fdea58ae16b2 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -118,6 +118,9 @@ static struct usb_device_id blacklist_ids[] = {
         /* IBM/Lenovo ThinkPad with Broadcom chip */
         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = HCI_WRONG_SCO_MTU },
 
+        /* ANYCOM Bluetooth USB-200 and USB-250 */
+        { USB_DEVICE(0x0a5c, 0x2111), .driver_info = HCI_RESET },
+
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 0e6f35fcc2eb..2af12fc45115 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -409,14 +409,6 @@ config SGI_MBCS
          If you have an SGI Altix with an attached SABrick
          say Y or M here, otherwise say N.
 
-config MSPEC
-        tristate "Memory special operations driver"
-        depends on IA64
-        help
-          If you have an ia64 and you want to enable memory special
-          operations support (formerly known as fetchop), say Y here,
-          otherwise say N.
-
 source "drivers/serial/Kconfig"
 
 config UNIX98_PTYS
@@ -1046,7 +1038,7 @@ source "drivers/char/tpm/Kconfig"
 
 config TELCLOCK
         tristate "Telecom clock driver for MPBL0010 ATCA SBC"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && X86
         default n
         help
           The telecom clock device is specific to the MPBL0010 ATCA computer and
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 91b71e750ee1..dffc19382f7e 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -27,32 +27,42 @@
 static int uninorth_rev;
 static int is_u3;
 
+static char __devinitdata *aperture = NULL;
 
 static int uninorth_fetch_size(void)
 {
-        int i;
-        u32 temp;
-        struct aper_size_info_32 *values;
-
-        pci_read_config_dword(agp_bridge->dev, UNI_N_CFG_GART_BASE, &temp);
-        temp &= ~(0xfffff000);
-        values = A_SIZE_32(agp_bridge->driver->aperture_sizes);
-
-        for (i = 0; i < agp_bridge->driver->num_aperture_sizes; i++) {
-                if (temp == values[i].size_value) {
-                        agp_bridge->previous_size =
-                            agp_bridge->current_size = (void *) (values + i);
-                        agp_bridge->aperture_size_idx = i;
-                        return values[i].size;
+        int i, size = 0;
+        struct aper_size_info_32 *values =
+            A_SIZE_32(agp_bridge->driver->aperture_sizes);
+
+        if (aperture) {
+                char *save = aperture;
+
+                size = memparse(aperture, &aperture) >> 20;
+                aperture = save;
+
+                for (i = 0; i < agp_bridge->driver->num_aperture_sizes; i++)
+                        if (size == values[i].size)
+                                break;
+
+                if (i == agp_bridge->driver->num_aperture_sizes) {
+                        printk(KERN_ERR PFX "Invalid aperture size, using"
+                               " default\n");
+                        size = 0;
+                        aperture = NULL;
                 }
         }
 
-        agp_bridge->previous_size =
-            agp_bridge->current_size = (void *) (values + 1);
-        agp_bridge->aperture_size_idx = 1;
-        return values[1].size;
+        if (!size) {
+                for (i = 0; i < agp_bridge->driver->num_aperture_sizes; i++)
+                        if (values[i].size == 32)
+                                break;
+        }
 
-        return 0;
+        agp_bridge->previous_size =
+            agp_bridge->current_size = (void *)(values + i);
+        agp_bridge->aperture_size_idx = i;
+        return values[i].size;
 }
 
 static void uninorth_tlbflush(struct agp_memory *mem)
@@ -683,5 +693,11 @@ static void __exit agp_uninorth_cleanup(void)
 module_init(agp_uninorth_init);
 module_exit(agp_uninorth_cleanup);
 
+module_param(aperture, charp, 0);
+MODULE_PARM_DESC(aperture,
+                 "Aperture size, must be power of two between 4MB and an\n"
+                 "\t\tupper limit specific to the UniNorth revision.\n"
+                 "\t\tDefault: 32M");
+
 MODULE_AUTHOR("Ben Herrenschmidt & Paul Mackerras");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 029baea33b62..6eafff13dab6 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -237,6 +237,8 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
 
         list = drm_alloc(sizeof(*list), DRM_MEM_MAPS);
         if (!list) {
+                if (map->type == _DRM_REGISTERS)
+                        drm_ioremapfree(map->handle, map->size, dev);
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 return -EINVAL;
         }
@@ -252,6 +254,8 @@ static int drm_addmap_core(drm_device_t * dev, unsigned int offset,
                 map->offset;
         ret = drm_map_handle(dev, &list->hash, user_token, 0);
         if (ret) {
+                if (map->type == _DRM_REGISTERS)
+                        drm_ioremapfree(map->handle, map->size, dev);
                 drm_free(map, sizeof(*map), DRM_MEM_MAPS);
                 drm_free(list, sizeof(*list), DRM_MEM_MAPS);
                 mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/char/drm/drm_sysfs.c b/drivers/char/drm/drm_sysfs.c
index 51ad98c685c3..ba4b8de83cf0 100644
--- a/drivers/char/drm/drm_sysfs.c
+++ b/drivers/char/drm/drm_sysfs.c
@@ -42,13 +42,24 @@ static CLASS_ATTR(version, S_IRUGO, version_show, NULL);
 struct class *drm_sysfs_create(struct module *owner, char *name)
 {
         struct class *class;
+        int err;
 
         class = class_create(owner, name);
-        if (!class)
-                return class;
+        if (!class) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
+        err = class_create_file(class, &class_attr_version);
+        if (err)
+                goto err_out_class;
 
-        class_create_file(class, &class_attr_version);
         return class;
+
+err_out_class:
+        class_destroy(class);
+err_out:
+        return ERR_PTR(err);
 }
 
 /**
@@ -96,20 +107,36 @@ static struct class_device_attribute class_device_attrs[] = {
 struct class_device *drm_sysfs_device_add(struct class *cs, drm_head_t *head)
 {
         struct class_device *class_dev;
-        int i;
+        int i, j, err;
 
         class_dev = class_device_create(cs, NULL,
                                         MKDEV(DRM_MAJOR, head->minor),
                                         &(head->dev->pdev)->dev,
                                         "card%d", head->minor);
-        if (!class_dev)
-                return NULL;
+        if (!class_dev) {
+                err = -ENOMEM;
+                goto err_out;
+        }
 
         class_set_devdata(class_dev, head);
 
-        for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++)
-                class_device_create_file(class_dev, &class_device_attrs[i]);
+        for (i = 0; i < ARRAY_SIZE(class_device_attrs); i++) {
+                err = class_device_create_file(class_dev,
+                                               &class_device_attrs[i]);
+                if (err)
+                        goto err_out_files;
+        }
+
         return class_dev;
+
+err_out_files:
+        if (i > 0)
+                for (j = 0; j < i; j++)
+                        class_device_remove_file(class_dev,
+                                                 &class_device_attrs[i]);
+        class_device_unregister(class_dev);
+err_out:
+        return ERR_PTR(err);
 }
 
 /**
diff --git a/drivers/char/drm/mga_drv.c b/drivers/char/drm/mga_drv.c
index e30f556b79f1..be49dbb9ec3f 100644
--- a/drivers/char/drm/mga_drv.c
+++ b/drivers/char/drm/mga_drv.c
@@ -47,6 +47,7 @@ static struct drm_driver driver = {
             DRIVER_USE_AGP | DRIVER_USE_MTRR | DRIVER_PCI_DMA |
             DRIVER_HAVE_DMA | DRIVER_HAVE_IRQ | DRIVER_IRQ_SHARED |
             DRIVER_IRQ_VBL,
+        .dev_priv_size = sizeof(drm_mga_buf_priv_t),
         .load = mga_driver_load,
         .unload = mga_driver_unload,
         .lastclose = mga_driver_lastclose,
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index 26bdf2ca59d7..d14477ba3679 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -538,6 +538,36 @@ static __inline__ int r300_emit_bitblt_multi(drm_radeon_private_t *dev_priv,
         return 0;
 }
 
+static __inline__ int r300_emit_indx_buffer(drm_radeon_private_t *dev_priv,
+                                             drm_radeon_kcmd_buffer_t *cmdbuf)
+{
+        u32 *cmd = (u32 *) cmdbuf->buf;
+        int count, ret;
+        RING_LOCALS;
+
+        count=(cmd[0]>>16) & 0x3fff;
+
+        if ((cmd[1] & 0x8000ffff) != 0x80000810) {
+                DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
+                return DRM_ERR(EINVAL);
+        }
+        ret = r300_check_offset(dev_priv, cmd[2]);
+        if (ret) {
+                DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
+                return DRM_ERR(EINVAL);
+        }
+
+        BEGIN_RING(count+2);
+        OUT_RING(cmd[0]);
+        OUT_RING_TABLE((int *)(cmdbuf->buf + 4), count + 1);
+        ADVANCE_RING();
+
+        cmdbuf->buf += (count+2)*4;
+        cmdbuf->bufsz -= (count+2)*4;
+
+        return 0;
+}
+
 static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
                                             drm_radeon_kcmd_buffer_t *cmdbuf)
 {
@@ -578,10 +608,11 @@ static __inline__ int r300_emit_raw_packet3(drm_radeon_private_t *dev_priv,
         case RADEON_CNTL_BITBLT_MULTI:
                 return r300_emit_bitblt_multi(dev_priv, cmdbuf);
 
+        case RADEON_CP_INDX_BUFFER:     /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
+                return r300_emit_indx_buffer(dev_priv, cmdbuf);
         case RADEON_CP_3D_DRAW_IMMD_2:  /* triggers drawing using in-packet vertex data */
         case RADEON_CP_3D_DRAW_VBUF_2:  /* triggers drawing of vertex buffers setup elsewhere */
         case RADEON_CP_3D_DRAW_INDX_2:  /* triggers drawing using indices to vertex buffer */
-        case RADEON_CP_INDX_BUFFER:     /* DRAW_INDX_2 without INDX_BUFFER seems to lock up the gpu */
         case RADEON_WAIT_FOR_IDLE:
         case RADEON_CP_NOP:
                 /* these packets are safe */
diff --git a/drivers/char/drm/radeon_state.c b/drivers/char/drm/radeon_state.c
index feac5f005d47..6e04fdd732ac 100644
--- a/drivers/char/drm/radeon_state.c
+++ b/drivers/char/drm/radeon_state.c
@@ -275,6 +275,8 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                                                      unsigned int *cmdsz)
 {
         u32 *cmd = (u32 *) cmdbuf->buf;
+        u32 offset, narrays;
+        int count, i, k;
 
         *cmdsz = 2 + ((cmd[0] & RADEON_CP_PACKET_COUNT_MASK) >> 16);
 
@@ -288,10 +290,106 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                 return DRM_ERR(EINVAL);
         }
 
-        /* Check client state and fix it up if necessary */
-        if (cmd[0] & 0x8000) {  /* MSB of opcode: next DWORD GUI_CNTL */
-                u32 offset;
+        switch(cmd[0] & 0xff00) {
+        /* XXX Are there old drivers needing other packets? */
 
+        case RADEON_3D_DRAW_IMMD:
+        case RADEON_3D_DRAW_VBUF:
+        case RADEON_3D_DRAW_INDX:
+        case RADEON_WAIT_FOR_IDLE:
+        case RADEON_CP_NOP:
+        case RADEON_3D_CLEAR_ZMASK:
+/*      case RADEON_CP_NEXT_CHAR:
+        case RADEON_CP_PLY_NEXTSCAN:
+        case RADEON_CP_SET_SCISSORS: */ /* probably safe but will never need them? */
+                /* these packets are safe */
+                break;
+
+        case RADEON_CP_3D_DRAW_IMMD_2:
+        case RADEON_CP_3D_DRAW_VBUF_2:
+        case RADEON_CP_3D_DRAW_INDX_2:
+        case RADEON_3D_CLEAR_HIZ:
+                /* safe but r200 only */
+                if (dev_priv->microcode_version != UCODE_R200) {
+                        DRM_ERROR("Invalid 3d packet for r100-class chip\n");
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+
+        case RADEON_3D_LOAD_VBPNTR:
+                count = (cmd[0] >> 16) & 0x3fff;
+
+                if (count > 18) { /* 12 arrays max */
+                        DRM_ERROR("Too large payload in 3D_LOAD_VBPNTR (count=%d)\n",
+                                  count);
+                        return DRM_ERR(EINVAL);
+                }
+
+                /* carefully check packet contents */
+                narrays = cmd[1] & ~0xc000;
+                k = 0;
+                i = 2;
+                while ((k < narrays) && (i < (count + 2))) {
+                        i++;            /* skip attribute field */
+                        if (radeon_check_and_fixup_offset(dev_priv, filp_priv, &cmd[i])) {
+                                DRM_ERROR
+                                    ("Invalid offset (k=%d i=%d) in 3D_LOAD_VBPNTR packet.\n",
+                                     k, i);
+                                return DRM_ERR(EINVAL);
+                        }
+                        k++;
+                        i++;
+                        if (k == narrays)
+                                break;
+                        /* have one more to process, they come in pairs */
+                        if (radeon_check_and_fixup_offset(dev_priv, filp_priv, &cmd[i])) {
+                                DRM_ERROR
+                                    ("Invalid offset (k=%d i=%d) in 3D_LOAD_VBPNTR packet.\n",
+                                     k, i);
+                                return DRM_ERR(EINVAL);
+                        }
+                        k++;
+                        i++;
+                }
+                /* do the counts match what we expect ? */
+                if ((k != narrays) || (i != (count + 2))) {
+                        DRM_ERROR
+                            ("Malformed 3D_LOAD_VBPNTR packet (k=%d i=%d narrays=%d count+1=%d).\n",
+                              k, i, narrays, count + 1);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+
+        case RADEON_3D_RNDR_GEN_INDX_PRIM:
+                if (dev_priv->microcode_version != UCODE_R100) {
+                        DRM_ERROR("Invalid 3d packet for r200-class chip\n");
+                        return DRM_ERR(EINVAL);
+                }
+                if (radeon_check_and_fixup_offset(dev_priv, filp_priv, &cmd[1])) {
+                                DRM_ERROR("Invalid rndr_gen_indx offset\n");
+                                return DRM_ERR(EINVAL);
+                }
+                break;
+
+        case RADEON_CP_INDX_BUFFER:
+                if (dev_priv->microcode_version != UCODE_R200) {
+                        DRM_ERROR("Invalid 3d packet for r100-class chip\n");
+                        return DRM_ERR(EINVAL);
+                }
+                if ((cmd[1] & 0x8000ffff) != 0x80000810) {
+                        DRM_ERROR("Invalid indx_buffer reg address %08X\n", cmd[1]);
+                        return DRM_ERR(EINVAL);
+                }
+                if (radeon_check_and_fixup_offset(dev_priv, filp_priv, &cmd[2])) {
+                        DRM_ERROR("Invalid indx_buffer offset is %08X\n", cmd[2]);
+                        return DRM_ERR(EINVAL);
+                }
+                break;
+
+        case RADEON_CNTL_HOSTDATA_BLT:
+        case RADEON_CNTL_PAINT_MULTI:
+        case RADEON_CNTL_BITBLT_MULTI:
+                /* MSB of opcode: next DWORD GUI_CNTL */
                 if (cmd[1] & (RADEON_GMC_SRC_PITCH_OFFSET_CNTL
                               | RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                         offset = cmd[2] << 10;
@@ -313,6 +411,11 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                         }
                         cmd[3] = (cmd[3] & 0xffc00000) | offset >> 10;
                 }
+                break;
+
+        default:
+                DRM_ERROR("Invalid packet type %x\n", cmd[0] & 0xff00);
+                return DRM_ERR(EINVAL);
         }
 
         return 0;
diff --git a/drivers/char/drm/savage_bci.c b/drivers/char/drm/savage_bci.c
index 59c7520bf9a2..a9a84f88df5e 100644
--- a/drivers/char/drm/savage_bci.c
+++ b/drivers/char/drm/savage_bci.c
@@ -728,6 +728,7 @@ static int savage_do_init_bci(drm_device_t * dev, drm_savage_init_t * init)
                 dev_priv->status = NULL;
         }
         if (dev_priv->dma_type == SAVAGE_DMA_AGP && init->buffers_offset) {
+                dev->agp_buffer_token = init->buffers_offset;
                 dev->agp_buffer_map = drm_core_findmap(dev,
                                                        init->buffers_offset);
                 if (!dev->agp_buffer_map) {
diff --git a/drivers/char/drm/savage_state.c b/drivers/char/drm/savage_state.c
index ef2581d16146..1ca1e9cb5a33 100644
--- a/drivers/char/drm/savage_state.c
+++ b/drivers/char/drm/savage_state.c
@@ -994,7 +994,7 @@ int savage_bci_cmdbuf(DRM_IOCTL_ARGS)
         if (cmdbuf.size) {
                 kcmd_addr = drm_alloc(cmdbuf.size * 8, DRM_MEM_DRIVER);
                 if (kcmd_addr == NULL)
-                        return ENOMEM;
+                        return DRM_ERR(ENOMEM);
 
                 if (DRM_COPY_FROM_USER(kcmd_addr, cmdbuf.cmd_addr,
                                        cmdbuf.size * 8))
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index c3f95583a120..706733c0b36a 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1157,6 +1157,7 @@ static int __init pc_init(void)
         int crd;
         struct board_info *bd;
         unsigned char board_id = 0;
+        int err = -ENOMEM;
 
         int pci_boards_found, pci_count;
 
@@ -1164,13 +1165,11 @@ static int __init pc_init(void)
 
         pc_driver = alloc_tty_driver(MAX_ALLOC);
         if (!pc_driver)
-                return -ENOMEM;
+                goto out1;
 
         pc_info = alloc_tty_driver(MAX_ALLOC);
-        if (!pc_info) {
-                put_tty_driver(pc_driver);
-                return -ENOMEM;
-        }
+        if (!pc_info)
+                goto out2;
 
         /* -----------------------------------------------------------------------
                 If epca_setup has not been ran by LILO set num_cards to defaults; copy
@@ -1370,11 +1369,17 @@ static int __init pc_init(void)
 
         } /* End for each card */
 
-        if (tty_register_driver(pc_driver))
-                panic("Couldn't register Digi PC/ driver");
+        err = tty_register_driver(pc_driver);
+        if (err) {
+                printk(KERN_ERR "Couldn't register Digi PC/ driver");
+                goto out3;
+        }
 
-        if (tty_register_driver(pc_info))
-                panic("Couldn't register Digi PC/ info ");
+        err = tty_register_driver(pc_info);
+        if (err) {
+                printk(KERN_ERR "Couldn't register Digi PC/ info ");
+                goto out4;
+        }
 
         /* -------------------------------------------------------------------
            Start up the poller to check for events on all enabled boards
@@ -1385,6 +1390,15 @@ static int __init pc_init(void)
         mod_timer(&epca_timer, jiffies + HZ/25);
         return 0;
 
+out4:
+        tty_unregister_driver(pc_driver);
+out3:
+        put_tty_driver(pc_info);
+out2:
+        put_tty_driver(pc_driver);
+out1:
+        return err;
+
 } /* End pc_init */
 
 /* ------------------ Begin post_fep_init  ---------------------- */
diff --git a/drivers/char/ftape/zftape/zftape-buffers.c b/drivers/char/ftape/zftape/zftape-buffers.c
index da06f138334e..7ebce2ec7897 100644
--- a/drivers/char/ftape/zftape/zftape-buffers.c
+++ b/drivers/char/ftape/zftape/zftape-buffers.c
@@ -85,7 +85,7 @@ int zft_vmalloc_once(void *new, size_t size)
                 peak_memory = used_memory;
         }
         TRACE_ABORT(0, ft_t_noise,
-                    "allocated buffer @ %p, %d bytes", *(void **)new, size);
+                    "allocated buffer @ %p, %zd bytes", *(void **)new, size);
 }
 int zft_vmalloc_always(void *new, size_t size)
 {
@@ -101,7 +101,7 @@ void zft_vfree(void *old, size_t size)
         if (*(void **)old) {
                 vfree(*(void **)old);
                 used_memory -= size;
-                TRACE(ft_t_noise, "released buffer @ %p, %d bytes",
+                TRACE(ft_t_noise, "released buffer @ %p, %zd bytes",
                       *(void **)old, size);
                 *(void **)old = NULL;
         }
diff --git a/drivers/char/ip2/i2lib.c b/drivers/char/ip2/i2lib.c
index fc944d375be7..54d93f0345e8 100644
--- a/drivers/char/ip2/i2lib.c
+++ b/drivers/char/ip2/i2lib.c
@@ -1007,7 +1007,7 @@ i2InputAvailable(i2ChanStrPtr pCh)
 // applications that one cannot break out of.
 //******************************************************************************
 static int
-i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
+i2Output(i2ChanStrPtr pCh, const char *pSource, int count)
 {
         i2eBordStrPtr pB;
         unsigned char *pInsert;
@@ -1020,7 +1020,7 @@ i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
 
         int bailout = 10;
 
-        ip2trace (CHANN, ITRC_OUTPUT, ITRC_ENTER, 2, count, user );
+        ip2trace (CHANN, ITRC_OUTPUT, ITRC_ENTER, 2, count, 0 );
 
         // Ensure channel structure seems real
         if ( !i2Validate ( pCh ) ) 
@@ -1087,12 +1087,7 @@ i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
                         DATA_COUNT_OF(pInsert)  = amountToMove;
 
                         // Move the data
-                        if ( user ) {
-                                rc = copy_from_user((char*)(DATA_OF(pInsert)), pSource,
-                                                amountToMove );
-                        } else {
-                                memcpy( (char*)(DATA_OF(pInsert)), pSource, amountToMove );
-                        }
+                        memcpy( (char*)(DATA_OF(pInsert)), pSource, amountToMove );
                         // Adjust pointers and indices
                         pSource                                 += amountToMove;
                         pCh->Obuf_char_count    += amountToMove;
diff --git a/drivers/char/ip2/i2lib.h b/drivers/char/ip2/i2lib.h
index 952e113ccd8a..e559e9bac06d 100644
--- a/drivers/char/ip2/i2lib.h
+++ b/drivers/char/ip2/i2lib.h
@@ -332,7 +332,7 @@ static int  i2QueueCommands(int, i2ChanStrPtr, int, int, cmdSyntaxPtr,...);
 static int  i2GetStatus(i2ChanStrPtr, int);
 static int  i2Input(i2ChanStrPtr);
 static int  i2InputFlush(i2ChanStrPtr);
-static int  i2Output(i2ChanStrPtr, const char *, int, int);
+static int  i2Output(i2ChanStrPtr, const char *, int);
 static int  i2OutputFree(i2ChanStrPtr);
 static int  i2ServiceBoard(i2eBordStrPtr);
 static void i2DrainOutput(i2ChanStrPtr, int);
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 858ba5432c99..a3f32d46d2f8 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -1704,7 +1704,7 @@ ip2_write( PTTY tty, const unsigned char *pData, int count)
 
         /* This is the actual move bit. Make sure it does what we need!!!!! */
         WRITE_LOCK_IRQSAVE(&pCh->Pbuf_spinlock,flags);
-        bytesSent = i2Output( pCh, pData, count, 0 );
+        bytesSent = i2Output( pCh, pData, count);
         WRITE_UNLOCK_IRQRESTORE(&pCh->Pbuf_spinlock,flags);
 
         ip2trace (CHANN, ITRC_WRITE, ITRC_RETURN, 1, bytesSent );
@@ -1764,7 +1764,7 @@ ip2_flush_chars( PTTY tty )
                 //
                 // We may need to restart i2Output if it does not fullfill this request
                 //
-                strip = i2Output( pCh, pCh->Pbuf, pCh->Pbuf_stuff, 0 );
+                strip = i2Output( pCh, pCh->Pbuf, pCh->Pbuf_stuff);
                 if ( strip != pCh->Pbuf_stuff ) {
                         memmove( pCh->Pbuf, &pCh->Pbuf[strip], pCh->Pbuf_stuff - strip );
                 }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 2455e8d478ac..c47add8e47df 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -376,13 +376,23 @@ static void free_recv_msg_list(struct list_head *q)
         }
 }
 
+static void free_smi_msg_list(struct list_head *q)
+{
+        struct ipmi_smi_msg *msg, *msg2;
+
+        list_for_each_entry_safe(msg, msg2, q, link) {
+                list_del(&msg->link);
+                ipmi_free_smi_msg(msg);
+        }
+}
+
 static void clean_up_interface_data(ipmi_smi_t intf)
 {
         int              i;
         struct cmd_rcvr  *rcvr, *rcvr2;
         struct list_head list;
 
-        free_recv_msg_list(&intf->waiting_msgs);
+        free_smi_msg_list(&intf->waiting_msgs);
         free_recv_msg_list(&intf->waiting_events);
 
         /* Wholesale remove all the entries from the list in the
@@ -1844,7 +1854,7 @@ static ssize_t provides_dev_sdrs_show(struct device *dev,
         struct bmc_device *bmc = dev_get_drvdata(dev);
 
         return snprintf(buf, 10, "%u\n",
-                        bmc->id.device_revision && 0x80 >> 7);
+                        (bmc->id.device_revision & 0x80) >> 7);
 }
 
 static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
@@ -1853,7 +1863,7 @@ static ssize_t revision_show(struct device *dev, struct device_attribute *attr,
         struct bmc_device *bmc = dev_get_drvdata(dev);
 
         return snprintf(buf, 20, "%u\n",
-                        bmc->id.device_revision && 0x0F);
+                        bmc->id.device_revision & 0x0F);
 }
 
 static ssize_t firmware_rev_show(struct device *dev,
@@ -1928,13 +1938,8 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                         (long long) bmc->guid[8]);
 }
 
-static void
-cleanup_bmc_device(struct kref *ref)
+static void remove_files(struct bmc_device *bmc)
 {
-        struct bmc_device *bmc;
-
-        bmc = container_of(ref, struct bmc_device, refcount);
-
         device_remove_file(&bmc->dev->dev,
                            &bmc->device_id_attr);
         device_remove_file(&bmc->dev->dev,
@@ -1951,12 +1956,23 @@ cleanup_bmc_device(struct kref *ref)
                            &bmc->manufacturer_id_attr);
         device_remove_file(&bmc->dev->dev,
                            &bmc->product_id_attr);
+
         if (bmc->id.aux_firmware_revision_set)
                 device_remove_file(&bmc->dev->dev,
                                    &bmc->aux_firmware_rev_attr);
         if (bmc->guid_set)
                 device_remove_file(&bmc->dev->dev,
                                    &bmc->guid_attr);
+}
+
+static void
+cleanup_bmc_device(struct kref *ref)
+{
+        struct bmc_device *bmc;
+
+        bmc = container_of(ref, struct bmc_device, refcount);
+
+        remove_files(bmc);
         platform_device_unregister(bmc->dev);
         kfree(bmc);
 }
@@ -1977,6 +1993,79 @@ static void ipmi_bmc_unregister(ipmi_smi_t intf)
         mutex_unlock(&ipmidriver_mutex);
 }
 
+static int create_files(struct bmc_device *bmc)
+{
+        int err;
+
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->device_id_attr);
+        if (err) goto out;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->provides_dev_sdrs_attr);
+        if (err) goto out_devid;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->revision_attr);
+        if (err) goto out_sdrs;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->firmware_rev_attr);
+        if (err) goto out_rev;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->version_attr);
+        if (err) goto out_firm;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->add_dev_support_attr);
+        if (err) goto out_version;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->manufacturer_id_attr);
+        if (err) goto out_add_dev;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->product_id_attr);
+        if (err) goto out_manu;
+        if (bmc->id.aux_firmware_revision_set) {
+                err = device_create_file(&bmc->dev->dev,
+                                   &bmc->aux_firmware_rev_attr);
+                if (err) goto out_prod_id;
+        }
+        if (bmc->guid_set) {
+                err = device_create_file(&bmc->dev->dev,
+                                   &bmc->guid_attr);
+                if (err) goto out_aux_firm;
+        }
+
+        return 0;
+
+out_aux_firm:
+        if (bmc->id.aux_firmware_revision_set)
+                device_remove_file(&bmc->dev->dev,
+                                   &bmc->aux_firmware_rev_attr);
+out_prod_id:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->product_id_attr);
+out_manu:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->manufacturer_id_attr);
+out_add_dev:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->add_dev_support_attr);
+out_version:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->version_attr);
+out_firm:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->firmware_rev_attr);
+out_rev:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->revision_attr);
+out_sdrs:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->provides_dev_sdrs_attr);
+out_devid:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->device_id_attr);
+out:
+        return err;
+}
+
 static int ipmi_bmc_register(ipmi_smi_t intf)
 {
         int               rv;
@@ -2029,7 +2118,7 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                 dev_set_drvdata(&bmc->dev->dev, bmc);
                 kref_init(&bmc->refcount);
 
-                rv = platform_device_register(bmc->dev);
+                rv = platform_device_add(bmc->dev);
                 mutex_unlock(&ipmidriver_mutex);
                 if (rv) {
                         printk(KERN_ERR
@@ -2051,7 +2140,6 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                 bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
                 bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
 
-
                 bmc->revision_attr.attr.name = "revision";
                 bmc->revision_attr.attr.owner = THIS_MODULE;
                 bmc->revision_attr.attr.mode = S_IRUGO;
@@ -2093,28 +2181,14 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                 bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
                 bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
 
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->device_id_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->provides_dev_sdrs_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->revision_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->firmware_rev_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->version_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->add_dev_support_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->manufacturer_id_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->product_id_attr);
-                if (bmc->id.aux_firmware_revision_set)
-                        device_create_file(&bmc->dev->dev,
-                                           &bmc->aux_firmware_rev_attr);
-                if (bmc->guid_set)
-                        device_create_file(&bmc->dev->dev,
-                                           &bmc->guid_attr);
+                rv = create_files(bmc);
+                if (rv) {
+                        mutex_lock(&ipmidriver_mutex);
+                        platform_device_unregister(bmc->dev);
+                        mutex_unlock(&ipmidriver_mutex);
+
+                        return rv;
+                }
 
                 printk(KERN_INFO
                        "ipmi: Found new BMC (man_id: 0x%6.6x, "
@@ -3168,7 +3242,9 @@ void ipmi_smi_msg_received(ipmi_smi_t          intf,
                    report the error immediately. */
                 if ((msg->rsp_size >= 3) && (msg->rsp[2] != 0)
                     && (msg->rsp[2] != IPMI_NODE_BUSY_ERR)
-                    && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR))
+                    && (msg->rsp[2] != IPMI_LOST_ARBITRATION_ERR)
+                    && (msg->rsp[2] != IPMI_BUS_ERR)
+                    && (msg->rsp[2] != IPMI_NAK_ON_WRITE_ERR))
                 {
                         int chan = msg->rsp[3] & 0xf;
 
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 24825bdca8f4..bb1fac104fda 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1211,7 +1211,7 @@ static void intf_mem_outb(struct si_sm_io *io, unsigned int offset,
 static unsigned char intf_mem_inw(struct si_sm_io *io, unsigned int offset)
 {
         return (readw((io->addr)+(offset * io->regspacing)) >> io->regshift)
-                && 0xff;
+                & 0xff;
 }
 
 static void intf_mem_outw(struct si_sm_io *io, unsigned int offset,
@@ -1223,7 +1223,7 @@ static void intf_mem_outw(struct si_sm_io *io, unsigned int offset,
 static unsigned char intf_mem_inl(struct si_sm_io *io, unsigned int offset)
 {
         return (readl((io->addr)+(offset * io->regspacing)) >> io->regshift)
-                && 0xff;
+                & 0xff;
 }
 
 static void intf_mem_outl(struct si_sm_io *io, unsigned int offset,
@@ -1236,7 +1236,7 @@ static void intf_mem_outl(struct si_sm_io *io, unsigned int offset,
 static unsigned char mem_inq(struct si_sm_io *io, unsigned int offset)
 {
         return (readq((io->addr)+(offset * io->regspacing)) >> io->regshift)
-                && 0xff;
+                & 0xff;
 }
 
 static void mem_outq(struct si_sm_io *io, unsigned int offset,
@@ -1789,7 +1789,7 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
-                return ENOMEM;
+                return -ENOMEM;
 
         info->addr_source = "PCI";
 
@@ -1810,7 +1810,7 @@ static int __devinit ipmi_pci_probe(struct pci_dev *pdev,
                 kfree(info);
                 printk(KERN_INFO "ipmi_si: %s: Unknown IPMI type: %d\n",
                        pci_name(pdev), class_type);
-                return ENOMEM;
+                return -ENOMEM;
         }
 
         rv = pci_enable_device(pdev);
@@ -1867,7 +1867,7 @@ static int ipmi_pci_resume(struct pci_dev *pdev)
 
 static struct pci_device_id ipmi_pci_devices[] = {
         { PCI_DEVICE(PCI_HP_VENDOR_ID, PCI_MMC_DEVICE_ID) },
-        { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE) }
+        { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE_MASK) }
 };
 MODULE_DEVICE_TABLE(pci, ipmi_pci_devices);
 
@@ -2346,7 +2346,7 @@ static int try_smi_init(struct smi_info *new_smi)
                 new_smi->dev = &new_smi->pdev->dev;
                 new_smi->dev->driver = &ipmi_driver;
 
-                rv = platform_device_register(new_smi->pdev);
+                rv = platform_device_add(new_smi->pdev);
                 if (rv) {
                         printk(KERN_ERR
                                "ipmi_si_intf:"
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index e9e9bf31c369..58c955e390b3 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -1062,11 +1062,12 @@ static void isicom_shutdown_port(struct isi_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
         struct isi_port *port = tty->driver_data;
-        struct isi_board *card = port->card;
+        struct isi_board *card;
         unsigned long flags;
 
         if (!port)
                 return;
+        card = port->card;
         if (isicom_paranoia_check(port, tty->name, "isicom_close"))
                 return;
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6511012cbdcd..55473371b7c6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -26,6 +26,7 @@
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
 #include <linux/pipe_fs_i.h>
+#include <linux/pfn.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -292,8 +293,8 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
         unsigned long pfn;
 
-        /* Turn a kernel-virtual address into a physical page frame */
-        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
+        /* Turn a pfn offset into an absolute pfn */
+        pfn = PFN_DOWN(virt_to_phys((void *)PAGE_OFFSET)) + vma->vm_pgoff;
 
         /*
          * RED-PEN: on some architectures there is more mapped memory
diff --git a/drivers/char/moxa.c b/drivers/char/moxa.c
index b401383808c2..96cb1f07332b 100644
--- a/drivers/char/moxa.c
+++ b/drivers/char/moxa.c
@@ -130,6 +130,7 @@ static moxa_isa_board_conf moxa_isa_boards[] =
 typedef struct _moxa_pci_devinfo {
         ushort busNum;
         ushort devNum;
+        struct pci_dev *pdev;
 } moxa_pci_devinfo;
 
 typedef struct _moxa_board_conf {
@@ -324,6 +325,9 @@ static int moxa_get_PCI_conf(struct pci_dev *p, int board_type, moxa_board_conf
         board->busType = MOXA_BUS_TYPE_PCI;
         board->pciInfo.busNum = p->bus->number;
         board->pciInfo.devNum = p->devfn >> 3;
+        board->pciInfo.pdev = p;
+        /* don't lose the reference in the next pci_get_device iteration */
+        pci_dev_get(p);
 
         return (0);
 }
@@ -493,6 +497,11 @@ static void __exit moxa_exit(void)
         if (tty_unregister_driver(moxaDriver))
                 printk("Couldn't unregister MOXA Intellio family serial driver\n");
         put_tty_driver(moxaDriver);
+
+        for (i = 0; i < MAX_BOARDS; i++)
+                if (moxa_boards[i].busType == MOXA_BUS_TYPE_PCI)
+                        pci_dev_put(moxa_boards[i].pciInfo.pdev);
+
         if (verbose)
                 printk("Done\n");
 }
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index 5c0dec39cf6c..235e89226112 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -72,7 +72,11 @@ enum {
         MSPEC_UNCACHED
 };
 
+#ifdef CONFIG_SGI_SN
 static int is_sn2;
+#else
+#define is_sn2          0
+#endif
 
 /*
  * One of these structures is allocated when an mspec region is mmaped. The
@@ -211,7 +215,7 @@ mspec_nopfn(struct vm_area_struct *vma, unsigned long address)
         if (vdata->type == MSPEC_FETCHOP)
                 paddr = TO_AMO(maddr);
         else
-                paddr = __pa(TO_CAC(maddr));
+                paddr = maddr & ~__IA64_UNCACHED_OFFSET;
 
         pfn = paddr >> PAGE_SHIFT;
 
@@ -335,6 +339,7 @@ mspec_init(void)
          * The fetchop device only works on SN2 hardware, uncached and cached
          * memory drivers should both be valid on all ia64 hardware
          */
+#ifdef CONFIG_SGI_SN
         if (ia64_platform_is("sn2")) {
                 is_sn2 = 1;
                 if (is_shub2()) {
@@ -363,6 +368,7 @@ mspec_init(void)
                         goto free_scratch_pages;
                 }
         }
+#endif
         ret = misc_register(&cached_miscdev);
         if (ret) {
                 printk(KERN_ERR "%s: failed to register device %i\n",
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 07f47a0208a7..eb6b13f4211a 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -645,6 +645,7 @@ void add_input_randomness(unsigned int type, unsigned int code,
         add_timer_randomness(&input_timer_state,
                              (type << 4) ^ code ^ (code >> 4) ^ value);
 }
+EXPORT_SYMBOL_GPL(add_input_randomness);
 
 void add_interrupt_randomness(int irq)
 {
diff --git a/drivers/char/rio/host.h b/drivers/char/rio/host.h
index ee2ddea7a63a..23d0681fe491 100644
--- a/drivers/char/rio/host.h
+++ b/drivers/char/rio/host.h
@@ -44,6 +44,7 @@
 **    the host.
 */
 struct Host {
+        struct pci_dev *pdev;
         unsigned char Type;             /* RIO_EISA, RIO_MCA, ... */
         unsigned char Ivec;             /* POLLED or ivec number */
         unsigned char Mode;             /* Control stuff */
diff --git a/drivers/char/rio/rio_linux.c b/drivers/char/rio/rio_linux.c
index c382df0f82f6..7ac68cb3bedd 100644
--- a/drivers/char/rio/rio_linux.c
+++ b/drivers/char/rio/rio_linux.c
@@ -1017,6 +1017,10 @@ static int __init rio_init(void)
                         rio_dprintk(RIO_DEBUG_PROBE, "Hmm Tested ok, uniqid = %x.\n", p->RIOHosts[p->RIONumHosts].UniqueNum);
 
                         fix_rio_pci(pdev);
+
+                        p->RIOHosts[p->RIONumHosts].pdev = pdev;
+                        pci_dev_get(pdev);
+
                         p->RIOLastPCISearch = 0;
                         p->RIONumHosts++;
                         found++;
@@ -1066,6 +1070,9 @@ static int __init rio_init(void)
                             ((readb(&p->RIOHosts[p->RIONumHosts].Unique[1]) & 0xFF) << 8) | ((readb(&p->RIOHosts[p->RIONumHosts].Unique[2]) & 0xFF) << 16) | ((readb(&p->RIOHosts[p->RIONumHosts].Unique[3]) & 0xFF) << 24);
                         rio_dprintk(RIO_DEBUG_PROBE, "Hmm Tested ok, uniqid = %x.\n", p->RIOHosts[p->RIONumHosts].UniqueNum);
 
+                        p->RIOHosts[p->RIONumHosts].pdev = pdev;
+                        pci_dev_get(pdev);
+
                         p->RIOLastPCISearch = 0;
                         p->RIONumHosts++;
                         found++;
@@ -1181,6 +1188,8 @@ static void __exit rio_exit(void)
                 }
                 /* It is safe/allowed to del_timer a non-active timer */
                 del_timer(&hp->timer);
+                if (hp->Type == RIO_PCI)
+                        pci_dev_put(hp->pdev);
         }
 
         if (misc_deregister(&rio_fw_device) < 0) {
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index 052e8120a471..7ce77619707c 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -662,7 +662,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                         p->RIOError.Error = COPYIN_FAILED;
                         return -EFAULT;
                 }
-                if (portStats.port >= RIO_PORTS) {
+                if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                         p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                         return -ENXIO;
                 }
@@ -702,7 +702,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                         p->RIOError.Error = COPYIN_FAILED;
                         return -EFAULT;
                 }
-                if (portStats.port >= RIO_PORTS) {
+                if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                         p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                         return -ENXIO;
                 }
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 461bfe0234c9..3af7f0958c5d 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -839,7 +839,7 @@ shutdown(struct cyclades_port * info)
     local_irq_save(flags);
         if (info->xmit_buf){
             free_page((unsigned long) info->xmit_buf);
-            info->xmit_buf = 0;
+            info->xmit_buf = NULL;
         }
 
         base_addr[CyCAR] = (u_char)channel;
@@ -1354,7 +1354,7 @@ cy_unthrottle(struct tty_struct * tty)
 
 static int
 get_serial_info(struct cyclades_port * info,
-                           struct serial_struct * retinfo)
+                           struct serial_struct __user * retinfo)
 {
   struct serial_struct tmp;
 
@@ -1376,7 +1376,7 @@ get_serial_info(struct cyclades_port * info,
 
 static int
 set_serial_info(struct cyclades_port * info,
-                           struct serial_struct * new_info)
+                           struct serial_struct __user * new_info)
 {
   struct serial_struct new_serial;
   struct cyclades_port old_info;
@@ -1503,7 +1503,7 @@ send_break( struct cyclades_port * info, int duration)
 } /* send_break */
 
 static int
-get_mon_info(struct cyclades_port * info, struct cyclades_monitor * mon)
+get_mon_info(struct cyclades_port * info, struct cyclades_monitor __user * mon)
 {
 
    if (copy_to_user(mon, &info->mon, sizeof(struct cyclades_monitor)))
@@ -1516,7 +1516,7 @@ get_mon_info(struct cyclades_port * info, struct cyclades_monitor * mon)
 }
 
 static int
-set_threshold(struct cyclades_port * info, unsigned long *arg)
+set_threshold(struct cyclades_port * info, unsigned long __user *arg)
 {
    volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
    unsigned long value;
@@ -1533,7 +1533,7 @@ set_threshold(struct cyclades_port * info, unsigned long *arg)
 }
 
 static int
-get_threshold(struct cyclades_port * info, unsigned long *value)
+get_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
    volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
    int channel;
@@ -1546,7 +1546,7 @@ get_threshold(struct cyclades_port * info, unsigned long *value)
 }
 
 static int
-set_default_threshold(struct cyclades_port * info, unsigned long *arg)
+set_default_threshold(struct cyclades_port * info, unsigned long __user *arg)
 {
    unsigned long value;
 
@@ -1558,13 +1558,13 @@ set_default_threshold(struct cyclades_port * info, unsigned long *arg)
 }
 
 static int
-get_default_threshold(struct cyclades_port * info, unsigned long *value)
+get_default_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
    return put_user(info->default_threshold,value);
 }
 
 static int
-set_timeout(struct cyclades_port * info, unsigned long *arg)
+set_timeout(struct cyclades_port * info, unsigned long __user *arg)
 {
    volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
    int channel;
@@ -1581,7 +1581,7 @@ set_timeout(struct cyclades_port * info, unsigned long *arg)
 }
 
 static int
-get_timeout(struct cyclades_port * info, unsigned long *value)
+get_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
    volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
    int channel;
@@ -1601,7 +1601,7 @@ set_default_timeout(struct cyclades_port * info, unsigned long value)
 }
 
 static int
-get_default_timeout(struct cyclades_port * info, unsigned long *value)
+get_default_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
    return put_user(info->default_timeout,value);
 }
@@ -1613,6 +1613,7 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
   unsigned long val;
   struct cyclades_port * info = (struct cyclades_port *)tty->driver_data;
   int ret_val = 0;
+  void __user *argp = (void __user *)arg;
 
 #ifdef SERIAL_DEBUG_OTHER
     printk("cy_ioctl %s, cmd = %x arg = %lx\n", tty->name, cmd, arg); /* */
@@ -1620,28 +1621,28 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 
     switch (cmd) {
         case CYGETMON:
-            ret_val = get_mon_info(info, (struct cyclades_monitor *)arg);
+            ret_val = get_mon_info(info, argp);
             break;
         case CYGETTHRESH:
-            ret_val = get_threshold(info, (unsigned long *)arg);
+            ret_val = get_threshold(info, argp);
             break;
         case CYSETTHRESH:
-            ret_val = set_threshold(info, (unsigned long *)arg);
+            ret_val = set_threshold(info, argp);
             break;
         case CYGETDEFTHRESH:
-            ret_val = get_default_threshold(info, (unsigned long *)arg);
+            ret_val = get_default_threshold(info, argp);
             break;
         case CYSETDEFTHRESH:
-            ret_val = set_default_threshold(info, (unsigned long *)arg);
+            ret_val = set_default_threshold(info, argp);
             break;
         case CYGETTIMEOUT:
-            ret_val = get_timeout(info, (unsigned long *)arg);
+            ret_val = get_timeout(info, argp);
             break;
         case CYSETTIMEOUT:
-            ret_val = set_timeout(info, (unsigned long *)arg);
+            ret_val = set_timeout(info, argp);
             break;
         case CYGETDEFTIMEOUT:
-            ret_val = get_default_timeout(info, (unsigned long *)arg);
+            ret_val = get_default_timeout(info, argp);
             break;
         case CYSETDEFTIMEOUT:
             ret_val = set_default_timeout(info, (unsigned long)arg);
@@ -1664,21 +1665,20 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 
 /* The following commands are incompletely implemented!!! */
         case TIOCGSOFTCAR:
-            ret_val = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+            ret_val = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) argp);
             break;
         case TIOCSSOFTCAR:
-            ret_val = get_user(val, (unsigned long *) arg);
+            ret_val = get_user(val, (unsigned long __user *) argp);
             if (ret_val)
                     break;
             tty->termios->c_cflag =
                     ((tty->termios->c_cflag & ~CLOCAL) | (val ? CLOCAL : 0));
             break;
         case TIOCGSERIAL:
-            ret_val = get_serial_info(info, (struct serial_struct *) arg);
+            ret_val = get_serial_info(info, argp);
             break;
         case TIOCSSERIAL:
-            ret_val = set_serial_info(info,
-                                   (struct serial_struct *) arg);
+            ret_val = set_serial_info(info, argp);
             break;
         default:
             ret_val = -ENOIOCTLCMD;
@@ -1773,7 +1773,7 @@ cy_close(struct tty_struct * tty, struct file * filp)
         tty->driver->flush_buffer(tty);
     tty_ldisc_flush(tty);
     info->event = 0;
-    info->tty = 0;
+    info->tty = NULL;
     if (info->blocked_open) {
         if (info->close_delay) {
             msleep_interruptible(jiffies_to_msecs(info->close_delay));
@@ -2250,7 +2250,7 @@ scrn[1] = '\0';
                 info->card = index;
                 info->line = port_num;
                 info->flags = STD_COM_FLAGS;
-                info->tty = 0;
+                info->tty = NULL;
                 info->xmit_fifo_size = 12;
                 info->cor1 = CyPARITY_NONE|Cy_8_BITS;
                 info->cor2 = CyETC;
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index d0b88d0e87fd..7e1bd9562c2a 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -183,11 +183,6 @@ static int sx_poll = HZ;
 
 static struct tty_driver *specialix_driver;
 
-static unsigned long baud_table[] =  {
-        0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-        9600, 19200, 38400, 57600, 115200, 0,
-};
-
 static struct specialix_board sx_board[SX_NBOARD] =  {
         { 0, SX_IOBASE1,  9, },
         { 0, SX_IOBASE2, 11, },
@@ -1090,9 +1085,9 @@ static void sx_change_speed(struct specialix_board *bp, struct specialix_port *p
 
         if (baud == 38400) {
                 if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
-                        baud ++;
+                        baud = 57600;
                 if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
-                        baud += 2;
+                        baud = 115200;
         }
 
         if (!baud) {
@@ -1150,11 +1145,9 @@ static void sx_change_speed(struct specialix_board *bp, struct specialix_port *p
         sx_out(bp, CD186x_RBPRL, tmp & 0xff);
         sx_out(bp, CD186x_TBPRL, tmp & 0xff);
         spin_unlock_irqrestore(&bp->lock, flags);
-        if (port->custom_divisor) {
+        if (port->custom_divisor)
                 baud = (SX_OSCFREQ + port->custom_divisor/2) / port->custom_divisor;
-                baud = ( baud + 5 ) / 10;
-        } else
-                baud = (baud_table[baud] + 5) / 10;   /* Estimated CPS */
+        baud = (baud + 5) / 10;         /* Estimated CPS */
 
         /* Two timer ticks seems enough to wakeup something like SLIP driver */
         tmp = ((baud + HZ/2) / HZ) * 2 - CD186x_NFIFO;
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 5fec626598cd..cc10af08cb05 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2602,7 +2602,7 @@ static void __exit sx_exit (void)
                 }
         }
         if (misc_deregister(&sx_fw_device) < 0) {
-                printk (KERN_INFO "sx: couldn't deregister firmware loader devic\n");
+                printk (KERN_INFO "sx: couldn't deregister firmware loader device\n");
         }
         sx_dprintk (SX_DEBUG_CLEANUP, "Cleaning up drivers (%d)\n", sx_initialized);
         if (sx_initialized)
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index f2864cc64240..06784adcc35c 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -133,8 +133,8 @@ static MGSL_PARAMS default_params = {
 };
 
 #define SHARED_MEM_ADDRESS_SIZE 0x40000
-#define BUFFERLISTSIZE (PAGE_SIZE)
-#define DMABUFFERSIZE (PAGE_SIZE)
+#define BUFFERLISTSIZE 4096
+#define DMABUFFERSIZE 4096
 #define MAXRXFRAMES 7
 
 typedef struct _DMABUFFERENTRY
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index a082a2e34252..6ad2d3bb945c 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1153,7 +1153,14 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vend
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
+        if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
+                list_del(&chip->list);
+                put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
+                kfree(chip);
+                kfree(devname);
+                return NULL;
+        }
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ad8ffe49256f..1ab0896070be 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -184,7 +184,9 @@ static int __init init_atmel(void)
         unsigned long base;
         struct  tpm_chip *chip;
 
-        driver_register(&atml_drv);
+        rc = driver_register(&atml_drv);
+        if (rc)
+                return rc;
 
         if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
@@ -195,10 +197,8 @@ static int __init init_atmel(void)
             (atmel_request_region
              (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
 
-
-        if (IS_ERR
-            (pdev =
-             platform_device_register_simple("tpm_atmel", -1, NULL, 0))) {
+        pdev = platform_device_register_simple("tpm_atmel", -1, NULL, 0);
+        if (IS_ERR(pdev)) {
                 rc = PTR_ERR(pdev);
                 goto err_rel_reg;
         }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 26287aace87d..608f73071bef 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -284,7 +284,7 @@ static struct device_driver nsc_drv = {
 static int __init init_nsc(void)
 {
         int rc = 0;
-        int lo, hi;
+        int lo, hi, err;
         int nscAddrBase = TPM_ADDR;
         struct tpm_chip *chip;
         unsigned long base;
@@ -297,7 +297,9 @@ static int __init init_nsc(void)
                         return -ENODEV;
         }
 
-        driver_register(&nsc_drv);
+        err = driver_register(&nsc_drv);
+        if (err)
+                return err;
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index 89e46d6dfc4e..0187b1185323 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -13,7 +13,7 @@ config WATCHDOG
           subsequently opening the file and then failing to write to it for
           longer than 1 minute will result in rebooting the machine. This
           could be useful for a networked machine that needs to come back
-          online as fast as possible after a lock-up. There's both a watchdog
+          on-line as fast as possible after a lock-up. There's both a watchdog
           implementation entirely in software (which can sometimes fail to
           reboot the machine) and a driver for hardware watchdog boards, which
           are more robust and can also keep track of the temperature inside
@@ -60,7 +60,7 @@ config SOFT_WATCHDOG
 
 # ARM Architecture
 
-config AT91_WATCHDOG
+config AT91RM9200_WATCHDOG
         tristate "AT91RM9200 watchdog"
         depends on WATCHDOG && ARCH_AT91RM9200
         help
@@ -71,7 +71,7 @@ config 21285_WATCHDOG
         tristate "DC21285 watchdog"
         depends on WATCHDOG && FOOTBRIDGE
         help
-          The Intel Footbridge chip contains a builtin watchdog circuit. Say Y
+          The Intel Footbridge chip contains a built-in watchdog circuit. Say Y
           here if you wish to use this. Alternatively say M to compile the
           driver as a module, which will be called wdt285.
 
@@ -269,11 +269,11 @@ config IB700_WDT
           Most people will say N.
 
 config IBMASR
-        tristate "IBM Automatic Server Restart"
-        depends on WATCHDOG && X86
-        help
+        tristate "IBM Automatic Server Restart"
+        depends on WATCHDOG && X86
+        help
           This is the driver for the IBM Automatic Server Restart watchdog
-          timer builtin into some eServer xSeries machines.
+          timer built-in into some eServer xSeries machines.
 
           To compile this driver as a module, choose M here: the
           module will be called ibmasr.
@@ -316,13 +316,16 @@ config I8XX_TCO
           To compile this driver as a module, choose M here: the
           module will be called i8xx_tco.
 
+          Note: This driver will be removed in the near future. Please
+          use the Intel TCO Timer/Watchdog driver.
+
 config ITCO_WDT
-        tristate "Intel TCO Timer/Watchdog (EXPERIMENTAL)"
-        depends on WATCHDOG && (X86 || IA64) && PCI && EXPERIMENTAL
+        tristate "Intel TCO Timer/Watchdog"
+        depends on WATCHDOG && (X86 || IA64) && PCI
         ---help---
           Hardware driver for the intel TCO timer based watchdog devices.
           These drivers are included in the Intel 82801 I/O Controller
-          Hub family 'from ICH0 up to ICH7) and in the Intel 6300ESB
+          Hub family (from ICH0 up to ICH8) and in the Intel 6300ESB
           controller hub.
 
           The TCO (Total Cost of Ownership) timer is a watchdog timer
@@ -395,6 +398,26 @@ config CPU5_WDT
           To compile this driver as a module, choose M here: the
           module will be called cpu5wdt.
 
+config SMSC37B787_WDT
+        tristate "Winbond SMsC37B787 Watchdog Timer"
+        depends on WATCHDOG && X86
+        ---help---
+          This is the driver for the hardware watchdog component on the
+          Winbond SMsC37B787 chipset as used on the NetRunner Mainboard
+          from Vision Systems and maybe others.
+
+          This watchdog simply watches your kernel to make sure it doesn't
+          freeze, and if it does, it reboots your computer after a certain
+          amount of time.
+
+          Usually a userspace daemon will notify the kernel WDT driver that
+          userspace is still alive, at regular intervals.
+
+          To compile this driver as a module, choose M here: the
+          module will be called smsc37b787_wdt.
+
+          Most people will say N.
+
 config W83627HF_WDT
         tristate "W83627HF Watchdog Timer"
         depends on WATCHDOG && X86
@@ -410,6 +433,21 @@ config W83627HF_WDT
 
           Most people will say N.
 
+config W83697HF_WDT
+        tristate "W83697HF/W83697HG Watchdog Timer"
+        depends on WATCHDOG && X86
+        ---help---
+          This is the driver for the hardware watchdog on the W83697HF/HG
+          chipset as used in Dedibox/VIA motherboards (and likely others).
+          This watchdog simply watches your kernel to make sure it doesn't
+          freeze, and if it does, it reboots your computer after a certain
+          amount of time.
+
+          To compile this driver as a module, choose M here: the
+          module will be called w83697hf_wdt.
+
+          Most people will say N.
+
 config W83877F_WDT
         tristate "W83877F (EMACS) Watchdog Timer"
         depends on WATCHDOG && X86
@@ -443,7 +481,7 @@ config MACHZ_WDT
         depends on WATCHDOG && X86
         ---help---
           If you are using a ZF Micro MachZ processor, say Y here, otherwise
-          N.  This is the driver for the watchdog timer builtin on that
+          N.  This is the driver for the watchdog timer built-in on that
           processor using ZF-Logic interface.  This watchdog simply watches
           your kernel to make sure it doesn't freeze, and if it does, it
           reboots your computer after a certain amount of time.
@@ -472,7 +510,6 @@ config SBC_EPX_C3_WATCHDOG
           To compile this driver as a module, choose M here: the
           module will be called sbc_epx_c3.
 
-
 # PowerPC Architecture
 
 config 8xx_WDT
@@ -502,7 +539,7 @@ config WATCHDOG_RTAS
         help
           This driver adds watchdog support for the RTAS watchdog.
 
-          To compile this driver as a module, choose M here. The module
+          To compile this driver as a module, choose M here. The module
           will be called wdrtas.
 
 # MIPS Architecture
@@ -556,7 +593,7 @@ config SH_WDT_MMAP
         help
           If you say Y here, user applications will be able to mmap the
           WDT/CPG registers.
-#
+
 # SPARC64 Architecture
 
 config WATCHDOG_CP1XXX
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index 7f70abad465a..36440497047c 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -23,7 +23,7 @@ obj-$(CONFIG_WDTPCI) += wdt_pci.o
 obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 
 # ARM Architecture
-obj-$(CONFIG_AT91_WATCHDOG) += at91_wdt.o
+obj-$(CONFIG_AT91RM9200_WATCHDOG) += at91rm9200_wdt.o
 obj-$(CONFIG_OMAP_WATCHDOG) += omap_wdt.o
 obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
 obj-$(CONFIG_977_WATCHDOG) += wdt977.o
@@ -53,7 +53,9 @@ obj-$(CONFIG_SCx200_WDT) += scx200_wdt.o
 obj-$(CONFIG_60XX_WDT) += sbc60xxwdt.o
 obj-$(CONFIG_SBC8360_WDT) += sbc8360.o
 obj-$(CONFIG_CPU5_WDT) += cpu5wdt.o
+obj-$(CONFIG_SMSC37B787_WDT) += smsc37b787_wdt.o
 obj-$(CONFIG_W83627HF_WDT) += w83627hf_wdt.o
+obj-$(CONFIG_W83697HF_WDT) += w83697hf_wdt.o
 obj-$(CONFIG_W83877F_WDT) += w83877f_wdt.o
 obj-$(CONFIG_W83977F_WDT) += w83977f_wdt.o
 obj-$(CONFIG_MACHZ_WDT) += machzwd.o
diff --git a/drivers/char/watchdog/alim7101_wdt.c b/drivers/char/watchdog/alim7101_wdt.c
index 5948863b592b..bf25d0a55a99 100644
--- a/drivers/char/watchdog/alim7101_wdt.c
+++ b/drivers/char/watchdog/alim7101_wdt.c
@@ -77,7 +77,8 @@ static struct pci_dev *alim7101_pmu;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+                 __stringify(CONFIG_WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Whack the dog
@@ -415,6 +416,16 @@ err_out:
 module_init(alim7101_wdt_init);
 module_exit(alim7101_wdt_unload);
 
+static struct pci_device_id alim7101_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M1533,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_AL, PCI_DEVICE_ID_AL_M7101,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { }
+};
+
+MODULE_DEVICE_TABLE(pci, alim7101_pci_tbl);
+
 MODULE_AUTHOR("Steve Hill");
 MODULE_DESCRIPTION("ALi M7101 PMU Computer Watchdog Timer driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/watchdog/at91_wdt.c b/drivers/char/watchdog/at91rm9200_wdt.c
index 4e7a1145e78f..4e7a1145e78f 100644
--- a/drivers/char/watchdog/at91_wdt.c
+++ b/drivers/char/watchdog/at91rm9200_wdt.c
diff --git a/drivers/char/watchdog/iTCO_wdt.c b/drivers/char/watchdog/iTCO_wdt.c
index aaac94db0d8b..b6f29cb8bd39 100644
--- a/drivers/char/watchdog/iTCO_wdt.c
+++ b/drivers/char/watchdog/iTCO_wdt.c
@@ -35,6 +35,10 @@
  *      82801GDH (ICH7DH)    : document number 307013-002, 307014-009,
  *      82801GBM (ICH7-M)    : document number 307013-002, 307014-009,
  *      82801GHM (ICH7-M DH) : document number 307013-002, 307014-009,
+ *      82801HB  (ICH8)      : document number 313056-002, 313057-004,
+ *      82801HR  (ICH8R)     : document number 313056-002, 313057-004,
+ *      82801HH  (ICH8DH)    : document number 313056-002, 313057-004,
+ *      82801HO  (ICH8DO)    : document number 313056-002, 313057-004,
  *      6300ESB  (6300ESB)   : document number 300641-003
  */
 
@@ -45,7 +49,7 @@
 /* Module and version information */
 #define DRV_NAME        "iTCO_wdt"
 #define DRV_VERSION     "1.00"
-#define DRV_RELDATE     "30-Jul-2006"
+#define DRV_RELDATE     "08-Oct-2006"
 #define PFX             DRV_NAME ": "
 
 /* Includes */
@@ -85,6 +89,9 @@ enum iTCO_chipsets {
         TCO_ICH7,       /* ICH7 & ICH7R */
         TCO_ICH7M,      /* ICH7-M */
         TCO_ICH7MDH,    /* ICH7-M DH */
+        TCO_ICH8,       /* ICH8 & ICH8R */
+        TCO_ICH8DH,     /* ICH8DH */
+        TCO_ICH8DO,     /* ICH8DO */
 };
 
 static struct {
@@ -108,6 +115,9 @@ static struct {
         {"ICH7 or ICH7R", 2},
         {"ICH7-M", 2},
         {"ICH7-M DH", 2},
+        {"ICH8 or ICH8R", 2},
+        {"ICH8DH", 2},
+        {"ICH8DO", 2},
         {NULL,0}
 };
 
@@ -135,6 +145,9 @@ static struct pci_device_id iTCO_wdt_pci_tbl[] = {
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_0,      PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH7    },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_1,      PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH7M   },
         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_31,     PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH7MDH },
+        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH8_0,      PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH8    },
+        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH8_2,      PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH8DH  },
+        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH8_3,      PCI_ANY_ID, PCI_ANY_ID, 0, 0, TCO_ICH8DO  },
         { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE (pci, iTCO_wdt_pci_tbl);
@@ -355,7 +368,8 @@ static int iTCO_wdt_get_timeleft (int *time_left)
                 spin_unlock(&iTCO_wdt_private.io_lock);
 
                 *time_left = (val8 * 6) / 10;
-        }
+        } else
+                return -EINVAL;
         return 0;
 }
 
@@ -426,7 +440,6 @@ static int iTCO_wdt_ioctl (struct inode *inode, struct file *file,
 {
         int new_options, retval = -EINVAL;
         int new_heartbeat;
-        int time_left;
         void __user *argp = (void __user *)arg;
         int __user *p = argp;
         static struct watchdog_info ident = {
@@ -486,6 +499,8 @@ static int iTCO_wdt_ioctl (struct inode *inode, struct file *file,
 
                 case WDIOC_GETTIMELEFT:
                 {
+                        int time_left;
+
                         if (iTCO_wdt_get_timeleft(&time_left))
                                 return -EINVAL;
 
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 68b1ca976d53..18cb050c3862 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -380,18 +380,21 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (res == NULL) {
                 printk(KERN_INFO PFX "failed to get irq resource\n");
+                iounmap(wdt_base);
                 return -ENOENT;
         }
 
         ret = request_irq(res->start, s3c2410wdt_irq, 0, pdev->name, pdev);
         if (ret != 0) {
                 printk(KERN_INFO PFX "failed to install irq (%d)\n", ret);
+                iounmap(wdt_base);
                 return ret;
         }
 
         wdt_clock = clk_get(&pdev->dev, "watchdog");
         if (wdt_clock == NULL) {
                 printk(KERN_INFO PFX "failed to find watchdog clock source\n");
+                iounmap(wdt_base);
                 return -ENOENT;
         }
 
@@ -415,6 +418,7 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         if (ret) {
                 printk (KERN_ERR PFX "cannot register miscdev on minor=%d (%d)\n",
                         WATCHDOG_MINOR, ret);
+                iounmap(wdt_base);
                 return ret;
         }
 
@@ -451,6 +455,7 @@ static int s3c2410wdt_remove(struct platform_device *dev)
                 wdt_clock = NULL;
         }
 
+        iounmap(wdt_base);
         misc_deregister(&s3c2410wdt_miscdev);
         return 0;
 }
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index d8d0f28e0acf..e3239833e4b0 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -392,7 +392,7 @@ static int __init sc1200wdt_init(void)
         if (io == -1) {
                 printk(KERN_ERR PFX "io parameter must be specified\n");
                 ret = -EINVAL;
-                goto out_clean;
+                goto out_pnp;
         }
 
 #if defined CONFIG_PNP
@@ -405,7 +405,7 @@ static int __init sc1200wdt_init(void)
         if (!request_region(io, io_len, SC1200_MODULE_NAME)) {
                 printk(KERN_ERR PFX "Unable to register IO port %#x\n", io);
                 ret = -EBUSY;
-                goto out_clean;
+                goto out_pnp;
         }
 
         ret = sc1200wdt_probe();
@@ -435,6 +435,11 @@ out_rbt:
 out_io:
         release_region(io, io_len);
 
+out_pnp:
+#if defined CONFIG_PNP
+        if (isapnp)
+                pnp_unregister_driver(&scl200wdt_pnp_driver);
+#endif
         goto out_clean;
 }
 
diff --git a/drivers/char/watchdog/smsc37b787_wdt.c b/drivers/char/watchdog/smsc37b787_wdt.c
new file mode 100644
index 000000000000..9f56913b484f
--- /dev/null
+++ b/drivers/char/watchdog/smsc37b787_wdt.c
@@ -0,0 +1,627 @@
+/*
+ *      SMsC 37B787 Watchdog Timer driver for Linux 2.6.x.x
+ *
+ *      Based on acquirewdt.c by Alan Cox <alan@redhat.com>
+ *       and some other existing drivers
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      The authors do NOT admit liability nor provide warranty for
+ *      any of this software. This material is provided "AS-IS" in
+ *      the hope that it may be useful for others.
+ *
+ *      (C) Copyright 2003-2006  Sven Anders <anders@anduras.de>
+ *
+ *  History:
+ *      2003 - Created version 1.0 for Linux 2.4.x.
+ *      2006 - Ported to Linux 2.6, added nowayout and MAGICCLOSE
+ *             features. Released version 1.1
+ *
+ *  Theory of operation:
+ *
+ *      A Watchdog Timer (WDT) is a hardware circuit that can
+ *      reset the computer system in case of a software fault.
+ *      You probably knew that already.
+ *
+ *      Usually a userspace daemon will notify the kernel WDT driver
+ *      via the /dev/watchdog special device file that userspace is
+ *      still alive, at regular intervals.  When such a notification
+ *      occurs, the driver will usually tell the hardware watchdog
+ *      that everything is in order, and that the watchdog should wait
+ *      for yet another little while to reset the system.
+ *      If userspace fails (RAM error, kernel bug, whatever), the
+ *      notifications cease to occur, and the hardware watchdog will
+ *      reset the system (causing a reboot) after the timeout occurs.
+ *
+ * Create device with:
+ *  mknod /dev/watchdog c 10 130
+ *
+ * For an example userspace keep-alive daemon, see:
+ *   Documentation/watchdog/watchdog.txt
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/delay.h>
+#include <linux/fs.h>
+#include <linux/ioport.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+
+/* enable support for minutes as units? */
+/* (does not always work correctly, so disabled by default!) */
+#define SMSC_SUPPORT_MINUTES
+#undef SMSC_SUPPORT_MINUTES
+
+#define MAX_TIMEOUT     255
+
+#define UNIT_SECOND     0
+#define UNIT_MINUTE     1
+
+#define MODNAME         "smsc37b787_wdt: "
+#define VERSION         "1.1"
+
+#define IOPORT          0x3F0
+#define IOPORT_SIZE     2
+#define IODEV_NO        8
+
+static int unit = UNIT_SECOND;  /* timer's unit */
+static int timeout = 60;        /* timeout value: default is 60 "units" */
+static unsigned long timer_enabled = 0;   /* is the timer enabled? */
+
+static char expect_close;       /* is the close expected? */
+
+static spinlock_t io_lock;      /* to guard the watchdog from io races */
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+/* -- Low level function ----------------------------------------*/
+
+/* unlock the IO chip */
+
+static inline void open_io_config(void)
+{
+        outb(0x55, IOPORT);
+        mdelay(1);
+        outb(0x55, IOPORT);
+}
+
+/* lock the IO chip */
+static inline void close_io_config(void)
+{
+        outb(0xAA, IOPORT);
+}
+
+/* select the IO device */
+static inline void select_io_device(unsigned char devno)
+{
+        outb(0x07, IOPORT);
+        outb(devno, IOPORT+1);
+}
+
+/* write to the control register */
+static inline void write_io_cr(unsigned char reg, unsigned char data)
+{
+        outb(reg, IOPORT);
+        outb(data, IOPORT+1);
+}
+
+/* read from the control register */
+static inline char read_io_cr(unsigned char reg)
+{
+        outb(reg, IOPORT);
+        return inb(IOPORT+1);
+}
+
+/* -- Medium level functions ------------------------------------*/
+
+static inline void gpio_bit12(unsigned char reg)
+{
+        // -- General Purpose I/O Bit 1.2 --
+        // Bit 0,   In/Out: 0 = Output, 1 = Input
+        // Bit 1,   Polarity: 0 = No Invert, 1 = Invert
+        // Bit 2,   Group Enable Intr.: 0 = Disable, 1 = Enable
+        // Bit 3/4, Function select: 00 = GPI/O, 01 = WDT, 10 = P17,
+        //                           11 = Either Edge Triggered Intr. 2
+        // Bit 5/6  (Reserved)
+        // Bit 7,   Output Type: 0 = Push Pull Bit, 1 = Open Drain
+        write_io_cr(0xE2, reg);
+}
+
+static inline void gpio_bit13(unsigned char reg)
+{
+        // -- General Purpose I/O Bit 1.3 --
+        // Bit 0,  In/Out: 0 = Output, 1 = Input
+        // Bit 1,  Polarity: 0 = No Invert, 1 = Invert
+        // Bit 2,  Group Enable Intr.: 0 = Disable, 1 = Enable
+        // Bit 3,  Function select: 0 = GPI/O, 1 = LED
+        // Bit 4-6 (Reserved)
+        // Bit 7,  Output Type: 0 = Push Pull Bit, 1 = Open Drain
+        write_io_cr(0xE3, reg);
+}
+
+static inline void wdt_timer_units(unsigned char new_units)
+{
+        // -- Watchdog timer units --
+        // Bit 0-6 (Reserved)
+        // Bit 7,  WDT Time-out Value Units Select
+        //         (0 = Minutes, 1 = Seconds)
+        write_io_cr(0xF1, new_units);
+}
+
+static inline void wdt_timeout_value(unsigned char new_timeout)
+{
+        // -- Watchdog Timer Time-out Value --
+        // Bit 0-7 Binary coded units (0=Disabled, 1..255)
+        write_io_cr(0xF2, new_timeout);
+}
+
+static inline void wdt_timer_conf(unsigned char conf)
+{
+        // -- Watchdog timer configuration --
+        // Bit 0   Joystick enable: 0* = No Reset, 1 = Reset WDT upon Gameport I/O
+        // Bit 1   Keyboard enable: 0* = No Reset, 1 = Reset WDT upon KBD Intr.
+        // Bit 2   Mouse enable: 0* = No Reset, 1 = Reset WDT upon Mouse Intr.
+        // Bit 3   Reset the timer
+        //         (Wrong in SMsC documentation? Given as: PowerLED Timout Enabled)
+        // Bit 4-7 WDT Interrupt Mapping: (0000* = Disabled,
+        //            0001=IRQ1, 0010=(Invalid), 0011=IRQ3 to 1111=IRQ15)
+        write_io_cr(0xF3, conf);
+}
+
+static inline void wdt_timer_ctrl(unsigned char reg)
+{
+        // -- Watchdog timer control --
+        // Bit 0   Status Bit: 0 = Timer counting, 1 = Timeout occured
+        // Bit 1   Power LED Toggle: 0 = Disable Toggle, 1 = Toggle at 1 Hz
+        // Bit 2   Force Timeout: 1 = Forces WD timeout event (self-cleaning)
+        // Bit 3   P20 Force Timeout enabled:
+        //          0 = P20 activity does not generate the WD timeout event
+        //          1 = P20 Allows rising edge of P20, from the keyboard
+        //              controller, to force the WD timeout event.
+        // Bit 4   (Reserved)
+        // -- Soft power management --
+        // Bit 5   Stop Counter: 1 = Stop software power down counter
+        //            set via register 0xB8, (self-cleaning)
+        //            (Upon read: 0 = Counter running, 1 = Counter stopped)
+        // Bit 6   Restart Counter: 1 = Restart software power down counter
+        //            set via register 0xB8, (self-cleaning)
+        // Bit 7   SPOFF: 1 = Force software power down (self-cleaning)
+
+        write_io_cr(0xF4, reg);
+}
+
+/* -- Higher level functions ------------------------------------*/
+
+/* initialize watchdog */
+
+static void wb_smsc_wdt_initialize(void)
+{
+        unsigned char old;
+
+        spin_lock(&io_lock);
+        open_io_config();
+        select_io_device(IODEV_NO);
+
+        // enable the watchdog
+        gpio_bit13(0x08);  // Select pin 80 = LED not GPIO
+        gpio_bit12(0x0A);  // Set pin 79 = WDT not GPIO/Output/Polarity=Invert
+
+        // disable the timeout
+        wdt_timeout_value(0);
+
+        // reset control register
+        wdt_timer_ctrl(0x00);
+
+        // reset configuration register
+        wdt_timer_conf(0x00);
+
+        // read old (timer units) register
+        old = read_io_cr(0xF1) & 0x7F;
+        if (unit == UNIT_SECOND) old |= 0x80; // set to seconds
+
+        // set the watchdog timer units
+        wdt_timer_units(old);
+
+        close_io_config();
+        spin_unlock(&io_lock);
+}
+
+/* shutdown the watchdog */
+
+static void wb_smsc_wdt_shutdown(void)
+{
+        spin_lock(&io_lock);
+        open_io_config();
+        select_io_device(IODEV_NO);
+
+        // disable the watchdog
+        gpio_bit13(0x09);
+        gpio_bit12(0x09);
+
+        // reset watchdog config register
+        wdt_timer_conf(0x00);
+
+        // reset watchdog control register
+        wdt_timer_ctrl(0x00);
+
+        // disable timeout
+        wdt_timeout_value(0x00);
+
+        close_io_config();
+        spin_unlock(&io_lock);
+}
+
+/* set timeout => enable watchdog */
+
+static void wb_smsc_wdt_set_timeout(unsigned char new_timeout)
+{
+        spin_lock(&io_lock);
+        open_io_config();
+        select_io_device(IODEV_NO);
+
+        // set Power LED to blink, if we enable the timeout
+        wdt_timer_ctrl((new_timeout == 0) ? 0x00 : 0x02);
+
+        // set timeout value
+        wdt_timeout_value(new_timeout);
+
+        close_io_config();
+        spin_unlock(&io_lock);
+}
+
+/* get timeout */
+
+static unsigned char wb_smsc_wdt_get_timeout(void)
+{
+        unsigned char set_timeout;
+
+        spin_lock(&io_lock);
+        open_io_config();
+        select_io_device(IODEV_NO);
+        set_timeout = read_io_cr(0xF2);
+        close_io_config();
+        spin_unlock(&io_lock);
+
+        return set_timeout;
+}
+
+/* disable watchdog */
+
+static void wb_smsc_wdt_disable(void)
+{
+        // set the timeout to 0 to disable the watchdog
+        wb_smsc_wdt_set_timeout(0);
+}
+
+/* enable watchdog by setting the current timeout */
+
+static void wb_smsc_wdt_enable(void)
+{
+        // set the current timeout...
+        wb_smsc_wdt_set_timeout(timeout);
+}
+
+/* reset the timer */
+
+static void wb_smsc_wdt_reset_timer(void)
+{
+        spin_lock(&io_lock);
+        open_io_config();
+        select_io_device(IODEV_NO);
+
+        // reset the timer
+        wdt_timeout_value(timeout);
+        wdt_timer_conf(0x08);
+
+        close_io_config();
+        spin_unlock(&io_lock);
+}
+
+/* return, if the watchdog is enabled (timeout is set...) */
+
+static int wb_smsc_wdt_status(void)
+{
+        return (wb_smsc_wdt_get_timeout() == 0) ? 0 : WDIOF_KEEPALIVEPING;
+}
+
+
+/* -- File operations -------------------------------------------*/
+
+/* open => enable watchdog and set initial timeout */
+
+static int wb_smsc_wdt_open(struct inode *inode, struct file *file)
+{
+        /* /dev/watchdog can only be opened once */
+
+        if (test_and_set_bit(0, &timer_enabled))
+                return -EBUSY;
+
+        if (nowayout)
+                __module_get(THIS_MODULE);
+
+        /* Reload and activate timer */
+        wb_smsc_wdt_enable();
+
+        printk(KERN_INFO MODNAME "Watchdog enabled. Timeout set to %d %s.\n", timeout, (unit == UNIT_SECOND) ? "second(s)" : "minute(s)");
+
+        return nonseekable_open(inode, file);
+}
+
+/* close => shut off the timer */
+
+static int wb_smsc_wdt_release(struct inode *inode, struct file *file)
+{
+        /* Shut off the timer. */
+
+        if (expect_close == 42) {
+                wb_smsc_wdt_disable();
+                printk(KERN_INFO MODNAME "Watchdog disabled, sleeping again...\n");
+        } else {
+                printk(KERN_CRIT MODNAME "Unexpected close, not stopping watchdog!\n");
+                wb_smsc_wdt_reset_timer();
+        }
+
+        clear_bit(0, &timer_enabled);
+        expect_close = 0;
+        return 0;
+}
+
+/* write => update the timer to keep the machine alive */
+
+static ssize_t wb_smsc_wdt_write(struct file *file, const char __user *data,
+                                 size_t len, loff_t *ppos)
+{
+        /* See if we got the magic character 'V' and reload the timer */
+        if (len) {
+                if (!nowayout) {
+                        size_t i;
+
+                        /* reset expect flag */
+                        expect_close = 0;
+
+                        /* scan to see whether or not we got the magic character */
+                        for (i = 0; i != len; i++) {
+                                char c;
+                                if (get_user(c, data+i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        expect_close = 42;
+                        }
+                }
+
+                /* someone wrote to us, we should reload the timer */
+                wb_smsc_wdt_reset_timer();
+        }
+        return len;
+}
+
+/* ioctl => control interface */
+
+static int wb_smsc_wdt_ioctl(struct inode *inode, struct file *file,
+                             unsigned int cmd, unsigned long arg)
+{
+        int new_timeout;
+
+        union {
+                struct watchdog_info __user *ident;
+                int __user *i;
+        } uarg;
+
+        static struct watchdog_info ident = {
+                .options =              WDIOF_KEEPALIVEPING |
+                                        WDIOF_SETTIMEOUT |
+                                        WDIOF_MAGICCLOSE,
+                .firmware_version =     0,
+                .identity =             "SMsC 37B787 Watchdog"
+        };
+
+        uarg.i = (int __user *)arg;
+
+        switch (cmd) {
+                default:
+                        return -ENOTTY;
+
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(uarg.ident, &ident,
+                                sizeof(ident)) ? -EFAULT : 0;
+
+                case WDIOC_GETSTATUS:
+                        return put_user(wb_smsc_wdt_status(), uarg.i);
+
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, uarg.i);
+
+                case WDIOC_KEEPALIVE:
+                        wb_smsc_wdt_reset_timer();
+                        return 0;
+
+                case WDIOC_SETTIMEOUT:
+                        if (get_user(new_timeout, uarg.i))
+                                return -EFAULT;
+
+                        // the API states this is given in secs
+                        if (unit == UNIT_MINUTE)
+                          new_timeout /= 60;
+
+                        if (new_timeout < 0 || new_timeout > MAX_TIMEOUT)
+                                return -EINVAL;
+
+                        timeout = new_timeout;
+                        wb_smsc_wdt_set_timeout(timeout);
+
+                        // fall through and return the new timeout...
+
+                case WDIOC_GETTIMEOUT:
+
+                        new_timeout = timeout;
+
+                        if (unit == UNIT_MINUTE)
+                          new_timeout *= 60;
+
+                        return put_user(new_timeout, uarg.i);
+
+                case WDIOC_SETOPTIONS:
+                {
+                        int options, retval = -EINVAL;
+
+                        if (get_user(options, uarg.i))
+                                return -EFAULT;
+
+                        if (options & WDIOS_DISABLECARD) {
+                                wb_smsc_wdt_disable();
+                                retval = 0;
+                        }
+
+                        if (options & WDIOS_ENABLECARD) {
+                                wb_smsc_wdt_enable();
+                                retval = 0;
+                        }
+
+                        return retval;
+                }
+        }
+}
+
+/* -- Notifier funtions -----------------------------------------*/
+
+static int wb_smsc_wdt_notify_sys(struct notifier_block *this, unsigned long code, void *unused)
+{
+        if (code == SYS_DOWN || code == SYS_HALT)
+        {
+                // set timeout to 0, to avoid possible race-condition
+                timeout = 0;
+                wb_smsc_wdt_disable();
+        }
+        return NOTIFY_DONE;
+}
+
+/* -- Module's structures ---------------------------------------*/
+
+static struct file_operations wb_smsc_wdt_fops =
+{
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = wb_smsc_wdt_write,
+        .ioctl          = wb_smsc_wdt_ioctl,
+        .open           = wb_smsc_wdt_open,
+        .release        = wb_smsc_wdt_release,
+};
+
+static struct notifier_block wb_smsc_wdt_notifier =
+{
+        .notifier_call  = wb_smsc_wdt_notify_sys,
+};
+
+static struct miscdevice wb_smsc_wdt_miscdev =
+{
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &wb_smsc_wdt_fops,
+};
+
+/* -- Module init functions -------------------------------------*/
+
+/* module's "constructor" */
+
+static int __init wb_smsc_wdt_init(void)
+{
+        int ret;
+
+        spin_lock_init(&io_lock);
+
+        printk("SMsC 37B787 watchdog component driver " VERSION " initialising...\n");
+
+        if (!request_region(IOPORT, IOPORT_SIZE, "SMsC 37B787 watchdog")) {
+                printk(KERN_ERR MODNAME "Unable to register IO port %#x\n", IOPORT);
+                ret = -EBUSY;
+                goto out_pnp;
+        }
+
+        // set new maximum, if it's too big
+        if (timeout > MAX_TIMEOUT)
+               timeout = MAX_TIMEOUT;
+
+        // init the watchdog timer
+        wb_smsc_wdt_initialize();
+
+        ret = register_reboot_notifier(&wb_smsc_wdt_notifier);
+        if (ret) {
+                printk(KERN_ERR MODNAME "Unable to register reboot notifier err = %d\n", ret);
+                goto out_io;
+        }
+
+        ret = misc_register(&wb_smsc_wdt_miscdev);
+        if (ret) {
+                printk(KERN_ERR MODNAME "Unable to register miscdev on minor %d\n", WATCHDOG_MINOR);
+                goto out_rbt;
+        }
+
+        // output info
+        printk(KERN_INFO MODNAME "Timeout set to %d %s.\n", timeout, (unit == UNIT_SECOND) ? "second(s)" : "minute(s)");
+        printk(KERN_INFO MODNAME "Watchdog initialized and sleeping (nowayout=%d)...\n", nowayout);
+
+        // ret = 0
+
+out_clean:
+        return ret;
+
+out_rbt:
+        unregister_reboot_notifier(&wb_smsc_wdt_notifier);
+
+out_io:
+        release_region(IOPORT, IOPORT_SIZE);
+
+out_pnp:
+        goto out_clean;
+}
+
+/* module's "destructor" */
+
+static void __exit wb_smsc_wdt_exit(void)
+{
+        /* Stop the timer before we leave */
+        if (!nowayout)
+        {
+                wb_smsc_wdt_shutdown();
+                printk(KERN_INFO MODNAME "Watchdog disabled.\n");
+        }
+
+        misc_deregister(&wb_smsc_wdt_miscdev);
+        unregister_reboot_notifier(&wb_smsc_wdt_notifier);
+        release_region(IOPORT, IOPORT_SIZE);
+
+        printk("SMsC 37B787 watchdog component driver removed.\n");
+}
+
+module_init(wb_smsc_wdt_init);
+module_exit(wb_smsc_wdt_exit);
+
+MODULE_AUTHOR("Sven Anders <anders@anduras.de>");
+MODULE_DESCRIPTION("Driver for SMsC 37B787 watchdog component (Version " VERSION ")");
+MODULE_LICENSE("GPL");
+
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
+
+#ifdef SMSC_SUPPORT_MINUTES
+module_param(unit, int, 0);
+MODULE_PARM_DESC(unit, "set unit to use, 0=seconds or 1=minutes, default is 0");
+#endif
+
+module_param(timeout, int, 0);
+MODULE_PARM_DESC(timeout, "range is 1-255 units, default is 60");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
diff --git a/drivers/char/watchdog/w83627hf_wdt.c b/drivers/char/watchdog/w83627hf_wdt.c
index b4adc527e687..07d4bff27226 100644
--- a/drivers/char/watchdog/w83627hf_wdt.c
+++ b/drivers/char/watchdog/w83627hf_wdt.c
@@ -33,6 +33,7 @@
 #include <linux/notifier.h>
 #include <linux/reboot.h>
 #include <linux/init.h>
+#include <linux/spinlock.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -44,6 +45,7 @@
 
 static unsigned long wdt_is_open;
 static char expect_close;
+static spinlock_t io_lock;
 
 /* You must set this - there is no sane way to probe for this board. */
 static int wdt_io = 0x2E;
@@ -110,12 +112,16 @@ w83627hf_init(void)
 static void
 wdt_ctrl(int timeout)
 {
+        spin_lock(&io_lock);
+        
         w83627hf_select_wd_register();
 
         outb_p(0xF6, WDT_EFER);    /* Select CRF6 */
         outb_p(timeout, WDT_EFDR); /* Write Timeout counter to CRF6 */
 
         w83627hf_unselect_wd_register();
+
+        spin_unlock(&io_lock);
 }
 
 static int
@@ -303,6 +309,8 @@ wdt_init(void)
 {
         int ret;
 
+        spin_lock_init(&io_lock);
+
         printk(KERN_INFO "WDT driver for the Winbond(TM) W83627HF Super I/O chip initialising.\n");
 
         if (wdt_set_heartbeat(timeout)) {
diff --git a/drivers/char/watchdog/w83697hf_wdt.c b/drivers/char/watchdog/w83697hf_wdt.c
new file mode 100644
index 000000000000..7768b55487c8
--- /dev/null
+++ b/drivers/char/watchdog/w83697hf_wdt.c
@@ -0,0 +1,450 @@
+/*
+ *      w83697hf/hg WDT driver
+ *
+ *      (c) Copyright 2006 Samuel Tardieu <sam@rfc1149.net>
+ *      (c) Copyright 2006 Marcus Junker <junker@anduras.de>
+ *
+ *      Based on w83627hf_wdt.c which is based on advantechwdt.c
+ *      which is based on wdt.c.
+ *      Original copyright messages:
+ *
+ *      (c) Copyright 2003 Pádraig Brady <P@draigBrady.com>
+ *
+ *      (c) Copyright 2000-2001 Marek Michalkiewicz <marekm@linux.org.pl>
+ *
+ *      (c) Copyright 1996 Alan Cox <alan@redhat.com>, All Rights Reserved.
+ *                              http://www.redhat.com
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ *      Neither Marcus Junker nor ANDURAS AG admit liability nor provide
+ *      warranty for any of this software. This material is provided
+ *      "AS-IS" and at no charge.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/miscdevice.h>
+#include <linux/watchdog.h>
+#include <linux/fs.h>
+#include <linux/ioport.h>
+#include <linux/notifier.h>
+#include <linux/reboot.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+
+#include <asm/io.h>
+#include <asm/uaccess.h>
+#include <asm/system.h>
+
+#define WATCHDOG_NAME "w83697hf/hg WDT"
+#define PFX WATCHDOG_NAME ": "
+#define WATCHDOG_TIMEOUT 60             /* 60 sec default timeout */
+
+static unsigned long wdt_is_open;
+static char expect_close;
+static spinlock_t io_lock;
+
+/* You must set this - there is no sane way to probe for this board. */
+static int wdt_io = 0x2e;
+module_param(wdt_io, int, 0);
+MODULE_PARM_DESC(wdt_io, "w83697hf/hg WDT io port (default 0x2e, 0 = autodetect)");
+
+static int timeout = WATCHDOG_TIMEOUT;  /* in seconds */
+module_param(timeout, int, 0);
+MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
+
+static int nowayout = WATCHDOG_NOWAYOUT;
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+
+/*
+ *      Kernel methods.
+ */
+
+#define W83697HF_EFER (wdt_io+0)        /* Extended Function Enable Register */
+#define W83697HF_EFIR (wdt_io+0)        /* Extended Function Index Register (same as EFER) */
+#define W83697HF_EFDR (wdt_io+1)        /* Extended Function Data Register */
+
+static inline void
+w83697hf_unlock(void)
+{
+        outb_p(0x87, W83697HF_EFER);    /* Enter extended function mode */
+        outb_p(0x87, W83697HF_EFER);    /* Again according to manual */
+}
+
+static inline void
+w83697hf_lock(void)
+{
+        outb_p(0xAA, W83697HF_EFER);    /* Leave extended function mode */
+}
+
+/*
+ *      The three functions w83697hf_get_reg(), w83697hf_set_reg() and
+ *      w83697hf_write_timeout() must be called with the device unlocked.
+ */
+
+static unsigned char
+w83697hf_get_reg(unsigned char reg)
+{
+        outb_p(reg, W83697HF_EFIR);
+        return inb_p(W83697HF_EFDR);
+}
+
+static void
+w83697hf_set_reg(unsigned char reg, unsigned char data)
+{
+        outb_p(reg, W83697HF_EFIR);
+        outb_p(data, W83697HF_EFDR);
+}
+
+static void
+w83697hf_write_timeout(int timeout)
+{
+        w83697hf_set_reg(0xF4, timeout);        /* Write Timeout counter to CRF4 */
+}
+
+static void
+w83697hf_select_wdt(void)
+{
+        w83697hf_unlock();
+        w83697hf_set_reg(0x07, 0x08);   /* Switch to logic device 8 (GPIO2) */
+}
+
+static inline void
+w83697hf_deselect_wdt(void)
+{
+        w83697hf_lock();
+}
+
+static void
+w83697hf_init(void)
+{
+        unsigned char bbuf;
+
+        w83697hf_select_wdt();
+
+        bbuf = w83697hf_get_reg(0x29);
+        bbuf &= ~0x60;
+        bbuf |= 0x20;
+        w83697hf_set_reg(0x29, bbuf);   /* Set pin 119 to WDTO# mode (= CR29, WDT0) */
+
+        bbuf = w83697hf_get_reg(0xF3);
+        bbuf &= ~0x04;
+        w83697hf_set_reg(0xF3, bbuf);   /* Count mode is seconds */
+
+        w83697hf_deselect_wdt();
+}
+
+static int
+wdt_ping(void)
+{
+        spin_lock(&io_lock);
+        w83697hf_select_wdt();
+
+        w83697hf_write_timeout(timeout);
+
+        w83697hf_deselect_wdt();
+        spin_unlock(&io_lock);
+        return 0;
+}
+
+static int
+wdt_enable(void)
+{
+        spin_lock(&io_lock);
+        w83697hf_select_wdt();
+
+        w83697hf_write_timeout(timeout);
+        w83697hf_set_reg(0x30, 1);      /* Enable timer */
+
+        w83697hf_deselect_wdt();
+        spin_unlock(&io_lock);
+        return 0;
+}
+
+static int
+wdt_disable(void)
+{
+        spin_lock(&io_lock);
+        w83697hf_select_wdt();
+
+        w83697hf_set_reg(0x30, 0);      /* Disable timer */
+        w83697hf_write_timeout(0);
+
+        w83697hf_deselect_wdt();
+        spin_unlock(&io_lock);
+        return 0;
+}
+
+static int
+wdt_set_heartbeat(int t)
+{
+        if ((t < 1) || (t > 255))
+                return -EINVAL;
+
+        timeout = t;
+        return 0;
+}
+
+static ssize_t
+wdt_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
+{
+        if (count) {
+                if (!nowayout) {
+                        size_t i;
+
+                        expect_close = 0;
+
+                        for (i = 0; i != count; i++) {
+                                char c;
+                                if (get_user(c, buf+i))
+                                        return -EFAULT;
+                                if (c == 'V')
+                                        expect_close = 42;
+                        }
+                }
+                wdt_ping();
+        }
+        return count;
+}
+
+static int
+wdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
+          unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int new_timeout;
+        static struct watchdog_info ident = {
+                .options = WDIOF_KEEPALIVEPING | WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE,
+                .firmware_version = 1,
+                .identity = "W83697HF WDT",
+        };
+
+        switch (cmd) {
+        case WDIOC_GETSUPPORT:
+                if (copy_to_user(argp, &ident, sizeof(ident)))
+                        return -EFAULT;
+                break;
+
+        case WDIOC_GETSTATUS:
+        case WDIOC_GETBOOTSTATUS:
+                return put_user(0, p);
+
+        case WDIOC_KEEPALIVE:
+                wdt_ping();
+                break;
+
+        case WDIOC_SETTIMEOUT:
+                if (get_user(new_timeout, p))
+                        return -EFAULT;
+                if (wdt_set_heartbeat(new_timeout))
+                        return -EINVAL;
+                wdt_ping();
+                /* Fall */
+
+        case WDIOC_GETTIMEOUT:
+                return put_user(timeout, p);
+
+        case WDIOC_SETOPTIONS:
+        {
+                int options, retval = -EINVAL;
+
+                if (get_user(options, p))
+                        return -EFAULT;
+
+                if (options & WDIOS_DISABLECARD) {
+                        wdt_disable();
+                        retval = 0;
+                }
+
+                if (options & WDIOS_ENABLECARD) {
+                        wdt_enable();
+                        retval = 0;
+                }
+
+                return retval;
+        }
+
+        default:
+                return -ENOTTY;
+        }
+        return 0;
+}
+
+static int
+wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(0, &wdt_is_open))
+                return -EBUSY;
+        /*
+         *      Activate
+         */
+
+        wdt_enable();
+        return nonseekable_open(inode, file);
+}
+
+static int
+wdt_close(struct inode *inode, struct file *file)
+{
+        if (expect_close == 42) {
+                wdt_disable();
+        } else {
+                printk (KERN_CRIT PFX "Unexpected close, not stopping watchdog!\n");
+                wdt_ping();
+        }
+        expect_close = 0;
+        clear_bit(0, &wdt_is_open);
+        return 0;
+}
+
+/*
+ *      Notifier for system down
+ */
+
+static int
+wdt_notify_sys(struct notifier_block *this, unsigned long code,
+        void *unused)
+{
+        if (code == SYS_DOWN || code == SYS_HALT) {
+                /* Turn the WDT off */
+                wdt_disable();
+        }
+        return NOTIFY_DONE;
+}
+
+/*
+ *      Kernel Interfaces
+ */
+
+static struct file_operations wdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .write          = wdt_write,
+        .ioctl          = wdt_ioctl,
+        .open           = wdt_open,
+        .release        = wdt_close,
+};
+
+static struct miscdevice wdt_miscdev = {
+        .minor = WATCHDOG_MINOR,
+        .name = "watchdog",
+        .fops = &wdt_fops,
+};
+
+/*
+ *      The WDT needs to learn about soft shutdowns in order to
+ *      turn the timebomb registers off.
+ */
+
+static struct notifier_block wdt_notifier = {
+        .notifier_call = wdt_notify_sys,
+};
+
+static int
+w83697hf_check_wdt(void)
+{
+        if (!request_region(wdt_io, 2, WATCHDOG_NAME)) {
+                printk (KERN_ERR PFX "I/O address 0x%x already in use\n", wdt_io);
+                return -EIO;
+        }
+
+        printk (KERN_DEBUG PFX "Looking for watchdog at address 0x%x\n", wdt_io);
+        w83697hf_unlock();
+        if (w83697hf_get_reg(0x20) == 0x60) {
+                printk (KERN_INFO PFX "watchdog found at address 0x%x\n", wdt_io);
+                w83697hf_lock();
+                return 0;
+        }
+        w83697hf_lock();        /* Reprotect in case it was a compatible device */
+
+        printk (KERN_INFO PFX "watchdog not found at address 0x%x\n", wdt_io);
+        release_region(wdt_io, 2);
+        return -EIO;
+}
+
+static int w83697hf_ioports[] = { 0x2e, 0x4e, 0x00 };
+
+static int __init
+wdt_init(void)
+{
+        int ret, i, found = 0;
+
+        spin_lock_init(&io_lock);
+
+        printk (KERN_INFO PFX "WDT driver for W83697HF/HG initializing\n");
+
+        if (wdt_io == 0) {
+                /* we will autodetect the W83697HF/HG watchdog */
+                for (i = 0; ((!found) && (w83697hf_ioports[i] != 0)); i++) {
+                        wdt_io = w83697hf_ioports[i];
+                        if (!w83697hf_check_wdt())
+                                found++;
+                }
+        } else {
+                if (!w83697hf_check_wdt())
+                        found++;
+        }
+
+        if (!found) {
+                printk (KERN_ERR PFX "No W83697HF/HG could be found\n");
+                ret = -EIO;
+                goto out;
+        }
+
+        w83697hf_init();
+        wdt_disable();  /* Disable watchdog until first use */
+
+        if (wdt_set_heartbeat(timeout)) {
+                wdt_set_heartbeat(WATCHDOG_TIMEOUT);
+                printk (KERN_INFO PFX "timeout value must be 1<=timeout<=255, using %d\n",
+                        WATCHDOG_TIMEOUT);
+        }
+
+        ret = register_reboot_notifier(&wdt_notifier);
+        if (ret != 0) {
+                printk (KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
+                        ret);
+                goto unreg_regions;
+        }
+
+        ret = misc_register(&wdt_miscdev);
+        if (ret != 0) {
+                printk (KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
+                        WATCHDOG_MINOR, ret);
+                goto unreg_reboot;
+        }
+
+        printk (KERN_INFO PFX "initialized. timeout=%d sec (nowayout=%d)\n",
+                timeout, nowayout);
+
+out:
+        return ret;
+unreg_reboot:
+        unregister_reboot_notifier(&wdt_notifier);
+unreg_regions:
+        release_region(wdt_io, 2);
+        goto out;
+}
+
+static void __exit
+wdt_exit(void)
+{
+        misc_deregister(&wdt_miscdev);
+        unregister_reboot_notifier(&wdt_notifier);
+        release_region(wdt_io, 2);
+}
+
+module_init(wdt_init);
+module_exit(wdt_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Marcus Junker <junker@anduras.de>, Samuel Tardieu <sam@rfc1149.net>");
+MODULE_DESCRIPTION("w83697hf/hg WDT driver");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index 7ad3be8c0f49..7fcb77a9d011 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -54,8 +54,8 @@ static cycle_t acpi_pm_read_verified(void)
                 v1 = read_pmtmr();
                 v2 = read_pmtmr();
                 v3 = read_pmtmr();
-        } while ((v1 > v2 && v1 < v3) || (v2 > v3 && v2 < v1)
-                        || (v3 > v1 && v3 < v2));
+        } while (unlikely((v1 > v2 && v1 < v3) || (v2 > v3 && v2 < v1)
+                          || (v3 > v1 && v3 < v2)));
 
         return (cycle_t)v2;
 }
@@ -138,6 +138,8 @@ static void __devinit acpi_pm_check_graylist(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_0,
                         acpi_pm_check_graylist);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_LE,
+                        acpi_pm_check_graylist);
 #endif
 
 
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 2cc71b66231e..491779af8d55 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -107,6 +107,7 @@ config CPU_FREQ_GOV_USERSPACE
 
 config CPU_FREQ_GOV_ONDEMAND
         tristate "'ondemand' cpufreq policy governor"
+        select CPU_FREQ_TABLE
         help
           'ondemand' - This driver adds a dynamic cpufreq policy governor.
           The governor does a periodic polling and 
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 86e69b7f9122..dd0c2623e27b 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -59,7 +59,7 @@ static int __init init_cpufreq_transition_notifier_list(void)
         srcu_init_notifier_head(&cpufreq_transition_notifier_list);
         return 0;
 }
-core_initcall(init_cpufreq_transition_notifier_list);
+pure_initcall(init_cpufreq_transition_notifier_list);
 
 static LIST_HEAD(cpufreq_governor_list);
 static DEFINE_MUTEX (cpufreq_governor_mutex);
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 4bde30bb3be7..75e9e38330ff 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -230,34 +230,43 @@ static struct kobj_type ktype_memctrl = {
  */
 static int edac_sysfs_memctrl_setup(void)
 {
-        int err=0;
+        int err = 0;
 
         debugf1("%s()\n", __func__);
 
         /* create the /sys/devices/system/edac directory */
         err = sysdev_class_register(&edac_class);
 
-        if (!err) {
-                /* Init the MC's kobject */
-                memset(&edac_memctrl_kobj, 0, sizeof (edac_memctrl_kobj));
-                edac_memctrl_kobj.parent = &edac_class.kset.kobj;
-                edac_memctrl_kobj.ktype = &ktype_memctrl;
+        if (err) {
+                debugf1("%s() error=%d\n", __func__, err);
+                return err;
+        }
 
-                /* generate sysfs "..../edac/mc"   */
-                err = kobject_set_name(&edac_memctrl_kobj,"mc");
+        /* Init the MC's kobject */
+        memset(&edac_memctrl_kobj, 0, sizeof (edac_memctrl_kobj));
+        edac_memctrl_kobj.parent = &edac_class.kset.kobj;
+        edac_memctrl_kobj.ktype = &ktype_memctrl;
 
-                if (!err) {
-                        /* FIXME: maybe new sysdev_create_subdir() */
-                        err = kobject_register(&edac_memctrl_kobj);
+        /* generate sysfs "..../edac/mc"   */
+        err = kobject_set_name(&edac_memctrl_kobj,"mc");
 
-                        if (err)
-                                debugf1("Failed to register '.../edac/mc'\n");
-                        else
-                                debugf1("Registered '.../edac/mc' kobject\n");
-                }
-        } else
-                debugf1("%s() error=%d\n", __func__, err);
+        if (err)
+                goto fail;
+
+        /* FIXME: maybe new sysdev_create_subdir() */
+        err = kobject_register(&edac_memctrl_kobj);
+
+        if (err) {
+                debugf1("Failed to register '.../edac/mc'\n");
+                goto fail;
+        }
 
+        debugf1("Registered '.../edac/mc' kobject\n");
+
+        return 0;
+
+fail:
+        sysdev_class_unregister(&edac_class);
         return err;
 }
 
diff --git a/drivers/eisa/eisa-bus.c b/drivers/eisa/eisa-bus.c
index 3a365e159d89..d944647c82c2 100644
--- a/drivers/eisa/eisa-bus.c
+++ b/drivers/eisa/eisa-bus.c
@@ -226,14 +226,26 @@ static int __init eisa_init_device (struct eisa_root_device *root,
 
 static int __init eisa_register_device (struct eisa_device *edev)
 {
-        if (device_register (&edev->dev))
-                return -1;
+        int rc = device_register (&edev->dev);
+        if (rc)
+                return rc;
 
-        device_create_file (&edev->dev, &dev_attr_signature);
-        device_create_file (&edev->dev, &dev_attr_enabled);
-        device_create_file (&edev->dev, &dev_attr_modalias);
+        rc = device_create_file (&edev->dev, &dev_attr_signature);
+        if (rc) goto err_devreg;
+        rc = device_create_file (&edev->dev, &dev_attr_enabled);
+        if (rc) goto err_sig;
+        rc = device_create_file (&edev->dev, &dev_attr_modalias);
+        if (rc) goto err_enab;
 
         return 0;
+
+err_enab:
+        device_remove_file (&edev->dev, &dev_attr_enabled);
+err_sig:
+        device_remove_file (&edev->dev, &dev_attr_signature);
+err_devreg:
+        device_unregister(&edev->dev);
+        return rc;
 }
 
 static int __init eisa_request_resources (struct eisa_root_device *root,
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 22d17474755f..ca4e67a022d0 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -70,9 +70,9 @@
 
 #define FCP_CMND(SCpnt) ((fcp_cmnd *)&(SCpnt->SCp))
 #define FC_SCMND(SCpnt) ((fc_channel *)(SCpnt->device->host->hostdata[0]))
-#define SC_FCMND(fcmnd) ((Scsi_Cmnd *)((long)fcmnd - (long)&(((Scsi_Cmnd *)0)->SCp)))
+#define SC_FCMND(fcmnd) ((struct scsi_cmnd *)((long)fcmnd - (long)&(((struct scsi_cmnd *)0)->SCp)))
 
-static int fcp_scsi_queue_it(fc_channel *, Scsi_Cmnd *, fcp_cmnd *, int);
+static int fcp_scsi_queue_it(fc_channel *, struct scsi_cmnd *, fcp_cmnd *, int);
 void fcp_queue_empty(fc_channel *);
 
 static void fcp_scsi_insert_queue (fc_channel *fc, fcp_cmnd *fcmd)
@@ -378,14 +378,14 @@ void fcp_register(fc_channel *fc, u8 type, int unregister)
                 printk ("FC: %segistering unknown type %02x\n", unregister ? "Unr" : "R", type);
 }
 
-static void fcp_scsi_done(Scsi_Cmnd *SCpnt);
+static void fcp_scsi_done(struct scsi_cmnd *SCpnt);
 
 static inline void fcp_scsi_receive(fc_channel *fc, int token, int status, fc_hdr *fch)
 {
         fcp_cmnd *fcmd;
         fcp_rsp  *rsp;
         int host_status;
-        Scsi_Cmnd *SCpnt;
+        struct scsi_cmnd *SCpnt;
         int sense_len;
         int rsp_status;
 
@@ -757,13 +757,14 @@ void fcp_release(fc_channel *fcchain, int count)  /* count must > 0 */
 }
 
 
-static void fcp_scsi_done (Scsi_Cmnd *SCpnt)
+static void fcp_scsi_done(struct scsi_cmnd *SCpnt)
 {
         if (FCP_CMND(SCpnt)->done)
                 FCP_CMND(SCpnt)->done(SCpnt);
 }
 
-static int fcp_scsi_queue_it(fc_channel *fc, Scsi_Cmnd *SCpnt, fcp_cmnd *fcmd, int prepare)
+static int fcp_scsi_queue_it(fc_channel *fc, struct scsi_cmnd *SCpnt,
+                             fcp_cmnd *fcmd, int prepare)
 {
         long i;
         fcp_cmd *cmd;
@@ -837,7 +838,8 @@ static int fcp_scsi_queue_it(fc_channel *fc, Scsi_Cmnd *SCpnt, fcp_cmnd *fcmd, i
         return 0;
 }
 
-int fcp_scsi_queuecommand(Scsi_Cmnd *SCpnt, void (* done)(Scsi_Cmnd *))
+int fcp_scsi_queuecommand(struct scsi_cmnd *SCpnt,
+                          void (* done)(struct scsi_cmnd *))
 {
         fcp_cmnd *fcmd = FCP_CMND(SCpnt);
         fc_channel *fc = FC_SCMND(SCpnt);
@@ -873,7 +875,7 @@ void fcp_queue_empty(fc_channel *fc)
         }
 }
 
-int fcp_scsi_abort(Scsi_Cmnd *SCpnt)
+int fcp_scsi_abort(struct scsi_cmnd *SCpnt)
 {
         /* Internal bookkeeping only. Lose 1 cmd_slots slot. */
         fcp_cmnd *fcmd = FCP_CMND(SCpnt);
@@ -910,7 +912,7 @@ int fcp_scsi_abort(Scsi_Cmnd *SCpnt)
 }
 
 #if 0
-void fcp_scsi_reset_done(Scsi_Cmnd *SCpnt)
+void fcp_scsi_reset_done(struct scsi_cmnd *SCpnt)
 {
         fc_channel *fc = FC_SCMND(SCpnt);
 
@@ -921,7 +923,7 @@ void fcp_scsi_reset_done(Scsi_Cmnd *SCpnt)
 
 #define FCP_RESET_TIMEOUT (2*HZ)
 
-int fcp_scsi_dev_reset(Scsi_Cmnd *SCpnt)
+int fcp_scsi_dev_reset(struct scsi_cmnd *SCpnt)
 {
 #if 0 /* broken junk, but if davem wants to compile this driver, let him.. */
         unsigned long flags;
@@ -931,7 +933,7 @@ int fcp_scsi_dev_reset(Scsi_Cmnd *SCpnt)
         DECLARE_MUTEX_LOCKED(sem);
 
         if (!fc->rst_pkt) {
-                fc->rst_pkt = (Scsi_Cmnd *) kmalloc(sizeof(SCpnt), GFP_KERNEL);
+                fc->rst_pkt = (struct scsi_cmnd *) kmalloc(sizeof(SCpnt), GFP_KERNEL);
                 if (!fc->rst_pkt) return FAILED;
                 
                 fcmd = FCP_CMND(fc->rst_pkt);
@@ -999,7 +1001,7 @@ int fcp_scsi_dev_reset(Scsi_Cmnd *SCpnt)
         return SUCCESS;
 }
 
-static int __fcp_scsi_host_reset(Scsi_Cmnd *SCpnt)
+static int __fcp_scsi_host_reset(struct scsi_cmnd *SCpnt)
 {
         fc_channel *fc = FC_SCMND(SCpnt);
         fcp_cmnd *fcmd = FCP_CMND(SCpnt);
@@ -1020,7 +1022,7 @@ static int __fcp_scsi_host_reset(Scsi_Cmnd *SCpnt)
         else return FAILED;
 }
 
-int fcp_scsi_host_reset(Scsi_Cmnd *SCpnt)
+int fcp_scsi_host_reset(struct scsi_cmnd *SCpnt)
 {
         unsigned long flags;
         int rc;
diff --git a/drivers/fc4/fcp_impl.h b/drivers/fc4/fcp_impl.h
index c397c84bef63..1ac61330592e 100644
--- a/drivers/fc4/fcp_impl.h
+++ b/drivers/fc4/fcp_impl.h
@@ -39,7 +39,7 @@ struct _fc_channel;
 typedef struct fcp_cmnd {
         struct fcp_cmnd         *next;
         struct fcp_cmnd         *prev;
-        void                    (*done)(Scsi_Cmnd *);
+        void                    (*done)(struct scsi_cmnd *);
         unsigned short          proto;
         unsigned short          token;
         unsigned int            did;
@@ -94,14 +94,14 @@ typedef struct _fc_channel {
         long                    *scsi_bitmap;
         long                    scsi_bitmap_end;
         int                     scsi_free;
-        int                     (*encode_addr)(Scsi_Cmnd *, u16 *, struct _fc_channel *, fcp_cmnd *);
+        int                     (*encode_addr)(struct scsi_cmnd *, u16 *, struct _fc_channel *, fcp_cmnd *);
         fcp_cmnd                *scsi_que;
         char                    scsi_name[4];
         fcp_cmnd                **cmd_slots;
         int                     channels;
         int                     targets;
         long                    *ages;
-        Scsi_Cmnd               *rst_pkt;
+        struct scsi_cmnd        *rst_pkt;
         fcp_posmap              *posmap;
         /* LOGIN stuff */
         fcp_cmnd                *login;
@@ -155,9 +155,10 @@ int fc_do_prli(fc_channel *, unsigned char);
         for_each_fc_channel(fc)                         \
                 if (fc->state == FC_STATE_ONLINE)
 
-int fcp_scsi_queuecommand(Scsi_Cmnd *, void (* done)(Scsi_Cmnd *));
-int fcp_scsi_abort(Scsi_Cmnd *);
-int fcp_scsi_dev_reset(Scsi_Cmnd *);
-int fcp_scsi_host_reset(Scsi_Cmnd *);
+int fcp_scsi_queuecommand(struct scsi_cmnd *,
+                          void (* done) (struct scsi_cmnd *));
+int fcp_scsi_abort(struct scsi_cmnd *);
+int fcp_scsi_dev_reset(struct scsi_cmnd *);
+int fcp_scsi_host_reset(struct scsi_cmnd *);
 
 #endif /* !(_FCP_SCSI_H) */
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 8bcb58cd4ac0..1865b56fb141 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -8,7 +8,7 @@
  *
  *  See Documentation/dcdbas.txt for more information.
  *
- *  Copyright (C) 1995-2005 Dell Inc.
+ *  Copyright (C) 1995-2006 Dell Inc.
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License v2.0 as published by
@@ -40,7 +40,7 @@
 #include "dcdbas.h"
 
 #define DRIVER_NAME             "dcdbas"
-#define DRIVER_VERSION          "5.6.0-2"
+#define DRIVER_VERSION          "5.6.0-3.2"
 #define DRIVER_DESCRIPTION      "Dell Systems Management Base Driver"
 
 static struct platform_device *dcdbas_pdev;
@@ -175,6 +175,9 @@ static ssize_t smi_data_write(struct kobject *kobj, char *buf, loff_t pos,
 {
         ssize_t ret;
 
+        if ((pos + count) > MAX_SMI_DATA_BUF_SIZE)
+                return -EINVAL;
+
         mutex_lock(&smi_data_lock);
 
         ret = smi_data_buf_realloc(pos + count);
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index fc17599c905e..fc702e40bd43 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -249,7 +249,7 @@ static int packetize_data(void *data, size_t length)
                 if ((rc = create_packet(temp, packet_length)))
                         return rc;
 
-                pr_debug("%p:%lu\n", temp, (end - temp));
+                pr_debug("%p:%td\n", temp, (end - temp));
                 temp += packet_length;
         }
 
@@ -705,27 +705,39 @@ static struct bin_attribute rbu_packet_size_attr = {
 
 static int __init dcdrbu_init(void)
 {
-        int rc = 0;
+        int rc;
         spin_lock_init(&rbu_data.lock);
 
         init_packet_head();
-        rbu_device =
-                platform_device_register_simple("dell_rbu", -1, NULL, 0);
-        if (!rbu_device) {
+        rbu_device = platform_device_register_simple("dell_rbu", -1, NULL, 0);
+        if (IS_ERR(rbu_device)) {
                 printk(KERN_ERR
                         "dell_rbu:%s:platform_device_register_simple "
                         "failed\n", __FUNCTION__);
-                return -EIO;
+                return PTR_ERR(rbu_device);
         }
 
-        sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
-        sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
-        sysfs_create_bin_file(&rbu_device->dev.kobj,
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
+        if (rc)
+                goto out_devreg;
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
+        if (rc)
+                goto out_data;
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj,
                 &rbu_packet_size_attr);
+        if (rc)
+                goto out_imtype;
 
         rbu_data.entry_created = 0;
-        return rc;
+        return 0;
 
+out_imtype:
+        sysfs_remove_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
+out_data:
+        sysfs_remove_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
+out_devreg:
+        platform_device_unregister(rbu_device);
+        return rc;
 }
 
 static __exit void dcdrbu_exit(void)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index b8b596d5778d..37deee6c0c1c 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -326,6 +326,26 @@ char *dmi_get_system_info(int field)
 }
 EXPORT_SYMBOL(dmi_get_system_info);
 
+
+/**
+ *      dmi_name_in_vendors - Check if string is anywhere in the DMI vendor information.
+ *      @str:   Case sensitive Name
+ */
+int dmi_name_in_vendors(char *str)
+{
+        static int fields[] = { DMI_BIOS_VENDOR, DMI_BIOS_VERSION, DMI_SYS_VENDOR,
+                                DMI_PRODUCT_NAME, DMI_PRODUCT_VERSION, DMI_BOARD_VENDOR,
+                                DMI_BOARD_NAME, DMI_BOARD_VERSION, DMI_NONE };
+        int i;
+        for (i = 0; fields[i] != DMI_NONE; i++) {
+                int f = fields[i];
+                if (dmi_ident[f] && strstr(dmi_ident[f], str))
+                        return 1;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(dmi_name_in_vendors);
+
 /**
  *      dmi_find_device - find onboard device by type/name
  *      @type: device type or %DMI_DEV_TYPE_ANY to match all device types
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 8ebce1c03ad7..5ab5e393b882 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -639,7 +639,12 @@ efivar_create_sysfs_entry(unsigned long variable_name_size,
 
         kobject_set_name(&new_efivar->kobj, "%s", short_name);
         kobj_set_kset_s(new_efivar, vars_subsys);
-        kobject_register(&new_efivar->kobj);
+        i = kobject_register(&new_efivar->kobj);
+        if (i) {
+                kfree(short_name);
+                kfree(new_efivar);
+                return 1;
+        }
 
         kfree(short_name);
         short_name = NULL;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 9b88b25b6edb..e76d91906c99 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -95,11 +95,13 @@ config SENSORS_ADM9240
           will be called adm9240.
 
 config SENSORS_K8TEMP
-        tristate "AMD K8 processor sensor"
+        tristate "AMD Athlon64/FX or Opteron temperature sensor"
         depends on HWMON && X86 && PCI && EXPERIMENTAL
         help
           If you say yes here you get support for the temperature
-          sensor(s) inside your AMD K8 CPU.
+          sensor(s) inside your CPU. Supported is whole AMD K8
+          microarchitecture. Please note that you will need at least
+          lm-sensors 2.10.1 for proper userspace support.
 
           This driver can also be built as a module.  If so, the module
           will be called k8temp.
@@ -369,8 +371,8 @@ config SENSORS_SMSC47M1
         help
           If you say yes here you get support for the integrated fan
           monitoring and control capabilities of the SMSC LPC47B27x,
-          LPC47M10x, LPC47M13x, LPC47M14x, LPC47M15x, LPC47M192 and
-          LPC47M997 chips.
+          LPC47M10x, LPC47M112, LPC47M13x, LPC47M14x, LPC47M15x,
+          LPC47M192 and LPC47M997 chips.
 
           The temperature and voltage sensor features of the LPC47M192
           and LPC47M997 are supported by another driver, select also
diff --git a/drivers/hwmon/adm9240.c b/drivers/hwmon/adm9240.c
index 377961c4a41e..aad594adf0c7 100644
--- a/drivers/hwmon/adm9240.c
+++ b/drivers/hwmon/adm9240.c
@@ -5,7 +5,7 @@
  * Copyright (C) 1999   Frodo Looijaard <frodol@dds.nl>
  *                      Philip Edelbrock <phil@netroedge.com>
  * Copyright (C) 2003   Michiel Rook <michiel@grendelproject.nl>
- * Copyright (C) 2005   Grant Coady <gcoady@gmail.com> with valuable
+ * Copyright (C) 2005   Grant Coady <gcoady.lk@gmail.com> with valuable
  *                              guidance from Jean Delvare
  *
  * Driver supports      Analog Devices          ADM9240
@@ -774,7 +774,7 @@ static void __exit sensors_adm9240_exit(void)
 }
 
 MODULE_AUTHOR("Michiel Rook <michiel@grendelproject.nl>, "
-                "Grant Coady <gcoady@gmail.com> and others");
+                "Grant Coady <gcoady.lk@gmail.com> and others");
 MODULE_DESCRIPTION("ADM9240/DS1780/LM81 driver");
 MODULE_LICENSE("GPL");
 
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index ac1b746df6d0..73bc2ffc598d 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -815,18 +815,18 @@ static int __init sm_lm78_init(void)
         if (res)
                 return res;
 
-        res = i2c_isa_add_driver(&lm78_isa_driver);
-        if (res) {
-                i2c_del_driver(&lm78_driver);
-                return res;
-        }
+        /* Don't exit if this one fails, we still want the I2C variants
+           to work! */
+        if (i2c_isa_add_driver(&lm78_isa_driver))
+                isa_address = 0;
 
         return 0;
 }
 
 static void __exit sm_lm78_exit(void)
 {
-        i2c_isa_del_driver(&lm78_isa_driver);
+        if (isa_address)
+                i2c_isa_del_driver(&lm78_isa_driver);
         i2c_del_driver(&lm78_driver);
 }
 
diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
index 47132fd26b1b..beb881c4b2e8 100644
--- a/drivers/hwmon/smsc47m1.c
+++ b/drivers/hwmon/smsc47m1.c
@@ -2,8 +2,8 @@
     smsc47m1.c - Part of lm_sensors, Linux kernel modules
                  for hardware monitoring
 
-    Supports the SMSC LPC47B27x, LPC47M10x, LPC47M13x, LPC47M14x,
-    LPC47M15x, LPC47M192 and LPC47M997 Super-I/O chips.
+    Supports the SMSC LPC47B27x, LPC47M10x, LPC47M112, LPC47M13x,
+    LPC47M14x, LPC47M15x, LPC47M192 and LPC47M997 Super-I/O chips.
 
     Copyright (C) 2002 Mark D. Studebaker <mdsxyz123@yahoo.com>
     Copyright (C) 2004 Jean Delvare <khali@linux-fr.org>
@@ -380,8 +380,8 @@ static int __init smsc47m1_find(unsigned short *addr)
         val = superio_inb(SUPERIO_REG_DEVID);
 
         /*
-         * SMSC LPC47M10x/LPC47M13x (device id 0x59), LPC47M14x (device id
-         * 0x5F) and LPC47B27x (device id 0x51) have fan control.
+         * SMSC LPC47M10x/LPC47M112/LPC47M13x (device id 0x59), LPC47M14x
+         * (device id 0x5F) and LPC47B27x (device id 0x51) have fan control.
          * The LPC47M15x and LPC47M192 chips "with hardware monitoring block"
          * can do much more besides (device id 0x60).
          * The LPC47M997 is undocumented, but seems to be compatible with
@@ -390,7 +390,8 @@ static int __init smsc47m1_find(unsigned short *addr)
         if (val == 0x51)
                 printk(KERN_INFO "smsc47m1: Found SMSC LPC47B27x\n");
         else if (val == 0x59)
-                printk(KERN_INFO "smsc47m1: Found SMSC LPC47M10x/LPC47M13x\n");
+                printk(KERN_INFO "smsc47m1: Found SMSC "
+                       "LPC47M10x/LPC47M112/LPC47M13x\n");
         else if (val == 0x5F)
                 printk(KERN_INFO "smsc47m1: Found SMSC LPC47M14x\n");
         else if (val == 0x60)
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 833faa275ffa..2257806d0102 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -354,6 +354,8 @@ static void w83627ehf_write_fan_div(struct i2c_client *client, int nr)
         case 0:
                 reg = (w83627ehf_read_value(client, W83627EHF_REG_FANDIV1) & 0xcf)
                     | ((data->fan_div[0] & 0x03) << 4);
+                /* fan5 input control bit is write only, compute the value */
+                reg |= (data->has_fan & (1 << 4)) ? 1 : 0;
                 w83627ehf_write_value(client, W83627EHF_REG_FANDIV1, reg);
                 reg = (w83627ehf_read_value(client, W83627EHF_REG_VBAT) & 0xdf)
                     | ((data->fan_div[0] & 0x04) << 3);
@@ -362,6 +364,8 @@ static void w83627ehf_write_fan_div(struct i2c_client *client, int nr)
         case 1:
                 reg = (w83627ehf_read_value(client, W83627EHF_REG_FANDIV1) & 0x3f)
                     | ((data->fan_div[1] & 0x03) << 6);
+                /* fan5 input control bit is write only, compute the value */
+                reg |= (data->has_fan & (1 << 4)) ? 1 : 0;
                 w83627ehf_write_value(client, W83627EHF_REG_FANDIV1, reg);
                 reg = (w83627ehf_read_value(client, W83627EHF_REG_VBAT) & 0xbf)
                     | ((data->fan_div[1] & 0x04) << 4);
@@ -1216,13 +1220,16 @@ static int w83627ehf_detect(struct i2c_adapter *adapter)
         superio_exit();
 
         /* It looks like fan4 and fan5 pins can be alternatively used
-           as fan on/off switches */
+           as fan on/off switches, but fan5 control is write only :/
+           We assume that if the serial interface is disabled, designers
+           connected fan5 as input unless they are emitting log 1, which
+           is not the default. */
 
         data->has_fan = 0x07; /* fan1, fan2 and fan3 */
         i = w83627ehf_read_value(client, W83627EHF_REG_FANDIV1);
         if ((i & (1 << 2)) && (!fan4pin))
                 data->has_fan |= (1 << 3);
-        if ((i & (1 << 0)) && (!fan5pin))
+        if (!(i & (1 << 1)) && (!fan5pin))
                 data->has_fan |= (1 << 4);
 
         /* Register sysfs hooks */
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index a4584ec69842..1232171c3aad 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1099,7 +1099,8 @@ w83781d_detect(struct i2c_adapter *adapter, int address, int kind)
            bank. */
         if (kind < 0) {
                 if (w83781d_read_value(client, W83781D_REG_CONFIG) & 0x80) {
-                        dev_dbg(dev, "Detection failed at step 3\n");
+                        dev_dbg(&adapter->dev, "Detection of w83781d chip "
+                                "failed at step 3\n");
                         err = -ENODEV;
                         goto ERROR2;
                 }
@@ -1109,7 +1110,8 @@ w83781d_detect(struct i2c_adapter *adapter, int address, int kind)
                 if ((!(val1 & 0x07)) &&
                     (((!(val1 & 0x80)) && (val2 != 0xa3) && (val2 != 0xc3))
                      || ((val1 & 0x80) && (val2 != 0x5c) && (val2 != 0x12)))) {
-                        dev_dbg(dev, "Detection failed at step 4\n");
+                        dev_dbg(&adapter->dev, "Detection of w83781d chip "
+                                "failed at step 4\n");
                         err = -ENODEV;
                         goto ERROR2;
                 }
@@ -1119,7 +1121,8 @@ w83781d_detect(struct i2c_adapter *adapter, int address, int kind)
                                   ((val1 & 0x80) && (val2 == 0x5c)))) {
                         if (w83781d_read_value
                             (client, W83781D_REG_I2C_ADDR) != address) {
-                                dev_dbg(dev, "Detection failed at step 5\n");
+                                dev_dbg(&adapter->dev, "Detection of w83781d "
+                                        "chip failed at step 5\n");
                                 err = -ENODEV;
                                 goto ERROR2;
                         }
@@ -1141,8 +1144,8 @@ w83781d_detect(struct i2c_adapter *adapter, int address, int kind)
                 else if (val2 == 0x12)
                         vendid = asus;
                 else {
-                        dev_dbg(dev, "Chip was made by neither "
-                                "Winbond nor Asus?\n");
+                        dev_dbg(&adapter->dev, "w83781d chip vendor is "
+                                "neither Winbond nor Asus\n");
                         err = -ENODEV;
                         goto ERROR2;
                 }
@@ -1161,10 +1164,9 @@ w83781d_detect(struct i2c_adapter *adapter, int address, int kind)
                         kind = as99127f;
                 else {
                         if (kind == 0)
-                                dev_warn(dev, "Ignoring 'force' "
+                                dev_warn(&adapter->dev, "Ignoring 'force' "
                                          "parameter for unknown chip at "
-                                         "adapter %d, address 0x%02x\n",
-                                         i2c_adapter_id(adapter), address);
+                                         "address 0x%02x\n", address);
                         err = -EINVAL;
                         goto ERROR2;
                 }
@@ -1685,11 +1687,10 @@ sensors_w83781d_init(void)
         if (res)
                 return res;
 
-        res = i2c_isa_add_driver(&w83781d_isa_driver);
-        if (res) {
-                i2c_del_driver(&w83781d_driver);
-                return res;
-        }
+        /* Don't exit if this one fails, we still want the I2C variants
+           to work! */
+        if (i2c_isa_add_driver(&w83781d_isa_driver))
+                isa_address = 0;
 
         return 0;
 }
@@ -1697,7 +1698,8 @@ sensors_w83781d_init(void)
 static void __exit
 sensors_w83781d_exit(void)
 {
-        i2c_isa_del_driver(&w83781d_isa_driver);
+        if (isa_address)
+                i2c_isa_del_driver(&w83781d_isa_driver);
         i2c_del_driver(&w83781d_driver);
 }
 
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 371ed4f69a97..9e5f885368b4 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -746,6 +746,52 @@ static ssize_t store_vrm_reg(struct device *dev,
 
 static DEVICE_ATTR(vrm, S_IRUGO | S_IWUSR, show_vrm_reg, store_vrm_reg);
 
+#define IN_UNIT_ATTRS(X) \
+        &sda_in_input[X].dev_attr.attr, \
+        &sda_in_min[X].dev_attr.attr,   \
+        &sda_in_max[X].dev_attr.attr
+
+#define FAN_UNIT_ATTRS(X) \
+        &sda_fan_input[X].dev_attr.attr,        \
+        &sda_fan_min[X].dev_attr.attr,          \
+        &sda_fan_div[X].dev_attr.attr
+
+#define TEMP_UNIT_ATTRS(X) \
+        &sda_temp_input[X].dev_attr.attr,       \
+        &sda_temp_max[X].dev_attr.attr,         \
+        &sda_temp_max_hyst[X].dev_attr.attr
+
+static struct attribute *w83791d_attributes[] = {
+        IN_UNIT_ATTRS(0),
+        IN_UNIT_ATTRS(1),
+        IN_UNIT_ATTRS(2),
+        IN_UNIT_ATTRS(3),
+        IN_UNIT_ATTRS(4),
+        IN_UNIT_ATTRS(5),
+        IN_UNIT_ATTRS(6),
+        IN_UNIT_ATTRS(7),
+        IN_UNIT_ATTRS(8),
+        IN_UNIT_ATTRS(9),
+        FAN_UNIT_ATTRS(0),
+        FAN_UNIT_ATTRS(1),
+        FAN_UNIT_ATTRS(2),
+        FAN_UNIT_ATTRS(3),
+        FAN_UNIT_ATTRS(4),
+        TEMP_UNIT_ATTRS(0),
+        TEMP_UNIT_ATTRS(1),
+        TEMP_UNIT_ATTRS(2),
+        &dev_attr_alarms.attr,
+        &sda_beep_ctrl[0].dev_attr.attr,
+        &sda_beep_ctrl[1].dev_attr.attr,
+        &dev_attr_cpu0_vid.attr,
+        &dev_attr_vrm.attr,
+        NULL
+};
+
+static const struct attribute_group w83791d_group = {
+        .attrs = w83791d_attributes,
+};
+
 /* This function is called when:
      * w83791d_driver is inserted (when this module is loaded), for each
        available adapter
@@ -967,41 +1013,20 @@ static int w83791d_detect(struct i2c_adapter *adapter, int address, int kind)
         }
 
         /* Register sysfs hooks */
+        if ((err = sysfs_create_group(&client->dev.kobj, &w83791d_group)))
+                goto error3;
+
+        /* Everything is ready, now register the working device */
         data->class_dev = hwmon_device_register(dev);
         if (IS_ERR(data->class_dev)) {
                 err = PTR_ERR(data->class_dev);
-                goto error3;
+                goto error4;
         }
 
-        for (i = 0; i < NUMBER_OF_VIN; i++) {
-                device_create_file(dev, &sda_in_input[i].dev_attr);
-                device_create_file(dev, &sda_in_min[i].dev_attr);
-                device_create_file(dev, &sda_in_max[i].dev_attr);
-        }
-
-        for (i = 0; i < NUMBER_OF_FANIN; i++) {
-                device_create_file(dev, &sda_fan_input[i].dev_attr);
-                device_create_file(dev, &sda_fan_div[i].dev_attr);
-                device_create_file(dev, &sda_fan_min[i].dev_attr);
-        }
-
-        for (i = 0; i < NUMBER_OF_TEMPIN; i++) {
-                device_create_file(dev, &sda_temp_input[i].dev_attr);
-                device_create_file(dev, &sda_temp_max[i].dev_attr);
-                device_create_file(dev, &sda_temp_max_hyst[i].dev_attr);
-        }
-
-        device_create_file(dev, &dev_attr_alarms);
-
-        for (i = 0; i < ARRAY_SIZE(sda_beep_ctrl); i++) {
-                device_create_file(dev, &sda_beep_ctrl[i].dev_attr);
-        }
-
-        device_create_file(dev, &dev_attr_cpu0_vid);
-        device_create_file(dev, &dev_attr_vrm);
-
         return 0;
 
+error4:
+        sysfs_remove_group(&client->dev.kobj, &w83791d_group);
 error3:
         if (data->lm75[0] != NULL) {
                 i2c_detach_client(data->lm75[0]);
@@ -1025,8 +1050,10 @@ static int w83791d_detach_client(struct i2c_client *client)
         int err;
 
         /* main client */
-        if (data)
+        if (data) {
                 hwmon_device_unregister(data->class_dev);
+                sysfs_remove_group(&client->dev.kobj, &w83791d_group);
+        }
 
         if ((err = i2c_detach_client(client)))
                 return err;
diff --git a/drivers/i2c/busses/i2c-isa.c b/drivers/i2c/busses/i2c-isa.c
index 4380653748a4..8ed59a2dff53 100644
--- a/drivers/i2c/busses/i2c-isa.c
+++ b/drivers/i2c/busses/i2c-isa.c
@@ -91,7 +91,7 @@ int i2c_isa_add_driver(struct i2c_driver *driver)
         /* Now look for clients */
         res = driver->attach_adapter(&isa_adapter);
         if (res) {
-                dev_err(&isa_adapter.dev,
+                dev_dbg(&isa_adapter.dev,
                         "Driver %s failed to attach adapter, unregistering\n",
                         driver->driver.name);
                 driver_unregister(&driver->driver);
diff --git a/drivers/i2c/busses/i2c-ixp4xx.c b/drivers/i2c/busses/i2c-ixp4xx.c
index 1ce01fb0ac09..05fffb9415a2 100644
--- a/drivers/i2c/busses/i2c-ixp4xx.c
+++ b/drivers/i2c/busses/i2c-ixp4xx.c
@@ -137,7 +137,8 @@ static int ixp4xx_i2c_probe(struct platform_device *plat_dev)
         gpio_line_set(gpio->scl_pin, 0);
         gpio_line_set(gpio->sda_pin, 0);
 
-        if ((err = i2c_bit_add_bus(&drv_data->adapter) != 0)) {
+        err = i2c_bit_add_bus(&drv_data->adapter);
+        if (err != 0)
                 printk(KERN_ERR "ERROR: Could not install %s\n", plat_dev->dev.bus_id);
 
                 kfree(drv_data);
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 81050d3c9b21..c95a6c154165 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -272,7 +272,8 @@ static int i2c_pxa_wait_slave(struct pxa_i2c *i2c)
                         dev_dbg(&i2c->adap.dev, "%s: %ld: ISR=%08x, ICR=%08x, IBMR=%02x\n",
                                 __func__, (long)jiffies, ISR, ICR, IBMR);
 
-                if ((ISR & (ISR_UB|ISR_IBB|ISR_SAD)) == ISR_SAD ||
+                if ((ISR & (ISR_UB|ISR_IBB)) == 0 ||
+                    (ISR & ISR_SAD) != 0 ||
                     (ICR & ICR_SCLE) == 0) {
                         if (i2c_debug > 1)
                                 dev_dbg(&i2c->adap.dev, "%s: done\n", __func__);
@@ -492,7 +493,10 @@ static void i2c_pxa_slave_txempty(struct pxa_i2c *i2c, u32 isr)
         if (isr & ISR_BED) {
                 /* what should we do here? */
         } else {
-                int ret = i2c->slave->read(i2c->slave->data);
+                int ret = 0;
+
+                if (i2c->slave != NULL)
+                        ret = i2c->slave->read(i2c->slave->data);
 
                 IDBR = ret;
                 ICR |= ICR_TB;   /* allow next byte */
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index 32aab0d34ee9..714bae780953 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -494,11 +494,12 @@ static __init int scx200_create_pci(const char *text, struct pci_dev *pdev,
         iface->pdev = pdev;
         iface->bar = bar;
 
-        pci_enable_device_bars(iface->pdev, 1 << iface->bar);
+        rc = pci_enable_device_bars(iface->pdev, 1 << iface->bar);
+        if (rc)
+                goto errout_free;
 
         rc = pci_request_region(iface->pdev, iface->bar, iface->adapter.name);
-
-        if (rc != 0) {
+        if (rc) {
                 printk(KERN_ERR NAME ": can't allocate PCI BAR %d\n",
                                 iface->bar);
                 goto errout_free;
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 69bbb6206a00..88214943d00a 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -597,7 +597,7 @@ static void cdrom_prepare_request(ide_drive_t *drive, struct request *rq)
         struct cdrom_info *cd = drive->driver_data;
 
         ide_init_drive_cmd(rq);
-        rq->cmd_type = REQ_TYPE_BLOCK_PC;
+        rq->cmd_type = REQ_TYPE_ATA_PC;
         rq->rq_disk = cd->disk;
 }
 
@@ -716,7 +716,7 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                 ide_error(drive, "request sense failure", stat);
                 return 1;
 
-        } else if (blk_pc_request(rq)) {
+        } else if (blk_pc_request(rq) || rq->cmd_type == REQ_TYPE_ATA_PC) {
                 /* All other functions, except for READ. */
                 unsigned long flags;
 
@@ -724,7 +724,7 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                  * if we have an error, pass back CHECK_CONDITION as the
                  * scsi status byte
                  */
-                if (!rq->errors)
+                if (blk_pc_request(rq) && !rq->errors)
                         rq->errors = SAM_STAT_CHECK_CONDITION;
 
                 /* Check for tray open. */
@@ -2023,7 +2023,8 @@ ide_do_rw_cdrom (ide_drive_t *drive, struct request *rq, sector_t block)
                 }
                 info->last_block = block;
                 return action;
-        } else if (rq->cmd_type == REQ_TYPE_SENSE) {
+        } else if (rq->cmd_type == REQ_TYPE_SENSE ||
+                   rq->cmd_type == REQ_TYPE_ATA_PC) {
                 return cdrom_do_packet_command(drive);
         } else if (blk_pc_request(rq)) {
                 return cdrom_do_block_pc(drive, rq);
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 1d0470c1f957..30175c7688e8 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -524,8 +524,8 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
         task_ioreg_t *hobsptr   = args.hobRegister;
         int err                 = 0;
         int tasksize            = sizeof(struct ide_task_request_s);
-        int taskin              = 0;
-        int taskout             = 0;
+        unsigned int taskin     = 0;
+        unsigned int taskout    = 0;
         u8 io_32bit             = drive->io_32bit;
         char __user *buf = (char __user *)arg;
 
@@ -538,8 +538,13 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
                 return -EFAULT;
         }
 
-        taskout = (int) req_task->out_size;
-        taskin  = (int) req_task->in_size;
+        taskout = req_task->out_size;
+        taskin  = req_task->in_size;
+        
+        if (taskin > 65536 || taskout > 65536) {
+                err = -EINVAL;
+                goto abort;
+        }
 
         if (taskout) {
                 int outtotal = tasksize;
diff --git a/drivers/ide/legacy/hd.c b/drivers/ide/legacy/hd.c
index b1d5291531b7..45ed03591cd8 100644
--- a/drivers/ide/legacy/hd.c
+++ b/drivers/ide/legacy/hd.c
@@ -459,7 +459,7 @@ ok_to_read:
 #ifdef DEBUG
         printk("%s: read: sector %ld, remaining = %ld, buffer=%p\n",
                 req->rq_disk->disk_name, req->sector, req->nr_sectors,
-                req->buffer+512));
+                req->buffer+512);
 #endif
         if (req->current_nr_sectors <= 0)
                 end_request(req, 1);
diff --git a/drivers/ide/pci/amd74xx.c b/drivers/ide/pci/amd74xx.c
index 2b0ea8b6608d..753fe0e21456 100644
--- a/drivers/ide/pci/amd74xx.c
+++ b/drivers/ide/pci/amd74xx.c
@@ -75,6 +75,7 @@ static struct amd_ide_chip {
         { PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE,        0x50, AMD_UDMA_133 },
         { PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_IDE,        0x50, AMD_UDMA_133 },
         { PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_IDE,        0x50, AMD_UDMA_133 },
+        { PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE,        0x50, AMD_UDMA_133 },
         { PCI_DEVICE_ID_AMD_CS5536_IDE,                 0x40, AMD_UDMA_100 },
         { 0 }
 };
@@ -491,7 +492,8 @@ static ide_pci_device_t amd74xx_chipsets[] __devinitdata = {
         /* 16 */ DECLARE_NV_DEV("NFORCE-MCP55"),
         /* 17 */ DECLARE_NV_DEV("NFORCE-MCP61"),
         /* 18 */ DECLARE_NV_DEV("NFORCE-MCP65"),
-        /* 19 */ DECLARE_AMD_DEV("AMD5536"),
+        /* 19 */ DECLARE_NV_DEV("NFORCE-MCP67"),
+        /* 20 */ DECLARE_AMD_DEV("AMD5536"),
 };
 
 static int __devinit amd74xx_probe(struct pci_dev *dev, const struct pci_device_id *id)
@@ -530,7 +532,8 @@ static struct pci_device_id amd74xx_pci_tbl[] = {
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP55_IDE,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 16 },
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP61_IDE,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 17 },
         { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP65_IDE,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 18 },
-        { PCI_VENDOR_ID_AMD,    PCI_DEVICE_ID_AMD_CS5536_IDE,           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 19 },
+        { PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE,  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 19 },
+        { PCI_VENDOR_ID_AMD,    PCI_DEVICE_ID_AMD_CS5536_IDE,           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 20 },
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, amd74xx_pci_tbl);
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index 965c43659e35..9f306880491a 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -40,6 +40,19 @@
 
 static int ide_generic_all;             /* Set to claim all devices */
 
+/*
+ * the module_param_named() was added for the modular case
+ * the __setup() is left as compatibility for existing setups
+ */
+#ifndef MODULE
+static int __init ide_generic_all_on(char *unused)
+{
+        ide_generic_all = 1;
+        printk(KERN_INFO "IDE generic will claim all unknown PCI IDE storage controllers.\n");
+        return 1;
+}
+__setup("all-generic-ide", ide_generic_all_on);
+#endif
 module_param_named(all_generic_ide, ide_generic_all, bool, 0444);
 MODULE_PARM_DESC(all_generic_ide, "IDE generic will claim all unknown PCI IDE storage controllers.");
 
@@ -234,13 +247,17 @@ static int __devinit generic_init_one(struct pci_dev *dev, const struct pci_devi
             (!(PCI_FUNC(dev->devfn) & 1)))
                 goto out;
 
-        if (dev->vendor == PCI_VENDOR_ID_JMICRON && PCI_FUNC(dev->devfn) != 1)
-                goto out;
+        if (dev->vendor == PCI_VENDOR_ID_JMICRON) {
+                if (dev->device != PCI_DEVICE_ID_JMICRON_JMB368 && PCI_FUNC(dev->devfn) != 1)
+                        goto out;
+        }
 
-        pci_read_config_word(dev, PCI_COMMAND, &command);
-        if (!(command & PCI_COMMAND_IO)) {
-                printk(KERN_INFO "Skipping disabled %s IDE controller.\n", d->name);
-                goto out;
+        if (dev->vendor != PCI_VENDOR_ID_JMICRON) {
+                pci_read_config_word(dev, PCI_COMMAND, &command);
+                if (!(command & PCI_COMMAND_IO)) {
+                        printk(KERN_INFO "Skipping disabled %s IDE controller.\n", d->name);
+                        goto out;
+                }
         }
         ret = ide_setup_pci_device(dev, d);
 out:
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index f3fe287fbd89..244f7eb7006d 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -774,7 +774,7 @@ ioc4_ide_exit(void)
         ioc4_unregister_submodule(&ioc4_ide_submodule);
 }
 
-module_init(ioc4_ide_init);
+late_initcall(ioc4_ide_init); /* Call only after IDE init is done */
 module_exit(ioc4_ide_exit);
 
 MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index 8a7b8fab6238..31e5cc49d61a 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -64,6 +64,7 @@
 #include <linux/ethtool.h>
 #include <asm/uaccess.h>
 #include <asm/delay.h>
+#include <asm/unaligned.h>
 #include <net/arp.h>
 
 #include "config_roms.h"
@@ -491,7 +492,7 @@ static void ether1394_reset_priv (struct net_device *dev, int set_mtu)
         int i;
         struct eth1394_priv *priv = netdev_priv(dev);
         struct hpsb_host *host = priv->host;
-        u64 guid = *((u64*)&(host->csr.rom->bus_info_data[3]));
+        u64 guid = get_unaligned((u64*)&(host->csr.rom->bus_info_data[3]));
         u16 maxpayload = 1 << (host->csr.max_rec + 1);
         int max_speed = IEEE1394_SPEED_MAX;
 
@@ -514,8 +515,8 @@ static void ether1394_reset_priv (struct net_device *dev, int set_mtu)
                                       ETHER1394_GASP_OVERHEAD)));
 
                 /* Set our hardware address while we're at it */
-                *(u64*)dev->dev_addr = guid;
-                *(u64*)dev->broadcast = ~0x0ULL;
+                memcpy(dev->dev_addr, &guid, sizeof(u64));
+                memset(dev->broadcast, 0xff, sizeof(u64));
         }
 
         spin_unlock_irqrestore (&priv->lock, flags);
@@ -894,6 +895,7 @@ static inline u16 ether1394_parse_encap(struct sk_buff *skb,
                 u16 maxpayload;
                 struct eth1394_node_ref *node;
                 struct eth1394_node_info *node_info;
+                __be64 guid;
 
                 /* Sanity check. MacOSX seems to be sending us 131 in this
                  * field (atleast on my Panther G5). Not sure why. */
@@ -902,8 +904,9 @@ static inline u16 ether1394_parse_encap(struct sk_buff *skb,
 
                 maxpayload = min(eth1394_speedto_maxpayload[sspd], (u16)(1 << (max_rec + 1)));
 
+                guid = get_unaligned(&arp1394->s_uniq_id);
                 node = eth1394_find_node_guid(&priv->ip_node_list,
-                                              be64_to_cpu(arp1394->s_uniq_id));
+                                              be64_to_cpu(guid));
                 if (!node) {
                         return 0;
                 }
@@ -931,10 +934,9 @@ static inline u16 ether1394_parse_encap(struct sk_buff *skb,
                 arp_ptr += arp->ar_pln;         /* skip over sender IP addr */
 
                 if (arp->ar_op == htons(ARPOP_REQUEST))
-                        /* just set ARP req target unique ID to 0 */
-                        *((u64*)arp_ptr) = 0;
+                        memset(arp_ptr, 0, sizeof(u64));
                 else
-                        *((u64*)arp_ptr) = *((u64*)dev->dev_addr);
+                        memcpy(arp_ptr, dev->dev_addr, sizeof(u64));
         }
 
         /* Now add the ethernet header. */
@@ -1675,8 +1677,10 @@ static int ether1394_tx (struct sk_buff *skb, struct net_device *dev)
                 if (max_payload < dg_size + hdr_type_len[ETH1394_HDR_LF_UF])
                         priv->bc_dgl++;
         } else {
+                __be64 guid = get_unaligned((u64 *)eth->h_dest);
+
                 node = eth1394_find_node_guid(&priv->ip_node_list,
-                                              be64_to_cpu(*(u64*)eth->h_dest));
+                                              be64_to_cpu(guid));
                 if (!node) {
                         ret = -EAGAIN;
                         goto fail;
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index dea13525df88..6e8ea9110c46 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -3552,12 +3552,21 @@ static int ohci1394_pci_suspend (struct pci_dev *pdev, pm_message_t state)
 {
         int err;
 
+        printk(KERN_INFO "%s does not fully support suspend and resume yet\n",
+               OHCI1394_DRIVER_NAME);
+
         err = pci_save_state(pdev);
-        if (err)
-                goto out;
+        if (err) {
+                printk(KERN_ERR "%s: pci_save_state failed with %d\n",
+                       OHCI1394_DRIVER_NAME, err);
+                return err;
+        }
         err = pci_set_power_state(pdev, pci_choose_state(pdev, state));
+#ifdef OHCI1394_DEBUG
         if (err)
-                goto out;
+                printk(KERN_DEBUG "%s: pci_set_power_state failed with %d\n",
+                       OHCI1394_DRIVER_NAME, err);
+#endif /* OHCI1394_DEBUG */
 
 /* PowerMac suspend code comes last */
 #ifdef CONFIG_PPC_PMAC
@@ -3570,8 +3579,8 @@ static int ohci1394_pci_suspend (struct pci_dev *pdev, pm_message_t state)
                         pmac_call_feature(PMAC_FTR_1394_ENABLE, of_node, 0, 0);
         }
 #endif /* CONFIG_PPC_PMAC */
-out:
-        return err;
+
+        return 0;
 }
 #endif /* CONFIG_PM */
 
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index 60d3fbdd216c..e11187ecc931 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -47,6 +47,7 @@ struct addr_req {
         struct sockaddr src_addr;
         struct sockaddr dst_addr;
         struct rdma_dev_addr *addr;
+        struct rdma_addr_client *client;
         void *context;
         void (*callback)(int status, struct sockaddr *src_addr,
                          struct rdma_dev_addr *addr, void *context);
@@ -61,6 +62,26 @@ static LIST_HEAD(req_list);
 static DECLARE_WORK(work, process_req, NULL);
 static struct workqueue_struct *addr_wq;
 
+void rdma_addr_register_client(struct rdma_addr_client *client)
+{
+        atomic_set(&client->refcount, 1);
+        init_completion(&client->comp);
+}
+EXPORT_SYMBOL(rdma_addr_register_client);
+
+static inline void put_client(struct rdma_addr_client *client)
+{
+        if (atomic_dec_and_test(&client->refcount))
+                complete(&client->comp);
+}
+
+void rdma_addr_unregister_client(struct rdma_addr_client *client)
+{
+        put_client(client);
+        wait_for_completion(&client->comp);
+}
+EXPORT_SYMBOL(rdma_addr_unregister_client);
+
 int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev,
                      const unsigned char *dst_dev_addr)
 {
@@ -229,6 +250,7 @@ static void process_req(void *data)
                 list_del(&req->list);
                 req->callback(req->status, &req->src_addr, req->addr,
                               req->context);
+                put_client(req->client);
                 kfree(req);
         }
 }
@@ -264,7 +286,8 @@ static int addr_resolve_local(struct sockaddr_in *src_in,
         return ret;
 }
 
-int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
+int rdma_resolve_ip(struct rdma_addr_client *client,
+                    struct sockaddr *src_addr, struct sockaddr *dst_addr,
                     struct rdma_dev_addr *addr, int timeout_ms,
                     void (*callback)(int status, struct sockaddr *src_addr,
                                      struct rdma_dev_addr *addr, void *context),
@@ -285,6 +308,8 @@ int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
         req->addr = addr;
         req->callback = callback;
         req->context = context;
+        req->client = client;
+        atomic_inc(&client->refcount);
 
         src_in = (struct sockaddr_in *) &req->src_addr;
         dst_in = (struct sockaddr_in *) &req->dst_addr;
@@ -305,6 +330,7 @@ int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
                 break;
         default:
                 ret = req->status;
+                atomic_dec(&client->refcount);
                 kfree(req);
                 break;
         }
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9ae4f3a67c70..845090b0859c 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -63,6 +63,7 @@ static struct ib_client cma_client = {
 };
 
 static struct ib_sa_client sa_client;
+static struct rdma_addr_client addr_client;
 static LIST_HEAD(dev_list);
 static LIST_HEAD(listen_any_list);
 static DEFINE_MUTEX(lock);
@@ -1625,8 +1626,8 @@ int rdma_resolve_addr(struct rdma_cm_id *id, struct sockaddr *src_addr,
         if (cma_any_addr(dst_addr))
                 ret = cma_resolve_loopback(id_priv);
         else
-                ret = rdma_resolve_ip(&id->route.addr.src_addr, dst_addr,
-                                      &id->route.addr.dev_addr,
+                ret = rdma_resolve_ip(&addr_client, &id->route.addr.src_addr,
+                                      dst_addr, &id->route.addr.dev_addr,
                                       timeout_ms, addr_handler, id_priv);
         if (ret)
                 goto err;
@@ -1762,22 +1763,29 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
 
         if (!cma_any_addr(addr)) {
                 ret = rdma_translate_ip(addr, &id->route.addr.dev_addr);
-                if (!ret) {
-                        mutex_lock(&lock);
-                        ret = cma_acquire_dev(id_priv);
-                        mutex_unlock(&lock);
-                }
                 if (ret)
-                        goto err;
+                        goto err1;
+
+                mutex_lock(&lock);
+                ret = cma_acquire_dev(id_priv);
+                mutex_unlock(&lock);
+                if (ret)
+                        goto err1;
         }
 
         memcpy(&id->route.addr.src_addr, addr, ip_addr_size(addr));
         ret = cma_get_port(id_priv);
         if (ret)
-                goto err;
+                goto err2;
 
         return 0;
-err:
+err2:
+        if (!cma_any_addr(addr)) {
+                mutex_lock(&lock);
+                cma_detach_from_dev(id_priv);
+                mutex_unlock(&lock);
+        }
+err1:
         cma_comp_exch(id_priv, CMA_ADDR_BOUND, CMA_IDLE);
         return ret;
 }
@@ -2210,6 +2218,7 @@ static int cma_init(void)
                 return -ENOMEM;
 
         ib_sa_register_client(&sa_client);
+        rdma_addr_register_client(&addr_client);
 
         ret = ib_register_client(&cma_client);
         if (ret)
@@ -2217,6 +2226,7 @@ static int cma_init(void)
         return 0;
 
 err:
+        rdma_addr_unregister_client(&addr_client);
         ib_sa_unregister_client(&sa_client);
         destroy_workqueue(cma_wq);
         return ret;
@@ -2225,6 +2235,7 @@ err:
 static void cma_cleanup(void)
 {
         ib_unregister_client(&cma_client);
+        rdma_addr_unregister_client(&addr_client);
         ib_sa_unregister_client(&sa_client);
         destroy_workqueue(cma_wq);
         idr_destroy(&sdp_ps);
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 493f4c65c7a2..a72bcea46ff6 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1750,7 +1750,7 @@ ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv,
                      */
                     (is_direct(wc->recv_buf.mad->mad_hdr.mgmt_class) ||
                      rcv_has_same_gid(mad_agent_priv, wr, wc)))
-                        return wr;
+                        return (wr->status == IB_WC_SUCCESS) ? wr : NULL;
         }
 
         /*
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index b72c7f69ca90..743247ec065e 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1214,7 +1214,7 @@ ssize_t ib_uverbs_query_qp(struct ib_uverbs_file *file,
         resp.qp_access_flags        = attr->qp_access_flags;
         resp.pkey_index             = attr->pkey_index;
         resp.alt_pkey_index         = attr->alt_pkey_index;
-        resp.en_sqd_async_notify    = attr->en_sqd_async_notify;
+        resp.sq_draining            = attr->sq_draining;
         resp.max_rd_atomic          = attr->max_rd_atomic;
         resp.max_dest_rd_atomic     = attr->max_dest_rd_atomic;
         resp.min_rnr_timer          = attr->min_rnr_timer;
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index dc1ebeac35c7..27fe242ed435 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1155,7 +1155,8 @@ static int __devinit c2_probe(struct pci_dev *pcidev,
                 goto bail10;
         }
 
-        c2_register_device(c2dev);
+        if (c2_register_device(c2dev))
+                goto bail10;
 
         return 0;
 
@@ -1243,7 +1244,7 @@ static struct pci_driver c2_pci_driver = {
 
 static int __init c2_init_module(void)
 {
-        return pci_module_init(&c2_pci_driver);
+        return pci_register_driver(&c2_pci_driver);
 }
 
 static void __exit c2_exit_module(void)
diff --git a/drivers/infiniband/hw/amso1100/c2_alloc.c b/drivers/infiniband/hw/amso1100/c2_alloc.c
index 028a60bbfca9..0315f99e4191 100644
--- a/drivers/infiniband/hw/amso1100/c2_alloc.c
+++ b/drivers/infiniband/hw/amso1100/c2_alloc.c
@@ -42,13 +42,14 @@ static int c2_alloc_mqsp_chunk(struct c2_dev *c2dev, gfp_t gfp_mask,
 {
         int i;
         struct sp_chunk *new_head;
+        dma_addr_t dma_addr;
 
-        new_head = (struct sp_chunk *) __get_free_page(gfp_mask);
+        new_head = dma_alloc_coherent(&c2dev->pcidev->dev, PAGE_SIZE,
+                                      &dma_addr, gfp_mask);
         if (new_head == NULL)
                 return -ENOMEM;
 
-        new_head->dma_addr = dma_map_single(c2dev->ibdev.dma_device, new_head,
-                                            PAGE_SIZE, DMA_FROM_DEVICE);
+        new_head->dma_addr = dma_addr;
         pci_unmap_addr_set(new_head, mapping, new_head->dma_addr);
 
         new_head->next = NULL;
@@ -80,10 +81,8 @@ void c2_free_mqsp_pool(struct c2_dev *c2dev, struct sp_chunk *root)
 
         while (root) {
                 next = root->next;
-                dma_unmap_single(c2dev->ibdev.dma_device,
-                                 pci_unmap_addr(root, mapping), PAGE_SIZE,
-                                 DMA_FROM_DEVICE);
-                __free_page((struct page *) root);
+                dma_free_coherent(&c2dev->pcidev->dev, PAGE_SIZE, root,
+                                  pci_unmap_addr(root, mapping));
                 root = next;
         }
 }
diff --git a/drivers/infiniband/hw/amso1100/c2_cq.c b/drivers/infiniband/hw/amso1100/c2_cq.c
index 9d7bcc5ade93..05c9154d46f4 100644
--- a/drivers/infiniband/hw/amso1100/c2_cq.c
+++ b/drivers/infiniband/hw/amso1100/c2_cq.c
@@ -246,20 +246,17 @@ int c2_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
 
 static void c2_free_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq)
 {
-
-        dma_unmap_single(c2dev->ibdev.dma_device, pci_unmap_addr(mq, mapping),
-                         mq->q_size * mq->msg_size, DMA_FROM_DEVICE);
-        free_pages((unsigned long) mq->msg_pool.host,
-                   get_order(mq->q_size * mq->msg_size));
+        dma_free_coherent(&c2dev->pcidev->dev, mq->q_size * mq->msg_size,
+                          mq->msg_pool.host, pci_unmap_addr(mq, mapping));
 }
 
 static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                            int msg_size)
 {
-        unsigned long pool_start;
+        u8 *pool_start;
 
-        pool_start = __get_free_pages(GFP_KERNEL,
-                                      get_order(q_size * msg_size));
+        pool_start = dma_alloc_coherent(&c2dev->pcidev->dev, q_size * msg_size,
+                                        &mq->host_dma, GFP_KERNEL);
         if (!pool_start)
                 return -ENOMEM;
 
@@ -267,13 +264,10 @@ static int c2_alloc_cq_buf(struct c2_dev *c2dev, struct c2_mq *mq, int q_size,
                        0,               /* index (currently unknown) */
                        q_size,
                        msg_size,
-                       (u8 *) pool_start,
+                       pool_start,
                        NULL,    /* peer (currently unknown) */
                        C2_MQ_HOST_TARGET);
 
-        mq->host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                      (void *)pool_start,
-                                      q_size * msg_size, DMA_FROM_DEVICE);
         pci_unmap_addr_set(mq, mapping, mq->host_dma);
 
         return 0;
diff --git a/drivers/infiniband/hw/amso1100/c2_provider.c b/drivers/infiniband/hw/amso1100/c2_provider.c
index da98d9f71429..fef972752912 100644
--- a/drivers/infiniband/hw/amso1100/c2_provider.c
+++ b/drivers/infiniband/hw/amso1100/c2_provider.c
@@ -757,20 +757,17 @@ static struct net_device *c2_pseudo_netdev_init(struct c2_dev *c2dev)
 
 int c2_register_device(struct c2_dev *dev)
 {
-        int ret;
+        int ret = -ENOMEM;
         int i;
 
         /* Register pseudo network device */
         dev->pseudo_netdev = c2_pseudo_netdev_init(dev);
-        if (dev->pseudo_netdev) {
-                ret = register_netdev(dev->pseudo_netdev);
-                if (ret) {
-                        printk(KERN_ERR PFX
-                                "Unable to register netdev, ret = %d\n", ret);
-                        free_netdev(dev->pseudo_netdev);
-                        return ret;
-                }
-        }
+        if (!dev->pseudo_netdev)
+                goto out3;
+
+        ret = register_netdev(dev->pseudo_netdev);
+        if (ret)
+                goto out2;
 
         pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
         strlcpy(dev->ibdev.name, "amso%d", IB_DEVICE_NAME_MAX);
@@ -848,21 +845,25 @@ int c2_register_device(struct c2_dev *dev)
 
         ret = ib_register_device(&dev->ibdev);
         if (ret)
-                return ret;
+                goto out1;
 
         for (i = 0; i < ARRAY_SIZE(c2_class_attributes); ++i) {
                 ret = class_device_create_file(&dev->ibdev.class_dev,
                                                c2_class_attributes[i]);
-                if (ret) {
-                        unregister_netdev(dev->pseudo_netdev);
-                        free_netdev(dev->pseudo_netdev);
-                        ib_unregister_device(&dev->ibdev);
-                        return ret;
-                }
+                if (ret)
+                        goto out0;
         }
+        goto out3;
 
-        pr_debug("%s:%u\n", __FUNCTION__, __LINE__);
-        return 0;
+out0:
+        ib_unregister_device(&dev->ibdev);
+out1:
+        unregister_netdev(dev->pseudo_netdev);
+out2:
+        free_netdev(dev->pseudo_netdev);
+out3:
+        pr_debug("%s:%u ret=%d\n", __FUNCTION__, __LINE__, ret);
+        return ret;
 }
 
 void c2_unregister_device(struct c2_dev *dev)
diff --git a/drivers/infiniband/hw/amso1100/c2_rnic.c b/drivers/infiniband/hw/amso1100/c2_rnic.c
index e37c5688c214..623dc95f91df 100644
--- a/drivers/infiniband/hw/amso1100/c2_rnic.c
+++ b/drivers/infiniband/hw/amso1100/c2_rnic.c
@@ -150,15 +150,15 @@ static int c2_rnic_query(struct c2_dev *c2dev, struct ib_device_attr *props)
             (struct c2wr_rnic_query_rep *) (unsigned long) (vq_req->reply_msg);
         if (!reply)
                 err = -ENOMEM;
-
-        err = c2_errno(reply);
+        else
+                err = c2_errno(reply);
         if (err)
                 goto bail2;
 
         props->fw_ver =
                 ((u64)be32_to_cpu(reply->fw_ver_major) << 32) |
-                ((be32_to_cpu(reply->fw_ver_minor) && 0xFFFF) << 16) |
-                (be32_to_cpu(reply->fw_ver_patch) && 0xFFFF);
+                ((be32_to_cpu(reply->fw_ver_minor) & 0xFFFF) << 16) |
+                (be32_to_cpu(reply->fw_ver_patch) & 0xFFFF);
         memcpy(&props->sys_image_guid, c2dev->netdev->dev_addr, 6);
         props->max_mr_size         = 0xFFFFFFFF;
         props->page_size_cap       = ~(C2_MIN_PAGESIZE-1);
@@ -517,14 +517,12 @@ int c2_rnic_init(struct c2_dev *c2dev)
         /* Initialize the Verbs Reply Queue */
         qsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q1_QSIZE));
         msgsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q1_MSGSIZE));
-        q1_pages = kmalloc(qsize * msgsize, GFP_KERNEL);
+        q1_pages = dma_alloc_coherent(&c2dev->pcidev->dev, qsize * msgsize,
+                                      &c2dev->rep_vq.host_dma, GFP_KERNEL);
         if (!q1_pages) {
                 err = -ENOMEM;
                 goto bail1;
         }
-        c2dev->rep_vq.host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                                (void *)q1_pages, qsize * msgsize,
-                                                DMA_FROM_DEVICE);
         pci_unmap_addr_set(&c2dev->rep_vq, mapping, c2dev->rep_vq.host_dma);
         pr_debug("%s rep_vq va %p dma %llx\n", __FUNCTION__, q1_pages,
                  (unsigned long long) c2dev->rep_vq.host_dma);
@@ -540,17 +538,15 @@ int c2_rnic_init(struct c2_dev *c2dev)
         /* Initialize the Asynchronus Event Queue */
         qsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q2_QSIZE));
         msgsize = be32_to_cpu(readl(mmio_regs + C2_REGS_Q2_MSGSIZE));
-        q2_pages = kmalloc(qsize * msgsize, GFP_KERNEL);
+        q2_pages = dma_alloc_coherent(&c2dev->pcidev->dev, qsize * msgsize,
+                                      &c2dev->aeq.host_dma, GFP_KERNEL);
         if (!q2_pages) {
                 err = -ENOMEM;
                 goto bail2;
         }
-        c2dev->aeq.host_dma = dma_map_single(c2dev->ibdev.dma_device,
-                                                (void *)q2_pages, qsize * msgsize,
-                                                DMA_FROM_DEVICE);
         pci_unmap_addr_set(&c2dev->aeq, mapping, c2dev->aeq.host_dma);
-        pr_debug("%s aeq va %p dma %llx\n", __FUNCTION__, q1_pages,
-                 (unsigned long long) c2dev->rep_vq.host_dma);
+        pr_debug("%s aeq va %p dma %llx\n", __FUNCTION__, q2_pages,
+                 (unsigned long long) c2dev->aeq.host_dma);
         c2_mq_rep_init(&c2dev->aeq,
                        2,
                        qsize,
@@ -597,17 +593,13 @@ int c2_rnic_init(struct c2_dev *c2dev)
       bail4:
         vq_term(c2dev);
       bail3:
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->aeq, mapping),
-                         c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(q2_pages);
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->aeq.q_size * c2dev->aeq.msg_size,
+                          q2_pages, pci_unmap_addr(&c2dev->aeq, mapping));
       bail2:
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->rep_vq, mapping),
-                         c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(q1_pages);
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
+                          q1_pages, pci_unmap_addr(&c2dev->rep_vq, mapping));
       bail1:
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
       bail0:
@@ -640,19 +632,17 @@ void c2_rnic_term(struct c2_dev *c2dev)
         /* Free the verbs request allocator */
         vq_term(c2dev);
 
-        /* Unmap and free the asynchronus event queue */
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->aeq, mapping),
-                         c2dev->aeq.q_size * c2dev->aeq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(c2dev->aeq.msg_pool.host);
-
-        /* Unmap and free the verbs reply queue */
-        dma_unmap_single(c2dev->ibdev.dma_device,
-                         pci_unmap_addr(&c2dev->rep_vq, mapping),
-                         c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
-                         DMA_FROM_DEVICE);
-        kfree(c2dev->rep_vq.msg_pool.host);
+        /* Free the asynchronus event queue */
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->aeq.q_size * c2dev->aeq.msg_size,
+                          c2dev->aeq.msg_pool.host,
+                          pci_unmap_addr(&c2dev->aeq, mapping));
+
+        /* Free the verbs reply queue */
+        dma_free_coherent(&c2dev->pcidev->dev,
+                          c2dev->rep_vq.q_size * c2dev->rep_vq.msg_size,
+                          c2dev->rep_vq.msg_pool.host,
+                          pci_unmap_addr(&c2dev->rep_vq, mapping));
 
         /* Free the MQ shared pointer pool */
         c2_free_mqsp_pool(c2dev, c2dev->kern_mqsp_pool);
diff --git a/drivers/infiniband/hw/ehca/Kconfig b/drivers/infiniband/hw/ehca/Kconfig
index 922389b64394..727b10d89686 100644
--- a/drivers/infiniband/hw/ehca/Kconfig
+++ b/drivers/infiniband/hw/ehca/Kconfig
@@ -10,6 +10,7 @@ config INFINIBAND_EHCA
 config INFINIBAND_EHCA_SCALING
         bool "Scaling support (EXPERIMENTAL)"
         depends on IBMEBUS && INFINIBAND_EHCA && HOTPLUG_CPU && EXPERIMENTAL
+        default y
         ---help---
         eHCA scaling support schedules the CQ callbacks to different CPUs.
 
diff --git a/drivers/infiniband/hw/ehca/ehca_av.c b/drivers/infiniband/hw/ehca/ehca_av.c
index 3bac197f9014..214e2fdddeef 100644
--- a/drivers/infiniband/hw/ehca/ehca_av.c
+++ b/drivers/infiniband/hw/ehca/ehca_av.c
@@ -118,8 +118,7 @@ struct ib_ah *ehca_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
                 }
                 memcpy(&av->av.grh.word_1, &gid, sizeof(gid));
         }
-        /* for the time being we use a hard coded PMTU of 2048 Bytes */
-        av->av.pmtu = 4;
+        av->av.pmtu = EHCA_MAX_MTU;
 
         /* dgid comes in grh.word_3 */
         memcpy(&av->av.grh.word_3, &ah_attr->grh.dgid,
@@ -193,7 +192,7 @@ int ehca_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr)
                 memcpy(&new_ehca_av.grh.word_1, &gid, sizeof(gid));
         }
 
-        new_ehca_av.pmtu = 4; /* see also comment in create_ah() */
+        new_ehca_av.pmtu = EHCA_MAX_MTU;
 
         memcpy(&new_ehca_av.grh.word_3, &ah_attr->grh.dgid,
                sizeof(ah_attr->grh.dgid));
diff --git a/drivers/infiniband/hw/ehca/ehca_hca.c b/drivers/infiniband/hw/ehca/ehca_hca.c
index 5eae6ac48425..e1b618c5f685 100644
--- a/drivers/infiniband/hw/ehca/ehca_hca.c
+++ b/drivers/infiniband/hw/ehca/ehca_hca.c
@@ -40,6 +40,7 @@
  */
 
 #include "ehca_tools.h"
+#include "ehca_iverbs.h"
 #include "hcp_if.h"
 
 int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
@@ -49,7 +50,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                                               ib_device);
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -96,7 +97,7 @@ int ehca_query_device(struct ib_device *ibdev, struct ib_device_attr *props)
                 = min_t(int, rblock->max_total_mcast_qp_attach, INT_MAX);
 
 query_device1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -109,7 +110,7 @@ int ehca_query_port(struct ib_device *ibdev,
                                               ib_device);
         struct hipz_query_port *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -162,7 +163,7 @@ int ehca_query_port(struct ib_device *ibdev,
         props->active_speed    = 0x1;
 
 query_port1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -178,7 +179,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
                 return -EINVAL;
         }
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device,  "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -193,7 +194,7 @@ int ehca_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
         memcpy(pkey, &rblock->pkey_entries + index, sizeof(u16));
 
 query_pkey1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
@@ -211,7 +212,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
                 return -EINVAL;
         }
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -227,7 +228,7 @@ int ehca_query_gid(struct ib_device *ibdev, u8 port,
         memcpy(&gid->raw[8], &rblock->guid_entries[index], sizeof(u64));
 
 query_gid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index 048cc443d1e7..c3ea746e9045 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -45,6 +45,7 @@
 #include "ehca_tools.h"
 #include "hcp_if.h"
 #include "hipz_fns.h"
+#include "ipz_pt_fn.h"
 
 #define EQE_COMPLETION_EVENT   EHCA_BMASK_IBM(1,1)
 #define EQE_CQ_QP_NUMBER       EHCA_BMASK_IBM(8,31)
@@ -137,38 +138,36 @@ int ehca_error_data(struct ehca_shca *shca, void *data,
         u64 *rblock;
         unsigned long block_count;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Cannot allocate rblock memory.");
                 ret = -ENOMEM;
                 goto error_data1;
         }
 
+        /* rblock must be 4K aligned and should be 4K large */
         ret = hipz_h_error_data(shca->ipz_hca_handle,
                                 resource,
                                 rblock,
                                 &block_count);
 
-        if (ret == H_R_STATE) {
+        if (ret == H_R_STATE)
                 ehca_err(&shca->ib_device,
                          "No error data is available: %lx.", resource);
-        }
         else if (ret == H_SUCCESS) {
                 int length;
 
                 length = EHCA_BMASK_GET(ERROR_DATA_LENGTH, rblock[0]);
 
-                if (length > PAGE_SIZE)
-                        length = PAGE_SIZE;
+                if (length > EHCA_PAGESIZE)
+                        length = EHCA_PAGESIZE;
 
                 print_error_data(shca, data, rblock, length);
-        }
-        else {
+        } else
                 ehca_err(&shca->ib_device,
                          "Error data could not be fetched: %lx", resource);
-        }
 
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
 
 error_data1:
         return ret;
diff --git a/drivers/infiniband/hw/ehca/ehca_iverbs.h b/drivers/infiniband/hw/ehca/ehca_iverbs.h
index 319c39d47f3a..3720e3032cce 100644
--- a/drivers/infiniband/hw/ehca/ehca_iverbs.h
+++ b/drivers/infiniband/hw/ehca/ehca_iverbs.h
@@ -179,4 +179,12 @@ int ehca_mmap_register(u64 physical,void **mapped,
 
 int ehca_munmap(unsigned long addr, size_t len);
 
+#ifdef CONFIG_PPC_64K_PAGES
+void *ehca_alloc_fw_ctrlblock(void);
+void ehca_free_fw_ctrlblock(void *ptr);
+#else
+#define ehca_alloc_fw_ctrlblock() ((void *) get_zeroed_page(GFP_KERNEL))
+#define ehca_free_fw_ctrlblock(ptr) free_page((unsigned long)(ptr))
+#endif
+
 #endif
diff --git a/drivers/infiniband/hw/ehca/ehca_main.c b/drivers/infiniband/hw/ehca/ehca_main.c
index 024d511c4b58..01f5aa9cb56d 100644
--- a/drivers/infiniband/hw/ehca/ehca_main.c
+++ b/drivers/infiniband/hw/ehca/ehca_main.c
@@ -40,6 +40,9 @@
  * POSSIBILITY OF SUCH DAMAGE.
  */
 
+#ifdef CONFIG_PPC_64K_PAGES
+#include <linux/slab.h>
+#endif
 #include "ehca_classes.h"
 #include "ehca_iverbs.h"
 #include "ehca_mrmw.h"
@@ -49,7 +52,7 @@
 MODULE_LICENSE("Dual BSD/GPL");
 MODULE_AUTHOR("Christoph Raisch <raisch@de.ibm.com>");
 MODULE_DESCRIPTION("IBM eServer HCA InfiniBand Device Driver");
-MODULE_VERSION("SVNEHCA_0017");
+MODULE_VERSION("SVNEHCA_0018");
 
 int ehca_open_aqp1     = 0;
 int ehca_debug_level   = 0;
@@ -94,11 +97,31 @@ spinlock_t ehca_cq_idr_lock;
 DEFINE_IDR(ehca_qp_idr);
 DEFINE_IDR(ehca_cq_idr);
 
+
 static struct list_head shca_list; /* list of all registered ehcas */
 static spinlock_t shca_list_lock;
 
 static struct timer_list poll_eqs_timer;
 
+#ifdef CONFIG_PPC_64K_PAGES
+static struct kmem_cache *ctblk_cache = NULL;
+
+void *ehca_alloc_fw_ctrlblock(void)
+{
+        void *ret = kmem_cache_zalloc(ctblk_cache, SLAB_KERNEL);
+        if (!ret)
+                ehca_gen_err("Out of memory for ctblk");
+        return ret;
+}
+
+void ehca_free_fw_ctrlblock(void *ptr)
+{
+        if (ptr)
+                kmem_cache_free(ctblk_cache, ptr);
+
+}
+#endif
+
 static int ehca_create_slab_caches(void)
 {
         int ret;
@@ -133,6 +156,17 @@ static int ehca_create_slab_caches(void)
                 goto create_slab_caches5;
         }
 
+#ifdef CONFIG_PPC_64K_PAGES
+        ctblk_cache = kmem_cache_create("ehca_cache_ctblk",
+                                        EHCA_PAGESIZE, H_CB_ALIGNMENT,
+                                        SLAB_HWCACHE_ALIGN,
+                                        NULL, NULL);
+        if (!ctblk_cache) {
+                ehca_gen_err("Cannot create ctblk SLAB cache.");
+                ehca_cleanup_mrmw_cache();
+                goto create_slab_caches5;
+        }
+#endif
         return 0;
 
 create_slab_caches5:
@@ -157,6 +191,10 @@ static void ehca_destroy_slab_caches(void)
         ehca_cleanup_qp_cache();
         ehca_cleanup_cq_cache();
         ehca_cleanup_pd_cache();
+#ifdef CONFIG_PPC_64K_PAGES
+        if (ctblk_cache)
+                kmem_cache_destroy(ctblk_cache);
+#endif
 }
 
 #define EHCA_HCAAVER  EHCA_BMASK_IBM(32,39)
@@ -168,7 +206,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         u64 h_ret;
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_gen_err("Cannot allocate rblock memory.");
                 return -ENOMEM;
@@ -211,7 +249,7 @@ int ehca_sense_attributes(struct ehca_shca *shca)
         shca->sport[1].rate = IB_RATE_30_GBPS;
 
 num_ports1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
         return ret;
 }
 
@@ -220,7 +258,7 @@ static int init_node_guid(struct ehca_shca *shca)
         int ret = 0;
         struct hipz_query_hca *rblock;
 
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        rblock = ehca_alloc_fw_ctrlblock();
         if (!rblock) {
                 ehca_err(&shca->ib_device, "Can't allocate rblock memory.");
                 return -ENOMEM;
@@ -235,7 +273,7 @@ static int init_node_guid(struct ehca_shca *shca)
         memcpy(&shca->ib_device.node_guid, &rblock->node_guid, sizeof(u64));
 
 init_node_guid1:
-        kfree(rblock);
+        ehca_free_fw_ctrlblock(rblock);
         return ret;
 }
 
@@ -431,7 +469,7 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         shca = dev->driver_data;                                           \
                                                                            \
-        rblock = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);                      \
+        rblock = ehca_alloc_fw_ctrlblock();                                \
         if (!rblock) {                                                     \
                 dev_err(dev, "Can't allocate rblock memory.");             \
                 return 0;                                                  \
@@ -439,12 +477,12 @@ static ssize_t  ehca_show_##name(struct device *dev,                       \
                                                                            \
         if (hipz_h_query_hca(shca->ipz_hca_handle, rblock) != H_SUCCESS) { \
                 dev_err(dev, "Can't query device properties");             \
-                kfree(rblock);                                             \
+                ehca_free_fw_ctrlblock(rblock);                            \
                 return 0;                                                  \
         }                                                                  \
                                                                            \
         data = rblock->name;                                               \
-        kfree(rblock);                                                     \
+        ehca_free_fw_ctrlblock(rblock);                                    \
                                                                            \
         if ((strcmp(#name, "num_ports") == 0) && (ehca_nr_ports == 1))     \
                 return snprintf(buf, 256, "1\n");                          \
@@ -752,7 +790,7 @@ int __init ehca_module_init(void)
         int ret;
 
         printk(KERN_INFO "eHCA Infiniband Device Driver "
-                         "(Rel.: SVNEHCA_0017)\n");
+                         "(Rel.: SVNEHCA_0018)\n");
         idr_init(&ehca_qp_idr);
         idr_init(&ehca_cq_idr);
         spin_lock_init(&ehca_qp_idr_lock);
diff --git a/drivers/infiniband/hw/ehca/ehca_mrmw.c b/drivers/infiniband/hw/ehca/ehca_mrmw.c
index 5ca65441e1da..abce676c0ae0 100644
--- a/drivers/infiniband/hw/ehca/ehca_mrmw.c
+++ b/drivers/infiniband/hw/ehca/ehca_mrmw.c
@@ -1013,7 +1013,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
         u32 i;
         u64 *kpage;
 
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1092,7 +1092,7 @@ int ehca_reg_mr_rpages(struct ehca_shca *shca,
 
 
 ehca_reg_mr_rpages_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_reg_mr_rpages_exit0:
         if (ret)
                 ehca_err(&shca->ib_device, "ret=%x shca=%p e_mr=%p pginfo=%p "
@@ -1124,7 +1124,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         ehca_mrmw_map_acl(acl, &hipz_acl);
         ehca_mrmw_set_pgsize_hipz_acl(&hipz_acl);
 
-        kpage = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        kpage = ehca_alloc_fw_ctrlblock();
         if (!kpage) {
                 ehca_err(&shca->ib_device, "kpage alloc failed");
                 ret = -ENOMEM;
@@ -1181,7 +1181,7 @@ inline int ehca_rereg_mr_rereg1(struct ehca_shca *shca,
         }
 
 ehca_rereg_mr_rereg1_exit1:
-        kfree(kpage);
+        ehca_free_fw_ctrlblock(kpage);
 ehca_rereg_mr_rereg1_exit0:
         if ( ret && (ret != -EAGAIN) )
                 ehca_err(&shca->ib_device, "ret=%x lkey=%x rkey=%x "
diff --git a/drivers/infiniband/hw/ehca/ehca_qp.c b/drivers/infiniband/hw/ehca/ehca_qp.c
index 4394123cdbd7..cf3e50ee2d06 100644
--- a/drivers/infiniband/hw/ehca/ehca_qp.c
+++ b/drivers/infiniband/hw/ehca/ehca_qp.c
@@ -811,8 +811,8 @@ static int internal_modify_qp(struct ib_qp *ibqp,
         unsigned long spl_flags = 0;
 
         /* do query_qp to obtain current attr values */
-        mqpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
-        if (mqpcb == NULL) {
+        mqpcb = ehca_alloc_fw_ctrlblock();
+        if (!mqpcb) {
                 ehca_err(ibqp->device, "Could not get zeroed page for mqpcb "
                          "ehca_qp=%p qp_num=%x ", my_qp, ibqp->qp_num);
                 return -ENOMEM;
@@ -1225,7 +1225,7 @@ modify_qp_exit2:
         }
 
 modify_qp_exit1:
-        kfree(mqpcb);
+        ehca_free_fw_ctrlblock(mqpcb);
 
         return ret;
 }
@@ -1277,7 +1277,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 return -EINVAL;
         }
 
-        qpcb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL );
+        qpcb = ehca_alloc_fw_ctrlblock();
         if (!qpcb) {
                 ehca_err(qp->device,"Out of memory for qpcb "
                          "ehca_qp=%p qp_num=%x", my_qp, qp->qp_num);
@@ -1401,7 +1401,7 @@ int ehca_query_qp(struct ib_qp *qp,
                 ehca_dmp(qpcb, 4*70, "qp_num=%x", qp->qp_num);
 
 query_qp_exit1:
-        kfree(qpcb);
+        ehca_free_fw_ctrlblock(qpcb);
 
         return ret;
 }
diff --git a/drivers/infiniband/hw/ehca/ehca_tools.h b/drivers/infiniband/hw/ehca/ehca_tools.h
index 809da3ef706b..973c4b591545 100644
--- a/drivers/infiniband/hw/ehca/ehca_tools.h
+++ b/drivers/infiniband/hw/ehca/ehca_tools.h
@@ -63,6 +63,7 @@
 #include <asm/ibmebus.h>
 #include <asm/io.h>
 #include <asm/pgtable.h>
+#include <asm/hvcall.h>
 
 extern int ehca_debug_level;
 
diff --git a/drivers/infiniband/hw/ehca/hipz_hw.h b/drivers/infiniband/hw/ehca/hipz_hw.h
index 3fc92b031c50..fad91368dc5a 100644
--- a/drivers/infiniband/hw/ehca/hipz_hw.h
+++ b/drivers/infiniband/hw/ehca/hipz_hw.h
@@ -45,6 +45,8 @@
 
 #include "ehca_tools.h"
 
+#define EHCA_MAX_MTU 4
+
 /* QP Table Entry Memory Map */
 struct hipz_qptemm {
         u64 qpx_hcr;
diff --git a/drivers/infiniband/hw/ipath/Kconfig b/drivers/infiniband/hw/ipath/Kconfig
index 574a678e7fdd..90c14543677d 100644
--- a/drivers/infiniband/hw/ipath/Kconfig
+++ b/drivers/infiniband/hw/ipath/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_IPATH
         tristate "QLogic InfiniPath Driver"
-        depends on PCI_MSI && 64BIT && INFINIBAND
+        depends on (PCI_MSI || HT_IRQ) && 64BIT && INFINIBAND && NET
         ---help---
         This is a driver for QLogic InfiniPath host channel adapters,
         including InfiniBand verbs support.  This driver allows these
diff --git a/drivers/infiniband/hw/ipath/Makefile b/drivers/infiniband/hw/ipath/Makefile
index 5e29cb0095e5..7dc10551cf18 100644
--- a/drivers/infiniband/hw/ipath/Makefile
+++ b/drivers/infiniband/hw/ipath/Makefile
@@ -10,8 +10,6 @@ ib_ipath-y := \
         ipath_eeprom.o \
         ipath_file_ops.o \
         ipath_fs.o \
-        ipath_iba6110.o \
-        ipath_iba6120.o \
         ipath_init_chip.o \
         ipath_intr.o \
         ipath_keys.o \
@@ -31,5 +29,8 @@ ib_ipath-y := \
         ipath_verbs_mcast.o \
         ipath_verbs.o
 
+ib_ipath-$(CONFIG_HT_IRQ) += ipath_iba6110.o
+ib_ipath-$(CONFIG_PCI_MSI) += ipath_iba6120.o
+
 ib_ipath-$(CONFIG_X86_64) += ipath_wc_x86_64.o
 ib_ipath-$(CONFIG_PPC64) += ipath_wc_ppc64.o
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index 29958b6e0214..28c087b824c2 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -67,19 +67,54 @@ static struct file_operations diag_file_ops = {
         .release = ipath_diag_release
 };
 
+static ssize_t ipath_diagpkt_write(struct file *fp,
+                                   const char __user *data,
+                                   size_t count, loff_t *off);
+
+static struct file_operations diagpkt_file_ops = {
+        .owner = THIS_MODULE,
+        .write = ipath_diagpkt_write,
+};
+
+static atomic_t diagpkt_count = ATOMIC_INIT(0);
+static struct cdev *diagpkt_cdev;
+static struct class_device *diagpkt_class_dev;
+
 int ipath_diag_add(struct ipath_devdata *dd)
 {
         char name[16];
+        int ret = 0;
+
+        if (atomic_inc_return(&diagpkt_count) == 1) {
+                ret = ipath_cdev_init(IPATH_DIAGPKT_MINOR,
+                                      "ipath_diagpkt", &diagpkt_file_ops,
+                                      &diagpkt_cdev, &diagpkt_class_dev);
+
+                if (ret) {
+                        ipath_dev_err(dd, "Couldn't create ipath_diagpkt "
+                                      "device: %d", ret);
+                        goto done;
+                }
+        }
 
         snprintf(name, sizeof(name), "ipath_diag%d", dd->ipath_unit);
 
-        return ipath_cdev_init(IPATH_DIAG_MINOR_BASE + dd->ipath_unit, name,
-                               &diag_file_ops, &dd->diag_cdev,
-                               &dd->diag_class_dev);
+        ret = ipath_cdev_init(IPATH_DIAG_MINOR_BASE + dd->ipath_unit, name,
+                              &diag_file_ops, &dd->diag_cdev,
+                              &dd->diag_class_dev);
+        if (ret)
+                ipath_dev_err(dd, "Couldn't create %s device: %d",
+                              name, ret);
+
+done:
+        return ret;
 }
 
 void ipath_diag_remove(struct ipath_devdata *dd)
 {
+        if (atomic_dec_and_test(&diagpkt_count))
+                ipath_cdev_cleanup(&diagpkt_cdev, &diagpkt_class_dev);
+
         ipath_cdev_cleanup(&dd->diag_cdev, &dd->diag_class_dev);
 }
 
@@ -275,30 +310,6 @@ bail:
         return ret;
 }
 
-static ssize_t ipath_diagpkt_write(struct file *fp,
-                                   const char __user *data,
-                                   size_t count, loff_t *off);
-
-static struct file_operations diagpkt_file_ops = {
-        .owner = THIS_MODULE,
-        .write = ipath_diagpkt_write,
-};
-
-static struct cdev *diagpkt_cdev;
-static struct class_device *diagpkt_class_dev;
-
-int __init ipath_diagpkt_add(void)
-{
-        return ipath_cdev_init(IPATH_DIAGPKT_MINOR,
-                               "ipath_diagpkt", &diagpkt_file_ops,
-                               &diagpkt_cdev, &diagpkt_class_dev);
-}
-
-void __exit ipath_diagpkt_remove(void)
-{
-        ipath_cdev_cleanup(&diagpkt_cdev, &diagpkt_class_dev);
-}
-
 /**
  * ipath_diagpkt_write - write an IB packet
  * @fp: the diag data device file pointer
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index 12cefa658f3b..1aeddb48e355 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -304,7 +304,7 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
         }
         addr = pci_resource_start(pdev, 0);
         len = pci_resource_len(pdev, 0);
-        ipath_cdbg(VERBOSE, "regbase (0) %llx len %d irq %x, vend %x/%x "
+        ipath_cdbg(VERBOSE, "regbase (0) %llx len %d pdev->irq %d, vend %x/%x "
                    "driver_data %lx\n", addr, len, pdev->irq, ent->vendor,
                    ent->device, ent->driver_data);
 
@@ -390,12 +390,16 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
 
         /* setup the chip-specific functions, as early as possible. */
         switch (ent->device) {
+#ifdef CONFIG_HT_IRQ
         case PCI_DEVICE_ID_INFINIPATH_HT:
                 ipath_init_iba6110_funcs(dd);
                 break;
+#endif
+#ifdef CONFIG_PCI_MSI
         case PCI_DEVICE_ID_INFINIPATH_PE800:
                 ipath_init_iba6120_funcs(dd);
                 break;
+#endif
         default:
                 ipath_dev_err(dd, "Found unknown QLogic deviceid 0x%x, "
                               "failing\n", ent->device);
@@ -467,15 +471,15 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
          * check 0 irq after we return from chip-specific bus setup, since
          * that can affect this due to setup
          */
-        if (!pdev->irq)
+        if (!dd->ipath_irq)
                 ipath_dev_err(dd, "irq is 0, BIOS error?  Interrupts won't "
                               "work\n");
         else {
-                ret = request_irq(pdev->irq, ipath_intr, IRQF_SHARED,
+                ret = request_irq(dd->ipath_irq, ipath_intr, IRQF_SHARED,
                                   IPATH_DRV_NAME, dd);
                 if (ret) {
                         ipath_dev_err(dd, "Couldn't setup irq handler, "
-                                      "irq=%u: %d\n", pdev->irq, ret);
+                                      "irq=%d: %d\n", dd->ipath_irq, ret);
                         goto bail_iounmap;
                 }
         }
@@ -637,11 +641,10 @@ static void __devexit ipath_remove_one(struct pci_dev *pdev)
          * free up port 0 (kernel) rcvhdr, egr bufs, and eventually tid bufs
          * for all versions of the driver, if they were allocated
          */
-        if (pdev->irq) {
-                ipath_cdbg(VERBOSE,
-                           "unit %u free_irq of irq %x\n",
-                           dd->ipath_unit, pdev->irq);
-                free_irq(pdev->irq, dd);
+        if (dd->ipath_irq) {
+                ipath_cdbg(VERBOSE, "unit %u free irq %d\n",
+                           dd->ipath_unit, dd->ipath_irq);
+                dd->ipath_f_free_irq(dd);
         } else
                 ipath_dbg("irq is 0, not doing free_irq "
                           "for unit %u\n", dd->ipath_unit);
@@ -2005,18 +2008,8 @@ static int __init infinipath_init(void)
                 goto bail_group;
         }
 
-        ret = ipath_diagpkt_add();
-        if (ret < 0) {
-                printk(KERN_ERR IPATH_DRV_NAME ": Unable to create "
-                       "diag data device: error %d\n", -ret);
-                goto bail_ipathfs;
-        }
-
         goto bail;
 
-bail_ipathfs:
-        ipath_exit_ipathfs();
-
 bail_group:
         ipath_driver_remove_group(&ipath_driver.driver);
 
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6110.c b/drivers/infiniband/hw/ipath/ipath_iba6110.c
index 9e4e8d4c6e20..e57c7a351cb5 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6110.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6110.c
@@ -38,6 +38,7 @@
 
 #include <linux/pci.h>
 #include <linux/delay.h>
+#include <linux/htirq.h>
 
 #include "ipath_kernel.h"
 #include "ipath_registers.h"
@@ -913,49 +914,40 @@ static void slave_or_pri_blk(struct ipath_devdata *dd, struct pci_dev *pdev,
         }
 }
 
-static int set_int_handler(struct ipath_devdata *dd, struct pci_dev *pdev,
-                            int pos)
+static int ipath_ht_intconfig(struct ipath_devdata *dd)
 {
-        u32 int_handler_addr_lower;
-        u32 int_handler_addr_upper;
-        u64 ihandler;
-        u32 intvec;
+        int ret;
 
-        /* use indirection register to get the intr handler */
-        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x10);
-        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_lower);
-        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x11);
-        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_upper);
+        if (dd->ipath_intconfig) {
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_interruptconfig,
+                                 dd->ipath_intconfig);  /* interrupt address */
+                ret = 0;
+        } else {
+                ipath_dev_err(dd, "No interrupts enabled, couldn't setup "
+                              "interrupt address\n");
+                ret = -EINVAL;
+        }
 
-        ihandler = (u64) int_handler_addr_lower |
-                ((u64) int_handler_addr_upper << 32);
+        return ret;
+}
+
+static void ipath_ht_irq_update(struct pci_dev *dev, int irq,
+                                struct ht_irq_msg *msg)
+{
+        struct ipath_devdata *dd = pci_get_drvdata(dev);
+        u64 prev_intconfig = dd->ipath_intconfig;
+
+        dd->ipath_intconfig = msg->address_lo;
+        dd->ipath_intconfig |= ((u64) msg->address_hi) << 32;
 
         /*
-         * kernels with CONFIG_PCI_MSI set the vector in the irq field of
-         * struct pci_device, so we use that to program the internal
-         * interrupt register (not config space) with that value. The BIOS
-         * must still have done the basic MSI setup.
-         */
-        intvec = pdev->irq;
-        /*
-         * clear any vector bits there; normally not set but we'll overload
-         * this for some debug purposes (setting the HTC debug register
-         * value from software, rather than GPIOs), so it might be set on a
-         * driver reload.
+         * If the previous value of dd->ipath_intconfig is zero, we're
+         * getting configured for the first time, and must not program the
+         * intconfig register here (it will be programmed later, when the
+         * hardware is ready).  Otherwise, we should.
          */
-        ihandler &= ~0xff0000;
-        /* x86 vector goes in intrinfo[23:16] */
-        ihandler |= intvec << 16;
-        ipath_cdbg(VERBOSE, "ihandler lower %x, upper %x, intvec %x, "
-                   "interruptconfig %llx\n", int_handler_addr_lower,
-                   int_handler_addr_upper, intvec,
-                   (unsigned long long) ihandler);
-
-        /* can't program yet, so save for interrupt setup */
-        dd->ipath_intconfig = ihandler;
-        /* keep going, so we find link control stuff also */
-
-        return ihandler != 0;
+        if (prev_intconfig)
+                ipath_ht_intconfig(dd);
 }
 
 /**
@@ -971,12 +963,19 @@ static int set_int_handler(struct ipath_devdata *dd, struct pci_dev *pdev,
 static int ipath_setup_ht_config(struct ipath_devdata *dd,
                                  struct pci_dev *pdev)
 {
-        int pos, ret = 0;
-        int ihandler = 0;
+        int pos, ret;
+
+        ret = __ht_create_irq(pdev, 0, ipath_ht_irq_update);
+        if (ret < 0) {
+                ipath_dev_err(dd, "Couldn't create interrupt handler: "
+                              "err %d\n", ret);
+                goto bail;
+        }
+        dd->ipath_irq = ret;
+        ret = 0;
 
         /*
-         * Read the capability info to find the interrupt info, and also
-         * handle clearing CRC errors in linkctrl register if necessary.  We
+         * Handle clearing CRC errors in linkctrl register if necessary.  We
          * do this early, before we ever enable errors or hardware errors,
          * mostly to avoid causing the chip to enter freeze mode.
          */
@@ -1000,17 +999,9 @@ static int ipath_setup_ht_config(struct ipath_devdata *dd,
                 }
                 if (!(cap_type & 0xE0))
                         slave_or_pri_blk(dd, pdev, pos, cap_type);
-                else if (cap_type == HT_INTR_DISC_CONFIG)
-                        ihandler = set_int_handler(dd, pdev, pos);
         } while ((pos = pci_find_next_capability(pdev, pos,
                                                  PCI_CAP_ID_HT)));
 
-        if (!ihandler) {
-                ipath_dev_err(dd, "Couldn't find interrupt handler in "
-                              "config space\n");
-                ret = -ENODEV;
-        }
-
 bail:
         return ret;
 }
@@ -1360,25 +1351,6 @@ static void ipath_ht_quiet_serdes(struct ipath_devdata *dd)
         ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
 }
 
-static int ipath_ht_intconfig(struct ipath_devdata *dd)
-{
-        int ret;
-
-        if (!dd->ipath_intconfig) {
-                ipath_dev_err(dd, "No interrupts enabled, couldn't setup "
-                              "interrupt address\n");
-                ret = 1;
-                goto bail;
-        }
-
-        ipath_write_kreg(dd, dd->ipath_kregs->kr_interruptconfig,
-                         dd->ipath_intconfig);  /* interrupt address */
-        ret = 0;
-
-bail:
-        return ret;
-}
-
 /**
  * ipath_pe_put_tid - write a TID in chip
  * @dd: the infinipath device
@@ -1575,6 +1547,14 @@ static int ipath_ht_get_base_info(struct ipath_portdata *pd, void *kbase)
         return 0;
 }
 
+static void ipath_ht_free_irq(struct ipath_devdata *dd)
+{
+        free_irq(dd->ipath_irq, dd);
+        ht_destroy_irq(dd->ipath_irq);
+        dd->ipath_irq = 0;
+        dd->ipath_intconfig = 0;
+}
+
 /**
  * ipath_init_iba6110_funcs - set up the chip-specific function pointers
  * @dd: the infinipath device
@@ -1598,6 +1578,7 @@ void ipath_init_iba6110_funcs(struct ipath_devdata *dd)
         dd->ipath_f_cleanup = ipath_setup_ht_cleanup;
         dd->ipath_f_setextled = ipath_setup_ht_setextled;
         dd->ipath_f_get_base_info = ipath_ht_get_base_info;
+        dd->ipath_f_free_irq = ipath_ht_free_irq;
 
         /*
          * initialize chip-specific variables
diff --git a/drivers/infiniband/hw/ipath/ipath_iba6120.c b/drivers/infiniband/hw/ipath/ipath_iba6120.c
index a72ab9de386a..6af89683f710 100644
--- a/drivers/infiniband/hw/ipath/ipath_iba6120.c
+++ b/drivers/infiniband/hw/ipath/ipath_iba6120.c
@@ -851,6 +851,7 @@ static int ipath_setup_pe_config(struct ipath_devdata *dd,
         int pos, ret;
 
         dd->ipath_msi_lo = 0;   /* used as a flag during reset processing */
+        dd->ipath_irq = pdev->irq;
         ret = pci_enable_msi(dd->pcidev);
         if (ret)
                 ipath_dev_err(dd, "pci_enable_msi failed: %d, "
@@ -1323,6 +1324,12 @@ done:
         return 0;
 }
 
+static void ipath_pe_free_irq(struct ipath_devdata *dd)
+{
+        free_irq(dd->ipath_irq, dd);
+        dd->ipath_irq = 0;
+}
+
 /**
  * ipath_init_iba6120_funcs - set up the chip-specific function pointers
  * @dd: the infinipath device
@@ -1349,6 +1356,7 @@ void ipath_init_iba6120_funcs(struct ipath_devdata *dd)
         dd->ipath_f_cleanup = ipath_setup_pe_cleanup;
         dd->ipath_f_setextled = ipath_setup_pe_setextled;
         dd->ipath_f_get_base_info = ipath_pe_get_base_info;
+        dd->ipath_f_free_irq = ipath_pe_free_irq;
 
         /* initialize chip-specific variables */
         dd->ipath_f_tidtemplate = ipath_pe_tidtemplate;
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index d9079ee12030..5652a550d442 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -710,14 +710,14 @@ static void ipath_bad_intr(struct ipath_devdata *dd, u32 * unexpectp)
                          * linuxbios development work, and it may happen in
                          * the future again.
                          */
-                        if (dd->pcidev && dd->pcidev->irq) {
+                        if (dd->pcidev && dd->ipath_irq) {
                                 ipath_dev_err(dd, "Now %u unexpected "
                                               "interrupts, unregistering "
                                               "interrupt handler\n",
                                               *unexpectp);
-                                ipath_dbg("free_irq of irq %x\n",
-                                          dd->pcidev->irq);
-                                free_irq(dd->pcidev->irq, dd);
+                                ipath_dbg("free_irq of irq %d\n",
+                                          dd->ipath_irq);
+                                dd->ipath_f_free_irq(dd);
                         }
                 }
                 if (ipath_read_kreg32(dd, dd->ipath_kregs->kr_intmask)) {
@@ -753,7 +753,7 @@ static void ipath_bad_regread(struct ipath_devdata *dd)
                 if (allbits == 2) {
                         ipath_dev_err(dd, "Still bad interrupt status, "
                                       "unregistering interrupt\n");
-                        free_irq(dd->pcidev->irq, dd);
+                        dd->ipath_f_free_irq(dd);
                 } else if (allbits > 2) {
                         if ((allbits % 10000) == 0)
                                 printk(".");
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 7c436697d0e4..986b2125b8f5 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -213,6 +213,8 @@ struct ipath_devdata {
         void (*ipath_f_setextled)(struct ipath_devdata *, u64, u64);
         /* fill out chip-specific fields */
         int (*ipath_f_get_base_info)(struct ipath_portdata *, void *);
+        /* free irq */
+        void (*ipath_f_free_irq)(struct ipath_devdata *);
         struct ipath_ibdev *verbs_dev;
         struct timer_list verbs_timer;
         /* total dwords sent (summed from counter) */
@@ -328,6 +330,8 @@ struct ipath_devdata {
         /* so we can rewrite it after a chip reset */
         u32 ipath_pcibar1;
 
+        /* interrupt number */
+        int ipath_irq;
         /* HT/PCI Vendor ID (here for NodeInfo) */
         u16 ipath_vendorid;
         /* HT/PCI Device ID (here for NodeInfo) */
@@ -869,9 +873,6 @@ int ipath_device_create_group(struct device *, struct ipath_devdata *);
 void ipath_device_remove_group(struct device *, struct ipath_devdata *);
 int ipath_expose_reset(struct device *);
 
-int ipath_diagpkt_add(void);
-void ipath_diagpkt_remove(void);
-
 int ipath_init_ipathfs(void);
 void ipath_exit_ipathfs(void);
 int ipathfs_add_device(struct ipath_devdata *);
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 99a94d710935..768df7265b81 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -1820,11 +1820,11 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
 
 #define MAD_IFC_BOX_SIZE      0x400
 #define MAD_IFC_MY_QPN_OFFSET 0x100
-#define MAD_IFC_RQPN_OFFSET   0x104
-#define MAD_IFC_SL_OFFSET     0x108
-#define MAD_IFC_G_PATH_OFFSET 0x109
-#define MAD_IFC_RLID_OFFSET   0x10a
-#define MAD_IFC_PKEY_OFFSET   0x10e
+#define MAD_IFC_RQPN_OFFSET   0x108
+#define MAD_IFC_SL_OFFSET     0x10c
+#define MAD_IFC_G_PATH_OFFSET 0x10d
+#define MAD_IFC_RLID_OFFSET   0x10e
+#define MAD_IFC_PKEY_OFFSET   0x112
 #define MAD_IFC_GRH_OFFSET    0x140
 
         inmailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
@@ -1862,7 +1862,7 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
 
                 val = in_wc->dlid_path_bits |
                         (in_wc->wc_flags & IB_WC_GRH ? 0x80 : 0);
-                MTHCA_PUT(inbox, val,               MAD_IFC_GRH_OFFSET);
+                MTHCA_PUT(inbox, val,               MAD_IFC_G_PATH_OFFSET);
 
                 MTHCA_PUT(inbox, in_wc->slid,       MAD_IFC_RLID_OFFSET);
                 MTHCA_PUT(inbox, in_wc->pkey_index, MAD_IFC_PKEY_OFFSET);
@@ -1870,7 +1870,7 @@ int mthca_MAD_IFC(struct mthca_dev *dev, int ignore_mkey, int ignore_bkey,
                 if (in_grh)
                         memcpy(inbox + MAD_IFC_GRH_OFFSET, in_grh, 40);
 
-                op_modifier |= 0x10;
+                op_modifier |= 0x4;
 
                 in_modifier |= in_wc->slid << 16;
         }
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index e393681ba7d4..149b36901239 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -39,6 +39,8 @@
 #include <linux/init.h>
 #include <linux/hardirq.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_pack.h>
 
 #include "mthca_dev.h"
@@ -210,6 +212,11 @@ static inline void update_cons_index(struct mthca_dev *dev, struct mthca_cq *cq,
                 mthca_write64(doorbell,
                               dev->kar + MTHCA_CQ_DOORBELL,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+                /*
+                 * Make sure doorbells don't leak out of CQ spinlock
+                 * and reach the HCA out of order:
+                 */
+                mmiowb();
         }
 }
 
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 5e5c58b9920b..6a7822e0fc19 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -39,6 +39,8 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 
+#include <asm/io.h>
+
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_cache.h>
 #include <rdma/ib_pack.h>
@@ -1732,6 +1734,11 @@ out:
                 mthca_write64(doorbell,
                               dev->kar + MTHCA_SEND_DOORBELL,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+                /*
+                 * Make sure doorbells don't leak out of SQ spinlock
+                 * and reach the HCA out of order:
+                 */
+                mmiowb();
         }
 
         qp->sq.next_ind = ind;
@@ -1851,6 +1858,12 @@ out:
         qp->rq.next_ind = ind;
         qp->rq.head    += nreq;
 
+        /*
+         * Make sure doorbells don't leak out of RQ spinlock and reach
+         * the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&qp->rq.lock, flags);
         return err;
 }
@@ -2112,6 +2125,12 @@ out:
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
         }
 
+        /*
+         * Make sure doorbells don't leak out of SQ spinlock and reach
+         * the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&qp->sq.lock, flags);
         return err;
 }
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 92a72f521528..f5d7677d1079 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -35,6 +35,8 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 
+#include <asm/io.h>
+
 #include "mthca_dev.h"
 #include "mthca_cmd.h"
 #include "mthca_memfree.h"
@@ -595,6 +597,12 @@ int mthca_tavor_post_srq_recv(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
                               MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
         }
 
+        /*
+         * Make sure doorbells don't leak out of SRQ spinlock and
+         * reach the HCA out of order:
+         */
+        mmiowb();
+
         spin_unlock_irqrestore(&srq->lock, flags);
         return err;
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 1eaf00e9862c..85522daeb946 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -49,6 +49,8 @@
 
 #include <net/dst.h>
 
+#define IPOIB_QPN(ha) (be32_to_cpup((__be32 *) ha) & 0xffffff)
+
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("IP-over-InfiniBand net driver");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -520,8 +522,7 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                 memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
                        sizeof(union ib_gid));
 
-                ipoib_send(dev, skb, path->ah,
-                           be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+                ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb->dst->neighbour->ha));
         } else {
                 neigh->ah  = NULL;
                 __skb_queue_tail(&neigh->queue, skb);
@@ -599,8 +600,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev,
                 ipoib_dbg(priv, "Send unicast ARP to %04x\n",
                           be16_to_cpu(path->pathrec.dlid));
 
-                ipoib_send(dev, skb, path->ah,
-                           be32_to_cpup((__be32 *) phdr->hwaddr));
+                ipoib_send(dev, skb, path->ah, IPOIB_QPN(phdr->hwaddr));
         } else if ((path->query || !path_rec_start(dev, path)) &&
                    skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) {
                 /* put pseudoheader back on for next time */
@@ -661,8 +661,7 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                 goto out;
                         }
 
-                        ipoib_send(dev, skb, neigh->ah,
-                                   be32_to_cpup((__be32 *) skb->dst->neighbour->ha));
+                        ipoib_send(dev, skb, neigh->ah, IPOIB_QPN(skb->dst->neighbour->ha));
                         goto out;
                 }
 
@@ -694,7 +693,7 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
                                            IPOIB_GID_FMT "\n",
                                            skb->dst ? "neigh" : "dst",
                                            be16_to_cpup((__be16 *) skb->data),
-                                           be32_to_cpup((__be32 *) phdr->hwaddr),
+                                           IPOIB_QPN(phdr->hwaddr),
                                            IPOIB_GID_RAW_ARG(phdr->hwaddr + 4));
                                 dev_kfree_skb_any(skb);
                                 ++priv->stats.tx_dropped;
@@ -777,7 +776,7 @@ static void ipoib_neigh_destructor(struct neighbour *n)
 
         ipoib_dbg(priv,
                   "neigh_destructor for %06x " IPOIB_GID_FMT "\n",
-                  be32_to_cpup((__be32 *) n->ha),
+                  IPOIB_QPN(n->ha),
                   IPOIB_GID_RAW_ARG(n->ha + 4));
 
         spin_lock_irqsave(&priv->lock, flags);
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c
index eb6f98d82289..9b2041e25d59 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.c
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.c
@@ -363,11 +363,11 @@ iscsi_iser_conn_start(struct iscsi_cls_conn *cls_conn)
         struct iscsi_conn *conn = cls_conn->dd_data;
         int err;
 
-        err = iscsi_conn_start(cls_conn);
+        err = iser_conn_set_full_featured_mode(conn);
         if (err)
                 return err;
 
-        return iser_conn_set_full_featured_mode(conn);
+        return iscsi_conn_start(cls_conn);
 }
 
 static struct iscsi_transport iscsi_iser_transport;
diff --git a/drivers/input/gameport/fm801-gp.c b/drivers/input/gameport/fm801-gp.c
index 90de5afe03c2..1dec00e20dbc 100644
--- a/drivers/input/gameport/fm801-gp.c
+++ b/drivers/input/gameport/fm801-gp.c
@@ -82,17 +82,19 @@ static int __devinit fm801_gp_probe(struct pci_dev *pci, const struct pci_device
 {
         struct fm801_gp *gp;
         struct gameport *port;
+        int error;
 
         gp = kzalloc(sizeof(struct fm801_gp), GFP_KERNEL);
         port = gameport_allocate_port();
         if (!gp || !port) {
                 printk(KERN_ERR "fm801-gp: Memory allocation failed\n");
-                kfree(gp);
-                gameport_free_port(port);
-                return -ENOMEM;
+                error = -ENOMEM;
+                goto err_out_free;
         }
 
-        pci_enable_device(pci);
+        error = pci_enable_device(pci);
+        if (error)
+                goto err_out_free;
 
         port->open = fm801_gp_open;
 #ifdef HAVE_COOKED
@@ -108,9 +110,8 @@ static int __devinit fm801_gp_probe(struct pci_dev *pci, const struct pci_device
         if (!gp->res_port) {
                 printk(KERN_DEBUG "fm801-gp: unable to grab region 0x%x-0x%x\n",
                         port->io, port->io + 0x0f);
-                gameport_free_port(port);
-                kfree(gp);
-                return -EBUSY;
+                error = -EBUSY;
+                goto err_out_disable_dev;
         }
 
         pci_set_drvdata(pci, gp);
@@ -119,6 +120,13 @@ static int __devinit fm801_gp_probe(struct pci_dev *pci, const struct pci_device
         gameport_register_port(port);
 
         return 0;
+
+ err_out_disable_dev:
+        pci_disable_device(pci);
+ err_out_free:
+        gameport_free_port(port);
+        kfree(gp);
+        return error;
 }
 
 static void __devexit fm801_gp_remove(struct pci_dev *pci)
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 3f47ae55c6f3..a0af97efe6ac 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -191,6 +191,8 @@ static void gameport_run_poll_handler(unsigned long d)
 
 static void gameport_bind_driver(struct gameport *gameport, struct gameport_driver *drv)
 {
+        int error;
+
         down_write(&gameport_bus.subsys.rwsem);
 
         gameport->dev.driver = &drv->driver;
@@ -198,8 +200,20 @@ static void gameport_bind_driver(struct gameport *gameport, struct gameport_driv
                 gameport->dev.driver = NULL;
                 goto out;
         }
-        device_bind_driver(&gameport->dev);
-out:
+
+        error = device_bind_driver(&gameport->dev);
+        if (error) {
+                printk(KERN_WARNING
+                        "gameport: device_bind_driver() failed "
+                        "for %s (%s) and %s, error: %d\n",
+                        gameport->phys, gameport->name,
+                        drv->description, error);
+                drv->disconnect(gameport);
+                gameport->dev.driver = NULL;
+                goto out;
+        }
+
+ out:
         up_write(&gameport_bus.subsys.rwsem);
 }
 
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index b6ef9eaad1dc..cbb93669d1ce 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -221,6 +221,7 @@ struct atkbd {
         unsigned long xl_bit;
         unsigned int last;
         unsigned long time;
+        unsigned long err_count;
 
         struct work_struct event_work;
         struct mutex event_mutex;
@@ -234,11 +235,13 @@ static ssize_t atkbd_attr_set_helper(struct device *dev, const char *buf, size_t
 #define ATKBD_DEFINE_ATTR(_name)                                                \
 static ssize_t atkbd_show_##_name(struct atkbd *, char *);                      \
 static ssize_t atkbd_set_##_name(struct atkbd *, const char *, size_t);         \
-static ssize_t atkbd_do_show_##_name(struct device *d, struct device_attribute *attr, char *b)                  \
+static ssize_t atkbd_do_show_##_name(struct device *d,                          \
+                                struct device_attribute *attr, char *b)         \
 {                                                                               \
         return atkbd_attr_show_helper(d, b, atkbd_show_##_name);                \
 }                                                                               \
-static ssize_t atkbd_do_set_##_name(struct device *d, struct device_attribute *attr, const char *b, size_t s)   \
+static ssize_t atkbd_do_set_##_name(struct device *d,                           \
+                        struct device_attribute *attr, const char *b, size_t s) \
 {                                                                               \
         return atkbd_attr_set_helper(d, b, s, atkbd_set_##_name);               \
 }                                                                               \
@@ -251,6 +254,32 @@ ATKBD_DEFINE_ATTR(set);
 ATKBD_DEFINE_ATTR(softrepeat);
 ATKBD_DEFINE_ATTR(softraw);
 
+#define ATKBD_DEFINE_RO_ATTR(_name)                                             \
+static ssize_t atkbd_show_##_name(struct atkbd *, char *);                      \
+static ssize_t atkbd_do_show_##_name(struct device *d,                          \
+                                struct device_attribute *attr, char *b)         \
+{                                                                               \
+        return atkbd_attr_show_helper(d, b, atkbd_show_##_name);                \
+}                                                                               \
+static struct device_attribute atkbd_attr_##_name =                             \
+        __ATTR(_name, S_IRUGO, atkbd_do_show_##_name, NULL);
+
+ATKBD_DEFINE_RO_ATTR(err_count);
+
+static struct attribute *atkbd_attributes[] = {
+        &atkbd_attr_extra.attr,
+        &atkbd_attr_scroll.attr,
+        &atkbd_attr_set.attr,
+        &atkbd_attr_softrepeat.attr,
+        &atkbd_attr_softraw.attr,
+        &atkbd_attr_err_count.attr,
+        NULL
+};
+
+static struct attribute_group atkbd_attribute_group = {
+        .attrs  = atkbd_attributes,
+};
+
 static const unsigned int xl_table[] = {
         ATKBD_RET_BAT, ATKBD_RET_ERR, ATKBD_RET_ACK,
         ATKBD_RET_NAK, ATKBD_RET_HANJA, ATKBD_RET_HANGEUL,
@@ -396,7 +425,10 @@ static irqreturn_t atkbd_interrupt(struct serio *serio, unsigned char data,
                         add_release_event = 1;
                         break;
                 case ATKBD_RET_ERR:
+                        atkbd->err_count++;
+#ifdef ATKBD_DEBUG
                         printk(KERN_DEBUG "atkbd.c: Keyboard on %s reports too many keys pressed.\n", serio->phys);
+#endif
                         goto out;
         }
 
@@ -786,12 +818,7 @@ static void atkbd_disconnect(struct serio *serio)
         synchronize_sched();  /* Allow atkbd_interrupt()s to complete. */
         flush_scheduled_work();
 
-        device_remove_file(&serio->dev, &atkbd_attr_extra);
-        device_remove_file(&serio->dev, &atkbd_attr_scroll);
-        device_remove_file(&serio->dev, &atkbd_attr_set);
-        device_remove_file(&serio->dev, &atkbd_attr_softrepeat);
-        device_remove_file(&serio->dev, &atkbd_attr_softraw);
-
+        sysfs_remove_group(&serio->dev.kobj, &atkbd_attribute_group);
         input_unregister_device(atkbd->dev);
         serio_close(serio);
         serio_set_drvdata(serio, NULL);
@@ -961,11 +988,7 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
         atkbd_set_keycode_table(atkbd);
         atkbd_set_device_attrs(atkbd);
 
-        device_create_file(&serio->dev, &atkbd_attr_extra);
-        device_create_file(&serio->dev, &atkbd_attr_scroll);
-        device_create_file(&serio->dev, &atkbd_attr_set);
-        device_create_file(&serio->dev, &atkbd_attr_softrepeat);
-        device_create_file(&serio->dev, &atkbd_attr_softraw);
+        sysfs_create_group(&serio->dev.kobj, &atkbd_attribute_group);
 
         atkbd_enable(atkbd);
 
@@ -1259,6 +1282,11 @@ static ssize_t atkbd_set_softraw(struct atkbd *atkbd, const char *buf, size_t co
         return count;
 }
 
+static ssize_t atkbd_show_err_count(struct atkbd *atkbd, char *buf)
+{
+        return sprintf(buf, "%lu\n", atkbd->err_count);
+}
+
 
 static int __init atkbd_init(void)
 {
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
index cb70970625b5..befdd6006b50 100644
--- a/drivers/input/keyboard/corgikbd.c
+++ b/drivers/input/keyboard/corgikbd.c
@@ -207,7 +207,7 @@ static irqreturn_t corgikbd_interrupt(int irq, void *dev_id)
 static void corgikbd_timer_callback(unsigned long data)
 {
         struct corgikbd *corgikbd_data = (struct corgikbd *) data;
-        corgikbd_scankeyboard(corgikbd_data, NULL);
+        corgikbd_scankeyboard(corgikbd_data);
 }
 
 /*
diff --git a/drivers/input/keyboard/lkkbd.c b/drivers/input/keyboard/lkkbd.c
index 708d5a1bc3d2..979b93e33da7 100644
--- a/drivers/input/keyboard/lkkbd.c
+++ b/drivers/input/keyboard/lkkbd.c
@@ -59,11 +59,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
- * Should you need to contact me, the author, you can do so either by
- * email or by paper mail:
- * Jan-Benedict Glaw, Lilienstraße 16, 33790 Hörste (near Halle/Westf.),
- * Germany.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/input/keyboard/locomokbd.c b/drivers/input/keyboard/locomokbd.c
index fd33c9cc3272..5788dbc317bb 100644
--- a/drivers/input/keyboard/locomokbd.c
+++ b/drivers/input/keyboard/locomokbd.c
@@ -186,7 +186,7 @@ static irqreturn_t locomokbd_interrupt(int irq, void *dev_id)
 static void locomokbd_timer_callback(unsigned long data)
 {
         struct locomokbd *locomokbd = (struct locomokbd *) data;
-        locomokbd_scankeyboard(locomokbd, NULL);
+        locomokbd_scankeyboard(locomokbd);
 }
 
 static int locomokbd_probe(struct locomo_dev *dev)
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index 8b18c009e3e0..28b2748e82d0 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -257,7 +257,7 @@ static void spitzkbd_timer_callback(unsigned long data)
 {
         struct spitzkbd *spitzkbd_data = (struct spitzkbd *) data;
 
-        spitzkbd_scankeyboard(spitzkbd_data, NULL);
+        spitzkbd_scankeyboard(spitzkbd_data);
 }
 
 /*
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index 1be963961c15..ab4da79ee560 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -60,7 +60,7 @@ static struct fasync_struct *hp_sdc_rtc_async_queue;
 
 static DECLARE_WAIT_QUEUE_HEAD(hp_sdc_rtc_wait);
 
-static ssize_t hp_sdc_rtc_read(struct file *file, char *buf,
+static ssize_t hp_sdc_rtc_read(struct file *file, char __user *buf,
                                size_t count, loff_t *ppos);
 
 static int hp_sdc_rtc_ioctl(struct inode *inode, struct file *file,
@@ -385,14 +385,14 @@ static int hp_sdc_rtc_set_i8042timer (struct timeval *setto, uint8_t setcmd)
         return 0;
 }
 
-static ssize_t hp_sdc_rtc_read(struct file *file, char *buf,
+static ssize_t hp_sdc_rtc_read(struct file *file, char __user *buf,
                                size_t count, loff_t *ppos) {
         ssize_t retval;
 
         if (count < sizeof(unsigned long))
                 return -EINVAL;
 
-        retval = put_user(68, (unsigned long *)buf);
+        retval = put_user(68, (unsigned long __user *)buf);
         return retval;
 }
 
@@ -696,7 +696,7 @@ static int __init hp_sdc_rtc_init(void)
         if ((ret = hp_sdc_request_timer_irq(&hp_sdc_rtc_isr)))
                 return ret;
         misc_register(&hp_sdc_rtc_dev);
-        create_proc_read_entry ("driver/rtc", 0, 0, 
+        create_proc_read_entry ("driver/rtc", 0, NULL,
                                 hp_sdc_rtc_read_proc, NULL);
 
         printk(KERN_INFO "HP i8042 SDC + MSM-58321 RTC support loaded "
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 4639537336fc..7b9d1c1da41a 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 59 Temple Place Suite 330, Boston, MA 02111-1307, USA.
  */
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/input.h>
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index bdfde046b741..49e11e2c1d5d 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -391,23 +391,23 @@ static int hilse_operate(hil_mlc *mlc, int repoll) {
 }
 
 #define FUNC(funct, funct_arg, zero_rc, neg_rc, pos_rc) \
-{ HILSE_FUNC,           { func: &funct }, funct_arg, zero_rc, neg_rc, pos_rc },
+{ HILSE_FUNC,           { .func = funct }, funct_arg, zero_rc, neg_rc, pos_rc },
 #define OUT(pack) \
-{ HILSE_OUT,            { packet: pack }, 0, HILSEN_NEXT, HILSEN_DOZE, 0 },
+{ HILSE_OUT,            { .packet = pack }, 0, HILSEN_NEXT, HILSEN_DOZE, 0 },
 #define CTS \
-{ HILSE_CTS,            { packet: 0    }, 0, HILSEN_NEXT | HILSEN_SCHED | HILSEN_BREAK, HILSEN_DOZE, 0 },
+{ HILSE_CTS,            { .packet = 0    }, 0, HILSEN_NEXT | HILSEN_SCHED | HILSEN_BREAK, HILSEN_DOZE, 0 },
 #define EXPECT(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT,         { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT,         { .packet = comp }, to, got, got_wrong, timed_out },
 #define EXPECT_LAST(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT_LAST,    { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT_LAST,    { .packet = comp }, to, got, got_wrong, timed_out },
 #define EXPECT_DISC(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT_DISC,    { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT_DISC,    { .packet = comp }, to, got, got_wrong, timed_out },
 #define IN(to, got, got_error, timed_out) \
-{ HILSE_IN,             { packet: 0    }, to, got, got_error, timed_out },
+{ HILSE_IN,             { .packet = 0    }, to, got, got_error, timed_out },
 #define OUT_DISC(pack) \
-{ HILSE_OUT_DISC,       { packet: pack }, 0, 0, 0, 0 },
+{ HILSE_OUT_DISC,       { .packet = pack }, 0, 0, 0, 0 },
 #define OUT_LAST(pack) \
-{ HILSE_OUT_LAST,       { packet: pack }, 0, 0, 0, 0 },
+{ HILSE_OUT_LAST,       { .packet = pack }, 0, 0, 0, 0 },
 
 struct hilse_node hil_mlc_se[HILSEN_END] = {
 
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index ba7b920347e3..9907ad3bea23 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -310,7 +310,7 @@ static void hp_sdc_tasklet(unsigned long foo) {
                                  * in tasklet/bh context.
                                  */
                                 if (curr->act.irqhook) 
-                                        curr->act.irqhook(0, 0, 0, 0);
+                                        curr->act.irqhook(0, NULL, 0, 0);
                         }
                         curr->actidx = curr->idx;
                         curr->idx++;
@@ -525,7 +525,7 @@ actdone:
                 up(curr->act.semaphore);
         }
         else if (act & HP_SDC_ACT_CALLBACK) {
-                curr->act.irqhook(0,0,0,0);
+                curr->act.irqhook(0,NULL,0,0);
         }
         if (curr->idx >= curr->endidx) { /* This transaction is over. */
                 if (act & HP_SDC_ACT_DEALLOC) kfree(curr);
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 09b06e605b50..7e3141f37e32 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -106,6 +106,7 @@ static unsigned char i8042_ctr;
 static unsigned char i8042_mux_present;
 static unsigned char i8042_kbd_irq_registered;
 static unsigned char i8042_aux_irq_registered;
+static unsigned char i8042_suppress_kbd_ack;
 static struct platform_device *i8042_platform_device;
 
 static irqreturn_t i8042_interrupt(int irq, void *dev_id);
@@ -316,7 +317,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
         unsigned char str, data;
         unsigned int dfl;
         unsigned int port_no;
-        int ret;
+        int ret = 1;
 
         spin_lock_irqsave(&i8042_lock, flags);
         str = i8042_read_status();
@@ -378,10 +379,16 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
             dfl & SERIO_PARITY ? ", bad parity" : "",
             dfl & SERIO_TIMEOUT ? ", timeout" : "");
 
+        if (unlikely(i8042_suppress_kbd_ack))
+                if (port_no == I8042_KBD_PORT_NO &&
+                    (data == 0xfa || data == 0xfe)) {
+                        i8042_suppress_kbd_ack = 0;
+                        goto out;
+                }
+
         if (likely(port->exists))
                 serio_interrupt(port->serio, data, dfl);
 
-        ret = 1;
  out:
         return IRQ_RETVAL(ret);
 }
@@ -842,11 +849,13 @@ static long i8042_panic_blink(long count)
         led ^= 0x01 | 0x04;
         while (i8042_read_status() & I8042_STR_IBF)
                 DELAY;
+        i8042_suppress_kbd_ack = 1;
         i8042_write_data(0xed); /* set leds */
         DELAY;
         while (i8042_read_status() & I8042_STR_IBF)
                 DELAY;
         DELAY;
+        i8042_suppress_kbd_ack = 1;
         i8042_write_data(led);
         DELAY;
         last_blink = count;
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index dcb16b5cbec0..e5b1b60757bb 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -189,7 +189,7 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
                 return -1;
         }
 
-        mutex_lock_nested(&ps2dev->cmd_mutex, SINGLE_DEPTH_NESTING);
+        mutex_lock(&ps2dev->cmd_mutex);
 
         serio_pause_rx(ps2dev->serio);
         ps2dev->flags = command == PS2_CMD_GETID ? PS2_FLAG_WAITID : 0;
@@ -296,6 +296,7 @@ EXPORT_SYMBOL(ps2_schedule_command);
 void ps2_init(struct ps2dev *ps2dev, struct serio *serio)
 {
         mutex_init(&ps2dev->cmd_mutex);
+        lockdep_set_subclass(&ps2dev->cmd_mutex, serio->depth);
         init_waitqueue_head(&ps2dev->wait);
         ps2dev->serio = serio;
 }
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 960fae3c3cea..211943f85cb6 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -118,6 +118,8 @@ static int serio_match_port(const struct serio_device_id *ids, struct serio *ser
 
 static void serio_bind_driver(struct serio *serio, struct serio_driver *drv)
 {
+        int error;
+
         down_write(&serio_bus.subsys.rwsem);
 
         if (serio_match_port(drv->id_table, serio)) {
@@ -126,9 +128,19 @@ static void serio_bind_driver(struct serio *serio, struct serio_driver *drv)
                         serio->dev.driver = NULL;
                         goto out;
                 }
-                device_bind_driver(&serio->dev);
+                error = device_bind_driver(&serio->dev);
+                if (error) {
+                        printk(KERN_WARNING
+                                "serio: device_bind_driver() failed "
+                                "for %s (%s) and %s, error: %d\n",
+                                serio->phys, serio->name,
+                                drv->description, error);
+                        serio_disconnect_driver(serio);
+                        serio->dev.driver = NULL;
+                        goto out;
+                }
         }
-out:
+ out:
         up_write(&serio_bus.subsys.rwsem);
 }
 
@@ -538,8 +550,12 @@ static void serio_init_port(struct serio *serio)
                  "serio%ld", (long)atomic_inc_return(&serio_no) - 1);
         serio->dev.bus = &serio_bus;
         serio->dev.release = serio_release_port;
-        if (serio->parent)
+        if (serio->parent) {
                 serio->dev.parent = &serio->parent->dev;
+                serio->depth = serio->parent->depth + 1;
+        } else
+                serio->depth = 0;
+        lockdep_set_subclass(&serio->lock, serio->depth);
 }
 
 /*
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
index ca79b2246195..66121f6a89ad 100644
--- a/drivers/input/touchscreen/corgi_ts.c
+++ b/drivers/input/touchscreen/corgi_ts.c
@@ -219,7 +219,7 @@ static void ts_interrupt_main(struct corgi_ts *corgi_ts, int isTimer)
 static void corgi_ts_timer(unsigned long data)
 {
         struct corgi_ts *corgits_data = (struct corgi_ts *) data;
-        ts_interrupt_main(corgits_data, 1, NULL);
+        ts_interrupt_main(corgits_data, 1);
 }
 
 static irqreturn_t ts_interrupt(int irq, void *dev_id)
@@ -237,7 +237,7 @@ static int corgits_suspend(struct platform_device *dev, pm_message_t state)
         if (corgi_ts->pendown) {
                 del_timer_sync(&corgi_ts->timer);
                 corgi_ts->tc.pressure = 0;
-                new_data(corgi_ts, NULL);
+                new_data(corgi_ts);
                 corgi_ts->pendown = 0;
         }
         corgi_ts->power_mode = PWR_MODE_SUSPEND;
diff --git a/drivers/input/touchscreen/hp680_ts_input.c b/drivers/input/touchscreen/hp680_ts_input.c
index e31c6c55b2e2..58fca316786c 100644
--- a/drivers/input/touchscreen/hp680_ts_input.c
+++ b/drivers/input/touchscreen/hp680_ts_input.c
@@ -6,7 +6,7 @@
 #include <asm/io.h>
 #include <asm/delay.h>
 #include <asm/adc.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 
 #define MODNAME "hp680_ts_input"
 
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index d10c8b82e6aa..b6f9476c0501 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, int len, int id, int channel)
         }
 
         for (p=buf, count=0; count < len; p++, count++) {
-                put_user(*card->q931_read++, p);
+                if (put_user(*card->q931_read++, p))
+                        return -EFAULT;
                 if (card->q931_read > card->q931_end)
                         card->q931_read = card->q931_buf;
         }
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index aca165d43aa0..5800beeebb85 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -616,7 +616,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         } else if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else {
-                dev_warn(cs->dev, "could not allocate skb\n");
+                warn("could not allocate skb\n");
                 bcs->inputstate |= INS_skip_frame;
         }
 
diff --git a/drivers/isdn/hisax/Kconfig b/drivers/isdn/hisax/Kconfig
index eb57a988e048..cfd2718a490d 100644
--- a/drivers/isdn/hisax/Kconfig
+++ b/drivers/isdn/hisax/Kconfig
@@ -344,7 +344,7 @@ config HISAX_HFC_SX
 
 config HISAX_ENTERNOW_PCI
         bool "Formula-n enter:now PCI card"
-        depends on PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || FRV))
+        depends on HISAX_NETJET && PCI && (BROKEN || !(SPARC || PPC || PARISC || M68K || FRV))
         help
           This enables HiSax support for the Formula-n enter:now PCI
           ISDN card.
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index e4823ab2b127..785b08554fca 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
                 count = cs->status_end - cs->status_read + 1;
                 if (count >= len)
                         count = len;
-                copy_to_user(p, cs->status_read, count);
+                if (copy_to_user(p, cs->status_read, count))
+                        return -EFAULT;
                 cs->status_read += count;
                 if (cs->status_read > cs->status_end)
                         cs->status_read = cs->status_buf;
@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
                                 cnt = HISAX_STATUS_BUFSIZE;
                         else
                                 cnt = count;
-                        copy_to_user(p, cs->status_read, cnt);
+                        if (copy_to_user(p, cs->status_read, cnt))
+                                return -EFAULT;
                         p += cnt;
                         cs->status_read += cnt % HISAX_STATUS_BUFSIZE;
                         count -= cnt;
diff --git a/drivers/isdn/hisax/diva.c b/drivers/isdn/hisax/diva.c
index 7e95f04f13da..3dacfff93f5f 100644
--- a/drivers/isdn/hisax/diva.c
+++ b/drivers/isdn/hisax/diva.c
@@ -716,8 +716,10 @@ release_io_diva(struct IsdnCardState *cs)
 
                 *cfg = 0; /* disable INT0/1 */ 
                 *cfg = 2; /* reset pending INT0 */
-                iounmap((void *)cs->hw.diva.cfg_reg);
-                iounmap((void *)cs->hw.diva.pci_cfg);
+                if (cs->hw.diva.cfg_reg)
+                        iounmap((void *)cs->hw.diva.cfg_reg);
+                if (cs->hw.diva.pci_cfg)
+                        iounmap((void *)cs->hw.diva.pci_cfg);
                 return;
         } else if (cs->subtyp != DIVA_IPAC_ISA) {
                 del_timer(&cs->hw.diva.tl);
@@ -734,6 +736,23 @@ release_io_diva(struct IsdnCardState *cs)
 }
 
 static void
+iounmap_diva(struct IsdnCardState *cs)
+{
+        if ((cs->subtyp == DIVA_IPAC_PCI) || (cs->subtyp == DIVA_IPACX_PCI)) {
+                if (cs->hw.diva.cfg_reg) {
+                        iounmap((void *)cs->hw.diva.cfg_reg);
+                        cs->hw.diva.cfg_reg = 0;
+                }
+                if (cs->hw.diva.pci_cfg) {
+                        iounmap((void *)cs->hw.diva.pci_cfg);
+                        cs->hw.diva.pci_cfg = 0;
+                }
+        }
+
+        return;
+}
+
+static void
 reset_diva(struct IsdnCardState *cs)
 {
         if (cs->subtyp == DIVA_IPAC_ISA) {
@@ -1069,11 +1088,13 @@ setup_diva(struct IsdnCard *card)
 
                 if (!cs->irq) {
                         printk(KERN_WARNING "Diva: No IRQ for PCI card found\n");
+                        iounmap_diva(cs);
                         return(0);
                 }
 
                 if (!cs->hw.diva.cfg_reg) {
                         printk(KERN_WARNING "Diva: No IO-Adr for PCI card found\n");
+                        iounmap_diva(cs);
                         return(0);
                 }
                 cs->irq_flags |= IRQF_SHARED;
@@ -1123,6 +1144,7 @@ ready:
                                CardType[card->typ],
                                cs->hw.diva.cfg_reg,
                                cs->hw.diva.cfg_reg + bytecnt);
+                        iounmap_diva(cs);
                         return (0);
                 }
         }
diff --git a/drivers/isdn/hysdn/boardergo.c b/drivers/isdn/hysdn/boardergo.c
index 160f22fa5941..82e42a80dc4b 100644
--- a/drivers/isdn/hysdn/boardergo.c
+++ b/drivers/isdn/hysdn/boardergo.c
@@ -45,11 +45,10 @@ ergo_interrupt(int intno, void *dev_id)
         if (!card->irq_enabled)
                 return IRQ_NONE;                /* other device interrupting or irq switched off */
 
-        save_flags(flags);
-        cli();                  /* no further irqs allowed */
+        spin_lock_irqsave(&card->hysdn_lock, flags); /* no further irqs allowed */
 
         if (!(bytein(card->iobase + PCI9050_INTR_REG) & PCI9050_INTR_REG_STAT1)) {
-                restore_flags(flags);   /* restore old state */
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);       /* restore old state */
                 return IRQ_NONE;                /* no interrupt requested by E1 */
         }
         /* clear any pending ints on the board */
@@ -61,7 +60,7 @@ ergo_interrupt(int intno, void *dev_id)
         /* start kernel task immediately after leaving all interrupts */
         if (!card->hw_lock)
                 schedule_work(&card->irq_queue);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
         return IRQ_HANDLED;
 }                               /* ergo_interrupt */
 
@@ -83,10 +82,9 @@ ergo_irq_bh(hysdn_card * card)
 
         dpr = card->dpram;      /* point to DPRAM */
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->hysdn_lock, flags);
         if (card->hw_lock) {
-                restore_flags(flags);   /* hardware currently unavailable */
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);       /* hardware currently unavailable */
                 return;
         }
         card->hw_lock = 1;      /* we now lock the hardware */
@@ -120,7 +118,7 @@ ergo_irq_bh(hysdn_card * card)
                         card->hw_lock = 0;      /* free hardware again */
         } while (again);        /* until nothing more to do */
 
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 }                               /* ergo_irq_bh */
 
 
@@ -137,8 +135,7 @@ ergo_stopcard(hysdn_card * card)
 #ifdef CONFIG_HYSDN_CAPI
         hycapi_capi_stop(card);
 #endif /* CONFIG_HYSDN_CAPI */
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->hysdn_lock, flags);
         val = bytein(card->iobase + PCI9050_INTR_REG);  /* get actual value */
         val &= ~(PCI9050_INTR_REG_ENPCI | PCI9050_INTR_REG_EN1);        /* mask irq */
         byteout(card->iobase + PCI9050_INTR_REG, val);
@@ -147,7 +144,7 @@ ergo_stopcard(hysdn_card * card)
         card->state = CARD_STATE_UNUSED;
         card->err_log_state = ERRLOG_STATE_OFF;         /* currently no log active */
 
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 }                               /* ergo_stopcard */
 
 /**************************************************************************/
@@ -162,12 +159,11 @@ ergo_set_errlog_state(hysdn_card * card, int on)
                 card->err_log_state = ERRLOG_STATE_OFF;         /* must be off */
                 return;
         }
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->hysdn_lock, flags);
 
         if (((card->err_log_state == ERRLOG_STATE_OFF) && !on) ||
             ((card->err_log_state == ERRLOG_STATE_ON) && on)) {
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);
                 return;         /* nothing to do */
         }
         if (on)
@@ -175,7 +171,7 @@ ergo_set_errlog_state(hysdn_card * card, int on)
         else
                 card->err_log_state = ERRLOG_STATE_STOP;        /* request stop */
 
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
         schedule_work(&card->irq_queue);
 }                               /* ergo_set_errlog_state */
 
@@ -356,8 +352,7 @@ ergo_waitpofready(struct HYSDN_CARD *card)
 
                         if (card->debug_flags & LOG_POF_RECORD)
                                 hysdn_addlog(card, "ERGO: pof boot success");
-                        save_flags(flags);
-                        cli();
+                        spin_lock_irqsave(&card->hysdn_lock, flags);
 
                         card->state = CARD_STATE_RUN;   /* now card is running */
                         /* enable the cards interrupt */
@@ -370,7 +365,7 @@ ergo_waitpofready(struct HYSDN_CARD *card)
                         dpr->ToHyInt = 1;
                         dpr->ToPcInt = 1;       /* interrupt to E1 for all cards */
 
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->hysdn_lock, flags);
                         if ((hynet_enable & (1 << card->myid)) 
                             && (i = hysdn_net_create(card))) 
                         {
@@ -408,7 +403,7 @@ ergo_releasehardware(hysdn_card * card)
         free_irq(card->irq, card);      /* release interrupt */
         release_region(card->iobase + PCI9050_INTR_REG, 1);     /* release all io ports */
         release_region(card->iobase + PCI9050_USER_IO, 1);
-        vfree(card->dpram);
+        iounmap(card->dpram);
         card->dpram = NULL;     /* release shared mem */
 }                               /* ergo_releasehardware */
 
@@ -448,6 +443,7 @@ ergo_inithardware(hysdn_card * card)
         card->waitpofready = ergo_waitpofready;
         card->set_errlog_state = ergo_set_errlog_state;
         INIT_WORK(&card->irq_queue, (void *) (void *) ergo_irq_bh, card);
+        card->hysdn_lock = SPIN_LOCK_UNLOCKED;
 
         return (0);
 }                               /* ergo_inithardware */
diff --git a/drivers/isdn/hysdn/hysdn_defs.h b/drivers/isdn/hysdn/hysdn_defs.h
index 461e831592dd..729df4089385 100644
--- a/drivers/isdn/hysdn/hysdn_defs.h
+++ b/drivers/isdn/hysdn/hysdn_defs.h
@@ -188,6 +188,8 @@ typedef struct HYSDN_CARD {
         /* init and deinit stopcard for booting, too */
         void (*stopcard) (struct HYSDN_CARD *);
         void (*releasehardware) (struct HYSDN_CARD *);
+
+        spinlock_t hysdn_lock;
 #ifdef CONFIG_HYSDN_CAPI
         struct hycapictrl_info {
                 char cardname[32];
diff --git a/drivers/isdn/hysdn/hysdn_proclog.c b/drivers/isdn/hysdn/hysdn_proclog.c
index c4301e8338ef..fcd49920b220 100644
--- a/drivers/isdn/hysdn/hysdn_proclog.c
+++ b/drivers/isdn/hysdn/hysdn_proclog.c
@@ -116,8 +116,7 @@ put_log_buffer(hysdn_card * card, char *cp)
         strcpy(ib->log_start, cp);      /* set output string */
         ib->next = NULL;
         ib->proc_ctrl = pd;     /* point to own control structure */
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->hysdn_lock, flags);
         ib->usage_cnt = pd->if_used;
         if (!pd->log_head)
                 pd->log_head = ib;      /* new head */
@@ -125,7 +124,7 @@ put_log_buffer(hysdn_card * card, char *cp)
                 pd->log_tail->next = ib;        /* follows existing messages */
         pd->log_tail = ib;      /* new tail */
         i = pd->del_lock++;     /* get lock state */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 
         /* delete old entrys */
         if (!i)
@@ -270,14 +269,13 @@ hysdn_log_open(struct inode *ino, struct file *filep)
         } else if ((filep->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
 
                 /* read access -> log/debug read */
-                save_flags(flags);
-                cli();
+                spin_lock_irqsave(&card->hysdn_lock, flags);
                 pd->if_used++;
                 if (pd->log_head)
                         filep->private_data = &pd->log_tail->next;
                 else
                         filep->private_data = &pd->log_head;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);
         } else {                /* simultaneous read/write access forbidden ! */
                 unlock_kernel();
                 return (-EPERM);        /* no permission this time */
@@ -301,7 +299,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
         hysdn_card *card;
         int retval = 0;
         unsigned long flags;
-
+        spinlock_t hysdn_lock = SPIN_LOCK_UNLOCKED;
 
         lock_kernel();
         if ((filep->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_WRITE) {
@@ -311,8 +309,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
                 /* read access -> log/debug read, mark one further file as closed */
 
                 pd = NULL;
-                save_flags(flags);
-                cli();
+                spin_lock_irqsave(&hysdn_lock, flags);
                 inf = *((struct log_data **) filep->private_data);      /* get first log entry */
                 if (inf)
                         pd = (struct procdata *) inf->proc_ctrl;        /* still entries there */
@@ -335,7 +332,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
                         inf->usage_cnt--;       /* decrement usage count for buffers */
                         inf = inf->next;
                 }
-                restore_flags(flags);
+                spin_unlock_irqrestore(&hysdn_lock, flags);
 
                 if (pd)
                         if (pd->if_used <= 0)   /* delete buffers if last file closed */
diff --git a/drivers/isdn/hysdn/hysdn_sched.c b/drivers/isdn/hysdn/hysdn_sched.c
index 1c0d54ac12ab..18758772b744 100644
--- a/drivers/isdn/hysdn/hysdn_sched.c
+++ b/drivers/isdn/hysdn/hysdn_sched.c
@@ -155,22 +155,17 @@ hysdn_tx_cfgline(hysdn_card *card, unsigned char *line, unsigned short chan)
         if (card->debug_flags & LOG_SCHED_ASYN)
                 hysdn_addlog(card, "async tx-cfg chan=%d len=%d", chan, strlen(line) + 1);
 
-        save_flags(flags);
-        cli();
         while (card->async_busy) {
-                sti();
 
                 if (card->debug_flags & LOG_SCHED_ASYN)
                         hysdn_addlog(card, "async tx-cfg delayed");
 
                 msleep_interruptible(20);               /* Timeout 20ms */
-                if (!--cnt) {
-                        restore_flags(flags);
+                if (!--cnt)
                         return (-ERR_ASYNC_TIME);       /* timed out */
-                }
-                cli();
         }                       /* wait for buffer to become free */
 
+        spin_lock_irqsave(&card->hysdn_lock, flags);
         strcpy(card->async_data, line);
         card->async_len = strlen(line) + 1;
         card->async_channel = chan;
@@ -178,30 +173,23 @@ hysdn_tx_cfgline(hysdn_card *card, unsigned char *line, unsigned short chan)
 
         /* now queue the task */
         schedule_work(&card->irq_queue);
-        sti();
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 
         if (card->debug_flags & LOG_SCHED_ASYN)
                 hysdn_addlog(card, "async tx-cfg data queued");
 
         cnt++;                  /* short delay */
-        cli();
 
         while (card->async_busy) {
-                sti();
 
                 if (card->debug_flags & LOG_SCHED_ASYN)
                         hysdn_addlog(card, "async tx-cfg waiting for tx-ready");
 
                 msleep_interruptible(20);               /* Timeout 20ms */
-                if (!--cnt) {
-                        restore_flags(flags);
+                if (!--cnt)
                         return (-ERR_ASYNC_TIME);       /* timed out */
-                }
-                cli();
         }                       /* wait for buffer to become free again */
 
-        restore_flags(flags);
-
         if (card->debug_flags & LOG_SCHED_ASYN)
                 hysdn_addlog(card, "async tx-cfg data send");
 
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index c3d79eef9e32..69aee2602aa6 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
                 if (dev->drv[drvidx]->interface->readstat) {
                         if (count > dev->drv[drvidx]->stavail)
                                 count = dev->drv[drvidx]->stavail;
-                        len = dev->drv[drvidx]->interface->
-                                readstat(buf, count, drvidx,
-                                         isdn_minor2chan(minor));
+                        len = dev->drv[drvidx]->interface->readstat(buf, count,
+                                                drvidx, isdn_minor2chan(minor));
+                        if (len < 0) {
+                                retval = len;
+                                goto out;
+                        }
                 } else {
                         len = 0;
                 }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6649f8bc9951..730bbd07ebc7 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int len, icn_card * card)
         for (p = buf, count = 0; count < len; p++, count++) {
                 if (card->msg_buf_read == card->msg_buf_write)
                         return count;
-                put_user(*card->msg_buf_read++, p);
+                if (put_user(*card->msg_buf_read++, p))
+                        return -EFAULT;
                 if (card->msg_buf_read > card->msg_buf_end)
                         card->msg_buf_read = card->msg_buf;
         }
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index fabbd461603e..c3ae2edaf6fa 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -100,12 +100,11 @@ isdnloop_pollbchan(unsigned long data)
                 isdnloop_bchan_send(card, 1);
         if (card->flags & (ISDNLOOP_FLAGS_B1ACTIVE | ISDNLOOP_FLAGS_B2ACTIVE)) {
                 /* schedule b-channel polling again */
-                save_flags(flags);
-                cli();
+                spin_lock_irqsave(&card->isdnloop_lock, flags);
                 card->rb_timer.expires = jiffies + ISDNLOOP_TIMER_BCREAD;
                 add_timer(&card->rb_timer);
                 card->flags |= ISDNLOOP_FLAGS_RBTIMER;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
         } else
                 card->flags &= ~ISDNLOOP_FLAGS_RBTIMER;
 }
@@ -281,8 +280,7 @@ isdnloop_putmsg(isdnloop_card * card, unsigned char c)
 {
         ulong flags;
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         *card->msg_buf_write++ = (c == 0xff) ? '\n' : c;
         if (card->msg_buf_write == card->msg_buf_read) {
                 if (++card->msg_buf_read > card->msg_buf_end)
@@ -290,7 +288,7 @@ isdnloop_putmsg(isdnloop_card * card, unsigned char c)
         }
         if (card->msg_buf_write > card->msg_buf_end)
                 card->msg_buf_write = card->msg_buf;
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 /*
@@ -372,21 +370,19 @@ isdnloop_polldchan(unsigned long data)
                 if (!(card->flags & ISDNLOOP_FLAGS_RBTIMER)) {
                         /* schedule b-channel polling */
                         card->flags |= ISDNLOOP_FLAGS_RBTIMER;
-                        save_flags(flags);
-                        cli();
+                        spin_lock_irqsave(&card->isdnloop_lock, flags);
                         del_timer(&card->rb_timer);
                         card->rb_timer.function = isdnloop_pollbchan;
                         card->rb_timer.data = (unsigned long) card;
                         card->rb_timer.expires = jiffies + ISDNLOOP_TIMER_BCREAD;
                         add_timer(&card->rb_timer);
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                 }
         /* schedule again */
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         card->st_timer.expires = jiffies + ISDNLOOP_TIMER_DCREAD;
         add_timer(&card->st_timer);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 /*
@@ -416,8 +412,7 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
                         return 0;
                 if (card->sndcount[channel] > ISDNLOOP_MAX_SQUEUE)
                         return 0;
-                save_flags(flags);
-                cli();
+                spin_lock_irqsave(&card->isdnloop_lock, flags);
                 nskb = dev_alloc_skb(skb->len);
                 if (nskb) {
                         memcpy(skb_put(nskb, len), skb->data, len);
@@ -426,7 +421,7 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
                 } else
                         len = 0;
                 card->sndcount[channel] += len;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
         }
         return len;
 }
@@ -451,7 +446,8 @@ isdnloop_readstatus(u_char __user *buf, int len, isdnloop_card * card)
         for (p = buf, count = 0; count < len; p++, count++) {
                 if (card->msg_buf_read == card->msg_buf_write)
                         return count;
-                put_user(*card->msg_buf_read++, p);
+                if (put_user(*card->msg_buf_read++, p))
+                        return -EFAULT;
                 if (card->msg_buf_read > card->msg_buf_end)
                         card->msg_buf_read = card->msg_buf;
         }
@@ -576,8 +572,7 @@ isdnloop_atimeout(isdnloop_card * card, int ch)
         unsigned long flags;
         char buf[60];
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         if (card->rcard) {
                 isdnloop_fake(card->rcard[ch], "DDIS_I", card->rch[ch] + 1);
                 card->rcard[ch]->rcard[card->rch[ch]] = NULL;
@@ -587,7 +582,7 @@ isdnloop_atimeout(isdnloop_card * card, int ch)
         /* No user responding */
         sprintf(buf, "CAU%s", isdnloop_unicause(card, 1, 3));
         isdnloop_fake(card, buf, ch + 1);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 /*
@@ -622,8 +617,7 @@ isdnloop_start_ctimer(isdnloop_card * card, int ch)
 {
         unsigned long flags;
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         init_timer(&card->c_timer[ch]);
         card->c_timer[ch].expires = jiffies + ISDNLOOP_TIMER_ALERTWAIT;
         if (ch)
@@ -632,7 +626,7 @@ isdnloop_start_ctimer(isdnloop_card * card, int ch)
                 card->c_timer[ch].function = isdnloop_atimeout0;
         card->c_timer[ch].data = (unsigned long) card;
         add_timer(&card->c_timer[ch]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 /*
@@ -647,10 +641,9 @@ isdnloop_kill_ctimer(isdnloop_card * card, int ch)
 {
         unsigned long flags;
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         del_timer(&card->c_timer[ch]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 static u_char si2bit[] =
@@ -706,13 +699,12 @@ isdnloop_try_call(isdnloop_card * card, char *p, int lch, isdn_ctrl * cmd)
                                         }
                         }
                         if (num_match) {
-                                save_flags(flags);
-                                cli();
+                                spin_lock_irqsave(&card->isdnloop_lock, flags);
                                 /* channel idle? */
                                 if (!(cc->rcard[ch])) {
                                         /* Check SI */
                                         if (!(si2bit[cmd->parm.setup.si1] & cc->sil[ch])) {
-                                                restore_flags(flags);
+                                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                                 return 3;
                                         }
                                         /* ch is idle, si and number matches */
@@ -720,10 +712,10 @@ isdnloop_try_call(isdnloop_card * card, char *p, int lch, isdn_ctrl * cmd)
                                         cc->rch[ch] = lch;
                                         card->rcard[lch] = cc;
                                         card->rch[lch] = ch;
-                                        restore_flags(flags);
+                                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                         return 0;
                                 } else {
-                                        restore_flags(flags);
+                                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                         /* num matches, but busy */
                                         if (ch == 1)
                                                 return 1;
@@ -1027,8 +1019,7 @@ isdnloop_stopcard(isdnloop_card * card)
         unsigned long flags;
         isdn_ctrl cmd;
 
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         if (card->flags & ISDNLOOP_FLAGS_RUNNING) {
                 card->flags &= ~ISDNLOOP_FLAGS_RUNNING;
                 del_timer(&card->st_timer);
@@ -1039,7 +1030,7 @@ isdnloop_stopcard(isdnloop_card * card)
                 cmd.driver = card->myid;
                 card->interface.statcallb(&cmd);
         }
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 
 /*
@@ -1078,18 +1069,17 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                 return -EBUSY;
         if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef)))
                 return -EFAULT;
-        save_flags(flags);
-        cli();
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
         switch (sdef.ptype) {
                 case ISDN_PTYPE_EURO:
                         if (isdnloop_fake(card, "DRV1.23EC-Q.931-CAPI-CNS-BASIS-20.02.96",
                                           -1)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                 return -ENOMEM;
                         }
                         card->sil[0] = card->sil[1] = 4;
                         if (isdnloop_fake(card, "TEI OK", 0)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                 return -ENOMEM;
                         }
                         for (i = 0; i < 3; i++)
@@ -1098,12 +1088,12 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                 case ISDN_PTYPE_1TR6:
                         if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
                                           -1)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                 return -ENOMEM;
                         }
                         card->sil[0] = card->sil[1] = 4;
                         if (isdnloop_fake(card, "TEI OK", 0)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                 return -ENOMEM;
                         }
                         strcpy(card->s0num[0], sdef.num[0]);
@@ -1111,7 +1101,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                         card->s0num[2][0] = '\0';
                         break;
                 default:
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                         printk(KERN_WARNING "isdnloop: Illegal D-channel protocol %d\n",
                                sdef.ptype);
                         return -EINVAL;
@@ -1122,7 +1112,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
         card->st_timer.data = (unsigned long) card;
         add_timer(&card->st_timer);
         card->flags |= ISDNLOOP_FLAGS_RUNNING;
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
         return 0;
 }
 
@@ -1472,6 +1462,7 @@ isdnloop_initcard(char *id)
                 skb_queue_head_init(&card->bqueue[i]);
         }
         skb_queue_head_init(&card->dqueue);
+        card->isdnloop_lock = SPIN_LOCK_UNLOCKED;
         card->next = cards;
         cards = card;
         if (!register_isdn(&card->interface)) {
diff --git a/drivers/isdn/isdnloop/isdnloop.h b/drivers/isdn/isdnloop/isdnloop.h
index d699fe53e1c3..0d458a86f529 100644
--- a/drivers/isdn/isdnloop/isdnloop.h
+++ b/drivers/isdn/isdnloop/isdnloop.h
@@ -94,6 +94,7 @@ typedef struct isdnloop_card {
         struct sk_buff_head
          bqueue[ISDNLOOP_BCH];  /* B-Channel queues                 */
         struct sk_buff_head dqueue;     /* D-Channel queue                  */
+        spinlock_t isdnloop_lock;
 } isdnloop_card;
 
 /*
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c
index 94f21486bb24..6ead5e1508b7 100644
--- a/drivers/isdn/pcbit/drv.c
+++ b/drivers/isdn/pcbit/drv.c
@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf, int len, int driver, int channel)
 
         if (stat_st < stat_end)
         {
-                copy_to_user(buf, statbuf + stat_st, len);
+                if (copy_to_user(buf, statbuf + stat_st, len))
+                        return -EFAULT;
                 stat_st += len;    
         }
         else
         {
                 if (len > STATBUF_LEN - stat_st)
                 {
-                        copy_to_user(buf, statbuf + stat_st, 
-                                       STATBUF_LEN - stat_st);
-                        copy_to_user(buf, statbuf, 
-                                       len - (STATBUF_LEN - stat_st));
+                        if (copy_to_user(buf, statbuf + stat_st,
+                                       STATBUF_LEN - stat_st))
+                                return -EFAULT;
+                        if (copy_to_user(buf, statbuf,
+                                       len - (STATBUF_LEN - stat_st)))
+                                return -EFAULT;
 
                         stat_st = len - (STATBUF_LEN - stat_st);
                 }
                 else
                 {
-                        copy_to_user(buf, statbuf + stat_st, len);
+                        if (copy_to_user(buf, statbuf + stat_st, len))
+                                return -EFAULT;
 
                         stat_st += len;
                         
diff --git a/drivers/isdn/pcbit/layer2.c b/drivers/isdn/pcbit/layer2.c
index 13e7d219d1c7..937fd2120381 100644
--- a/drivers/isdn/pcbit/layer2.c
+++ b/drivers/isdn/pcbit/layer2.c
@@ -311,6 +311,7 @@ pcbit_deliver(void *data)
                 dev->read_queue = frame->next;
                 spin_unlock_irqrestore(&dev->lock, flags);
 
+                msg = 0;
                 SET_MSG_CPU(msg, 0);
                 SET_MSG_PROC(msg, 0);
                 SET_MSG_CMD(msg, frame->skb->data[2]);
diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c
index 222ca7c08baa..06c9872e8c6a 100644
--- a/drivers/isdn/sc/init.c
+++ b/drivers/isdn/sc/init.c
@@ -98,13 +98,14 @@ static int __init sc_init(void)
                          * Confirm the I/O Address with a test
                          */
                         if(io[b] == 0) {
-                                pr_debug("I/O Address 0x%x is in use.\n");
+                                pr_debug("I/O Address invalid.\n");
                                 continue;
                         }
 
                         outb(0x18, io[b] + 0x400 * EXP_PAGE0);
                         if(inb(io[b] + 0x400 * EXP_PAGE0) != 0x18) {
-                                pr_debug("I/O Base 0x%x fails test\n");
+                                pr_debug("I/O Base 0x%x fails test\n",
+                                         io[b] + 0x400 * EXP_PAGE0);
                                 continue;
                         }
                 }
@@ -158,8 +159,8 @@ static int __init sc_init(void)
                         outb(0xFF, io[b] + RESET_OFFSET);
                         msleep_interruptible(10000);
                 }
-                pr_debug("RAM Base for board %d is 0x%x, %s probe\n", b, ram[b],
-                        ram[b] == 0 ? "will" : "won't");
+                pr_debug("RAM Base for board %d is 0x%lx, %s probe\n", b,
+                        ram[b], ram[b] == 0 ? "will" : "won't");
 
                 if(ram[b]) {
                         /*
@@ -168,7 +169,7 @@ static int __init sc_init(void)
                          * board model
                          */
                         if(request_region(ram[b], SRAM_PAGESIZE, "sc test")) {
-                                pr_debug("request_region for RAM base 0x%x succeeded\n", ram[b]);
+                                pr_debug("request_region for RAM base 0x%lx succeeded\n", ram[b]);
                                 model = identify_board(ram[b], io[b]);
                                 release_region(ram[b], SRAM_PAGESIZE);
                         }
@@ -204,7 +205,7 @@ static int __init sc_init(void)
                          * Nope, there was no place in RAM for the
                          * board, or it couldn't be identified
                          */
-                         pr_debug("Failed to find an adapter at 0x%x\n", ram[b]);
+                         pr_debug("Failed to find an adapter at 0x%lx\n", ram[b]);
                          continue;
                 }
 
@@ -451,7 +452,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
         HWConfig_pl hwci;
         int x;
 
-        pr_debug("Attempting to identify adapter @ 0x%x io 0x%x\n",
+        pr_debug("Attempting to identify adapter @ 0x%lx io 0x%x\n",
                 rambase, iobase);
 
         /*
@@ -490,7 +491,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
         outb(PRI_BASEPG_VAL, pgport);
         msleep_interruptible(1000);
         sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
         if(sig == SIGNATURE)
                 return PRI_BOARD;
 
@@ -500,7 +501,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
         outb(BRI_BASEPG_VAL, pgport);
         msleep_interruptible(1000);
         sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
         if(sig == SIGNATURE)
                 return BRI_BOARD;
 
@@ -510,7 +511,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
          * Try to spot a card
          */
         sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
         if(sig != SIGNATURE)
                 return -1;
 
@@ -540,7 +541,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
         memcpy_fromio(&rcvmsg, &(dpm->rsp_queue[dpm->rsp_tail]), MSG_LEN);
         pr_debug("Got HWConfig response, status = 0x%x\n", rcvmsg.rsp_status);
         memcpy(&hwci, &(rcvmsg.msg_data.HWCresponse), sizeof(HWConfig_pl));
-        pr_debug("Hardware Config: Interface: %s, RAM Size: %d, Serial: %s\n"
+        pr_debug("Hardware Config: Interface: %s, RAM Size: %ld, Serial: %s\n"
                  "                 Part: %s, Rev: %s\n",
                  hwci.st_u_sense ? "S/T" : "U", hwci.ram_size,
                  hwci.serial_no, hwci.part_no, hwci.rev_no);
diff --git a/drivers/isdn/sc/packet.c b/drivers/isdn/sc/packet.c
index f50defc38ae5..1e04676b016b 100644
--- a/drivers/isdn/sc/packet.c
+++ b/drivers/isdn/sc/packet.c
@@ -44,7 +44,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
                 return -ENODEV;
         }
 
-        pr_debug("%s: sndpkt: frst = 0x%x nxt = %d  f = %d n = %d\n",
+        pr_debug("%s: sndpkt: frst = 0x%lx nxt = %d  f = %d n = %d\n",
                 sc_adapter[card]->devicename,
                 sc_adapter[card]->channel[channel].first_sendbuf,
                 sc_adapter[card]->channel[channel].next_sendbuf,
@@ -66,7 +66,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
         ReqLnkWrite.buff_offset = sc_adapter[card]->channel[channel].next_sendbuf *
                 BUFFER_SIZE + sc_adapter[card]->channel[channel].first_sendbuf;
         ReqLnkWrite.msg_len = data->len; /* sk_buff size */
-        pr_debug("%s: writing %d bytes to buffer offset 0x%x\n",
+        pr_debug("%s: writing %d bytes to buffer offset 0x%lx\n",
                         sc_adapter[card]->devicename,
                         ReqLnkWrite.msg_len, ReqLnkWrite.buff_offset);
         memcpy_toshmem(card, (char *)ReqLnkWrite.buff_offset, data->data, ReqLnkWrite.msg_len);
@@ -74,7 +74,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
         /*
          * sendmessage
          */
-        pr_debug("%s: sndpkt size=%d, buf_offset=0x%x buf_indx=%d\n",
+        pr_debug("%s: sndpkt size=%d, buf_offset=0x%lx buf_indx=%d\n",
                 sc_adapter[card]->devicename,
                 ReqLnkWrite.msg_len, ReqLnkWrite.buff_offset,
                 sc_adapter[card]->channel[channel].next_sendbuf);
@@ -124,7 +124,7 @@ void rcvpkt(int card, RspMessage *rcvmsg)
                         return;
                 }
                 skb_put(skb, rcvmsg->msg_data.response.msg_len);
-                pr_debug("%s: getting data from offset: 0x%x\n",
+                pr_debug("%s: getting data from offset: 0x%lx\n",
                         sc_adapter[card]->devicename,
                         rcvmsg->msg_data.response.buff_offset);
                 memcpy_fromshmem(card,
@@ -143,7 +143,7 @@ void rcvpkt(int card, RspMessage *rcvmsg)
 /*              memset_shmem(card, rcvmsg->msg_data.response.buff_offset, 0, BUFFER_SIZE); */
                 newll.buff_offset = rcvmsg->msg_data.response.buff_offset;
                 newll.msg_len = BUFFER_SIZE;
-                pr_debug("%s: recycled buffer at offset 0x%x size %d\n",
+                pr_debug("%s: recycled buffer at offset 0x%lx size %d\n",
                         sc_adapter[card]->devicename,
                         newll.buff_offset, newll.msg_len);
                 sendmessage(card, CEPID, ceReqTypeLnk, ceReqClass1, ceReqLnkRead,
@@ -186,7 +186,7 @@ int setup_buffers(int card, int c)
         sc_adapter[card]->channel[c-1].num_sendbufs = nBuffers / 2;
         sc_adapter[card]->channel[c-1].free_sendbufs = nBuffers / 2;
         sc_adapter[card]->channel[c-1].next_sendbuf = 0;
-        pr_debug("%s: send buffer setup complete: first=0x%x n=%d f=%d, nxt=%d\n",
+        pr_debug("%s: send buffer setup complete: first=0x%lx n=%d f=%d, nxt=%d\n",
                                 sc_adapter[card]->devicename,
                                 sc_adapter[card]->channel[c-1].first_sendbuf,
                                 sc_adapter[card]->channel[c-1].num_sendbufs,
@@ -203,7 +203,7 @@ int setup_buffers(int card, int c)
                         ((sc_adapter[card]->channel[c-1].first_sendbuf +
                         (nBuffers / 2) * buffer_size) + (buffer_size * i));
                 RcvBuffOffset.msg_len = buffer_size;
-                pr_debug("%s: adding RcvBuffer #%d offset=0x%x sz=%d bufsz:%d\n",
+                pr_debug("%s: adding RcvBuffer #%d offset=0x%lx sz=%d bufsz:%d\n",
                                 sc_adapter[card]->devicename,
                                 i + 1, RcvBuffOffset.buff_offset, 
                                 RcvBuffOffset.msg_len,buffer_size);
diff --git a/drivers/isdn/sc/shmem.c b/drivers/isdn/sc/shmem.c
index 24854826ca45..6f58862992db 100644
--- a/drivers/isdn/sc/shmem.c
+++ b/drivers/isdn/sc/shmem.c
@@ -61,7 +61,7 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
         spin_unlock_irqrestore(&sc_adapter[card]->lock, flags);
         pr_debug("%s: set page to %#x\n",sc_adapter[card]->devicename,
                 ((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE)>>14)|0x80);
-        pr_debug("%s: copying %d bytes from %#x to %#x\n",
+        pr_debug("%s: copying %d bytes from %#lx to %#lx\n",
                 sc_adapter[card]->devicename, n,
                 (unsigned long) src,
                 sc_adapter[card]->rambase + ((unsigned long) dest %0x4000));
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index aecbbe2e89a9..3c1711210e38 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -91,6 +91,8 @@ EXPORT_SYMBOL_GPL(led_classdev_resume);
  */
 int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
 {
+        int rc;
+
         led_cdev->class_dev = class_device_create(leds_class, NULL, 0,
                                                 parent, "%s", led_cdev->name);
         if (unlikely(IS_ERR(led_cdev->class_dev)))
@@ -99,8 +101,10 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
         class_set_devdata(led_cdev->class_dev, led_cdev);
 
         /* register the attributes */
-        class_device_create_file(led_cdev->class_dev,
-                                &class_device_attr_brightness);
+        rc = class_device_create_file(led_cdev->class_dev,
+                                      &class_device_attr_brightness);
+        if (rc)
+                goto err_out;
 
         /* add to the list of leds */
         write_lock(&leds_list_lock);
@@ -110,16 +114,28 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
 #ifdef CONFIG_LEDS_TRIGGERS
         rwlock_init(&led_cdev->trigger_lock);
 
-        led_trigger_set_default(led_cdev);
+        rc = class_device_create_file(led_cdev->class_dev,
+                                      &class_device_attr_trigger);
+        if (rc)
+                goto err_out_led_list;
 
-        class_device_create_file(led_cdev->class_dev,
-                                &class_device_attr_trigger);
+        led_trigger_set_default(led_cdev);
 #endif
 
         printk(KERN_INFO "Registered led device: %s\n",
                         led_cdev->class_dev->class_id);
 
         return 0;
+
+#ifdef CONFIG_LEDS_TRIGGERS
+err_out_led_list:
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_brightness);
+        list_del(&led_cdev->node);
+#endif
+err_out:
+        class_device_unregister(led_cdev->class_dev);
+        return rc;
 }
 EXPORT_SYMBOL_GPL(led_classdev_register);
 
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
index 179c2876b541..29a8818a32ec 100644
--- a/drivers/leds/ledtrig-timer.c
+++ b/drivers/leds/ledtrig-timer.c
@@ -123,6 +123,7 @@ static CLASS_DEVICE_ATTR(delay_off, 0644, led_delay_off_show,
 static void timer_trig_activate(struct led_classdev *led_cdev)
 {
         struct timer_trig_data *timer_data;
+        int rc;
 
         timer_data = kzalloc(sizeof(struct timer_trig_data), GFP_KERNEL);
         if (!timer_data)
@@ -134,10 +135,21 @@ static void timer_trig_activate(struct led_classdev *led_cdev)
         timer_data->timer.function = led_timer_function;
         timer_data->timer.data = (unsigned long) led_cdev;
 
-        class_device_create_file(led_cdev->class_dev,
+        rc = class_device_create_file(led_cdev->class_dev,
                                 &class_device_attr_delay_on);
-        class_device_create_file(led_cdev->class_dev,
+        if (rc) goto err_out;
+        rc = class_device_create_file(led_cdev->class_dev,
                                 &class_device_attr_delay_off);
+        if (rc) goto err_out_delayon;
+
+        return;
+
+err_out_delayon:
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_delay_on);
+err_out:
+        led_cdev->trigger_data = NULL;
+        kfree(timer_data);
 }
 
 static void timer_trig_deactivate(struct led_classdev *led_cdev)
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index fa4b13f89369..b3fbb45bc90a 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -685,6 +685,17 @@ static int __init wf_pm112_init(void)
                 ++nr_cores;
 
         printk(KERN_INFO "windfarm: initializing for dual-core desktop G5\n");
+
+#ifdef MODULE
+        request_module("windfarm_smu_controls");
+        request_module("windfarm_smu_sensors");
+        request_module("windfarm_smu_sat");
+        request_module("windfarm_lm75_sensor");
+        request_module("windfarm_max6690_sensor");
+        request_module("windfarm_cpufreq_clamp");
+
+#endif /* MODULE */
+
         platform_driver_register(&wf_pm112_driver);
         return 0;
 }
diff --git a/drivers/macintosh/windfarm_pm81.c b/drivers/macintosh/windfarm_pm81.c
index 2a944851b8e1..f24fa734046a 100644
--- a/drivers/macintosh/windfarm_pm81.c
+++ b/drivers/macintosh/windfarm_pm81.c
@@ -788,6 +788,7 @@ static int __init wf_smu_init(void)
                 request_module("windfarm_smu_controls");
                 request_module("windfarm_smu_sensors");
                 request_module("windfarm_lm75_sensor");
+                request_module("windfarm_cpufreq_clamp");
 
 #endif /* MODULE */
                 platform_driver_register(&wf_smu_driver);
diff --git a/drivers/macintosh/windfarm_pm91.c b/drivers/macintosh/windfarm_pm91.c
index 9961a67b4f85..26eee69ebe6d 100644
--- a/drivers/macintosh/windfarm_pm91.c
+++ b/drivers/macintosh/windfarm_pm91.c
@@ -719,6 +719,7 @@ static int __init wf_smu_init(void)
                 request_module("windfarm_smu_controls");
                 request_module("windfarm_smu_sensors");
                 request_module("windfarm_lm75_sensor");
+                request_module("windfarm_cpufreq_clamp");
 
 #endif /* MODULE */
                 platform_driver_register(&wf_smu_driver);
diff --git a/drivers/mca/mca-bus.c b/drivers/mca/mca-bus.c
index 09baa43b2599..da862e4632dd 100644
--- a/drivers/mca/mca-bus.c
+++ b/drivers/mca/mca-bus.c
@@ -100,6 +100,7 @@ static DEVICE_ATTR(pos, S_IRUGO, mca_show_pos, NULL);
 int __init mca_register_device(int bus, struct mca_device *mca_dev)
 {
         struct mca_bus *mca_bus = mca_root_busses[bus];
+        int rc;
 
         mca_dev->dev.parent = &mca_bus->dev;
         mca_dev->dev.bus = &mca_bus_type;
@@ -108,13 +109,23 @@ int __init mca_register_device(int bus, struct mca_device *mca_dev)
         mca_dev->dev.dma_mask = &mca_dev->dma_mask;
         mca_dev->dev.coherent_dma_mask = mca_dev->dma_mask;
 
-        if (device_register(&mca_dev->dev))
-                return 0;
+        rc = device_register(&mca_dev->dev);
+        if (rc)
+                goto err_out;
 
-        device_create_file(&mca_dev->dev, &dev_attr_id);
-        device_create_file(&mca_dev->dev, &dev_attr_pos);
+        rc = device_create_file(&mca_dev->dev, &dev_attr_id);
+        if (rc) goto err_out_devreg;
+        rc = device_create_file(&mca_dev->dev, &dev_attr_pos);
+        if (rc) goto err_out_id;
 
         return 1;
+
+err_out_id:
+        device_remove_file(&mca_dev->dev, &dev_attr_id);
+err_out_devreg:
+        device_unregister(&mca_dev->dev);
+err_out:
+        return 0;
 }
 
 /* */
@@ -130,13 +141,16 @@ struct mca_bus * __devinit mca_attach_bus(int bus)
                 return NULL;
         }
 
-        mca_bus = kmalloc(sizeof(struct mca_bus), GFP_KERNEL);
+        mca_bus = kzalloc(sizeof(struct mca_bus), GFP_KERNEL);
         if (!mca_bus)
                 return NULL;
-        memset(mca_bus, 0, sizeof(struct mca_bus));
+
         sprintf(mca_bus->dev.bus_id,"mca%d",bus);
         sprintf(mca_bus->name,"Host %s MCA Bridge", bus ? "Secondary" : "Primary");
-        device_register(&mca_bus->dev);
+        if (device_register(&mca_bus->dev)) {
+                kfree(mca_bus);
+                return NULL;
+        }
 
         mca_root_busses[bus] = mca_bus;
 
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 8e67634e79a0..d6f614738bbd 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -536,7 +536,7 @@ static int bitmap_read_sb(struct bitmap *bitmap)
                 printk(KERN_INFO "%s: bitmap file is out of date (%llu < %llu) "
                         "-- forcing full recovery\n", bmname(bitmap), events,
                         (unsigned long long) bitmap->mddev->events);
-                sb->state |= BITMAP_STALE;
+                sb->state |= cpu_to_le32(BITMAP_STALE);
         }
 success:
         /* assign fields using values from superblock */
@@ -544,11 +544,11 @@ success:
         bitmap->daemon_sleep = daemon_sleep;
         bitmap->daemon_lastrun = jiffies;
         bitmap->max_write_behind = write_behind;
-        bitmap->flags |= sb->state;
+        bitmap->flags |= le32_to_cpu(sb->state);
         if (le32_to_cpu(sb->version) == BITMAP_MAJOR_HOSTENDIAN)
                 bitmap->flags |= BITMAP_HOSTENDIAN;
         bitmap->events_cleared = le64_to_cpu(sb->events_cleared);
-        if (sb->state & BITMAP_STALE)
+        if (sb->state & cpu_to_le32(BITMAP_STALE))
                 bitmap->events_cleared = bitmap->mddev->events;
         err = 0;
 out:
@@ -578,9 +578,9 @@ static void bitmap_mask_state(struct bitmap *bitmap, enum bitmap_state bits,
         spin_unlock_irqrestore(&bitmap->lock, flags);
         sb = (bitmap_super_t *)kmap_atomic(bitmap->sb_page, KM_USER0);
         switch (op) {
-                case MASK_SET: sb->state |= bits;
+                case MASK_SET: sb->state |= cpu_to_le32(bits);
                                 break;
-                case MASK_UNSET: sb->state &= ~bits;
+                case MASK_UNSET: sb->state &= cpu_to_le32(~bits);
                                 break;
                 default: BUG();
         }
@@ -1413,7 +1413,7 @@ int bitmap_create(mddev_t *mddev)
         int err;
         sector_t start;
 
-        BUG_ON(sizeof(bitmap_super_t) != 256);
+        BUILD_BUG_ON(sizeof(bitmap_super_t) != 256);
 
         if (!file && !mddev->bitmap_offset) /* bitmap disabled, nothing to do */
                 return 0;
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 655d816760e5..08a40f4e4f60 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/crypto.h>
 #include <linux/workqueue.h>
+#include <linux/backing-dev.h>
 #include <asm/atomic.h>
 #include <linux/scatterlist.h>
 #include <asm/page.h>
@@ -602,7 +603,7 @@ static void process_write(struct crypt_io *io)
 
                 /* out of memory -> run queues */
                 if (remaining)
-                        blk_congestion_wait(bio_data_dir(clone), HZ/100);
+                        congestion_wait(bio_data_dir(clone), HZ/100);
         }
 }
 
@@ -914,8 +915,6 @@ static int crypt_status(struct dm_target *ti, status_type_t type,
                         char *result, unsigned int maxlen)
 {
         struct crypt_config *cc = (struct crypt_config *) ti->private;
-        const char *cipher;
-        const char *chainmode = NULL;
         unsigned int sz = 0;
 
         switch (type) {
@@ -924,14 +923,11 @@ static int crypt_status(struct dm_target *ti, status_type_t type,
                 break;
 
         case STATUSTYPE_TABLE:
-                cipher = crypto_blkcipher_name(cc->tfm);
-
-                chainmode = cc->chainmode;
-
                 if (cc->iv_mode)
-                        DMEMIT("%s-%s-%s ", cipher, chainmode, cc->iv_mode);
+                        DMEMIT("%s-%s-%s ", cc->cipher, cc->chainmode,
+                               cc->iv_mode);
                 else
-                        DMEMIT("%s-%s ", cipher, chainmode);
+                        DMEMIT("%s-%s ", cc->cipher, cc->chainmode);
 
                 if (cc->key_size > 0) {
                         if ((maxlen - sz) < ((cc->key_size << 1) + 1))
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index d13bb15a8a02..4510ad8f971c 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -606,9 +606,14 @@ static struct hash_cell *__find_device_hash_cell(struct dm_ioctl *param)
                 return __get_name_cell(param->name);
 
         md = dm_get_md(huge_decode_dev(param->dev));
-        if (md)
-                mdptr = dm_get_mdptr(md);
+        if (!md)
+                goto out;
 
+        mdptr = dm_get_mdptr(md);
+        if (!mdptr)
+                dm_put(md);
+
+out:
         return mdptr;
 }
 
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 659224cb7c53..48a653b3f518 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -24,6 +24,7 @@
 
 static struct workqueue_struct *_kmirrord_wq;
 static struct work_struct _kmirrord_work;
+static DECLARE_WAIT_QUEUE_HEAD(_kmirrord_recovery_stopped);
 
 static inline void wake(void)
 {
@@ -83,6 +84,7 @@ struct region_hash {
         struct list_head *buckets;
 
         spinlock_t region_lock;
+        atomic_t recovery_in_flight;
         struct semaphore recovery_count;
         struct list_head clean_regions;
         struct list_head quiesced_regions;
@@ -191,6 +193,7 @@ static int rh_init(struct region_hash *rh, struct mirror_set *ms,
 
         spin_lock_init(&rh->region_lock);
         sema_init(&rh->recovery_count, 0);
+        atomic_set(&rh->recovery_in_flight, 0);
         INIT_LIST_HEAD(&rh->clean_regions);
         INIT_LIST_HEAD(&rh->quiesced_regions);
         INIT_LIST_HEAD(&rh->recovered_regions);
@@ -382,6 +385,8 @@ static void rh_update_states(struct region_hash *rh)
                 rh->log->type->clear_region(rh->log, reg->key);
                 rh->log->type->complete_resync_work(rh->log, reg->key, 1);
                 dispatch_bios(rh->ms, &reg->delayed_bios);
+                if (atomic_dec_and_test(&rh->recovery_in_flight))
+                        wake_up_all(&_kmirrord_recovery_stopped);
                 up(&rh->recovery_count);
                 mempool_free(reg, rh->region_pool);
         }
@@ -502,11 +507,21 @@ static int __rh_recovery_prepare(struct region_hash *rh)
 
 static void rh_recovery_prepare(struct region_hash *rh)
 {
-        while (!down_trylock(&rh->recovery_count))
+        /* Extra reference to avoid race with rh_stop_recovery */
+        atomic_inc(&rh->recovery_in_flight);
+
+        while (!down_trylock(&rh->recovery_count)) {
+                atomic_inc(&rh->recovery_in_flight);
                 if (__rh_recovery_prepare(rh) <= 0) {
+                        atomic_dec(&rh->recovery_in_flight);
                         up(&rh->recovery_count);
                         break;
                 }
+        }
+
+        /* Drop the extra reference */
+        if (atomic_dec_and_test(&rh->recovery_in_flight))
+                wake_up_all(&_kmirrord_recovery_stopped);
 }
 
 /*
@@ -1177,6 +1192,11 @@ static void mirror_postsuspend(struct dm_target *ti)
         struct dirty_log *log = ms->rh.log;
 
         rh_stop_recovery(&ms->rh);
+
+        /* Wait for all I/O we generated to complete */
+        wait_event(_kmirrord_recovery_stopped,
+                   !atomic_read(&ms->rh.recovery_in_flight));
+
         if (log->type->suspend && log->type->suspend(log))
                 /* FIXME: need better error handling */
                 DMWARN("log suspend failed");
diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
index c5a16c550122..6f9fcd4db9b5 100644
--- a/drivers/md/dm-round-robin.c
+++ b/drivers/md/dm-round-robin.c
@@ -136,7 +136,7 @@ static int rr_add_path(struct path_selector *ps, struct path *path,
 
         path->pscontext = pi;
 
-        list_add(&pi->list, &s->valid_paths);
+        list_add_tail(&pi->list, &s->valid_paths);
 
         return 0;
 }
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index b5764a86c8b5..fc4f743f3b53 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1285,7 +1285,7 @@ int dm_suspend(struct mapped_device *md, int do_lockfs)
         down(&md->suspend_lock);
 
         if (dm_suspended(md))
-                goto out;
+                goto out_unlock;
 
         map = dm_get_table(md);
 
@@ -1361,6 +1361,8 @@ out:
         }
 
         dm_table_put(map);
+
+out_unlock:
         up(&md->suspend_lock);
         return r;
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 57fa64f93e5f..8cbf9c9df1c3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -974,12 +974,13 @@ static void super_90_sync(mddev_t *mddev, mdk_rdev_t *rdev)
  * version 1 superblock
  */
 
-static unsigned int calc_sb_1_csum(struct mdp_superblock_1 * sb)
+static __le32 calc_sb_1_csum(struct mdp_superblock_1 * sb)
 {
-        unsigned int disk_csum, csum;
+        __le32 disk_csum;
+        u32 csum;
         unsigned long long newcsum;
         int size = 256 + le32_to_cpu(sb->max_dev)*2;
-        unsigned int *isuper = (unsigned int*)sb;
+        __le32 *isuper = (__le32*)sb;
         int i;
 
         disk_csum = sb->sb_csum;
@@ -989,7 +990,7 @@ static unsigned int calc_sb_1_csum(struct mdp_superblock_1 * sb)
                 newcsum += le32_to_cpu(*isuper++);
 
         if (size == 2)
-                newcsum += le16_to_cpu(*(unsigned short*) isuper);
+                newcsum += le16_to_cpu(*(__le16*) isuper);
 
         csum = (newcsum & 0xffffffff) + (newcsum >> 32);
         sb->sb_csum = disk_csum;
@@ -1106,7 +1107,7 @@ static int super_1_load(mdk_rdev_t *rdev, mdk_rdev_t *refdev, int minor_version)
         if (le32_to_cpu(sb->chunksize))
                 rdev->size &= ~((sector_t)le32_to_cpu(sb->chunksize)/2 - 1);
 
-        if (le32_to_cpu(sb->size) > rdev->size*2)
+        if (le64_to_cpu(sb->size) > rdev->size*2)
                 return -EINVAL;
         return ret;
 }
@@ -1228,7 +1229,7 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
         else
                 sb->resync_offset = cpu_to_le64(0);
 
-        sb->cnt_corrected_read = atomic_read(&rdev->corrected_errors);
+        sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
 
         sb->raid_disks = cpu_to_le32(mddev->raid_disks);
         sb->size = cpu_to_le64(mddev->size<<1);
@@ -2002,6 +2003,7 @@ static mdk_rdev_t *md_import_device(dev_t newdev, int super_format, int super_mi
         kobject_init(&rdev->kobj);
 
         rdev->desc_nr = -1;
+        rdev->saved_raid_disk = -1;
         rdev->flags = 0;
         rdev->data_offset = 0;
         rdev->sb_events = 0;
@@ -3198,6 +3200,7 @@ static int do_md_run(mddev_t * mddev)
 
         mddev->changed = 1;
         md_new_event(mddev);
+        kobject_uevent(&mddev->gendisk->kobj, KOBJ_CHANGE);
         return 0;
 }
 
@@ -4043,11 +4046,8 @@ static int update_size(mddev_t *mddev, unsigned long size)
                 return -EBUSY;
         ITERATE_RDEV(mddev,rdev,tmp) {
                 sector_t avail;
-                if (rdev->sb_offset > rdev->data_offset)
-                        avail = (rdev->sb_offset*2) - rdev->data_offset;
-                else
-                        avail = get_capacity(rdev->bdev->bd_disk)
-                                - rdev->data_offset;
+                avail = rdev->size * 2;
+
                 if (fit && (size == 0 || size > avail/2))
                         size = avail/2;
                 if (avail < ((sector_t)size << 1))
@@ -4486,6 +4486,7 @@ static int md_thread(void * arg)
          * many dirty RAID5 blocks.
          */
 
+        current->flags |= PF_NOFREEZE;
         allow_signal(SIGKILL);
         while (!kthread_should_stop()) {
 
@@ -4502,7 +4503,6 @@ static int md_thread(void * arg)
                          test_bit(THREAD_WAKEUP, &thread->flags)
                          || kthread_should_stop(),
                          thread->timeout);
-                try_to_freeze();
 
                 clear_bit(THREAD_WAKEUP, &thread->flags);
 
@@ -4912,6 +4912,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
 }
 
 static struct file_operations md_seq_fops = {
+        .owner          = THIS_MODULE,
         .open           = md_seq_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 171ff41b52b0..14da37fee37b 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -277,6 +277,7 @@ static void multipath_error (mddev_t *mddev, mdk_rdev_t *rdev)
                         set_bit(Faulty, &rdev->flags);
                         set_bit(MD_CHANGE_DEVS, &mddev->flags);
                         conf->working_disks--;
+                        mddev->degraded++;
                         printk(KERN_ALERT "multipath: IO failure on %s,"
                                 " disabling IO path. \n Operation continuing"
                                 " on %d IO paths.\n",
@@ -336,6 +337,7 @@ static int multipath_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
                                 blk_queue_max_sectors(mddev->queue, PAGE_SIZE>>9);
 
                         conf->working_disks++;
+                        mddev->degraded--;
                         rdev->raid_disk = path;
                         set_bit(In_sync, &rdev->flags);
                         rcu_assign_pointer(p->rdev, rdev);
@@ -501,7 +503,7 @@ static int multipath_run (mddev_t *mddev)
                         mdname(mddev));
                 goto out_free_conf;
         }
-        mddev->degraded = conf->raid_disks = conf->working_disks;
+        mddev->degraded = conf->raid_disks - conf->working_disks;
 
         conf->pool = mempool_create_kzalloc_pool(NR_RESERVED_BUFS,
                                                  sizeof(struct multipath_bh));
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index dc9d2def0270..656fae912fe3 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1474,8 +1474,8 @@ static void fix_read_error(conf_t *conf, int read_disk,
                                                "raid1:%s: read error corrected "
                                                "(%d sectors at %llu on %s)\n",
                                                mdname(mddev), s,
-                                               (unsigned long long)sect +
-                                                   rdev->data_offset,
+                                               (unsigned long long)(sect +
+                                                   rdev->data_offset),
                                                bdevname(rdev->bdev, b));
                                 }
                         }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1250f0eab4af..7492d6033ac6 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1470,8 +1470,8 @@ static void fix_read_error(conf_t *conf, mddev_t *mddev, r10bio_t *r10_bio)
                                                "raid10:%s: read error corrected"
                                                " (%d sectors at %llu on %s)\n",
                                                mdname(mddev), s,
-                                               (unsigned long long)sect+
-                                                    rdev->data_offset,
+                                               (unsigned long long)(sect+
+                                                    rdev->data_offset),
                                                bdevname(rdev->bdev, b));
 
                                 rdev_dec_pending(rdev, mddev);
@@ -2079,7 +2079,7 @@ static int run(mddev_t *mddev)
                 disk = conf->mirrors + i;
 
                 if (!disk->rdev ||
-                    !test_bit(In_sync, &rdev->flags)) {
+                    !test_bit(In_sync, &disk->rdev->flags)) {
                         disk->head_position = 0;
                         mddev->degraded++;
                 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e14f45780720..69c3e201fa3b 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3659,7 +3659,7 @@ static void end_reshape(raid5_conf_t *conf)
                 bdev = bdget_disk(conf->mddev->gendisk, 0);
                 if (bdev) {
                         mutex_lock(&bdev->bd_inode->i_mutex);
-                        i_size_write(bdev->bd_inode, conf->mddev->array_size << 10);
+                        i_size_write(bdev->bd_inode, (loff_t)conf->mddev->array_size << 10);
                         mutex_unlock(&bdev->bd_inode->i_mutex);
                         bdput(bdev);
                 }
diff --git a/drivers/media/common/saa7146_i2c.c b/drivers/media/common/saa7146_i2c.c
index d9953f7a8b6b..5297a365c928 100644
--- a/drivers/media/common/saa7146_i2c.c
+++ b/drivers/media/common/saa7146_i2c.c
@@ -217,11 +217,9 @@ static int saa7146_i2c_writeout(struct saa7146_dev *dev, u32* dword, int short_d
                 }
                 /* wait until we get a transfer done or error */
                 timeout = jiffies + HZ/100 + 1; /* 10ms */
+                /* first read usually delivers bogus results... */
+                saa7146_i2c_status(dev);
                 while(1) {
-                        /**
-                         *  first read usually delivers bogus results...
-                         */
-                        saa7146_i2c_status(dev);
                         status = saa7146_i2c_status(dev);
                         if ((status & 0x3) != 1)
                                 break;
@@ -232,10 +230,10 @@ static int saa7146_i2c_writeout(struct saa7146_dev *dev, u32* dword, int short_d
                                 DEB_I2C(("saa7146_i2c_writeout: timed out waiting for end of xfer\n"));
                                 return -EIO;
                         }
-                        if ((++trial < 20) && short_delay)
+                        if (++trial < 50 && short_delay)
                                 udelay(10);
                         else
-                        msleep(1);
+                                msleep(1);
                 }
         }
 
diff --git a/drivers/media/dvb/b2c2/flexcop-usb.c b/drivers/media/dvb/b2c2/flexcop-usb.c
index 2853ea1bdaf1..87fb75f0d1cf 100644
--- a/drivers/media/dvb/b2c2/flexcop-usb.c
+++ b/drivers/media/dvb/b2c2/flexcop-usb.c
@@ -246,7 +246,7 @@ static int flexcop_usb_i2c_req(struct flexcop_usb *fc_usb,
         wIndex = (chipaddr << 8 ) | addr;
 
         deb_i2c("i2c %2d: %02x %02x %02x %02x %02x %02x\n",func,request_type,req,
-                        ((wValue && 0xff) << 8),wValue >> 8,((wIndex && 0xff) << 8),wIndex >> 8);
+                wValue & 0xff, wValue >> 8, wIndex & 0xff, wIndex >> 8);
 
         len = usb_control_msg(fc_usb->udev,pipe,
                         req,
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
index fb6c4cc8477d..14e69a736eda 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -665,6 +665,10 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type)
         case BTTV_BOARD_TWINHAN_DST:
                 /*      DST is not a frontend driver !!!                */
                 state = (struct dst_state *) kmalloc(sizeof (struct dst_state), GFP_KERNEL);
+                if (!state) {
+                        printk("dvb_bt8xx: No memory\n");
+                        break;
+                }
                 /*      Setup the Card                                  */
                 state->config = &dst_config;
                 state->i2c = card->i2c_adapter;
diff --git a/drivers/media/dvb/dvb-core/Kconfig b/drivers/media/dvb/dvb-core/Kconfig
index e46eae3b9be2..1990eda10c46 100644
--- a/drivers/media/dvb/dvb-core/Kconfig
+++ b/drivers/media/dvb/dvb-core/Kconfig
@@ -19,6 +19,6 @@ config DVB_CORE_ATTACH
           allow the card drivers to only load the frontend modules
           they require. This saves several KBytes of memory.
 
-          Note: You will need moudule-init-tools v3.2 or later for this feature.
+          Note: You will need module-init-tools v3.2 or later for this feature.
 
           If unsure say Y.
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 2cc5caa26a0a..a263b3f3c21d 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -26,7 +26,7 @@ config DVB_USB_A800
         tristate "AVerMedia AverTV DVB-T USB 2.0 (A800)"
         depends on DVB_USB
         select DVB_DIB3000MC
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the AVerMedia AverTV DVB-T USB 2.0 (A800) receiver.
 
@@ -34,7 +34,7 @@ config DVB_USB_DIBUSB_MB
         tristate "DiBcom USB DVB-T devices (based on the DiB3000M-B) (see help for device list)"
         depends on DVB_USB
         select DVB_DIB3000MB
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Support for USB 1.1 and 2.0 DVB-T receivers based on reference designs made by
           DiBcom (<http://www.dibcom.fr>) equipped with a DiB3000M-B demodulator.
@@ -55,7 +55,7 @@ config DVB_USB_DIBUSB_MC
         tristate "DiBcom USB DVB-T devices (based on the DiB3000M-C/P) (see help for device list)"
         depends on DVB_USB
         select DVB_DIB3000MC
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Support for USB2.0 DVB-T receivers based on reference designs made by
           DiBcom (<http://www.dibcom.fr>) equipped with a DiB3000M-C/P demodulator.
@@ -70,7 +70,7 @@ config DVB_USB_DIB0700
         tristate "DiBcom DiB0700 USB DVB devices (see help for supported devices)"
         depends on DVB_USB
         select DVB_DIB3000MC
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Support for USB2.0/1.1 DVB receivers based on the DiB0700 USB bridge. The
           USB bridge is also present in devices having the DiB7700 DVB-T-USB
@@ -87,7 +87,7 @@ config DVB_USB_UMT_010
         tristate "HanfTek UMT-010 DVB-T USB2.0 support"
         depends on DVB_USB
         select DVB_DIB3000MC
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the HanfTek UMT-010 USB2.0 stick-sized DVB-T receiver.
 
@@ -153,7 +153,7 @@ config DVB_USB_NOVA_T_USB2
         tristate "Hauppauge WinTV-NOVA-T usb2 DVB-T USB2.0 support"
         depends on DVB_USB
         select DVB_DIB3000MC
-        select DVB_TUNER_MT2060
+        select DVB_TUNER_MT2060 if !DVB_FE_CUSTOMISE
         help
           Say Y here to support the Hauppauge WinTV-NOVA-T usb2 DVB-T USB2.0 receiver.
 
diff --git a/drivers/media/dvb/dvb-usb/dibusb-common.c b/drivers/media/dvb/dvb-usb/dibusb-common.c
index fd3a9902f98d..5143e426d283 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-common.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-common.c
@@ -169,7 +169,7 @@ EXPORT_SYMBOL(dibusb_read_eeprom_byte);
 // Config Adjacent channels  Perf -cal22
 static struct dibx000_agc_config dib3000p_mt2060_agc_config = {
         .band_caps = BAND_VHF | BAND_UHF,
-        .setup     = (0 << 15) | (0 << 14) | (1 << 13) | (1 << 12) | (29 << 0),
+        .setup     = (1 << 8) | (5 << 5) | (1 << 4) | (1 << 3) | (0 << 2) | (2 << 0),
 
         .agc1_max = 48497,
         .agc1_min = 23593,
@@ -196,10 +196,14 @@ static struct dib3000mc_config stk3000p_dib3000p_config = {
         .ln_adc_level = 0x1cc7,
 
         .output_mpeg2_in_188_bytes = 1,
+
+        .agc_command1 = 1,
+        .agc_command2 = 1,
 };
 
 static struct dibx000_agc_config dib3000p_panasonic_agc_config = {
-        .setup    = (0 << 15) | (0 << 14) | (1 << 13) | (1 << 12) | (29 << 0),
+        .band_caps = BAND_VHF | BAND_UHF,
+        .setup     = (1 << 8) | (5 << 5) | (1 << 4) | (1 << 3) | (0 << 2) | (2 << 0),
 
         .agc1_max = 56361,
         .agc1_min = 22282,
@@ -226,6 +230,9 @@ static struct dib3000mc_config mod3000p_dib3000p_config = {
         .ln_adc_level = 0x1cc7,
 
         .output_mpeg2_in_188_bytes = 1,
+
+        .agc_command1 = 1,
+        .agc_command2 = 1,
 };
 
 int dibusb_dib3000mc_frontend_attach(struct dvb_usb_adapter *adap)
diff --git a/drivers/media/dvb/dvb-usb/dibusb.h b/drivers/media/dvb/dvb-usb/dibusb.h
index 5153fb943da1..b60781032742 100644
--- a/drivers/media/dvb/dvb-usb/dibusb.h
+++ b/drivers/media/dvb/dvb-usb/dibusb.h
@@ -99,7 +99,9 @@
 struct dibusb_state {
         struct dib_fe_xfer_ops ops;
         int mt2060_present;
+};
 
+struct dibusb_device_state {
         /* for RC5 remote control */
         int old_toggle;
         int last_repeat_count;
diff --git a/drivers/media/dvb/dvb-usb/nova-t-usb2.c b/drivers/media/dvb/dvb-usb/nova-t-usb2.c
index a9219bf69b89..a58874c790b2 100644
--- a/drivers/media/dvb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/dvb/dvb-usb/nova-t-usb2.c
@@ -75,7 +75,7 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
         u8 key[5],cmd[2] = { DIBUSB_REQ_POLL_REMOTE, 0x35 }, data,toggle,custom;
         u16 raw;
         int i;
-        struct dibusb_state *st = d->priv;
+        struct dibusb_device_state *st = d->priv;
 
         dvb_usb_generic_rw(d,cmd,2,key,5,0);
 
@@ -184,6 +184,7 @@ static struct dvb_usb_device_properties nova_t_properties = {
                         .size_of_priv     = sizeof(struct dibusb_state),
                 }
         },
+        .size_of_priv     = sizeof(struct dibusb_device_state),
 
         .power_ctrl       = dibusb2_0_power_ctrl,
         .read_mac_address = nova_t_read_mac_address,
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index 080fa257a0bc..aebb8d6f26f8 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -276,6 +276,8 @@ config DVB_TDA826X
 
 config DVB_TUNER_MT2060
         tristate "Microtune MT2060 silicon IF tuner"
+        depends on I2C
+        default m if DVB_FE_CUSTOMISE
         help
           A driver for the silicon IF tuner MT2060 from Microtune.
 
diff --git a/drivers/media/dvb/frontends/bcm3510.h b/drivers/media/dvb/frontends/bcm3510.h
index 6dfa839a7022..7e4f95e1734b 100644
--- a/drivers/media/dvb/frontends/bcm3510.h
+++ b/drivers/media/dvb/frontends/bcm3510.h
@@ -34,7 +34,7 @@ struct bcm3510_config
         int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
 };
 
-#if defined(CONFIG_DVB_BCM3510) || defined(CONFIG_DVB_BCM3510_MODULE)
+#if defined(CONFIG_DVB_BCM3510) || (defined(CONFIG_DVB_BCM3510_MODULE) && defined(MODULE))
 extern struct dvb_frontend* bcm3510_attach(const struct bcm3510_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/cx22700.h b/drivers/media/dvb/frontends/cx22700.h
index 10286cc29fb4..7ac33690cdcc 100644
--- a/drivers/media/dvb/frontends/cx22700.h
+++ b/drivers/media/dvb/frontends/cx22700.h
@@ -31,7 +31,7 @@ struct cx22700_config
         u8 demod_address;
 };
 
-#if defined(CONFIG_DVB_CX22700) || defined(CONFIG_DVB_CX22700_MODULE)
+#if defined(CONFIG_DVB_CX22700) || (defined(CONFIG_DVB_CX22700_MODULE) && defined(MODULE))
 extern struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/cx22702.h b/drivers/media/dvb/frontends/cx22702.h
index bc217ddf02c0..9cd64da6ee40 100644
--- a/drivers/media/dvb/frontends/cx22702.h
+++ b/drivers/media/dvb/frontends/cx22702.h
@@ -41,7 +41,7 @@ struct cx22702_config
         u8 output_mode;
 };
 
-#if defined(CONFIG_DVB_CX22702) || defined(CONFIG_DVB_CX22702_MODULE)
+#if defined(CONFIG_DVB_CX22702) || (defined(CONFIG_DVB_CX22702_MODULE) && defined(MODULE))
 extern struct dvb_frontend* cx22702_attach(const struct cx22702_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/cx24110.h b/drivers/media/dvb/frontends/cx24110.h
index c9d5ae250ebb..0ca3af4db513 100644
--- a/drivers/media/dvb/frontends/cx24110.h
+++ b/drivers/media/dvb/frontends/cx24110.h
@@ -41,7 +41,7 @@ static inline int cx24110_pll_write(struct dvb_frontend *fe, u32 val) {
         return r;
 }
 
-#if defined(CONFIG_DVB_CX24110) || defined(CONFIG_DVB_CX24110_MODULE)
+#if defined(CONFIG_DVB_CX24110) || (defined(CONFIG_DVB_CX24110_MODULE) && defined(MODULE))
 extern struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/cx24123.h b/drivers/media/dvb/frontends/cx24123.h
index 57a1dae1dc40..84f9e4f5c15e 100644
--- a/drivers/media/dvb/frontends/cx24123.h
+++ b/drivers/media/dvb/frontends/cx24123.h
@@ -35,7 +35,7 @@ struct cx24123_config
         int lnb_polarity;
 };
 
-#if defined(CONFIG_DVB_CX24123) || defined(CONFIG_DVB_CX24123_MODULE)
+#if defined(CONFIG_DVB_CX24123) || (defined(CONFIG_DVB_CX24123_MODULE) && defined(MODULE))
 extern struct dvb_frontend* cx24123_attach(const struct cx24123_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/dib3000.h b/drivers/media/dvb/frontends/dib3000.h
index 0caac3f0f279..a6d3854a67bc 100644
--- a/drivers/media/dvb/frontends/dib3000.h
+++ b/drivers/media/dvb/frontends/dib3000.h
@@ -41,7 +41,7 @@ struct dib_fe_xfer_ops
         int (*tuner_pass_ctrl)(struct dvb_frontend *fe, int onoff, u8 pll_ctrl);
 };
 
-#if defined(CONFIG_DVB_DIB3000MB) || defined(CONFIG_DVB_DIB3000MB_MODULE)
+#if defined(CONFIG_DVB_DIB3000MB) || (defined(CONFIG_DVB_DIB3000MB_MODULE) && defined(MODULE))
 extern struct dvb_frontend* dib3000mb_attach(const struct dib3000_config* config,
                                              struct i2c_adapter* i2c, struct dib_fe_xfer_ops *xfer_ops);
 #else
diff --git a/drivers/media/dvb/frontends/dib3000mc.c b/drivers/media/dvb/frontends/dib3000mc.c
index ccc813b525d6..3561a777568c 100644
--- a/drivers/media/dvb/frontends/dib3000mc.c
+++ b/drivers/media/dvb/frontends/dib3000mc.c
@@ -345,7 +345,7 @@ static int dib3000mc_init(struct dvb_frontend *demod)
 
         /* agc */
         dib3000mc_write_word(state, 36, state->cfg->max_time);
-        dib3000mc_write_word(state, 37, agc->setup);
+        dib3000mc_write_word(state, 37, (state->cfg->agc_command1 << 13) | (state->cfg->agc_command2 << 12) | (0x1d << 0));
         dib3000mc_write_word(state, 38, state->cfg->pwm3_value);
         dib3000mc_write_word(state, 39, state->cfg->ln_adc_level);
 
diff --git a/drivers/media/dvb/frontends/dib3000mc.h b/drivers/media/dvb/frontends/dib3000mc.h
index b198cd5b1843..72d4757601d8 100644
--- a/drivers/media/dvb/frontends/dib3000mc.h
+++ b/drivers/media/dvb/frontends/dib3000mc.h
@@ -28,6 +28,9 @@ struct dib3000mc_config {
         u16 max_time;
         u16 ln_adc_level;
 
+        u8 agc_command1 :1;
+        u8 agc_command2 :1;
+
         u8 mobile_mode;
 
         u8 output_mpeg2_in_188_bytes;
@@ -36,7 +39,7 @@ struct dib3000mc_config {
 #define DEFAULT_DIB3000MC_I2C_ADDRESS 16
 #define DEFAULT_DIB3000P_I2C_ADDRESS  24
 
-#if defined(CONFIG_DVB_DIB3000MC) || defined(CONFIG_DVB_DIB3000MC_MODULE)
+#if defined(CONFIG_DVB_DIB3000MC) || (defined(CONFIG_DVB_DIB3000MC_MODULE) && defined(MODULE))
 extern struct dvb_frontend * dib3000mc_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib3000mc_config *cfg);
 #else
 static inline struct dvb_frontend * dib3000mc_attach(struct i2c_adapter *i2c_adap, u8 i2c_addr, struct dib3000mc_config *cfg)
diff --git a/drivers/media/dvb/frontends/isl6421.h b/drivers/media/dvb/frontends/isl6421.h
index 1916e3eb2df3..ea7f78a7d3cd 100644
--- a/drivers/media/dvb/frontends/isl6421.h
+++ b/drivers/media/dvb/frontends/isl6421.h
@@ -39,7 +39,7 @@
 #define ISL6421_ISEL1   0x20
 #define ISL6421_DCL     0x40
 
-#if defined(CONFIG_DVB_ISL6421) || defined(CONFIG_DVB_ISL6421_MODULE)
+#if defined(CONFIG_DVB_ISL6421) || (defined(CONFIG_DVB_ISL6421_MODULE) && defined(MODULE))
 /* override_set and override_clear control which system register bits (above) to always set & clear */
 extern struct dvb_frontend *isl6421_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, u8 i2c_addr,
                           u8 override_set, u8 override_clear);
diff --git a/drivers/media/dvb/frontends/l64781.h b/drivers/media/dvb/frontends/l64781.h
index 21ba4a230760..cd15f76ff28d 100644
--- a/drivers/media/dvb/frontends/l64781.h
+++ b/drivers/media/dvb/frontends/l64781.h
@@ -31,7 +31,7 @@ struct l64781_config
         u8 demod_address;
 };
 
-#if defined(CONFIG_DVB_L64781) || defined(CONFIG_DVB_L64781_MODULE)
+#if defined(CONFIG_DVB_L64781) || (defined(CONFIG_DVB_L64781_MODULE) && defined(MODULE))
 extern struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                                           struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/lgdt330x.h b/drivers/media/dvb/frontends/lgdt330x.h
index 3f96b485584c..995059004b10 100644
--- a/drivers/media/dvb/frontends/lgdt330x.h
+++ b/drivers/media/dvb/frontends/lgdt330x.h
@@ -52,7 +52,7 @@ struct lgdt330x_config
         int clock_polarity_flip;
 };
 
-#if defined(CONFIG_DVB_LGDT330X) || defined(CONFIG_DVB_LGDT330X_MODULE)
+#if defined(CONFIG_DVB_LGDT330X) || (defined(CONFIG_DVB_LGDT330X_MODULE) && defined(MODULE))
 extern struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
                                             struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/lnbp21.h b/drivers/media/dvb/frontends/lnbp21.h
index 1fe1dd179312..68906acf7d63 100644
--- a/drivers/media/dvb/frontends/lnbp21.h
+++ b/drivers/media/dvb/frontends/lnbp21.h
@@ -39,7 +39,7 @@
 
 #include <linux/dvb/frontend.h>
 
-#if defined(CONFIG_DVB_LNBP21) || defined(CONFIG_DVB_LNBP21_MODULE)
+#if defined(CONFIG_DVB_LNBP21) || (defined(CONFIG_DVB_LNBP21_MODULE) && defined(MODULE))
 /* override_set and override_clear control which system register bits (above) to always set & clear */
 extern struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, u8 override_set, u8 override_clear);
 #else
diff --git a/drivers/media/dvb/frontends/mt2060.h b/drivers/media/dvb/frontends/mt2060.h
index 34a37c2b556f..0a86eab3a954 100644
--- a/drivers/media/dvb/frontends/mt2060.h
+++ b/drivers/media/dvb/frontends/mt2060.h
@@ -30,6 +30,14 @@ struct mt2060_config {
         u8 clock_out; /* 0 = off, 1 = CLK/4, 2 = CLK/2, 3 = CLK/1 */
 };
 
+#if defined(CONFIG_DVB_TUNER_MT2060) || (defined(CONFIG_DVB_TUNER_MT2060_MODULE) && defined(MODULE))
 extern struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2060_config *cfg, u16 if1);
+#else
+static inline struct dvb_frontend * mt2060_attach(struct dvb_frontend *fe, struct i2c_adapter *i2c, struct mt2060_config *cfg, u16 if1)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __FUNCTION__);
+        return NULL;
+}
+#endif // CONFIG_DVB_TUNER_MT2060
 
 #endif
diff --git a/drivers/media/dvb/frontends/mt312.h b/drivers/media/dvb/frontends/mt312.h
index 7112fb4d58ac..cf9a1505ad4b 100644
--- a/drivers/media/dvb/frontends/mt312.h
+++ b/drivers/media/dvb/frontends/mt312.h
@@ -34,7 +34,7 @@ struct mt312_config
         u8 demod_address;
 };
 
-#if defined(CONFIG_DVB_MT312) || defined(CONFIG_DVB_MT312_MODULE)
+#if defined(CONFIG_DVB_MT312) || (defined(CONFIG_DVB_MT312_MODULE) && defined(MODULE))
 struct dvb_frontend* vp310_mt312_attach(const struct mt312_config* config,
                                         struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/mt352.h b/drivers/media/dvb/frontends/mt352.h
index 0035c2e2d7c2..e9964081fd84 100644
--- a/drivers/media/dvb/frontends/mt352.h
+++ b/drivers/media/dvb/frontends/mt352.h
@@ -51,7 +51,7 @@ struct mt352_config
         int (*demod_init)(struct dvb_frontend* fe);
 };
 
-#if defined(CONFIG_DVB_MT352) || defined(CONFIG_DVB_MT352_MODULE)
+#if defined(CONFIG_DVB_MT352) || (defined(CONFIG_DVB_MT352_MODULE) && defined(MODULE))
 extern struct dvb_frontend* mt352_attach(const struct mt352_config* config,
                                          struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/nxt200x.h b/drivers/media/dvb/frontends/nxt200x.h
index 2eb220e98062..28bc5591b319 100644
--- a/drivers/media/dvb/frontends/nxt200x.h
+++ b/drivers/media/dvb/frontends/nxt200x.h
@@ -45,7 +45,7 @@ struct nxt200x_config
         int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
 };
 
-#if defined(CONFIG_DVB_NXT200X) || defined(CONFIG_DVB_NXT200X_MODULE)
+#if defined(CONFIG_DVB_NXT200X) || (defined(CONFIG_DVB_NXT200X_MODULE) && defined(MODULE))
 extern struct dvb_frontend* nxt200x_attach(const struct nxt200x_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/nxt6000.h b/drivers/media/dvb/frontends/nxt6000.h
index 9397393a6bd1..13d22518356e 100644
--- a/drivers/media/dvb/frontends/nxt6000.h
+++ b/drivers/media/dvb/frontends/nxt6000.h
@@ -33,7 +33,7 @@ struct nxt6000_config
         u8 clock_inversion:1;
 };
 
-#if defined(CONFIG_DVB_NXT6000) || defined(CONFIG_DVB_NXT6000_MODULE)
+#if defined(CONFIG_DVB_NXT6000) || (defined(CONFIG_DVB_NXT6000_MODULE) && defined(MODULE))
 extern struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/or51132.h b/drivers/media/dvb/frontends/or51132.h
index 9718be4fb835..add24f0a743b 100644
--- a/drivers/media/dvb/frontends/or51132.h
+++ b/drivers/media/dvb/frontends/or51132.h
@@ -34,7 +34,7 @@ struct or51132_config
         int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
 };
 
-#if defined(CONFIG_DVB_OR51132) || defined(CONFIG_DVB_OR51132_MODULE)
+#if defined(CONFIG_DVB_OR51132) || (defined(CONFIG_DVB_OR51132_MODULE) && defined(MODULE))
 extern struct dvb_frontend* or51132_attach(const struct or51132_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/or51211.h b/drivers/media/dvb/frontends/or51211.h
index 10a5419f9e00..8aad8402d615 100644
--- a/drivers/media/dvb/frontends/or51211.h
+++ b/drivers/media/dvb/frontends/or51211.h
@@ -37,7 +37,7 @@ struct or51211_config
         void (*sleep)(struct dvb_frontend * fe);
 };
 
-#if defined(CONFIG_DVB_OR51211) || defined(CONFIG_DVB_OR51211_MODULE)
+#if defined(CONFIG_DVB_OR51211) || (defined(CONFIG_DVB_OR51211_MODULE) && defined(MODULE))
 extern struct dvb_frontend* or51211_attach(const struct or51211_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/s5h1420.h b/drivers/media/dvb/frontends/s5h1420.h
index efc54d7f3c55..1555870f7226 100644
--- a/drivers/media/dvb/frontends/s5h1420.h
+++ b/drivers/media/dvb/frontends/s5h1420.h
@@ -34,7 +34,7 @@ struct s5h1420_config
         u8 invert:1;
 };
 
-#if defined(CONFIG_DVB_S5H1420) || defined(CONFIG_DVB_S5H1420_MODULE)
+#if defined(CONFIG_DVB_S5H1420) || (defined(CONFIG_DVB_S5H1420_MODULE) && defined(MODULE))
 extern struct dvb_frontend* s5h1420_attach(const struct s5h1420_config* config,
              struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/sp8870.h b/drivers/media/dvb/frontends/sp8870.h
index 4cf27d3b10f2..909cefe7139e 100644
--- a/drivers/media/dvb/frontends/sp8870.h
+++ b/drivers/media/dvb/frontends/sp8870.h
@@ -35,7 +35,7 @@ struct sp8870_config
         int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
 };
 
-#if defined(CONFIG_DVB_SP8870) || defined(CONFIG_DVB_SP8870_MODULE)
+#if defined(CONFIG_DVB_SP8870) || (defined(CONFIG_DVB_SP8870_MODULE) && defined(MODULE))
 extern struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
                                           struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/sp887x.h b/drivers/media/dvb/frontends/sp887x.h
index cab7ea644dfa..7ee78d7d916d 100644
--- a/drivers/media/dvb/frontends/sp887x.h
+++ b/drivers/media/dvb/frontends/sp887x.h
@@ -17,7 +17,7 @@ struct sp887x_config
         int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
 };
 
-#if defined(CONFIG_DVB_SP887X) || defined(CONFIG_DVB_SP887X_MODULE)
+#if defined(CONFIG_DVB_SP887X) || (defined(CONFIG_DVB_SP887X_MODULE) && defined(MODULE))
 extern struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
                                           struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/stv0297.h b/drivers/media/dvb/frontends/stv0297.h
index 760b80db43a5..69f4515df2b9 100644
--- a/drivers/media/dvb/frontends/stv0297.h
+++ b/drivers/media/dvb/frontends/stv0297.h
@@ -42,7 +42,7 @@ struct stv0297_config
         u8 stop_during_read:1;
 };
 
-#if defined(CONFIG_DVB_STV0297) || defined(CONFIG_DVB_STV0297_MODULE)
+#if defined(CONFIG_DVB_STV0297) || (defined(CONFIG_DVB_STV0297_MODULE) && defined(MODULE))
 extern struct dvb_frontend* stv0297_attach(const struct stv0297_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/stv0299.h b/drivers/media/dvb/frontends/stv0299.h
index 7ef25207081d..33df9495908f 100644
--- a/drivers/media/dvb/frontends/stv0299.h
+++ b/drivers/media/dvb/frontends/stv0299.h
@@ -89,7 +89,7 @@ struct stv0299_config
         int (*set_symbol_rate)(struct dvb_frontend* fe, u32 srate, u32 ratio);
 };
 
-#if defined(CONFIG_DVB_STV0299) || defined(CONFIG_DVB_STV0299_MODULE)
+#if defined(CONFIG_DVB_STV0299) || (defined(CONFIG_DVB_STV0299_MODULE) && defined(MODULE))
 extern struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/tda10021.h b/drivers/media/dvb/frontends/tda10021.h
index d68ae20c8412..e3da780108f6 100644
--- a/drivers/media/dvb/frontends/tda10021.h
+++ b/drivers/media/dvb/frontends/tda10021.h
@@ -32,7 +32,7 @@ struct tda10021_config
         u8 demod_address;
 };
 
-#if defined(CONFIG_DVB_TDA10021) || defined(CONFIG_DVB_TDA10021_MODULE)
+#if defined(CONFIG_DVB_TDA10021) || (defined(CONFIG_DVB_TDA10021_MODULE) && defined(MODULE))
 extern struct dvb_frontend* tda10021_attach(const struct tda10021_config* config,
                                             struct i2c_adapter* i2c, u8 pwm);
 #else
diff --git a/drivers/media/dvb/frontends/tda1004x.h b/drivers/media/dvb/frontends/tda1004x.h
index e28fca05734c..605ad2dfc09d 100644
--- a/drivers/media/dvb/frontends/tda1004x.h
+++ b/drivers/media/dvb/frontends/tda1004x.h
@@ -71,7 +71,7 @@ struct tda1004x_config
         int (*request_firmware)(struct dvb_frontend* fe, const struct firmware **fw, char* name);
 };
 
-#if defined(CONFIG_DVB_TDA1004X) || defined(CONFIG_DVB_TDA1004X_MODULE)
+#if defined(CONFIG_DVB_TDA1004X) || (defined(CONFIG_DVB_TDA1004X_MODULE) && defined(MODULE))
 extern struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
                                             struct i2c_adapter* i2c);
 
diff --git a/drivers/media/dvb/frontends/tda10086.h b/drivers/media/dvb/frontends/tda10086.h
index e8061db11123..ed584a8f4a89 100644
--- a/drivers/media/dvb/frontends/tda10086.h
+++ b/drivers/media/dvb/frontends/tda10086.h
@@ -35,7 +35,16 @@ struct tda10086_config
         u8 invert;
 };
 
+#if defined(CONFIG_DVB_TDA10086) || (defined(CONFIG_DVB_TDA10086_MODULE) && defined(MODULE))
 extern struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
                                             struct i2c_adapter* i2c);
+#else
+static inline struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
+                                                   struct i2c_adapter* i2c)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __FUNCTION__);
+        return NULL;
+}
+#endif // CONFIG_DVB_TDA10086
 
 #endif // TDA10086_H
diff --git a/drivers/media/dvb/frontends/tda8083.h b/drivers/media/dvb/frontends/tda8083.h
index aae15bdce6eb..2d3307999f21 100644
--- a/drivers/media/dvb/frontends/tda8083.h
+++ b/drivers/media/dvb/frontends/tda8083.h
@@ -35,7 +35,7 @@ struct tda8083_config
         u8 demod_address;
 };
 
-#if defined(CONFIG_DVB_TDA8083) || defined(CONFIG_DVB_TDA8083_MODULE)
+#if defined(CONFIG_DVB_TDA8083) || (defined(CONFIG_DVB_TDA8083_MODULE) && defined(MODULE))
 extern struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/tda826x.c b/drivers/media/dvb/frontends/tda826x.c
index eeab26bd36ed..34815b0b97e4 100644
--- a/drivers/media/dvb/frontends/tda826x.c
+++ b/drivers/media/dvb/frontends/tda826x.c
@@ -121,7 +121,7 @@ static struct dvb_tuner_ops tda826x_tuner_ops = {
         .info = {
                 .name = "Philips TDA826X",
                 .frequency_min = 950000,
-                .frequency_min = 2175000
+                .frequency_max = 2175000
         },
         .release = tda826x_release,
         .sleep = tda826x_sleep,
diff --git a/drivers/media/dvb/frontends/tda826x.h b/drivers/media/dvb/frontends/tda826x.h
index 3307607632b0..ad9981195961 100644
--- a/drivers/media/dvb/frontends/tda826x.h
+++ b/drivers/media/dvb/frontends/tda826x.h
@@ -35,6 +35,19 @@
  * @param has_loopthrough Set to 1 if the card has a loopthrough RF connector.
  * @return FE pointer on success, NULL on failure.
  */
-extern struct dvb_frontend *tda826x_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c, int has_loopthrough);
-
-#endif
+#if defined(CONFIG_DVB_TDA826X) || (defined(CONFIG_DVB_TDA826X_MODULE) && defined(MODULE))
+extern struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe, int addr,
+                                           struct i2c_adapter *i2c,
+                                           int has_loopthrough);
+#else
+static inline struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe,
+                                                  int addr,
+                                                  struct i2c_adapter *i2c,
+                                                  int has_loopthrough)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __FUNCTION__);
+        return NULL;
+}
+#endif // CONFIG_DVB_TDA826X
+
+#endif // __DVB_TDA826X_H__
diff --git a/drivers/media/dvb/frontends/tua6100.h b/drivers/media/dvb/frontends/tua6100.h
index 8f98033ffa7b..03a665e7df6d 100644
--- a/drivers/media/dvb/frontends/tua6100.h
+++ b/drivers/media/dvb/frontends/tua6100.h
@@ -34,7 +34,7 @@
 #include <linux/i2c.h>
 #include "dvb_frontend.h"
 
-#if defined(CONFIG_DVB_TUA6100) || defined(CONFIG_DVB_TUA6100_MODULE)
+#if defined(CONFIG_DVB_TUA6100) || (defined(CONFIG_DVB_TUA6100_MODULE) && defined(MODULE))
 extern struct dvb_frontend *tua6100_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c);
 #else
 static inline struct dvb_frontend* tua6100_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c)
diff --git a/drivers/media/dvb/frontends/ves1820.h b/drivers/media/dvb/frontends/ves1820.h
index f0c9dded39d7..e4a2a324046a 100644
--- a/drivers/media/dvb/frontends/ves1820.h
+++ b/drivers/media/dvb/frontends/ves1820.h
@@ -41,7 +41,7 @@ struct ves1820_config
         u8 selagc:1;
 };
 
-#if defined(CONFIG_DVB_VES1820) || defined(CONFIG_DVB_VES1820_MODULE)
+#if defined(CONFIG_DVB_VES1820) || (defined(CONFIG_DVB_VES1820_MODULE) && defined(MODULE))
 extern struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
                                            struct i2c_adapter* i2c, u8 pwm);
 #else
diff --git a/drivers/media/dvb/frontends/ves1x93.h b/drivers/media/dvb/frontends/ves1x93.h
index 395fed39b286..d507f8966f81 100644
--- a/drivers/media/dvb/frontends/ves1x93.h
+++ b/drivers/media/dvb/frontends/ves1x93.h
@@ -40,7 +40,7 @@ struct ves1x93_config
         u8 invert_pwm:1;
 };
 
-#if defined(CONFIG_DVB_VES1X93) || defined(CONFIG_DVB_VES1X93_MODULE)
+#if defined(CONFIG_DVB_VES1X93) || (defined(CONFIG_DVB_VES1X93_MODULE) && defined(MODULE))
 extern struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
                                            struct i2c_adapter* i2c);
 #else
diff --git a/drivers/media/dvb/frontends/zl10353.h b/drivers/media/dvb/frontends/zl10353.h
index 79a947215c4d..0bc0109737f1 100644
--- a/drivers/media/dvb/frontends/zl10353.h
+++ b/drivers/media/dvb/frontends/zl10353.h
@@ -36,7 +36,7 @@ struct zl10353_config
         int parallel_ts;
 };
 
-#if defined(CONFIG_DVB_ZL10353) || defined(CONFIG_DVB_ZL10353_MODULE)
+#if defined(CONFIG_DVB_ZL10353) || (defined(CONFIG_DVB_ZL10353_MODULE) && defined(MODULE))
 extern struct dvb_frontend* zl10353_attach(const struct zl10353_config *config,
                                            struct i2c_adapter *i2c);
 #else
diff --git a/drivers/media/dvb/ttpci/budget-ci.c b/drivers/media/dvb/ttpci/budget-ci.c
index 2a2e9b400613..cd5ec489af1c 100644
--- a/drivers/media/dvb/ttpci/budget-ci.c
+++ b/drivers/media/dvb/ttpci/budget-ci.c
@@ -46,7 +46,14 @@
 #include "bsbe1.h"
 #include "bsru6.h"
 
-#define DEBIADDR_IR             0x1234
+/*
+ * Regarding DEBIADDR_IR:
+ * Some CI modules hang if random addresses are read.
+ * Using address 0x4000 for the IR read means that we
+ * use the same address as for CI version, which should
+ * be a safe default.
+ */
+#define DEBIADDR_IR             0x4000
 #define DEBIADDR_CICONTROL      0x0000
 #define DEBIADDR_CIVERSION      0x4000
 #define DEBIADDR_IO             0x1000
@@ -1028,6 +1035,7 @@ static void frontend_init(struct budget_ci *budget_ci)
 
         case 0x1012:            // TT DVB-T CI budget (tda10046/Philips tdm1316l(tda6651tt))
                 budget_ci->tuner_pll_address = 0x60;
+                philips_tdm1316l_config.invert = 1;
                 budget_ci->budget.dvb_frontend =
                         dvb_attach(tda10046_attach, &philips_tdm1316l_config, &budget_ci->budget.i2c_adap);
                 if (budget_ci->budget.dvb_frontend) {
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index afb734df6e05..bf267552941f 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -186,7 +186,7 @@ config VIDEO_KS0127
 
 config VIDEO_SAA7110
         tristate "Philips SAA7110 video decoder"
-        depends on VIDEO_V4L1
+        depends on VIDEO_V4L1 && I2C
         ---help---
           Support for the Philips SAA7110 video decoders.
 
@@ -677,6 +677,8 @@ config VIDEO_M32R_AR_M64278
 menu "V4L USB devices"
         depends on USB && VIDEO_DEV
 
+source "drivers/media/video/pvrusb2/Kconfig"
+
 source "drivers/media/video/em28xx/Kconfig"
 
 source "drivers/media/video/usbvideo/Kconfig"
diff --git a/drivers/media/video/bt8xx/bttv-cards.c b/drivers/media/video/bt8xx/bttv-cards.c
index a84903e0d810..21ebe8f13815 100644
--- a/drivers/media/video/bt8xx/bttv-cards.c
+++ b/drivers/media/video/bt8xx/bttv-cards.c
@@ -4001,7 +4001,7 @@ static void __devinit init_PXC200(struct bttv *btv)
  *      - sleep 1ms
  *      - write 0x0E
  *     read from GPIO_DATA into buf (uint_32)
- *      - if ( buf>>18 & 0x01 ) || ( buf>>19 && 0x01 != 0 )
+ *      - if ( buf>>18 & 0x01 ) || ( buf>>19 & 0x01 != 0 )
  *                error. ERROR_CPLD_Check_Failed.
  */
 /* ----------------------------------------------------------------------- */
diff --git a/drivers/media/video/cx25840/cx25840-vbi.c b/drivers/media/video/cx25840/cx25840-vbi.c
index 48014a254e15..f85f2084324f 100644
--- a/drivers/media/video/cx25840/cx25840-vbi.c
+++ b/drivers/media/video/cx25840/cx25840-vbi.c
@@ -235,6 +235,7 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
                         0, 0, V4L2_SLICED_VPS, 0, 0,    /* 9 */
                         0, 0, 0, 0
                 };
+                int is_pal = !(cx25840_get_v4lstd(client) & V4L2_STD_525_60);
                 int i;
 
                 fmt = arg;
@@ -246,13 +247,25 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
                 if ((cx25840_read(client, 0x404) & 0x10) == 0)
                         break;
 
-                for (i = 7; i <= 23; i++) {
-                        u8 v = cx25840_read(client, 0x424 + i - 7);
+                if (is_pal) {
+                        for (i = 7; i <= 23; i++) {
+                                u8 v = cx25840_read(client, 0x424 + i - 7);
+
+                                svbi->service_lines[0][i] = lcr2vbi[v >> 4];
+                                svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
+                                svbi->service_set |=
+                                        svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                        }
+                }
+                else {
+                        for (i = 10; i <= 21; i++) {
+                                u8 v = cx25840_read(client, 0x424 + i - 10);
 
-                        svbi->service_lines[0][i] = lcr2vbi[v >> 4];
-                        svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
-                        svbi->service_set |=
-                                 svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                                svbi->service_lines[0][i] = lcr2vbi[v >> 4];
+                                svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
+                                svbi->service_set |=
+                                        svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                        }
                 }
                 break;
         }
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index af71d4225c76..f764a57c56be 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -1230,6 +1230,7 @@ struct cx88_board cx88_boards[] = {
                         .vmux   = 2,
                         .gpio0  = 0x84bf,
                 }},
+                .mpeg           = CX88_MPEG_DVB,
         },
         [CX88_BOARD_NORWOOD_MICRO] = {
                 .name           = "Norwood Micro TV Tuner",
@@ -1590,6 +1591,18 @@ struct cx88_subid cx88_subids[] = {
                 .subvendor = 0x0070,
                 .subdevice = 0x9000,
                 .card      = CX88_BOARD_HAUPPAUGE_DVB_T1,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1400,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1401,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1402,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
         },
 };
 const unsigned int cx88_idcount = ARRAY_SIZE(cx88_subids);
@@ -1633,7 +1646,15 @@ static void hauppauge_eeprom(struct cx88_core *core, u8 *eeprom_data)
         /* Make sure we support the board model */
         switch (tv.model)
         {
+        case 14009: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in) */
+        case 14019: /* WinTV-HVR3000 (Retail, IR Blaster, b/panel video, 3.5mm audio in) */
+        case 14029: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - 880 bridge) */
+        case 14109: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - low profile) */
+        case 14129: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - 880 bridge - LP) */
+        case 14559: /* WinTV-HVR3000 (OEM, no IR, b/panel video, 3.5mm audio in) */
         case 14569: /* WinTV-HVR3000 (OEM, no IR, no back panel video) */
+        case 14659: /* WinTV-HVR3000 (OEM, no IR, b/panel video, RCA audio in - Low profile) */
+        case 14669: /* WinTV-HVR3000 (OEM, no IR, no b/panel video - Low profile) */
         case 28552: /* WinTV-PVR 'Roslyn' (No IR) */
         case 34519: /* WinTV-PCI-FM */
         case 90002: /* Nova-T-PCI (9002) */
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index bd0c8797f26d..0ef13e7efa2e 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -315,15 +315,22 @@ static struct cx22702_config hauppauge_novat_config = {
         .demod_address = 0x43,
         .output_mode   = CX22702_SERIAL_OUTPUT,
 };
+
 static struct cx22702_config hauppauge_hvr1100_config = {
         .demod_address = 0x63,
         .output_mode   = CX22702_SERIAL_OUTPUT,
 };
+
 static struct cx22702_config hauppauge_hvr1300_config = {
         .demod_address = 0x63,
         .output_mode   = CX22702_SERIAL_OUTPUT,
 };
 
+static struct cx22702_config hauppauge_hvr3000_config = {
+        .demod_address = 0x63,
+        .output_mode = CX22702_SERIAL_OUTPUT,
+};
+
 static int or51132_set_ts_param(struct dvb_frontend* fe,
                                 int is_punctured)
 {
@@ -558,6 +565,16 @@ static int dvb_register(struct cx8802_dev *dev)
                                    &dvb_pll_fmd1216me);
                 }
                 break;
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
+                dev->dvb.frontend = dvb_attach(cx22702_attach,
+                                               &hauppauge_hvr3000_config,
+                                               &dev->core->i2c_adap);
+                if (dev->dvb.frontend != NULL) {
+                        dvb_attach(dvb_pll_attach, dev->dvb.frontend, 0x61,
+                                   &dev->core->i2c_adap,
+                                   &dvb_pll_fmd1216me);
+                }
+                break;
         case CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_PLUS:
                 dev->dvb.frontend = dvb_attach(mt352_attach,
                                                &dvico_fusionhdtv,
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index 83ebf7a3c054..57e1c024a547 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -196,18 +196,25 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
         case CX88_BOARD_HAUPPAUGE_NOVASPLUS_S1:
         case CX88_BOARD_HAUPPAUGE_HVR1100:
         case CX88_BOARD_HAUPPAUGE_HVR1300:
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
                 ir_codes = ir_codes_hauppauge_new;
                 ir_type = IR_TYPE_RC5;
                 ir->sampling = 1;
                 break;
         case CX88_BOARD_WINFAST_DTV2000H:
-        case CX88_BOARD_WINFAST2000XP_EXPERT:
                 ir_codes = ir_codes_winfast;
                 ir->gpio_addr = MO_GP0_IO;
                 ir->mask_keycode = 0x8f8;
                 ir->mask_keyup = 0x100;
                 ir->polling = 50; /* ms */
                 break;
+        case CX88_BOARD_WINFAST2000XP_EXPERT:
+                ir_codes = ir_codes_winfast;
+                ir->gpio_addr = MO_GP0_IO;
+                ir->mask_keycode = 0x8f8;
+                ir->mask_keyup = 0x100;
+                ir->polling = 1; /* ms */
+                break;
         case CX88_BOARD_IODATA_GVBCTV7E:
                 ir_codes = ir_codes_iodata_bctv7e;
                 ir->gpio_addr = MO_GP0_IO;
@@ -215,7 +222,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
                 ir->mask_keydown = 0x02;
                 ir->polling = 5; /* ms */
                 break;
-       case CX88_BOARD_PROLINK_PLAYTVPVR:
+        case CX88_BOARD_PROLINK_PLAYTVPVR:
         case CX88_BOARD_PIXELVIEW_PLAYTV_ULTRA_PRO:
                 ir_codes = ir_codes_pixelview;
                 ir->gpio_addr = MO_GP1_IO;
@@ -419,6 +426,7 @@ void cx88_ir_irq(struct cx88_core *core)
         case CX88_BOARD_HAUPPAUGE_NOVASPLUS_S1:
         case CX88_BOARD_HAUPPAUGE_HVR1100:
         case CX88_BOARD_HAUPPAUGE_HVR1300:
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
                 ircode = ir_decode_biphase(ir->samples, ir->scount, 5, 7);
                 ir_dprintk("biphase decoded: %x\n", ircode);
                 if ((ircode & 0xfffff000) != 0x3000)
diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c
index bc544cc7ccb8..f786ab11d2cd 100644
--- a/drivers/media/video/et61x251/et61x251_core.c
+++ b/drivers/media/video/et61x251/et61x251_core.c
@@ -973,16 +973,32 @@ static CLASS_DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
                          et61x251_show_i2c_val, et61x251_store_i2c_val);
 
 
-static void et61x251_create_sysfs(struct et61x251_device* cam)
+static int et61x251_create_sysfs(struct et61x251_device* cam)
 {
         struct video_device *v4ldev = cam->v4ldev;
+        int rc;
 
-        video_device_create_file(v4ldev, &class_device_attr_reg);
-        video_device_create_file(v4ldev, &class_device_attr_val);
+        rc = video_device_create_file(v4ldev, &class_device_attr_reg);
+        if (rc) goto err;
+        rc = video_device_create_file(v4ldev, &class_device_attr_val);
+        if (rc) goto err_reg;
         if (cam->sensor.sysfs_ops) {
-                video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
-                video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
+                if (rc) goto err_val;
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_i2c_reg;
         }
+
+        return 0;
+
+err_i2c_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_i2c_reg);
+err_val:
+        video_device_remove_file(v4ldev, &class_device_attr_val);
+err_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_reg);
+err:
+        return rc;
 }
 #endif /* CONFIG_VIDEO_ADV_DEBUG */
 
@@ -2534,7 +2550,9 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
         dev_nr = (dev_nr < ET61X251_MAX_DEVICES-1) ? dev_nr+1 : 0;
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-        et61x251_create_sysfs(cam);
+        err = et61x251_create_sysfs(cam);
+        if (err)
+                goto fail2;
         DBG(2, "Optional device control through 'sysfs' interface ready");
 #endif
 
@@ -2544,6 +2562,13 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
         return 0;
 
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+fail2:
+        video_nr[dev_nr] = -1;
+        dev_nr = (dev_nr < ET61X251_MAX_DEVICES-1) ? dev_nr+1 : 0;
+        mutex_unlock(&cam->dev_mutex);
+        video_unregister_device(cam->v4ldev);
+#endif
 fail:
         if (cam) {
                 kfree(cam->control_buffer);
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index ce4886f1528d..b4db2cbb5a84 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -5648,17 +5648,49 @@ static ssize_t show_exposure(struct class_device *cd, char *buf)
 }
 static CLASS_DEVICE_ATTR(exposure, S_IRUGO, show_exposure, NULL);
 
-static void ov_create_sysfs(struct video_device *vdev)
+static int ov_create_sysfs(struct video_device *vdev)
 {
-        video_device_create_file(vdev, &class_device_attr_custom_id);
-        video_device_create_file(vdev, &class_device_attr_model);
-        video_device_create_file(vdev, &class_device_attr_bridge);
-        video_device_create_file(vdev, &class_device_attr_sensor);
-        video_device_create_file(vdev, &class_device_attr_brightness);
-        video_device_create_file(vdev, &class_device_attr_saturation);
-        video_device_create_file(vdev, &class_device_attr_contrast);
-        video_device_create_file(vdev, &class_device_attr_hue);
-        video_device_create_file(vdev, &class_device_attr_exposure);
+        int rc;
+
+        rc = video_device_create_file(vdev, &class_device_attr_custom_id);
+        if (rc) goto err;
+        rc = video_device_create_file(vdev, &class_device_attr_model);
+        if (rc) goto err_id;
+        rc = video_device_create_file(vdev, &class_device_attr_bridge);
+        if (rc) goto err_model;
+        rc = video_device_create_file(vdev, &class_device_attr_sensor);
+        if (rc) goto err_bridge;
+        rc = video_device_create_file(vdev, &class_device_attr_brightness);
+        if (rc) goto err_sensor;
+        rc = video_device_create_file(vdev, &class_device_attr_saturation);
+        if (rc) goto err_bright;
+        rc = video_device_create_file(vdev, &class_device_attr_contrast);
+        if (rc) goto err_sat;
+        rc = video_device_create_file(vdev, &class_device_attr_hue);
+        if (rc) goto err_contrast;
+        rc = video_device_create_file(vdev, &class_device_attr_exposure);
+        if (rc) goto err_hue;
+
+        return 0;
+
+err_hue:
+        video_device_remove_file(vdev, &class_device_attr_hue);
+err_contrast:
+        video_device_remove_file(vdev, &class_device_attr_contrast);
+err_sat:
+        video_device_remove_file(vdev, &class_device_attr_saturation);
+err_bright:
+        video_device_remove_file(vdev, &class_device_attr_brightness);
+err_sensor:
+        video_device_remove_file(vdev, &class_device_attr_sensor);
+err_bridge:
+        video_device_remove_file(vdev, &class_device_attr_bridge);
+err_model:
+        video_device_remove_file(vdev, &class_device_attr_model);
+err_id:
+        video_device_remove_file(vdev, &class_device_attr_custom_id);
+err:
+        return rc;
 }
 
 /****************************************************************************
@@ -5817,7 +5849,11 @@ ov51x_probe(struct usb_interface *intf, const struct usb_device_id *id)
              ov->vdev->minor);
 
         usb_set_intfdata(intf, ov);
-        ov_create_sysfs(ov->vdev);
+        if (ov_create_sysfs(ov->vdev)) {
+                err("ov_create_sysfs failed");
+                goto error;
+        }
+
         return 0;
 
 error:
diff --git a/drivers/media/video/pvrusb2/pvrusb2-cx2584x-v4l.c b/drivers/media/video/pvrusb2/pvrusb2-cx2584x-v4l.c
index df8feac16aee..c80c26be6e4d 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-cx2584x-v4l.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-cx2584x-v4l.c
@@ -221,7 +221,7 @@ static unsigned int decoder_describe(struct pvr2_v4l_cx2584x *ctxt,
 static void decoder_reset(struct pvr2_v4l_cx2584x *ctxt)
 {
         int ret;
-        ret = pvr2_i2c_client_cmd(ctxt->client,VIDIOC_INT_RESET,0);
+        ret = pvr2_i2c_client_cmd(ctxt->client,VIDIOC_INT_RESET,NULL);
         pvr2_trace(PVR2_TRACE_CHIPS,"i2c cx25840 decoder_reset (ret=%d)",ret);
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
index 97e974d9b9c3..bb40e9085977 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-v4l2.c
@@ -711,8 +711,8 @@ static void pvr2_v4l2_dev_destroy(struct pvr2_v4l2_dev *dip)
                dip->devbase.minor,pvr2_config_get_name(dip->config));
 
         /* Paranoia */
-        dip->v4lp = 0;
-        dip->stream = 0;
+        dip->v4lp = NULL;
+        dip->stream = NULL;
 
         /* Actual deallocation happens later when all internal references
            are gone. */
@@ -1076,7 +1076,7 @@ struct pvr2_v4l2 *pvr2_v4l2_create(struct pvr2_context *mnp)
         vp->vdev = kmalloc(sizeof(*vp->vdev),GFP_KERNEL);
         if (!vp->vdev) {
                 kfree(vp);
-                return 0;
+                return NULL;
         }
         memset(vp->vdev,0,sizeof(*vp->vdev));
         pvr2_channel_init(&vp->channel,mnp);
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index c77b85cf3d80..46c114830884 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -1024,12 +1024,25 @@ static ssize_t show_snapshot_button_status(struct class_device *class_dev, char
 static CLASS_DEVICE_ATTR(button, S_IRUGO | S_IWUSR, show_snapshot_button_status,
                          NULL);
 
-static void pwc_create_sysfs_files(struct video_device *vdev)
+static int pwc_create_sysfs_files(struct video_device *vdev)
 {
         struct pwc_device *pdev = video_get_drvdata(vdev);
-        if (pdev->features & FEATURE_MOTOR_PANTILT)
-                video_device_create_file(vdev, &class_device_attr_pan_tilt);
-        video_device_create_file(vdev, &class_device_attr_button);
+        int rc;
+
+        rc = video_device_create_file(vdev, &class_device_attr_button);
+        if (rc)
+                goto err;
+        if (pdev->features & FEATURE_MOTOR_PANTILT) {
+                rc = video_device_create_file(vdev,&class_device_attr_pan_tilt);
+                if (rc) goto err_button;
+        }
+
+        return 0;
+
+err_button:
+        video_device_remove_file(vdev, &class_device_attr_button);
+err:
+        return rc;
 }
 
 static void pwc_remove_sysfs_files(struct video_device *vdev)
@@ -1408,7 +1421,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
         struct usb_device *udev = interface_to_usbdev(intf);
         struct pwc_device *pdev = NULL;
         int vendor_id, product_id, type_id;
-        int i, hint;
+        int i, hint, rc;
         int features = 0;
         int video_nr = -1; /* default: use next available device */
         char serial_number[30], *name;
@@ -1709,9 +1722,8 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
         i = video_register_device(pdev->vdev, VFL_TYPE_GRABBER, video_nr);
         if (i < 0) {
                 PWC_ERROR("Failed to register as video device (%d).\n", i);
-                video_device_release(pdev->vdev); /* Drip... drip... drip... */
-                kfree(pdev); /* Oops, no memory leaks please */
-                return -EIO;
+                rc = i;
+                goto err;
         }
         else {
                 PWC_INFO("Registered as /dev/video%d.\n", pdev->vdev->minor & 0x3F);
@@ -1723,13 +1735,24 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
 
         PWC_DEBUG_PROBE("probe() function returning struct at 0x%p.\n", pdev);
         usb_set_intfdata (intf, pdev);
-        pwc_create_sysfs_files(pdev->vdev);
+        rc = pwc_create_sysfs_files(pdev->vdev);
+        if (rc)
+                goto err_unreg;
 
         /* Set the leds off */
         pwc_set_leds(pdev, 0, 0);
         pwc_camera_power(pdev, 0);
 
         return 0;
+
+err_unreg:
+        if (hint < MAX_DEV_HINTS)
+                device_hint[hint].pdev = NULL;
+        video_unregister_device(pdev->vdev);
+err:
+        video_device_release(pdev->vdev); /* Drip... drip... drip... */
+        kfree(pdev); /* Oops, no memory leaks please */
+        return rc;
 }
 
 /* The user janked out the cable... */
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index 974179d4d389..c5719f7bd1ac 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -960,6 +960,8 @@ static void saa711x_set_v4lstd(struct i2c_client *client, v4l2_std_id std)
                         reg |= 0x10;
                 } else if (std == V4L2_STD_NTSC_M_JP) {
                         reg |= 0x40;
+                } else if (std == V4L2_STD_SECAM) {
+                        reg |= 0x50;
                 }
                 saa711x_write(client, R_0E_CHROMA_CNTL_1, reg);
         } else {
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index c9d8e3b9cc37..51f0cfdcb680 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -2969,7 +2969,7 @@ struct saa7134_board saa7134_boards[] = {
                 /* Petr Baudis <pasky@ucw.cz> */
                 .name           = "AVerMedia TV Hybrid A16AR",
                 .audio_clock    = 0x187de7,
-                .tuner_type     = TUNER_PHILIPS_TDA8290, /* untested */
+                .tuner_type     = TUNER_PHILIPS_TD1316, /* untested */
                 .radio_type     = TUNER_TEA5767, /* untested */
                 .tuner_addr     = ADDR_UNSET,
                 .radio_addr     = ADDR_UNSET,
@@ -3718,6 +3718,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
         case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
         case SAA7134_BOARD_AVERMEDIA_307:
         case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
+        case SAA7134_BOARD_AVERMEDIA_777:
 /*      case SAA7134_BOARD_SABRENT_SBTTVFM:  */ /* not finished yet */
         case SAA7134_BOARD_VIDEOMATE_TV_PVR:
         case SAA7134_BOARD_VIDEOMATE_GOLD_PLUS:
@@ -3734,6 +3735,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
         case SAA7134_BOARD_FLYDVBT_LR301:
         case SAA7134_BOARD_FLYDVBTDUO:
         case SAA7134_BOARD_PROTEUS_2309:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
                 dev->has_remote = SAA7134_REMOTE_GPIO;
                 break;
         case SAA7134_BOARD_FLYDVBS_LR300:
@@ -3772,7 +3774,6 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                 saa_writeb(SAA7134_GPIO_GPMODE3, 0x08);
                 saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x00);
                 break;
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
         case SAA7134_BOARD_AVERMEDIA_CARDBUS:
                 /* power-up tuner chip */
                 saa_andorl(SAA7134_GPIO_GPMODE0 >> 2,   0xffffffff, 0xffffffff);
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 1ba53b525ad2..6b61d9b2fcb5 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1147,6 +1147,8 @@ static int dvb_init(struct saa7134_dev *dev)
                                                &philips_europa_config,
                                                &dev->i2c_adap);
                 if (dev->dvb.frontend) {
+                        dev->original_demod_sleep = dev->dvb.frontend->ops.sleep;
+                        dev->dvb.frontend->ops.sleep = philips_europa_demod_sleep;
                         dev->dvb.frontend->ops.tuner_ops.init = philips_europa_tuner_init;
                         dev->dvb.frontend->ops.tuner_ops.sleep = philips_europa_tuner_sleep;
                         dev->dvb.frontend->ops.tuner_ops.set_params = philips_td1316_tuner_set_params;
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index ff5991136f4e..dee83552e681 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -185,7 +185,6 @@ int saa7134_input_init1(struct saa7134_dev *dev)
         case SAA7134_BOARD_AVERMEDIA_STUDIO_305:
         case SAA7134_BOARD_AVERMEDIA_STUDIO_307:
         case SAA7134_BOARD_AVERMEDIA_GO_007_FM:
-        case SAA7134_BOARD_AVERMEDIA_A16AR:
                 ir_codes     = ir_codes_avermedia;
                 mask_keycode = 0x0007C8;
                 mask_keydown = 0x000010;
@@ -194,6 +193,16 @@ int saa7134_input_init1(struct saa7134_dev *dev)
                 saa_setb(SAA7134_GPIO_GPMODE0, 0x4);
                 saa_setb(SAA7134_GPIO_GPSTATUS0, 0x4);
                 break;
+        case SAA7134_BOARD_AVERMEDIA_777:
+        case SAA7134_BOARD_AVERMEDIA_A16AR:
+                ir_codes     = ir_codes_avermedia;
+                mask_keycode = 0x02F200;
+                mask_keydown = 0x000400;
+                polling      = 50; // ms
+                /* Without this we won't receive key up events */
+                saa_setb(SAA7134_GPIO_GPMODE1, 0x1);
+                saa_setb(SAA7134_GPIO_GPSTATUS1, 0x1);
+                break;
         case SAA7134_BOARD_KWORLD_TERMINATOR:
                 ir_codes     = ir_codes_pixelview;
                 mask_keycode = 0x00001f;
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index 203302f21827..830617ea81cc 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -2248,7 +2248,11 @@ static int radio_do_ioctl(struct inode *inode, struct file *file,
                 t->type = V4L2_TUNER_RADIO;
 
                 saa7134_i2c_call_clients(dev, VIDIOC_G_TUNER, t);
-
+                if (dev->input->amux == TV) {
+                        t->signal = 0xf800 - ((saa_readb(0x581) & 0x1f) << 11);
+                        t->rxsubchans = (saa_readb(0x529) & 0x08) ?
+                                        V4L2_TUNER_SUB_STEREO : V4L2_TUNER_SUB_MONO;
+                }
                 return 0;
         }
         case VIDIOC_S_TUNER:
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index 3e0ff8a78468..a4702d3c2aca 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1240,23 +1240,53 @@ static CLASS_DEVICE_ATTR(frame_header, S_IRUGO,
                          sn9c102_show_frame_header, NULL);
 
 
-static void sn9c102_create_sysfs(struct sn9c102_device* cam)
+static int sn9c102_create_sysfs(struct sn9c102_device* cam)
 {
         struct video_device *v4ldev = cam->v4ldev;
+        int rc;
+
+        rc = video_device_create_file(v4ldev, &class_device_attr_reg);
+        if (rc) goto err;
+        rc = video_device_create_file(v4ldev, &class_device_attr_val);
+        if (rc) goto err_reg;
+        rc = video_device_create_file(v4ldev, &class_device_attr_frame_header);
+        if (rc) goto err_val;
 
-        video_device_create_file(v4ldev, &class_device_attr_reg);
-        video_device_create_file(v4ldev, &class_device_attr_val);
-        video_device_create_file(v4ldev, &class_device_attr_frame_header);
-        if (cam->bridge == BRIDGE_SN9C101 || cam->bridge == BRIDGE_SN9C102)
-                video_device_create_file(v4ldev, &class_device_attr_green);
-        else if (cam->bridge == BRIDGE_SN9C103) {
-                video_device_create_file(v4ldev, &class_device_attr_blue);
-                video_device_create_file(v4ldev, &class_device_attr_red);
-        }
         if (cam->sensor.sysfs_ops) {
-                video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
-                video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
+                if (rc) goto err_frhead;
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_i2c_reg;
+        }
+
+        if (cam->bridge == BRIDGE_SN9C101 || cam->bridge == BRIDGE_SN9C102) {
+                rc = video_device_create_file(v4ldev, &class_device_attr_green);
+                if (rc) goto err_i2c_val;
+        } else if (cam->bridge == BRIDGE_SN9C103) {
+                rc = video_device_create_file(v4ldev, &class_device_attr_blue);
+                if (rc) goto err_i2c_val;
+                rc = video_device_create_file(v4ldev, &class_device_attr_red);
+                if (rc) goto err_blue;
         }
+
+        return 0;
+
+err_blue:
+        video_device_remove_file(v4ldev, &class_device_attr_blue);
+err_i2c_val:
+        if (cam->sensor.sysfs_ops)
+                video_device_remove_file(v4ldev, &class_device_attr_i2c_val);
+err_i2c_reg:
+        if (cam->sensor.sysfs_ops)
+                video_device_remove_file(v4ldev, &class_device_attr_i2c_reg);
+err_frhead:
+        video_device_remove_file(v4ldev, &class_device_attr_frame_header);
+err_val:
+        video_device_remove_file(v4ldev, &class_device_attr_val);
+err_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_reg);
+err:
+        return rc;
 }
 #endif /* CONFIG_VIDEO_ADV_DEBUG */
 
@@ -2809,10 +2839,7 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
                 DBG(1, "V4L2 device registration failed");
                 if (err == -ENFILE && video_nr[dev_nr] == -1)
                         DBG(1, "Free /dev/videoX node not found");
-                video_nr[dev_nr] = -1;
-                dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
-                mutex_unlock(&cam->dev_mutex);
-                goto fail;
+                goto fail2;
         }
 
         DBG(2, "V4L2 device registered as /dev/video%d", cam->v4ldev->minor);
@@ -2823,7 +2850,9 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
         dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
 
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-        sn9c102_create_sysfs(cam);
+        err = sn9c102_create_sysfs(cam);
+        if (err)
+                goto fail3;
         DBG(2, "Optional device control through 'sysfs' interface ready");
 #endif
 
@@ -2833,6 +2862,14 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
 
         return 0;
 
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+fail3:
+        video_unregister_device(cam->v4ldev);
+#endif
+fail2:
+        video_nr[dev_nr] = -1;
+        dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
+        mutex_unlock(&cam->dev_mutex);
 fail:
         if (cam) {
                 kfree(cam->control_buffer);
diff --git a/drivers/media/video/stv680.c b/drivers/media/video/stv680.c
index 87e11300181d..6d1ef1e2e8ef 100644
--- a/drivers/media/video/stv680.c
+++ b/drivers/media/video/stv680.c
@@ -516,16 +516,45 @@ stv680_file(frames_read, framecount, "%d\n");
 stv680_file(packets_dropped, dropped, "%d\n");
 stv680_file(decoding_errors, error, "%d\n");
 
-static void stv680_create_sysfs_files(struct video_device *vdev)
+static int stv680_create_sysfs_files(struct video_device *vdev)
 {
-        video_device_create_file(vdev, &class_device_attr_model);
-        video_device_create_file(vdev, &class_device_attr_in_use);
-        video_device_create_file(vdev, &class_device_attr_streaming);
-        video_device_create_file(vdev, &class_device_attr_palette);
-        video_device_create_file(vdev, &class_device_attr_frames_total);
-        video_device_create_file(vdev, &class_device_attr_frames_read);
-        video_device_create_file(vdev, &class_device_attr_packets_dropped);
-        video_device_create_file(vdev, &class_device_attr_decoding_errors);
+        int rc;
+
+        rc = video_device_create_file(vdev, &class_device_attr_model);
+        if (rc) goto err;
+        rc = video_device_create_file(vdev, &class_device_attr_in_use);
+        if (rc) goto err_model;
+        rc = video_device_create_file(vdev, &class_device_attr_streaming);
+        if (rc) goto err_inuse;
+        rc = video_device_create_file(vdev, &class_device_attr_palette);
+        if (rc) goto err_stream;
+        rc = video_device_create_file(vdev, &class_device_attr_frames_total);
+        if (rc) goto err_pal;
+        rc = video_device_create_file(vdev, &class_device_attr_frames_read);
+        if (rc) goto err_framtot;
+        rc = video_device_create_file(vdev, &class_device_attr_packets_dropped);
+        if (rc) goto err_framread;
+        rc = video_device_create_file(vdev, &class_device_attr_decoding_errors);
+        if (rc) goto err_dropped;
+
+        return 0;
+
+err_dropped:
+        video_device_remove_file(vdev, &class_device_attr_packets_dropped);
+err_framread:
+        video_device_remove_file(vdev, &class_device_attr_frames_read);
+err_framtot:
+        video_device_remove_file(vdev, &class_device_attr_frames_total);
+err_pal:
+        video_device_remove_file(vdev, &class_device_attr_palette);
+err_stream:
+        video_device_remove_file(vdev, &class_device_attr_streaming);
+err_inuse:
+        video_device_remove_file(vdev, &class_device_attr_in_use);
+err_model:
+        video_device_remove_file(vdev, &class_device_attr_model);
+err:
+        return rc;
 }
 
 static void stv680_remove_sysfs_files(struct video_device *vdev)
@@ -1418,9 +1447,13 @@ static int stv680_probe (struct usb_interface *intf, const struct usb_device_id
         PDEBUG (0, "STV(i): registered new video device: video%d", stv680->vdev->minor);
 
         usb_set_intfdata (intf, stv680);
-        stv680_create_sysfs_files(stv680->vdev);
+        retval = stv680_create_sysfs_files(stv680->vdev);
+        if (retval)
+                goto error_unreg;
         return 0;
 
+error_unreg:
+        video_unregister_device(stv680->vdev);
 error_vdev:
         video_device_release(stv680->vdev);
 error:
diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
index 8fff642fad56..781682373b61 100644
--- a/drivers/media/video/tuner-types.c
+++ b/drivers/media/video/tuner-types.c
@@ -1046,7 +1046,6 @@ static struct tuner_params tuner_samsung_tcpn_2121p30a_params[] = {
                 .type   = TUNER_PARAM_TYPE_NTSC,
                 .ranges = tuner_samsung_tcpn_2121p30a_ntsc_ranges,
                 .count  = ARRAY_SIZE(tuner_samsung_tcpn_2121p30a_ntsc_ranges),
-                .has_tda9887 = 1,
         },
 };
 
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index e6baaee038bf..6b9ef731b83a 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -468,7 +468,7 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
                                 (eeprom_data[i+6] << 8) +
                                 (eeprom_data[i+7] << 16);
 
-                                if ( (eeprom_data[i + 8] && 0xf0) &&
+                                if ( (eeprom_data[i + 8] & 0xf0) &&
                                         (tvee->serial_number < 0xffffff) ) {
                                         tvee->MAC_address[0] = 0x00;
                                         tvee->MAC_address[1] = 0x0D;
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 479a0675cf60..d424a4129d69 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -17,10 +17,11 @@
  */
 
 #define dbgarg(cmd, fmt, arg...) \
-                if (vfd->debug & V4L2_DEBUG_IOCTL_ARG)                  \
+                if (vfd->debug & V4L2_DEBUG_IOCTL_ARG) {                \
                         printk (KERN_DEBUG "%s: ",  vfd->name);         \
                         v4l_printk_ioctl(cmd);                          \
-                        printk (KERN_DEBUG "%s: " fmt, vfd->name, ## arg);
+                        printk (KERN_DEBUG "%s: " fmt, vfd->name, ## arg); \
+                }
 
 #define dbgarg2(fmt, arg...) \
                 if (vfd->debug & V4L2_DEBUG_IOCTL_ARG)                  \
@@ -1287,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                         ret=vfd->vidioc_g_parm(file, fh, p);
                 } else {
                         struct v4l2_standard s;
+                        int i;
 
                         if (!vfd->tvnormsize) {
                                 printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1297,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                         if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                 return -EINVAL;
 
-                        v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,
-                                                 vfd->tvnorms[vfd->current_norm].name);
+                        for (i = 0; i < vfd->tvnormsize; i++)
+                                if (vfd->tvnorms[i].id == vfd->current_norm)
+                                        break;
+                        if (i >= vfd->tvnormsize)
+                                return -EINVAL;
+
+                        v4l2_video_std_construct(&s, vfd->current_norm,
+                                                 vfd->tvnorms[i].name);
 
                         memset(p,0,sizeof(*p));
 
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index e7c01d560b64..3c8dc72dc8e9 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -272,7 +272,7 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
 
         /* Get first addr pointed to pixel position */
         oldpg=get_addr_pos(pos,pages,to_addr);
-        pg=pfn_to_page(to_addr[oldpg].sg->dma_address >> PAGE_SHIFT);
+        pg=pfn_to_page(sg_dma_address(to_addr[oldpg].sg) >> PAGE_SHIFT);
         basep = kmap_atomic(pg, KM_BOUNCE_READ)+to_addr[oldpg].sg->offset;
 
         /* We will just duplicate the second pixel at the packet */
@@ -287,7 +287,7 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
                 for (color=0;color<4;color++) {
                         pgpos=get_addr_pos(pos,pages,to_addr);
                         if (pgpos!=oldpg) {
-                                pg=pfn_to_page(to_addr[pgpos].sg->dma_address >> PAGE_SHIFT);
+                                pg=pfn_to_page(sg_dma_address(to_addr[pgpos].sg) >> PAGE_SHIFT);
                                 kunmap_atomic(basep, KM_BOUNCE_READ);
                                 basep= kmap_atomic(pg, KM_BOUNCE_READ)+to_addr[pgpos].sg->offset;
                                 oldpg=pgpos;
@@ -339,8 +339,8 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
                                 for (color=0;color<4;color++) {
                                         pgpos=get_addr_pos(pos,pages,to_addr);
                                         if (pgpos!=oldpg) {
-                                                pg=pfn_to_page(to_addr[pgpos].
-                                                                sg->dma_address
+                                                pg=pfn_to_page(sg_dma_address(
+                                                                to_addr[pgpos].sg)
                                                                 >> PAGE_SHIFT);
                                                 kunmap_atomic(basep,
                                                                 KM_BOUNCE_READ);
@@ -386,7 +386,7 @@ static void vivi_fillbuff(struct vivi_dev *dev,struct vivi_buffer *buf)
         struct timeval ts;
 
         /* Test if DMA mapping is ready */
-        if (!vb->dma.sglist[0].dma_address)
+        if (!sg_dma_address(&vb->dma.sglist[0]))
                 return;
 
         prep_to_addr(to_addr,vb);
@@ -783,7 +783,7 @@ static int vivi_map_sg(void *dev, struct scatterlist *sg, int nents,
         for (i = 0; i < nents; i++ ) {
                 BUG_ON(!sg[i].page);
 
-                sg[i].dma_address = page_to_phys(sg[i].page) + sg[i].offset;
+                sg_dma_address(&sg[i]) = page_to_phys(sg[i].page) + sg[i].offset;
         }
 
         return nents;
diff --git a/drivers/message/fusion/mptbase.h b/drivers/message/fusion/mptbase.h
index c537d71c18e4..a4afad4ecab2 100644
--- a/drivers/message/fusion/mptbase.h
+++ b/drivers/message/fusion/mptbase.h
@@ -75,8 +75,8 @@
 #define COPYRIGHT       "Copyright (c) 1999-2005 " MODULEAUTHOR
 #endif
 
-#define MPT_LINUX_VERSION_COMMON        "3.04.01"
-#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.01"
+#define MPT_LINUX_VERSION_COMMON        "3.04.02"
+#define MPT_LINUX_PACKAGE_NAME          "@(#)mptlinux-3.04.02"
 #define WHAT_MAGIC_STRING               "@" "(" "#" ")"
 
 #define show_mptmod_ver(s,ver)  \
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index e57bb035a021..1dd491773150 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -96,6 +96,10 @@ static int mptfc_qcmd(struct scsi_cmnd *SCpnt,
 static void mptfc_target_destroy(struct scsi_target *starget);
 static void mptfc_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout);
 static void __devexit mptfc_remove(struct pci_dev *pdev);
+static int mptfc_abort(struct scsi_cmnd *SCpnt);
+static int mptfc_dev_reset(struct scsi_cmnd *SCpnt);
+static int mptfc_bus_reset(struct scsi_cmnd *SCpnt);
+static int mptfc_host_reset(struct scsi_cmnd *SCpnt);
 
 static struct scsi_host_template mptfc_driver_template = {
         .module                         = THIS_MODULE,
@@ -110,10 +114,10 @@ static struct scsi_host_template mptfc_driver_template = {
         .target_destroy                 = mptfc_target_destroy,
         .slave_destroy                  = mptscsih_slave_destroy,
         .change_queue_depth             = mptscsih_change_queue_depth,
-        .eh_abort_handler               = mptscsih_abort,
-        .eh_device_reset_handler        = mptscsih_dev_reset,
-        .eh_bus_reset_handler           = mptscsih_bus_reset,
-        .eh_host_reset_handler          = mptscsih_host_reset,
+        .eh_abort_handler               = mptfc_abort,
+        .eh_device_reset_handler        = mptfc_dev_reset,
+        .eh_bus_reset_handler           = mptfc_bus_reset,
+        .eh_host_reset_handler          = mptfc_host_reset,
         .bios_param                     = mptscsih_bios_param,
         .can_queue                      = MPT_FC_CAN_QUEUE,
         .this_id                        = -1,
@@ -171,6 +175,77 @@ static struct fc_function_template mptfc_transport_functions = {
         .show_host_symbolic_name = 1,
 };
 
+static int
+mptfc_block_error_handler(struct scsi_cmnd *SCpnt,
+                          int (*func)(struct scsi_cmnd *SCpnt),
+                          const char *caller)
+{
+        struct scsi_device      *sdev = SCpnt->device;
+        struct Scsi_Host        *shost = sdev->host;
+        struct fc_rport         *rport = starget_to_rport(scsi_target(sdev));
+        unsigned long           flags;
+        int                     ready;
+
+        spin_lock_irqsave(shost->host_lock, flags);
+        while ((ready = fc_remote_port_chkready(rport) >> 16) == DID_IMM_RETRY) {
+                spin_unlock_irqrestore(shost->host_lock, flags);
+                dfcprintk ((MYIOC_s_INFO_FMT
+                        "mptfc_block_error_handler.%d: %d:%d, port status is "
+                        "DID_IMM_RETRY, deferring %s recovery.\n",
+                        ((MPT_SCSI_HOST *) shost->hostdata)->ioc->name,
+                        ((MPT_SCSI_HOST *) shost->hostdata)->ioc->sh->host_no,
+                        SCpnt->device->id,SCpnt->device->lun,caller));
+                msleep(1000);
+                spin_lock_irqsave(shost->host_lock, flags);
+        }
+        spin_unlock_irqrestore(shost->host_lock, flags);
+
+        if (ready == DID_NO_CONNECT || !SCpnt->device->hostdata) {
+                dfcprintk ((MYIOC_s_INFO_FMT
+                        "%s.%d: %d:%d, failing recovery, "
+                        "port state %d, vdev %p.\n", caller,
+                        ((MPT_SCSI_HOST *) shost->hostdata)->ioc->name,
+                        ((MPT_SCSI_HOST *) shost->hostdata)->ioc->sh->host_no,
+                        SCpnt->device->id,SCpnt->device->lun,ready,
+                        SCpnt->device->hostdata));
+                return FAILED;
+        }
+        dfcprintk ((MYIOC_s_INFO_FMT
+                "%s.%d: %d:%d, executing recovery.\n", caller,
+                ((MPT_SCSI_HOST *) shost->hostdata)->ioc->name,
+                ((MPT_SCSI_HOST *) shost->hostdata)->ioc->sh->host_no,
+                SCpnt->device->id,SCpnt->device->lun));
+        return (*func)(SCpnt);
+}
+
+static int
+mptfc_abort(struct scsi_cmnd *SCpnt)
+{
+        return
+            mptfc_block_error_handler(SCpnt, mptscsih_abort, __FUNCTION__);
+}
+
+static int
+mptfc_dev_reset(struct scsi_cmnd *SCpnt)
+{
+        return
+            mptfc_block_error_handler(SCpnt, mptscsih_dev_reset, __FUNCTION__);
+}
+
+static int
+mptfc_bus_reset(struct scsi_cmnd *SCpnt)
+{
+        return
+            mptfc_block_error_handler(SCpnt, mptscsih_bus_reset, __FUNCTION__);
+}
+
+static int
+mptfc_host_reset(struct scsi_cmnd *SCpnt)
+{
+        return
+            mptfc_block_error_handler(SCpnt, mptscsih_host_reset, __FUNCTION__);
+}
+
 static void
 mptfc_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
 {
@@ -562,6 +637,12 @@ mptfc_qcmd(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd *))
                 return 0;
         }
 
+        if (!SCpnt->device->hostdata) { /* vdev */
+                SCpnt->result = DID_NO_CONNECT << 16;
+                done(SCpnt);
+                return 0;
+        }
+
         /* dd_data is null until finished adding target */
         ri = *((struct mptfc_rport_info **)rport->dd_data);
         if (unlikely(!ri)) {
diff --git a/drivers/message/i2o/bus-osm.c b/drivers/message/i2o/bus-osm.c
index ac06f10c54ec..d96c687aee93 100644
--- a/drivers/message/i2o/bus-osm.c
+++ b/drivers/message/i2o/bus-osm.c
@@ -80,18 +80,26 @@ static DEVICE_ATTR(scan, S_IWUSR, NULL, i2o_bus_store_scan);
  *      @dev: device to verify if it is a I2O Bus Adapter device
  *
  *      Because we want all Bus Adapters always return 0.
+ *      Except when we fail.  Then we are sad.
  *
- *      Returns 0.
+ *      Returns 0, except when we fail to excel.
  */
 static int i2o_bus_probe(struct device *dev)
 {
         struct i2o_device *i2o_dev = to_i2o_device(get_device(dev));
+        int rc;
 
-        device_create_file(dev, &dev_attr_scan);
+        rc = device_create_file(dev, &dev_attr_scan);
+        if (rc)
+                goto err_out;
 
         osm_info("device added (TID: %03x)\n", i2o_dev->lct_data.tid);
 
         return 0;
+
+err_out:
+        put_device(dev);
+        return rc;
 };
 
 /**
diff --git a/drivers/message/i2o/exec-osm.c b/drivers/message/i2o/exec-osm.c
index 7bd4d85d0b42..a2350640384b 100644
--- a/drivers/message/i2o/exec-osm.c
+++ b/drivers/message/i2o/exec-osm.c
@@ -124,10 +124,10 @@ static void i2o_exec_wait_free(struct i2o_exec_wait *wait)
 int i2o_msg_post_wait_mem(struct i2o_controller *c, struct i2o_message *msg,
                           unsigned long timeout, struct i2o_dma *dma)
 {
-        DECLARE_WAIT_QUEUE_HEAD(wq);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
         struct i2o_exec_wait *wait;
         static u32 tcntxt = 0x80000000;
-        long flags;
+        unsigned long flags;
         int rc = 0;
 
         wait = i2o_exec_wait_alloc();
@@ -325,13 +325,24 @@ static DEVICE_ATTR(product_id, S_IRUGO, i2o_exec_show_product_id, NULL);
 static int i2o_exec_probe(struct device *dev)
 {
         struct i2o_device *i2o_dev = to_i2o_device(dev);
+        int rc;
 
-        i2o_event_register(i2o_dev, &i2o_exec_driver, 0, 0xffffffff);
+        rc = i2o_event_register(i2o_dev, &i2o_exec_driver, 0, 0xffffffff);
+        if (rc) goto err_out;
 
-        device_create_file(dev, &dev_attr_vendor_id);
-        device_create_file(dev, &dev_attr_product_id);
+        rc = device_create_file(dev, &dev_attr_vendor_id);
+        if (rc) goto err_evtreg;
+        rc = device_create_file(dev, &dev_attr_product_id);
+        if (rc) goto err_vid;
 
         return 0;
+
+err_vid:
+        device_remove_file(dev, &dev_attr_vendor_id);
+err_evtreg:
+        i2o_event_register(to_i2o_device(dev), &i2o_exec_driver, 0, 0);
+err_out:
+        return rc;
 };
 
 /**
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3df0e7a07c46..00db31c314e0 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -28,6 +28,18 @@ config IBM_ASM
 
           If unsure, say N.
 
+config SGI_IOC4
+        tristate "SGI IOC4 Base IO support"
+        depends on PCI
+        ---help---
+          This option enables basic support for the IOC4 chip on certain
+          SGI IO controller cards (IO9, IO10, and PCI-RT).  This option
+          does not enable any specific functions on such a card, but provides
+          necessary infrastructure for other drivers to utilize.
+
+          If you have an SGI Altix with an IOC4-based card say Y.
+          Otherwise say N.
+
 config TIFM_CORE
         tristate "TI Flash Media interface support (EXPERIMENTAL)"
         depends on EXPERIMENTAL
@@ -57,4 +69,23 @@ config TIFM_7XX1
           To compile this driver as a module, choose M here: the module will
           be called tifm_7xx1.
 
+config MSI_LAPTOP
+        tristate "MSI Laptop Extras"
+        depends on X86
+        depends on ACPI_EC
+        depends on BACKLIGHT_CLASS_DEVICE
+        ---help---
+          This is a driver for laptops built by MSI (MICRO-STAR
+          INTERNATIONAL):
+
+          MSI MegaBook S270 (MS-1013)
+          Cytron/TCM/Medion/Tchibo MD96100/SAM2000
+
+          It adds support for Bluetooth, WLAN and LCD brightness control.
+
+          More information about this driver is available at
+          <http://0pointer.de/lennart/tchibo.html>.
+
+          If you have an MSI S270 laptop, say Y or M here.
+
 endmenu
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index d65ece76095a..c9e98ab021c5 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -5,6 +5,8 @@ obj- := misc.o	# Dummy rule to force built-in.o to be made
 
 obj-$(CONFIG_IBM_ASM)           += ibmasm/
 obj-$(CONFIG_HDPU_FEATURES)     += hdpuftrs/
+obj-$(CONFIG_MSI_LAPTOP)     += msi-laptop.o
 obj-$(CONFIG_LKDTM)             += lkdtm.o
 obj-$(CONFIG_TIFM_CORE)         += tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
+obj-$(CONFIG_SGI_IOC4)          += ioc4.o
diff --git a/drivers/sn/ioc4.c b/drivers/misc/ioc4.c
index 8562821e6498..b995a15b7526 100644
--- a/drivers/sn/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (C) 2005-2006 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 /* This file contains the master driver module for use by SGI IOC4 subdrivers.
@@ -29,12 +29,10 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/ioc4.h>
-#include <linux/mmtimer.h>
-#include <linux/rtc.h>
+#include <linux/ktime.h>
 #include <linux/mutex.h>
-#include <asm/sn/addrs.h>
-#include <asm/sn/clksupport.h>
-#include <asm/sn/shub_mmr.h>
+#include <linux/time.h>
+#include <asm/io.h>
 
 /***************
  * Definitions *
@@ -43,7 +41,7 @@
 /* Tweakable values */
 
 /* PCI bus speed detection/calibration */
-#define IOC4_CALIBRATE_COUNT 63 /* Calibration cycle period */
+#define IOC4_CALIBRATE_COUNT 63         /* Calibration cycle period */
 #define IOC4_CALIBRATE_CYCLES 256       /* Average over this many cycles */
 #define IOC4_CALIBRATE_DISCARD 2        /* Discard first few cycles */
 #define IOC4_CALIBRATE_LOW_MHZ 25       /* Lower bound on bus speed sanity */
@@ -143,11 +141,11 @@ ioc4_unregister_submodule(struct ioc4_submodule *is)
 static void
 ioc4_clock_calibrate(struct ioc4_driver_data *idd)
 {
-        extern unsigned long sn_rtc_cycles_per_second;
         union ioc4_int_out int_out;
         union ioc4_gpcr gpcr;
         unsigned int state, last_state = 1;
-        uint64_t start = 0, end, period;
+        struct timespec start_ts, end_ts;
+        uint64_t start, end, period;
         unsigned int count = 0;
 
         /* Enable output */
@@ -175,30 +173,28 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
                 if (!last_state && state) {
                         count++;
                         if (count == IOC4_CALIBRATE_END) {
-                                end = rtc_time();
+                                ktime_get_ts(&end_ts);
                                 break;
                         } else if (count == IOC4_CALIBRATE_DISCARD)
-                                start = rtc_time();
+                                ktime_get_ts(&start_ts);
                 }
                 last_state = state;
         } while (1);
 
         /* Calculation rearranged to preserve intermediate precision.
          * Logically:
-         * 1. "end - start" gives us number of RTC cycles over all the
-         *    square wave cycles measured.
-         * 2. Divide by number of square wave cycles to get number of
-         *    RTC cycles per square wave cycle.
+         * 1. "end - start" gives us the measurement period over all
+         *    the square wave cycles.
+         * 2. Divide by number of square wave cycles to get the period
+         *    of a square wave cycle.
          * 3. Divide by 2*(int_out.fields.count+1), which is the formula
          *    by which the IOC4 generates the square wave, to get the
-         *    number of RTC cycles per IOC4 INT_OUT count.
-         * 4. Divide by sn_rtc_cycles_per_second to get seconds per
-         *    count.
-         * 5. Multiply by 1E9 to get nanoseconds per count.
+         *    period of an IOC4 INT_OUT count.
          */
-        period = ((end - start) * 1000000000) /
-            (IOC4_CALIBRATE_CYCLES * 2 * (IOC4_CALIBRATE_COUNT + 1)
-             * sn_rtc_cycles_per_second);
+        end = end_ts.tv_sec * NSEC_PER_SEC + end_ts.tv_nsec;
+        start = start_ts.tv_sec * NSEC_PER_SEC + start_ts.tv_nsec;
+        period = (end - start) /
+                (IOC4_CALIBRATE_CYCLES * 2 * (IOC4_CALIBRATE_COUNT + 1));
 
         /* Bounds check the result. */
         if (period > IOC4_CALIBRATE_LOW_LIMIT ||
@@ -210,10 +206,12 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
                        IOC4_CALIBRATE_DEFAULT / IOC4_EXTINT_COUNT_DIVISOR);
                 period = IOC4_CALIBRATE_DEFAULT;
         } else {
+                u64 ns = period;
+
+                do_div(ns, IOC4_EXTINT_COUNT_DIVISOR);
                 printk(KERN_DEBUG
-                       "IOC4 %s: PCI clock is %ld ns.\n",
-                       pci_name(idd->idd_pdev),
-                       period / IOC4_EXTINT_COUNT_DIVISOR);
+                       "IOC4 %s: PCI clock is %llu ns.\n",
+                       pci_name(idd->idd_pdev), (unsigned long long)ns);
         }
 
         /* Remember results.  We store the extint clock period rather
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index bbdba7b37e11..db9d7df75ae0 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -44,12 +44,14 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/fs.h>
 #include <linux/module.h>
+#include <linux/buffer_head.h>
 #include <linux/kprobes.h>
-#include <linux/kallsyms.h>
+#include <linux/list.h>
 #include <linux/init.h>
-#include <linux/irq.h>
 #include <linux/interrupt.h>
+#include <linux/hrtimer.h>
 #include <scsi/scsi_cmnd.h>
 
 #ifdef CONFIG_IDE
@@ -116,16 +118,16 @@ static enum ctype cptype = NONE;
 static int count = DEFAULT_COUNT;
 
 module_param(recur_count, int, 0644);
-MODULE_PARM_DESC(recur_count, "Recurcion level for the stack overflow test,\
-                                 default is 10");
+MODULE_PARM_DESC(recur_count, " Recursion level for the stack overflow test, "\
+                                 "default is 10");
 module_param(cpoint_name, charp, 0644);
-MODULE_PARM_DESC(cpoint_name, "Crash Point, where kernel is to be crashed");
-module_param(cpoint_type, charp, 06444);
-MODULE_PARM_DESC(cpoint_type, "Crash Point Type, action to be taken on\
-                                hitting the crash point");
-module_param(cpoint_count, int, 06444);
-MODULE_PARM_DESC(cpoint_count, "Crash Point Count, number of times the \
-                                crash point is to be hit to trigger action");
+MODULE_PARM_DESC(cpoint_name, " Crash Point, where kernel is to be crashed");
+module_param(cpoint_type, charp, 0644);
+MODULE_PARM_DESC(cpoint_type, " Crash Point Type, action to be taken on "\
+                                "hitting the crash point");
+module_param(cpoint_count, int, 0644);
+MODULE_PARM_DESC(cpoint_count, " Crash Point Count, number of times the "\
+                                "crash point is to be hit to trigger action");
 
 unsigned int jp_do_irq(unsigned int irq)
 {
@@ -155,8 +157,8 @@ void jp_ll_rw_block(int rw, int nr, struct buffer_head *bhs[])
 
 struct scan_control;
 
-unsigned long jp_shrink_page_list(struct list_head *page_list,
-                                        struct scan_control *sc)
+unsigned long jp_shrink_inactive_list(unsigned long max_scan,
+                                struct zone *zone, struct scan_control *sc)
 {
         lkdtm_handler();
         jprobe_return();
@@ -295,8 +297,8 @@ int lkdtm_module_init(void)
                 lkdtm.entry = (kprobe_opcode_t*) jp_ll_rw_block;
                 break;
         case MEM_SWAPOUT:
-                lkdtm.kp.symbol_name = "shrink_page_list";
-                lkdtm.entry = (kprobe_opcode_t*) jp_shrink_page_list;
+                lkdtm.kp.symbol_name = "shrink_inactive_list";
+                lkdtm.entry = (kprobe_opcode_t*) jp_shrink_inactive_list;
                 break;
         case TIMERADD:
                 lkdtm.kp.symbol_name = "hrtimer_start";
diff --git a/drivers/misc/msi-laptop.c b/drivers/misc/msi-laptop.c
new file mode 100644
index 000000000000..fdb7153f4426
--- /dev/null
+++ b/drivers/misc/msi-laptop.c
@@ -0,0 +1,395 @@
+/*-*-linux-c-*-*/
+
+/*
+  Copyright (C) 2006 Lennart Poettering <mzxreary (at) 0pointer (dot) de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+  02110-1301, USA.
+ */
+
+/*
+ * msi-laptop.c - MSI S270 laptop support. This laptop is sold under
+ * various brands, including "Cytron/TCM/Medion/Tchibo MD96100".
+ *
+ * This driver exports a few files in /sys/devices/platform/msi-laptop-pf/:
+ *
+ *   lcd_level - Screen brightness: contains a single integer in the
+ *   range 0..8. (rw)
+ *
+ *   auto_brightness - Enable automatic brightness control: contains
+ *   either 0 or 1. If set to 1 the hardware adjusts the screen
+ *   brightness automatically when the power cord is
+ *   plugged/unplugged. (rw)
+ *
+ *   wlan - WLAN subsystem enabled: contains either 0 or 1. (ro)
+ *
+ *   bluetooth - Bluetooth subsystem enabled: contains either 0 or 1
+ *   Please note that this file is constantly 0 if no Bluetooth
+ *   hardware is available. (ro)
+ *
+ * In addition to these platform device attributes the driver
+ * registers itself in the Linux backlight control subsystem and is
+ * available to userspace under /sys/class/backlight/msi-laptop-bl/.
+ *
+ * This driver might work on other laptops produced by MSI. If you
+ * want to try it you can pass force=1 as argument to the module which
+ * will force it to load even when the DMI data doesn't identify the
+ * laptop as MSI S270. YMMV.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/dmi.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
+#include <linux/autoconf.h>
+
+#define MSI_DRIVER_VERSION "0.5"
+
+#define MSI_LCD_LEVEL_MAX 9
+
+#define MSI_EC_COMMAND_WIRELESS 0x10
+#define MSI_EC_COMMAND_LCD_LEVEL 0x11
+
+static int force;
+module_param(force, bool, 0);
+MODULE_PARM_DESC(force, "Force driver load, ignore DMI data");
+
+static int auto_brightness;
+module_param(auto_brightness, int, 0);
+MODULE_PARM_DESC(auto_brightness, "Enable automatic brightness control (0: disabled; 1: enabled; 2: don't touch)");
+
+/* Hardware access */
+
+static int set_lcd_level(int level)
+{
+        u8 buf[2];
+
+        if (level < 0 || level >= MSI_LCD_LEVEL_MAX)
+                return -EINVAL;
+
+        buf[0] = 0x80;
+        buf[1] = (u8) (level*31);
+
+        return ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, buf, sizeof(buf), NULL, 0);
+}
+
+static int get_lcd_level(void)
+{
+        u8 wdata = 0, rdata;
+        int result;
+
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+
+        return (int) rdata / 31;
+}
+
+static int get_auto_brightness(void)
+{
+        u8 wdata = 4, rdata;
+        int result;
+
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+
+        return !!(rdata & 8);
+}
+
+static int set_auto_brightness(int enable)
+{
+        u8 wdata[2], rdata;
+        int result;
+
+        wdata[0] = 4;
+
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+
+        wdata[0] = 0x84;
+        wdata[1] = (rdata & 0xF7) | (enable ? 8 : 0);
+
+        return ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, wdata, 2, NULL, 0);
+}
+
+static int get_wireless_state(int *wlan, int *bluetooth)
+{
+        u8 wdata = 0, rdata;
+        int result;
+
+        result = ec_transaction(MSI_EC_COMMAND_WIRELESS, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return -1;
+
+        if (wlan)
+                *wlan = !!(rdata & 8);
+
+        if (bluetooth)
+                *bluetooth = !!(rdata & 128);
+
+        return 0;
+}
+
+/* Backlight device stuff */
+
+static int bl_get_brightness(struct backlight_device *b)
+{
+        return get_lcd_level();
+}
+
+
+static int bl_update_status(struct backlight_device *b)
+{
+        return set_lcd_level(b->props->brightness);
+}
+
+static struct backlight_properties msibl_props = {
+        .owner          = THIS_MODULE,
+        .get_brightness = bl_get_brightness,
+        .update_status  = bl_update_status,
+        .max_brightness = MSI_LCD_LEVEL_MAX-1,
+};
+
+static struct backlight_device *msibl_device;
+
+/* Platform device */
+
+static ssize_t show_wlan(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+
+        int ret, enabled;
+
+        ret = get_wireless_state(&enabled, NULL);
+        if (ret < 0)
+                return ret;
+
+        return sprintf(buf, "%i\n", enabled);
+}
+
+static ssize_t show_bluetooth(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+
+        int ret, enabled;
+
+        ret = get_wireless_state(NULL, &enabled);
+        if (ret < 0)
+                return ret;
+
+        return sprintf(buf, "%i\n", enabled);
+}
+
+static ssize_t show_lcd_level(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+
+        int ret;
+
+        ret = get_lcd_level();
+        if (ret < 0)
+                return ret;
+
+        return sprintf(buf, "%i\n", ret);
+}
+
+static ssize_t store_lcd_level(struct device *dev,
+        struct device_attribute *attr, const char *buf, size_t count)
+{
+
+        int level, ret;
+
+        if (sscanf(buf, "%i", &level) != 1 || (level < 0 || level >= MSI_LCD_LEVEL_MAX))
+                return -EINVAL;
+
+        ret = set_lcd_level(level);
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static ssize_t show_auto_brightness(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+
+        int ret;
+
+        ret = get_auto_brightness();
+        if (ret < 0)
+                return ret;
+
+        return sprintf(buf, "%i\n", ret);
+}
+
+static ssize_t store_auto_brightness(struct device *dev,
+        struct device_attribute *attr, const char *buf, size_t count)
+{
+
+        int enable, ret;
+
+        if (sscanf(buf, "%i", &enable) != 1 || (enable != (enable & 1)))
+                return -EINVAL;
+
+        ret = set_auto_brightness(enable);
+        if (ret < 0)
+                return ret;
+
+        return count;
+}
+
+static DEVICE_ATTR(lcd_level, 0644, show_lcd_level, store_lcd_level);
+static DEVICE_ATTR(auto_brightness, 0644, show_auto_brightness, store_auto_brightness);
+static DEVICE_ATTR(bluetooth, 0444, show_bluetooth, NULL);
+static DEVICE_ATTR(wlan, 0444, show_wlan, NULL);
+
+static struct attribute *msipf_attributes[] = {
+        &dev_attr_lcd_level.attr,
+        &dev_attr_auto_brightness.attr,
+        &dev_attr_bluetooth.attr,
+        &dev_attr_wlan.attr,
+        NULL
+};
+
+static struct attribute_group msipf_attribute_group = {
+        .attrs = msipf_attributes
+};
+
+static struct platform_driver msipf_driver = {
+        .driver = {
+                .name = "msi-laptop-pf",
+                .owner = THIS_MODULE,
+        }
+};
+
+static struct platform_device *msipf_device;
+
+/* Initialization */
+
+static struct dmi_system_id __initdata msi_dmi_table[] = {
+        {
+                .ident = "MSI S270",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MS-1013"),
+                }
+        },
+        {
+                .ident = "Medion MD96100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NOTEBOOK"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SAM2000"),
+                }
+        },
+        { }
+};
+
+
+static int __init msi_init(void)
+{
+        int ret;
+
+        if (acpi_disabled)
+                return -ENODEV;
+
+        if (!force && !dmi_check_system(msi_dmi_table))
+                return -ENODEV;
+
+        if (auto_brightness < 0 || auto_brightness > 2)
+                return -EINVAL;
+
+        /* Register backlight stuff */
+
+        msibl_device = backlight_device_register("msi-laptop-bl", NULL, &msibl_props);
+        if (IS_ERR(msibl_device))
+                return PTR_ERR(msibl_device);
+
+        ret = platform_driver_register(&msipf_driver);
+        if (ret)
+                goto fail_backlight;
+
+        /* Register platform stuff */
+
+        msipf_device = platform_device_alloc("msi-laptop-pf", -1);
+        if (!msipf_device) {
+                ret = -ENOMEM;
+                goto fail_platform_driver;
+        }
+
+        ret = platform_device_add(msipf_device);
+        if (ret)
+                goto fail_platform_device1;
+
+        ret = sysfs_create_group(&msipf_device->dev.kobj, &msipf_attribute_group);
+        if (ret)
+                goto fail_platform_device2;
+
+        /* Disable automatic brightness control by default because
+         * this module was probably loaded to do brightness control in
+         * software. */
+
+        if (auto_brightness != 2)
+                set_auto_brightness(auto_brightness);
+
+        printk(KERN_INFO "msi-laptop: driver "MSI_DRIVER_VERSION" successfully loaded.\n");
+
+        return 0;
+
+fail_platform_device2:
+
+        platform_device_del(msipf_device);
+
+fail_platform_device1:
+
+        platform_device_put(msipf_device);
+
+fail_platform_driver:
+
+        platform_driver_unregister(&msipf_driver);
+
+fail_backlight:
+
+        backlight_device_unregister(msibl_device);
+
+        return ret;
+}
+
+static void __exit msi_cleanup(void)
+{
+
+        sysfs_remove_group(&msipf_device->dev.kobj, &msipf_attribute_group);
+        platform_device_unregister(msipf_device);
+        platform_driver_unregister(&msipf_driver);
+        backlight_device_unregister(msibl_device);
+
+        /* Enable automatic brightness control again */
+        if (auto_brightness != 2)
+                set_auto_brightness(1);
+
+        printk(KERN_INFO "msi-laptop: driver unloaded.\n");
+}
+
+module_init(msi_init);
+module_exit(msi_cleanup);
+
+MODULE_AUTHOR("Lennart Poettering");
+MODULE_DESCRIPTION("MSI Laptop Support");
+MODULE_VERSION(MSI_DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index ee8863c123e3..766bc54406e5 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -475,7 +475,7 @@ static u32 mmc_select_voltage(struct mmc_host *host, u32 ocr)
         if (bit) {
                 bit -= 1;
 
-                ocr = 3 << bit;
+                ocr &= 3 << bit;
 
                 host->ios.vdd = bit;
                 mmc_set_ios(host);
@@ -1178,14 +1178,29 @@ static void mmc_rescan(void *data)
 {
         struct mmc_host *host = data;
         struct list_head *l, *n;
+        unsigned char power_mode;
 
         mmc_claim_host(host);
 
-        if (host->ios.power_mode == MMC_POWER_ON)
+        /*
+         * Check for removed cards and newly inserted ones. We check for
+         * removed cards first so we can intelligently re-select the VDD.
+         */
+        power_mode = host->ios.power_mode;
+        if (power_mode == MMC_POWER_ON)
                 mmc_check_cards(host);
 
         mmc_setup(host);
 
+        /*
+         * Some broken cards process CMD1 even in stand-by state. There is
+         * no reply, but an ILLEGAL_COMMAND error is cached and returned
+         * after next command. We poll for card status here to clear any
+         * possibly pending error.
+         */
+        if (power_mode == MMC_POWER_ON)
+                mmc_check_cards(host);
+
         if (!list_empty(&host->cards)) {
                 /*
                  * (Re-)calculate the fastest clock rate which the
diff --git a/drivers/mmc/tifm_sd.c b/drivers/mmc/tifm_sd.c
index 2bacff60913d..0fdc55b08a6d 100644
--- a/drivers/mmc/tifm_sd.c
+++ b/drivers/mmc/tifm_sd.c
@@ -14,6 +14,7 @@
 #include <linux/mmc/protocol.h>
 #include <linux/mmc/host.h>
 #include <linux/highmem.h>
+#include <asm/io.h>
 
 #define DRIVER_NAME "tifm_sd"
 #define DRIVER_VERSION "0.6"
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index baece61169f4..41bfcae1fbf4 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -1479,6 +1479,7 @@ static void nand_write_page_syndrome(struct mtd_info *mtd,
  * @buf:        the data to write
  * @page:       page number to write
  * @cached:     cached programming
+ * @raw:        use _raw version of write_page
  */
 static int nand_write_page(struct mtd_info *mtd, struct nand_chip *chip,
                            const uint8_t *buf, int page, int cached, int raw)
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index ab92cc794c64..6e863aa9894c 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -486,7 +486,7 @@ config SGI_IOC3_ETH_HW_TX_CSUM
 
 config MIPS_SIM_NET
         tristate "MIPS simulator Network device (EXPERIMENTAL)"
-        depends on NETDEVICES && MIPS_SIM && EXPERIMENTAL
+        depends on MIPS_SIM && EXPERIMENTAL
         help
           The MIPSNET device is a simple Ethernet network device which is
           emulated by the MIPS Simulator.
@@ -2112,7 +2112,7 @@ config SKGE
 
 config SKY2
         tristate "SysKonnect Yukon2 support (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI
         select CRC32
         ---help---
           This driver supports Gigabit Ethernet adapters based on the
@@ -2120,8 +2120,8 @@ config SKY2
           Marvell 88E8021/88E8022/88E8035/88E8036/88E8038/88E8050/88E8052/
           88E8053/88E8055/88E8061/88E8062, SysKonnect SK-9E21D/SK-9S21
 
-          This driver does not support the original Yukon chipset: a seperate
-          driver, skge, is provided for Yukon-based adapters.
+          There is companion driver for the older Marvell Yukon and
+          Genesis based adapters: skge.
 
           To compile this driver as a module, choose M here: the module
           will be called sky2.  This is recommended.
@@ -2288,7 +2288,7 @@ config UGETH_TX_ON_DEMOND
 
 config UGETH_HAS_GIGA
         bool
-        depends on UCC_GETH && MPC836x
+        depends on UCC_GETH && PPC_MPC836x
 
 config MV643XX_ETH
         tristate "MV-643XX Ethernet support"
@@ -2467,7 +2467,7 @@ config ISERIES_VETH
 
 config RIONET
         tristate "RapidIO Ethernet over messaging driver support"
-        depends on NETDEVICES && RAPIDIO
+        depends on RAPIDIO
 
 config RIONET_TX_SIZE
         int "Number of outbound queue entries"
@@ -2717,6 +2717,7 @@ config PPP_MPPE
        select CRYPTO
        select CRYPTO_SHA1
        select CRYPTO_ARC4
+       select CRYPTO_ECB
        ---help---
          Support for the MPPE Encryption protocol, as employed by the
          Microsoft Point-to-Point Tunneling Protocol.
@@ -2832,7 +2833,7 @@ config NET_FC
           "SCSI generic support".
 
 config SHAPER
-        tristate "Traffic Shaper (EXPERIMENTAL)"
+        tristate "Traffic Shaper (OBSOLETE)"
         depends on EXPERIMENTAL
         ---help---
           The traffic shaper is a virtual network device that allows you to
@@ -2841,9 +2842,9 @@ config SHAPER
           these virtual devices. See
           <file:Documentation/networking/shaper.txt> for more information.
 
-          An alternative to this traffic shaper is the experimental
-          Class-Based Queuing (CBQ) scheduling support which you get if you
-          say Y to "QoS and/or fair queuing" above.
+          An alternative to this traffic shaper are traffic schedulers which
+          you'll get if you say Y to "QoS and/or fair queuing" in
+          "Networking options".
 
           To compile this driver as a module, choose M here: the module
           will be called shaper.  If unsure, say N.
diff --git a/drivers/net/arcnet/com20020.c b/drivers/net/arcnet/com20020.c
index 0dc70c7b7940..aa9dd8f11269 100644
--- a/drivers/net/arcnet/com20020.c
+++ b/drivers/net/arcnet/com20020.c
@@ -337,13 +337,16 @@ static void com20020_set_mc_list(struct net_device *dev)
         }
 }
 
-#ifdef MODULE
-
+#if defined(CONFIG_ARCNET_COM20020_PCI_MODULE) || \
+    defined(CONFIG_ARCNET_COM20020_ISA_MODULE)
 EXPORT_SYMBOL(com20020_check);
 EXPORT_SYMBOL(com20020_found);
+#endif
 
 MODULE_LICENSE("GPL");
 
+#ifdef MODULE
+
 int init_module(void)
 {
         BUGLVL(D_NORMAL) printk(VERSION);
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 127561c782fd..8ebd68e2af98 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -193,12 +193,9 @@ static struct net_device_stats *ep93xx_get_stats(struct net_device *dev)
 static int ep93xx_rx(struct net_device *dev, int *budget)
 {
         struct ep93xx_priv *ep = netdev_priv(dev);
-        int tail_offset;
         int rx_done;
         int processed;
 
-        tail_offset = rdl(ep, REG_RXSTSQCURADD) - ep->descs_dma_addr;
-
         rx_done = 0;
         processed = 0;
         while (*budget > 0) {
@@ -211,36 +208,28 @@ static int ep93xx_rx(struct net_device *dev, int *budget)
 
                 entry = ep->rx_pointer;
                 rstat = ep->descs->rstat + entry;
-                if ((void *)rstat - (void *)ep->descs == tail_offset) {
+
+                rstat0 = rstat->rstat0;
+                rstat1 = rstat->rstat1;
+                if (!(rstat0 & RSTAT0_RFP) || !(rstat1 & RSTAT1_RFP)) {
                         rx_done = 1;
                         break;
                 }
 
-                rstat0 = rstat->rstat0;
-                rstat1 = rstat->rstat1;
                 rstat->rstat0 = 0;
                 rstat->rstat1 = 0;
 
-                if (!(rstat0 & RSTAT0_RFP))
-                        printk(KERN_CRIT "ep93xx_rx: buffer not done "
-                                         " %.8x %.8x\n", rstat0, rstat1);
                 if (!(rstat0 & RSTAT0_EOF))
                         printk(KERN_CRIT "ep93xx_rx: not end-of-frame "
                                          " %.8x %.8x\n", rstat0, rstat1);
                 if (!(rstat0 & RSTAT0_EOB))
                         printk(KERN_CRIT "ep93xx_rx: not end-of-buffer "
                                          " %.8x %.8x\n", rstat0, rstat1);
-                if (!(rstat1 & RSTAT1_RFP))
-                        printk(KERN_CRIT "ep93xx_rx: buffer1 not done "
-                                         " %.8x %.8x\n", rstat0, rstat1);
                 if ((rstat1 & RSTAT1_BUFFER_INDEX) >> 16 != entry)
                         printk(KERN_CRIT "ep93xx_rx: entry mismatch "
                                          " %.8x %.8x\n", rstat0, rstat1);
 
                 if (!(rstat0 & RSTAT0_RWE)) {
-                        printk(KERN_NOTICE "ep93xx_rx: receive error "
-                                         " %.8x %.8x\n", rstat0, rstat1);
-
                         ep->stats.rx_errors++;
                         if (rstat0 & RSTAT0_OE)
                                 ep->stats.rx_fifo_errors++;
@@ -301,13 +290,8 @@ err:
 
 static int ep93xx_have_more_rx(struct ep93xx_priv *ep)
 {
-        struct ep93xx_rstat *rstat;
-        int tail_offset;
-
-        rstat = ep->descs->rstat + ep->rx_pointer;
-        tail_offset = rdl(ep, REG_RXSTSQCURADD) - ep->descs_dma_addr;
-
-        return !((void *)rstat - (void *)ep->descs == tail_offset);
+        struct ep93xx_rstat *rstat = ep->descs->rstat + ep->rx_pointer;
+        return !!((rstat->rstat0 & RSTAT0_RFP) && (rstat->rstat1 & RSTAT1_RFP));
 }
 
 static int ep93xx_poll(struct net_device *dev, int *budget)
@@ -347,7 +331,7 @@ static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
         struct ep93xx_priv *ep = netdev_priv(dev);
         int entry;
 
-        if (unlikely(skb->len) > MAX_PKT_SIZE) {
+        if (unlikely(skb->len > MAX_PKT_SIZE)) {
                 ep->stats.tx_dropped++;
                 dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
@@ -379,10 +363,8 @@ static int ep93xx_xmit(struct sk_buff *skb, struct net_device *dev)
 static void ep93xx_tx_complete(struct net_device *dev)
 {
         struct ep93xx_priv *ep = netdev_priv(dev);
-        int tail_offset;
         int wake;
 
-        tail_offset = rdl(ep, REG_TXSTSQCURADD) - ep->descs_dma_addr;
         wake = 0;
 
         spin_lock(&ep->tx_pending_lock);
@@ -393,15 +375,13 @@ static void ep93xx_tx_complete(struct net_device *dev)
 
                 entry = ep->tx_clean_pointer;
                 tstat = ep->descs->tstat + entry;
-                if ((void *)tstat - (void *)ep->descs == tail_offset)
-                        break;
 
                 tstat0 = tstat->tstat0;
+                if (!(tstat0 & TSTAT0_TXFP))
+                        break;
+
                 tstat->tstat0 = 0;
 
-                if (!(tstat0 & TSTAT0_TXFP))
-                        printk(KERN_CRIT "ep93xx_tx_complete: buffer not done "
-                                         " %.8x\n", tstat0);
                 if (tstat0 & TSTAT0_FA)
                         printk(KERN_CRIT "ep93xx_tx_complete: frame aborted "
                                          " %.8x\n", tstat0);
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 4873dc610d22..7db3c8af0894 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -102,7 +102,7 @@ static void enable_mac(struct net_device *, int);
 // externs
 extern int get_ethernet_addr(char *ethernet_addr);
 extern void str2eaddr(unsigned char *ea, unsigned char *str);
-extern char * __init prom_getcmdline(void);
+extern char * prom_getcmdline(void);
 
 /*
  * Theory of operation
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index b124eee4eb10..474a4e3438db 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -908,8 +908,9 @@ static irqreturn_t b44_interrupt(int irq, void *dev_id)
         istat = br32(bp, B44_ISTAT);
         imask = br32(bp, B44_IMASK);
 
-        /* ??? What the fuck is the purpose of the interrupt mask
-         * ??? register if we have to mask it out by hand anyways?
+        /* The interrupt mask register controls which interrupt bits
+         * will actually raise an interrupt to the CPU when set by hw/firmware,
+         * but doesn't mask off the bits.
          */
         istat &= imask;
         if (istat) {
@@ -1706,14 +1707,15 @@ static void __b44_set_rx_mode(struct net_device *dev)
 
                 __b44_set_mac_addr(bp);
 
-                if (dev->flags & IFF_ALLMULTI)
+                if ((dev->flags & IFF_ALLMULTI) ||
+                    (dev->mc_count > B44_MCAST_TABLE_SIZE))
                         val |= RXCONFIG_ALLMULTI;
                 else
                         i = __b44_load_mcast(bp, dev);
 
-                for (; i < 64; i++) {
+                for (; i < 64; i++)
                         __b44_cam_write(bp, zero, i);
-                }
+
                 bw32(bp, B44_RXCONFIG, val);
                 val = br32(bp, B44_CAM_CTRL);
                 bw32(bp, B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
@@ -2055,7 +2057,7 @@ static int b44_read_eeprom(struct b44 *bp, u8 *data)
         u16 *ptr = (u16 *) data;
 
         for (i = 0; i < 128; i += 2)
-                ptr[i / 2] = readw(bp->regs + 4096 + i);
+                ptr[i / 2] = cpu_to_le16(readw(bp->regs + 4096 + i));
 
         return 0;
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index e83bc825f6af..32923162179e 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1433,7 +1433,7 @@ void bond_alb_monitor(struct bonding *bond)
                  * write lock to protect from other code that also
                  * sets the promiscuity.
                  */
-                write_lock(&bond->curr_slave_lock);
+                write_lock_bh(&bond->curr_slave_lock);
 
                 if (bond_info->primary_is_promisc &&
                     (++bond_info->rlb_promisc_timeout_counter >= RLB_PROMISC_TIMEOUT)) {
@@ -1448,7 +1448,7 @@ void bond_alb_monitor(struct bonding *bond)
                         bond_info->primary_is_promisc = 0;
                 }
 
-                write_unlock(&bond->curr_slave_lock);
+                write_unlock_bh(&bond->curr_slave_lock);
 
                 if (bond_info->rlb_rebalance) {
                         bond_info->rlb_rebalance = 0;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c0bbddae4ec4..17a461152d39 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4692,6 +4692,8 @@ static int bond_check_params(struct bond_params *params)
         return 0;
 }
 
+static struct lock_class_key bonding_netdev_xmit_lock_key;
+
 /* Create a new bond based on the specified name and bonding parameters.
  * Caller must NOT hold rtnl_lock; we need to release it here before we
  * set up our sysfs entries.
@@ -4727,6 +4729,9 @@ int bond_create(char *name, struct bond_params *params, struct bonding **newbond
         if (res < 0) {
                 goto out_bond;
         }
+
+        lockdep_set_class(&bond_dev->_xmit_lock, &bonding_netdev_xmit_lock_key);
+
         if (newbond)
                 *newbond = bond_dev->priv;
 
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index 966b563e42bb..a03d781f6d0a 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -509,6 +509,8 @@ etrax_ethernet_init(void)
                  * does not share cacheline with any other data (to avoid cache bug)
                  */
                 RxDescList[i].skb = dev_alloc_skb(MAX_MEDIA_DATA_SIZE + 2 * L1_CACHE_BYTES);
+                if (!RxDescList[i].skb)
+                        return -ENOMEM;
                 RxDescList[i].descr.ctrl   = 0;
                 RxDescList[i].descr.sw_len = MAX_MEDIA_DATA_SIZE;
                 RxDescList[i].descr.next   = virt_to_phys(&RxDescList[i + 1]);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 27d5d2f02533..19ab3441269c 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -2039,7 +2039,6 @@ static int e100_change_mtu(struct net_device *netdev, int new_mtu)
         return 0;
 }
 
-#ifdef CONFIG_PM
 static int e100_asf(struct nic *nic)
 {
         /* ASF can be enabled from eeprom */
@@ -2048,7 +2047,6 @@ static int e100_asf(struct nic *nic)
            !(nic->eeprom[eeprom_config_asf] & eeprom_gcl) &&
            ((nic->eeprom[eeprom_smbus_addr] & 0xFF) != 0xFE));
 }
-#endif
 
 static int e100_up(struct nic *nic)
 {
@@ -2715,34 +2713,35 @@ static void __devexit e100_remove(struct pci_dev *pdev)
         }
 }
 
+#ifdef CONFIG_PM
 static int e100_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
         struct nic *nic = netdev_priv(netdev);
 
+#ifdef CONFIG_E100_NAPI
         if (netif_running(netdev))
-                e100_down(nic);
-        e100_hw_reset(nic);
-        netif_device_detach(netdev);
+                netif_poll_disable(nic->netdev);
+#endif
+        del_timer_sync(&nic->watchdog);
+        netif_carrier_off(nic->netdev);
 
-#ifdef CONFIG_PM
         pci_save_state(pdev);
-        if (nic->flags & (wol_magic | e100_asf(nic)))
-#else
-        if (nic->flags & (wol_magic))
-#endif
-                pci_enable_wake(pdev, pci_choose_state(pdev, state), 1);
-        else
-                /* disable PME */
-                pci_enable_wake(pdev, 0, 0);
+
+        if ((nic->flags & wol_magic) | e100_asf(nic)) {
+                pci_enable_wake(pdev, PCI_D3hot, 1);
+                pci_enable_wake(pdev, PCI_D3cold, 1);
+        } else {
+                pci_enable_wake(pdev, PCI_D3hot, 0);
+                pci_enable_wake(pdev, PCI_D3cold, 0);
+        }
 
         pci_disable_device(pdev);
-        pci_set_power_state(pdev, pci_choose_state(pdev, state));
+        pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
 }
 
-#ifdef CONFIG_PM
 static int e100_resume(struct pci_dev *pdev)
 {
         struct net_device *netdev = pci_get_drvdata(pdev);
@@ -2764,7 +2763,26 @@ static int e100_resume(struct pci_dev *pdev)
 
 static void e100_shutdown(struct pci_dev *pdev)
 {
-        e100_suspend(pdev, PMSG_SUSPEND);
+        struct net_device *netdev = pci_get_drvdata(pdev);
+        struct nic *nic = netdev_priv(netdev);
+
+#ifdef CONFIG_E100_NAPI
+        if (netif_running(netdev))
+                netif_poll_disable(nic->netdev);
+#endif
+        del_timer_sync(&nic->watchdog);
+        netif_carrier_off(nic->netdev);
+
+        if ((nic->flags & wol_magic) | e100_asf(nic)) {
+                pci_enable_wake(pdev, PCI_D3hot, 1);
+                pci_enable_wake(pdev, PCI_D3cold, 1);
+        } else {
+                pci_enable_wake(pdev, PCI_D3hot, 0);
+                pci_enable_wake(pdev, PCI_D3cold, 0);
+        }
+
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
 }
 
 /* ------------------ PCI Error Recovery infrastructure  -------------- */
@@ -2848,9 +2866,9 @@ static struct pci_driver e100_driver = {
         .id_table =     e100_id_table,
         .probe =        e100_probe,
         .remove =       __devexit_p(e100_remove),
+#ifdef CONFIG_PM
         /* Power Management hooks */
         .suspend =      e100_suspend,
-#ifdef CONFIG_PM
         .resume =       e100_resume,
 #endif
         .shutdown =     e100_shutdown,
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index 773821e4cf57..c564adbd669b 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -461,7 +461,8 @@ e1000_get_regs(struct net_device *netdev,
         regs_buff[24] = (uint32_t)phy_data;  /* phy local receiver status */
         regs_buff[25] = regs_buff[24];  /* phy remote receiver status */
         if (hw->mac_type >= e1000_82540 &&
-           hw->media_type == e1000_media_type_copper) {
+            hw->mac_type < e1000_82571 &&
+            hw->media_type == e1000_media_type_copper) {
                 regs_buff[26] = E1000_READ_REG(hw, MANC);
         }
 }
@@ -1690,6 +1691,7 @@ static int e1000_wol_exclusion(struct e1000_adapter *adapter, struct ethtool_wol
         int retval = 1; /* fail by default */
 
         switch (hw->device_id) {
+        case E1000_DEV_ID_82542:
         case E1000_DEV_ID_82543GC_FIBER:
         case E1000_DEV_ID_82543GC_COPPER:
         case E1000_DEV_ID_82544EI_FIBER:
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index 112447fd8bf2..449a60303e07 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -1961,9 +1961,9 @@ struct e1000_hw {
 #define E1000_RXDCTL_GRAN    0x01000000 /* RXDCTL Granularity */
 
 /* Transmit Descriptor Control */
-#define E1000_TXDCTL_PTHRESH 0x000000FF /* TXDCTL Prefetch Threshold */
-#define E1000_TXDCTL_HTHRESH 0x0000FF00 /* TXDCTL Host Threshold */
-#define E1000_TXDCTL_WTHRESH 0x00FF0000 /* TXDCTL Writeback Threshold */
+#define E1000_TXDCTL_PTHRESH 0x0000003F /* TXDCTL Prefetch Threshold */
+#define E1000_TXDCTL_HTHRESH 0x00003F00 /* TXDCTL Host Threshold */
+#define E1000_TXDCTL_WTHRESH 0x003F0000 /* TXDCTL Writeback Threshold */
 #define E1000_TXDCTL_GRAN    0x01000000 /* TXDCTL Granularity */
 #define E1000_TXDCTL_LWTHRESH 0xFE000000 /* TXDCTL Low Threshold */
 #define E1000_TXDCTL_FULL_TX_DESC_WB 0x01010000 /* GRAN=1, WTHRESH=1 */
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index ce0d35fe3947..726ec5e88ab2 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -35,7 +35,7 @@ static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
 #else
 #define DRIVERNAPI "-NAPI"
 #endif
-#define DRV_VERSION "7.2.9-k2"DRIVERNAPI
+#define DRV_VERSION "7.2.9-k4"DRIVERNAPI
 char e1000_driver_version[] = DRV_VERSION;
 static char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -699,7 +699,10 @@ e1000_reset(struct e1000_adapter *adapter)
                                     phy_data);
         }
 
-        if ((adapter->en_mng_pt) && (adapter->hw.mac_type < e1000_82571)) {
+        if ((adapter->en_mng_pt) &&
+            (adapter->hw.mac_type >= e1000_82540) &&
+            (adapter->hw.mac_type < e1000_82571) &&
+            (adapter->hw.media_type == e1000_media_type_copper)) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 manc |= (E1000_MANC_ARP_EN | E1000_MANC_EN_MNG2HOST);
                 E1000_WRITE_REG(&adapter->hw, MANC, manc);
@@ -1076,8 +1079,9 @@ e1000_remove(struct pci_dev *pdev)
 
         flush_scheduled_work();
 
-        if (adapter->hw.mac_type < e1000_82571 &&
-           adapter->hw.media_type == e1000_media_type_copper) {
+        if (adapter->hw.mac_type >= e1000_82540 &&
+            adapter->hw.mac_type < e1000_82571 &&
+            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 if (manc & E1000_MANC_SMBUS_EN) {
                         manc |= E1000_MANC_ARP_EN;
@@ -1804,9 +1808,11 @@ e1000_setup_rctl(struct e1000_adapter *adapter)
          * followed by the page buffers.  Therefore, skb->data is
          * sized to hold the largest protocol header.
          */
+        /* allocations using alloc_page take too long for regular MTU
+         * so only enable packet split for jumbo frames */
         pages = PAGE_USE_COUNT(adapter->netdev->mtu);
-        if ((adapter->hw.mac_type > e1000_82547_rev_2) && (pages <= 3) &&
-            PAGE_SIZE <= 16384)
+        if ((adapter->hw.mac_type >= e1000_82571) && (pages <= 3) &&
+            PAGE_SIZE <= 16384 && (rctl & E1000_RCTL_LPE))
                 adapter->rx_ps_pages = pages;
         else
                 adapter->rx_ps_pages = 0;
@@ -2986,6 +2992,11 @@ e1000_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
                 return NETDEV_TX_OK;
         }
 
+        /* 82571 and newer doesn't need the workaround that limited descriptor
+         * length to 4kB */
+        if (adapter->hw.mac_type >= e1000_82571)
+                max_per_txd = 8192;
+
 #ifdef NETIF_F_TSO
         mss = skb_shinfo(skb)->gso_size;
         /* The controller does a simple calculation to
@@ -3775,9 +3786,6 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 length = le16_to_cpu(rx_desc->length);
 
-                /* adjust length to remove Ethernet CRC */
-                length -= 4;
-
                 if (unlikely(!(status & E1000_RXD_STAT_EOP))) {
                         /* All receives must fit into a single buffer */
                         E1000_DBG("%s: Receive packet consumed multiple"
@@ -3805,6 +3813,10 @@ e1000_clean_rx_irq(struct e1000_adapter *adapter,
                         }
                 }
 
+                /* adjust length to remove Ethernet CRC, this must be
+                 * done after the TBI_ACCEPT workaround above */
+                length -= 4;
+
                 /* code added for copybreak, this should improve
                  * performance for small packets with large amounts
                  * of reassembly being done in the stack */
@@ -4773,8 +4785,9 @@ e1000_suspend(struct pci_dev *pdev, pm_message_t state)
                 pci_enable_wake(pdev, PCI_D3cold, 0);
         }
 
-        if (adapter->hw.mac_type < e1000_82571 &&
-           adapter->hw.media_type == e1000_media_type_copper) {
+        if (adapter->hw.mac_type >= e1000_82540 &&
+            adapter->hw.mac_type < e1000_82571 &&
+            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 if (manc & E1000_MANC_SMBUS_EN) {
                         manc |= E1000_MANC_ARP_EN;
@@ -4787,6 +4800,9 @@ e1000_suspend(struct pci_dev *pdev, pm_message_t state)
         if (adapter->hw.phy_type == e1000_phy_igp_3)
                 e1000_phy_powerdown_workaround(&adapter->hw);
 
+        if (netif_running(netdev))
+                e1000_free_irq(adapter);
+
         /* Release control of h/w to f/w.  If f/w is AMT enabled, this
          * would have already happened in close and is redundant. */
         e1000_release_hw_control(adapter);
@@ -4817,6 +4833,10 @@ e1000_resume(struct pci_dev *pdev)
         pci_enable_wake(pdev, PCI_D3hot, 0);
         pci_enable_wake(pdev, PCI_D3cold, 0);
 
+        if (netif_running(netdev) && (err = e1000_request_irq(adapter)))
+                return err;
+
+        e1000_power_up_phy(adapter);
         e1000_reset(adapter);
         E1000_WRITE_REG(&adapter->hw, WUS, ~0);
 
@@ -4825,8 +4845,9 @@ e1000_resume(struct pci_dev *pdev)
 
         netif_device_attach(netdev);
 
-        if (adapter->hw.mac_type < e1000_82571 &&
-           adapter->hw.media_type == e1000_media_type_copper) {
+        if (adapter->hw.mac_type >= e1000_82540 &&
+            adapter->hw.mac_type < e1000_82571 &&
+            adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 manc &= ~(E1000_MANC_ARP_EN);
                 E1000_WRITE_REG(&adapter->hw, MANC, manc);
@@ -4914,10 +4935,6 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         pci_enable_wake(pdev, PCI_D3hot, 0);
         pci_enable_wake(pdev, PCI_D3cold, 0);
 
-        /* Perform card reset only on one instance of the card */
-        if (PCI_FUNC (pdev->devfn) != 0)
-                return PCI_ERS_RESULT_RECOVERED;
-
         e1000_reset(adapter);
         E1000_WRITE_REG(&adapter->hw, WUS, ~0);
 
@@ -4948,6 +4965,7 @@ static void e1000_io_resume(struct pci_dev *pdev)
         netif_device_attach(netdev);
 
         if (adapter->hw.mac_type >= e1000_82540 &&
+            adapter->hw.mac_type < e1000_82571 &&
             adapter->hw.media_type == e1000_media_type_copper) {
                 manc = E1000_READ_REG(&adapter->hw, MANC);
                 manc &= ~(E1000_MANC_ARP_EN);
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 23b451a8ae12..39ad9f73d1ec 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0028"
+#define DRV_VERSION     "EHEA_0043"
 
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
         | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
@@ -50,6 +50,7 @@
 #define EHEA_MAX_ENTRIES_SQ  32767
 #define EHEA_MIN_ENTRIES_QP  127
 
+#define EHEA_SMALL_QUEUES
 #define EHEA_NUM_TX_QP 1
 
 #ifdef EHEA_SMALL_QUEUES
@@ -59,11 +60,11 @@
 #define EHEA_DEF_ENTRIES_RQ2    1023
 #define EHEA_DEF_ENTRIES_RQ3    1023
 #else
-#define EHEA_MAX_CQE_COUNT     32000
-#define EHEA_DEF_ENTRIES_SQ    16000
-#define EHEA_DEF_ENTRIES_RQ1   32080
-#define EHEA_DEF_ENTRIES_RQ2    4020
-#define EHEA_DEF_ENTRIES_RQ3    4020
+#define EHEA_MAX_CQE_COUNT      4080
+#define EHEA_DEF_ENTRIES_SQ     4080
+#define EHEA_DEF_ENTRIES_RQ1    8160
+#define EHEA_DEF_ENTRIES_RQ2    2040
+#define EHEA_DEF_ENTRIES_RQ3    2040
 #endif
 
 #define EHEA_MAX_ENTRIES_EQ 20
@@ -104,9 +105,6 @@
 #define EHEA_BCMC_VLANID_ALL    0x01
 #define EHEA_BCMC_VLANID_SINGLE 0x00
 
-/* Use this define to kmallocate pHYP control blocks */
-#define H_CB_ALIGNMENT          4096
-
 #define EHEA_CACHE_LINE          128
 
 /* Memory Regions */
diff --git a/drivers/net/ehea/ehea_ethtool.c b/drivers/net/ehea/ehea_ethtool.c
index 82eb2fb8c75e..9f57c2e78ced 100644
--- a/drivers/net/ehea/ehea_ethtool.c
+++ b/drivers/net/ehea/ehea_ethtool.c
@@ -238,7 +238,7 @@ static void ehea_get_ethtool_stats(struct net_device *dev,
         data[i++] = port->port_res[0].swqe_refill_th;
         data[i++] = port->resets;
 
-        cb6 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb6 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb6) {
                 ehea_error("no mem for cb6");
                 return;
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index c6b31775e26b..6ad696101418 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -92,7 +92,7 @@ static struct net_device_stats *ehea_get_stats(struct net_device *dev)
 
         memset(stats, 0, sizeof(*stats));
 
-        cb2 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb2 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb2) {
                 ehea_error("no mem for cb2");
                 goto out;
@@ -586,8 +586,8 @@ int ehea_sense_port_attr(struct ehea_port *port)
         u64 hret;
         struct hcp_ehea_port_cb0 *cb0;
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
-        if (!cb0) {
+        cb0 = kzalloc(PAGE_SIZE, GFP_ATOMIC);   /* May be called via */
+        if (!cb0) {                             /* ehea_neq_tasklet() */
                 ehea_error("no mem for cb0");
                 ret = -ENOMEM;
                 goto out;
@@ -670,7 +670,7 @@ int ehea_set_portspeed(struct ehea_port *port, u32 port_speed)
         u64 hret;
         int ret = 0;
 
-        cb4 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb4 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb4) {
                 ehea_error("no mem for cb4");
                 ret = -ENOMEM;
@@ -765,8 +765,7 @@ static void ehea_parse_eqe(struct ehea_adapter *adapter, u64 eqe)
 
                 if (EHEA_BMASK_GET(NEQE_PORT_UP, eqe)) {
                         if (!netif_carrier_ok(port->netdev)) {
-                                ret = ehea_sense_port_attr(
-                                        adapter->port[portnum]);
+                                ret = ehea_sense_port_attr(port);
                                 if (ret) {
                                         ehea_error("failed resensing port "
                                                    "attributes");
@@ -818,7 +817,7 @@ static void ehea_parse_eqe(struct ehea_adapter *adapter, u64 eqe)
                 netif_stop_queue(port->netdev);
                 break;
         default:
-                ehea_error("unknown event code %x", ec);
+                ehea_error("unknown event code %x, eqe=0x%lX", ec, eqe);
                 break;
         }
 }
@@ -986,7 +985,7 @@ static int ehea_configure_port(struct ehea_port *port)
         struct hcp_ehea_port_cb0 *cb0;
 
         ret = -ENOMEM;
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0)
                 goto out;
 
@@ -1444,7 +1443,7 @@ static int ehea_set_mac_addr(struct net_device *dev, void *sa)
                 goto out;
         }
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0) {
                 ehea_error("no mem for cb0");
                 ret = -ENOMEM;
@@ -1502,7 +1501,7 @@ static void ehea_promiscuous(struct net_device *dev, int enable)
         if ((enable && port->promisc) || (!enable && !port->promisc))
                 return;
 
-        cb7 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb7 = kzalloc(PAGE_SIZE, GFP_ATOMIC);
         if (!cb7) {
                 ehea_error("no mem for cb7");
                 goto out;
@@ -1606,7 +1605,7 @@ static void ehea_add_multicast_entry(struct ehea_port* port, u8* mc_mac_addr)
         struct ehea_mc_list *ehea_mcl_entry;
         u64 hret;
 
-        ehea_mcl_entry = kzalloc(sizeof(*ehea_mcl_entry), GFP_KERNEL);
+        ehea_mcl_entry = kzalloc(sizeof(*ehea_mcl_entry), GFP_ATOMIC);
         if (!ehea_mcl_entry) {
                 ehea_error("no mem for mcl_entry");
                 return;
@@ -1841,7 +1840,7 @@ static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (netif_msg_tx_queued(port)) {
                 ehea_info("post swqe on QP %d", pr->qp->init_attr.qp_nr);
-                ehea_dump(swqe, sizeof(*swqe), "swqe");
+                ehea_dump(swqe, 512, "swqe");
         }
 
         ehea_post_swqe(pr->qp, swqe);
@@ -1871,7 +1870,7 @@ static void ehea_vlan_rx_register(struct net_device *dev,
 
         port->vgrp = grp;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1900,7 +1899,7 @@ static void ehea_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
         int index;
         u64 hret;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1936,7 +1935,7 @@ static void ehea_vlan_rx_kill_vid(struct net_device *dev, unsigned short vid)
         if (port->vgrp)
                 port->vgrp->vlan_devices[vid] = NULL;
 
-        cb1 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb1 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb1) {
                 ehea_error("no mem for cb1");
                 goto out;
@@ -1969,7 +1968,7 @@ int ehea_activate_qp(struct ehea_adapter *adapter, struct ehea_qp *qp)
         u64 dummy64 = 0;
         struct hcp_modify_qp_cb0* cb0;
 
-        cb0 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb0 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb0) {
                 ret = -ENOMEM;
                 goto out;
@@ -2270,7 +2269,7 @@ int ehea_sense_adapter_attr(struct ehea_adapter *adapter)
         u64 hret;
         int ret;
 
-        cb = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb) {
                 ret = -ENOMEM;
                 goto out;
@@ -2341,7 +2340,7 @@ static int ehea_setup_single_port(struct ehea_port *port,
                 goto out;
 
         /* Enable Jumbo frames */
-        cb4 = kzalloc(H_CB_ALIGNMENT, GFP_KERNEL);
+        cb4 = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!cb4) {
                 ehea_error("no mem for cb4");
         } else {
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 4a85aca4c7e9..0cfc2bc1a27b 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -44,71 +44,99 @@ static inline u16 get_order_of_qentries(u16 queue_entries)
 #define H_ALL_RES_TYPE_MR        5
 #define H_ALL_RES_TYPE_MW        6
 
-static long ehea_hcall_9arg_9ret(unsigned long opcode,
-                                 unsigned long arg1, unsigned long arg2,
-                                 unsigned long arg3, unsigned long arg4,
-                                 unsigned long arg5, unsigned long arg6,
-                                 unsigned long arg7, unsigned long arg8,
-                                 unsigned long arg9, unsigned long *out1,
-                                 unsigned long *out2,unsigned long *out3,
-                                 unsigned long *out4,unsigned long *out5,
-                                 unsigned long *out6,unsigned long *out7,
-                                 unsigned long *out8,unsigned long *out9)
+static long ehea_plpar_hcall_norets(unsigned long opcode,
+                                    unsigned long arg1,
+                                    unsigned long arg2,
+                                    unsigned long arg3,
+                                    unsigned long arg4,
+                                    unsigned long arg5,
+                                    unsigned long arg6,
+                                    unsigned long arg7)
 {
-        long hret;
+        long ret;
         int i, sleep_msecs;
 
         for (i = 0; i < 5; i++) {
-                hret = plpar_hcall_9arg_9ret(opcode,arg1, arg2, arg3, arg4,
-                                             arg5, arg6, arg7, arg8, arg9, out1,
-                                             out2, out3, out4, out5, out6, out7,
-                                             out8, out9);
-                if (H_IS_LONG_BUSY(hret)) {
-                        sleep_msecs = get_longbusy_msecs(hret);
+                ret = plpar_hcall_norets(opcode, arg1, arg2, arg3, arg4,
+                                         arg5, arg6, arg7);
+
+                if (H_IS_LONG_BUSY(ret)) {
+                        sleep_msecs = get_longbusy_msecs(ret);
                         msleep_interruptible(sleep_msecs);
                         continue;
                 }
 
-                if (hret < H_SUCCESS)
-                        ehea_error("op=%lx hret=%lx "
-                                   "i1=%lx i2=%lx i3=%lx i4=%lx i5=%lx i6=%lx "
-                                   "i7=%lx i8=%lx i9=%lx "
-                                   "o1=%lx o2=%lx o3=%lx o4=%lx o5=%lx o6=%lx "
-                                   "o7=%lx o8=%lx o9=%lx",
-                                   opcode, hret, arg1, arg2, arg3, arg4, arg5,
-                                   arg6, arg7, arg8, arg9, *out1, *out2, *out3,
-                                   *out4, *out5, *out6, *out7, *out8, *out9);
-                return hret;
+                if (ret < H_SUCCESS)
+                        ehea_error("opcode=%lx ret=%lx"
+                                   " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
+                                   " arg5=%lx arg6=%lx arg7=%lx ",
+                                   opcode, ret,
+                                   arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7);
+
+                return ret;
         }
+
         return H_BUSY;
 }
 
-u64 ehea_h_query_ehea_qp(const u64 adapter_handle, const u8 qp_category,
-                         const u64 qp_handle, const u64 sel_mask, void *cb_addr)
+static long ehea_plpar_hcall9(unsigned long opcode,
+                              unsigned long *outs, /* array of 9 outputs */
+                              unsigned long arg1,
+                              unsigned long arg2,
+                              unsigned long arg3,
+                              unsigned long arg4,
+                              unsigned long arg5,
+                              unsigned long arg6,
+                              unsigned long arg7,
+                              unsigned long arg8,
+                              unsigned long arg9)
 {
-        u64 dummy;
+        long ret;
+        int i, sleep_msecs;
 
-        if ((((u64)cb_addr) & (PAGE_SIZE - 1)) != 0) {
-                ehea_error("not on pageboundary");
-                return H_PARAMETER;
+        for (i = 0; i < 5; i++) {
+                ret = plpar_hcall9(opcode, outs,
+                                   arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7, arg8, arg9);
+
+                if (H_IS_LONG_BUSY(ret)) {
+                        sleep_msecs = get_longbusy_msecs(ret);
+                        msleep_interruptible(sleep_msecs);
+                        continue;
+                }
+
+                if (ret < H_SUCCESS)
+                        ehea_error("opcode=%lx ret=%lx"
+                                   " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
+                                   " arg5=%lx arg6=%lx arg7=%lx arg8=%lx"
+                                   " arg9=%lx"
+                                   " out1=%lx out2=%lx out3=%lx out4=%lx"
+                                   " out5=%lx out6=%lx out7=%lx out8=%lx"
+                                   " out9=%lx",
+                                   opcode, ret,
+                                   arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7, arg8, arg9,
+                                   outs[0], outs[1], outs[2], outs[3],
+                                   outs[4], outs[5], outs[6], outs[7],
+                                   outs[8]);
+
+                return ret;
         }
 
-        return ehea_hcall_9arg_9ret(H_QUERY_HEA_QP,
-                                    adapter_handle,             /* R4 */
-                                    qp_category,                /* R5 */
-                                    qp_handle,                  /* R6 */
-                                    sel_mask,                   /* R7 */
-                                    virt_to_abs(cb_addr),       /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return H_BUSY;
+}
+
+u64 ehea_h_query_ehea_qp(const u64 adapter_handle, const u8 qp_category,
+                         const u64 qp_handle, const u64 sel_mask, void *cb_addr)
+{
+        return ehea_plpar_hcall_norets(H_QUERY_HEA_QP,
+                                       adapter_handle,          /* R4 */
+                                       qp_category,             /* R5 */
+                                       qp_handle,               /* R6 */
+                                       sel_mask,                /* R7 */
+                                       virt_to_abs(cb_addr),    /* R8 */
+                                       0, 0);
 }
 
 /* input param R5 */
@@ -180,6 +208,7 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
                              u64 *qp_handle, struct h_epas *h_epas)
 {
         u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
 
         u64 allocate_controls =
             EHEA_BMASK_SET(H_ALL_RES_QP_EQPO, init_attr->low_lat_rq1 ? 1 : 0)
@@ -219,45 +248,29 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
             EHEA_BMASK_SET(H_ALL_RES_QP_TH_RQ2, init_attr->rq2_threshold)
             | EHEA_BMASK_SET(H_ALL_RES_QP_TH_RQ3, init_attr->rq3_threshold);
 
-        u64 r5_out = 0;
-        u64 r6_out = 0;
-        u64 r7_out = 0;
-        u64 r8_out = 0;
-        u64 r9_out = 0;
-        u64 g_la_user_out = 0;
-        u64 r11_out = 0;
-        u64 r12_out = 0;
-
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,             /* R4 */
-                                    allocate_controls,          /* R5 */
-                                    init_attr->send_cq_handle,  /* R6 */
-                                    init_attr->recv_cq_handle,  /* R7 */
-                                    init_attr->aff_eq_handle,   /* R8 */
-                                    r9_reg,                     /* R9 */
-                                    max_r10_reg,                /* R10 */
-                                    r11_in,                     /* R11 */
-                                    threshold,                  /* R12 */
-                                    qp_handle,                  /* R4 */
-                                    &r5_out,                    /* R5 */
-                                    &r6_out,                    /* R6 */
-                                    &r7_out,                    /* R7 */
-                                    &r8_out,                    /* R8 */
-                                    &r9_out,                    /* R9 */
-                                    &g_la_user_out,             /* R10 */
-                                    &r11_out,                   /* R11 */
-                                    &r12_out);                  /* R12 */
-
-        init_attr->qp_nr = (u32)r5_out;
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 allocate_controls,             /* R5 */
+                                 init_attr->send_cq_handle,     /* R6 */
+                                 init_attr->recv_cq_handle,     /* R7 */
+                                 init_attr->aff_eq_handle,      /* R8 */
+                                 r9_reg,                        /* R9 */
+                                 max_r10_reg,                   /* R10 */
+                                 r11_in,                        /* R11 */
+                                 threshold);                    /* R12 */
+
+        *qp_handle = outs[0];
+        init_attr->qp_nr = (u32)outs[1];
 
         init_attr->act_nr_send_wqes =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_SWQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_SWQE, outs[2]);
         init_attr->act_nr_rwqes_rq1 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R1WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R1WQE, outs[2]);
         init_attr->act_nr_rwqes_rq2 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R2WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R2WQE, outs[2]);
         init_attr->act_nr_rwqes_rq3 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R3WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R3WQE, outs[2]);
 
         init_attr->act_wqe_size_enc_sq = init_attr->wqe_size_enc_sq;
         init_attr->act_wqe_size_enc_rq1 = init_attr->wqe_size_enc_rq1;
@@ -265,25 +278,25 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
         init_attr->act_wqe_size_enc_rq3 = init_attr->wqe_size_enc_rq3;
 
         init_attr->nr_sq_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_SQ, r8_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_SQ, outs[4]);
         init_attr->nr_rq1_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ1, r8_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ1, outs[4]);
         init_attr->nr_rq2_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ2, r9_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ2, outs[5]);
         init_attr->nr_rq3_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ3, r9_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ3, outs[5]);
 
         init_attr->liobn_sq =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_SQ, r11_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_SQ, outs[7]);
         init_attr->liobn_rq1 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ1, r11_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ1, outs[7]);
         init_attr->liobn_rq2 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ2, r12_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ2, outs[8]);
         init_attr->liobn_rq3 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ3, r12_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ3, outs[8]);
 
         if (!hret)
-                hcp_epas_ctor(h_epas, g_la_user_out, g_la_user_out);
+                hcp_epas_ctor(h_epas, outs[6], outs[6]);
 
         return hret;
 }
@@ -292,31 +305,24 @@ u64 ehea_h_alloc_resource_cq(const u64 adapter_handle,
                              struct ehea_cq_attr *cq_attr,
                              u64 *cq_handle, struct h_epas *epas)
 {
-        u64 hret, dummy, act_nr_of_cqes_out, act_pages_out;
-        u64 g_la_privileged_out, g_la_user_out;
-
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,             /* R4 */
-                                    H_ALL_RES_TYPE_CQ,          /* R5 */
-                                    cq_attr->eq_handle,         /* R6 */
-                                    cq_attr->cq_token,          /* R7 */
-                                    cq_attr->max_nr_of_cqes,    /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    cq_handle,                  /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &act_nr_of_cqes_out,        /* R7 */
-                                    &act_pages_out,             /* R8 */
-                                    &g_la_privileged_out,       /* R9 */
-                                    &g_la_user_out,             /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-
-        cq_attr->act_nr_of_cqes = act_nr_of_cqes_out;
-        cq_attr->nr_pages = act_pages_out;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 H_ALL_RES_TYPE_CQ,             /* R5 */
+                                 cq_attr->eq_handle,            /* R6 */
+                                 cq_attr->cq_token,             /* R7 */
+                                 cq_attr->max_nr_of_cqes,       /* R8 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
+
+        *cq_handle = outs[0];
+        cq_attr->act_nr_of_cqes = outs[3];
+        cq_attr->nr_pages = outs[4];
 
         if (!hret)
-                hcp_epas_ctor(epas, g_la_privileged_out, g_la_user_out);
+                hcp_epas_ctor(epas, outs[5], outs[6]);
 
         return hret;
 }
@@ -361,9 +367,8 @@ u64 ehea_h_alloc_resource_cq(const u64 adapter_handle,
 u64 ehea_h_alloc_resource_eq(const u64 adapter_handle,
                              struct ehea_eq_attr *eq_attr, u64 *eq_handle)
 {
-        u64 hret, dummy, eq_liobn, allocate_controls;
-        u64 ist1_out, ist2_out, ist3_out, ist4_out;
-        u64 act_nr_of_eqes_out, act_pages_out;
+        u64 hret, allocate_controls;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
 
         /* resource type */
         allocate_controls =
@@ -372,27 +377,20 @@ u64 ehea_h_alloc_resource_eq(const u64 adapter_handle,
             | EHEA_BMASK_SET(H_ALL_RES_EQ_INH_EQE_GEN, !eq_attr->eqe_gen)
             | EHEA_BMASK_SET(H_ALL_RES_EQ_NON_NEQ_ISN, 1);
 
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,             /* R4 */
-                                    allocate_controls,          /* R5 */
-                                    eq_attr->max_nr_of_eqes,    /* R6 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R10 */
-                                    eq_handle,                  /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &eq_liobn,                  /* R6 */
-                                    &act_nr_of_eqes_out,        /* R7 */
-                                    &act_pages_out,             /* R8 */
-                                    &ist1_out,                  /* R9 */
-                                    &ist2_out,                  /* R10 */
-                                    &ist3_out,                  /* R11 */
-                                    &ist4_out);                 /* R12 */
-
-        eq_attr->act_nr_of_eqes = act_nr_of_eqes_out;
-        eq_attr->nr_pages = act_pages_out;
-        eq_attr->ist1 = ist1_out;
-        eq_attr->ist2 = ist2_out;
-        eq_attr->ist3 = ist3_out;
-        eq_attr->ist4 = ist4_out;
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 allocate_controls,             /* R5 */
+                                 eq_attr->max_nr_of_eqes,       /* R6 */
+                                 0, 0, 0, 0, 0, 0);             /* R7-R10 */
+
+        *eq_handle = outs[0];
+        eq_attr->act_nr_of_eqes = outs[3];
+        eq_attr->nr_pages = outs[4];
+        eq_attr->ist1 = outs[5];
+        eq_attr->ist2 = outs[6];
+        eq_attr->ist3 = outs[7];
+        eq_attr->ist4 = outs[8];
 
         return hret;
 }
@@ -402,31 +400,22 @@ u64 ehea_h_modify_ehea_qp(const u64 adapter_handle, const u8 cat,
                           void *cb_addr, u64 *inv_attr_id, u64 *proc_mask,
                           u16 *out_swr, u16 *out_rwr)
 {
-        u64 hret, dummy, act_out_swr, act_out_rwr;
-
-        if ((((u64)cb_addr) & (PAGE_SIZE - 1)) != 0) {
-                ehea_error("not on page boundary");
-                return H_PARAMETER;
-        }
-
-        hret = ehea_hcall_9arg_9ret(H_MODIFY_HEA_QP,
-                                    adapter_handle,             /* R4 */
-                                    (u64) cat,                  /* R5 */
-                                    qp_handle,                  /* R6 */
-                                    sel_mask,                   /* R7 */
-                                    virt_to_abs(cb_addr),       /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    inv_attr_id,                /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &act_out_swr,               /* R7 */
-                                    &act_out_rwr,               /* R8 */
-                                    proc_mask,                  /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-        *out_swr = act_out_swr;
-        *out_rwr = act_out_rwr;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+
+        hret = ehea_plpar_hcall9(H_MODIFY_HEA_QP,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 (u64) cat,                     /* R5 */
+                                 qp_handle,                     /* R6 */
+                                 sel_mask,                      /* R7 */
+                                 virt_to_abs(cb_addr),          /* R8 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
+
+        *inv_attr_id = outs[0];
+        *out_swr = outs[3];
+        *out_rwr = outs[4];
+        *proc_mask = outs[5];
 
         return hret;
 }
@@ -435,122 +424,81 @@ u64 ehea_h_register_rpage(const u64 adapter_handle, const u8 pagesize,
                           const u8 queue_type, const u64 resource_handle,
                           const u64 log_pageaddr, u64 count)
 {
-        u64 dummy, reg_control;
+        u64  reg_control;
 
         reg_control = EHEA_BMASK_SET(H_REG_RPAGE_PAGE_SIZE, pagesize)
                     | EHEA_BMASK_SET(H_REG_RPAGE_QT, queue_type);
 
-        return ehea_hcall_9arg_9ret(H_REGISTER_HEA_RPAGES,
-                                    adapter_handle,             /* R4 */
-                                    reg_control,                /* R5 */
-                                    resource_handle,            /* R6 */
-                                    log_pageaddr,               /* R7 */
-                                    count,                      /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return ehea_plpar_hcall_norets(H_REGISTER_HEA_RPAGES,
+                                       adapter_handle,          /* R4 */
+                                       reg_control,             /* R5 */
+                                       resource_handle,         /* R6 */
+                                       log_pageaddr,            /* R7 */
+                                       count,                   /* R8 */
+                                       0, 0);                   /* R9-R10 */
 }
 
 u64 ehea_h_register_smr(const u64 adapter_handle, const u64 orig_mr_handle,
                         const u64 vaddr_in, const u32 access_ctrl, const u32 pd,
                         struct ehea_mr *mr)
 {
-        u64 hret, dummy, lkey_out;
-
-        hret = ehea_hcall_9arg_9ret(H_REGISTER_SMR,
-                                    adapter_handle       ,          /* R4 */
-                                    orig_mr_handle,                 /* R5 */
-                                    vaddr_in,                       /* R6 */
-                                    (((u64)access_ctrl) << 32ULL),  /* R7 */
-                                    pd,                             /* R8 */
-                                    0, 0, 0, 0,                     /* R9-R12 */
-                                    &mr->handle,                    /* R4 */
-                                    &dummy,                         /* R5 */
-                                    &lkey_out,                      /* R6 */
-                                    &dummy,                         /* R7 */
-                                    &dummy,                         /* R8 */
-                                    &dummy,                         /* R9 */
-                                    &dummy,                         /* R10 */
-                                    &dummy,                         /* R11 */
-                                    &dummy);                        /* R12 */
-        mr->lkey = (u32)lkey_out;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+
+        hret = ehea_plpar_hcall9(H_REGISTER_SMR,
+                                 outs,
+                                 adapter_handle       ,          /* R4 */
+                                 orig_mr_handle,                 /* R5 */
+                                 vaddr_in,                       /* R6 */
+                                 (((u64)access_ctrl) << 32ULL),  /* R7 */
+                                 pd,                             /* R8 */
+                                 0, 0, 0, 0);                    /* R9-R12 */
+
+        mr->handle = outs[0];
+        mr->lkey = (u32)outs[2];
 
         return hret;
 }
 
 u64 ehea_h_disable_and_get_hea(const u64 adapter_handle, const u64 qp_handle)
 {
-        u64 hret, dummy, ladr_next_sq_wqe_out;
-        u64 ladr_next_rq1_wqe_out, ladr_next_rq2_wqe_out, ladr_next_rq3_wqe_out;
-
-        hret = ehea_hcall_9arg_9ret(H_DISABLE_AND_GET_HEA,
-                                    adapter_handle,             /* R4 */
-                                    H_DISABLE_GET_EHEA_WQE_P,   /* R5 */
-                                    qp_handle,                  /* R6 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R12 */
-                                    &ladr_next_sq_wqe_out,      /* R4 */
-                                    &ladr_next_rq1_wqe_out,     /* R5 */
-                                    &ladr_next_rq2_wqe_out,     /* R6 */
-                                    &ladr_next_rq3_wqe_out,     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-        return hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+
+        return ehea_plpar_hcall9(H_DISABLE_AND_GET_HEA,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 H_DISABLE_GET_EHEA_WQE_P,      /* R5 */
+                                 qp_handle,                     /* R6 */
+                                 0, 0, 0, 0, 0, 0);             /* R7-R12 */
 }
 
 u64 ehea_h_free_resource(const u64 adapter_handle, const u64 res_handle)
 {
-        u64 dummy;
-
-        return ehea_hcall_9arg_9ret(H_FREE_RESOURCE,
-                                    adapter_handle,        /* R4 */
-                                    res_handle,            /* R5 */
-                                    0, 0, 0, 0, 0, 0, 0,   /* R6-R12 */
-                                    &dummy,                /* R4 */
-                                    &dummy,                /* R5 */
-                                    &dummy,                /* R6 */
-                                    &dummy,                /* R7 */
-                                    &dummy,                /* R8 */
-                                    &dummy,                /* R9 */
-                                    &dummy,                /* R10 */
-                                    &dummy,                /* R11 */
-                                    &dummy);               /* R12 */
+        return ehea_plpar_hcall_norets(H_FREE_RESOURCE,
+                                       adapter_handle,     /* R4 */
+                                       res_handle,         /* R5 */
+                                       0, 0, 0, 0, 0);     /* R6-R10 */
 }
 
 u64 ehea_h_alloc_resource_mr(const u64 adapter_handle, const u64 vaddr,
                              const u64 length, const u32 access_ctrl,
                              const u32 pd, u64 *mr_handle, u32 *lkey)
 {
-        u64 hret, dummy, lkey_out;
-
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,                /* R4 */
-                                    5,                             /* R5 */
-                                    vaddr,                         /* R6 */
-                                    length,                        /* R7 */
-                                    (((u64) access_ctrl) << 32ULL),/* R8 */
-                                    pd,                            /* R9 */
-                                    0, 0, 0,                       /* R10-R12 */
-                                    mr_handle,                     /* R4 */
-                                    &dummy,                        /* R5 */
-                                    &lkey_out,                     /* R6 */
-                                    &dummy,                        /* R7 */
-                                    &dummy,                        /* R8 */
-                                    &dummy,                        /* R9 */
-                                    &dummy,                        /* R10 */
-                                    &dummy,                        /* R11 */
-                                    &dummy);                       /* R12 */
-        *lkey = (u32) lkey_out;
-
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
+                                 outs,
+                                 adapter_handle,                   /* R4 */
+                                 5,                                /* R5 */
+                                 vaddr,                            /* R6 */
+                                 length,                           /* R7 */
+                                 (((u64) access_ctrl) << 32ULL),   /* R8 */
+                                 pd,                               /* R9 */
+                                 0, 0, 0);                         /* R10-R12 */
+
+        *mr_handle = outs[0];
+        *lkey = (u32)outs[2];
         return hret;
 }
 
@@ -558,7 +506,7 @@ u64 ehea_h_register_rpage_mr(const u64 adapter_handle, const u64 mr_handle,
                              const u8 pagesize, const u8 queue_type,
                              const u64 log_pageaddr, const u64 count)
 {
-        if ((count > 1) && (log_pageaddr & 0xfff)) {
+        if ((count > 1) && (log_pageaddr & ~PAGE_MASK)) {
                 ehea_error("not on pageboundary");
                 return H_PARAMETER;
         }
@@ -570,23 +518,14 @@ u64 ehea_h_register_rpage_mr(const u64 adapter_handle, const u64 mr_handle,
 
 u64 ehea_h_query_ehea(const u64 adapter_handle, void *cb_addr)
 {
-        u64 hret, dummy, cb_logaddr;
+        u64 hret, cb_logaddr;
 
         cb_logaddr = virt_to_abs(cb_addr);
 
-        hret = ehea_hcall_9arg_9ret(H_QUERY_HEA,
-                                    adapter_handle,             /* R4 */
-                                    cb_logaddr,                 /* R5 */
-                                    0, 0, 0, 0, 0, 0, 0,        /* R6-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        hret = ehea_plpar_hcall_norets(H_QUERY_HEA,
+                                       adapter_handle,          /* R4 */
+                                       cb_logaddr,              /* R5 */
+                                       0, 0, 0, 0, 0);          /* R6-R10 */
 #ifdef DEBUG
         ehea_dmp(cb_addr, sizeof(struct hcp_query_ehea), "hcp_query_ehea");
 #endif
@@ -597,36 +536,28 @@ u64 ehea_h_query_ehea_port(const u64 adapter_handle, const u16 port_num,
                            const u8 cb_cat, const u64 select_mask,
                            void *cb_addr)
 {
-        u64 port_info, dummy;
+        u64 port_info;
         u64 cb_logaddr = virt_to_abs(cb_addr);
         u64 arr_index = 0;
 
         port_info = EHEA_BMASK_SET(H_MEHEAPORT_CAT, cb_cat)
                   | EHEA_BMASK_SET(H_MEHEAPORT_PN, port_num);
 
-        return ehea_hcall_9arg_9ret(H_QUERY_HEA_PORT,
-                                    adapter_handle,             /* R4 */
-                                    port_info,                  /* R5 */
-                                    select_mask,                /* R6 */
-                                    arr_index,                  /* R7 */
-                                    cb_logaddr,                 /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return ehea_plpar_hcall_norets(H_QUERY_HEA_PORT,
+                                       adapter_handle,          /* R4 */
+                                       port_info,               /* R5 */
+                                       select_mask,             /* R6 */
+                                       arr_index,               /* R7 */
+                                       cb_logaddr,              /* R8 */
+                                       0, 0);                   /* R9-R10 */
 }
 
 u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
                             const u8 cb_cat, const u64 select_mask,
                             void *cb_addr)
 {
-        u64 port_info, dummy, inv_attr_ident, proc_mask;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        u64 port_info;
         u64 arr_index = 0;
         u64 cb_logaddr = virt_to_abs(cb_addr);
 
@@ -635,29 +566,21 @@ u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
 #ifdef DEBUG
         ehea_dump(cb_addr, sizeof(struct hcp_ehea_port_cb0), "Before HCALL");
 #endif
-        return ehea_hcall_9arg_9ret(H_MODIFY_HEA_PORT,
-                                    adapter_handle,             /* R4 */
-                                    port_info,                  /* R5 */
-                                    select_mask,                /* R6 */
-                                    arr_index,                  /* R7 */
-                                    cb_logaddr,                 /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    &inv_attr_ident,            /* R4 */
-                                    &proc_mask,                 /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return ehea_plpar_hcall9(H_MODIFY_HEA_PORT,
+                                 outs,
+                                 adapter_handle,                /* R4 */
+                                 port_info,                     /* R5 */
+                                 select_mask,                   /* R6 */
+                                 arr_index,                     /* R7 */
+                                 cb_logaddr,                    /* R8 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
 }
 
 u64 ehea_h_reg_dereg_bcmc(const u64 adapter_handle, const u16 port_num,
                           const u8 reg_type, const u64 mc_mac_addr,
                           const u16 vlan_id, const u32 hcall_id)
 {
-        u64 r5_port_num, r6_reg_type, r7_mc_mac_addr, r8_vlan_id, dummy;
+        u64 r5_port_num, r6_reg_type, r7_mc_mac_addr, r8_vlan_id;
         u64 mac_addr = mc_mac_addr >> 16;
 
         r5_port_num = EHEA_BMASK_SET(H_REGBCMC_PN, port_num);
@@ -665,41 +588,21 @@ u64 ehea_h_reg_dereg_bcmc(const u64 adapter_handle, const u16 port_num,
         r7_mc_mac_addr = EHEA_BMASK_SET(H_REGBCMC_MACADDR, mac_addr);
         r8_vlan_id = EHEA_BMASK_SET(H_REGBCMC_VLANID, vlan_id);
 
-        return ehea_hcall_9arg_9ret(hcall_id,
-                                    adapter_handle,             /* R4 */
-                                    r5_port_num,                /* R5 */
-                                    r6_reg_type,                /* R6 */
-                                    r7_mc_mac_addr,             /* R7 */
-                                    r8_vlan_id,                 /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return ehea_plpar_hcall_norets(hcall_id,
+                                       adapter_handle,          /* R4 */
+                                       r5_port_num,             /* R5 */
+                                       r6_reg_type,             /* R6 */
+                                       r7_mc_mac_addr,          /* R7 */
+                                       r8_vlan_id,              /* R8 */
+                                       0, 0);                   /* R9-R12 */
 }
 
 u64 ehea_h_reset_events(const u64 adapter_handle, const u64 neq_handle,
                         const u64 event_mask)
 {
-        u64 dummy;
-
-        return ehea_hcall_9arg_9ret(H_RESET_EVENTS,
-                                    adapter_handle,             /* R4 */
-                                    neq_handle,                 /* R5 */
-                                    event_mask,                 /* R6 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
+        return ehea_plpar_hcall_norets(H_RESET_EVENTS,
+                                       adapter_handle,          /* R4 */
+                                       neq_handle,              /* R5 */
+                                       event_mask,              /* R6 */
+                                       0, 0, 0, 0);             /* R7-R12 */
 }
diff --git a/drivers/net/ehea/ehea_phyp.h b/drivers/net/ehea/ehea_phyp.h
index fa51e3b5bb05..919f94b75933 100644
--- a/drivers/net/ehea/ehea_phyp.h
+++ b/drivers/net/ehea/ehea_phyp.h
@@ -81,14 +81,16 @@ static inline u32 get_longbusy_msecs(int long_busy_ret_code)
 static inline void hcp_epas_ctor(struct h_epas *epas, u64 paddr_kernel,
                                  u64 paddr_user)
 {
-        epas->kernel.addr = ioremap(paddr_kernel, PAGE_SIZE);
+        /* To support 64k pages we must round to 64k page boundary */
+        epas->kernel.addr = ioremap((paddr_kernel & PAGE_MASK), PAGE_SIZE) +
+                            (paddr_kernel & ~PAGE_MASK);
         epas->user.addr = paddr_user;
 }
 
 static inline void hcp_epas_dtor(struct h_epas *epas)
 {
         if (epas->kernel.addr)
-                iounmap(epas->kernel.addr);
+                iounmap((void __iomem*)((u64)epas->kernel.addr & PAGE_MASK));
 
         epas->user.addr = 0;
         epas->kernel.addr = 0;
diff --git a/drivers/net/ehea/ehea_qmr.c b/drivers/net/ehea/ehea_qmr.c
index 3e1862326c88..72ef7bde3346 100644
--- a/drivers/net/ehea/ehea_qmr.c
+++ b/drivers/net/ehea/ehea_qmr.c
@@ -209,11 +209,11 @@ int ehea_destroy_cq(struct ehea_cq *cq)
 {
         u64 adapter_handle, hret;
 
-        adapter_handle = cq->adapter->handle;
-
         if (!cq)
                 return 0;
 
+        adapter_handle = cq->adapter->handle;
+
         /* deregister all previous registered pages */
         hret = ehea_h_free_resource(adapter_handle, cq->fw_handle);
         if (hret != H_SUCCESS) {
@@ -512,7 +512,7 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
 
         start = KERNELBASE;
         end = (u64)high_memory;
-        nr_pages = (end - start) / PAGE_SIZE;
+        nr_pages = (end - start) / EHEA_PAGESIZE;
 
         pt =  kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (!pt) {
@@ -538,9 +538,9 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
                 if (nr_pages > 1) {
                         u64 num_pages = min(nr_pages, (u64)512);
                         for (i = 0; i < num_pages; i++)
-                                pt[i] = virt_to_abs((void*)(((u64)start)
-                                                             + ((k++) *
-                                                                PAGE_SIZE)));
+                                pt[i] = virt_to_abs((void*)(((u64)start) +
+                                                            ((k++) *
+                                                             EHEA_PAGESIZE)));
 
                         hret = ehea_h_register_rpage_mr(adapter->handle,
                                                         adapter->mr.handle, 0,
@@ -548,8 +548,9 @@ int ehea_reg_mr_adapter(struct ehea_adapter *adapter)
                                                         num_pages);
                         nr_pages -= num_pages;
                 } else {
-                        u64 abs_adr = virt_to_abs((void*)(((u64)start)
-                                                           + (k * PAGE_SIZE)));
+                        u64 abs_adr = virt_to_abs((void*)(((u64)start) +
+                                                          (k * EHEA_PAGESIZE)));
+
                         hret = ehea_h_register_rpage_mr(adapter->handle,
                                                         adapter->mr.handle, 0,
                                                         0, abs_adr,1);
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 8cc3c331aca8..b7b8bc2a6307 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -162,9 +162,9 @@ static char *version =
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
 #include <linux/jiffies.h>
+#include <linux/io.h>
 
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/dma.h>
 
 
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 99b7a411db28..c5ed635bce36 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -2497,6 +2497,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
         u8 __iomem *base = get_hwbase(dev);
         u32 events;
         int i;
+        unsigned long flags;
 
         dprintk(KERN_DEBUG "%s: nv_nic_irq_tx\n", dev->name);
 
@@ -2508,16 +2509,16 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                 if (!(events & np->irqmask))
                         break;
 
-                spin_lock_irq(&np->lock);
+                spin_lock_irqsave(&np->lock, flags);
                 nv_tx_done(dev);
-                spin_unlock_irq(&np->lock);
+                spin_unlock_irqrestore(&np->lock, flags);
 
                 if (events & (NVREG_IRQ_TX_ERR)) {
                         dprintk(KERN_DEBUG "%s: received irq with events 0x%x. Probably TX fail.\n",
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_TX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2527,7 +2528,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                         break;
                 }
 
@@ -2601,6 +2602,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
         u8 __iomem *base = get_hwbase(dev);
         u32 events;
         int i;
+        unsigned long flags;
 
         dprintk(KERN_DEBUG "%s: nv_nic_irq_rx\n", dev->name);
 
@@ -2614,14 +2616,14 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
 
                 nv_rx_process(dev, dev->weight);
                 if (nv_alloc_rx(dev)) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         if (!np->in_shutdown)
                                 mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                 }
 
                 if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2631,7 +2633,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                         break;
                 }
         }
@@ -2648,6 +2650,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
         u8 __iomem *base = get_hwbase(dev);
         u32 events;
         int i;
+        unsigned long flags;
 
         dprintk(KERN_DEBUG "%s: nv_nic_irq_other\n", dev->name);
 
@@ -2660,14 +2663,14 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                         break;
 
                 if (events & NVREG_IRQ_LINK) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         nv_link_irq(dev);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                 }
                 if (np->need_linktimer && time_after(jiffies, np->link_timeout)) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         nv_linkchange(dev);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                         np->link_timeout = jiffies + LINK_TIMEOUT;
                 }
                 if (events & (NVREG_IRQ_UNKNOWN)) {
@@ -2675,7 +2678,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_OTHER, base + NvRegIrqMask);
                         pci_push(base);
@@ -2685,7 +2688,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                         break;
                 }
 
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 4bac3cd8f235..44c9f993dcc4 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -212,7 +212,8 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                         break;
                 }
 
-                free_index = pool->consumer_index++ % pool->size;
+                free_index = pool->consumer_index;
+                pool->consumer_index = (pool->consumer_index + 1) % pool->size;
                 index = pool->free_map[free_index];
 
                 ibmveth_assert(index != IBM_VETH_INVALID_MAP);
@@ -238,7 +239,10 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                 if(lpar_rc != H_SUCCESS) {
                         pool->free_map[free_index] = index;
                         pool->skbuff[index] = NULL;
-                        pool->consumer_index--;
+                        if (pool->consumer_index == 0)
+                                pool->consumer_index = pool->size - 1;
+                        else
+                                pool->consumer_index--;
                         dma_unmap_single(&adapter->vdev->dev,
                                         pool->dma_addr[index], pool->buff_size,
                                         DMA_FROM_DEVICE);
@@ -325,7 +329,10 @@ static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64
                          adapter->rx_buff_pool[pool].buff_size,
                          DMA_FROM_DEVICE);
 
-        free_index = adapter->rx_buff_pool[pool].producer_index++ % adapter->rx_buff_pool[pool].size;
+        free_index = adapter->rx_buff_pool[pool].producer_index;
+        adapter->rx_buff_pool[pool].producer_index
+                = (adapter->rx_buff_pool[pool].producer_index + 1)
+                % adapter->rx_buff_pool[pool].size;
         adapter->rx_buff_pool[pool].free_map[free_index] = index;
 
         mb();
@@ -437,6 +444,31 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                                                  &adapter->rx_buff_pool[i]);
 }
 
+static int ibmveth_register_logical_lan(struct ibmveth_adapter *adapter,
+        union ibmveth_buf_desc rxq_desc, u64 mac_address)
+{
+        int rc, try_again = 1;
+
+        /* After a kexec the adapter will still be open, so our attempt to
+        * open it will fail. So if we get a failure we free the adapter and
+        * try again, but only once. */
+retry:
+        rc = h_register_logical_lan(adapter->vdev->unit_address,
+                                    adapter->buffer_list_dma, rxq_desc.desc,
+                                    adapter->filter_list_dma, mac_address);
+
+        if (rc != H_SUCCESS && try_again) {
+                do {
+                        rc = h_free_logical_lan(adapter->vdev->unit_address);
+                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+
+                try_again = 0;
+                goto retry;
+        }
+
+        return rc;
+}
+
 static int ibmveth_open(struct net_device *netdev)
 {
         struct ibmveth_adapter *adapter = netdev->priv;
@@ -502,12 +534,9 @@ static int ibmveth_open(struct net_device *netdev)
         ibmveth_debug_printk("filter list @ 0x%p\n", adapter->filter_list_addr);
         ibmveth_debug_printk("receive q   @ 0x%p\n", adapter->rx_queue.queue_addr);
 
+        h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
 
-        lpar_rc = h_register_logical_lan(adapter->vdev->unit_address,
-                                         adapter->buffer_list_dma,
-                                         rxq_desc.desc,
-                                         adapter->filter_list_dma,
-                                         mac_address);
+        lpar_rc = ibmveth_register_logical_lan(adapter, rxq_desc, mac_address);
 
         if(lpar_rc != H_SUCCESS) {
                 ibmveth_error_printk("h_register_logical_lan failed with %ld\n", lpar_rc);
@@ -905,6 +934,14 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
         return -EINVAL;
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void ibmveth_poll_controller(struct net_device *dev)
+{
+        ibmveth_replenish_task(dev->priv);
+        ibmveth_interrupt(dev->irq, dev);
+}
+#endif
+
 static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 {
         int rc, i;
@@ -977,6 +1014,9 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
         netdev->ethtool_ops           = &netdev_ethtool_ops;
         netdev->change_mtu         = ibmveth_change_mtu;
         SET_NETDEV_DEV(netdev, &dev->dev);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        netdev->poll_controller = ibmveth_poll_controller;
+#endif
         netdev->features |= NETIF_F_LLTX;
         spin_lock_init(&adapter->stats_lock);
 
@@ -1132,7 +1172,9 @@ static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
 {
         struct proc_dir_entry *entry;
         if (ibmveth_proc_dir) {
-                entry = create_proc_entry(adapter->netdev->name, S_IFREG, ibmveth_proc_dir);
+                char u_addr[10];
+                sprintf(u_addr, "%x", adapter->vdev->unit_address);
+                entry = create_proc_entry(u_addr, S_IFREG, ibmveth_proc_dir);
                 if (!entry) {
                         ibmveth_error_printk("Cannot create adapter proc entry");
                 } else {
@@ -1147,7 +1189,9 @@ static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
 static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter)
 {
         if (ibmveth_proc_dir) {
-                remove_proc_entry(adapter->netdev->name, ibmveth_proc_dir);
+                char u_addr[10];
+                sprintf(u_addr, "%x", adapter->vdev->unit_address);
+                remove_proc_entry(u_addr, ibmveth_proc_dir);
         }
 }
 
diff --git a/drivers/net/ioc3-eth.c b/drivers/net/ioc3-eth.c
index e963dbf816be..f56b00ee385e 100644
--- a/drivers/net/ioc3-eth.c
+++ b/drivers/net/ioc3-eth.c
@@ -1017,7 +1017,7 @@ static void ioc3_init(struct net_device *dev)
         struct ioc3_private *ip = netdev_priv(dev);
         struct ioc3 *ioc3 = ip->regs;
 
-        del_timer(&ip->ioc3_timer);             /* Kill if running      */
+        del_timer_sync(&ip->ioc3_timer);        /* Kill if running      */
 
         ioc3_w_emcr(EMCR_RST);                  /* Reset                */
         (void) ioc3_r_emcr();                   /* Flush WB             */
@@ -1081,7 +1081,7 @@ static int ioc3_close(struct net_device *dev)
 {
         struct ioc3_private *ip = netdev_priv(dev);
 
-        del_timer(&ip->ioc3_timer);
+        del_timer_sync(&ip->ioc3_timer);
 
         netif_stop_queue(dev);
 
diff --git a/drivers/net/irda/stir4200.c b/drivers/net/irda/stir4200.c
index be8a66e702b0..3b4c47875935 100644
--- a/drivers/net/irda/stir4200.c
+++ b/drivers/net/irda/stir4200.c
@@ -15,8 +15,7 @@
 *
 *       This program is free software; you can redistribute it and/or modify
 *       it under the terms of the GNU General Public License as published by
-*       the Free Software Foundation; either version 2 of the License, or
-*       (at your option) any later version.
+*       the Free Software Foundation; either version 2 of the License.
 *
 *       This program is distributed in the hope that it will be useful,
 *       but WITHOUT ANY WARRANTY; without even the implied warranty of
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 4178b4b1d2df..82c10dec1b5a 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -58,7 +58,11 @@
 #include <linux/tcp.h>
 #include <linux/percpu.h>
 
-static DEFINE_PER_CPU(struct net_device_stats, loopback_stats);
+struct pcpu_lstats {
+        unsigned long packets;
+        unsigned long bytes;
+};
+static DEFINE_PER_CPU(struct pcpu_lstats, pcpu_lstats);
 
 #define LOOPBACK_OVERHEAD (128 + MAX_HEADER + 16 + 16)
 
@@ -128,7 +132,7 @@ static void emulate_large_send_offload(struct sk_buff *skb)
  */
 static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        struct net_device_stats *lb_stats;
+        struct pcpu_lstats *lb_stats;
 
         skb_orphan(skb);
 
@@ -149,16 +153,14 @@ static int loopback_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
         dev->last_rx = jiffies;
 
-        lb_stats = &per_cpu(loopback_stats, get_cpu());
-        lb_stats->rx_bytes += skb->len;
-        lb_stats->tx_bytes = lb_stats->rx_bytes;
-        lb_stats->rx_packets++;
-        lb_stats->tx_packets = lb_stats->rx_packets;
-        put_cpu();
+        /* it's OK to use __get_cpu_var() because BHs are off */
+        lb_stats = &__get_cpu_var(pcpu_lstats);
+        lb_stats->bytes += skb->len;
+        lb_stats->packets++;
 
         netif_rx(skb);
 
-        return(0);
+        return 0;
 }
 
 static struct net_device_stats loopback_stats;
@@ -166,20 +168,21 @@ static struct net_device_stats loopback_stats;
 static struct net_device_stats *get_stats(struct net_device *dev)
 {
         struct net_device_stats *stats = &loopback_stats;
+        unsigned long bytes = 0;
+        unsigned long packets = 0;
         int i;
 
-        memset(stats, 0, sizeof(struct net_device_stats));
-
         for_each_possible_cpu(i) {
-                struct net_device_stats *lb_stats;
+                const struct pcpu_lstats *lb_stats;
 
-                lb_stats = &per_cpu(loopback_stats, i);
-                stats->rx_bytes   += lb_stats->rx_bytes;
-                stats->tx_bytes   += lb_stats->tx_bytes;
-                stats->rx_packets += lb_stats->rx_packets;
-                stats->tx_packets += lb_stats->tx_packets;
+                lb_stats = &per_cpu(pcpu_lstats, i);
+                bytes   += lb_stats->bytes;
+                packets += lb_stats->packets;
         }
-
+        stats->rx_packets = packets;
+        stats->tx_packets = packets;
+        stats->rx_bytes = bytes;
+        stats->tx_bytes = bytes;
         return stats;
 }
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 2ffa3a59e704..9997081c6dae 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -2155,7 +2155,7 @@ static void eth_update_mib_counters(struct mv643xx_private *mp)
         for (offset = ETH_MIB_BAD_OCTETS_RECEIVED;
                         offset <= ETH_MIB_FRAMES_1024_TO_MAX_OCTETS;
                         offset += 4)
-                *(u32 *)((char *)p + offset) = read_mib(mp, offset);
+                *(u32 *)((char *)p + offset) += read_mib(mp, offset);
 
         p->good_octets_sent += read_mib(mp, ETH_MIB_GOOD_OCTETS_SENT_LOW);
         p->good_octets_sent +=
@@ -2164,7 +2164,7 @@ static void eth_update_mib_counters(struct mv643xx_private *mp)
         for (offset = ETH_MIB_GOOD_FRAMES_SENT;
                         offset <= ETH_MIB_LATE_COLLISION;
                         offset += 4)
-                *(u32 *)((char *)p + offset) = read_mib(mp, offset);
+                *(u32 *)((char *)p + offset) += read_mib(mp, offset);
 }
 
 /*
diff --git a/drivers/net/myri10ge/myri10ge.c b/drivers/net/myri10ge/myri10ge.c
index fdbb0d7213b0..806081b59733 100644
--- a/drivers/net/myri10ge/myri10ge.c
+++ b/drivers/net/myri10ge/myri10ge.c
@@ -2416,7 +2416,6 @@ static void myri10ge_enable_ecrc(struct myri10ge_priv *mgp)
  * firmware image, and set tx.boundary to 4KB.
  */
 
-#define PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE   0x0132
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE23 0x25f7
 #define PCI_DEVICE_ID_INTEL_E5000_PCIE47 0x25fa
 
diff --git a/drivers/net/myri_code.h b/drivers/net/myri_code.h
index e21ec9b2c706..ba7b8652c501 100644
--- a/drivers/net/myri_code.h
+++ b/drivers/net/myri_code.h
@@ -1,8 +1,8 @@
 /* This is the Myrinet MCP code for LANai4.x */
 /* Generated by  cat $MYRI_HOME/lib/lanai/mcp4.dat > myri_code4.h */
 
-static unsigned int lanai4_code_off = 0x0000; /* half-word offset */
-static unsigned char lanai4_code[76256] __initdata = {
+static unsigned int __devinitdata lanai4_code_off = 0x0000; /* half-word offset */
+static unsigned char __devinitdata lanai4_code[76256] = {
 0xF2,0x0E,
 0xFE,0x00, 0xC2,0x90, 0x00,0x00, 0x07,0x88, 0x00,0x08, 0xE0,0x01, 0x01,0x4C, 0x97,0x93,
 0xFF,0xFC, 0xE0,0x00, 0x00,0x14, 0x00,0x00, 0x00,0x01, 0x00,0x00, 0x00,0x00, 0x92,0x93,
@@ -4774,8 +4774,8 @@ static unsigned char lanai4_code[76256] __initdata = {
 
 /* This is the LANai data */
 
-static unsigned int lanai4_data_off = 0x94F0; /* half-word offset */
-static unsigned char lanai4_data[20472] __initdata;
+static unsigned int __devinitdata lanai4_data_off = 0x94F0; /* half-word offset */
+static unsigned char __devinitdata lanai4_data[20472];
 
 
 #ifdef SYMBOL_DEFINES_COMPILED
diff --git a/drivers/net/myri_sbus.c b/drivers/net/myri_sbus.c
index 466b484c9fa4..7747bfd99f91 100644
--- a/drivers/net/myri_sbus.c
+++ b/drivers/net/myri_sbus.c
@@ -168,7 +168,7 @@ static int myri_do_handshake(struct myri_eth *mp)
         return 0;
 }
 
-static int myri_load_lanai(struct myri_eth *mp)
+static int __devinit myri_load_lanai(struct myri_eth *mp)
 {
         struct net_device       *dev = mp->dev;
         struct myri_shmem __iomem *shmem = mp->shmem;
@@ -891,7 +891,7 @@ static void dump_eeprom(struct myri_eth *mp)
 }
 #endif
 
-static int __init myri_ether_init(struct sbus_dev *sdev)
+static int __devinit myri_ether_init(struct sbus_dev *sdev)
 {
         static int num;
         static unsigned version_printed;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index f1c75751cab7..27f90b2139c0 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -214,6 +214,7 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8168), 0, 0, RTL_CFG_2 },
         { PCI_DEVICE(PCI_VENDOR_ID_REALTEK,     0x8169), 0, 0, RTL_CFG_0 },
         { PCI_DEVICE(PCI_VENDOR_ID_DLINK,       0x4300), 0, 0, RTL_CFG_0 },
+        { PCI_DEVICE(0x1259,                    0xc107), 0, 0, RTL_CFG_0 },
         { PCI_DEVICE(0x16ec,                    0x0116), 0, 0, RTL_CFG_0 },
         { PCI_VENDOR_ID_LINKSYS,                0x1032,
                 PCI_ANY_ID, 0x0024, 0, 0, RTL_CFG_0 },
@@ -1396,41 +1397,6 @@ static void rtl8169_netpoll(struct net_device *dev)
 }
 #endif
 
-static void __rtl8169_set_mac_addr(struct net_device *dev, void __iomem *ioaddr)
-{
-        unsigned int i, j;
-
-        RTL_W8(Cfg9346, Cfg9346_Unlock);
-        for (i = 0; i < 2; i++) {
-                __le32 l = 0;
-
-                for (j = 0; j < 4; j++) {
-                        l <<= 8;
-                        l |= dev->dev_addr[4*i + j];
-                }
-                RTL_W32(MAC0 + 4*i, cpu_to_be32(l));
-        }
-        RTL_W8(Cfg9346, Cfg9346_Lock);
-}
-
-static int rtl8169_set_mac_addr(struct net_device *dev, void *p)
-{
-        struct rtl8169_private *tp = netdev_priv(dev);
-        struct sockaddr *addr = p;
-
-        if (!is_valid_ether_addr(addr->sa_data))
-                return -EINVAL;
-
-        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
-
-        if (netif_running(dev)) {
-                spin_lock_irq(&tp->lock);
-                __rtl8169_set_mac_addr(dev, tp->mmio_addr);
-                spin_unlock_irq(&tp->lock);
-        }
-        return 0;
-}
-
 static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
                                   void __iomem *ioaddr)
 {
@@ -1680,7 +1646,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->stop = rtl8169_close;
         dev->tx_timeout = rtl8169_tx_timeout;
         dev->set_multicast_list = rtl8169_set_rx_mode;
-        dev->set_mac_address = rtl8169_set_mac_addr;
         dev->watchdog_timeo = RTL8169_TX_TIMEOUT;
         dev->irq = pdev->irq;
         dev->base_addr = (unsigned long) ioaddr;
@@ -1928,8 +1893,6 @@ rtl8169_hw_start(struct net_device *dev)
         /* Enable all known interrupts by setting the interrupt mask. */
         RTL_W16(IntrMask, rtl8169_intr_mask);
 
-        __rtl8169_set_mac_addr(dev, ioaddr);
-
         netif_start_queue(dev);
 }
 
@@ -2700,6 +2663,7 @@ static void rtl8169_down(struct net_device *dev)
         struct rtl8169_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
         unsigned int poll_locked = 0;
+        unsigned int intrmask;
 
         rtl8169_delete_timer(dev);
 
@@ -2738,8 +2702,11 @@ core_down:
          * 2) dev->change_mtu
          *    -> rtl8169_poll can not be issued again and re-enable the
          *       interruptions. Let's simply issue the IRQ down sequence again.
+         *
+         * No loop if hotpluged or major error (0xffff).
          */
-        if (RTL_R16(IntrMask))
+        intrmask = RTL_R16(IntrMask);
+        if (intrmask && (intrmask != 0xffff))
                 goto core_down;
 
         rtl8169_tx_clear(tp);
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index a231ab7d28dd..33569ec9dbfc 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -5985,6 +5985,11 @@ static int set_rxd_buffer_pointer(nic_t *sp, RxD_t *rxdp, buffAdd_t *ba,
                         ((RxD3_t*)rxdp)->Buffer1_ptr = *temp1;
                 } else {
                         *skb = dev_alloc_skb(size);
+                        if (!(*skb)) {
+                                DBG_PRINT(ERR_DBG, "%s: dev_alloc_skb failed\n",
+                                          dev->name);
+                                return -ENOMEM;
+                        }
                         ((RxD3_t*)rxdp)->Buffer2_ptr = *temp2 =
                                 pci_map_single(sp->pdev, (*skb)->data,
                                                dev->mtu + 4,
@@ -6007,7 +6012,11 @@ static int set_rxd_buffer_pointer(nic_t *sp, RxD_t *rxdp, buffAdd_t *ba,
                         ((RxD3_t*)rxdp)->Buffer2_ptr = *temp2;
                 } else {
                         *skb = dev_alloc_skb(size);
-
+                        if (!(*skb)) {
+                                DBG_PRINT(ERR_DBG, "%s: dev_alloc_skb failed\n",
+                                          dev->name);
+                                return -ENOMEM;
+                        }
                         ((RxD3_t*)rxdp)->Buffer0_ptr = *temp0 =
                                 pci_map_single(sp->pdev, ba->ba_0, BUF0_LEN,
                                                PCI_DMA_FROMDEVICE);
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index db2324939b69..1eae16b72b4b 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2903,7 +2903,7 @@ sbmac_init_module(void)
 
                 dev = alloc_etherdev(sizeof(struct sbmac_softc));
                 if (!dev)
-                        return -ENOMEM; /* return ENOMEM */
+                        return -ENOMEM;
 
                 printk(KERN_DEBUG "sbmac: configuring MAC at %lx\n", port);
 
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index a4a58e4e93a1..b2949035f66a 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -11,8 +11,7 @@
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * the Free Software Foundation; either version 2 of the License.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -43,7 +42,7 @@
 #include "skge.h"
 
 #define DRV_NAME                "skge"
-#define DRV_VERSION             "1.8"
+#define DRV_VERSION             "1.9"
 #define PFX                     DRV_NAME " "
 
 #define DEFAULT_TX_RING_SIZE    128
@@ -197,8 +196,8 @@ static u32 skge_supported_modes(const struct skge_hw *hw)
                 else if (hw->chip_id == CHIP_ID_YUKON)
                         supported &= ~SUPPORTED_1000baseT_Half;
         } else
-                supported = SUPPORTED_1000baseT_Full | SUPPORTED_FIBRE
-                        | SUPPORTED_Autoneg;
+                supported = SUPPORTED_1000baseT_Full | SUPPORTED_1000baseT_Half
+                        | SUPPORTED_FIBRE | SUPPORTED_Autoneg;
 
         return supported;
 }
@@ -487,31 +486,37 @@ static void skge_get_pauseparam(struct net_device *dev,
 {
         struct skge_port *skge = netdev_priv(dev);
 
-        ecmd->tx_pause = (skge->flow_control == FLOW_MODE_LOC_SEND)
-                || (skge->flow_control == FLOW_MODE_SYMMETRIC);
-        ecmd->rx_pause = (skge->flow_control == FLOW_MODE_REM_SEND)
-                || (skge->flow_control == FLOW_MODE_SYMMETRIC);
+        ecmd->rx_pause = (skge->flow_control == FLOW_MODE_SYMMETRIC)
+                || (skge->flow_control == FLOW_MODE_SYM_OR_REM);
+        ecmd->tx_pause = ecmd->rx_pause || (skge->flow_control == FLOW_MODE_LOC_SEND);
 
-        ecmd->autoneg = skge->autoneg;
+        ecmd->autoneg = ecmd->rx_pause || ecmd->tx_pause;
 }
 
 static int skge_set_pauseparam(struct net_device *dev,
                                struct ethtool_pauseparam *ecmd)
 {
         struct skge_port *skge = netdev_priv(dev);
+        struct ethtool_pauseparam old;
 
-        skge->autoneg = ecmd->autoneg;
-        if (ecmd->rx_pause && ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_SYMMETRIC;
-        else if (ecmd->rx_pause && !ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_REM_SEND;
-        else if (!ecmd->rx_pause && ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_LOC_SEND;
-        else
-                skge->flow_control = FLOW_MODE_NONE;
+        skge_get_pauseparam(dev, &old);
+
+        if (ecmd->autoneg != old.autoneg)
+                skge->flow_control = ecmd->autoneg ? FLOW_MODE_NONE : FLOW_MODE_SYMMETRIC;
+        else {
+                if (ecmd->rx_pause && ecmd->tx_pause)
+                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                else if (ecmd->rx_pause && !ecmd->tx_pause)
+                        skge->flow_control = FLOW_MODE_SYM_OR_REM;
+                else if (!ecmd->rx_pause && ecmd->tx_pause)
+                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                else
+                        skge->flow_control = FLOW_MODE_NONE;
+        }
 
         if (netif_running(dev))
                 skge_phy_reset(skge);
+
         return 0;
 }
 
@@ -854,6 +859,23 @@ static int skge_rx_fill(struct net_device *dev)
         return 0;
 }
 
+static const char *skge_pause(enum pause_status status)
+{
+        switch(status) {
+        case FLOW_STAT_NONE:
+                return "none";
+        case FLOW_STAT_REM_SEND:
+                return "rx only";
+        case FLOW_STAT_LOC_SEND:
+                return "tx_only";
+        case FLOW_STAT_SYMMETRIC:               /* Both station may send PAUSE */
+                return "both";
+        default:
+                return "indeterminated";
+        }
+}
+
+
 static void skge_link_up(struct skge_port *skge)
 {
         skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG),
@@ -862,16 +884,13 @@ static void skge_link_up(struct skge_port *skge)
         netif_carrier_on(skge->netdev);
         netif_wake_queue(skge->netdev);
 
-        if (netif_msg_link(skge))
+        if (netif_msg_link(skge)) {
                 printk(KERN_INFO PFX
                        "%s: Link is up at %d Mbps, %s duplex, flow control %s\n",
                        skge->netdev->name, skge->speed,
                        skge->duplex == DUPLEX_FULL ? "full" : "half",
-                       (skge->flow_control == FLOW_MODE_NONE) ? "none" :
-                       (skge->flow_control == FLOW_MODE_LOC_SEND) ? "tx only" :
-                       (skge->flow_control == FLOW_MODE_REM_SEND) ? "rx only" :
-                       (skge->flow_control == FLOW_MODE_SYMMETRIC) ? "tx and rx" :
-                       "unknown");
+                       skge_pause(skge->flow_status));
+        }
 }
 
 static void skge_link_down(struct skge_port *skge)
@@ -884,6 +903,29 @@ static void skge_link_down(struct skge_port *skge)
                 printk(KERN_INFO PFX "%s: Link is down.\n", skge->netdev->name);
 }
 
+
+static void xm_link_down(struct skge_hw *hw, int port)
+{
+        struct net_device *dev = hw->dev[port];
+        struct skge_port *skge = netdev_priv(dev);
+        u16 cmd, msk;
+
+        if (hw->phy_type == SK_PHY_XMAC) {
+                msk = xm_read16(hw, port, XM_IMSK);
+                msk |= XM_IS_INP_ASS | XM_IS_LIPA_RC | XM_IS_RX_PAGE | XM_IS_AND;
+                xm_write16(hw, port, XM_IMSK, msk);
+        }
+
+        cmd = xm_read16(hw, port, XM_MMU_CMD);
+        cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
+        xm_write16(hw, port, XM_MMU_CMD, cmd);
+        /* dummy read to ensure writing */
+        (void) xm_read16(hw, port, XM_MMU_CMD);
+
+        if (netif_carrier_ok(dev))
+                skge_link_down(skge);
+}
+
 static int __xm_phy_read(struct skge_hw *hw, int port, u16 reg, u16 *val)
 {
         int i;
@@ -992,7 +1034,15 @@ static const u16 phy_pause_map[] = {
         [FLOW_MODE_NONE] =      0,
         [FLOW_MODE_LOC_SEND] =  PHY_AN_PAUSE_ASYM,
         [FLOW_MODE_SYMMETRIC] = PHY_AN_PAUSE_CAP,
-        [FLOW_MODE_REM_SEND]  = PHY_AN_PAUSE_CAP | PHY_AN_PAUSE_ASYM,
+        [FLOW_MODE_SYM_OR_REM]  = PHY_AN_PAUSE_CAP | PHY_AN_PAUSE_ASYM,
+};
+
+/* special defines for FIBER (88E1011S only) */
+static const u16 fiber_pause_map[] = {
+        [FLOW_MODE_NONE]        = PHY_X_P_NO_PAUSE,
+        [FLOW_MODE_LOC_SEND]    = PHY_X_P_ASYM_MD,
+        [FLOW_MODE_SYMMETRIC]   = PHY_X_P_SYM_MD,
+        [FLOW_MODE_SYM_OR_REM]  = PHY_X_P_BOTH_MD,
 };
 
 
@@ -1008,14 +1058,7 @@ static void bcom_check_link(struct skge_hw *hw, int port)
         status = xm_phy_read(hw, port, PHY_BCOM_STAT);
 
         if ((status & PHY_ST_LSYNC) == 0) {
-                u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
-                cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
-                xm_write16(hw, port, XM_MMU_CMD, cmd);
-                /* dummy read to ensure writing */
-                (void) xm_read16(hw, port, XM_MMU_CMD);
-
-                if (netif_carrier_ok(dev))
-                        skge_link_down(skge);
+                xm_link_down(hw, port);
                 return;
         }
 
@@ -1048,20 +1091,19 @@ static void bcom_check_link(struct skge_hw *hw, int port)
                         return;
                 }
 
-
                 /* We are using IEEE 802.3z/D5.0 Table 37-4 */
                 switch (aux & PHY_B_AS_PAUSE_MSK) {
                 case PHY_B_AS_PAUSE_MSK:
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
                         break;
                 case PHY_B_AS_PRR:
-                        skge->flow_control = FLOW_MODE_REM_SEND;
+                        skge->flow_status = FLOW_STAT_REM_SEND;
                         break;
                 case PHY_B_AS_PRT:
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                         break;
                 default:
-                        skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_status = FLOW_STAT_NONE;
                 }
                 skge->speed = SPEED_1000;
         }
@@ -1191,17 +1233,7 @@ static void xm_phy_init(struct skge_port *skge)
                 if (skge->advertising & ADVERTISED_1000baseT_Full)
                         ctrl |= PHY_X_AN_FD;
 
-                switch(skge->flow_control) {
-                case FLOW_MODE_NONE:
-                        ctrl |= PHY_X_P_NO_PAUSE;
-                        break;
-                case FLOW_MODE_LOC_SEND:
-                        ctrl |= PHY_X_P_ASYM_MD;
-                        break;
-                case FLOW_MODE_SYMMETRIC:
-                        ctrl |= PHY_X_P_BOTH_MD;
-                        break;
-                }
+                ctrl |= fiber_pause_map[skge->flow_control];
 
                 xm_phy_write(hw, port, PHY_XMAC_AUNE_ADV, ctrl);
 
@@ -1235,14 +1267,7 @@ static void xm_check_link(struct net_device *dev)
         status = xm_phy_read(hw, port, PHY_XMAC_STAT);
 
         if ((status & PHY_ST_LSYNC) == 0) {
-                u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
-                cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
-                xm_write16(hw, port, XM_MMU_CMD, cmd);
-                /* dummy read to ensure writing */
-                (void) xm_read16(hw, port, XM_MMU_CMD);
-
-                if (netif_carrier_ok(dev))
-                        skge_link_down(skge);
+                xm_link_down(hw, port);
                 return;
         }
 
@@ -1276,15 +1301,20 @@ static void xm_check_link(struct net_device *dev)
                 }
 
                 /* We are using IEEE 802.3z/D5.0 Table 37-4 */
-                if (lpa & PHY_X_P_SYM_MD)
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
-                else if ((lpa & PHY_X_RS_PAUSE) == PHY_X_P_ASYM_MD)
-                        skge->flow_control = FLOW_MODE_REM_SEND;
-                else if ((lpa & PHY_X_RS_PAUSE) == PHY_X_P_BOTH_MD)
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                if ((skge->flow_control == FLOW_MODE_SYMMETRIC ||
+                     skge->flow_control == FLOW_MODE_SYM_OR_REM) &&
+                    (lpa & PHY_X_P_SYM_MD))
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
+                else if (skge->flow_control == FLOW_MODE_SYM_OR_REM &&
+                         (lpa & PHY_X_RS_PAUSE) == PHY_X_P_ASYM_MD)
+                        /* Enable PAUSE receive, disable PAUSE transmit */
+                        skge->flow_status  = FLOW_STAT_REM_SEND;
+                else if (skge->flow_control == FLOW_MODE_LOC_SEND &&
+                         (lpa & PHY_X_RS_PAUSE) == PHY_X_P_BOTH_MD)
+                        /* Disable PAUSE receive, enable PAUSE transmit */
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                 else
-                        skge->flow_control = FLOW_MODE_NONE;
-
+                        skge->flow_status = FLOW_STAT_NONE;
 
                 skge->speed = SPEED_1000;
         }
@@ -1568,6 +1598,10 @@ static void genesis_mac_intr(struct skge_hw *hw, int port)
                 printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
                        skge->netdev->name, status);
 
+        if (hw->phy_type == SK_PHY_XMAC &&
+            (status & (XM_IS_INP_ASS | XM_IS_LIPA_RC)))
+                xm_link_down(hw, port);
+
         if (status & XM_IS_TXF_UR) {
                 xm_write32(hw, port, XM_MODE, XM_MD_FTF);
                 ++skge->net_stats.tx_fifo_errors;
@@ -1582,7 +1616,7 @@ static void genesis_link_up(struct skge_port *skge)
 {
         struct skge_hw *hw = skge->hw;
         int port = skge->port;
-        u16 cmd;
+        u16 cmd, msk;
         u32 mode;
 
         cmd = xm_read16(hw, port, XM_MMU_CMD);
@@ -1591,8 +1625,8 @@ static void genesis_link_up(struct skge_port *skge)
          * enabling pause frame reception is required for 1000BT
          * because the XMAC is not reset if the link is going down
          */
-        if (skge->flow_control == FLOW_MODE_NONE ||
-            skge->flow_control == FLOW_MODE_LOC_SEND)
+        if (skge->flow_status == FLOW_STAT_NONE ||
+            skge->flow_status == FLOW_STAT_LOC_SEND)
                 /* Disable Pause Frame Reception */
                 cmd |= XM_MMU_IGN_PF;
         else
@@ -1602,8 +1636,8 @@ static void genesis_link_up(struct skge_port *skge)
         xm_write16(hw, port, XM_MMU_CMD, cmd);
 
         mode = xm_read32(hw, port, XM_MODE);
-        if (skge->flow_control == FLOW_MODE_SYMMETRIC ||
-            skge->flow_control == FLOW_MODE_LOC_SEND) {
+        if (skge->flow_status== FLOW_STAT_SYMMETRIC ||
+            skge->flow_status == FLOW_STAT_LOC_SEND) {
                 /*
                  * Configure Pause Frame Generation
                  * Use internal and external Pause Frame Generation.
@@ -1631,7 +1665,11 @@ static void genesis_link_up(struct skge_port *skge)
         }
 
         xm_write32(hw, port, XM_MODE, mode);
-        xm_write16(hw, port, XM_IMSK, XM_DEF_MSK);
+        msk = XM_DEF_MSK;
+        if (hw->phy_type != SK_PHY_XMAC)
+                msk |= XM_IS_INP_ASS;   /* disable GP0 interrupt bit */
+
+        xm_write16(hw, port, XM_IMSK, msk);
         xm_read16(hw, port, XM_ISRC);
 
         /* get MMU Command Reg. */
@@ -1779,11 +1817,17 @@ static void yukon_init(struct skge_hw *hw, int port)
                                 adv |= PHY_M_AN_10_FD;
                         if (skge->advertising & ADVERTISED_10baseT_Half)
                                 adv |= PHY_M_AN_10_HD;
-                } else  /* special defines for FIBER (88E1011S only) */
-                        adv |= PHY_M_AN_1000X_AHD | PHY_M_AN_1000X_AFD;
 
-                /* Set Flow-control capabilities */
-                adv |= phy_pause_map[skge->flow_control];
+                        /* Set Flow-control capabilities */
+                        adv |= phy_pause_map[skge->flow_control];
+                } else {
+                        if (skge->advertising & ADVERTISED_1000baseT_Full)
+                                adv |= PHY_M_AN_1000X_AFD;
+                        if (skge->advertising & ADVERTISED_1000baseT_Half)
+                                adv |= PHY_M_AN_1000X_AHD;
+
+                        adv |= fiber_pause_map[skge->flow_control];
+                }
 
                 /* Restart Auto-negotiation */
                 ctrl |= PHY_CT_ANE | PHY_CT_RE_CFG;
@@ -1917,6 +1961,11 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
         case FLOW_MODE_LOC_SEND:
                 /* disable Rx flow-control */
                 reg |= GM_GPCR_FC_RX_DIS | GM_GPCR_AU_FCT_DIS;
+                break;
+        case FLOW_MODE_SYMMETRIC:
+        case FLOW_MODE_SYM_OR_REM:
+                /* enable Tx & Rx flow-control */
+                break;
         }
 
         gma_write16(hw, port, GM_GP_CTRL, reg);
@@ -2111,13 +2160,11 @@ static void yukon_link_down(struct skge_port *skge)
         ctrl &= ~(GM_GPCR_RX_ENA | GM_GPCR_TX_ENA);
         gma_write16(hw, port, GM_GP_CTRL, ctrl);
 
-        if (skge->flow_control == FLOW_MODE_REM_SEND) {
+        if (skge->flow_status == FLOW_STAT_REM_SEND) {
+                ctrl = gm_phy_read(hw, port, PHY_MARV_AUNE_ADV);
+                ctrl |= PHY_M_AN_ASP;
                 /* restore Asymmetric Pause bit */
-                gm_phy_write(hw, port, PHY_MARV_AUNE_ADV,
-                                  gm_phy_read(hw, port,
-                                                   PHY_MARV_AUNE_ADV)
-                                  | PHY_M_AN_ASP);
-
+                gm_phy_write(hw, port, PHY_MARV_AUNE_ADV, ctrl);
         }
 
         yukon_reset(hw, port);
@@ -2164,19 +2211,19 @@ static void yukon_phy_intr(struct skge_port *skge)
                 /* We are using IEEE 802.3z/D5.0 Table 37-4 */
                 switch (phystat & PHY_M_PS_PAUSE_MSK) {
                 case PHY_M_PS_PAUSE_MSK:
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
                         break;
                 case PHY_M_PS_RX_P_EN:
-                        skge->flow_control = FLOW_MODE_REM_SEND;
+                        skge->flow_status = FLOW_STAT_REM_SEND;
                         break;
                 case PHY_M_PS_TX_P_EN:
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                         break;
                 default:
-                        skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_status = FLOW_STAT_NONE;
                 }
 
-                if (skge->flow_control == FLOW_MODE_NONE ||
+                if (skge->flow_status == FLOW_STAT_NONE ||
                     (skge->speed < SPEED_1000 && skge->duplex == DUPLEX_HALF))
                         skge_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
                 else
@@ -3399,7 +3446,7 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
 
         /* Auto speed and flow control */
         skge->autoneg = AUTONEG_ENABLE;
-        skge->flow_control = FLOW_MODE_SYMMETRIC;
+        skge->flow_control = FLOW_MODE_SYM_OR_REM;
         skge->duplex = -1;
         skge->speed = -1;
         skge->advertising = skge_supported_modes(hw);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index d0b47d46cf9d..537c0aaa1db8 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2195,7 +2195,8 @@ enum {
         XM_IS_RX_COMP   = 1<<0, /* Bit  0:      Frame Rx Complete */
 };
 
-#define XM_DEF_MSK      (~(XM_IS_RXC_OV | XM_IS_TXC_OV | XM_IS_RXF_OV | XM_IS_TXF_UR))
+#define XM_DEF_MSK      (~(XM_IS_INP_ASS | XM_IS_LIPA_RC | \
+                           XM_IS_RXF_OV | XM_IS_TXF_UR))
 
 
 /*      XM_HW_CFG       16 bit r/w      Hardware Config Register */
@@ -2426,13 +2427,24 @@ struct skge_hw {
         struct mutex         phy_mutex;
 };
 
-enum {
-        FLOW_MODE_NONE          = 0, /* No Flow-Control */
-        FLOW_MODE_LOC_SEND      = 1, /* Local station sends PAUSE */
-        FLOW_MODE_REM_SEND      = 2, /* Symmetric or just remote */
+enum pause_control {
+        FLOW_MODE_NONE          = 1, /* No Flow-Control */
+        FLOW_MODE_LOC_SEND      = 2, /* Local station sends PAUSE */
         FLOW_MODE_SYMMETRIC     = 3, /* Both stations may send PAUSE */
+        FLOW_MODE_SYM_OR_REM    = 4, /* Both stations may send PAUSE or
+                                      * just the remote station may send PAUSE
+                                      */
+};
+
+enum pause_status {
+        FLOW_STAT_INDETERMINATED=0,     /* indeterminated */
+        FLOW_STAT_NONE,                 /* No Flow Control */
+        FLOW_STAT_REM_SEND,             /* Remote Station sends PAUSE */
+        FLOW_STAT_LOC_SEND,             /* Local station sends PAUSE */
+        FLOW_STAT_SYMMETRIC,            /* Both station may send PAUSE */
 };
 
+
 struct skge_port {
         u32                  msg_enable;
         struct skge_hw       *hw;
@@ -2445,9 +2457,10 @@ struct skge_port {
         struct net_device_stats net_stats;
 
         struct work_struct   link_thread;
+        enum pause_control   flow_control;
+        enum pause_status    flow_status;
         u8                   rx_csum;
         u8                   blink_on;
-        u8                   flow_control;
         u8                   wol;
         u8                   autoneg;   /* AUTONEG_ENABLE, AUTONEG_DISABLE */
         u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 459c845d6648..16616f5440d0 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -10,8 +10,7 @@
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * the Free Software Foundation; either version 2 of the License.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ -50,7 +49,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.9"
+#define DRV_VERSION             "1.10"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -96,9 +95,9 @@ static int disable_msi = 0;
 module_param(disable_msi, int, 0);
 MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
 
-static int idle_timeout = 100;
+static int idle_timeout = 0;
 module_param(idle_timeout, int, 0);
-MODULE_PARM_DESC(idle_timeout, "Idle timeout workaround for lost interrupts (ms)");
+MODULE_PARM_DESC(idle_timeout, "Watchdog timer for lost interrupts (ms)");
 
 static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, 0x9000) },
@@ -284,6 +283,31 @@ static void sky2_gmac_reset(struct sky2_hw *hw, unsigned port)
         gma_write16(hw, port, GM_RX_CTRL, reg);
 }
 
+/* flow control to advertise bits */
+static const u16 copper_fc_adv[] = {
+        [FC_NONE]       = 0,
+        [FC_TX]         = PHY_M_AN_ASP,
+        [FC_RX]         = PHY_M_AN_PC,
+        [FC_BOTH]       = PHY_M_AN_PC | PHY_M_AN_ASP,
+};
+
+/* flow control to advertise bits when using 1000BaseX */
+static const u16 fiber_fc_adv[] = {
+        [FC_BOTH] = PHY_M_P_BOTH_MD_X,
+        [FC_TX]   = PHY_M_P_ASYM_MD_X,
+        [FC_RX]   = PHY_M_P_SYM_MD_X,
+        [FC_NONE] = PHY_M_P_NO_PAUSE_X,
+};
+
+/* flow control to GMA disable bits */
+static const u16 gm_fc_disable[] = {
+        [FC_NONE] = GM_GPCR_FC_RX_DIS | GM_GPCR_FC_TX_DIS,
+        [FC_TX]   = GM_GPCR_FC_RX_DIS,
+        [FC_RX]   = GM_GPCR_FC_TX_DIS,
+        [FC_BOTH] = 0,
+};
+
+
 static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
 {
         struct sky2_port *sky2 = netdev_priv(hw->dev[port]);
@@ -356,16 +380,7 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
         }
 
-        ctrl = gm_phy_read(hw, port, PHY_MARV_CTRL);
-        if (sky2->autoneg == AUTONEG_DISABLE)
-                ctrl &= ~PHY_CT_ANE;
-        else
-                ctrl |= PHY_CT_ANE;
-
-        ctrl |= PHY_CT_RESET;
-        gm_phy_write(hw, port, PHY_MARV_CTRL, ctrl);
-
-        ctrl = 0;
+        ctrl = PHY_CT_RESET;
         ct1000 = 0;
         adv = PHY_AN_CSMA;
         reg = 0;
@@ -384,20 +399,16 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                                 adv |= PHY_M_AN_10_FD;
                         if (sky2->advertising & ADVERTISED_10baseT_Half)
                                 adv |= PHY_M_AN_10_HD;
+
+                        adv |= copper_fc_adv[sky2->flow_mode];
                 } else {        /* special defines for FIBER (88E1040S only) */
                         if (sky2->advertising & ADVERTISED_1000baseT_Full)
                                 adv |= PHY_M_AN_1000X_AFD;
                         if (sky2->advertising & ADVERTISED_1000baseT_Half)
                                 adv |= PHY_M_AN_1000X_AHD;
-                }
 
-                /* Set Flow-control capabilities */
-                if (sky2->tx_pause && sky2->rx_pause)
-                        adv |= PHY_AN_PAUSE_CAP;        /* symmetric */
-                else if (sky2->rx_pause && !sky2->tx_pause)
-                        adv |= PHY_AN_PAUSE_ASYM | PHY_AN_PAUSE_CAP;
-                else if (!sky2->rx_pause && sky2->tx_pause)
-                        adv |= PHY_AN_PAUSE_ASYM;       /* local */
+                        adv |= fiber_fc_adv[sky2->flow_mode];
+                }
 
                 /* Restart Auto-negotiation */
                 ctrl |= PHY_CT_ANE | PHY_CT_RE_CFG;
@@ -422,25 +433,17 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 if (sky2->duplex == DUPLEX_FULL) {
                         reg |= GM_GPCR_DUP_FULL;
                         ctrl |= PHY_CT_DUP_MD;
-                } else if (sky2->speed != SPEED_1000 && hw->chip_id != CHIP_ID_YUKON_EC_U) {
-                        /* Turn off flow control for 10/100mbps */
-                        sky2->rx_pause = 0;
-                        sky2->tx_pause = 0;
-                }
+                } else if (sky2->speed < SPEED_1000)
+                        sky2->flow_mode = FC_NONE;
 
-                if (!sky2->rx_pause)
-                        reg |= GM_GPCR_FC_RX_DIS;
 
-                if (!sky2->tx_pause)
-                        reg |= GM_GPCR_FC_TX_DIS;
+                reg |= gm_fc_disable[sky2->flow_mode];
 
                 /* Forward pause packets to GMAC? */
-                if (sky2->tx_pause || sky2->rx_pause)
+                if (sky2->flow_mode & FC_RX)
                         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_ON);
                 else
                         sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
-
-                ctrl |= PHY_CT_RESET;
         }
 
         gma_write16(hw, port, GM_GP_CTRL, reg);
@@ -683,7 +686,7 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
         sky2_write16(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_OPER_ON);
 
         if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
-                sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
+                sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 512/8);
                 sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
                 if (hw->dev[port]->mtu > ETH_DATA_LEN) {
                         /* set Tx GMAC FIFO Almost Empty Threshold */
@@ -695,16 +698,10 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
 }
 
-/* Assign Ram Buffer allocation.
- * start and end are in units of 4k bytes
- * ram registers are in units of 64bit words
- */
-static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk)
+/* Assign Ram Buffer allocation in units of 64bit (8 bytes) */
+static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 end)
 {
-        u32 start, end;
-
-        start = startk * 4096/8;
-        end = (endk * 4096/8) - 1;
+        pr_debug(PFX "q %d %#x %#x\n", q, start, end);
 
         sky2_write8(hw, RB_ADDR(q, RB_CTRL), RB_RST_CLR);
         sky2_write32(hw, RB_ADDR(q, RB_START), start);
@@ -713,7 +710,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u8 startk, u8 endk)
         sky2_write32(hw, RB_ADDR(q, RB_RP), start);
 
         if (q == Q_R1 || q == Q_R2) {
-                u32 space = (endk - startk) * 4096/8;
+                u32 space = end - start + 1;
                 u32 tp = space - space/4;
 
                 /* On receive queue's set the thresholds
@@ -1195,19 +1192,16 @@ static int sky2_up(struct net_device *dev)
 
         sky2_mac_init(hw, port);
 
-        /* Determine available ram buffer space (in 4K blocks).
-         * Note: not sure about the FE setting below yet
-         */
-        if (hw->chip_id == CHIP_ID_YUKON_FE)
-                ramsize = 4;
-        else
-                ramsize = sky2_read8(hw, B2_E_0);
+        /* Determine available ram buffer space in qwords.  */
+        ramsize = sky2_read8(hw, B2_E_0) * 4096/8;
 
-        /* Give transmitter one third (rounded up) */
-        rxspace = ramsize - (ramsize + 2) / 3;
+        if (ramsize > 6*1024/8)
+                rxspace = ramsize - (ramsize + 2) / 3;
+        else
+                rxspace = ramsize / 2;
 
-        sky2_ramset(hw, rxqaddr[port], 0, rxspace);
-        sky2_ramset(hw, txqaddr[port], rxspace, ramsize);
+        sky2_ramset(hw, rxqaddr[port], 0, rxspace-1);
+        sky2_ramset(hw, txqaddr[port], rxspace, ramsize-1);
 
         /* Make sure SyncQ is disabled */
         sky2_write8(hw, RB_ADDR(port == 0 ? Q_XS1 : Q_XS2, RB_CTRL),
@@ -1499,6 +1493,11 @@ static int sky2_down(struct net_device *dev)
         /* Stop more packets from being queued */
         netif_stop_queue(dev);
 
+        /* Disable port IRQ */
+        imask = sky2_read32(hw, B0_IMSK);
+        imask &= ~portirq_msk[port];
+        sky2_write32(hw, B0_IMSK, imask);
+
         sky2_gmac_reset(hw, port);
 
         /* Stop transmitter */
@@ -1549,11 +1548,6 @@ static int sky2_down(struct net_device *dev)
         sky2_write8(hw, SK_REG(port, RX_GMF_CTRL_T), GMF_RST_SET);
         sky2_write8(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_RST_SET);
 
-        /* Disable port IRQ */
-        imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~portirq_msk[port];
-        sky2_write32(hw, B0_IMSK, imask);
-
         sky2_phy_power(hw, port, 0);
 
         /* turn off LED's */
@@ -1605,6 +1599,12 @@ static void sky2_link_up(struct sky2_port *sky2)
         struct sky2_hw *hw = sky2->hw;
         unsigned port = sky2->port;
         u16 reg;
+        static const char *fc_name[] = {
+                [FC_NONE]       = "none",
+                [FC_TX]         = "tx",
+                [FC_RX]         = "rx",
+                [FC_BOTH]       = "both",
+        };
 
         /* enable Rx/Tx */
         reg = gma_read16(hw, port, GM_GP_CTRL);
@@ -1648,8 +1648,7 @@ static void sky2_link_up(struct sky2_port *sky2)
                        "%s: Link is up at %d Mbps, %s duplex, flow control %s\n",
                        sky2->netdev->name, sky2->speed,
                        sky2->duplex == DUPLEX_FULL ? "full" : "half",
-                       (sky2->tx_pause && sky2->rx_pause) ? "both" :
-                       sky2->tx_pause ? "tx" : sky2->rx_pause ? "rx" : "none");
+                       fc_name[sky2->flow_status]);
 }
 
 static void sky2_link_down(struct sky2_port *sky2)
@@ -1664,7 +1663,7 @@ static void sky2_link_down(struct sky2_port *sky2)
         reg &= ~(GM_GPCR_RX_ENA | GM_GPCR_TX_ENA);
         gma_write16(hw, port, GM_GP_CTRL, reg);
 
-        if (sky2->rx_pause && !sky2->tx_pause) {
+        if (sky2->flow_status == FC_RX) {
                 /* restore Asymmetric Pause bit */
                 gm_phy_write(hw, port, PHY_MARV_AUNE_ADV,
                              gm_phy_read(hw, port, PHY_MARV_AUNE_ADV)
@@ -1683,6 +1682,14 @@ static void sky2_link_down(struct sky2_port *sky2)
         sky2_phy_init(hw, port);
 }
 
+static enum flow_control sky2_flow(int rx, int tx)
+{
+        if (rx)
+                return tx ? FC_BOTH : FC_RX;
+        else
+                return tx ? FC_TX : FC_NONE;
+}
+
 static int sky2_autoneg_done(struct sky2_port *sky2, u16 aux)
 {
         struct sky2_hw *hw = sky2->hw;
@@ -1703,39 +1710,20 @@ static int sky2_autoneg_done(struct sky2_port *sky2, u16 aux)
         }
 
         sky2->speed = sky2_phy_speed(hw, aux);
-        if (sky2->speed == SPEED_1000) {
-                u16 ctl2 = gm_phy_read(hw, port, PHY_MARV_1000T_CTRL);
-                u16 lpa2 = gm_phy_read(hw, port, PHY_MARV_1000T_STAT);
-                if (lpa2  & PHY_B_1000S_MSF) {
-                        printk(KERN_ERR PFX "%s: master/slave fault",
-                               sky2->netdev->name);
-                        return -1;
-                }
-
-                if ((ctl2 & PHY_M_1000C_AFD) && (lpa2 & PHY_B_1000S_LP_FD))
-                        sky2->duplex = DUPLEX_FULL;
-                else
-                        sky2->duplex = DUPLEX_HALF;
-        } else {
-                u16 adv = gm_phy_read(hw, port, PHY_MARV_AUNE_ADV);
-                if ((aux & adv) & PHY_AN_FULL)
-                        sky2->duplex = DUPLEX_FULL;
-                else
-                        sky2->duplex = DUPLEX_HALF;
-        }
+        sky2->duplex = (aux & PHY_M_PS_FULL_DUP) ? DUPLEX_FULL : DUPLEX_HALF;
 
         /* Pause bits are offset (9..8) */
         if (hw->chip_id == CHIP_ID_YUKON_XL || hw->chip_id == CHIP_ID_YUKON_EC_U)
                 aux >>= 6;
 
-        sky2->rx_pause = (aux & PHY_M_PS_RX_P_EN) != 0;
-        sky2->tx_pause = (aux & PHY_M_PS_TX_P_EN) != 0;
+        sky2->flow_status = sky2_flow(aux & PHY_M_PS_RX_P_EN,
+                                      aux & PHY_M_PS_TX_P_EN);
 
-        if (sky2->duplex == DUPLEX_HALF && sky2->speed != SPEED_1000
+        if (sky2->duplex == DUPLEX_HALF && sky2->speed < SPEED_1000
             && hw->chip_id != CHIP_ID_YUKON_EC_U)
-                sky2->rx_pause = sky2->tx_pause = 0;
+                sky2->flow_status = FC_NONE;
 
-        if (sky2->rx_pause || sky2->tx_pause)
+        if (aux & PHY_M_PS_RX_P_EN)
                 sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_ON);
         else
                 sky2_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
@@ -1750,13 +1738,13 @@ static void sky2_phy_intr(struct sky2_hw *hw, unsigned port)
         struct sky2_port *sky2 = netdev_priv(dev);
         u16 istatus, phystat;
 
+        if (!netif_running(dev))
+                return;
+
         spin_lock(&sky2->phy_lock);
         istatus = gm_phy_read(hw, port, PHY_MARV_INT_STAT);
         phystat = gm_phy_read(hw, port, PHY_MARV_PHY_STAT);
 
-        if (!netif_running(dev))
-                goto out;
-
         if (netif_msg_intr(sky2))
                 printk(KERN_INFO PFX "%s: phy interrupt status 0x%x 0x%x\n",
                        sky2->netdev->name, istatus, phystat);
@@ -1907,7 +1895,7 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
                 pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
                                                length, PCI_DMA_FROMDEVICE);
                 re->skb->ip_summed = CHECKSUM_NONE;
-                __skb_put(skb, length);
+                skb_put(skb, length);
         }
         return skb;
 }
@@ -1970,7 +1958,7 @@ static struct sk_buff *receive_new(struct sky2_port *sky2,
         if (skb_shinfo(skb)->nr_frags)
                 skb_put_frags(skb, hdr_space, length);
         else
-                skb_put(skb, hdr_space);
+                skb_put(skb, length);
         return skb;
 }
 
@@ -2016,6 +2004,10 @@ oversize:
 
 error:
         ++sky2->net_stats.rx_errors;
+        if (status & GMR_FS_RX_FF_OV) {
+                sky2->net_stats.rx_fifo_errors++;
+                goto resubmit;
+        }
 
         if (netif_msg_rx_err(sky2) && net_ratelimit())
                 printk(KERN_INFO PFX "%s: rx error, status 0x%x length %d\n",
@@ -2027,8 +2019,6 @@ error:
                 sky2->net_stats.rx_frame_errors++;
         if (status & GMR_FS_CRC_ERR)
                 sky2->net_stats.rx_crc_errors++;
-        if (status & GMR_FS_RX_FF_OV)
-                sky2->net_stats.rx_fifo_errors++;
 
         goto resubmit;
 }
@@ -2220,8 +2210,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                 /* PCI-Express uncorrectable Error occurred */
                 u32 pex_err;
 
-                pex_err = sky2_pci_read32(hw,
-                                          hw->err_cap + PCI_ERR_UNCOR_STATUS);
+                pex_err = sky2_pci_read32(hw, PEX_UNC_ERR_STAT);
 
                 if (net_ratelimit())
                         printk(KERN_ERR PFX "%s: pci express error (0x%x)\n",
@@ -2229,20 +2218,15 @@ static void sky2_hw_intr(struct sky2_hw *hw)
 
                 /* clear the interrupt */
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                sky2_pci_write32(hw,
-                                 hw->err_cap + PCI_ERR_UNCOR_STATUS,
-                                 0xffffffffUL);
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT,
+                                       0xffffffffUL);
                 sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
 
-
-                /* In case of fatal error mask off to keep from getting stuck */
-                if (pex_err & (PCI_ERR_UNC_POISON_TLP | PCI_ERR_UNC_FCP
-                               | PCI_ERR_UNC_DLP)) {
+                if (pex_err & PEX_FATAL_ERRORS) {
                         u32 hwmsk = sky2_read32(hw, B0_HWE_IMSK);
                         hwmsk &= ~Y2_IS_PCI_EXP;
                         sky2_write32(hw, B0_HWE_IMSK, hwmsk);
                 }
-
         }
 
         if (status & Y2_HWE_L1_MASK)
@@ -2423,7 +2407,6 @@ static int sky2_reset(struct sky2_hw *hw)
         u16 status;
         u8 t8;
         int i;
-        u32 msk;
 
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
 
@@ -2464,13 +2447,9 @@ static int sky2_reset(struct sky2_hw *hw)
         sky2_write8(hw, B0_CTST, CS_MRST_CLR);
 
         /* clear any PEX errors */
-        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP)) {
-                hw->err_cap = pci_find_ext_capability(hw->pdev, PCI_EXT_CAP_ID_ERR);
-                if (hw->err_cap)
-                        sky2_pci_write32(hw,
-                                         hw->err_cap + PCI_ERR_UNCOR_STATUS,
-                                         0xffffffffUL);
-        }
+        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP))
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT, 0xffffffffUL);
+
 
         hw->pmd_type = sky2_read8(hw, B2_PMD_TYP);
         hw->ports = 1;
@@ -2527,10 +2506,7 @@ static int sky2_reset(struct sky2_hw *hw)
                 sky2_write8(hw, RAM_BUFFER(i, B3_RI_RTO_XS2), SK_RI_TO_53);
         }
 
-        msk = Y2_HWE_ALL_MASK;
-        if (!hw->err_cap)
-                msk &= ~Y2_IS_PCI_EXP;
-        sky2_write32(hw, B0_HWE_IMSK, msk);
+        sky2_write32(hw, B0_HWE_IMSK, Y2_HWE_ALL_MASK);
 
         for (i = 0; i < hw->ports; i++)
                 sky2_gmac_reset(hw, i);
@@ -2762,7 +2738,7 @@ static int sky2_nway_reset(struct net_device *dev)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
 
-        if (sky2->autoneg != AUTONEG_ENABLE)
+        if (!netif_running(dev) || sky2->autoneg != AUTONEG_ENABLE)
                 return -EINVAL;
 
         sky2_phy_reinit(sky2);
@@ -2864,6 +2840,14 @@ static int sky2_set_mac_address(struct net_device *dev, void *p)
         return 0;
 }
 
+static void inline sky2_add_filter(u8 filter[8], const u8 *addr)
+{
+        u32 bit;
+
+        bit = ether_crc(ETH_ALEN, addr) & 63;
+        filter[bit >> 3] |= 1 << (bit & 7);
+}
+
 static void sky2_set_multicast(struct net_device *dev)
 {
         struct sky2_port *sky2 = netdev_priv(dev);
@@ -2872,7 +2856,10 @@ static void sky2_set_multicast(struct net_device *dev)
         struct dev_mc_list *list = dev->mc_list;
         u16 reg;
         u8 filter[8];
+        int rx_pause;
+        static const u8 pause_mc_addr[ETH_ALEN] = { 0x1, 0x80, 0xc2, 0x0, 0x0, 0x1 };
 
+        rx_pause = (sky2->flow_status == FC_RX || sky2->flow_status == FC_BOTH);
         memset(filter, 0, sizeof(filter));
 
         reg = gma_read16(hw, port, GM_RX_CTRL);
@@ -2880,18 +2867,19 @@ static void sky2_set_multicast(struct net_device *dev)
 
         if (dev->flags & IFF_PROMISC)   /* promiscuous */
                 reg &= ~(GM_RXCR_UCF_ENA | GM_RXCR_MCF_ENA);
-        else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > 16)     /* all multicast */
+        else if (dev->flags & IFF_ALLMULTI)
                 memset(filter, 0xff, sizeof(filter));
-        else if (dev->mc_count == 0)    /* no multicast */
+        else if (dev->mc_count == 0 && !rx_pause)
                 reg &= ~GM_RXCR_MCF_ENA;
         else {
                 int i;
                 reg |= GM_RXCR_MCF_ENA;
 
-                for (i = 0; list && i < dev->mc_count; i++, list = list->next) {
-                        u32 bit = ether_crc(ETH_ALEN, list->dmi_addr) & 0x3f;
-                        filter[bit / 8] |= 1 << (bit % 8);
-                }
+                if (rx_pause)
+                        sky2_add_filter(filter, pause_mc_addr);
+
+                for (i = 0; list && i < dev->mc_count; i++, list = list->next)
+                        sky2_add_filter(filter, list->dmi_addr);
         }
 
         gma_write16(hw, port, GM_MC_ADDR_H1,
@@ -3004,8 +2992,20 @@ static void sky2_get_pauseparam(struct net_device *dev,
 {
         struct sky2_port *sky2 = netdev_priv(dev);
 
-        ecmd->tx_pause = sky2->tx_pause;
-        ecmd->rx_pause = sky2->rx_pause;
+        switch (sky2->flow_mode) {
+        case FC_NONE:
+                ecmd->tx_pause = ecmd->rx_pause = 0;
+                break;
+        case FC_TX:
+                ecmd->tx_pause = 1, ecmd->rx_pause = 0;
+                break;
+        case FC_RX:
+                ecmd->tx_pause = 0, ecmd->rx_pause = 1;
+                break;
+        case FC_BOTH:
+                ecmd->tx_pause = ecmd->rx_pause = 1;
+        }
+
         ecmd->autoneg = sky2->autoneg;
 }
 
@@ -3015,10 +3015,10 @@ static int sky2_set_pauseparam(struct net_device *dev,
         struct sky2_port *sky2 = netdev_priv(dev);
 
         sky2->autoneg = ecmd->autoneg;
-        sky2->tx_pause = ecmd->tx_pause != 0;
-        sky2->rx_pause = ecmd->rx_pause != 0;
+        sky2->flow_mode = sky2_flow(ecmd->rx_pause, ecmd->tx_pause);
 
-        sky2_phy_reinit(sky2);
+        if (netif_running(dev))
+                sky2_phy_reinit(sky2);
 
         return 0;
 }
@@ -3238,7 +3238,11 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
                 dev->poll = sky2_poll;
         dev->weight = NAPI_WEIGHT;
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = sky2_netpoll;
+        /* Network console (only works on port 0)
+         * because netpoll makes assumptions about NAPI
+         */
+        if (port == 0)
+                dev->poll_controller = sky2_netpoll;
 #endif
 
         sky2 = netdev_priv(dev);
@@ -3248,8 +3252,8 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
 
         /* Auto speed and flow control */
         sky2->autoneg = AUTONEG_ENABLE;
-        sky2->tx_pause = 1;
-        sky2->rx_pause = 1;
+        sky2->flow_mode = FC_BOTH;
+
         sky2->duplex = -1;
         sky2->speed = -1;
         sky2->advertising = sky2_supported_modes(hw);
@@ -3340,9 +3344,8 @@ static int __devinit sky2_test_msi(struct sky2_hw *hw)
 
         if (!hw->msi_detected) {
                 /* MSI test failed, go back to INTx mode */
-                printk(KERN_WARNING PFX "%s: No interrupt was generated using MSI, "
-                       "switching to INTx mode. Please report this failure to "
-                       "the PCI maintainer and include system chipset information.\n",
+                printk(KERN_INFO PFX "%s: No interrupt generated using MSI, "
+                       "switching to INTx mode.\n",
                        pci_name(pdev));
 
                 err = -EOPNOTSUPP;
@@ -3350,6 +3353,7 @@ static int __devinit sky2_test_msi(struct sky2_hw *hw)
         }
 
         sky2_write32(hw, B0_IMSK, 0);
+        sky2_read32(hw, B0_IMSK);
 
         free_irq(pdev->irq, hw);
 
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index f66109a96d95..6d2a23f66c9a 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -6,15 +6,24 @@
 
 #define ETH_JUMBO_MTU           9000    /* Maximum MTU supported */
 
-/* PCI device specific config registers */
+/* PCI config registers */
 enum {
         PCI_DEV_REG1    = 0x40,
         PCI_DEV_REG2    = 0x44,
+        PCI_DEV_STATUS  = 0x7c,
         PCI_DEV_REG3    = 0x80,
         PCI_DEV_REG4    = 0x84,
         PCI_DEV_REG5    = 0x88,
 };
 
+enum {
+        PEX_DEV_CAP     = 0xe4,
+        PEX_DEV_CTRL    = 0xe8,
+        PEX_DEV_STA     = 0xea,
+        PEX_LNK_STAT    = 0xf2,
+        PEX_UNC_ERR_STAT= 0x104,
+};
+
 /* Yukon-2 */
 enum pci_dev_reg_1 {
         PCI_Y2_PIG_ENA   = 1<<31, /* Enable Plug-in-Go (YUKON-2) */
@@ -63,6 +72,39 @@ enum pci_dev_reg_4 {
                                PCI_STATUS_REC_MASTER_ABORT | \
                                PCI_STATUS_REC_TARGET_ABORT | \
                                PCI_STATUS_PARITY)
+
+enum pex_dev_ctrl {
+        PEX_DC_MAX_RRS_MSK      = 7<<12, /* Bit 14..12: Max. Read Request Size */
+        PEX_DC_EN_NO_SNOOP      = 1<<11,/* Enable No Snoop */
+        PEX_DC_EN_AUX_POW       = 1<<10,/* Enable AUX Power */
+        PEX_DC_EN_PHANTOM       = 1<<9, /* Enable Phantom Functions */
+        PEX_DC_EN_EXT_TAG       = 1<<8, /* Enable Extended Tag Field */
+        PEX_DC_MAX_PLS_MSK      = 7<<5, /* Bit  7.. 5:  Max. Payload Size Mask */
+        PEX_DC_EN_REL_ORD       = 1<<4, /* Enable Relaxed Ordering */
+        PEX_DC_EN_UNS_RQ_RP     = 1<<3, /* Enable Unsupported Request Reporting */
+        PEX_DC_EN_FAT_ER_RP     = 1<<2, /* Enable Fatal Error Reporting */
+        PEX_DC_EN_NFA_ER_RP     = 1<<1, /* Enable Non-Fatal Error Reporting */
+        PEX_DC_EN_COR_ER_RP     = 1<<0, /* Enable Correctable Error Reporting */
+};
+#define  PEX_DC_MAX_RD_RQ_SIZE(x) (((x)<<12) & PEX_DC_MAX_RRS_MSK)
+
+/* PEX_UNC_ERR_STAT      PEX Uncorrectable Errors Status Register (Yukon-2) */
+enum pex_err {
+        PEX_UNSUP_REQ   = 1<<20, /* Unsupported Request Error */
+
+        PEX_MALFOR_TLP  = 1<<18, /* Malformed TLP */
+
+        PEX_UNEXP_COMP  = 1<<16, /* Unexpected Completion */
+
+        PEX_COMP_TO     = 1<<14, /* Completion Timeout */
+        PEX_FLOW_CTRL_P = 1<<13, /* Flow Control Protocol Error */
+        PEX_POIS_TLP    = 1<<12, /* Poisoned TLP */
+
+        PEX_DATA_LINK_P = 1<<4, /* Data Link Protocol Error */
+        PEX_FATAL_ERRORS= (PEX_MALFOR_TLP | PEX_FLOW_CTRL_P | PEX_DATA_LINK_P),
+};
+
+
 enum csr_regs {
         B0_RAP          = 0x0000,
         B0_CTST         = 0x0004,
@@ -1534,7 +1576,7 @@ enum {
 
         GMR_FS_ANY_ERR  = GMR_FS_RX_FF_OV | GMR_FS_CRC_ERR |
                           GMR_FS_FRAGMENT | GMR_FS_LONG_ERR |
-                          GMR_FS_MII_ERR | GMR_FS_BAD_FC |
+                          GMR_FS_MII_ERR | GMR_FS_GOOD_FC | GMR_FS_BAD_FC |
                           GMR_FS_UN_SIZE | GMR_FS_JABBER,
 };
 
@@ -1786,6 +1828,13 @@ struct rx_ring_info {
         dma_addr_t      frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
 };
 
+enum flow_control {
+        FC_NONE = 0,
+        FC_TX   = 1,
+        FC_RX   = 2,
+        FC_BOTH = 3,
+};
+
 struct sky2_port {
         struct sky2_hw       *hw;
         struct net_device    *netdev;
@@ -1818,13 +1867,13 @@ struct sky2_port {
 
         dma_addr_t           rx_le_map;
         dma_addr_t           tx_le_map;
-        u32                  advertising;       /* ADVERTISED_ bits */
+        u16                  advertising;       /* ADVERTISED_ bits */
         u16                  speed;     /* SPEED_1000, SPEED_100, ... */
         u8                   autoneg;   /* AUTONEG_ENABLE, AUTONEG_DISABLE */
         u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
-        u8                   rx_pause;
-        u8                   tx_pause;
         u8                   rx_csum;
+        enum flow_control    flow_mode;
+        enum flow_control    flow_status;
 
         struct net_device_stats net_stats;
 
@@ -1836,7 +1885,6 @@ struct sky2_hw {
         struct net_device    *dev[2];
 
         int                  pm_cap;
-        int                  err_cap;
         u8                   chip_id;
         u8                   chip_rev;
         u8                   pmd_type;
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 636dbfcdf8cb..a8640169fc77 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -398,6 +398,42 @@ static inline void LPD7_SMC_outsw (unsigned char* a, int r,
 
 #define SMC_IRQ_FLAGS           (0)
 
+#elif   defined(CONFIG_ARCH_VERSATILE)
+
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       1
+#define SMC_NOWAIT              1
+
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inl(a, r)           readl((a) + (r))
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
+#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+
+#define SMC_IRQ_FLAGS           (0)
+
+#elif   defined(CONFIG_ARCH_VERSATILE)
+
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       1
+#define SMC_NOWAIT              1
+
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inl(a, r)           readl((a) + (r))
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
+#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+
+#define SMC_IRQ_FLAGS           (0)
+
 #else
 
 #define SMC_CAN_USE_8BIT        1
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 46a009085f7c..418138dd6c68 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -55,12 +55,13 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher@de.ibm.com> and Jens Osterkamp " \
               "<Jens.Osterkamp@de.ibm.com>");
 MODULE_DESCRIPTION("Spider Southbridge Gigabit Ethernet driver");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(VERSION);
 
 static int rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_DEFAULT;
 static int tx_descriptors = SPIDER_NET_TX_DESCRIPTORS_DEFAULT;
 
-module_param(rx_descriptors, int, 0644);
-module_param(tx_descriptors, int, 0644);
+module_param(rx_descriptors, int, 0444);
+module_param(tx_descriptors, int, 0444);
 
 MODULE_PARM_DESC(rx_descriptors, "number of descriptors used " \
                  "in rx chains");
@@ -300,7 +301,7 @@ static int
 spider_net_init_chain(struct spider_net_card *card,
                        struct spider_net_descr_chain *chain,
                        struct spider_net_descr *start_descr,
-                       int direction, int no)
+                       int no)
 {
         int i;
         struct spider_net_descr *descr;
@@ -315,7 +316,7 @@ spider_net_init_chain(struct spider_net_card *card,
 
                 buf = pci_map_single(card->pdev, descr,
                                      SPIDER_NET_DESCR_SIZE,
-                                     direction);
+                                     PCI_DMA_BIDIRECTIONAL);
 
                 if (pci_dma_mapping_error(buf))
                         goto iommu_error;
@@ -329,11 +330,6 @@ spider_net_init_chain(struct spider_net_card *card,
         (descr-1)->next = start_descr;
         start_descr->prev = descr-1;
 
-        descr = start_descr;
-        if (direction == PCI_DMA_FROMDEVICE)
-                for (i=0; i < no; i++, descr++)
-                        descr->next_descr_addr = descr->next->bus_addr;
-
         spin_lock_init(&chain->lock);
         chain->head = start_descr;
         chain->tail = start_descr;
@@ -346,7 +342,7 @@ iommu_error:
                 if (descr->bus_addr)
                         pci_unmap_single(card->pdev, descr->bus_addr,
                                          SPIDER_NET_DESCR_SIZE,
-                                         direction);
+                                         PCI_DMA_BIDIRECTIONAL);
         return -ENOMEM;
 }
 
@@ -362,15 +358,15 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
         struct spider_net_descr *descr;
 
         descr = card->rx_chain.head;
-        while (descr->next != card->rx_chain.head) {
+        do {
                 if (descr->skb) {
                         dev_kfree_skb(descr->skb);
                         pci_unmap_single(card->pdev, descr->buf_addr,
                                          SPIDER_NET_MAX_FRAME,
-                                         PCI_DMA_FROMDEVICE);
+                                         PCI_DMA_BIDIRECTIONAL);
                 }
                 descr = descr->next;
-        }
+        } while (descr != card->rx_chain.head);
 }
 
 /**
@@ -645,26 +641,41 @@ static int
 spider_net_prepare_tx_descr(struct spider_net_card *card,
                             struct sk_buff *skb)
 {
-        struct spider_net_descr *descr = card->tx_chain.head;
+        struct spider_net_descr *descr;
         dma_addr_t buf;
+        unsigned long flags;
+        int length;
 
-        buf = pci_map_single(card->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
+        length = skb->len;
+        if (length < ETH_ZLEN) {
+                if (skb_pad(skb, ETH_ZLEN-length))
+                        return 0;
+                length = ETH_ZLEN;
+        }
+
+        buf = pci_map_single(card->pdev, skb->data, length, PCI_DMA_TODEVICE);
         if (pci_dma_mapping_error(buf)) {
                 if (netif_msg_tx_err(card) && net_ratelimit())
                         pr_err("could not iommu-map packet (%p, %i). "
-                                  "Dropping packet\n", skb->data, skb->len);
+                                  "Dropping packet\n", skb->data, length);
                 card->spider_stats.tx_iommu_map_error++;
                 return -ENOMEM;
         }
 
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
+        descr = card->tx_chain.head;
+        card->tx_chain.head = descr->next;
+
         descr->buf_addr = buf;
-        descr->buf_size = skb->len;
+        descr->buf_size = length;
         descr->next_descr_addr = 0;
         descr->skb = skb;
         descr->data_status = 0;
 
         descr->dmac_cmd_status =
                         SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
+
         if (skb->protocol == htons(ETH_P_IP))
                 switch (skb->nh.iph->protocol) {
                 case IPPROTO_TCP:
@@ -675,32 +686,51 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
                         break;
                 }
 
+        /* Chain the bus address, so that the DMA engine finds this descr. */
         descr->prev->next_descr_addr = descr->bus_addr;
 
+        card->netdev->trans_start = jiffies; /* set netdev watchdog timer */
         return 0;
 }
 
-/**
- * spider_net_release_tx_descr - processes a used tx descriptor
- * @card: card structure
- * @descr: descriptor to release
- *
- * releases a used tx descriptor (unmapping, freeing of skb)
- */
-static inline void
-spider_net_release_tx_descr(struct spider_net_card *card)
+static int
+spider_net_set_low_watermark(struct spider_net_card *card)
 {
+        unsigned long flags;
+        int status;
+        int cnt=0;
+        int i;
         struct spider_net_descr *descr = card->tx_chain.tail;
-        struct sk_buff *skb;
 
-        card->tx_chain.tail = card->tx_chain.tail->next;
-        descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+        /* Measure the length of the queue. Measurement does not
+         * need to be precise -- does not need a lock. */
+        while (descr != card->tx_chain.head) {
+                status = descr->dmac_cmd_status & SPIDER_NET_DESCR_NOT_IN_USE;
+                if (status == SPIDER_NET_DESCR_NOT_IN_USE)
+                        break;
+                descr = descr->next;
+                cnt++;
+        }
 
-        /* unmap the skb */
-        skb = descr->skb;
-        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
-                        PCI_DMA_TODEVICE);
-        dev_kfree_skb_any(skb);
+        /* If TX queue is short, don't even bother with interrupts */
+        if (cnt < card->num_tx_desc/4)
+                return cnt;
+
+        /* Set low-watermark 3/4th's of the way into the queue. */
+        descr = card->tx_chain.tail;
+        cnt = (cnt*3)/4;
+        for (i=0;i<cnt; i++)
+                descr = descr->next;
+
+        /* Set the new watermark, clear the old watermark */
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
+        descr->dmac_cmd_status |= SPIDER_NET_DESCR_TXDESFLG;
+        if (card->low_watermark && card->low_watermark != descr)
+                card->low_watermark->dmac_cmd_status =
+                     card->low_watermark->dmac_cmd_status & ~SPIDER_NET_DESCR_TXDESFLG;
+        card->low_watermark = descr;
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
+        return cnt;
 }
 
 /**
@@ -719,21 +749,29 @@ static int
 spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
 {
         struct spider_net_descr_chain *chain = &card->tx_chain;
+        struct spider_net_descr *descr;
+        struct sk_buff *skb;
+        u32 buf_addr;
+        unsigned long flags;
         int status;
 
-        spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR);
-
         while (chain->tail != chain->head) {
-                status = spider_net_get_descr_status(chain->tail);
+                spin_lock_irqsave(&chain->lock, flags);
+                descr = chain->tail;
+
+                status = spider_net_get_descr_status(descr);
                 switch (status) {
                 case SPIDER_NET_DESCR_COMPLETE:
                         card->netdev_stats.tx_packets++;
-                        card->netdev_stats.tx_bytes += chain->tail->skb->len;
+                        card->netdev_stats.tx_bytes += descr->skb->len;
                         break;
 
                 case SPIDER_NET_DESCR_CARDOWNED:
-                        if (!brutal)
+                        if (!brutal) {
+                                spin_unlock_irqrestore(&chain->lock, flags);
                                 return 1;
+                        }
+
                         /* fallthrough, if we release the descriptors
                          * brutally (then we don't care about
                          * SPIDER_NET_DESCR_CARDOWNED) */
@@ -750,11 +788,25 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
 
                 default:
                         card->netdev_stats.tx_dropped++;
-                        return 1;
+                        if (!brutal) {
+                                spin_unlock_irqrestore(&chain->lock, flags);
+                                return 1;
+                        }
                 }
-                spider_net_release_tx_descr(card);
-        }
 
+                chain->tail = descr->next;
+                descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+                skb = descr->skb;
+                buf_addr = descr->buf_addr;
+                spin_unlock_irqrestore(&chain->lock, flags);
+
+                /* unmap the skb */
+                if (skb) {
+                        int len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+                        pci_unmap_single(card->pdev, buf_addr, len, PCI_DMA_TODEVICE);
+                        dev_kfree_skb(skb);
+                }
+        }
         return 0;
 }
 
@@ -763,8 +815,12 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
  * @card: card structure
  * @descr: descriptor address to enable TX processing at
  *
- * spider_net_kick_tx_dma writes the current tx chain head as start address
- * of the tx descriptor chain and enables the transmission DMA engine
+ * This routine will start the transmit DMA running if
+ * it is not already running. This routine ned only be
+ * called when queueing a new packet to an empty tx queue.
+ * Writes the current tx chain head as start address
+ * of the tx descriptor chain and enables the transmission
+ * DMA engine.
  */
 static inline void
 spider_net_kick_tx_dma(struct spider_net_card *card)
@@ -804,65 +860,43 @@ out:
 static int
 spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
+        int cnt;
         struct spider_net_card *card = netdev_priv(netdev);
         struct spider_net_descr_chain *chain = &card->tx_chain;
-        struct spider_net_descr *descr = chain->head;
-        unsigned long flags;
-        int result;
-
-        spin_lock_irqsave(&chain->lock, flags);
 
         spider_net_release_tx_chain(card, 0);
 
-        if (chain->head->next == chain->tail->prev) {
-                card->netdev_stats.tx_dropped++;
-                result = NETDEV_TX_LOCKED;
-                goto out;
-        }
+        if ((chain->head->next == chain->tail->prev) ||
+           (spider_net_prepare_tx_descr(card, skb) != 0)) {
 
-        if (spider_net_get_descr_status(descr) != SPIDER_NET_DESCR_NOT_IN_USE) {
                 card->netdev_stats.tx_dropped++;
-                result = NETDEV_TX_LOCKED;
-                goto out;
+                netif_stop_queue(netdev);
+                return NETDEV_TX_BUSY;
         }
 
-        if (spider_net_prepare_tx_descr(card, skb) != 0) {
-                card->netdev_stats.tx_dropped++;
-                result = NETDEV_TX_BUSY;
-                goto out;
-        }
-
-        result = NETDEV_TX_OK;
-
-        spider_net_kick_tx_dma(card);
-        card->tx_chain.head = card->tx_chain.head->next;
-
-out:
-        spin_unlock_irqrestore(&chain->lock, flags);
-        netif_wake_queue(netdev);
-        return result;
+        cnt = spider_net_set_low_watermark(card);
+        if (cnt < 5)
+                spider_net_kick_tx_dma(card);
+        return NETDEV_TX_OK;
 }
 
 /**
  * spider_net_cleanup_tx_ring - cleans up the TX ring
  * @card: card structure
  *
- * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
- * interrupts to cleanup our TX ring) and returns sent packets to the stack
- * by freeing them
+ * spider_net_cleanup_tx_ring is called by either the tx_timer
+ * or from the NAPI polling routine.
+ * This routine releases resources associted with transmitted
+ * packets, including updating the queue tail pointer.
  */
 static void
 spider_net_cleanup_tx_ring(struct spider_net_card *card)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&card->tx_chain.lock, flags);
-
         if ((spider_net_release_tx_chain(card, 0) != 0) &&
-            (card->netdev->flags & IFF_UP))
+            (card->netdev->flags & IFF_UP)) {
                 spider_net_kick_tx_dma(card);
-
-        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
+                netif_wake_queue(card->netdev);
+        }
 }
 
 /**
@@ -1053,6 +1087,7 @@ spider_net_poll(struct net_device *netdev, int *budget)
         int packets_to_do, packets_done = 0;
         int no_more_packets = 0;
 
+        spider_net_cleanup_tx_ring(card);
         packets_to_do = min(*budget, netdev->quota);
 
         while (packets_to_do) {
@@ -1243,12 +1278,15 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
         case SPIDER_NET_PHYINT:
         case SPIDER_NET_GMAC2INT:
         case SPIDER_NET_GMAC1INT:
-        case SPIDER_NET_GIPSINT:
         case SPIDER_NET_GFIFOINT:
         case SPIDER_NET_DMACINT:
         case SPIDER_NET_GSYSINT:
                 break; */
 
+        case SPIDER_NET_GIPSINT:
+                show_error = 0;
+                break;
+
         case SPIDER_NET_GPWOPCMPINT:
                 /* PHY write operation completed */
                 show_error = 0;
@@ -1307,9 +1345,10 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
         case SPIDER_NET_GDTDCEINT:
                 /* chain end. If a descriptor should be sent, kick off
                  * tx dma
-                if (card->tx_chain.tail == card->tx_chain.head)
+                if (card->tx_chain.tail != card->tx_chain.head)
                         spider_net_kick_tx_dma(card);
-                show_error = 0; */
+                */
+                show_error = 0;
                 break;
 
         /* case SPIDER_NET_G1TMCNTINT: not used. print a message */
@@ -1354,7 +1393,7 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
                 if (netif_msg_intr(card))
                         pr_err("got descriptor chain end interrupt, "
                                "restarting DMAC %c.\n",
-                               'D'+i-SPIDER_NET_GDDDCEINT);
+                               'D'-(i-SPIDER_NET_GDDDCEINT)/3);
                 spider_net_refill_rx_chain(card);
                 spider_net_enable_rxdmac(card);
                 show_error = 0;
@@ -1423,8 +1462,9 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
         }
 
         if ((show_error) && (netif_msg_intr(card)))
-                pr_err("Got error interrupt, GHIINT0STS = 0x%08x, "
+                pr_err("Got error interrupt on %s, GHIINT0STS = 0x%08x, "
                        "GHIINT1STS = 0x%08x, GHIINT2STS = 0x%08x\n",
+                       card->netdev->name,
                        status_reg, error_reg1, error_reg2);
 
         /* clear interrupt sources */
@@ -1460,6 +1500,8 @@ spider_net_interrupt(int irq, void *ptr)
                 spider_net_rx_irq_off(card);
                 netif_rx_schedule(netdev);
         }
+        if (status_reg & SPIDER_NET_TXINT)
+                netif_rx_schedule(netdev);
 
         if (status_reg & SPIDER_NET_ERRINT )
                 spider_net_handle_error_irq(card, status_reg);
@@ -1599,7 +1641,7 @@ spider_net_enable_card(struct spider_net_card *card)
                              SPIDER_NET_INT2_MASK_VALUE);
 
         spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_GDTDCEIDIS);
+                             SPIDER_NET_GDTBSTA | SPIDER_NET_GDTDCEIDIS);
 }
 
 /**
@@ -1615,17 +1657,26 @@ int
 spider_net_open(struct net_device *netdev)
 {
         struct spider_net_card *card = netdev_priv(netdev);
-        int result;
+        struct spider_net_descr *descr;
+        int i, result;
 
         result = -ENOMEM;
         if (spider_net_init_chain(card, &card->tx_chain, card->descr,
-                        PCI_DMA_TODEVICE, card->tx_desc))
+                                  card->num_tx_desc))
                 goto alloc_tx_failed;
+
+        card->low_watermark = NULL;
+
+        /* rx_chain is after tx_chain, so offset is descr + tx_count */
         if (spider_net_init_chain(card, &card->rx_chain,
-                        card->descr + card->rx_desc,
-                        PCI_DMA_FROMDEVICE, card->rx_desc))
+                                  card->descr + card->num_tx_desc,
+                                  card->num_rx_desc))
                 goto alloc_rx_failed;
 
+        descr = card->rx_chain.head;
+        for (i=0; i < card->num_rx_desc; i++, descr++)
+                descr->next_descr_addr = descr->next->bus_addr;
+
         /* allocate rx skbs */
         if (spider_net_alloc_rx_skbs(card))
                 goto alloc_skbs_failed;
@@ -1878,10 +1929,7 @@ spider_net_stop(struct net_device *netdev)
         spider_net_disable_rxdmac(card);
 
         /* release chains */
-        if (spin_trylock(&card->tx_chain.lock)) {
-                spider_net_release_tx_chain(card, 1);
-                spin_unlock(&card->tx_chain.lock);
-        }
+        spider_net_release_tx_chain(card, 1);
 
         spider_net_free_chain(card, &card->tx_chain);
         spider_net_free_chain(card, &card->rx_chain);
@@ -2012,8 +2060,8 @@ spider_net_setup_netdev(struct spider_net_card *card)
 
         card->options.rx_csum = SPIDER_NET_RX_CSUM_DEFAULT;
 
-        card->tx_desc = tx_descriptors;
-        card->rx_desc = rx_descriptors;
+        card->num_tx_desc = tx_descriptors;
+        card->num_rx_desc = rx_descriptors;
 
         spider_net_setup_netdev_ops(netdev);
 
@@ -2252,6 +2300,8 @@ static struct pci_driver spider_net_driver = {
  */
 static int __init spider_net_init(void)
 {
+        printk(KERN_INFO "Spidernet version %s.\n", VERSION);
+
         if (rx_descriptors < SPIDER_NET_RX_DESCRIPTORS_MIN) {
                 rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_MIN;
                 pr_info("adjusting rx descriptors to %i.\n", rx_descriptors);
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index a59deda2f95e..b3b46119b424 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -24,6 +24,8 @@
 #ifndef _SPIDER_NET_H
 #define _SPIDER_NET_H
 
+#define VERSION "1.1 A"
+
 #include "sungem_phy.h"
 
 extern int spider_net_stop(struct net_device *netdev);
@@ -47,7 +49,7 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_TX_DESCRIPTORS_MIN           16
 #define SPIDER_NET_TX_DESCRIPTORS_MAX           512
 
-#define SPIDER_NET_TX_TIMER                     20
+#define SPIDER_NET_TX_TIMER                     (HZ/5)
 
 #define SPIDER_NET_RX_CSUM_DEFAULT              1
 
@@ -189,7 +191,9 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_MACMODE_VALUE        0x00000001
 #define SPIDER_NET_BURSTLMT_VALUE       0x00000200 /* about 16 us */
 
-/* 1(0)                                 enable r/tx dma
+/* DMAC control register GDMACCNTR
+ *
+ * 1(0)                         enable r/tx dma
  *  0000000                             fixed to 0
  *
  *         000000                       fixed to 0
@@ -198,6 +202,7 @@ extern char spider_net_driver_name[];
  *
  *                 000000               fixed to 0
  *                       00             burst alignment: 128 bytes
+ *                       11             burst alignment: 1024 bytes
  *
  *                         00000        fixed to 0
  *                              0       descr writeback size 32 bytes
@@ -208,10 +213,13 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_DMA_RX_VALUE         0x80000000
 #define SPIDER_NET_DMA_RX_FEND_VALUE    0x00030003
 /* to set TX_DMA_EN */
-#define SPIDER_NET_TX_DMA_EN            0x80000000
-#define SPIDER_NET_GDTDCEIDIS           0x00000002
-#define SPIDER_NET_DMA_TX_VALUE         SPIDER_NET_TX_DMA_EN | \
-                                        SPIDER_NET_GDTDCEIDIS
+#define SPIDER_NET_TX_DMA_EN           0x80000000
+#define SPIDER_NET_GDTBSTA             0x00000300
+#define SPIDER_NET_GDTDCEIDIS          0x00000002
+#define SPIDER_NET_DMA_TX_VALUE        SPIDER_NET_TX_DMA_EN | \
+                                       SPIDER_NET_GDTBSTA | \
+                                       SPIDER_NET_GDTDCEIDIS
+
 #define SPIDER_NET_DMA_TX_FEND_VALUE    0x00030003
 
 /* SPIDER_NET_UA_DESCR_VALUE is OR'ed with the unicast address */
@@ -320,13 +328,10 @@ enum spider_net_int2_status {
         SPIDER_NET_GRISPDNGINT
 };
 
-#define SPIDER_NET_TXINT        ( (1 << SPIDER_NET_GTTEDINT) | \
-                                  (1 << SPIDER_NET_GDTDCEINT) | \
-                                  (1 << SPIDER_NET_GDTFDCINT) )
+#define SPIDER_NET_TXINT        ( (1 << SPIDER_NET_GDTFDCINT) )
 
-/* we rely on flagged descriptor interrupts*/
-#define SPIDER_NET_RXINT        ( (1 << SPIDER_NET_GDAFDCINT) | \
-                                  (1 << SPIDER_NET_GRMFLLINT) )
+/* We rely on flagged descriptor interrupts */
+#define SPIDER_NET_RXINT        ( (1 << SPIDER_NET_GDAFDCINT) )
 
 #define SPIDER_NET_ERRINT       ( 0xffffffff & \
                                   (~SPIDER_NET_TXINT) & \
@@ -349,6 +354,7 @@ enum spider_net_int2_status {
 #define SPIDER_NET_DESCR_FORCE_END              0x50000000 /* used in rx and tx */
 #define SPIDER_NET_DESCR_CARDOWNED              0xA0000000 /* used in rx and tx */
 #define SPIDER_NET_DESCR_NOT_IN_USE             0xF0000000
+#define SPIDER_NET_DESCR_TXDESFLG               0x00800000
 
 struct spider_net_descr {
         /* as defined by the hardware */
@@ -433,6 +439,7 @@ struct spider_net_card {
 
         struct spider_net_descr_chain tx_chain;
         struct spider_net_descr_chain rx_chain;
+        struct spider_net_descr *low_watermark;
 
         struct net_device_stats netdev_stats;
 
@@ -448,8 +455,8 @@ struct spider_net_card {
 
         /* for ethtool */
         int msg_enable;
-        int rx_desc;
-        int tx_desc;
+        int num_rx_desc;
+        int num_tx_desc;
         struct spider_net_extra_stats spider_stats;
 
         struct spider_net_descr descr[0];
diff --git a/drivers/net/spider_net_ethtool.c b/drivers/net/spider_net_ethtool.c
index 589e43658dee..91b995102915 100644
--- a/drivers/net/spider_net_ethtool.c
+++ b/drivers/net/spider_net_ethtool.c
@@ -76,7 +76,7 @@ spider_net_ethtool_get_drvinfo(struct net_device *netdev,
         /* clear and fill out info */
         memset(drvinfo, 0, sizeof(struct ethtool_drvinfo));
         strncpy(drvinfo->driver, spider_net_driver_name, 32);
-        strncpy(drvinfo->version, "0.1", 32);
+        strncpy(drvinfo->version, VERSION, 32);
         strcpy(drvinfo->fw_version, "no information");
         strncpy(drvinfo->bus_info, pci_name(card->pdev), 32);
 }
@@ -158,9 +158,9 @@ spider_net_ethtool_get_ringparam(struct net_device *netdev,
         struct spider_net_card *card = netdev->priv;
 
         ering->tx_max_pending = SPIDER_NET_TX_DESCRIPTORS_MAX;
-        ering->tx_pending = card->tx_desc;
+        ering->tx_pending = card->num_tx_desc;
         ering->rx_max_pending = SPIDER_NET_RX_DESCRIPTORS_MAX;
-        ering->rx_pending = card->rx_desc;
+        ering->rx_pending = card->num_rx_desc;
 }
 
 static int spider_net_get_stats_count(struct net_device *netdev)
diff --git a/drivers/net/sun3_82586.c b/drivers/net/sun3_82586.c
index d1d1885b0295..a3220a96524f 100644
--- a/drivers/net/sun3_82586.c
+++ b/drivers/net/sun3_82586.c
@@ -330,7 +330,7 @@ out2:
 out1:
         free_netdev(dev);
 out:
-        iounmap((void *)ioaddr);
+        iounmap((void __iomem *)ioaddr);
         return ERR_PTR(err);
 }
 
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 91c76544e4dd..b865db363ba0 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -286,7 +286,7 @@ struct net_device * __init sun3lance_probe(int unit)
 
 out1:
 #ifdef CONFIG_SUN3
-        iounmap((void *)dev->base_addr);
+        iounmap((void __iomem *)dev->base_addr);
 #endif
 out:
         free_netdev(dev);
@@ -326,7 +326,7 @@ static int __init lance_probe( struct net_device *dev)
                 ioaddr_probe[1] = tmp2;
 
 #ifdef CONFIG_SUN3
-                iounmap((void *)ioaddr);
+                iounmap((void __iomem *)ioaddr);
 #endif
                 return 0;
         }
@@ -956,7 +956,7 @@ void cleanup_module(void)
 {
         unregister_netdev(sun3lance_dev);
 #ifdef CONFIG_SUN3
-        iounmap((void *)sun3lance_dev->base_addr);
+        iounmap((void __iomem *)sun3lance_dev->base_addr);
 #endif
         free_netdev(sun3lance_dev);
 }
diff --git a/drivers/net/sunbmac.c b/drivers/net/sunbmac.c
index 6439b0cef1e4..18f88853e1e5 100644
--- a/drivers/net/sunbmac.c
+++ b/drivers/net/sunbmac.c
@@ -42,7 +42,7 @@
 #define DRV_RELDATE     "11/24/03"
 #define DRV_AUTHOR      "David S. Miller (davem@redhat.com)"
 
-static char version[] __initdata =
+static char version[] =
         DRV_NAME ".c:v" DRV_VERSION " " DRV_RELDATE " " DRV_AUTHOR "\n";
 
 MODULE_VERSION(DRV_VERSION);
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 327836b1014e..c20bb998e0e5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -68,8 +68,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.66"
-#define DRV_MODULE_RELDATE      "September 23, 2006"
+#define DRV_MODULE_VERSION      "3.69"
+#define DRV_MODULE_RELDATE      "November 15, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -129,7 +129,7 @@
 #define RX_JUMBO_PKT_BUF_SZ     (9046 + tp->rx_offset + 64)
 
 /* minimum number of free TX descriptors required to wake up TX process */
-#define TG3_TX_WAKEUP_THRESH            (TG3_TX_RING_SIZE / 4)
+#define TG3_TX_WAKEUP_THRESH(tp)                ((tp)->tx_pending / 4)
 
 /* number of ETHTOOL_GSTATS u64's */
 #define TG3_NUM_STATS           (sizeof(struct tg3_ethtool_stats)/sizeof(u64))
@@ -3075,10 +3075,10 @@ static void tg3_tx(struct tg3 *tp)
         smp_mb();
 
         if (unlikely(netif_queue_stopped(tp->dev) &&
-                     (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))) {
+                     (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH(tp)))) {
                 netif_tx_lock(tp->dev);
                 if (netif_queue_stopped(tp->dev) &&
-                    (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH))
+                    (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH(tp)))
                         netif_wake_queue(tp->dev);
                 netif_tx_unlock(tp->dev);
         }
@@ -3928,7 +3928,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tp->tx_prod = entry;
         if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH(tp))
                         netif_wake_queue(tp->dev);
         }
 
@@ -4143,7 +4143,7 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev)
         tp->tx_prod = entry;
         if (unlikely(tg3_tx_avail(tp) <= (MAX_SKB_FRAGS + 1))) {
                 netif_stop_queue(dev);
-                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH)
+                if (tg3_tx_avail(tp) > TG3_TX_WAKEUP_THRESH(tp))
                         netif_wake_queue(tp->dev);
         }
 
@@ -4728,10 +4728,11 @@ static int tg3_poll_fw(struct tg3 *tp)
         u32 val;
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
-                for (i = 0; i < 400; i++) {
+                /* Wait up to 20ms for init done. */
+                for (i = 0; i < 200; i++) {
                         if (tr32(VCPU_STATUS) & VCPU_STATUS_INIT_DONE)
                                 return 0;
-                        udelay(10);
+                        udelay(100);
                 }
                 return -ENODEV;
         }
@@ -6014,7 +6015,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 tg3_abort_hw(tp, 1);
         }
 
-        if ((tp->tg3_flags2 & TG3_FLG2_MII_SERDES) && reset_phy)
+        if (reset_phy)
                 tg3_phy_reset(tp);
 
         err = tg3_chip_reset(tp);
@@ -6574,7 +6575,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 tw32(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
         }
 
-        err = tg3_setup_phy(tp, reset_phy);
+        err = tg3_setup_phy(tp, 0);
         if (err)
                 return err;
 
@@ -6978,8 +6979,10 @@ static int tg3_open(struct net_device *dev)
         tg3_full_lock(tp, 0);
 
         err = tg3_set_power_state(tp, PCI_D0);
-        if (err)
+        if (err) {
+                tg3_full_unlock(tp);
                 return err;
+        }
 
         tg3_disable_ints(tp);
         tp->tg3_flags &= ~TG3_FLAG_INIT_COMPLETE;
@@ -8106,7 +8109,10 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if ((ering->rx_pending > TG3_RX_RING_SIZE - 1) ||
             (ering->rx_jumbo_pending > TG3_RX_JUMBO_RING_SIZE - 1) ||
-            (ering->tx_pending > TG3_TX_RING_SIZE - 1))
+            (ering->tx_pending > TG3_TX_RING_SIZE - 1) ||
+            (ering->tx_pending <= MAX_SKB_FRAGS) ||
+            ((tp->tg3_flags2 & TG3_FLG2_HW_TSO_1_BUG) &&
+             (ering->tx_pending <= (MAX_SKB_FRAGS * 3))))
                 return -EINVAL;
 
         if (netif_running(dev)) {
@@ -10209,7 +10215,7 @@ skip_phy_reset:
 static void __devinit tg3_read_partno(struct tg3 *tp)
 {
         unsigned char vpd_data[256];
-        int i;
+        unsigned int i;
         u32 magic;
 
         if (tg3_nvram_read_swab(tp, 0x0, &magic))
@@ -10255,9 +10261,9 @@ static void __devinit tg3_read_partno(struct tg3 *tp)
         }
 
         /* Now parse and find the part number. */
-        for (i = 0; i < 256; ) {
+        for (i = 0; i < 254; ) {
                 unsigned char val = vpd_data[i];
-                int block_end;
+                unsigned int block_end;
 
                 if (val == 0x82 || val == 0x91) {
                         i = (i + 3 +
@@ -10273,21 +10279,26 @@ static void __devinit tg3_read_partno(struct tg3 *tp)
                              (vpd_data[i + 1] +
                               (vpd_data[i + 2] << 8)));
                 i += 3;
-                while (i < block_end) {
+
+                if (block_end > 256)
+                        goto out_not_found;
+
+                while (i < (block_end - 2)) {
                         if (vpd_data[i + 0] == 'P' &&
                             vpd_data[i + 1] == 'N') {
                                 int partno_len = vpd_data[i + 2];
 
-                                if (partno_len > 24)
+                                i += 3;
+                                if (partno_len > 24 || (partno_len + i) > 256)
                                         goto out_not_found;
 
                                 memcpy(tp->board_part_number,
-                                       &vpd_data[i + 3],
-                                       partno_len);
+                                       &vpd_data[i], partno_len);
 
                                 /* Success. */
                                 return;
                         }
+                        i += 3 + vpd_data[i + 2];
                 }
 
                 /* Part number not found. */
@@ -10357,7 +10368,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         u32 pci_state_reg, grc_misc_cfg;
         u32 val;
         u16 pci_cmd;
-        int err;
+        int err, pcie_cap;
 
         /* Force memory write invalidate off.  If we leave it on,
          * then on 5700_BX chips we have to enable a workaround.
@@ -10532,8 +10543,19 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
             GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
                 tp->tg3_flags2 |= TG3_FLG2_JUMBO_CAPABLE;
 
-        if (pci_find_capability(tp->pdev, PCI_CAP_ID_EXP) != 0)
+        pcie_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_EXP);
+        if (pcie_cap != 0) {
                 tp->tg3_flags2 |= TG3_FLG2_PCI_EXPRESS;
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
+                        u16 lnkctl;
+
+                        pci_read_config_word(tp->pdev,
+                                             pcie_cap + PCI_EXP_LNKCTL,
+                                             &lnkctl);
+                        if (lnkctl & PCI_EXP_LNKCTL_CLKREQ_EN)
+                                tp->tg3_flags2 &= ~TG3_FLG2_HW_TSO_2;
+                }
+        }
 
         /* If we have an AMD 762 or VIA K8T800 chipset, write
          * reordering to the mailbox registers done by the host
@@ -11800,6 +11822,7 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
         else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701 ||
             tp->pci_chip_rev_id == CHIPREV_ID_5705_A0 ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906 ||
             (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) != 0) {
                 tp->tg3_flags2 &= ~TG3_FLG2_TSO_CAPABLE;
         } else {
diff --git a/drivers/net/tokenring/proteon.c b/drivers/net/tokenring/proteon.c
index 4f756960db2a..cb7dbb63c9d9 100644
--- a/drivers/net/tokenring/proteon.c
+++ b/drivers/net/tokenring/proteon.c
@@ -370,6 +370,10 @@ static int __init proteon_init(void)
                 dev->dma = dma[i];
                 pdev = platform_device_register_simple("proteon",
                         i, NULL, 0);
+                if (IS_ERR(pdev)) {
+                        free_netdev(dev);
+                        continue;
+                }
                 err = setup_card(dev, &pdev->dev);
                 if (!err) {
                         proteon_dev[i] = pdev;
@@ -385,9 +389,10 @@ static int __init proteon_init(void)
         /* Probe for cards. */
         if (num == 0) {
                 printk(KERN_NOTICE "proteon.c: No cards found.\n");
-                return (-ENODEV);
+                platform_driver_unregister(&proteon_driver);
+                return -ENODEV;
         }
-        return (0);
+        return 0;
 }
 
 static void __exit proteon_cleanup(void)
diff --git a/drivers/net/tokenring/skisa.c b/drivers/net/tokenring/skisa.c
index d6ba41cf3110..33afea31d87b 100644
--- a/drivers/net/tokenring/skisa.c
+++ b/drivers/net/tokenring/skisa.c
@@ -380,6 +380,10 @@ static int __init sk_isa_init(void)
                 dev->dma = dma[i];
                 pdev = platform_device_register_simple("skisa",
                         i, NULL, 0);
+                if (IS_ERR(pdev)) {
+                        free_netdev(dev);
+                        continue;
+                }
                 err = setup_card(dev, &pdev->dev);
                 if (!err) {
                         sk_isa_dev[i] = pdev;
@@ -395,9 +399,10 @@ static int __init sk_isa_init(void)
         /* Probe for cards. */
         if (num == 0) {
                 printk(KERN_NOTICE "skisa.c: No cards found.\n");
-                return (-ENODEV);
+                platform_driver_unregister(&sk_isa_driver);
+                return -ENODEV;
         }
-        return (0);
+        return 0;
 }
 
 static void __exit sk_isa_cleanup(void)
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 2cfd9634895a..f6b3a94e97bf 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1730,7 +1730,7 @@ static void __init de21040_get_media_info(struct de_private *de)
 }
 
 /* Note: this routine returns extra data bits for size detection. */
-static unsigned __init tulip_read_eeprom(void __iomem *regs, int location, int addr_len)
+static unsigned __devinit tulip_read_eeprom(void __iomem *regs, int location, int addr_len)
 {
         int i;
         unsigned retval = 0;
@@ -1926,7 +1926,7 @@ bad_srom:
         goto fill_defaults;
 }
 
-static int __init de_init_one (struct pci_dev *pdev,
+static int __devinit de_init_one (struct pci_dev *pdev,
                                   const struct pci_device_id *ent)
 {
         struct net_device *dev;
@@ -2082,7 +2082,7 @@ err_out_free:
         return rc;
 }
 
-static void __exit de_remove_one (struct pci_dev *pdev)
+static void __devexit de_remove_one (struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct de_private *de = dev->priv;
@@ -2164,7 +2164,7 @@ static struct pci_driver de_driver = {
         .name           = DRV_NAME,
         .id_table       = de_pci_tbl,
         .probe          = de_init_one,
-        .remove         = __exit_p(de_remove_one),
+        .remove         = __devexit_p(de_remove_one),
 #ifdef CONFIG_PM
         .suspend        = de_suspend,
         .resume         = de_resume,
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 12cd7b561f35..b37888011067 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -2,14 +2,11 @@
  * Copyright (C) Freescale Semicondutor, Inc. 2006. All rights reserved.
  *
  * Author: Shlomi Gridish <gridish@freescale.com>
+ *         Li Yang <leoli@freescale.com>
  *
  * Description:
  * QE UCC Gigabit Ethernet Driver
  *
- * Changelog:
- * Jul 6, 2006 Li Yang <LeoLi@freescale.com>
- * - Rearrange code and style fixes
- *
  * This program is free software; you can redistribute  it and/or modify it
  * under  the terms of  the GNU General  Public License as published by the
  * Free Software Foundation;  either version 2 of the  License, or (at your
@@ -31,9 +28,9 @@
 #include <linux/dma-mapping.h>
 #include <linux/fsl_devices.h>
 #include <linux/ethtool.h>
-#include <linux/platform_device.h>
 #include <linux/mii.h>
 
+#include <asm/of_device.h>
 #include <asm/uaccess.h>
 #include <asm/irq.h>
 #include <asm/io.h>
@@ -70,7 +67,7 @@
 
 static DEFINE_SPINLOCK(ugeth_lock);
 
-static ucc_geth_info_t ugeth_primary_info = {
+static struct ucc_geth_info ugeth_primary_info = {
         .uf_info = {
                     .bd_mem_part = MEM_PART_SYSTEM,
                     .rtsm = UCC_FAST_SEND_IDLES_BETWEEN_FRAMES,
@@ -163,7 +160,7 @@ static ucc_geth_info_t ugeth_primary_info = {
         .riscRx = QE_RISC_ALLOCATION_RISC1_AND_RISC2,
 };
 
-static ucc_geth_info_t ugeth_info[8];
+static struct ucc_geth_info ugeth_info[8];
 
 #ifdef DEBUG
 static void mem_disp(u8 *addr, int size)
@@ -219,8 +216,8 @@ static struct list_head *dequeue(struct list_head *lh)
         }
 }
 
-static int get_interface_details(enet_interface_e enet_interface,
-                                 enet_speed_e *speed,
+static int get_interface_details(enum enet_interface enet_interface,
+                                 enum enet_speed *speed,
                                  int *r10m,
                                  int *rmm,
                                  int *rpm,
@@ -283,7 +280,7 @@ static int get_interface_details(enet_interface_e enet_interface,
         return 0;
 }
 
-static struct sk_buff *get_new_skb(ucc_geth_private_t *ugeth, u8 *bd)
+static struct sk_buff *get_new_skb(struct ucc_geth_private *ugeth, u8 *bd)
 {
         struct sk_buff *skb = NULL;
 
@@ -303,21 +300,19 @@ static struct sk_buff *get_new_skb(ucc_geth_private_t *ugeth, u8 *bd)
 
         skb->dev = ugeth->dev;
 
-        BD_BUFFER_SET(bd,
+        out_be32(&((struct qe_bd *)bd)->buf,
                       dma_map_single(NULL,
                                      skb->data,
                                      ugeth->ug_info->uf_info.max_rx_buf_length +
                                      UCC_GETH_RX_DATA_BUF_ALIGNMENT,
                                      DMA_FROM_DEVICE));
 
-        BD_STATUS_AND_LENGTH_SET(bd,
-                                 (R_E | R_I |
-                                  (BD_STATUS_AND_LENGTH(bd) & R_W)));
+        out_be32((u32 *)bd, (R_E | R_I | (in_be32((u32 *)bd) & R_W)));
 
         return skb;
 }
 
-static int rx_bd_buffer_set(ucc_geth_private_t *ugeth, u8 rxQ)
+static int rx_bd_buffer_set(struct ucc_geth_private *ugeth, u8 rxQ)
 {
         u8 *bd;
         u32 bd_status;
@@ -328,7 +323,7 @@ static int rx_bd_buffer_set(ucc_geth_private_t *ugeth, u8 rxQ)
         i = 0;
 
         do {
-                bd_status = BD_STATUS_AND_LENGTH(bd);
+                bd_status = in_be32((u32*)bd);
                 skb = get_new_skb(ugeth, bd);
 
                 if (!skb)       /* If can not allocate data buffer,
@@ -338,19 +333,19 @@ static int rx_bd_buffer_set(ucc_geth_private_t *ugeth, u8 rxQ)
                 ugeth->rx_skbuff[rxQ][i] = skb;
 
                 /* advance the BD pointer */
-                bd += UCC_GETH_SIZE_OF_BD;
+                bd += sizeof(struct qe_bd);
                 i++;
         } while (!(bd_status & R_W));
 
         return 0;
 }
 
-static int fill_init_enet_entries(ucc_geth_private_t *ugeth,
+static int fill_init_enet_entries(struct ucc_geth_private *ugeth,
                                   volatile u32 *p_start,
                                   u8 num_entries,
                                   u32 thread_size,
                                   u32 thread_alignment,
-                                  qe_risc_allocation_e risc,
+                                  enum qe_risc_allocation risc,
                                   int skip_page_for_first_entry)
 {
         u32 init_enet_offset;
@@ -383,10 +378,10 @@ static int fill_init_enet_entries(ucc_geth_private_t *ugeth,
         return 0;
 }
 
-static int return_init_enet_entries(ucc_geth_private_t *ugeth,
+static int return_init_enet_entries(struct ucc_geth_private *ugeth,
                                     volatile u32 *p_start,
                                     u8 num_entries,
-                                    qe_risc_allocation_e risc,
+                                    enum qe_risc_allocation risc,
                                     int skip_page_for_first_entry)
 {
         u32 init_enet_offset;
@@ -416,11 +411,11 @@ static int return_init_enet_entries(ucc_geth_private_t *ugeth,
 }
 
 #ifdef DEBUG
-static int dump_init_enet_entries(ucc_geth_private_t *ugeth,
+static int dump_init_enet_entries(struct ucc_geth_private *ugeth,
                                   volatile u32 *p_start,
                                   u8 num_entries,
                                   u32 thread_size,
-                                  qe_risc_allocation_e risc,
+                                  enum qe_risc_allocation risc,
                                   int skip_page_for_first_entry)
 {
         u32 init_enet_offset;
@@ -456,14 +451,14 @@ static int dump_init_enet_entries(ucc_geth_private_t *ugeth,
 #endif
 
 #ifdef CONFIG_UGETH_FILTERING
-static enet_addr_container_t *get_enet_addr_container(void)
+static struct enet_addr_container *get_enet_addr_container(void)
 {
-        enet_addr_container_t *enet_addr_cont;
+        struct enet_addr_container *enet_addr_cont;
 
         /* allocate memory */
-        enet_addr_cont = kmalloc(sizeof(enet_addr_container_t), GFP_KERNEL);
+        enet_addr_cont = kmalloc(sizeof(struct enet_addr_container), GFP_KERNEL);
         if (!enet_addr_cont) {
-                ugeth_err("%s: No memory for enet_addr_container_t object.",
+                ugeth_err("%s: No memory for enet_addr_container object.",
                           __FUNCTION__);
                 return NULL;
         }
@@ -472,45 +467,43 @@ static enet_addr_container_t *get_enet_addr_container(void)
 }
 #endif /* CONFIG_UGETH_FILTERING */
 
-static void put_enet_addr_container(enet_addr_container_t *enet_addr_cont)
+static void put_enet_addr_container(struct enet_addr_container *enet_addr_cont)
 {
         kfree(enet_addr_cont);
 }
 
+static int set_mac_addr(__be16 __iomem *reg, u8 *mac)
+{
+        out_be16(&reg[0], ((u16)mac[5] << 8) | mac[4]);
+        out_be16(&reg[1], ((u16)mac[3] << 8) | mac[2]);
+        out_be16(&reg[2], ((u16)mac[1] << 8) | mac[0]);
+}
+
 #ifdef CONFIG_UGETH_FILTERING
-static int hw_add_addr_in_paddr(ucc_geth_private_t *ugeth,
-                                enet_addr_t *p_enet_addr, u8 paddr_num)
+static int hw_add_addr_in_paddr(struct ucc_geth_private *ugeth,
+                                u8 *p_enet_addr, u8 paddr_num)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
 
         if (!(paddr_num < NUM_OF_PADDRS)) {
-                ugeth_warn("%s: Illagel paddr_num.", __FUNCTION__);
+                ugeth_warn("%s: Illegal paddr_num.", __FUNCTION__);
                 return -EINVAL;
         }
 
         p_82xx_addr_filt =
-            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            (struct ucc_geth_82xx_address_filtering_pram *) ugeth->p_rx_glbl_pram->
             addressfiltering;
 
         /* Ethernet frames are defined in Little Endian mode,    */
         /* therefore to insert the address we reverse the bytes. */
-        out_be16(&p_82xx_addr_filt->paddr[paddr_num].h,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[5])) << 8)) |
-                        (u16) (*p_enet_addr)[4]));
-        out_be16(&p_82xx_addr_filt->paddr[paddr_num].m,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[3])) << 8)) |
-                        (u16) (*p_enet_addr)[2]));
-        out_be16(&p_82xx_addr_filt->paddr[paddr_num].l,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[1])) << 8)) |
-                        (u16) (*p_enet_addr)[0]));
-
+        set_mac_addr(&p_82xx_addr_filt->paddr[paddr_num].h, p_enet_addr);
         return 0;
 }
 #endif /* CONFIG_UGETH_FILTERING */
 
-static int hw_clear_addr_in_paddr(ucc_geth_private_t *ugeth, u8 paddr_num)
+static int hw_clear_addr_in_paddr(struct ucc_geth_private *ugeth, u8 paddr_num)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
 
         if (!(paddr_num < NUM_OF_PADDRS)) {
                 ugeth_warn("%s: Illagel paddr_num.", __FUNCTION__);
@@ -518,7 +511,7 @@ static int hw_clear_addr_in_paddr(ucc_geth_private_t *ugeth, u8 paddr_num)
         }
 
         p_82xx_addr_filt =
-            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            (struct ucc_geth_82xx_address_filtering_pram *) ugeth->p_rx_glbl_pram->
             addressfiltering;
 
         /* Writing address ff.ff.ff.ff.ff.ff disables address
@@ -530,14 +523,14 @@ static int hw_clear_addr_in_paddr(ucc_geth_private_t *ugeth, u8 paddr_num)
         return 0;
 }
 
-static void hw_add_addr_in_hash(ucc_geth_private_t *ugeth,
-                                enet_addr_t *p_enet_addr)
+static void hw_add_addr_in_hash(struct ucc_geth_private *ugeth,
+                                u8 *p_enet_addr)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
         u32 cecr_subblock;
 
         p_82xx_addr_filt =
-            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            (struct ucc_geth_82xx_address_filtering_pram *) ugeth->p_rx_glbl_pram->
             addressfiltering;
 
         cecr_subblock =
@@ -546,25 +539,18 @@ static void hw_add_addr_in_hash(ucc_geth_private_t *ugeth,
         /* Ethernet frames are defined in Little Endian mode,
         therefor to insert */
         /* the address to the hash (Big Endian mode), we reverse the bytes.*/
-        out_be16(&p_82xx_addr_filt->taddr.h,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[5])) << 8)) |
-                        (u16) (*p_enet_addr)[4]));
-        out_be16(&p_82xx_addr_filt->taddr.m,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[3])) << 8)) |
-                        (u16) (*p_enet_addr)[2]));
-        out_be16(&p_82xx_addr_filt->taddr.l,
-                 (u16) (((u16) (((u16) ((*p_enet_addr)[1])) << 8)) |
-                        (u16) (*p_enet_addr)[0]));
+
+        set_mac_addr(&p_82xx_addr_filt->taddr.h, p_enet_addr);
 
         qe_issue_cmd(QE_SET_GROUP_ADDRESS, cecr_subblock,
-                     (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+                     QE_CR_PROTOCOL_ETHERNET, 0);
 }
 
 #ifdef CONFIG_UGETH_MAGIC_PACKET
-static void magic_packet_detection_enable(ucc_geth_private_t *ugeth)
+static void magic_packet_detection_enable(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_private_t *uccf;
-        ucc_geth_t *ug_regs;
+        struct ucc_fast_private *uccf;
+        struct ucc_geth *ug_regs;
         u32 maccfg2, uccm;
 
         uccf = ugeth->uccf;
@@ -581,10 +567,10 @@ static void magic_packet_detection_enable(ucc_geth_private_t *ugeth)
         out_be32(&ug_regs->maccfg2, maccfg2);
 }
 
-static void magic_packet_detection_disable(ucc_geth_private_t *ugeth)
+static void magic_packet_detection_disable(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_private_t *uccf;
-        ucc_geth_t *ug_regs;
+        struct ucc_fast_private *uccf;
+        struct ucc_geth *ug_regs;
         u32 maccfg2, uccm;
 
         uccf = ugeth->uccf;
@@ -602,26 +588,26 @@ static void magic_packet_detection_disable(ucc_geth_private_t *ugeth)
 }
 #endif /* MAGIC_PACKET */
 
-static inline int compare_addr(enet_addr_t *addr1, enet_addr_t *addr2)
+static inline int compare_addr(u8 **addr1, u8 **addr2)
 {
         return memcmp(addr1, addr2, ENET_NUM_OCTETS_PER_ADDRESS);
 }
 
 #ifdef DEBUG
-static void get_statistics(ucc_geth_private_t *ugeth,
-                           ucc_geth_tx_firmware_statistics_t *
+static void get_statistics(struct ucc_geth_private *ugeth,
+                           struct ucc_geth_tx_firmware_statistics *
                            tx_firmware_statistics,
-                           ucc_geth_rx_firmware_statistics_t *
+                           struct ucc_geth_rx_firmware_statistics *
                            rx_firmware_statistics,
-                           ucc_geth_hardware_statistics_t *hardware_statistics)
+                           struct ucc_geth_hardware_statistics *hardware_statistics)
 {
-        ucc_fast_t *uf_regs;
-        ucc_geth_t *ug_regs;
-        ucc_geth_tx_firmware_statistics_pram_t *p_tx_fw_statistics_pram;
-        ucc_geth_rx_firmware_statistics_pram_t *p_rx_fw_statistics_pram;
+        struct ucc_fast *uf_regs;
+        struct ucc_geth *ug_regs;
+        struct ucc_geth_tx_firmware_statistics_pram *p_tx_fw_statistics_pram;
+        struct ucc_geth_rx_firmware_statistics_pram *p_rx_fw_statistics_pram;
 
         ug_regs = ugeth->ug_regs;
-        uf_regs = (ucc_fast_t *) ug_regs;
+        uf_regs = (struct ucc_fast *) ug_regs;
         p_tx_fw_statistics_pram = ugeth->p_tx_fw_statistics_pram;
         p_rx_fw_statistics_pram = ugeth->p_rx_fw_statistics_pram;
 
@@ -727,7 +713,7 @@ static void get_statistics(ucc_geth_private_t *ugeth,
         }
 }
 
-static void dump_bds(ucc_geth_private_t *ugeth)
+static void dump_bds(struct ucc_geth_private *ugeth)
 {
         int i;
         int length;
@@ -736,7 +722,7 @@ static void dump_bds(ucc_geth_private_t *ugeth)
                 if (ugeth->p_tx_bd_ring[i]) {
                         length =
                             (ugeth->ug_info->bdRingLenTx[i] *
-                             UCC_GETH_SIZE_OF_BD);
+                             sizeof(struct qe_bd));
                         ugeth_info("TX BDs[%d]", i);
                         mem_disp(ugeth->p_tx_bd_ring[i], length);
                 }
@@ -745,14 +731,14 @@ static void dump_bds(ucc_geth_private_t *ugeth)
                 if (ugeth->p_rx_bd_ring[i]) {
                         length =
                             (ugeth->ug_info->bdRingLenRx[i] *
-                             UCC_GETH_SIZE_OF_BD);
+                             sizeof(struct qe_bd));
                         ugeth_info("RX BDs[%d]", i);
                         mem_disp(ugeth->p_rx_bd_ring[i], length);
                 }
         }
 }
 
-static void dump_regs(ucc_geth_private_t *ugeth)
+static void dump_regs(struct ucc_geth_private *ugeth)
 {
         int i;
 
@@ -893,7 +879,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                         ugeth_info("Base address: 0x%08x",
                                    (u32) & ugeth->p_thread_data_tx[i]);
                         mem_disp((u8 *) & ugeth->p_thread_data_tx[i],
-                                 sizeof(ucc_geth_thread_data_tx_t));
+                                 sizeof(struct ucc_geth_thread_data_tx));
                 }
         }
         if (ugeth->p_thread_data_rx) {
@@ -927,7 +913,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                         ugeth_info("Base address: 0x%08x",
                                    (u32) & ugeth->p_thread_data_rx[i]);
                         mem_disp((u8 *) & ugeth->p_thread_data_rx[i],
-                                 sizeof(ucc_geth_thread_data_rx_t));
+                                 sizeof(struct ucc_geth_thread_data_rx));
                 }
         }
         if (ugeth->p_exf_glbl_param) {
@@ -1105,7 +1091,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                         ugeth_info("Base address: 0x%08x",
                                    (u32) & ugeth->p_send_q_mem_reg->sqqd[i]);
                         mem_disp((u8 *) & ugeth->p_send_q_mem_reg->sqqd[i],
-                                 sizeof(ucc_geth_send_queue_qd_t));
+                                 sizeof(struct ucc_geth_send_queue_qd));
                 }
         }
         if (ugeth->p_scheduler) {
@@ -1187,7 +1173,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                                  qe_muram_addr(in_be32
                                                (&ugeth->p_rx_bd_qs_tbl[i].
                                                 bdbaseptr)),
-                                 sizeof(ucc_geth_rx_prefetched_bds_t));
+                                 sizeof(struct ucc_geth_rx_prefetched_bds));
                 }
         }
         if (ugeth->p_init_enet_param_shadow) {
@@ -1198,7 +1184,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                 mem_disp((u8 *) ugeth->p_init_enet_param_shadow,
                          sizeof(*ugeth->p_init_enet_param_shadow));
 
-                size = sizeof(ucc_geth_thread_rx_pram_t);
+                size = sizeof(struct ucc_geth_thread_rx_pram);
                 if (ugeth->ug_info->rxExtendedFiltering) {
                         size +=
                             THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
@@ -1216,7 +1202,7 @@ static void dump_regs(ucc_geth_private_t *ugeth)
                                        &(ugeth->p_init_enet_param_shadow->
                                          txthread[0]),
                                        ENET_INIT_PARAM_MAX_ENTRIES_TX,
-                                       sizeof(ucc_geth_thread_tx_pram_t),
+                                       sizeof(struct ucc_geth_thread_tx_pram),
                                        ugeth->ug_info->riscTx, 0);
                 dump_init_enet_entries(ugeth,
                                        &(ugeth->p_init_enet_param_shadow->
@@ -1578,12 +1564,12 @@ static int init_min_frame_len(u16 min_frame_length,
         return 0;
 }
 
-static int adjust_enet_interface(ucc_geth_private_t *ugeth)
+static int adjust_enet_interface(struct ucc_geth_private *ugeth)
 {
-        ucc_geth_info_t *ug_info;
-        ucc_geth_t *ug_regs;
-        ucc_fast_t *uf_regs;
-        enet_speed_e speed;
+        struct ucc_geth_info *ug_info;
+        struct ucc_geth *ug_regs;
+        struct ucc_fast *uf_regs;
+        enum enet_speed speed;
         int ret_val, rpm = 0, tbi = 0, r10m = 0, rmm =
             0, limited_to_full_duplex = 0;
         u32 upsmr, maccfg2, utbipar, tbiBaseAddress;
@@ -1691,8 +1677,8 @@ static int adjust_enet_interface(ucc_geth_private_t *ugeth)
  */
 static void adjust_link(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
-        ucc_geth_t *ug_regs;
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct ucc_geth *ug_regs;
         u32 tempval;
         struct ugeth_mii_info *mii_info = ugeth->mii_info;
 
@@ -1722,7 +1708,7 @@ static void adjust_link(struct net_device *dev)
                 if (mii_info->speed != ugeth->oldspeed) {
                         switch (mii_info->speed) {
                         case 1000:
-#ifdef CONFIG_MPC836x
+#ifdef CONFIG_PPC_MPC836x
 /* FIXME: This code is for 100Mbs BUG fixing,
 remove this when it is fixed!!! */
                                 if (ugeth->ug_info->enet_interface ==
@@ -1768,7 +1754,7 @@ remove this when it is fixed!!! */
                                 break;
                         case 100:
                         case 10:
-#ifdef CONFIG_MPC836x
+#ifdef CONFIG_PPC_MPC836x
 /* FIXME: This code is for 100Mbs BUG fixing,
 remove this lines when it will be fixed!!! */
                                 ugeth->ug_info->enet_interface = ENET_100_RGMII;
@@ -1827,9 +1813,9 @@ remove this lines when it will be fixed!!! */
  */
 static int init_phy(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
         struct phy_info *curphy;
-        ucc_mii_mng_t *mii_regs;
+        struct ucc_mii_mng *mii_regs;
         struct ugeth_mii_info *mii_info;
         int err;
 
@@ -1914,17 +1900,17 @@ static int init_phy(struct net_device *dev)
 }
 
 #ifdef CONFIG_UGETH_TX_ON_DEMOND
-static int ugeth_transmit_on_demand(ucc_geth_private_t *ugeth)
+static int ugeth_transmit_on_demand(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_transmit_on_demand(ugeth->uccf);
+        struct ucc_fastransmit_on_demand(ugeth->uccf);
 
         return 0;
 }
 #endif
 
-static int ugeth_graceful_stop_tx(ucc_geth_private_t *ugeth)
+static int ugeth_graceful_stop_tx(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
         u32 cecr_subblock;
         u32 temp;
 
@@ -1940,7 +1926,7 @@ static int ugeth_graceful_stop_tx(ucc_geth_private_t *ugeth)
         cecr_subblock =
             ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
         qe_issue_cmd(QE_GRACEFUL_STOP_TX, cecr_subblock,
-                     (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+                     QE_CR_PROTOCOL_ETHERNET, 0);
 
         /* Wait for command to complete */
         do {
@@ -1952,9 +1938,9 @@ static int ugeth_graceful_stop_tx(ucc_geth_private_t *ugeth)
         return 0;
 }
 
-static int ugeth_graceful_stop_rx(ucc_geth_private_t * ugeth)
+static int ugeth_graceful_stop_rx(struct ucc_geth_private * ugeth)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
         u32 cecr_subblock;
         u8 temp;
 
@@ -1973,7 +1959,7 @@ static int ugeth_graceful_stop_rx(ucc_geth_private_t * ugeth)
                     ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.
                                                 ucc_num);
                 qe_issue_cmd(QE_GRACEFUL_STOP_RX, cecr_subblock,
-                             (u8) QE_CR_PROTOCOL_ETHERNET, 0);
+                             QE_CR_PROTOCOL_ETHERNET, 0);
 
                 temp = ugeth->p_rx_glbl_pram->rxgstpack;
         } while (!(temp & GRACEFUL_STOP_ACKNOWLEDGE_RX));
@@ -1983,41 +1969,40 @@ static int ugeth_graceful_stop_rx(ucc_geth_private_t * ugeth)
         return 0;
 }
 
-static int ugeth_restart_tx(ucc_geth_private_t *ugeth)
+static int ugeth_restart_tx(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
         u32 cecr_subblock;
 
         uccf = ugeth->uccf;
 
         cecr_subblock =
             ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
-        qe_issue_cmd(QE_RESTART_TX, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
-                     0);
+        qe_issue_cmd(QE_RESTART_TX, cecr_subblock, QE_CR_PROTOCOL_ETHERNET, 0);
         uccf->stopped_tx = 0;
 
         return 0;
 }
 
-static int ugeth_restart_rx(ucc_geth_private_t *ugeth)
+static int ugeth_restart_rx(struct ucc_geth_private *ugeth)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
         u32 cecr_subblock;
 
         uccf = ugeth->uccf;
 
         cecr_subblock =
             ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
-        qe_issue_cmd(QE_RESTART_RX, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
+        qe_issue_cmd(QE_RESTART_RX, cecr_subblock, QE_CR_PROTOCOL_ETHERNET,
                      0);
         uccf->stopped_rx = 0;
 
         return 0;
 }
 
-static int ugeth_enable(ucc_geth_private_t *ugeth, comm_dir_e mode)
+static int ugeth_enable(struct ucc_geth_private *ugeth, enum comm_dir mode)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
         int enabled_tx, enabled_rx;
 
         uccf = ugeth->uccf;
@@ -2044,9 +2029,9 @@ static int ugeth_enable(ucc_geth_private_t *ugeth, comm_dir_e mode)
 
 }
 
-static int ugeth_disable(ucc_geth_private_t * ugeth, comm_dir_e mode)
+static int ugeth_disable(struct ucc_geth_private * ugeth, enum comm_dir mode)
 {
-        ucc_fast_private_t *uccf;
+        struct ucc_fast_private *uccf;
 
         uccf = ugeth->uccf;
 
@@ -2069,7 +2054,7 @@ static int ugeth_disable(ucc_geth_private_t * ugeth, comm_dir_e mode)
         return 0;
 }
 
-static void ugeth_dump_regs(ucc_geth_private_t *ugeth)
+static void ugeth_dump_regs(struct ucc_geth_private *ugeth)
 {
 #ifdef DEBUG
         ucc_fast_dump_regs(ugeth->uccf);
@@ -2079,9 +2064,9 @@ static void ugeth_dump_regs(ucc_geth_private_t *ugeth)
 }
 
 #ifdef CONFIG_UGETH_FILTERING
-static int ugeth_ext_filtering_serialize_tad(ucc_geth_tad_params_t *
+static int ugeth_ext_filtering_serialize_tad(struct ucc_geth_tad_params *
                                              p_UccGethTadParams,
-                                             qe_fltr_tad_t *qe_fltr_tad)
+                                             struct qe_fltr_tad *qe_fltr_tad)
 {
         u16 temp;
 
@@ -2119,11 +2104,11 @@ static int ugeth_ext_filtering_serialize_tad(ucc_geth_tad_params_t *
         return 0;
 }
 
-static enet_addr_container_t
-    *ugeth_82xx_filtering_get_match_addr_in_hash(ucc_geth_private_t *ugeth,
-                                                 enet_addr_t *p_enet_addr)
+static struct enet_addr_container_t
+    *ugeth_82xx_filtering_get_match_addr_in_hash(struct ucc_geth_private *ugeth,
+                                                 struct enet_addr *p_enet_addr)
 {
-        enet_addr_container_t *enet_addr_cont;
+        struct enet_addr_container *enet_addr_cont;
         struct list_head *p_lh;
         u16 i, num;
         int32_t j;
@@ -2144,7 +2129,7 @@ static enet_addr_container_t
 
         for (i = 0; i < num; i++) {
                 enet_addr_cont =
-                    (enet_addr_container_t *)
+                    (struct enet_addr_container *)
                     ENET_ADDR_CONT_ENTRY(dequeue(p_lh));
                 for (j = ENET_NUM_OCTETS_PER_ADDRESS - 1; j >= 0; j--) {
                         if ((*p_enet_addr)[j] != (enet_addr_cont->address)[j])
@@ -2157,11 +2142,11 @@ static enet_addr_container_t
         return NULL;
 }
 
-static int ugeth_82xx_filtering_add_addr_in_hash(ucc_geth_private_t *ugeth,
-                                                 enet_addr_t *p_enet_addr)
+static int ugeth_82xx_filtering_add_addr_in_hash(struct ucc_geth_private *ugeth,
+                                                 struct enet_addr *p_enet_addr)
 {
-        ucc_geth_enet_address_recognition_location_e location;
-        enet_addr_container_t *enet_addr_cont;
+        enum ucc_geth_enet_address_recognition_location location;
+        struct enet_addr_container *enet_addr_cont;
         struct list_head *p_lh;
         u8 i;
         u32 limit;
@@ -2196,18 +2181,17 @@ static int ugeth_82xx_filtering_add_addr_in_hash(ucc_geth_private_t *ugeth,
         enqueue(p_lh, &enet_addr_cont->node);   /* Put it back */
         ++(*p_counter);
 
-        hw_add_addr_in_hash(ugeth, &(enet_addr_cont->address));
-
+        hw_add_addr_in_hash(ugeth, enet_addr_cont->address);
         return 0;
 }
 
-static int ugeth_82xx_filtering_clear_addr_in_hash(ucc_geth_private_t *ugeth,
-                                                   enet_addr_t *p_enet_addr)
+static int ugeth_82xx_filtering_clear_addr_in_hash(struct ucc_geth_private *ugeth,
+                                                   struct enet_addr *p_enet_addr)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
-        enet_addr_container_t *enet_addr_cont;
-        ucc_fast_private_t *uccf;
-        comm_dir_e comm_dir;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
+        struct enet_addr_container *enet_addr_cont;
+        struct ucc_fast_private *uccf;
+        enum comm_dir comm_dir;
         u16 i, num;
         struct list_head *p_lh;
         u32 *addr_h, *addr_l;
@@ -2216,7 +2200,7 @@ static int ugeth_82xx_filtering_clear_addr_in_hash(ucc_geth_private_t *ugeth,
         uccf = ugeth->uccf;
 
         p_82xx_addr_filt =
-            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            (struct ucc_geth_82xx_address_filtering_pram *) ugeth->p_rx_glbl_pram->
             addressfiltering;
 
         if (!
@@ -2256,9 +2240,9 @@ static int ugeth_82xx_filtering_clear_addr_in_hash(ucc_geth_private_t *ugeth,
         num = --(*p_counter);
         for (i = 0; i < num; i++) {
                 enet_addr_cont =
-                    (enet_addr_container_t *)
+                    (struct enet_addr_container *)
                     ENET_ADDR_CONT_ENTRY(dequeue(p_lh));
-                hw_add_addr_in_hash(ugeth, &(enet_addr_cont->address));
+                hw_add_addr_in_hash(ugeth, enet_addr_cont->address);
                 enqueue(p_lh, &enet_addr_cont->node);   /* Put it back */
         }
 
@@ -2269,14 +2253,14 @@ static int ugeth_82xx_filtering_clear_addr_in_hash(ucc_geth_private_t *ugeth,
 }
 #endif /* CONFIG_UGETH_FILTERING */
 
-static int ugeth_82xx_filtering_clear_all_addr_in_hash(ucc_geth_private_t *
+static int ugeth_82xx_filtering_clear_all_addr_in_hash(struct ucc_geth_private *
                                                        ugeth,
-                                                       enet_addr_type_e
+                                                       enum enet_addr_type
                                                        enet_addr_type)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
-        ucc_fast_private_t *uccf;
-        comm_dir_e comm_dir;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
+        struct ucc_fast_private *uccf;
+        enum comm_dir comm_dir;
         struct list_head *p_lh;
         u16 i, num;
         u32 *addr_h, *addr_l;
@@ -2285,7 +2269,7 @@ static int ugeth_82xx_filtering_clear_all_addr_in_hash(ucc_geth_private_t *
         uccf = ugeth->uccf;
 
         p_82xx_addr_filt =
-            (ucc_geth_82xx_address_filtering_pram_t *) ugeth->p_rx_glbl_pram->
+            (struct ucc_geth_82xx_address_filtering_pram *) ugeth->p_rx_glbl_pram->
             addressfiltering;
 
         if (enet_addr_type == ENET_ADDR_TYPE_GROUP) {
@@ -2331,8 +2315,8 @@ static int ugeth_82xx_filtering_clear_all_addr_in_hash(ucc_geth_private_t *
 }
 
 #ifdef CONFIG_UGETH_FILTERING
-static int ugeth_82xx_filtering_add_addr_in_paddr(ucc_geth_private_t *ugeth,
-                                                  enet_addr_t *p_enet_addr,
+static int ugeth_82xx_filtering_add_addr_in_paddr(struct ucc_geth_private *ugeth,
+                                                  struct enet_addr *p_enet_addr,
                                                   u8 paddr_num)
 {
         int i;
@@ -2352,14 +2336,14 @@ static int ugeth_82xx_filtering_add_addr_in_paddr(ucc_geth_private_t *ugeth,
 }
 #endif /* CONFIG_UGETH_FILTERING */
 
-static int ugeth_82xx_filtering_clear_addr_in_paddr(ucc_geth_private_t *ugeth,
+static int ugeth_82xx_filtering_clear_addr_in_paddr(struct ucc_geth_private *ugeth,
                                                     u8 paddr_num)
 {
         ugeth->indAddrRegUsed[paddr_num] = 0; /* mark this paddr as not used */
         return hw_clear_addr_in_paddr(ugeth, paddr_num);/* clear in hardware */
 }
 
-static void ucc_geth_memclean(ucc_geth_private_t *ugeth)
+static void ucc_geth_memclean(struct ucc_geth_private *ugeth)
 {
         u16 i, j;
         u8 *bd;
@@ -2433,8 +2417,8 @@ static void ucc_geth_memclean(ucc_geth_private_t *ugeth)
                 for (j = 0; j < ugeth->ug_info->bdRingLenTx[i]; j++) {
                         if (ugeth->tx_skbuff[i][j]) {
                                 dma_unmap_single(NULL,
-                                                 BD_BUFFER_ARG(bd),
-                                                 (BD_STATUS_AND_LENGTH(bd) &
+                                                 ((qe_bd_t *)bd)->buf,
+                                                 (in_be32((u32 *)bd) &
                                                   BD_LENGTH_MASK),
                                                  DMA_TO_DEVICE);
                                 dev_kfree_skb_any(ugeth->tx_skbuff[i][j]);
@@ -2460,18 +2444,17 @@ static void ucc_geth_memclean(ucc_geth_private_t *ugeth)
                         bd = ugeth->p_rx_bd_ring[i];
                         for (j = 0; j < ugeth->ug_info->bdRingLenRx[i]; j++) {
                                 if (ugeth->rx_skbuff[i][j]) {
-                                        dma_unmap_single(NULL, BD_BUFFER(bd),
-                                                 ugeth->ug_info->
-                                                 uf_info.
-                                                 max_rx_buf_length +
-                                                 UCC_GETH_RX_DATA_BUF_ALIGNMENT,
-                                                 DMA_FROM_DEVICE);
-
-                                        dev_kfree_skb_any(ugeth->
-                                                          rx_skbuff[i][j]);
+                                        dma_unmap_single(NULL,
+                                                ((struct qe_bd *)bd)->buf,
+                                                ugeth->ug_info->
+                                                uf_info.max_rx_buf_length +
+                                                UCC_GETH_RX_DATA_BUF_ALIGNMENT,
+                                                DMA_FROM_DEVICE);
+                                        dev_kfree_skb_any(
+                                                ugeth->rx_skbuff[i][j]);
                                         ugeth->rx_skbuff[i][j] = NULL;
                                 }
-                                bd += UCC_GETH_SIZE_OF_BD;
+                                bd += sizeof(struct qe_bd);
                         }
 
                         kfree(ugeth->rx_skbuff[i]);
@@ -2496,11 +2479,11 @@ static void ucc_geth_memclean(ucc_geth_private_t *ugeth)
 
 static void ucc_geth_set_multi(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth;
+        struct ucc_geth_private *ugeth;
         struct dev_mc_list *dmi;
-        ucc_fast_t *uf_regs;
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
-        enet_addr_t tempaddr;
+        struct ucc_fast *uf_regs;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
+        u8 tempaddr[6];
         u8 *mcptr, *tdptr;
         int i, j;
 
@@ -2517,7 +2500,7 @@ static void ucc_geth_set_multi(struct net_device *dev)
                 uf_regs->upsmr &= ~UPSMR_PRO;
 
                 p_82xx_addr_filt =
-                    (ucc_geth_82xx_address_filtering_pram_t *) ugeth->
+                    (struct ucc_geth_82xx_address_filtering_pram *) ugeth->
                     p_rx_glbl_pram->addressfiltering;
 
                 if (dev->flags & IFF_ALLMULTI) {
@@ -2546,23 +2529,22 @@ static void ucc_geth_set_multi(struct net_device *dev)
                                  * copy bytes MSB first from dmi_addr.
                                  */
                                 mcptr = (u8 *) dmi->dmi_addr + 5;
-                                tdptr = (u8 *) & tempaddr;
+                                tdptr = (u8 *) tempaddr;
                                 for (j = 0; j < 6; j++)
                                         *tdptr++ = *mcptr--;
 
                                 /* Ask CPM to run CRC and set bit in
                                  * filter mask.
                                  */
-                                hw_add_addr_in_hash(ugeth, &tempaddr);
-
+                                hw_add_addr_in_hash(ugeth, tempaddr);
                         }
                 }
         }
 }
 
-static void ucc_geth_stop(ucc_geth_private_t *ugeth)
+static void ucc_geth_stop(struct ucc_geth_private *ugeth)
 {
-        ucc_geth_t *ug_regs = ugeth->ug_regs;
+        struct ucc_geth *ug_regs = ugeth->ug_regs;
         u32 tempval;
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
@@ -2605,15 +2587,15 @@ static void ucc_geth_stop(ucc_geth_private_t *ugeth)
         ucc_geth_memclean(ugeth);
 }
 
-static int ucc_geth_startup(ucc_geth_private_t *ugeth)
+static int ucc_geth_startup(struct ucc_geth_private *ugeth)
 {
-        ucc_geth_82xx_address_filtering_pram_t *p_82xx_addr_filt;
-        ucc_geth_init_pram_t *p_init_enet_pram;
-        ucc_fast_private_t *uccf;
-        ucc_geth_info_t *ug_info;
-        ucc_fast_info_t *uf_info;
-        ucc_fast_t *uf_regs;
-        ucc_geth_t *ug_regs;
+        struct ucc_geth_82xx_address_filtering_pram *p_82xx_addr_filt;
+        struct ucc_geth_init_pram *p_init_enet_pram;
+        struct ucc_fast_private *uccf;
+        struct ucc_geth_info *ug_info;
+        struct ucc_fast_info *uf_info;
+        struct ucc_fast *uf_regs;
+        struct ucc_geth *ug_regs;
         int ret_val = -EINVAL;
         u32 remoder = UCC_GETH_REMODER_INIT;
         u32 init_enet_pram_offset, cecr_subblock, command, maccfg1;
@@ -2788,7 +2770,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP);
 
         uf_regs = uccf->uf_regs;
-        ug_regs = (ucc_geth_t *) (uccf->uf_regs);
+        ug_regs = (struct ucc_geth *) (uccf->uf_regs);
         ugeth->ug_regs = ug_regs;
 
         init_default_reg_vals(&uf_regs->upsmr,
@@ -2869,10 +2851,10 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 /* Allocate in multiple of
                    UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT,
                    according to spec */
-                length = ((ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD)
+                length = ((ug_info->bdRingLenTx[j] * sizeof(struct qe_bd))
                           / UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT)
                     * UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT;
-                if ((ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD) %
+                if ((ug_info->bdRingLenTx[j] * sizeof(struct qe_bd)) %
                     UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT)
                         length += UCC_GETH_TX_BD_RING_SIZE_MEMORY_ALIGNMENT;
                 if (uf_info->bd_mem_part == MEM_PART_SYSTEM) {
@@ -2904,13 +2886,13 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 }
                 /* Zero unused end of bd ring, according to spec */
                 memset(ugeth->p_tx_bd_ring[j] +
-                       ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD, 0,
-                       length - ug_info->bdRingLenTx[j] * UCC_GETH_SIZE_OF_BD);
+                       ug_info->bdRingLenTx[j] * sizeof(struct qe_bd), 0,
+                       length - ug_info->bdRingLenTx[j] * sizeof(struct qe_bd));
         }
 
         /* Allocate Rx bds */
         for (j = 0; j < ug_info->numQueuesRx; j++) {
-                length = ug_info->bdRingLenRx[j] * UCC_GETH_SIZE_OF_BD;
+                length = ug_info->bdRingLenRx[j] * sizeof(struct qe_bd);
                 if (uf_info->bd_mem_part == MEM_PART_SYSTEM) {
                         u32 align = 4;
                         if (UCC_GETH_RX_BD_RING_ALIGNMENT > 4)
@@ -2960,12 +2942,15 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 ugeth->skb_curtx[j] = ugeth->skb_dirtytx[j] = 0;
                 bd = ugeth->confBd[j] = ugeth->txBd[j] = ugeth->p_tx_bd_ring[j];
                 for (i = 0; i < ug_info->bdRingLenTx[j]; i++) {
-                        BD_BUFFER_CLEAR(bd);
-                        BD_STATUS_AND_LENGTH_SET(bd, 0);
-                        bd += UCC_GETH_SIZE_OF_BD;
+                        /* clear bd buffer */
+                        out_be32(&((struct qe_bd *)bd)->buf, 0);
+                        /* set bd status and length */
+                        out_be32((u32 *)bd, 0);
+                        bd += sizeof(struct qe_bd);
                 }
-                bd -= UCC_GETH_SIZE_OF_BD;
-                BD_STATUS_AND_LENGTH_SET(bd, T_W);/* for last BD set Wrap bit */
+                bd -= sizeof(struct qe_bd);
+                /* set bd status and length */
+                out_be32((u32 *)bd, T_W);       /* for last BD set Wrap bit */
         }
 
         /* Init Rx bds */
@@ -2989,12 +2974,15 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 ugeth->skb_currx[j] = 0;
                 bd = ugeth->rxBd[j] = ugeth->p_rx_bd_ring[j];
                 for (i = 0; i < ug_info->bdRingLenRx[j]; i++) {
-                        BD_STATUS_AND_LENGTH_SET(bd, R_I);
-                        BD_BUFFER_CLEAR(bd);
-                        bd += UCC_GETH_SIZE_OF_BD;
+                        /* set bd status and length */
+                        out_be32((u32 *)bd, R_I);
+                        /* clear bd buffer */
+                        out_be32(&((struct qe_bd *)bd)->buf, 0);
+                        bd += sizeof(struct qe_bd);
                 }
-                bd -= UCC_GETH_SIZE_OF_BD;
-                BD_STATUS_AND_LENGTH_SET(bd, R_W);/* for last BD set Wrap bit */
+                bd -= sizeof(struct qe_bd);
+                /* set bd status and length */
+                out_be32((u32 *)bd, R_W); /* for last BD set Wrap bit */
         }
 
         /*
@@ -3003,7 +2991,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Tx global PRAM */
         /* Allocate global tx parameter RAM page */
         ugeth->tx_glbl_pram_offset =
-            qe_muram_alloc(sizeof(ucc_geth_tx_global_pram_t),
+            qe_muram_alloc(sizeof(struct ucc_geth_tx_global_pram),
                            UCC_GETH_TX_GLOBAL_PRAM_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->tx_glbl_pram_offset)) {
                 ugeth_err
@@ -3013,10 +3001,10 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 return -ENOMEM;
         }
         ugeth->p_tx_glbl_pram =
-            (ucc_geth_tx_global_pram_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_tx_global_pram *) qe_muram_addr(ugeth->
                                                         tx_glbl_pram_offset);
         /* Zero out p_tx_glbl_pram */
-        memset(ugeth->p_tx_glbl_pram, 0, sizeof(ucc_geth_tx_global_pram_t));
+        memset(ugeth->p_tx_glbl_pram, 0, sizeof(struct ucc_geth_tx_global_pram));
 
         /* Fill global PRAM */
 
@@ -3024,7 +3012,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Size varies with number of Tx threads */
         ugeth->thread_dat_tx_offset =
             qe_muram_alloc(numThreadsTxNumerical *
-                           sizeof(ucc_geth_thread_data_tx_t) +
+                           sizeof(struct ucc_geth_thread_data_tx) +
                            32 * (numThreadsTxNumerical == 1),
                            UCC_GETH_THREAD_DATA_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->thread_dat_tx_offset)) {
@@ -3036,7 +3024,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         ugeth->p_thread_data_tx =
-            (ucc_geth_thread_data_tx_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_thread_data_tx *) qe_muram_addr(ugeth->
                                                         thread_dat_tx_offset);
         out_be32(&ugeth->p_tx_glbl_pram->tqptr, ugeth->thread_dat_tx_offset);
 
@@ -3053,7 +3041,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Size varies with number of Tx queues */
         ugeth->send_q_mem_reg_offset =
             qe_muram_alloc(ug_info->numQueuesTx *
-                           sizeof(ucc_geth_send_queue_qd_t),
+                           sizeof(struct ucc_geth_send_queue_qd),
                            UCC_GETH_SEND_QUEUE_QUEUE_DESCRIPTOR_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->send_q_mem_reg_offset)) {
                 ugeth_err
@@ -3064,7 +3052,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         ugeth->p_send_q_mem_reg =
-            (ucc_geth_send_queue_mem_region_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_send_queue_mem_region *) qe_muram_addr(ugeth->
                         send_q_mem_reg_offset);
         out_be32(&ugeth->p_tx_glbl_pram->sqptr, ugeth->send_q_mem_reg_offset);
 
@@ -3073,7 +3061,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         for (i = 0; i < ug_info->numQueuesTx; i++) {
                 endOfRing =
                     ugeth->p_tx_bd_ring[i] + (ug_info->bdRingLenTx[i] -
-                                              1) * UCC_GETH_SIZE_OF_BD;
+                                              1) * sizeof(struct qe_bd);
                 if (ugeth->ug_info->uf_info.bd_mem_part == MEM_PART_SYSTEM) {
                         out_be32(&ugeth->p_send_q_mem_reg->sqqd[i].bd_ring_base,
                                  (u32) virt_to_phys(ugeth->p_tx_bd_ring[i]));
@@ -3096,7 +3084,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         if (ug_info->numQueuesTx > 1) {
         /* scheduler exists only if more than 1 tx queue */
                 ugeth->scheduler_offset =
-                    qe_muram_alloc(sizeof(ucc_geth_scheduler_t),
+                    qe_muram_alloc(sizeof(struct ucc_geth_scheduler),
                                    UCC_GETH_SCHEDULER_ALIGNMENT);
                 if (IS_MURAM_ERR(ugeth->scheduler_offset)) {
                         ugeth_err
@@ -3107,12 +3095,12 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 }
 
                 ugeth->p_scheduler =
-                    (ucc_geth_scheduler_t *) qe_muram_addr(ugeth->
+                    (struct ucc_geth_scheduler *) qe_muram_addr(ugeth->
                                                            scheduler_offset);
                 out_be32(&ugeth->p_tx_glbl_pram->schedulerbasepointer,
                          ugeth->scheduler_offset);
                 /* Zero out p_scheduler */
-                memset(ugeth->p_scheduler, 0, sizeof(ucc_geth_scheduler_t));
+                memset(ugeth->p_scheduler, 0, sizeof(struct ucc_geth_scheduler));
 
                 /* Set values in scheduler */
                 out_be32(&ugeth->p_scheduler->mblinterval,
@@ -3144,7 +3132,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
             statisticsMode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_TX) {
                 ugeth->tx_fw_statistics_pram_offset =
                     qe_muram_alloc(sizeof
-                                   (ucc_geth_tx_firmware_statistics_pram_t),
+                                   (struct ucc_geth_tx_firmware_statistics_pram),
                                    UCC_GETH_TX_STATISTICS_ALIGNMENT);
                 if (IS_MURAM_ERR(ugeth->tx_fw_statistics_pram_offset)) {
                         ugeth_err
@@ -3154,11 +3142,11 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                         return -ENOMEM;
                 }
                 ugeth->p_tx_fw_statistics_pram =
-                    (ucc_geth_tx_firmware_statistics_pram_t *)
+                    (struct ucc_geth_tx_firmware_statistics_pram *)
                     qe_muram_addr(ugeth->tx_fw_statistics_pram_offset);
                 /* Zero out p_tx_fw_statistics_pram */
                 memset(ugeth->p_tx_fw_statistics_pram,
-                       0, sizeof(ucc_geth_tx_firmware_statistics_pram_t));
+                       0, sizeof(struct ucc_geth_tx_firmware_statistics_pram));
         }
 
         /* temoder */
@@ -3183,7 +3171,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Rx global PRAM */
         /* Allocate global rx parameter RAM page */
         ugeth->rx_glbl_pram_offset =
-            qe_muram_alloc(sizeof(ucc_geth_rx_global_pram_t),
+            qe_muram_alloc(sizeof(struct ucc_geth_rx_global_pram),
                            UCC_GETH_RX_GLOBAL_PRAM_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->rx_glbl_pram_offset)) {
                 ugeth_err
@@ -3193,10 +3181,10 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 return -ENOMEM;
         }
         ugeth->p_rx_glbl_pram =
-            (ucc_geth_rx_global_pram_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_rx_global_pram *) qe_muram_addr(ugeth->
                                                         rx_glbl_pram_offset);
         /* Zero out p_rx_glbl_pram */
-        memset(ugeth->p_rx_glbl_pram, 0, sizeof(ucc_geth_rx_global_pram_t));
+        memset(ugeth->p_rx_glbl_pram, 0, sizeof(struct ucc_geth_rx_global_pram));
 
         /* Fill global PRAM */
 
@@ -3204,7 +3192,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Size varies with number of Rx threads */
         ugeth->thread_dat_rx_offset =
             qe_muram_alloc(numThreadsRxNumerical *
-                           sizeof(ucc_geth_thread_data_rx_t),
+                           sizeof(struct ucc_geth_thread_data_rx),
                            UCC_GETH_THREAD_DATA_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->thread_dat_rx_offset)) {
                 ugeth_err
@@ -3215,7 +3203,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         ugeth->p_thread_data_rx =
-            (ucc_geth_thread_data_rx_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_thread_data_rx *) qe_muram_addr(ugeth->
                                                         thread_dat_rx_offset);
         out_be32(&ugeth->p_rx_glbl_pram->rqptr, ugeth->thread_dat_rx_offset);
 
@@ -3227,7 +3215,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
             statisticsMode & UCC_GETH_STATISTICS_GATHERING_MODE_FIRMWARE_RX) {
                 ugeth->rx_fw_statistics_pram_offset =
                     qe_muram_alloc(sizeof
-                                   (ucc_geth_rx_firmware_statistics_pram_t),
+                                   (struct ucc_geth_rx_firmware_statistics_pram),
                                    UCC_GETH_RX_STATISTICS_ALIGNMENT);
                 if (IS_MURAM_ERR(ugeth->rx_fw_statistics_pram_offset)) {
                         ugeth_err
@@ -3237,11 +3225,11 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                         return -ENOMEM;
                 }
                 ugeth->p_rx_fw_statistics_pram =
-                    (ucc_geth_rx_firmware_statistics_pram_t *)
+                    (struct ucc_geth_rx_firmware_statistics_pram *)
                     qe_muram_addr(ugeth->rx_fw_statistics_pram_offset);
                 /* Zero out p_rx_fw_statistics_pram */
                 memset(ugeth->p_rx_fw_statistics_pram, 0,
-                       sizeof(ucc_geth_rx_firmware_statistics_pram_t));
+                       sizeof(struct ucc_geth_rx_firmware_statistics_pram));
         }
 
         /* intCoalescingPtr */
@@ -3249,7 +3237,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Size varies with number of Rx queues */
         ugeth->rx_irq_coalescing_tbl_offset =
             qe_muram_alloc(ug_info->numQueuesRx *
-                           sizeof(ucc_geth_rx_interrupt_coalescing_entry_t),
+                           sizeof(struct ucc_geth_rx_interrupt_coalescing_entry),
                            UCC_GETH_RX_INTERRUPT_COALESCING_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->rx_irq_coalescing_tbl_offset)) {
                 ugeth_err
@@ -3260,7 +3248,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         ugeth->p_rx_irq_coalescing_tbl =
-            (ucc_geth_rx_interrupt_coalescing_table_t *)
+            (struct ucc_geth_rx_interrupt_coalescing_table *)
             qe_muram_addr(ugeth->rx_irq_coalescing_tbl_offset);
         out_be32(&ugeth->p_rx_glbl_pram->intcoalescingptr,
                  ugeth->rx_irq_coalescing_tbl_offset);
@@ -3300,7 +3288,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 l3qt = 0;
                 for (i = 0; i < 8; i++)
                         l3qt |= (ug_info->l3qt[j + i] << (28 - 4 * i));
-                out_be32(&ugeth->p_rx_glbl_pram->l3qt[j], l3qt);
+                out_be32(&ugeth->p_rx_glbl_pram->l3qt[j/8], l3qt);
         }
 
         /* vlantype */
@@ -3316,8 +3304,8 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Size varies with number of Rx queues */
         ugeth->rx_bd_qs_tbl_offset =
             qe_muram_alloc(ug_info->numQueuesRx *
-                           (sizeof(ucc_geth_rx_bd_queues_entry_t) +
-                            sizeof(ucc_geth_rx_prefetched_bds_t)),
+                           (sizeof(struct ucc_geth_rx_bd_queues_entry) +
+                            sizeof(struct ucc_geth_rx_prefetched_bds)),
                            UCC_GETH_RX_BD_QUEUES_ALIGNMENT);
         if (IS_MURAM_ERR(ugeth->rx_bd_qs_tbl_offset)) {
                 ugeth_err
@@ -3328,14 +3316,14 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         ugeth->p_rx_bd_qs_tbl =
-            (ucc_geth_rx_bd_queues_entry_t *) qe_muram_addr(ugeth->
+            (struct ucc_geth_rx_bd_queues_entry *) qe_muram_addr(ugeth->
                                     rx_bd_qs_tbl_offset);
         out_be32(&ugeth->p_rx_glbl_pram->rbdqptr, ugeth->rx_bd_qs_tbl_offset);
         /* Zero out p_rx_bd_qs_tbl */
         memset(ugeth->p_rx_bd_qs_tbl,
                0,
-               ug_info->numQueuesRx * (sizeof(ucc_geth_rx_bd_queues_entry_t) +
-                                       sizeof(ucc_geth_rx_prefetched_bds_t)));
+               ug_info->numQueuesRx * (sizeof(struct ucc_geth_rx_bd_queues_entry) +
+                                       sizeof(struct ucc_geth_rx_prefetched_bds)));
 
         /* Setup the table */
         /* Assume BD rings are already established */
@@ -3406,7 +3394,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 /* Allocate memory for extended filtering Mode Global
                 Parameters */
                 ugeth->exf_glbl_param_offset =
-                    qe_muram_alloc(sizeof(ucc_geth_exf_global_pram_t),
+                    qe_muram_alloc(sizeof(struct ucc_geth_exf_global_pram),
                 UCC_GETH_RX_EXTENDED_FILTERING_GLOBAL_PARAMETERS_ALIGNMENT);
                 if (IS_MURAM_ERR(ugeth->exf_glbl_param_offset)) {
                         ugeth_err
@@ -3417,7 +3405,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 }
 
                 ugeth->p_exf_glbl_param =
-                    (ucc_geth_exf_global_pram_t *) qe_muram_addr(ugeth->
+                    (struct ucc_geth_exf_global_pram *) qe_muram_addr(ugeth->
                                  exf_glbl_param_offset);
                 out_be32(&ugeth->p_rx_glbl_pram->exfGlobalParam,
                          ugeth->exf_glbl_param_offset);
@@ -3439,7 +3427,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                         INIT_LIST_HEAD(&ugeth->ind_hash_q);
                 }
                 p_82xx_addr_filt =
-                    (ucc_geth_82xx_address_filtering_pram_t *) ugeth->
+                    (struct ucc_geth_82xx_address_filtering_pram *) ugeth->
                     p_rx_glbl_pram->addressfiltering;
 
                 ugeth_82xx_filtering_clear_all_addr_in_hash(ugeth,
@@ -3462,7 +3450,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
          * allocated resources can be released when the channel is freed.
          */
         if (!(ugeth->p_init_enet_param_shadow =
-             (ucc_geth_init_pram_t *) kmalloc(sizeof(ucc_geth_init_pram_t),
+             (struct ucc_geth_init_pram *) kmalloc(sizeof(struct ucc_geth_init_pram),
                                               GFP_KERNEL))) {
                 ugeth_err
                     ("%s: Can not allocate memory for"
@@ -3472,7 +3460,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
         /* Zero out *p_init_enet_param_shadow */
         memset((char *)ugeth->p_init_enet_param_shadow,
-               0, sizeof(ucc_geth_init_pram_t));
+               0, sizeof(struct ucc_geth_init_pram));
 
         /* Fill shadow InitEnet command parameter structure */
 
@@ -3506,7 +3494,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
         ugeth->p_init_enet_param_shadow->largestexternallookupkeysize =
             ug_info->largestexternallookupkeysize;
-        size = sizeof(ucc_geth_thread_rx_pram_t);
+        size = sizeof(struct ucc_geth_thread_rx_pram);
         if (ug_info->rxExtendedFiltering) {
                 size += THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING;
                 if (ug_info->largestexternallookupkeysize ==
@@ -3537,7 +3525,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
              fill_init_enet_entries(ugeth,
                                     &(ugeth->p_init_enet_param_shadow->
                                       txthread[0]), numThreadsTxNumerical,
-                                    sizeof(ucc_geth_thread_tx_pram_t),
+                                    sizeof(struct ucc_geth_thread_tx_pram),
                                     UCC_GETH_THREAD_TX_PRAM_ALIGNMENT,
                                     ug_info->riscTx, 0)) != 0) {
                 ugeth_err("%s: Can not fill p_init_enet_param_shadow.",
@@ -3557,7 +3545,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         }
 
         /* Allocate InitEnet command parameter structure */
-        init_enet_pram_offset = qe_muram_alloc(sizeof(ucc_geth_init_pram_t), 4);
+        init_enet_pram_offset = qe_muram_alloc(sizeof(struct ucc_geth_init_pram), 4);
         if (IS_MURAM_ERR(init_enet_pram_offset)) {
                 ugeth_err
                     ("%s: Can not allocate DPRAM memory for p_init_enet_pram.",
@@ -3566,7 +3554,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
                 return -ENOMEM;
         }
         p_init_enet_pram =
-            (ucc_geth_init_pram_t *) qe_muram_addr(init_enet_pram_offset);
+            (struct ucc_geth_init_pram *) qe_muram_addr(init_enet_pram_offset);
 
         /* Copy shadow InitEnet command parameter structure into PRAM */
         p_init_enet_pram->resinit1 = ugeth->p_init_enet_param_shadow->resinit1;
@@ -3591,7 +3579,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
         /* Issue QE command */
         cecr_subblock =
             ucc_fast_get_qe_cr_subblock(ugeth->ug_info->uf_info.ucc_num);
-        qe_issue_cmd(command, cecr_subblock, (u8) QE_CR_PROTOCOL_ETHERNET,
+        qe_issue_cmd(command, cecr_subblock, QE_CR_PROTOCOL_ETHERNET,
                      init_enet_pram_offset);
 
         /* Free InitEnet command parameter */
@@ -3603,7 +3591,7 @@ static int ucc_geth_startup(ucc_geth_private_t *ugeth)
 /* returns a net_device_stats structure pointer */
 static struct net_device_stats *ucc_geth_get_stats(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
 
         return &(ugeth->stats);
 }
@@ -3614,7 +3602,7 @@ static struct net_device_stats *ucc_geth_get_stats(struct net_device *dev)
  * starting over will fix the problem. */
 static void ucc_geth_timeout(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
 
@@ -3634,7 +3622,7 @@ static void ucc_geth_timeout(struct net_device *dev)
 /* It is pointed to by the dev->hard_start_xmit function pointer */
 static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
         u8 *bd;                 /* BD pointer */
         u32 bd_status;
         u8 txQ = 0;
@@ -3647,7 +3635,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* Start from the next BD that should be filled */
         bd = ugeth->txBd[txQ];
-        bd_status = BD_STATUS_AND_LENGTH(bd);
+        bd_status = in_be32((u32 *)bd);
         /* Save the skb pointer so we can free it later */
         ugeth->tx_skbuff[txQ][ugeth->skb_curtx[txQ]] = skb;
 
@@ -3657,20 +3645,21 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
              1) & TX_RING_MOD_MASK(ugeth->ug_info->bdRingLenTx[txQ]);
 
         /* set up the buffer descriptor */
-        BD_BUFFER_SET(bd,
+        out_be32(&((struct qe_bd *)bd)->buf,
                       dma_map_single(NULL, skb->data, skb->len, DMA_TO_DEVICE));
 
-        //printk(KERN_DEBUG"skb->data is 0x%x\n",skb->data);
+        /* printk(KERN_DEBUG"skb->data is 0x%x\n",skb->data); */
 
         bd_status = (bd_status & T_W) | T_R | T_I | T_L | skb->len;
 
-        BD_STATUS_AND_LENGTH_SET(bd, bd_status);
+        /* set bd status and length */
+        out_be32((u32 *)bd, bd_status);
 
         dev->trans_start = jiffies;
 
         /* Move to next BD in the ring */
         if (!(bd_status & T_W))
-                ugeth->txBd[txQ] = bd + UCC_GETH_SIZE_OF_BD;
+                ugeth->txBd[txQ] = bd + sizeof(struct qe_bd);
         else
                 ugeth->txBd[txQ] = ugeth->p_tx_bd_ring[txQ];
 
@@ -3695,7 +3684,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
-static int ucc_geth_rx(ucc_geth_private_t *ugeth, u8 rxQ, int rx_work_limit)
+static int ucc_geth_rx(struct ucc_geth_private *ugeth, u8 rxQ, int rx_work_limit)
 {
         struct sk_buff *skb;
         u8 *bd;
@@ -3709,11 +3698,11 @@ static int ucc_geth_rx(ucc_geth_private_t *ugeth, u8 rxQ, int rx_work_limit)
         /* collect received buffers */
         bd = ugeth->rxBd[rxQ];
 
-        bd_status = BD_STATUS_AND_LENGTH(bd);
+        bd_status = in_be32((u32 *)bd);
 
         /* while there are received buffers and BD is full (~R_E) */
         while (!((bd_status & (R_E)) || (--rx_work_limit < 0))) {
-                bdBuffer = (u8 *) BD_BUFFER(bd);
+                bdBuffer = (u8 *) in_be32(&((struct qe_bd *)bd)->buf);
                 length = (u16) ((bd_status & BD_LENGTH_MASK) - 4);
                 skb = ugeth->rx_skbuff[rxQ][ugeth->skb_currx[rxQ]];
 
@@ -3768,9 +3757,9 @@ static int ucc_geth_rx(ucc_geth_private_t *ugeth, u8 rxQ, int rx_work_limit)
                 if (bd_status & R_W)
                         bd = ugeth->p_rx_bd_ring[rxQ];
                 else
-                        bd += UCC_GETH_SIZE_OF_BD;
+                        bd += sizeof(struct qe_bd);
 
-                bd_status = BD_STATUS_AND_LENGTH(bd);
+                bd_status = in_be32((u32 *)bd);
         }
 
         ugeth->rxBd[rxQ] = bd;
@@ -3781,12 +3770,12 @@ static int ucc_geth_rx(ucc_geth_private_t *ugeth, u8 rxQ, int rx_work_limit)
 static int ucc_geth_tx(struct net_device *dev, u8 txQ)
 {
         /* Start from the next BD that should be filled */
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
         u8 *bd;                 /* BD pointer */
         u32 bd_status;
 
         bd = ugeth->confBd[txQ];
-        bd_status = BD_STATUS_AND_LENGTH(bd);
+        bd_status = in_be32((u32 *)bd);
 
         /* Normal processing. */
         while ((bd_status & T_R) == 0) {
@@ -3813,7 +3802,7 @@ static int ucc_geth_tx(struct net_device *dev, u8 txQ)
 
                 /* Advance the confirmation BD pointer */
                 if (!(bd_status & T_W))
-                        ugeth->confBd[txQ] += UCC_GETH_SIZE_OF_BD;
+                        ugeth->confBd[txQ] += sizeof(struct qe_bd);
                 else
                         ugeth->confBd[txQ] = ugeth->p_tx_bd_ring[txQ];
         }
@@ -3823,7 +3812,7 @@ static int ucc_geth_tx(struct net_device *dev, u8 txQ)
 #ifdef CONFIG_UGETH_NAPI
 static int ucc_geth_poll(struct net_device *dev, int *budget)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
         int howmany;
         int rx_work_limit = *budget;
         u8 rxQ = 0;
@@ -3847,9 +3836,9 @@ static int ucc_geth_poll(struct net_device *dev, int *budget)
 static irqreturn_t ucc_geth_irq_handler(int irq, void *info)
 {
         struct net_device *dev = (struct net_device *)info;
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
-        ucc_fast_private_t *uccf;
-        ucc_geth_info_t *ug_info;
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct ucc_fast_private *uccf;
+        struct ucc_geth_info *ug_info;
         register u32 ucce = 0;
         register u32 bit_mask = UCCE_RXBF_SINGLE_MASK;
         register u32 tx_mask = UCCE_TXBF_SINGLE_MASK;
@@ -3912,7 +3901,7 @@ static irqreturn_t ucc_geth_irq_handler(int irq, void *info)
 static irqreturn_t phy_interrupt(int irq, void *dev_id)
 {
         struct net_device *dev = (struct net_device *)dev_id;
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
 
@@ -3932,8 +3921,8 @@ static irqreturn_t phy_interrupt(int irq, void *dev_id)
 static void ugeth_phy_change(void *data)
 {
         struct net_device *dev = (struct net_device *)data;
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
-        ucc_geth_t *ug_regs;
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct ucc_geth *ug_regs;
         int result = 0;
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
@@ -3963,7 +3952,7 @@ static void ugeth_phy_change(void *data)
 static void ugeth_phy_timer(unsigned long data)
 {
         struct net_device *dev = (struct net_device *)data;
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
 
         schedule_work(&ugeth->tq);
 
@@ -3979,7 +3968,7 @@ static void ugeth_phy_timer(unsigned long data)
 static void ugeth_phy_startup_timer(unsigned long data)
 {
         struct ugeth_mii_info *mii_info = (struct ugeth_mii_info *)data;
-        ucc_geth_private_t *ugeth = netdev_priv(mii_info->dev);
+        struct ucc_geth_private *ugeth = netdev_priv(mii_info->dev);
         static int secondary = UGETH_AN_TIMEOUT;
         int result;
 
@@ -4034,7 +4023,7 @@ static void ugeth_phy_startup_timer(unsigned long data)
 /* Returns 0 for success. */
 static int ucc_geth_open(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
         int err;
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
@@ -4111,7 +4100,7 @@ static int ucc_geth_open(struct net_device *dev)
 /* Stops the kernel queue, and halts the controller */
 static int ucc_geth_close(struct net_device *dev)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
 
@@ -4130,30 +4119,53 @@ static int ucc_geth_close(struct net_device *dev)
 
 const struct ethtool_ops ucc_geth_ethtool_ops = { };
 
-static int ucc_geth_probe(struct device *device)
+static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *match)
 {
-        struct platform_device *pdev = to_platform_device(device);
-        struct ucc_geth_platform_data *ugeth_pdata;
+        struct device *device = &ofdev->dev;
+        struct device_node *np = ofdev->node;
         struct net_device *dev = NULL;
         struct ucc_geth_private *ugeth = NULL;
         struct ucc_geth_info *ug_info;
-        int err;
+        struct resource res;
+        struct device_node *phy;
+        int err, ucc_num, phy_interface;
         static int mii_mng_configured = 0;
+        const phandle *ph;
+        const unsigned int *prop;
 
         ugeth_vdbg("%s: IN", __FUNCTION__);
 
-        ugeth_pdata = (struct ucc_geth_platform_data *)pdev->dev.platform_data;
+        prop = get_property(np, "device-id", NULL);
+        ucc_num = *prop - 1;
+        if ((ucc_num < 0) || (ucc_num > 7))
+                return -ENODEV;
+
+        ug_info = &ugeth_info[ucc_num];
+        ug_info->uf_info.ucc_num = ucc_num;
+        prop = get_property(np, "rx-clock", NULL);
+        ug_info->uf_info.rx_clock = *prop;
+        prop = get_property(np, "tx-clock", NULL);
+        ug_info->uf_info.tx_clock = *prop;
+        err = of_address_to_resource(np, 0, &res);
+        if (err)
+                return -EINVAL;
+
+        ug_info->uf_info.regs = res.start;
+        ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
+
+        ph = get_property(np, "phy-handle", NULL);
+        phy = of_find_node_by_phandle(*ph);
 
-        ug_info = &ugeth_info[pdev->id];
-        ug_info->uf_info.ucc_num = pdev->id;
-        ug_info->uf_info.rx_clock = ugeth_pdata->rx_clock;
-        ug_info->uf_info.tx_clock = ugeth_pdata->tx_clock;
-        ug_info->uf_info.regs = ugeth_pdata->phy_reg_addr;
-        ug_info->uf_info.irq = platform_get_irq(pdev, 0);
-        ug_info->phy_address = ugeth_pdata->phy_id;
-        ug_info->enet_interface = ugeth_pdata->phy_interface;
-        ug_info->board_flags = ugeth_pdata->board_flags;
-        ug_info->phy_interrupt = ugeth_pdata->phy_interrupt;
+        if (phy == NULL)
+                return -ENODEV;
+
+        prop = get_property(phy, "reg", NULL);
+        ug_info->phy_address = *prop;
+        prop = get_property(phy, "interface", NULL);
+        ug_info->enet_interface = *prop;
+        ug_info->phy_interrupt = irq_of_parse_and_map(phy, 0);
+        ug_info->board_flags = (ug_info->phy_interrupt == NO_IRQ)?
+                        0:FSL_UGETH_BRD_HAS_PHY_INTR;
 
         printk(KERN_INFO "ucc_geth: UCC%1d at 0x%8x (irq = %d) \n",
                 ug_info->uf_info.ucc_num + 1, ug_info->uf_info.regs,
@@ -4161,12 +4173,44 @@ static int ucc_geth_probe(struct device *device)
 
         if (ug_info == NULL) {
                 ugeth_err("%s: [%d] Missing additional data!", __FUNCTION__,
-                          pdev->id);
+                          ucc_num);
                 return -ENODEV;
         }
 
+        /* FIXME: Work around for early chip rev.               */
+        /* There's a bug in initial chip rev(s) in the RGMII ac */
+        /* timing.                                              */
+        /* The following compensates by writing to the reserved */
+        /* QE Port Output Hold Registers (CPOH1?).              */
+        prop = get_property(phy, "interface", NULL);
+        phy_interface = *prop;
+        if ((phy_interface == ENET_1000_RGMII) ||
+                        (phy_interface == ENET_100_RGMII) ||
+                        (phy_interface == ENET_10_RGMII)) {
+                struct device_node *soc;
+                phys_addr_t immrbase = -1;
+                u32 *tmp_reg;
+                u32 tmp_val;
+
+                soc = of_find_node_by_type(NULL, "soc");
+                if (soc) {
+                        unsigned int size;
+                        const void *prop = get_property(soc, "reg", &size);
+                        immrbase = of_translate_address(soc, prop);
+                        of_node_put(soc);
+                };
+
+                tmp_reg = (u32 *) ioremap(immrbase + 0x14A8, 0x4);
+                tmp_val = in_be32(tmp_reg);
+                if (ucc_num == 1)
+                        out_be32(tmp_reg, tmp_val | 0x00003000);
+                else if (ucc_num == 2)
+                        out_be32(tmp_reg, tmp_val | 0x0c000000);
+                iounmap(tmp_reg);
+        }
+
         if (!mii_mng_configured) {
-                ucc_set_qe_mux_mii_mng(ug_info->uf_info.ucc_num);
+                ucc_set_qe_mux_mii_mng(ucc_num);
                 mii_mng_configured = 1;
         }
 
@@ -4213,13 +4257,14 @@ static int ucc_geth_probe(struct device *device)
 
         ugeth->ug_info = ug_info;
         ugeth->dev = dev;
-        memcpy(dev->dev_addr, ugeth_pdata->mac_addr, 6);
+        memcpy(dev->dev_addr, get_property(np, "mac-address", NULL), 6);
 
         return 0;
 }
 
-static int ucc_geth_remove(struct device *device)
+static int ucc_geth_remove(struct of_device* ofdev)
 {
+        struct device *device = &ofdev->dev;
         struct net_device *dev = dev_get_drvdata(device);
         struct ucc_geth_private *ugeth = netdev_priv(dev);
 
@@ -4230,28 +4275,38 @@ static int ucc_geth_remove(struct device *device)
         return 0;
 }
 
-/* Structure for a device driver */
-static struct device_driver ucc_geth_driver = {
-        .name = DRV_NAME,
-        .bus = &platform_bus_type,
-        .probe = ucc_geth_probe,
-        .remove = ucc_geth_remove,
+static struct of_device_id ucc_geth_match[] = {
+        {
+                .type = "network",
+                .compatible = "ucc_geth",
+        },
+        {},
+};
+
+MODULE_DEVICE_TABLE(of, ucc_geth_match);
+
+static struct of_platform_driver ucc_geth_driver = {
+        .name           = DRV_NAME,
+        .match_table    = ucc_geth_match,
+        .probe          = ucc_geth_probe,
+        .remove         = ucc_geth_remove,
 };
 
 static int __init ucc_geth_init(void)
 {
         int i;
+
         printk(KERN_INFO "ucc_geth: " DRV_DESC "\n");
         for (i = 0; i < 8; i++)
                 memcpy(&(ugeth_info[i]), &ugeth_primary_info,
                        sizeof(ugeth_primary_info));
 
-        return driver_register(&ucc_geth_driver);
+        return of_register_driver(&ucc_geth_driver);
 }
 
 static void __exit ucc_geth_exit(void)
 {
-        driver_unregister(&ucc_geth_driver);
+        of_unregister_driver(&ucc_geth_driver);
 }
 
 module_init(ucc_geth_init);
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 005965f5dd9b..a66561253593 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -36,24 +36,24 @@
 #define ENET_INIT_PARAM_MAX_ENTRIES_RX  9
 #define ENET_INIT_PARAM_MAX_ENTRIES_TX  8
 
-typedef struct ucc_mii_mng {
+struct ucc_mii_mng {
         u32 miimcfg;            /* MII management configuration reg */
         u32 miimcom;            /* MII management command reg */
         u32 miimadd;            /* MII management address reg */
         u32 miimcon;            /* MII management control reg */
         u32 miimstat;           /* MII management status reg */
         u32 miimind;            /* MII management indication reg */
-} __attribute__ ((packed)) ucc_mii_mng_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth {
-        ucc_fast_t uccf;
+struct ucc_geth {
+        struct ucc_fast uccf;
 
         u32 maccfg1;            /* mac configuration reg. 1 */
         u32 maccfg2;            /* mac configuration reg. 2 */
         u32 ipgifg;             /* interframe gap reg.  */
         u32 hafdup;             /* half-duplex reg.  */
         u8 res1[0x10];
-        ucc_mii_mng_t miimng;   /* MII management structure */
+        struct ucc_mii_mng miimng;      /* MII management structure */
         u32 ifctl;              /* interface control reg */
         u32 ifstat;             /* interface statux reg */
         u32 macstnaddr1;        /* mac station address part 1 reg */
@@ -111,7 +111,7 @@ typedef struct ucc_geth {
         u32 scar;               /* Statistics carry register */
         u32 scam;               /* Statistics caryy mask register */
         u8 res5[0x200 - 0x1c4];
-} __attribute__ ((packed)) ucc_geth_t;
+} __attribute__ ((packed));
 
 /* UCC GETH TEMODR Register */
 #define TEMODER_TX_RMON_STATISTICS_ENABLE       0x0100  /* enable Tx statistics
@@ -508,39 +508,39 @@ typedef struct ucc_geth {
 /* UCC GETH UDSR (Data Synchronization Register) */
 #define UDSR_MAGIC                              0x067E
 
-typedef struct ucc_geth_thread_data_tx {
+struct ucc_geth_thread_data_tx {
         u8 res0[104];
-} __attribute__ ((packed)) ucc_geth_thread_data_tx_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_thread_data_rx {
+struct ucc_geth_thread_data_rx {
         u8 res0[40];
-} __attribute__ ((packed)) ucc_geth_thread_data_rx_t;
+} __attribute__ ((packed));
 
 /* Send Queue Queue-Descriptor */
-typedef struct ucc_geth_send_queue_qd {
+struct ucc_geth_send_queue_qd {
         u32 bd_ring_base;       /* pointer to BD ring base address */
         u8 res0[0x8];
         u32 last_bd_completed_address;/* initialize to last entry in BD ring */
         u8 res1[0x30];
-} __attribute__ ((packed)) ucc_geth_send_queue_qd_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_send_queue_mem_region {
-        ucc_geth_send_queue_qd_t sqqd[NUM_TX_QUEUES];
-} __attribute__ ((packed)) ucc_geth_send_queue_mem_region_t;
+struct ucc_geth_send_queue_mem_region {
+        struct ucc_geth_send_queue_qd sqqd[NUM_TX_QUEUES];
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_thread_tx_pram {
+struct ucc_geth_thread_tx_pram {
         u8 res0[64];
-} __attribute__ ((packed)) ucc_geth_thread_tx_pram_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_thread_rx_pram {
+struct ucc_geth_thread_rx_pram {
         u8 res0[128];
-} __attribute__ ((packed)) ucc_geth_thread_rx_pram_t;
+} __attribute__ ((packed));
 
 #define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING        64
 #define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_8      64
 #define THREAD_RX_PRAM_ADDITIONAL_FOR_EXTENDED_FILTERING_16     96
 
-typedef struct ucc_geth_scheduler {
+struct ucc_geth_scheduler {
         u16 cpucount0;          /* CPU packet counter */
         u16 cpucount1;          /* CPU packet counter */
         u16 cecount0;           /* QE packet counter */
@@ -574,9 +574,9 @@ typedef struct ucc_geth_scheduler {
                                       /**< weight factor for queues   */
         u32 minw;               /* temporary variable handled by QE */
         u8 res1[0x70 - 0x64];
-} __attribute__ ((packed)) ucc_geth_scheduler_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_tx_firmware_statistics_pram {
+struct ucc_geth_tx_firmware_statistics_pram {
         u32 sicoltx;            /* single collision */
         u32 mulcoltx;           /* multiple collision */
         u32 latecoltxfr;        /* late collision */
@@ -596,9 +596,9 @@ typedef struct ucc_geth_tx_firmware_statistics_pram {
                                    and 1518 octets */
         u32 txpktsjumbo;        /* total packets (including bad) between 1024
                                    and MAXLength octets */
-} __attribute__ ((packed)) ucc_geth_tx_firmware_statistics_pram_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_firmware_statistics_pram {
+struct ucc_geth_rx_firmware_statistics_pram {
         u32 frrxfcser;          /* frames with crc error */
         u32 fraligner;          /* frames with alignment error */
         u32 inrangelenrxer;     /* in range length error */
@@ -630,33 +630,33 @@ typedef struct ucc_geth_rx_firmware_statistics_pram {
                                    replaced */
         u32 insertvlan;         /* total frames that had their VLAN tag
                                    inserted */
-} __attribute__ ((packed)) ucc_geth_rx_firmware_statistics_pram_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_interrupt_coalescing_entry {
+struct ucc_geth_rx_interrupt_coalescing_entry {
         u32 interruptcoalescingmaxvalue;        /* interrupt coalescing max
                                                    value */
         u32 interruptcoalescingcounter; /* interrupt coalescing counter,
                                            initialize to
                                            interruptcoalescingmaxvalue */
-} __attribute__ ((packed)) ucc_geth_rx_interrupt_coalescing_entry_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_interrupt_coalescing_table {
-        ucc_geth_rx_interrupt_coalescing_entry_t coalescingentry[NUM_RX_QUEUES];
+struct ucc_geth_rx_interrupt_coalescing_table {
+        struct ucc_geth_rx_interrupt_coalescing_entry coalescingentry[NUM_RX_QUEUES];
                                        /**< interrupt coalescing entry */
-} __attribute__ ((packed)) ucc_geth_rx_interrupt_coalescing_table_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_prefetched_bds {
-        qe_bd_t bd[NUM_BDS_IN_PREFETCHED_BDS];  /* prefetched bd */
-} __attribute__ ((packed)) ucc_geth_rx_prefetched_bds_t;
+struct ucc_geth_rx_prefetched_bds {
+        struct qe_bd bd[NUM_BDS_IN_PREFETCHED_BDS];     /* prefetched bd */
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_bd_queues_entry {
+struct ucc_geth_rx_bd_queues_entry {
         u32 bdbaseptr;          /* BD base pointer */
         u32 bdptr;              /* BD pointer */
         u32 externalbdbaseptr;  /* external BD base pointer */
         u32 externalbdptr;      /* external BD pointer */
-} __attribute__ ((packed)) ucc_geth_rx_bd_queues_entry_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_tx_global_pram {
+struct ucc_geth_tx_global_pram {
         u16 temoder;
         u8 res0[0x38 - 0x02];
         u32 sqptr;              /* a base pointer to send queue memory region */
@@ -670,15 +670,15 @@ typedef struct ucc_geth_tx_global_pram {
         u32 tqptr;              /* a base pointer to the Tx Queues Memory
                                    Region */
         u8 res2[0x80 - 0x74];
-} __attribute__ ((packed)) ucc_geth_tx_global_pram_t;
+} __attribute__ ((packed));
 
 /* structure representing Extended Filtering Global Parameters in PRAM */
-typedef struct ucc_geth_exf_global_pram {
+struct ucc_geth_exf_global_pram {
         u32 l2pcdptr;           /* individual address filter, high */
         u8 res0[0x10 - 0x04];
-} __attribute__ ((packed)) ucc_geth_exf_global_pram_t;
+} __attribute__ ((packed));
 
-typedef struct ucc_geth_rx_global_pram {
+struct ucc_geth_rx_global_pram {
         u32 remoder;            /* ethernet mode reg. */
         u32 rqptr;              /* base pointer to the Rx Queues Memory Region*/
         u32 res0[0x1];
@@ -710,12 +710,12 @@ typedef struct ucc_geth_rx_global_pram {
         u32 exfGlobalParam;     /* base address for extended filtering global
                                    parameters */
         u8 res6[0x100 - 0xC4];  /* Initialize to zero */
-} __attribute__ ((packed)) ucc_geth_rx_global_pram_t;
+} __attribute__ ((packed));
 
 #define GRACEFUL_STOP_ACKNOWLEDGE_RX            0x01
 
 /* structure representing InitEnet command */
-typedef struct ucc_geth_init_pram {
+struct ucc_geth_init_pram {
         u8 resinit1;
         u8 resinit2;
         u8 resinit3;
@@ -729,7 +729,7 @@ typedef struct ucc_geth_init_pram {
         u32 txglobal;           /* tx global */
         u32 txthread[ENET_INIT_PARAM_MAX_ENTRIES_TX];   /* tx threads */
         u8 res3[0x1];
-} __attribute__ ((packed)) ucc_geth_init_pram_t;
+} __attribute__ ((packed));
 
 #define ENET_INIT_PARAM_RGF_SHIFT               (32 - 4)
 #define ENET_INIT_PARAM_TGF_SHIFT               (32 - 8)
@@ -746,27 +746,27 @@ typedef struct ucc_geth_init_pram {
 #define ENET_INIT_PARAM_MAGIC_RES_INIT5         0x0400
 
 /* structure representing 82xx Address Filtering Enet Address in PRAM */
-typedef struct ucc_geth_82xx_enet_address {
+struct ucc_geth_82xx_enet_address {
         u8 res1[0x2];
         u16 h;                  /* address (MSB) */
         u16 m;                  /* address */
         u16 l;                  /* address (LSB) */
-} __attribute__ ((packed)) ucc_geth_82xx_enet_address_t;
+} __attribute__ ((packed));
 
 /* structure representing 82xx Address Filtering PRAM */
-typedef struct ucc_geth_82xx_address_filtering_pram {
+struct ucc_geth_82xx_address_filtering_pram {
         u32 iaddr_h;            /* individual address filter, high */
         u32 iaddr_l;            /* individual address filter, low */
         u32 gaddr_h;            /* group address filter, high */
         u32 gaddr_l;            /* group address filter, low */
-        ucc_geth_82xx_enet_address_t taddr;
-        ucc_geth_82xx_enet_address_t paddr[NUM_OF_PADDRS];
+        struct ucc_geth_82xx_enet_address taddr;
+        struct ucc_geth_82xx_enet_address paddr[NUM_OF_PADDRS];
         u8 res0[0x40 - 0x38];
-} __attribute__ ((packed)) ucc_geth_82xx_address_filtering_pram_t;
+} __attribute__ ((packed));
 
 /* GETH Tx firmware statistics structure, used when calling
    UCC_GETH_GetStatistics. */
-typedef struct ucc_geth_tx_firmware_statistics {
+struct ucc_geth_tx_firmware_statistics {
         u32 sicoltx;            /* single collision */
         u32 mulcoltx;           /* multiple collision */
         u32 latecoltxfr;        /* late collision */
@@ -786,11 +786,11 @@ typedef struct ucc_geth_tx_firmware_statistics {
                                    and 1518 octets */
         u32 txpktsjumbo;        /* total packets (including bad) between 1024
                                    and MAXLength octets */
-} __attribute__ ((packed)) ucc_geth_tx_firmware_statistics_t;
+} __attribute__ ((packed));
 
 /* GETH Rx firmware statistics structure, used when calling
    UCC_GETH_GetStatistics. */
-typedef struct ucc_geth_rx_firmware_statistics {
+struct ucc_geth_rx_firmware_statistics {
         u32 frrxfcser;          /* frames with crc error */
         u32 fraligner;          /* frames with alignment error */
         u32 inrangelenrxer;     /* in range length error */
@@ -822,11 +822,11 @@ typedef struct ucc_geth_rx_firmware_statistics {
                                    replaced */
         u32 insertvlan;         /* total frames that had their VLAN tag
                                    inserted */
-} __attribute__ ((packed)) ucc_geth_rx_firmware_statistics_t;
+} __attribute__ ((packed));
 
 /* GETH hardware statistics structure, used when calling
    UCC_GETH_GetStatistics. */
-typedef struct ucc_geth_hardware_statistics {
+struct ucc_geth_hardware_statistics {
         u32 tx64;               /* Total number of frames (including bad
                                    frames) transmitted that were exactly of the
                                    minimal length (64 for un tagged, 68 for
@@ -871,7 +871,7 @@ typedef struct ucc_geth_hardware_statistics {
         u32 rbca;               /* Total number of frames received succesfully
                                    that had destination address equal to the
                                    broadcast address */
-} __attribute__ ((packed)) ucc_geth_hardware_statistics_t;
+} __attribute__ ((packed));
 
 /* UCC GETH Tx errors returned via TxConf callback */
 #define TX_ERRORS_DEF      0x0200
@@ -1013,21 +1013,21 @@ typedef struct ucc_geth_hardware_statistics {
                                 (MIIMCFG_MANAGEMENT_CLOCK_DIVIDE_BY_112)
 
 /* Ethernet speed */
-typedef enum enet_speed {
+enum enet_speed {
         ENET_SPEED_10BT,        /* 10 Base T */
         ENET_SPEED_100BT,       /* 100 Base T */
         ENET_SPEED_1000BT       /* 1000 Base T */
-} enet_speed_e;
+};
 
 /* Ethernet Address Type. */
-typedef enum enet_addr_type {
+enum enet_addr_type {
         ENET_ADDR_TYPE_INDIVIDUAL,
         ENET_ADDR_TYPE_GROUP,
         ENET_ADDR_TYPE_BROADCAST
-} enet_addr_type_e;
+};
 
 /* TBI / MII Set Register */
-typedef enum enet_tbi_mii_reg {
+enum enet_tbi_mii_reg {
         ENET_TBI_MII_CR = 0x00, /* Control (CR ) */
         ENET_TBI_MII_SR = 0x01, /* Status (SR ) */
         ENET_TBI_MII_ANA = 0x04,        /* AN advertisement (ANA ) */
@@ -1040,10 +1040,10 @@ typedef enum enet_tbi_mii_reg {
         ENET_TBI_MII_EXST = 0x0F,       /* Extended status (EXST ) */
         ENET_TBI_MII_JD = 0x10, /* Jitter diagnostics (JD ) */
         ENET_TBI_MII_TBICON = 0x11      /* TBI control (TBICON ) */
-} enet_tbi_mii_reg_e;
+};
 
 /* UCC GETH 82xx Ethernet Address Recognition Location */
-typedef enum ucc_geth_enet_address_recognition_location {
+enum ucc_geth_enet_address_recognition_location {
         UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_STATION_ADDRESS,/* station
                                                                       address */
         UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_PADDR_FIRST, /* additional
@@ -1065,10 +1065,10 @@ typedef enum ucc_geth_enet_address_recognition_location {
         UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_GROUP_HASH,  /* group hash */
         UCC_GETH_ENET_ADDRESS_RECOGNITION_LOCATION_INDIVIDUAL_HASH /* individual
                                                                       hash */
-} ucc_geth_enet_address_recognition_location_e;
+};
 
 /* UCC GETH vlan operation tagged */
-typedef enum ucc_geth_vlan_operation_tagged {
+enum ucc_geth_vlan_operation_tagged {
         UCC_GETH_VLAN_OPERATION_TAGGED_NOP = 0x0,       /* Tagged - nop */
         UCC_GETH_VLAN_OPERATION_TAGGED_REPLACE_VID_PORTION_OF_Q_TAG
                 = 0x1,  /* Tagged - replace vid portion of q tag */
@@ -1076,18 +1076,18 @@ typedef enum ucc_geth_vlan_operation_tagged {
                 = 0x2,  /* Tagged - if vid0 replace vid with default value  */
         UCC_GETH_VLAN_OPERATION_TAGGED_EXTRACT_Q_TAG_FROM_FRAME
                 = 0x3   /* Tagged - extract q tag from frame */
-} ucc_geth_vlan_operation_tagged_e;
+};
 
 /* UCC GETH vlan operation non-tagged */
-typedef enum ucc_geth_vlan_operation_non_tagged {
+enum ucc_geth_vlan_operation_non_tagged {
         UCC_GETH_VLAN_OPERATION_NON_TAGGED_NOP = 0x0,   /* Non tagged - nop */
         UCC_GETH_VLAN_OPERATION_NON_TAGGED_Q_TAG_INSERT = 0x1   /* Non tagged -
                                                                    q tag insert
                                                                  */
-} ucc_geth_vlan_operation_non_tagged_e;
+};
 
 /* UCC GETH Rx Quality of Service Mode */
-typedef enum ucc_geth_qos_mode {
+enum ucc_geth_qos_mode {
         UCC_GETH_QOS_MODE_DEFAULT = 0x0,        /* default queue */
         UCC_GETH_QOS_MODE_QUEUE_NUM_FROM_L2_CRITERIA = 0x1,     /* queue
                                                                    determined
@@ -1097,11 +1097,11 @@ typedef enum ucc_geth_qos_mode {
                                                                    determined
                                                                    by L3
                                                                    criteria */
-} ucc_geth_qos_mode_e;
+};
 
 /* UCC GETH Statistics Gathering Mode - These are bit flags, 'or' them together
    for combined functionality */
-typedef enum ucc_geth_statistics_gathering_mode {
+enum ucc_geth_statistics_gathering_mode {
         UCC_GETH_STATISTICS_GATHERING_MODE_NONE = 0x00000000,   /* No
                                                                    statistics
                                                                    gathering */
@@ -1122,10 +1122,10 @@ typedef enum ucc_geth_statistics_gathering_mode {
                                                                       statistics
                                                                       gathering
                                                                     */
-} ucc_geth_statistics_gathering_mode_e;
+};
 
 /* UCC GETH Pad and CRC Mode - Note, Padding without CRC is not possible */
-typedef enum ucc_geth_maccfg2_pad_and_crc_mode {
+enum ucc_geth_maccfg2_pad_and_crc_mode {
         UCC_GETH_PAD_AND_CRC_MODE_NONE
                 = MACCFG2_PAD_AND_CRC_MODE_NONE,        /* Neither Padding
                                                            short frames
@@ -1135,61 +1135,59 @@ typedef enum ucc_geth_maccfg2_pad_and_crc_mode {
                                                            CRC only */
         UCC_GETH_PAD_AND_CRC_MODE_PAD_AND_CRC =
             MACCFG2_PAD_AND_CRC_MODE_PAD_AND_CRC
-} ucc_geth_maccfg2_pad_and_crc_mode_e;
+};
 
 /* UCC GETH upsmr Flow Control Mode */
-typedef enum ucc_geth_flow_control_mode {
+enum ucc_geth_flow_control_mode {
         UPSMR_AUTOMATIC_FLOW_CONTROL_MODE_NONE = 0x00000000,    /* No automatic
                                                                    flow control
                                                                  */
         UPSMR_AUTOMATIC_FLOW_CONTROL_MODE_PAUSE_WHEN_EMERGENCY
                 = 0x00004000    /* Send pause frame when RxFIFO reaches its
                                    emergency threshold */
-} ucc_geth_flow_control_mode_e;
+};
 
 /* UCC GETH number of threads */
-typedef enum ucc_geth_num_of_threads {
+enum ucc_geth_num_of_threads {
         UCC_GETH_NUM_OF_THREADS_1 = 0x1,        /* 1 */
         UCC_GETH_NUM_OF_THREADS_2 = 0x2,        /* 2 */
         UCC_GETH_NUM_OF_THREADS_4 = 0x0,        /* 4 */
         UCC_GETH_NUM_OF_THREADS_6 = 0x3,        /* 6 */
         UCC_GETH_NUM_OF_THREADS_8 = 0x4 /* 8 */
-} ucc_geth_num_of_threads_e;
+};
 
 /* UCC GETH number of station addresses */
-typedef enum ucc_geth_num_of_station_addresses {
+enum ucc_geth_num_of_station_addresses {
         UCC_GETH_NUM_OF_STATION_ADDRESSES_1,    /* 1 */
         UCC_GETH_NUM_OF_STATION_ADDRESSES_5     /* 5 */
-} ucc_geth_num_of_station_addresses_e;
-
-typedef u8 enet_addr_t[ENET_NUM_OCTETS_PER_ADDRESS];
+};
 
 /* UCC GETH 82xx Ethernet Address Container */
-typedef struct enet_addr_container {
-        enet_addr_t address;    /* ethernet address */
-        ucc_geth_enet_address_recognition_location_e location;  /* location in
+struct enet_addr_container {
+        u8 address[ENET_NUM_OCTETS_PER_ADDRESS];        /* ethernet address */
+        enum ucc_geth_enet_address_recognition_location location;       /* location in
                                                                    82xx address
                                                                    recognition
                                                                    hardware */
         struct list_head node;
-} enet_addr_container_t;
+};
 
-#define ENET_ADDR_CONT_ENTRY(ptr) list_entry(ptr, enet_addr_container_t, node)
+#define ENET_ADDR_CONT_ENTRY(ptr) list_entry(ptr, struct enet_addr_container, node)
 
 /* UCC GETH Termination Action Descriptor (TAD) structure. */
-typedef struct ucc_geth_tad_params {
+struct ucc_geth_tad_params {
         int rx_non_dynamic_extended_features_mode;
         int reject_frame;
-        ucc_geth_vlan_operation_tagged_e vtag_op;
-        ucc_geth_vlan_operation_non_tagged_e vnontag_op;
-        ucc_geth_qos_mode_e rqos;
+        enum ucc_geth_vlan_operation_tagged vtag_op;
+        enum ucc_geth_vlan_operation_non_tagged vnontag_op;
+        enum ucc_geth_qos_mode rqos;
         u8 vpri;
         u16 vid;
-} ucc_geth_tad_params_t;
+};
 
 /* GETH protocol initialization structure */
-typedef struct ucc_geth_info {
-        ucc_fast_info_t uf_info;
+struct ucc_geth_info {
+        struct ucc_fast_info uf_info;
         u8 numQueuesTx;
         u8 numQueuesRx;
         int ipCheckSumCheck;
@@ -1251,51 +1249,51 @@ typedef struct ucc_geth_info {
         u8 iphoffset[TX_IP_OFFSET_ENTRY_MAX];
         u16 bdRingLenTx[NUM_TX_QUEUES];
         u16 bdRingLenRx[NUM_RX_QUEUES];
-        enet_interface_e enet_interface;
-        ucc_geth_num_of_station_addresses_e numStationAddresses;
-         qe_fltr_largest_external_tbl_lookup_key_size_e
+        enum enet_interface enet_interface;
+        enum ucc_geth_num_of_station_addresses numStationAddresses;
+        enum qe_fltr_largest_external_tbl_lookup_key_size
             largestexternallookupkeysize;
-        ucc_geth_statistics_gathering_mode_e statisticsMode;
-        ucc_geth_vlan_operation_tagged_e vlanOperationTagged;
-        ucc_geth_vlan_operation_non_tagged_e vlanOperationNonTagged;
-        ucc_geth_qos_mode_e rxQoSMode;
-        ucc_geth_flow_control_mode_e aufc;
-        ucc_geth_maccfg2_pad_and_crc_mode_e padAndCrc;
-        ucc_geth_num_of_threads_e numThreadsTx;
-        ucc_geth_num_of_threads_e numThreadsRx;
-        qe_risc_allocation_e riscTx;
-        qe_risc_allocation_e riscRx;
-} ucc_geth_info_t;
+        enum ucc_geth_statistics_gathering_mode statisticsMode;
+        enum ucc_geth_vlan_operation_tagged vlanOperationTagged;
+        enum ucc_geth_vlan_operation_non_tagged vlanOperationNonTagged;
+        enum ucc_geth_qos_mode rxQoSMode;
+        enum ucc_geth_flow_control_mode aufc;
+        enum ucc_geth_maccfg2_pad_and_crc_mode padAndCrc;
+        enum ucc_geth_num_of_threads numThreadsTx;
+        enum ucc_geth_num_of_threads numThreadsRx;
+        enum qe_risc_allocation riscTx;
+        enum qe_risc_allocation riscRx;
+};
 
 /* structure representing UCC GETH */
-typedef struct ucc_geth_private {
-        ucc_geth_info_t *ug_info;
-        ucc_fast_private_t *uccf;
+struct ucc_geth_private {
+        struct ucc_geth_info *ug_info;
+        struct ucc_fast_private *uccf;
         struct net_device *dev;
         struct net_device_stats stats;  /* linux network statistics */
-        ucc_geth_t *ug_regs;
-        ucc_geth_init_pram_t *p_init_enet_param_shadow;
-        ucc_geth_exf_global_pram_t *p_exf_glbl_param;
+        struct ucc_geth *ug_regs;
+        struct ucc_geth_init_pram *p_init_enet_param_shadow;
+        struct ucc_geth_exf_global_pram *p_exf_glbl_param;
         u32 exf_glbl_param_offset;
-        ucc_geth_rx_global_pram_t *p_rx_glbl_pram;
+        struct ucc_geth_rx_global_pram *p_rx_glbl_pram;
         u32 rx_glbl_pram_offset;
-        ucc_geth_tx_global_pram_t *p_tx_glbl_pram;
+        struct ucc_geth_tx_global_pram *p_tx_glbl_pram;
         u32 tx_glbl_pram_offset;
-        ucc_geth_send_queue_mem_region_t *p_send_q_mem_reg;
+        struct ucc_geth_send_queue_mem_region *p_send_q_mem_reg;
         u32 send_q_mem_reg_offset;
-        ucc_geth_thread_data_tx_t *p_thread_data_tx;
+        struct ucc_geth_thread_data_tx *p_thread_data_tx;
         u32 thread_dat_tx_offset;
-        ucc_geth_thread_data_rx_t *p_thread_data_rx;
+        struct ucc_geth_thread_data_rx *p_thread_data_rx;
         u32 thread_dat_rx_offset;
-        ucc_geth_scheduler_t *p_scheduler;
+        struct ucc_geth_scheduler *p_scheduler;
         u32 scheduler_offset;
-        ucc_geth_tx_firmware_statistics_pram_t *p_tx_fw_statistics_pram;
+        struct ucc_geth_tx_firmware_statistics_pram *p_tx_fw_statistics_pram;
         u32 tx_fw_statistics_pram_offset;
-        ucc_geth_rx_firmware_statistics_pram_t *p_rx_fw_statistics_pram;
+        struct ucc_geth_rx_firmware_statistics_pram *p_rx_fw_statistics_pram;
         u32 rx_fw_statistics_pram_offset;
-        ucc_geth_rx_interrupt_coalescing_table_t *p_rx_irq_coalescing_tbl;
+        struct ucc_geth_rx_interrupt_coalescing_table *p_rx_irq_coalescing_tbl;
         u32 rx_irq_coalescing_tbl_offset;
-        ucc_geth_rx_bd_queues_entry_t *p_rx_bd_qs_tbl;
+        struct ucc_geth_rx_bd_queues_entry *p_rx_bd_qs_tbl;
         u32 rx_bd_qs_tbl_offset;
         u8 *p_tx_bd_ring[NUM_TX_QUEUES];
         u32 tx_bd_ring_offset[NUM_TX_QUEUES];
@@ -1308,7 +1306,7 @@ typedef struct ucc_geth_private {
         u16 cpucount[NUM_TX_QUEUES];
         volatile u16 *p_cpucount[NUM_TX_QUEUES];
         int indAddrRegUsed[NUM_OF_PADDRS];
-        enet_addr_t paddr[NUM_OF_PADDRS];
+        u8 paddr[NUM_OF_PADDRS][ENET_NUM_OCTETS_PER_ADDRESS];   /* ethernet address */
         u8 numGroupAddrInHash;
         u8 numIndAddrInHash;
         u8 numIndAddrInReg;
@@ -1334,6 +1332,6 @@ typedef struct ucc_geth_private {
         int oldspeed;
         int oldduplex;
         int oldlink;
-} ucc_geth_private_t;
+};
 
 #endif                          /* __UCC_GETH_H__ */
diff --git a/drivers/net/ucc_geth_phy.c b/drivers/net/ucc_geth_phy.c
index 67260eb3188a..5360ec05eaa3 100644
--- a/drivers/net/ucc_geth_phy.c
+++ b/drivers/net/ucc_geth_phy.c
@@ -42,7 +42,6 @@
 
 #include "ucc_geth.h"
 #include "ucc_geth_phy.h"
-#include <platforms/83xx/mpc8360e_pb.h>
 
 #define ugphy_printk(level, format, arg...)  \
         printk(level format "\n", ## arg)
@@ -72,16 +71,14 @@ static int genmii_read_status(struct ugeth_mii_info *mii_info);
 u16 phy_read(struct ugeth_mii_info *mii_info, u16 regnum);
 void phy_write(struct ugeth_mii_info *mii_info, u16 regnum, u16 val);
 
-static u8 *bcsr_regs = NULL;
-
 /* Write value to the PHY for this device to the register at regnum, */
 /* waiting until the write is done before it returns.  All PHY */
 /* configuration has to be done through the TSEC1 MIIM regs */
 void write_phy_reg(struct net_device *dev, int mii_id, int regnum, int value)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
-        ucc_mii_mng_t *mii_regs;
-        enet_tbi_mii_reg_e mii_reg = (enet_tbi_mii_reg_e) regnum;
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct ucc_mii_mng *mii_regs;
+        enum enet_tbi_mii_reg mii_reg = (enum enet_tbi_mii_reg) regnum;
         u32 tmp_reg;
 
         ugphy_vdbg("%s: IN", __FUNCTION__);
@@ -116,9 +113,9 @@ void write_phy_reg(struct net_device *dev, int mii_id, int regnum, int value)
 /* configuration has to be done through the TSEC1 MIIM regs */
 int read_phy_reg(struct net_device *dev, int mii_id, int regnum)
 {
-        ucc_geth_private_t *ugeth = netdev_priv(dev);
-        ucc_mii_mng_t *mii_regs;
-        enet_tbi_mii_reg_e mii_reg = (enet_tbi_mii_reg_e) regnum;
+        struct ucc_geth_private *ugeth = netdev_priv(dev);
+        struct ucc_mii_mng *mii_regs;
+        enum enet_tbi_mii_reg mii_reg = (enum enet_tbi_mii_reg) regnum;
         u32 tmp_reg;
         u16 value;
 
@@ -634,11 +631,6 @@ static void dm9161_close(struct ugeth_mii_info *mii_info)
 
 static int dm9161_ack_interrupt(struct ugeth_mii_info *mii_info)
 {
-/* FIXME: This lines are for BUG fixing in the mpc8325.
-Remove this from here when it's fixed */
-        if (bcsr_regs == NULL)
-                bcsr_regs = (u8 *) ioremap(BCSR_PHYS_ADDR, BCSR_SIZE);
-        bcsr_regs[14] |= 0x40;
         ugphy_vdbg("%s: IN", __FUNCTION__);
 
         /* Clear the interrupts by reading the reg */
@@ -650,12 +642,6 @@ Remove this from here when it's fixed */
 
 static int dm9161_config_intr(struct ugeth_mii_info *mii_info)
 {
-/* FIXME: This lines are for BUG fixing in the mpc8325.
-Remove this from here when it's fixed */
-        if (bcsr_regs == NULL) {
-                bcsr_regs = (u8 *) ioremap(BCSR_PHYS_ADDR, BCSR_SIZE);
-                bcsr_regs[14] &= ~0x40;
-        }
         ugphy_vdbg("%s: IN", __FUNCTION__);
 
         if (mii_info->interrupts == MII_INTERRUPT_ENABLED)
diff --git a/drivers/net/ucc_geth_phy.h b/drivers/net/ucc_geth_phy.h
index 2f98b8f1bb0a..f5740783670f 100644
--- a/drivers/net/ucc_geth_phy.h
+++ b/drivers/net/ucc_geth_phy.h
@@ -126,7 +126,7 @@ struct ugeth_mii_info {
         /* And management functions */
         struct phy_info *phyinfo;
 
-        ucc_mii_mng_t *mii_regs;
+        struct ucc_mii_mng *mii_regs;
 
         /* forced speed & duplex (no autoneg)
          * partner speed & duplex & pause (autoneg)
diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig
index 58b7efbb0750..b5d0d7fb647a 100644
--- a/drivers/net/wan/Kconfig
+++ b/drivers/net/wan/Kconfig
@@ -127,7 +127,7 @@ config LANMEDIA
 # There is no way to detect a Sealevel board. Force it modular
 config SEALEVEL_4021
         tristate "Sealevel Systems 4021 support"
-        depends on WAN && ISA && m && ISA_DMA_API
+        depends on WAN && ISA && m && ISA_DMA_API && INET
         help
           This is a driver for the Sealevel Systems ACB 56 serial I/O adapter.
 
diff --git a/drivers/net/wan/n2.c b/drivers/net/wan/n2.c
index dcf46add3adf..5c322dfb79f6 100644
--- a/drivers/net/wan/n2.c
+++ b/drivers/net/wan/n2.c
@@ -500,7 +500,7 @@ static int __init n2_init(void)
 #ifdef MODULE
                 printk(KERN_INFO "n2: no card initialized\n");
 #endif
-                return -ENOSYS; /* no parameters specified, abort */
+                return -EINVAL; /* no parameters specified, abort */
         }
 
         printk(KERN_INFO "%s\n", version);
@@ -538,11 +538,11 @@ static int __init n2_init(void)
                         n2_run(io, irq, ram, valid[0], valid[1]);
 
                 if (*hw == '\x0')
-                        return first_card ? 0 : -ENOSYS;
+                        return first_card ? 0 : -EINVAL;
         }while(*hw++ == ':');
 
         printk(KERN_ERR "n2: invalid hardware parameters\n");
-        return first_card ? 0 : -ENOSYS;
+        return first_card ? 0 : -EINVAL;
 }
 
 
diff --git a/drivers/net/wan/pc300_drv.c b/drivers/net/wan/pc300_drv.c
index 5823e3bca178..36d1c3ff7078 100644
--- a/drivers/net/wan/pc300_drv.c
+++ b/drivers/net/wan/pc300_drv.c
@@ -2867,7 +2867,6 @@ static int ch_config(pc300dev_t * d)
         uclong clktype = chan->conf.phys_settings.clock_type;
         ucshort encoding = chan->conf.proto_settings.encoding;
         ucshort parity = chan->conf.proto_settings.parity;   
-        int tmc, br;
         ucchar md0, md2;
     
         /* Reset the channel */
@@ -2940,8 +2939,12 @@ static int ch_config(pc300dev_t * d)
                 case PC300_RSV:
                 case PC300_X21:
                         if (clktype == CLOCK_INT || clktype == CLOCK_TXINT) {
+                                int tmc, br;
+
                                 /* Calculate the clkrate parameters */
                                 tmc = clock_rate_calc(clkrate, card->hw.clock, &br);
+                                if (tmc < 0)
+                                        return -EIO;
                                 cpc_writeb(scabase + M_REG(TMCT, ch), tmc);
                                 cpc_writeb(scabase + M_REG(TXS, ch),
                                            (TXS_DTRXC | TXS_IBRG | br));
@@ -3097,14 +3100,16 @@ static int cpc_attach(struct net_device *dev, unsigned short encoding,
         return 0;
 }
 
-static void cpc_opench(pc300dev_t * d)
+static int cpc_opench(pc300dev_t * d)
 {
         pc300ch_t *chan = (pc300ch_t *) d->chan;
         pc300_t *card = (pc300_t *) chan->card;
-        int ch = chan->channel;
+        int ch = chan->channel, rc;
         void __iomem *scabase = card->hw.scabase;
 
-        ch_config(d);
+        rc = ch_config(d);
+        if (rc)
+                return rc;
 
         rx_config(d);
 
@@ -3113,6 +3118,8 @@ static void cpc_opench(pc300dev_t * d)
         /* Assert RTS and DTR */
         cpc_writeb(scabase + M_REG(CTL, ch),
                    cpc_readb(scabase + M_REG(CTL, ch)) & ~(CTL_RTS | CTL_DTR));
+
+        return 0;
 }
 
 static void cpc_closech(pc300dev_t * d)
@@ -3168,9 +3175,16 @@ int cpc_open(struct net_device *dev)
         }
 
         sprintf(ifr.ifr_name, "%s", dev->name);
-        cpc_opench(d);
+        result = cpc_opench(d);
+        if (result)
+                goto err_out;
+
         netif_start_queue(dev);
         return 0;
+
+err_out:
+        hdlc_close(dev);
+        return result;
 }
 
 static int cpc_close(struct net_device *dev)
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 0a33c8a56e13..efcdaf1c5f73 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -2897,6 +2897,8 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
                 goto err_out_map;
         }
         ai->wifidev = init_wifidev(ai, dev);
+        if (!ai->wifidev)
+                goto err_out_reg;
 
         set_bit(FLAG_REGISTERED,&ai->flags);
         airo_print_info(dev->name, "MAC enabled %x:%x:%x:%x:%x:%x",
@@ -2908,11 +2910,18 @@ static struct net_device *_init_airo_card( unsigned short irq, int port,
                 for( i = 0; i < MAX_FIDS; i++ )
                         ai->fids[i] = transmit_allocate(ai,AIRO_DEF_MTU,i>=MAX_FIDS/2);
 
-        setup_proc_entry( dev, dev->priv ); /* XXX check for failure */
+        if (setup_proc_entry(dev, dev->priv) < 0)
+                goto err_out_wifi;
+
         netif_start_queue(dev);
         SET_MODULE_OWNER(dev);
         return dev;
 
+err_out_wifi:
+        unregister_netdev(ai->wifidev);
+        free_netdev(ai->wifidev);
+err_out_reg:
+        unregister_netdev(dev);
 err_out_map:
         if (test_bit(FLAG_MPI,&ai->flags) && pci) {
                 pci_free_consistent(pci, PCI_SHARED_LEN, ai->shared, ai->shared_dma);
@@ -3089,7 +3098,8 @@ static int airo_thread(void *data) {
                                                 set_bit(JOB_AUTOWEP, &ai->jobs);
                                                 break;
                                         }
-                                        if (!kthread_should_stop()) {
+                                        if (!kthread_should_stop() &&
+                                            !freezing(current)) {
                                                 unsigned long wake_at;
                                                 if (!ai->expires || !ai->scan_timeout) {
                                                         wake_at = max(ai->expires,
@@ -3101,7 +3111,8 @@ static int airo_thread(void *data) {
                                                 schedule_timeout(wake_at - jiffies);
                                                 continue;
                                         }
-                                } else if (!kthread_should_stop()) {
+                                } else if (!kthread_should_stop() &&
+                                           !freezing(current)) {
                                         schedule();
                                         continue;
                                 }
@@ -4495,91 +4506,128 @@ static int setup_proc_entry( struct net_device *dev,
         apriv->proc_entry = create_proc_entry(apriv->proc_name,
                                               S_IFDIR|airo_perm,
                                               airo_entry);
-        apriv->proc_entry->uid = proc_uid;
-        apriv->proc_entry->gid = proc_gid;
-        apriv->proc_entry->owner = THIS_MODULE;
+        if (!apriv->proc_entry)
+                goto fail;
+        apriv->proc_entry->uid = proc_uid;
+        apriv->proc_entry->gid = proc_gid;
+        apriv->proc_entry->owner = THIS_MODULE;
 
         /* Setup the StatsDelta */
         entry = create_proc_entry("StatsDelta",
                                   S_IFREG | (S_IRUGO&proc_perm),
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_stats_delta;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_statsdelta_ops);
 
         /* Setup the Stats */
         entry = create_proc_entry("Stats",
                                   S_IFREG | (S_IRUGO&proc_perm),
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_stats;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_stats_ops);
 
         /* Setup the Status */
         entry = create_proc_entry("Status",
                                   S_IFREG | (S_IRUGO&proc_perm),
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_status;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_status_ops);
 
         /* Setup the Config */
         entry = create_proc_entry("Config",
                                   S_IFREG | proc_perm,
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_config;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_config_ops);
 
         /* Setup the SSID */
         entry = create_proc_entry("SSID",
                                   S_IFREG | proc_perm,
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_ssid;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_SSID_ops);
 
         /* Setup the APList */
         entry = create_proc_entry("APList",
                                   S_IFREG | proc_perm,
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_aplist;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_APList_ops);
 
         /* Setup the BSSList */
         entry = create_proc_entry("BSSList",
                                   S_IFREG | proc_perm,
                                   apriv->proc_entry);
+        if (!entry)
+                goto fail_bsslist;
         entry->uid = proc_uid;
         entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_BSSList_ops);
 
         /* Setup the WepKey */
         entry = create_proc_entry("WepKey",
                                   S_IFREG | proc_perm,
                                   apriv->proc_entry);
-        entry->uid = proc_uid;
-        entry->gid = proc_gid;
+        if (!entry)
+                goto fail_wepkey;
+        entry->uid = proc_uid;
+        entry->gid = proc_gid;
         entry->data = dev;
-        entry->owner = THIS_MODULE;
+        entry->owner = THIS_MODULE;
         SETPROC_OPS(entry, proc_wepkey_ops);
 
         return 0;
+
+fail_wepkey:
+        remove_proc_entry("BSSList", apriv->proc_entry);
+fail_bsslist:
+        remove_proc_entry("APList", apriv->proc_entry);
+fail_aplist:
+        remove_proc_entry("SSID", apriv->proc_entry);
+fail_ssid:
+        remove_proc_entry("Config", apriv->proc_entry);
+fail_config:
+        remove_proc_entry("Status", apriv->proc_entry);
+fail_status:
+        remove_proc_entry("Stats", apriv->proc_entry);
+fail_stats:
+        remove_proc_entry("StatsDelta", apriv->proc_entry);
+fail_stats_delta:
+        remove_proc_entry(apriv->proc_name, airo_entry);
+fail:
+        return -ENOMEM;
 }
 
 static int takedown_proc_entry( struct net_device *dev,
@@ -5924,7 +5972,6 @@ static int airo_get_essid(struct net_device *dev,
 
         /* Get the current SSID */
         memcpy(extra, status_rid.SSID, status_rid.SSIDlen);
-        extra[status_rid.SSIDlen] = '\0';
         /* If none, we may want to get the one that was set */
 
         /* Push it out ! */
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 31eed85de60f..0c07b8b7250d 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -1678,11 +1678,9 @@ static int atmel_get_essid(struct net_device *dev,
         /* Get the current SSID */
         if (priv->new_SSID_size != 0) {
                 memcpy(extra, priv->new_SSID, priv->new_SSID_size);
-                extra[priv->new_SSID_size] = '\0';
                 dwrq->length = priv->new_SSID_size;
         } else {
                 memcpy(extra, priv->SSID, priv->SSID_size);
-                extra[priv->SSID_size] = '\0';
                 dwrq->length = priv->SSID_size;
         }
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index 76e3aed4b471..978ed099e285 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -705,11 +705,30 @@ int bcm43xx_dma_init(struct bcm43xx_private *bcm)
         struct bcm43xx_dmaring *ring;
         int err = -ENOMEM;
         int dma64 = 0;
-        u32 sbtmstatehi;
+        u64 mask = bcm43xx_get_supported_dma_mask(bcm);
+        int nobits;
 
-        sbtmstatehi = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH);
-        if (sbtmstatehi & BCM43xx_SBTMSTATEHIGH_DMA64BIT)
+        if (mask == DMA_64BIT_MASK) {
                 dma64 = 1;
+                nobits = 64;
+        } else if (mask == DMA_32BIT_MASK)
+                nobits = 32;
+        else
+                nobits = 30;
+        err = pci_set_dma_mask(bcm->pci_dev, mask);
+        err |= pci_set_consistent_dma_mask(bcm->pci_dev, mask);
+        if (err) {
+#ifdef CONFIG_BCM43XX_PIO
+                printk(KERN_WARNING PFX "DMA not supported on this device."
+                                        " Falling back to PIO.\n");
+                bcm->__using_pio = 1;
+                return -ENOSYS;
+#else
+                printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
+                                    "Please recompile the driver with PIO support.\n");
+                return -ENODEV;
+#endif /* CONFIG_BCM43XX_PIO */
+        }
 
         /* setup TX DMA channels. */
         ring = bcm43xx_setup_dmaring(bcm, 0, 1, dma64);
@@ -755,8 +774,7 @@ int bcm43xx_dma_init(struct bcm43xx_private *bcm)
                 dma->rx_ring3 = ring;
         }
 
-        dprintk(KERN_INFO PFX "%s DMA initialized\n",
-                        dma64 ? "64-bit" : "32-bit");
+        dprintk(KERN_INFO PFX "%d-bit DMA initialized\n", nobits);
         err = 0;
 out:
         return err;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
index e04bcaddd1d0..d1105e569a41 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
@@ -4,6 +4,7 @@
 #include <linux/list.h>
 #include <linux/spinlock.h>
 #include <linux/workqueue.h>
+#include <linux/dma-mapping.h>
 #include <linux/linkage.h>
 #include <asm/atomic.h>
 
@@ -314,6 +315,23 @@ int bcm43xx_dma_tx(struct bcm43xx_private *bcm,
                    struct ieee80211_txb *txb);
 void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring);
 
+/* Helper function that returns the dma mask for this device. */
+static inline
+u64 bcm43xx_get_supported_dma_mask(struct bcm43xx_private *bcm)
+{
+        int dma64 = bcm43xx_read32(bcm, BCM43xx_CIR_SBTMSTATEHIGH) &
+                                   BCM43xx_SBTMSTATEHIGH_DMA64BIT;
+        u16 mmio_base = bcm43xx_dmacontroller_base(dma64, 0);
+        u32 mask = BCM43xx_DMA32_TXADDREXT_MASK;
+
+        if (dma64)
+                return DMA_64BIT_MASK;
+        bcm43xx_write32(bcm, mmio_base + BCM43xx_DMA32_TXCTL, mask);
+        if (bcm43xx_read32(bcm, mmio_base + BCM43xx_DMA32_TXCTL) & mask)
+                return DMA_32BIT_MASK;
+        return DMA_30BIT_MASK;
+}
+
 #else /* CONFIG_BCM43XX_DMA */
 
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_leds.c b/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
index c3f90c8563d9..7d383a27b927 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_leds.c
@@ -189,20 +189,24 @@ void bcm43xx_leds_update(struct bcm43xx_private *bcm, int activity)
                 case BCM43xx_LED_INACTIVE:
                         continue;
                 case BCM43xx_LED_OFF:
+                case BCM43xx_LED_BCM4303_3:
                         break;
                 case BCM43xx_LED_ON:
                         turn_on = 1;
                         break;
                 case BCM43xx_LED_ACTIVITY:
+                case BCM43xx_LED_BCM4303_0:
                         turn_on = activity;
                         break;
                 case BCM43xx_LED_RADIO_ALL:
                         turn_on = radio->enabled;
                         break;
                 case BCM43xx_LED_RADIO_A:
+                case BCM43xx_LED_BCM4303_2:
                         turn_on = (radio->enabled && phy->type == BCM43xx_PHYTYPE_A);
                         break;
                 case BCM43xx_LED_RADIO_B:
+                case BCM43xx_LED_BCM4303_1:
                         turn_on = (radio->enabled &&
                                    (phy->type == BCM43xx_PHYTYPE_B ||
                                     phy->type == BCM43xx_PHYTYPE_G));
@@ -242,7 +246,7 @@ void bcm43xx_leds_update(struct bcm43xx_private *bcm, int activity)
                         //TODO
                         break;
                 case BCM43xx_LED_ASSOC:
-                        if (bcm->softmac->associated)
+                        if (bcm->softmac->associnfo.associated)
                                 turn_on = 1;
                         break;
 #ifdef CONFIG_BCM43XX_DEBUG
@@ -257,7 +261,8 @@ void bcm43xx_leds_update(struct bcm43xx_private *bcm, int activity)
                         continue;
 #endif /* CONFIG_BCM43XX_DEBUG */
                 default:
-                        assert(0);
+                        dprintkl(KERN_INFO PFX "Bad value in leds_update,"
+                                " led->behaviour: 0x%x\n", led->behaviour);
                 };
 
                 if (led->activelow)
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_leds.h b/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
index d3716cf3aebc..811e14a81198 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_leds.h
@@ -46,6 +46,12 @@ enum { /* LED behaviour values */
         BCM43xx_LED_TEST_BLINKSLOW,
         BCM43xx_LED_TEST_BLINKMEDIUM,
         BCM43xx_LED_TEST_BLINKFAST,
+
+        /* Misc values for BCM4303 */
+        BCM43xx_LED_BCM4303_0 = 0x2B,
+        BCM43xx_LED_BCM4303_1 = 0x78,
+        BCM43xx_LED_BCM4303_2 = 0x2E,
+        BCM43xx_LED_BCM4303_3 = 0x19,
 };
 
 int bcm43xx_leds_init(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index bad3452ea893..a1b783813d8e 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -746,7 +746,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
         if (err)
                 goto err_ctlreg;
         spromctl |= 0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
         /* We must burn lots of CPU cycles here, but that does not
@@ -768,7 +768,7 @@ int bcm43xx_sprom_write(struct bcm43xx_private *bcm, const u16 *sprom)
                 mdelay(20);
         }
         spromctl &= ~0x10; /* SPROM WRITE enable. */
-        bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
+        err = bcm43xx_pci_write_config32(bcm, BCM43xx_PCICFG_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
         mdelay(500);
@@ -1463,6 +1463,23 @@ static void handle_irq_transmit_status(struct bcm43xx_private *bcm)
         }
 }
 
+static void drain_txstatus_queue(struct bcm43xx_private *bcm)
+{
+        u32 dummy;
+
+        if (bcm->current_core->rev < 5)
+                return;
+        /* Read all entries from the microcode TXstatus FIFO
+         * and throw them away.
+         */
+        while (1) {
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_0);
+                if (!dummy)
+                        break;
+                dummy = bcm43xx_read32(bcm, BCM43xx_MMIO_XMITSTAT_1);
+        }
+}
+
 static void bcm43xx_generate_noise_sample(struct bcm43xx_private *bcm)
 {
         bcm43xx_shm_write16(bcm, BCM43xx_SHM_SHARED, 0x408, 0x7F7F);
@@ -2925,10 +2942,13 @@ static int bcm43xx_wireless_core_init(struct bcm43xx_private *bcm,
                 bcm43xx_write16(bcm, 0x043C, 0x000C);
 
         if (active_wlcore) {
-                if (bcm43xx_using_pio(bcm))
+                if (bcm43xx_using_pio(bcm)) {
                         err = bcm43xx_pio_init(bcm);
-                else
+                } else {
                         err = bcm43xx_dma_init(bcm);
+                        if (err == -ENOSYS)
+                                err = bcm43xx_pio_init(bcm);
+                }
                 if (err)
                         goto err_chip_cleanup;
         }
@@ -3160,17 +3180,30 @@ static int estimate_periodic_work_badness(unsigned int state)
 static void bcm43xx_periodic_work_handler(void *d)
 {
         struct bcm43xx_private *bcm = d;
+        struct net_device *net_dev = bcm->net_dev;
         unsigned long flags;
         u32 savedirqs = 0;
         int badness;
+        unsigned long orig_trans_start = 0;
 
+        mutex_lock(&bcm->mutex);
         badness = estimate_periodic_work_badness(bcm->periodic_state);
         if (badness > BADNESS_LIMIT) {
                 /* Periodic work will take a long time, so we want it to
                  * be preemtible.
                  */
-                mutex_lock(&bcm->mutex);
-                netif_tx_disable(bcm->net_dev);
+
+                netif_tx_lock_bh(net_dev);
+                /* We must fake a started transmission here, as we are going to
+                 * disable TX. If we wouldn't fake a TX, it would be possible to
+                 * trigger the netdev watchdog, if the last real TX is already
+                 * some time on the past (slightly less than 5secs)
+                 */
+                orig_trans_start = net_dev->trans_start;
+                net_dev->trans_start = jiffies;
+                netif_stop_queue(net_dev);
+                netif_tx_unlock_bh(net_dev);
+
                 spin_lock_irqsave(&bcm->irq_lock, flags);
                 bcm43xx_mac_suspend(bcm);
                 if (bcm43xx_using_pio(bcm))
@@ -3182,7 +3215,6 @@ static void bcm43xx_periodic_work_handler(void *d)
                 /* Periodic work should take short time, so we want low
                  * locking overhead.
                  */
-                mutex_lock(&bcm->mutex);
                 spin_lock_irqsave(&bcm->irq_lock, flags);
         }
 
@@ -3196,6 +3228,7 @@ static void bcm43xx_periodic_work_handler(void *d)
                         bcm43xx_pio_thaw_txqueues(bcm);
                 bcm43xx_mac_enable(bcm);
                 netif_wake_queue(bcm->net_dev);
+                net_dev->trans_start = orig_trans_start;
         }
         mmiowb();
         spin_unlock_irqrestore(&bcm->irq_lock, flags);
@@ -3516,6 +3549,7 @@ int bcm43xx_select_wireless_core(struct bcm43xx_private *bcm,
         bcm43xx_macfilter_clear(bcm, BCM43xx_MACFILTER_ASSOC);
         bcm43xx_macfilter_set(bcm, BCM43xx_MACFILTER_SELF, (u8 *)(bcm->net_dev->dev_addr));
         bcm43xx_security_init(bcm);
+        drain_txstatus_queue(bcm);
         ieee80211softmac_start(bcm->net_dev);
 
         /* Let's go! Be careful after enabling the IRQs.
@@ -3993,8 +4027,6 @@ static int bcm43xx_init_private(struct bcm43xx_private *bcm,
                                 struct net_device *net_dev,
                                 struct pci_dev *pci_dev)
 {
-        int err;
-
         bcm43xx_set_status(bcm, BCM43xx_STAT_UNINIT);
         bcm->ieee = netdev_priv(net_dev);
         bcm->softmac = ieee80211_priv(net_dev);
@@ -4012,22 +4044,8 @@ static int bcm43xx_init_private(struct bcm43xx_private *bcm,
                      (void (*)(unsigned long))bcm43xx_interrupt_tasklet,
                      (unsigned long)bcm);
         tasklet_disable_nosync(&bcm->isr_tasklet);
-        if (modparam_pio) {
+        if (modparam_pio)
                 bcm->__using_pio = 1;
-        } else {
-                err = pci_set_dma_mask(pci_dev, DMA_30BIT_MASK);
-                err |= pci_set_consistent_dma_mask(pci_dev, DMA_30BIT_MASK);
-                if (err) {
-#ifdef CONFIG_BCM43XX_PIO
-                        printk(KERN_WARNING PFX "DMA not supported. Falling back to PIO.\n");
-                        bcm->__using_pio = 1;
-#else
-                        printk(KERN_ERR PFX "FATAL: DMA not supported and PIO not configured. "
-                                            "Recompile the driver with PIO support, please.\n");
-                        return -ENODEV;
-#endif /* CONFIG_BCM43XX_PIO */
-                }
-        }
         bcm->rts_threshold = BCM43xx_DEFAULT_RTS_THRESHOLD;
 
         /* default to sw encryption for now */
@@ -4208,7 +4226,11 @@ static int bcm43xx_resume(struct pci_dev *pdev)
         dprintk(KERN_INFO PFX "Resuming...\n");
 
         pci_set_power_state(pdev, 0);
-        pci_enable_device(pdev);
+        err = pci_enable_device(pdev);
+        if (err) {
+                printk(KERN_ERR PFX "Failure with pci_enable_device!\n");
+                return err;
+        }
         pci_restore_state(pdev);
 
         bcm43xx_chipset_attach(bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 9b7b15cf6561..d27016f8c736 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -847,7 +847,7 @@ static struct iw_statistics *bcm43xx_get_wireless_stats(struct net_device *net_d
         unsigned long flags;
 
         wstats = &bcm->stats.wstats;
-        if (!mac->associated) {
+        if (!mac->associnfo.associated) {
                 wstats->miss.beacon = 0;
 //              bcm->ieee->ieee_stats.tx_retry_limit_exceeded = 0; // FIXME: should this be cleared here?
                 wstats->discard.retries = 0;
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 686d895116de..f63909e4bc32 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -887,6 +887,13 @@ static struct pcmcia_device_id hostap_cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID123(
                 "U.S. Robotics", "IEEE 802.11b PC-CARD", "Version 01.02",
                 0xc7b8df9d, 0x1700d087, 0x4b74baa0),
+        PCMCIA_DEVICE_PROD_ID123(
+                "Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio",
+                "Ver. 1.00",
+                0x5cd01705, 0x4271660f, 0x9d08ee12),
+        PCMCIA_DEVICE_PROD_ID123(
+                "corega", "WL PCCL-11", "ISL37300P",
+                0xa21501a, 0x59868926, 0xc9049a39),
         PCMCIA_DEVICE_NULL
 };
 MODULE_DEVICE_TABLE(pcmcia, hostap_cs_ids);
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index 6dfa041be66d..bc81b13a5a2a 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -364,7 +364,7 @@ static int prism2_plx_check_cis(void __iomem *attr_mem, int attr_len,
 
         pos = 0;
         while (pos < CIS_MAX_LEN - 1 && cis[pos] != CISTPL_END) {
-                if (pos + cis[pos + 1] >= CIS_MAX_LEN)
+                if (pos + 2 + cis[pos + 1] > CIS_MAX_LEN)
                         goto cis_error;
 
                 switch (cis[pos]) {
@@ -391,7 +391,7 @@ static int prism2_plx_check_cis(void __iomem *attr_mem, int attr_len,
                         break;
 
                 case CISTPL_MANFID:
-                        if (cis[pos + 1] < 5)
+                        if (cis[pos + 1] < 4)
                                 goto cis_error;
                         manfid1 = cis[pos + 2] + (cis[pos + 3] << 8);
                         manfid2 = cis[pos + 4] + (cis[pos + 5] << 8);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index b779c7dcc1a8..336cabac13b3 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -2457,6 +2457,7 @@ void free_orinocodev(struct net_device *dev)
 /* Wireless extensions                                              */
 /********************************************************************/
 
+/* Return : < 0 -> error code ; >= 0 -> length */
 static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
                                 char buf[IW_ESSID_MAX_SIZE+1])
 {
@@ -2501,9 +2502,9 @@ static int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
         len = le16_to_cpu(essidbuf.len);
         BUG_ON(len > IW_ESSID_MAX_SIZE);
 
-        memset(buf, 0, IW_ESSID_MAX_SIZE+1);
+        memset(buf, 0, IW_ESSID_MAX_SIZE);
         memcpy(buf, p, len);
-        buf[len] = '\0';
+        err = len;
 
  fail_unlock:
         orinoco_unlock(priv, &flags);
@@ -3027,17 +3028,18 @@ static int orinoco_ioctl_getessid(struct net_device *dev,
 
         if (netif_running(dev)) {
                 err = orinoco_hw_get_essid(priv, &active, essidbuf);
-                if (err)
+                if (err < 0)
                         return err;
+                erq->length = err;
         } else {
                 if (orinoco_lock(priv, &flags) != 0)
                         return -EBUSY;
-                memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE + 1);
+                memcpy(essidbuf, priv->desired_essid, IW_ESSID_MAX_SIZE);
+                erq->length = strlen(priv->desired_essid);
                 orinoco_unlock(priv, &flags);
         }
 
         erq->flags = 1;
-        erq->length = strlen(essidbuf);
 
         return 0;
 }
@@ -3075,10 +3077,10 @@ static int orinoco_ioctl_getnick(struct net_device *dev,
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
 
-        memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE+1);
+        memcpy(nickbuf, priv->nick, IW_ESSID_MAX_SIZE);
         orinoco_unlock(priv, &flags);
 
-        nrq->length = strlen(nickbuf);
+        nrq->length = strlen(priv->nick);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 0b381d77015c..7fbfc9e41d07 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -1198,7 +1198,6 @@ static int ray_get_essid(struct net_device *dev,
 
         /* Get the essid that was set */
         memcpy(extra, local->sparm.b5.a_current_ess_id, IW_ESSID_MAX_SIZE);
-        extra[IW_ESSID_MAX_SIZE] = '\0';
 
         /* Push it out ! */
         dwrq->length = strlen(extra);
diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
index 30057a335a7b..36b29ff05814 100644
--- a/drivers/net/wireless/zd1201.c
+++ b/drivers/net/wireless/zd1201.c
@@ -193,10 +193,8 @@ static void zd1201_usbrx(struct urb *urb)
         struct sk_buff *skb;
         unsigned char type;
 
-        if (!zd) {
-                free = 1;
-                goto exit;
-        }
+        if (!zd)
+                return;
 
         switch(urb->status) {
                 case -EILSEQ:
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index 2d12837052b0..a7d29bddb298 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -1099,7 +1099,7 @@ static void link_led_handler(void *p)
         int r;
 
         spin_lock_irq(&mac->lock);
-        is_associated = sm->associated != 0;
+        is_associated = sm->associnfo.associated != 0;
         spin_unlock_irq(&mac->lock);
 
         r = zd_chip_control_leds(chip,
diff --git a/drivers/parport/parport_ip32.c b/drivers/parport/parport_ip32.c
index e3e19277030a..ec44efdbb84e 100644
--- a/drivers/parport/parport_ip32.c
+++ b/drivers/parport/parport_ip32.c
@@ -780,7 +780,7 @@ static irqreturn_t parport_ip32_interrupt(int irq, void *dev_id)
         enum parport_ip32_irq_mode irq_mode = priv->irq_mode;
         switch (irq_mode) {
         case PARPORT_IP32_IRQ_FWD:
-                parport_generic_irq(irq, p, regs);
+                parport_generic_irq(irq, p);
                 break;
         case PARPORT_IP32_IRQ_HERE:
                 parport_ip32_wakeup(p);
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index 30294127a0aa..5f1b9f58070e 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -19,7 +19,7 @@ config PCI_MSI
 
 config PCI_MULTITHREAD_PROBE
         bool "PCI Multi-threaded probe (EXPERIMENTAL)"
-        depends on PCI && EXPERIMENTAL
+        depends on PCI && EXPERIMENTAL && BROKEN
         help
           Say Y here if you want the PCI core to spawn a new thread for
           every PCI device that is probed.  This can cause a huge
@@ -55,7 +55,7 @@ config PCI_DEBUG
 config HT_IRQ
         bool "Interrupts on hypertransport devices"
         default y
-        depends on X86_LOCAL_APIC && X86_IO_APIC
+        depends on PCI && X86_LOCAL_APIC && X86_IO_APIC
         help
            This allows native hypertransport devices to use interrupts.
 
diff --git a/drivers/pci/hotplug/acpi_pcihp.c b/drivers/pci/hotplug/acpi_pcihp.c
index 51cb9f817c22..270a33cc08f6 100644
--- a/drivers/pci/hotplug/acpi_pcihp.c
+++ b/drivers/pci/hotplug/acpi_pcihp.c
@@ -29,10 +29,10 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <acpi/acpi.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/actypes.h>
-#include "pci_hotplug.h"
 
 #define MY_NAME "acpi_pcihp"
 
diff --git a/drivers/pci/hotplug/acpiphp.h b/drivers/pci/hotplug/acpiphp.h
index 7fff07e877c7..59c5b242d86d 100644
--- a/drivers/pci/hotplug/acpiphp.h
+++ b/drivers/pci/hotplug/acpiphp.h
@@ -38,7 +38,7 @@
 #include <linux/acpi.h>
 #include <linux/kobject.h>      /* for KOBJ_NAME_LEN */
 #include <linux/mutex.h>
-#include "pci_hotplug.h"
+#include <linux/pci_hotplug.h>
 
 #define dbg(format, arg...)                                     \
         do {                                                    \
diff --git a/drivers/pci/hotplug/acpiphp_core.c b/drivers/pci/hotplug/acpiphp_core.c
index e2fef60c2d06..c57d9d5ce84e 100644
--- a/drivers/pci/hotplug/acpiphp_core.c
+++ b/drivers/pci/hotplug/acpiphp_core.c
@@ -37,10 +37,10 @@
 
 #include <linux/kernel.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
-#include "pci_hotplug.h"
 #include "acpiphp.h"
 
 #define MY_NAME "acpiphp"
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 83e8e4412de5..16167b016266 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -45,11 +45,11 @@
 
 #include <linux/kernel.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/smp_lock.h>
 #include <linux/mutex.h>
 
 #include "../pci.h"
-#include "pci_hotplug.h"
 #include "acpiphp.h"
 
 static LIST_HEAD(bridge_list);
@@ -1807,8 +1807,8 @@ u8 acpiphp_get_power_status(struct acpiphp_slot *slot)
 
 
 /*
- * latch closed:  1
- * latch   open:  0
+ * latch   open:  1
+ * latch closed:  0
  */
 u8 acpiphp_get_latch_status(struct acpiphp_slot *slot)
 {
@@ -1816,7 +1816,7 @@ u8 acpiphp_get_latch_status(struct acpiphp_slot *slot)
 
         sta = get_slot_status(slot);
 
-        return (sta & ACPI_STA_SHOW_IN_UI) ? 1 : 0;
+        return (sta & ACPI_STA_SHOW_IN_UI) ? 0 : 1;
 }
 
 
diff --git a/drivers/pci/hotplug/acpiphp_ibm.c b/drivers/pci/hotplug/acpiphp_ibm.c
index d0a07d9ab30c..bd40aee10e16 100644
--- a/drivers/pci/hotplug/acpiphp_ibm.c
+++ b/drivers/pci/hotplug/acpiphp_ibm.c
@@ -35,7 +35,6 @@
 #include <linux/moduleparam.h>
 
 #include "acpiphp.h"
-#include "pci_hotplug.h"
 
 #define DRIVER_VERSION  "1.0.1"
 #define DRIVER_AUTHOR   "Irene Zubarev <zubarev@us.ibm.com>, Vernon Mauery <vernux@us.ibm.com>"
diff --git a/drivers/pci/hotplug/cpci_hotplug_core.c b/drivers/pci/hotplug/cpci_hotplug_core.c
index d06ab4045134..684551559d44 100644
--- a/drivers/pci/hotplug/cpci_hotplug_core.c
+++ b/drivers/pci/hotplug/cpci_hotplug_core.c
@@ -29,12 +29,12 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/smp_lock.h>
 #include <asm/atomic.h>
 #include <linux/delay.h>
-#include "pci_hotplug.h"
 #include "cpci_hotplug.h"
 
 #define DRIVER_AUTHOR   "Scott Murray <scottm@somanetworks.com>"
diff --git a/drivers/pci/hotplug/cpci_hotplug_pci.c b/drivers/pci/hotplug/cpci_hotplug_pci.c
index 4afcaffd031c..7b1beaad2752 100644
--- a/drivers/pci/hotplug/cpci_hotplug_pci.c
+++ b/drivers/pci/hotplug/cpci_hotplug_pci.c
@@ -26,9 +26,9 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/proc_fs.h>
 #include "../pci.h"
-#include "pci_hotplug.h"
 #include "cpci_hotplug.h"
 
 #define MY_NAME "cpci_hotplug"
diff --git a/drivers/pci/hotplug/cpcihp_generic.c b/drivers/pci/hotplug/cpcihp_generic.c
index e847f0d6c7fe..f3852a6b74ea 100644
--- a/drivers/pci/hotplug/cpcihp_generic.c
+++ b/drivers/pci/hotplug/cpcihp_generic.c
@@ -84,7 +84,7 @@ static int __init validate_parameters(void)
 
         if(!bridge) {
                 info("not configured, disabling.");
-                return 1;
+                return -EINVAL;
         }
         str = bridge;
         if(!*str)
@@ -147,7 +147,7 @@ static int __init cpcihp_generic_init(void)
 
         info(DRIVER_DESC " version: " DRIVER_VERSION);
         status = validate_parameters();
-        if(status != 0)
+        if (status)
                 return status;
 
         r = request_region(port, 1, "#ENUM hotswap signal register");
diff --git a/drivers/pci/hotplug/cpqphp.h b/drivers/pci/hotplug/cpqphp.h
index ea040c32f47d..298ad7f3f4f4 100644
--- a/drivers/pci/hotplug/cpqphp.h
+++ b/drivers/pci/hotplug/cpqphp.h
@@ -28,7 +28,6 @@
 #ifndef _CPQPHP_H
 #define _CPQPHP_H
 
-#include "pci_hotplug.h"
 #include <linux/interrupt.h>
 #include <asm/io.h>             /* for read? and write? functions */
 #include <linux/delay.h>        /* for delays */
diff --git a/drivers/pci/hotplug/cpqphp_core.c b/drivers/pci/hotplug/cpqphp_core.c
index 1fc259913b68..5617cfdadc5c 100644
--- a/drivers/pci/hotplug/cpqphp_core.c
+++ b/drivers/pci/hotplug/cpqphp_core.c
@@ -37,6 +37,7 @@
 #include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 
diff --git a/drivers/pci/hotplug/cpqphp_ctrl.c b/drivers/pci/hotplug/cpqphp_ctrl.c
index 3ec2ad7db49a..79ff6b4de3a6 100644
--- a/drivers/pci/hotplug/cpqphp_ctrl.c
+++ b/drivers/pci/hotplug/cpqphp_ctrl.c
@@ -36,6 +36,7 @@
 #include <linux/wait.h>
 #include <linux/smp_lock.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include "cpqphp.h"
 
 static u32 configure_new_device(struct controller* ctrl, struct pci_func *func,
diff --git a/drivers/pci/hotplug/cpqphp_nvram.c b/drivers/pci/hotplug/cpqphp_nvram.c
index cf0878917537..298a6cfd8406 100644
--- a/drivers/pci/hotplug/cpqphp_nvram.c
+++ b/drivers/pci/hotplug/cpqphp_nvram.c
@@ -33,6 +33,7 @@
 #include <linux/slab.h>
 #include <linux/workqueue.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/init.h>
 #include <asm/uaccess.h>
 #include "cpqphp.h"
diff --git a/drivers/pci/hotplug/cpqphp_pci.c b/drivers/pci/hotplug/cpqphp_pci.c
index 0d9688952f4a..fc7c74d72595 100644
--- a/drivers/pci/hotplug/cpqphp_pci.c
+++ b/drivers/pci/hotplug/cpqphp_pci.c
@@ -33,6 +33,7 @@
 #include <linux/workqueue.h>
 #include <linux/proc_fs.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include "../pci.h"
 #include "cpqphp.h"
 #include "cpqphp_nvram.h"
diff --git a/drivers/pci/hotplug/cpqphp_sysfs.c b/drivers/pci/hotplug/cpqphp_sysfs.c
index 5bab666cd67e..634f74d919d3 100644
--- a/drivers/pci/hotplug/cpqphp_sysfs.c
+++ b/drivers/pci/hotplug/cpqphp_sysfs.c
@@ -32,6 +32,7 @@
 #include <linux/proc_fs.h>
 #include <linux/workqueue.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/debugfs.h>
 #include "cpqphp.h"
 
diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
index 05a4f0f90186..e27907c91d92 100644
--- a/drivers/pci/hotplug/fakephp.c
+++ b/drivers/pci/hotplug/fakephp.c
@@ -35,10 +35,10 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/slab.h>
-#include "pci_hotplug.h"
 #include "../pci.h"
 
 #if !defined(MODULE)
@@ -181,7 +181,9 @@ static void pci_rescan_slot(struct pci_dev *temp)
 
         if (!pci_read_config_byte(temp, PCI_HEADER_TYPE, &hdr_type)) {
                 temp->hdr_type = hdr_type & 0x7f;
-                if (!pci_find_slot(bus->number, temp->devfn)) {
+                if ((dev = pci_get_slot(bus, temp->devfn)) != NULL)
+                        pci_dev_put(dev);
+                else {
                         dev = pci_scan_single_device(bus, temp->devfn);
                         if (dev) {
                                 dbg("New device on %s function %x:%x\n",
@@ -205,7 +207,9 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                 continue;
                         temp->hdr_type = hdr_type & 0x7f;
 
-                        if (!pci_find_slot(bus->number, temp->devfn)) {
+                        if ((dev = pci_get_slot(bus, temp->devfn)) != NULL)
+                                pci_dev_put(dev);
+                        else {
                                 dev = pci_scan_single_device(bus, temp->devfn);
                                 if (dev) {
                                         dbg("New device on %s function %x:%x\n",
@@ -305,7 +309,7 @@ static int disable_slot(struct hotplug_slot *slot)
         /* search for subfunctions and disable them first */
         if (!(dslot->dev->devfn & 7)) {
                 for (func = 1; func < 8; func++) {
-                        dev = pci_find_slot(dslot->dev->bus->number,
+                        dev = pci_get_slot(dslot->dev->bus,
                                         dslot->dev->devfn + func);
                         if (dev) {
                                 hslot = get_slot_from_dev(dev);
@@ -315,6 +319,7 @@ static int disable_slot(struct hotplug_slot *slot)
                                         err("Hotplug slot not found for subfunction of PCI device\n");
                                         return -ENODEV;
                                 }
+                                pci_dev_put(dev);
                         } else
                                 dbg("No device in slot found\n");
                 }
diff --git a/drivers/pci/hotplug/ibmphp.h b/drivers/pci/hotplug/ibmphp.h
index dba6d8ca9bda..612d96301509 100644
--- a/drivers/pci/hotplug/ibmphp.h
+++ b/drivers/pci/hotplug/ibmphp.h
@@ -30,7 +30,7 @@
  *
  */
 
-#include "pci_hotplug.h"
+#include <linux/pci_hotplug.h>
 
 extern int ibmphp_debug;
 
diff --git a/drivers/pci/hotplug/pci_hotplug_core.c b/drivers/pci/hotplug/pci_hotplug_core.c
index e2823ea9c4ed..f5d632e72323 100644
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -21,9 +21,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>
- *
- * Filesystem portion based on work done by Pat Mochel on ddfs/driverfs
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 
@@ -32,6 +30,8 @@
 #include <linux/kernel.h>
 #include <linux/types.h>
 #include <linux/list.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
 #include <linux/pagemap.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
@@ -39,11 +39,8 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <asm/uaccess.h>
-#include <linux/kobject.h>
-#include <linux/sysfs.h>
-#include "pci_hotplug.h"
-
 
 #define MY_NAME "pci_hotplug"
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index eaea9d36a1bb..4fb12fcda563 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -31,11 +31,11 @@
 
 #include <linux/types.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/delay.h>
 #include <linux/sched.h>                /* signal_pending() */
 #include <linux/pcieport_if.h>
 #include <linux/mutex.h>
-#include "pci_hotplug.h"
 
 #define MY_NAME "pciehp"
 
@@ -92,6 +92,7 @@ struct php_ctlr_state_s {
 struct controller {
         struct controller *next;
         struct mutex crit_sect;         /* critical section mutex */
+        struct mutex ctrl_lock;         /* controller lock */
         struct php_ctlr_state_s *hpc_ctlr_handle; /* HPC controller handle */
         int num_slots;                  /* Number of slots on ctlr */
         int slot_num_inc;               /* 1 or -1 */
@@ -166,10 +167,10 @@ struct controller {
  * error Messages
  */
 #define msg_initialization_err  "Initialization failure, error=%d\n"
-#define msg_button_on           "PCI slot #%d - powering on due to button press.\n"
-#define msg_button_off          "PCI slot #%d - powering off due to button press.\n"
-#define msg_button_cancel       "PCI slot #%d - action canceled due to button press.\n"
-#define msg_button_ignore       "PCI slot #%d - button press ignored.  (action in progress...)\n"
+#define msg_button_on           "PCI slot #%s - powering on due to button press.\n"
+#define msg_button_off          "PCI slot #%s - powering off due to button press.\n"
+#define msg_button_cancel       "PCI slot #%s - action canceled due to button press.\n"
+#define msg_button_ignore       "PCI slot #%s - button press ignored.  (action in progress...)\n"
 
 /* controller functions */
 extern int      pciehp_event_start_thread       (void);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index c67b7c3f1ddf..f93e81e2d2c7 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -448,7 +448,7 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
         }
 
         /* Wait for exclusive access to hardware */
-        mutex_lock(&ctrl->crit_sect);
+        mutex_lock(&ctrl->ctrl_lock);
 
         t_slot->hpc_ops->get_adapter_status(t_slot, &value); /* Check if slot is occupied */
         
@@ -456,7 +456,7 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
                 rc = t_slot->hpc_ops->power_off_slot(t_slot); /* Power off slot if not occupied*/
                 if (rc) {
                         /* Done with exclusive hardware access */
-                        mutex_unlock(&ctrl->crit_sect);
+                        mutex_unlock(&ctrl->ctrl_lock);
                         goto err_out_free_ctrl_slot;
                 } else
                         /* Wait for the command to complete */
@@ -464,7 +464,7 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
         }
 
         /* Done with exclusive hardware access */
-        mutex_unlock(&ctrl->crit_sect);
+        mutex_unlock(&ctrl->ctrl_lock);
 
         return 0;
 
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 41290a106bd8..372c63e35aa9 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -43,6 +43,11 @@ static int event_finished;
 static unsigned long pushbutton_pending;        /* = 0 */
 static unsigned long surprise_rm_pending;       /* = 0 */
 
+static inline char *slot_name(struct slot *p_slot)
+{
+        return p_slot->hotplug_slot->name;
+}
+
 u8 pciehp_handle_attention_button(u8 hp_slot, void *inst_id)
 {
         struct controller *ctrl = (struct controller *) inst_id;
@@ -68,7 +73,7 @@ u8 pciehp_handle_attention_button(u8 hp_slot, void *inst_id)
         /*
          *  Button pressed - See if need to TAKE ACTION!!!
          */
-        info("Button pressed on Slot(%d)\n", ctrl->first_slot + hp_slot);
+        info("Button pressed on Slot(%s)\n", slot_name(p_slot));
         taskInfo->event_type = INT_BUTTON_PRESS;
 
         if ((p_slot->state == BLINKINGON_STATE)
@@ -78,7 +83,7 @@ u8 pciehp_handle_attention_button(u8 hp_slot, void *inst_id)
                  * or hot-remove
                  */
                 taskInfo->event_type = INT_BUTTON_CANCEL;
-                info("Button cancel on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Button cancel on Slot(%s)\n", slot_name(p_slot));
         } else if ((p_slot->state == POWERON_STATE)
                    || (p_slot->state == POWEROFF_STATE)) {
                 /* Ignore if the slot is on power-on or power-off state; this 
@@ -86,7 +91,7 @@ u8 pciehp_handle_attention_button(u8 hp_slot, void *inst_id)
                  * hot-remove is undergoing
                  */
                 taskInfo->event_type = INT_BUTTON_IGNORE;
-                info("Button ignore on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Button ignore on Slot(%s)\n", slot_name(p_slot));
         }
 
         if (rc)
@@ -122,13 +127,13 @@ u8 pciehp_handle_switch_change(u8 hp_slot, void *inst_id)
                 /*
                  * Switch opened
                  */
-                info("Latch open on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Latch open on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_SWITCH_OPEN;
         } else {
                 /*
                  *  Switch closed
                  */
-                info("Latch close on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Latch close on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_SWITCH_CLOSE;
         }
 
@@ -166,13 +171,13 @@ u8 pciehp_handle_presence_change(u8 hp_slot, void *inst_id)
                 /*
                  * Card Present
                  */
-                info("Card present on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Card present on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_PRESENCE_ON;
         } else {
                 /*
                  * Not Present
                  */
-                info("Card not present on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Card not present on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_PRESENCE_OFF;
         }
 
@@ -206,13 +211,13 @@ u8 pciehp_handle_power_fault(u8 hp_slot, void *inst_id)
                 /*
                  * power fault Cleared
                  */
-                info("Power fault cleared on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Power fault cleared on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_POWER_FAULT_CLEAR;
         } else {
                 /*
                  *   power fault
                  */
-                info("Power fault on Slot(%d)\n", ctrl->first_slot + hp_slot);
+                info("Power fault on Slot(%s)\n", slot_name(p_slot));
                 taskInfo->event_type = INT_POWER_FAULT;
                 info("power fault bit %x set\n", hp_slot);
         }
@@ -229,13 +234,13 @@ u8 pciehp_handle_power_fault(u8 hp_slot, void *inst_id)
 static void set_slot_off(struct controller *ctrl, struct slot * pslot)
 {
         /* Wait for exclusive access to hardware */
-        mutex_lock(&ctrl->crit_sect);
+        mutex_lock(&ctrl->ctrl_lock);
 
         /* turn off slot, turn on Amber LED, turn off Green LED if supported*/
         if (POWER_CTRL(ctrl->ctrlcap)) {
                 if (pslot->hpc_ops->power_off_slot(pslot)) {   
                         err("%s: Issue of Slot Power Off command failed\n", __FUNCTION__);
-                        mutex_unlock(&ctrl->crit_sect);
+                        mutex_unlock(&ctrl->ctrl_lock);
                         return;
                 }
                 wait_for_ctrl_irq (ctrl);
@@ -249,14 +254,14 @@ static void set_slot_off(struct controller *ctrl, struct slot * pslot)
         if (ATTN_LED(ctrl->ctrlcap)) { 
                 if (pslot->hpc_ops->set_attention_status(pslot, 1)) {   
                         err("%s: Issue of Set Attention Led command failed\n", __FUNCTION__);
-                        mutex_unlock(&ctrl->crit_sect);
+                        mutex_unlock(&ctrl->ctrl_lock);
                         return;
                 }
                 wait_for_ctrl_irq (ctrl);
         }
 
         /* Done with exclusive hardware access */
-        mutex_unlock(&ctrl->crit_sect);
+        mutex_unlock(&ctrl->ctrl_lock);
 }
 
 /**
@@ -279,13 +284,13 @@ static int board_added(struct slot *p_slot)
                         ctrl->slot_device_offset, hp_slot);
 
         /* Wait for exclusive access to hardware */
-        mutex_lock(&ctrl->crit_sect);
+        mutex_lock(&ctrl->ctrl_lock);
 
         if (POWER_CTRL(ctrl->ctrlcap)) {
                 /* Power on slot */
                 rc = p_slot->hpc_ops->power_on_slot(p_slot);
                 if (rc) {
-                        mutex_unlock(&ctrl->crit_sect);
+                        mutex_unlock(&ctrl->ctrl_lock);
                         return -1;
                 }
 
@@ -301,7 +306,7 @@ static int board_added(struct slot *p_slot)
         }
 
         /* Done with exclusive hardware access */
-        mutex_unlock(&ctrl->crit_sect);
+        mutex_unlock(&ctrl->ctrl_lock);
 
         /* Wait for ~1 second */
         wait_for_ctrl_irq (ctrl);
@@ -335,7 +340,7 @@ static int board_added(struct slot *p_slot)
                 pci_fixup_device(pci_fixup_final, ctrl->pci_dev);
         if (PWR_LED(ctrl->ctrlcap)) {
                 /* Wait for exclusive access to hardware */
-                mutex_lock(&ctrl->crit_sect);
+                mutex_lock(&ctrl->ctrl_lock);
 
                 p_slot->hpc_ops->green_led_on(p_slot);
   
@@ -343,7 +348,7 @@ static int board_added(struct slot *p_slot)
                 wait_for_ctrl_irq (ctrl);
         
                 /* Done with exclusive hardware access */
-                mutex_unlock(&ctrl->crit_sect);
+                mutex_unlock(&ctrl->ctrl_lock);
         }
         return 0;
 
@@ -375,14 +380,14 @@ static int remove_board(struct slot *p_slot)
         dbg("In %s, hp_slot = %d\n", __FUNCTION__, hp_slot);
 
         /* Wait for exclusive access to hardware */
-        mutex_lock(&ctrl->crit_sect);
+        mutex_lock(&ctrl->ctrl_lock);
 
         if (POWER_CTRL(ctrl->ctrlcap)) {
                 /* power off slot */
                 rc = p_slot->hpc_ops->power_off_slot(p_slot);
                 if (rc) {
                         err("%s: Issue of Slot Disable command failed\n", __FUNCTION__);
-                        mutex_unlock(&ctrl->crit_sect);
+                        mutex_unlock(&ctrl->ctrl_lock);
                         return rc;
                 }
                 /* Wait for the command to complete */
@@ -398,7 +403,7 @@ static int remove_board(struct slot *p_slot)
         }
 
         /* Done with exclusive hardware access */
-        mutex_unlock(&ctrl->crit_sect);
+        mutex_unlock(&ctrl->ctrl_lock);
 
         return 0;
 }
@@ -445,7 +450,7 @@ static void pciehp_pushbutton_thread(unsigned long slot)
 
                 if (pciehp_enable_slot(p_slot) && PWR_LED(p_slot->ctrl->ctrlcap)) {
                         /* Wait for exclusive access to hardware */
-                        mutex_lock(&p_slot->ctrl->crit_sect);
+                        mutex_lock(&p_slot->ctrl->ctrl_lock);
 
                         p_slot->hpc_ops->green_led_off(p_slot);
 
@@ -453,7 +458,7 @@ static void pciehp_pushbutton_thread(unsigned long slot)
                         wait_for_ctrl_irq (p_slot->ctrl);
 
                         /* Done with exclusive hardware access */
-                        mutex_unlock(&p_slot->ctrl->crit_sect);
+                        mutex_unlock(&p_slot->ctrl->ctrl_lock);
                 }
                 p_slot->state = STATIC_STATE;
         }
@@ -495,7 +500,7 @@ static void pciehp_surprise_rm_thread(unsigned long slot)
 
                 if (pciehp_enable_slot(p_slot) && PWR_LED(p_slot->ctrl->ctrlcap)) {
                         /* Wait for exclusive access to hardware */
-                        mutex_lock(&p_slot->ctrl->crit_sect);
+                        mutex_lock(&p_slot->ctrl->ctrl_lock);
 
                         p_slot->hpc_ops->green_led_off(p_slot);
 
@@ -503,7 +508,7 @@ static void pciehp_surprise_rm_thread(unsigned long slot)
                         wait_for_ctrl_irq (p_slot->ctrl);
 
                         /* Done with exclusive hardware access */
-                        mutex_unlock(&p_slot->ctrl->crit_sect);
+                        mutex_unlock(&p_slot->ctrl->ctrl_lock);
                 }
                 p_slot->state = STATIC_STATE;
         }
@@ -616,7 +621,7 @@ static void interrupt_event_handler(struct controller *ctrl)
                                         switch (p_slot->state) {
                                         case BLINKINGOFF_STATE:
                                                 /* Wait for exclusive access to hardware */
-                                                mutex_lock(&ctrl->crit_sect);
+                                                mutex_lock(&ctrl->ctrl_lock);
                                                 
                                                 if (PWR_LED(ctrl->ctrlcap)) {
                                                         p_slot->hpc_ops->green_led_on(p_slot);
@@ -630,11 +635,11 @@ static void interrupt_event_handler(struct controller *ctrl)
                                                         wait_for_ctrl_irq (ctrl);
                                                 }
                                                 /* Done with exclusive hardware access */
-                                                mutex_unlock(&ctrl->crit_sect);
+                                                mutex_unlock(&ctrl->ctrl_lock);
                                                 break;
                                         case BLINKINGON_STATE:
                                                 /* Wait for exclusive access to hardware */
-                                                mutex_lock(&ctrl->crit_sect);
+                                                mutex_lock(&ctrl->ctrl_lock);
 
                                                 if (PWR_LED(ctrl->ctrlcap)) {
                                                         p_slot->hpc_ops->green_led_off(p_slot);
@@ -647,14 +652,14 @@ static void interrupt_event_handler(struct controller *ctrl)
                                                         wait_for_ctrl_irq (ctrl);
                                                 }
                                                 /* Done with exclusive hardware access */
-                                                mutex_unlock(&ctrl->crit_sect);
+                                                mutex_unlock(&ctrl->ctrl_lock);
 
                                                 break;
                                         default:
                                                 warn("Not a valid state\n");
                                                 return;
                                         }
-                                        info(msg_button_cancel, p_slot->number);
+                                        info(msg_button_cancel, slot_name(p_slot));
                                         p_slot->state = STATIC_STATE;
                                 }
                                 /* ***********Button Pressed (No action on 1st press...) */
@@ -667,16 +672,16 @@ static void interrupt_event_handler(struct controller *ctrl)
                                                         /* slot is on */
                                                         dbg("slot is on\n");
                                                         p_slot->state = BLINKINGOFF_STATE;
-                                                        info(msg_button_off, p_slot->number);
+                                                        info(msg_button_off, slot_name(p_slot));
                                                 } else {
                                                         /* slot is off */
                                                         dbg("slot is off\n");
                                                         p_slot->state = BLINKINGON_STATE;
-                                                        info(msg_button_on, p_slot->number);
+                                                        info(msg_button_on, slot_name(p_slot));
                                                 }
 
                                                 /* Wait for exclusive access to hardware */
-                                                mutex_lock(&ctrl->crit_sect);
+                                                mutex_lock(&ctrl->ctrl_lock);
 
                                                 /* blink green LED and turn off amber */
                                                 if (PWR_LED(ctrl->ctrlcap)) {
@@ -693,7 +698,7 @@ static void interrupt_event_handler(struct controller *ctrl)
                                                 }
 
                                                 /* Done with exclusive hardware access */
-                                                mutex_unlock(&ctrl->crit_sect);
+                                                mutex_unlock(&ctrl->ctrl_lock);
 
                                                 init_timer(&p_slot->task_event);
                                                 p_slot->task_event.expires = jiffies + 5 * HZ;   /* 5 second delay */
@@ -708,7 +713,7 @@ static void interrupt_event_handler(struct controller *ctrl)
                                         if (POWER_CTRL(ctrl->ctrlcap)) {
                                                 dbg("power fault\n");
                                                 /* Wait for exclusive access to hardware */
-                                                mutex_lock(&ctrl->crit_sect);
+                                                mutex_lock(&ctrl->ctrl_lock);
 
                                                 if (ATTN_LED(ctrl->ctrlcap)) {
                                                         p_slot->hpc_ops->set_attention_status(p_slot, 1);
@@ -721,7 +726,7 @@ static void interrupt_event_handler(struct controller *ctrl)
                                                 }
 
                                                 /* Done with exclusive hardware access */
-                                                mutex_unlock(&ctrl->crit_sect);
+                                                mutex_unlock(&ctrl->ctrl_lock);
                                         }
                                 }
                                 /***********SURPRISE REMOVAL********************/
@@ -760,14 +765,16 @@ int pciehp_enable_slot(struct slot *p_slot)
 
         rc = p_slot->hpc_ops->get_adapter_status(p_slot, &getstatus);
         if (rc || !getstatus) {
-                info("%s: no adapter on slot(%x)\n", __FUNCTION__, p_slot->number);
+                info("%s: no adapter on slot(%s)\n", __FUNCTION__,
+                     slot_name(p_slot));
                 mutex_unlock(&p_slot->ctrl->crit_sect);
                 return -ENODEV;
         }
         if (MRL_SENS(p_slot->ctrl->ctrlcap)) {  
                 rc = p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
                 if (rc || getstatus) {
-                        info("%s: latch open on slot(%x)\n", __FUNCTION__, p_slot->number);
+                        info("%s: latch open on slot(%s)\n", __FUNCTION__,
+                             slot_name(p_slot));
                         mutex_unlock(&p_slot->ctrl->crit_sect);
                         return -ENODEV;
                 }
@@ -776,12 +783,12 @@ int pciehp_enable_slot(struct slot *p_slot)
         if (POWER_CTRL(p_slot->ctrl->ctrlcap)) {        
                 rc = p_slot->hpc_ops->get_power_status(p_slot, &getstatus);
                 if (rc || getstatus) {
-                        info("%s: already enabled on slot(%x)\n", __FUNCTION__, p_slot->number);
+                        info("%s: already enabled on slot(%s)\n", __FUNCTION__,
+                             slot_name(p_slot));
                         mutex_unlock(&p_slot->ctrl->crit_sect);
                         return -EINVAL;
                 }
         }
-        mutex_unlock(&p_slot->ctrl->crit_sect);
 
         p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
 
@@ -790,9 +797,9 @@ int pciehp_enable_slot(struct slot *p_slot)
                 p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
         }
 
-        if (p_slot)
-                update_slot_info(p_slot);
+        update_slot_info(p_slot);
 
+        mutex_unlock(&p_slot->ctrl->crit_sect);
         return rc;
 }
 
@@ -811,7 +818,8 @@ int pciehp_disable_slot(struct slot *p_slot)
         if (!HP_SUPR_RM(p_slot->ctrl->ctrlcap)) {       
                 ret = p_slot->hpc_ops->get_adapter_status(p_slot, &getstatus);
                 if (ret || !getstatus) {
-                        info("%s: no adapter on slot(%x)\n", __FUNCTION__, p_slot->number);
+                        info("%s: no adapter on slot(%s)\n", __FUNCTION__,
+                             slot_name(p_slot));
                         mutex_unlock(&p_slot->ctrl->crit_sect);
                         return -ENODEV;
                 }
@@ -820,7 +828,8 @@ int pciehp_disable_slot(struct slot *p_slot)
         if (MRL_SENS(p_slot->ctrl->ctrlcap)) {  
                 ret = p_slot->hpc_ops->get_latch_status(p_slot, &getstatus);
                 if (ret || getstatus) {
-                        info("%s: latch open on slot(%x)\n", __FUNCTION__, p_slot->number);
+                        info("%s: latch open on slot(%s)\n", __FUNCTION__,
+                             slot_name(p_slot));
                         mutex_unlock(&p_slot->ctrl->crit_sect);
                         return -ENODEV;
                 }
@@ -829,16 +838,17 @@ int pciehp_disable_slot(struct slot *p_slot)
         if (POWER_CTRL(p_slot->ctrl->ctrlcap)) {        
                 ret = p_slot->hpc_ops->get_power_status(p_slot, &getstatus);
                 if (ret || !getstatus) {
-                        info("%s: already disabled slot(%x)\n", __FUNCTION__, p_slot->number);
+                        info("%s: already disabled slot(%s)\n", __FUNCTION__,
+                             slot_name(p_slot));
                         mutex_unlock(&p_slot->ctrl->crit_sect);
                         return -EINVAL;
                 }
         }
 
-        mutex_unlock(&p_slot->ctrl->crit_sect);
-
         ret = remove_board(p_slot);
         update_slot_info(p_slot);
+
+        mutex_unlock(&p_slot->ctrl->crit_sect);
         return ret;
 }
 
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 703a64a39fe8..1c551c697c35 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -1402,6 +1402,8 @@ int pcie_init(struct controller * ctrl, struct pcie_device *dev)
                 pdev->subsystem_vendor, pdev->subsystem_device);
 
         mutex_init(&ctrl->crit_sect);
+        mutex_init(&ctrl->ctrl_lock);
+
         /* setup wait queue */
         init_waitqueue_head(&ctrl->queue);
 
diff --git a/drivers/pci/hotplug/pcihp_skeleton.c b/drivers/pci/hotplug/pcihp_skeleton.c
index 2b9e10e38613..50bcd3fe61da 100644
--- a/drivers/pci/hotplug/pcihp_skeleton.c
+++ b/drivers/pci/hotplug/pcihp_skeleton.c
@@ -33,8 +33,8 @@
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/init.h>
-#include "pci_hotplug.h"
 
 #define SLOT_NAME_SIZE  10
 struct slot {
diff --git a/drivers/pci/hotplug/rpadlpar_sysfs.c b/drivers/pci/hotplug/rpadlpar_sysfs.c
index db69be85b458..6c5be3ff578c 100644
--- a/drivers/pci/hotplug/rpadlpar_sysfs.c
+++ b/drivers/pci/hotplug/rpadlpar_sysfs.c
@@ -14,7 +14,7 @@
  */
 #include <linux/kobject.h>
 #include <linux/string.h>
-#include "pci_hotplug.h"
+#include <linux/pci_hotplug.h>
 #include "rpadlpar.h"
 
 #define DLPAR_KOBJ_NAME       "control"
diff --git a/drivers/pci/hotplug/rpaphp.h b/drivers/pci/hotplug/rpaphp.h
index 310b6186c0e5..2e7accf0f734 100644
--- a/drivers/pci/hotplug/rpaphp.h
+++ b/drivers/pci/hotplug/rpaphp.h
@@ -28,7 +28,7 @@
 #define _PPC64PHP_H
 
 #include <linux/pci.h>
-#include "pci_hotplug.h"
+#include <linux/pci_hotplug.h>
 
 #define DR_INDICATOR 9002
 #define DR_ENTITY_SENSE 9003
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 7288a3eccfb3..141486df235b 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -26,6 +26,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
 #include <linux/smp_lock.h>
@@ -36,7 +37,6 @@
 #include "../pci.h"             /* for pci_add_new_bus */
                                 /* and pci_do_scan_bus */
 #include "rpaphp.h"
-#include "pci_hotplug.h"
 
 int debug;
 static struct semaphore rpaphp_sem;
diff --git a/drivers/pci/hotplug/sgi_hotplug.c b/drivers/pci/hotplug/sgi_hotplug.c
index f31d83c2c633..b62ad31a9739 100644
--- a/drivers/pci/hotplug/sgi_hotplug.c
+++ b/drivers/pci/hotplug/sgi_hotplug.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/proc_fs.h>
 #include <linux/types.h>
 #include <linux/mutex.h>
@@ -29,7 +30,6 @@
 #include <asm/sn/types.h>
 
 #include "../pci.h"
-#include "pci_hotplug.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("SGI (prarit@sgi.com, dickie@sgi.com, habeck@sgi.com)");
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index c7103ac5cd06..ea2087c34149 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -31,12 +31,11 @@
 
 #include <linux/types.h>
 #include <linux/pci.h>
+#include <linux/pci_hotplug.h>
 #include <linux/delay.h>
 #include <linux/sched.h>        /* signal_pending(), struct timer_list */
 #include <linux/mutex.h>
 
-#include "pci_hotplug.h"
-
 #if !defined(MODULE)
         #define MY_NAME "shpchp"
 #else
@@ -103,7 +102,6 @@ struct controller {
         u32 cap_offset;
         unsigned long mmio_base;
         unsigned long mmio_size;
-        volatile int cmd_busy;
 };
 
 
diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c
index 4d8aee119134..83a5226ba9ed 100644
--- a/drivers/pci/hotplug/shpchp_hpc.c
+++ b/drivers/pci/hotplug/shpchp_hpc.c
@@ -302,21 +302,51 @@ static void start_int_poll_timer(struct php_ctlr_state_s *php_ctlr, int sec)
         add_timer(&php_ctlr->int_poll_timer);
 }
 
+static inline int is_ctrl_busy(struct controller *ctrl)
+{
+        u16 cmd_status = shpc_readw(ctrl, CMD_STATUS);
+        return cmd_status & 0x1;
+}
+
+/*
+ * Returns 1 if SHPC finishes executing a command within 1 sec,
+ * otherwise returns 0.
+ */
+static inline int shpc_poll_ctrl_busy(struct controller *ctrl)
+{
+        int i;
+
+        if (!is_ctrl_busy(ctrl))
+                return 1;
+
+        /* Check every 0.1 sec for a total of 1 sec */
+        for (i = 0; i < 10; i++) {
+                msleep(100);
+                if (!is_ctrl_busy(ctrl))
+                        return 1;
+        }
+
+        return 0;
+}
+
 static inline int shpc_wait_cmd(struct controller *ctrl)
 {
         int retval = 0;
-        unsigned int timeout_msec = shpchp_poll_mode ? 2000 : 1000;
-        unsigned long timeout = msecs_to_jiffies(timeout_msec);
-        int rc = wait_event_interruptible_timeout(ctrl->queue,
-                                                  !ctrl->cmd_busy, timeout);
-        if (!rc) {
+        unsigned long timeout = msecs_to_jiffies(1000);
+        int rc;
+
+        if (shpchp_poll_mode)
+                rc = shpc_poll_ctrl_busy(ctrl);
+        else
+                rc = wait_event_interruptible_timeout(ctrl->queue,
+                                                !is_ctrl_busy(ctrl), timeout);
+        if (!rc && is_ctrl_busy(ctrl)) {
                 retval = -EIO;
-                err("Command not completed in %d msec\n", timeout_msec);
+                err("Command not completed in 1000 msec\n");
         } else if (rc < 0) {
                 retval = -EINTR;
                 info("Command was interrupted by a signal\n");
         }
-        ctrl->cmd_busy = 0;
 
         return retval;
 }
@@ -327,26 +357,15 @@ static int shpc_write_cmd(struct slot *slot, u8 t_slot, u8 cmd)
         u16 cmd_status;
         int retval = 0;
         u16 temp_word;
-        int i;
 
         DBG_ENTER_ROUTINE 
 
         mutex_lock(&slot->ctrl->cmd_lock);
 
-        for (i = 0; i < 10; i++) {
-                cmd_status = shpc_readw(ctrl, CMD_STATUS);
-                
-                if (!(cmd_status & 0x1))
-                        break;
-                /*  Check every 0.1 sec for a total of 1 sec*/
-                msleep(100);
-        }
-
-        cmd_status = shpc_readw(ctrl, CMD_STATUS);
-        
-        if (cmd_status & 0x1) { 
+        if (!shpc_poll_ctrl_busy(ctrl)) {
                 /* After 1 sec and and the controller is still busy */
-                err("%s : Controller is still busy after 1 sec.\n", __FUNCTION__);
+                err("%s : Controller is still busy after 1 sec.\n",
+                    __FUNCTION__);
                 retval = -EBUSY;
                 goto out;
         }
@@ -358,7 +377,6 @@ static int shpc_write_cmd(struct slot *slot, u8 t_slot, u8 cmd)
         /* To make sure the Controller Busy bit is 0 before we send out the
          * command. 
          */
-        slot->ctrl->cmd_busy = 1;
         shpc_writew(ctrl, CMD, temp_word);
 
         /*
@@ -908,7 +926,6 @@ static irqreturn_t shpc_isr(int irq, void *dev_id)
                 serr_int &= ~SERR_INTR_RSVDZ_MASK;
                 shpc_writel(ctrl, SERR_INTR_ENABLE, serr_int);
 
-                ctrl->cmd_busy = 0;
                 wake_up_interruptible(&ctrl->queue);
         }
 
@@ -1101,7 +1118,7 @@ int shpc_init(struct controller * ctrl, struct pci_dev * pdev)
 {
         struct php_ctlr_state_s *php_ctlr, *p;
         void *instance_id = ctrl;
-        int rc, num_slots = 0;
+        int rc = -1, num_slots = 0;
         u8 hp_slot;
         u32 shpc_base_offset;
         u32 tempdword, slot_reg, slot_config;
@@ -1167,11 +1184,15 @@ int shpc_init(struct controller * ctrl, struct pci_dev * pdev)
         info("HPC vendor_id %x device_id %x ss_vid %x ss_did %x\n", pdev->vendor, pdev->device, pdev->subsystem_vendor, 
                 pdev->subsystem_device);
         
-        if (pci_enable_device(pdev))
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                err("%s: pci_enable_device failed\n", __FUNCTION__);
                 goto abort_free_ctlr;
+        }
 
         if (!request_mem_region(ctrl->mmio_base, ctrl->mmio_size, MY_NAME)) {
                 err("%s: cannot reserve MMIO region\n", __FUNCTION__);
+                rc = -1;
                 goto abort_free_ctlr;
         }
 
@@ -1180,6 +1201,7 @@ int shpc_init(struct controller * ctrl, struct pci_dev * pdev)
                 err("%s: cannot remap MMIO region %lx @ %lx\n", __FUNCTION__,
                     ctrl->mmio_size, ctrl->mmio_base);
                 release_mem_region(ctrl->mmio_base, ctrl->mmio_size);
+                rc = -1;
                 goto abort_free_ctlr;
         }
         dbg("%s: php_ctlr->creg %p\n", __FUNCTION__, php_ctlr->creg);
@@ -1282,8 +1304,10 @@ int shpc_init(struct controller * ctrl, struct pci_dev * pdev)
          */
         if (atomic_add_return(1, &shpchp_num_controllers) == 1) {
                 shpchp_wq = create_singlethread_workqueue("shpchpd");
-                if (!shpchp_wq)
-                        return -ENOMEM;
+                if (!shpchp_wq) {
+                        rc = -ENOMEM;
+                        goto abort_free_ctlr;
+                }
         }
 
         /*
@@ -1313,8 +1337,10 @@ int shpc_init(struct controller * ctrl, struct pci_dev * pdev)
 
         /* We end up here for the many possible ways to fail this API.  */
 abort_free_ctlr:
+        if (php_ctlr->creg)
+                iounmap(php_ctlr->creg);
         kfree(php_ctlr);
 abort:
         DBG_LEAVE_ROUTINE
-        return -1;
+        return rc;
 }
diff --git a/drivers/pci/htirq.c b/drivers/pci/htirq.c
index 0e27f2404a83..0a8d1cce9fa0 100644
--- a/drivers/pci/htirq.c
+++ b/drivers/pci/htirq.c
@@ -25,97 +25,72 @@ static DEFINE_SPINLOCK(ht_irq_lock);
 
 struct ht_irq_cfg {
         struct pci_dev *dev;
+         /* Update callback used to cope with buggy hardware */
+        ht_irq_update_t *update;
         unsigned pos;
         unsigned idx;
+        struct ht_irq_msg msg;
 };
 
-void write_ht_irq_low(unsigned int irq, u32 data)
-{
-        struct ht_irq_cfg *cfg = get_irq_data(irq);
-        unsigned long flags;
-        spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx);
-        pci_write_config_dword(cfg->dev, cfg->pos + 4, data);
-        spin_unlock_irqrestore(&ht_irq_lock, flags);
-}
 
-void write_ht_irq_high(unsigned int irq, u32 data)
+void write_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg)
 {
         struct ht_irq_cfg *cfg = get_irq_data(irq);
         unsigned long flags;
         spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx + 1);
-        pci_write_config_dword(cfg->dev, cfg->pos + 4, data);
-        spin_unlock_irqrestore(&ht_irq_lock, flags);
-}
-
-u32 read_ht_irq_low(unsigned int irq)
-{
-        struct ht_irq_cfg *cfg = get_irq_data(irq);
-        unsigned long flags;
-        u32 data;
-        spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx);
-        pci_read_config_dword(cfg->dev, cfg->pos + 4, &data);
+        if (cfg->msg.address_lo != msg->address_lo) {
+                pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx);
+                pci_write_config_dword(cfg->dev, cfg->pos + 4, msg->address_lo);
+        }
+        if (cfg->msg.address_hi != msg->address_hi) {
+                pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx + 1);
+                pci_write_config_dword(cfg->dev, cfg->pos + 4, msg->address_hi);
+        }
+        if (cfg->update)
+                cfg->update(cfg->dev, irq, msg);
         spin_unlock_irqrestore(&ht_irq_lock, flags);
-        return data;
+        cfg->msg = *msg;
 }
 
-u32 read_ht_irq_high(unsigned int irq)
+void fetch_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg)
 {
         struct ht_irq_cfg *cfg = get_irq_data(irq);
-        unsigned long flags;
-        u32 data;
-        spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx + 1);
-        pci_read_config_dword(cfg->dev, cfg->pos + 4, &data);
-        spin_unlock_irqrestore(&ht_irq_lock, flags);
-        return data;
+        *msg = cfg->msg;
 }
 
 void mask_ht_irq(unsigned int irq)
 {
         struct ht_irq_cfg *cfg;
-        unsigned long flags;
-        u32 data;
+        struct ht_irq_msg msg;
 
         cfg = get_irq_data(irq);
 
-        spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx);
-        pci_read_config_dword(cfg->dev, cfg->pos + 4, &data);
-        data |= 1;
-        pci_write_config_dword(cfg->dev, cfg->pos + 4, data);
-        spin_unlock_irqrestore(&ht_irq_lock, flags);
+        msg = cfg->msg;
+        msg.address_lo |= 1;
+        write_ht_irq_msg(irq, &msg);
 }
 
 void unmask_ht_irq(unsigned int irq)
 {
         struct ht_irq_cfg *cfg;
-        unsigned long flags;
-        u32 data;
+        struct ht_irq_msg msg;
 
         cfg = get_irq_data(irq);
 
-        spin_lock_irqsave(&ht_irq_lock, flags);
-        pci_write_config_byte(cfg->dev, cfg->pos + 2, cfg->idx);
-        pci_read_config_dword(cfg->dev, cfg->pos + 4, &data);
-        data &= ~1;
-        pci_write_config_dword(cfg->dev, cfg->pos + 4, data);
-        spin_unlock_irqrestore(&ht_irq_lock, flags);
+        msg = cfg->msg;
+        msg.address_lo &= ~1;
+        write_ht_irq_msg(irq, &msg);
 }
 
 /**
- * ht_create_irq - create an irq and attach it to a device.
+ * __ht_create_irq - create an irq and attach it to a device.
  * @dev: The hypertransport device to find the irq capability on.
  * @idx: Which of the possible irqs to attach to.
- *
- * ht_create_irq is needs to be called for all hypertransport devices
- * that generate irqs.
+ * @update: Function to be called when changing the htirq message
  *
  * The irq number of the new irq or a negative error value is returned.
  */
-int ht_create_irq(struct pci_dev *dev, int idx)
+int __ht_create_irq(struct pci_dev *dev, int idx, ht_irq_update_t *update)
 {
         struct ht_irq_cfg *cfg;
         unsigned long flags;
@@ -150,8 +125,12 @@ int ht_create_irq(struct pci_dev *dev, int idx)
                 return -ENOMEM;
 
         cfg->dev = dev;
+        cfg->update = update;
         cfg->pos = pos;
         cfg->idx = 0x10 + (idx * 2);
+        /* Initialize msg to a value that will never match the first write. */
+        cfg->msg.address_lo = 0xffffffff;
+        cfg->msg.address_hi = 0xffffffff;
 
         irq = create_irq();
         if (irq < 0) {
@@ -169,6 +148,21 @@ int ht_create_irq(struct pci_dev *dev, int idx)
 }
 
 /**
+ * ht_create_irq - create an irq and attach it to a device.
+ * @dev: The hypertransport device to find the irq capability on.
+ * @idx: Which of the possible irqs to attach to.
+ *
+ * ht_create_irq needs to be called for all hypertransport devices
+ * that generate irqs.
+ *
+ * The irq number of the new irq or a negative error value is returned.
+ */
+int ht_create_irq(struct pci_dev *dev, int idx)
+{
+        return __ht_create_irq(dev, idx, NULL);
+}
+
+/**
  * ht_destroy_irq - destroy an irq created with ht_create_irq
  *
  * This reverses ht_create_irq removing the specified irq from
@@ -186,5 +180,6 @@ void ht_destroy_irq(unsigned int irq)
         kfree(cfg);
 }
 
+EXPORT_SYMBOL(__ht_create_irq);
 EXPORT_SYMBOL(ht_create_irq);
 EXPORT_SYMBOL(ht_destroy_irq);
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index f9fdc54473c4..9fc9a34ef24a 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -627,22 +627,24 @@ static int msix_capability_init(struct pci_dev *dev,
  * pci_msi_supported - check whether MSI may be enabled on device
  * @dev: pointer to the pci_dev data structure of MSI device function
  *
- * MSI must be globally enabled and supported by the device and its root
- * bus. But, the root bus is not easy to find since some architectures
- * have virtual busses on top of the PCI hierarchy (for instance the
- * hypertransport bus), while the actual bus where MSI must be supported
- * is below. So we test the MSI flag on all parent busses and assume
- * that no quirk will ever set the NO_MSI flag on a non-root bus.
+ * Look at global flags, the device itself, and its parent busses
+ * to return 0 if MSI are supported for the device.
  **/
 static
 int pci_msi_supported(struct pci_dev * dev)
 {
         struct pci_bus *bus;
 
+        /* MSI must be globally enabled and supported by the device */
         if (!pci_msi_enable || !dev || dev->no_msi)
                 return -EINVAL;
 
-        /* check MSI flags of all parent busses */
+        /* Any bridge which does NOT route MSI transactions from it's
+         * secondary bus to it's primary bus must set NO_MSI flag on
+         * the secondary pci_bus.
+         * We expect only arch-specific PCI host bus controller driver
+         * or quirks for specific PCI bridges to be setting NO_MSI.
+         */
         for (bus = dev->bus; bus; bus = bus->parent)
                 if (bus->bus_flags & PCI_BUS_FLAGS_NO_MSI)
                         return -EINVAL;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index b1c0c707d96c..194f1d21d3d7 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -265,6 +265,13 @@ static int pci_device_remove(struct device * dev)
         }
 
         /*
+         * If the device is still on, set the power state as "unknown",
+         * since it might change by the next time we load the driver.
+         */
+        if (pci_dev->current_state == PCI_D0)
+                pci_dev->current_state = PCI_UNKNOWN;
+
+        /*
          * We would love to complain here if pci_dev->is_enabled is set, that
          * the driver should have called pci_disable_device(), but the
          * unfortunate fact is there are too many odd BIOS and bridge setups
@@ -288,6 +295,12 @@ static int pci_device_suspend(struct device * dev, pm_message_t state)
                 suspend_report_result(drv->suspend, i);
         } else {
                 pci_save_state(pci_dev);
+                /*
+                 * mark its power state as "unknown", since we don't know if
+                 * e.g. the BIOS will change its device state when we suspend.
+                 */
+                if (pci_dev->current_state == PCI_D0)
+                        pci_dev->current_state = PCI_UNKNOWN;
         }
         return i;
 }
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index a1d2e979b17f..f952bfea48a6 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -642,6 +642,9 @@ err:
  */
 void pci_remove_sysfs_dev_files(struct pci_dev *pdev)
 {
+        if (!sysfs_initialized)
+                return;
+
         if (pdev->cfg_size < 4096)
                 sysfs_remove_bin_file(&pdev->dev.kobj, &pci_config_attr);
         else
diff --git a/drivers/pci/pcie/portdrv.h b/drivers/pci/pcie/portdrv.h
index 67fcd176babd..3656e0349dd1 100644
--- a/drivers/pci/pcie/portdrv.h
+++ b/drivers/pci/pcie/portdrv.h
@@ -9,6 +9,8 @@
 #ifndef _PORTDRV_H_
 #define _PORTDRV_H_
 
+#include <linux/compiler.h>
+
 #if !defined(PCI_CAP_ID_PME)
 #define PCI_CAP_ID_PME                  1
 #endif
@@ -39,7 +41,7 @@ extern int pcie_port_device_suspend(struct pci_dev *dev, pm_message_t state);
 extern int pcie_port_device_resume(struct pci_dev *dev);
 #endif
 extern void pcie_port_device_remove(struct pci_dev *dev);
-extern int pcie_port_bus_register(void);
+extern int __must_check pcie_port_bus_register(void);
 extern void pcie_port_bus_unregister(void);
 
 #endif /* _PORTDRV_H_ */
diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
index bd6615b4d40e..b20a9b81dae2 100644
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
@@ -6,7 +6,6 @@
  * Copyright (C) Tom Long Nguyen (tom.l.nguyen@intel.com)
  */
 
-#include <linux/compiler.h>
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/kernel.h>
@@ -401,7 +400,7 @@ void pcie_port_device_remove(struct pci_dev *dev)
                 pci_disable_msi(dev);
 }
 
-int __must_check pcie_port_bus_register(void)
+int pcie_port_bus_register(void)
 {
         return bus_register(&pcie_port_bus_type);
 }
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 037690e08f5f..b4da7954611e 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -37,7 +37,6 @@ static int pcie_portdrv_save_config(struct pci_dev *dev)
         return pci_save_state(dev);
 }
 
-#ifdef CONFIG_PM
 static int pcie_portdrv_restore_config(struct pci_dev *dev)
 {
         int retval;
@@ -50,6 +49,7 @@ static int pcie_portdrv_restore_config(struct pci_dev *dev)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static int pcie_portdrv_suspend(struct pci_dev *dev, pm_message_t state)
 {
         int ret = pcie_port_device_suspend(dev, state);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index a3b0a5eb5054..e159d6604494 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1067,3 +1067,95 @@ EXPORT_SYMBOL(pci_scan_bridge);
 EXPORT_SYMBOL(pci_scan_single_device);
 EXPORT_SYMBOL_GPL(pci_scan_child_bus);
 #endif
+
+static int __init pci_sort_bf_cmp(const struct pci_dev *a, const struct pci_dev *b)
+{
+        if      (pci_domain_nr(a->bus) < pci_domain_nr(b->bus)) return -1;
+        else if (pci_domain_nr(a->bus) > pci_domain_nr(b->bus)) return  1;
+
+        if      (a->bus->number < b->bus->number) return -1;
+        else if (a->bus->number > b->bus->number) return  1;
+
+        if      (a->devfn < b->devfn) return -1;
+        else if (a->devfn > b->devfn) return  1;
+
+        return 0;
+}
+
+/*
+ * Yes, this forcably breaks the klist abstraction temporarily.  It
+ * just wants to sort the klist, not change reference counts and
+ * take/drop locks rapidly in the process.  It does all this while
+ * holding the lock for the list, so objects can't otherwise be
+ * added/removed while we're swizzling.
+ */
+static void __init pci_insertion_sort_klist(struct pci_dev *a, struct list_head *list)
+{
+        struct list_head *pos;
+        struct klist_node *n;
+        struct device *dev;
+        struct pci_dev *b;
+
+        list_for_each(pos, list) {
+                n = container_of(pos, struct klist_node, n_node);
+                dev = container_of(n, struct device, knode_bus);
+                b = to_pci_dev(dev);
+                if (pci_sort_bf_cmp(a, b) <= 0) {
+                        list_move_tail(&a->dev.knode_bus.n_node, &b->dev.knode_bus.n_node);
+                        return;
+                }
+        }
+        list_move_tail(&a->dev.knode_bus.n_node, list);
+}
+
+static void __init pci_sort_breadthfirst_klist(void)
+{
+        LIST_HEAD(sorted_devices);
+        struct list_head *pos, *tmp;
+        struct klist_node *n;
+        struct device *dev;
+        struct pci_dev *pdev;
+
+        spin_lock(&pci_bus_type.klist_devices.k_lock);
+        list_for_each_safe(pos, tmp, &pci_bus_type.klist_devices.k_list) {
+                n = container_of(pos, struct klist_node, n_node);
+                dev = container_of(n, struct device, knode_bus);
+                pdev = to_pci_dev(dev);
+                pci_insertion_sort_klist(pdev, &sorted_devices);
+        }
+        list_splice(&sorted_devices, &pci_bus_type.klist_devices.k_list);
+        spin_unlock(&pci_bus_type.klist_devices.k_lock);
+}
+
+static void __init pci_insertion_sort_devices(struct pci_dev *a, struct list_head *list)
+{
+        struct pci_dev *b;
+
+        list_for_each_entry(b, list, global_list) {
+                if (pci_sort_bf_cmp(a, b) <= 0) {
+                        list_move_tail(&a->global_list, &b->global_list);
+                        return;
+                }
+        }
+        list_move_tail(&a->global_list, list);
+}
+
+static void __init pci_sort_breadthfirst_devices(void)
+{
+        LIST_HEAD(sorted_devices);
+        struct pci_dev *dev, *tmp;
+
+        down_write(&pci_bus_sem);
+        list_for_each_entry_safe(dev, tmp, &pci_devices, global_list) {
+                pci_insertion_sort_devices(dev, &sorted_devices);
+        }
+        list_splice(&sorted_devices, &pci_devices);
+        up_write(&pci_bus_sem);
+}
+
+void __init pci_sort_breadthfirst(void)
+{
+        pci_sort_breadthfirst_devices();
+        pci_sort_breadthfirst_klist();
+}
+
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 23b599d6a9d5..5b4483811691 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -453,6 +453,12 @@ static void __devinit quirk_ich6_lpc_acpi(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_0, quirk_ich6_lpc_acpi );
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_1, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH7_0, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH7_1, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH7_31, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH8_0, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH8_2, quirk_ich6_lpc_acpi );
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH8_3, quirk_ich6_lpc_acpi );
 
 /*
  * VIA ACPI: One IO region pointed to by longword at
@@ -648,11 +654,43 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C686_4,	quirk_vi
  * Some of the on-chip devices are actually '586 devices' so they are
  * listed here.
  */
+
+static int via_irq_fixup_needed = -1;
+
+/*
+ * As some VIA hardware is available in PCI-card form, we need to restrict
+ * this quirk to VIA PCI hardware built onto VIA-based motherboards only.
+ * We try to locate a VIA southbridge before deciding whether the quirk
+ * should be applied.
+ */
+static const struct pci_device_id via_irq_fixup_tbl[] = {
+        {
+                .vendor         = PCI_VENDOR_ID_VIA,
+                .device         = PCI_ANY_ID,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .class          = PCI_CLASS_BRIDGE_ISA << 8,
+                .class_mask     = 0xffff00,
+        },
+        { 0, },
+};
+
 static void quirk_via_irq(struct pci_dev *dev)
 {
         u8 irq, new_irq;
 
-        new_irq = dev->irq & 0xf;
+        if (via_irq_fixup_needed == -1)
+                via_irq_fixup_needed = pci_dev_present(via_irq_fixup_tbl);
+
+        if (!via_irq_fixup_needed)
+                return;
+
+        new_irq = dev->irq;
+
+        /* Don't quirk interrupts outside the legacy IRQ range */
+        if (!new_irq || new_irq > 15)
+                return;
+
         pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
         if (new_irq != irq) {
                 printk(KERN_INFO "PCI: VIA IRQ fixup for %s, from %d to %d\n",
@@ -661,14 +699,7 @@ static void quirk_via_irq(struct pci_dev *dev)
                 pci_write_config_byte(dev, PCI_INTERRUPT_LINE, new_irq);
         }
 }
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_0, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_2, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_3, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235_USB_2, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_ANY_ID, quirk_via_irq);
 
 /*
  * VIA VT82C598 has its device ID settable and many BIOSes
@@ -683,33 +714,6 @@ static void __devinit quirk_vt82c598_id(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_82C597_0,     quirk_vt82c598_id );
 
-#ifdef CONFIG_ACPI_SLEEP
-
-/*
- * Some VIA systems boot with the abnormal status flag set. This can cause
- * the BIOS to re-POST the system on resume rather than passing control
- * back to the OS.  Clear the flag on boot
- */
-static void __devinit quirk_via_abnormal_poweroff(struct pci_dev *dev)
-{
-        u32 reg;
-
-        acpi_hw_register_read(ACPI_MTX_DO_NOT_LOCK, ACPI_REGISTER_PM1_STATUS,
-                                &reg);
-
-        if (reg & 0x800) {
-                printk("Clearing abnormal poweroff flag\n");
-                acpi_hw_register_write(ACPI_MTX_DO_NOT_LOCK,
-                                        ACPI_REGISTER_PM1_STATUS,
-                                        (u16)0x800);
-        }
-}
-
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235, quirk_via_abnormal_poweroff);
-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, quirk_via_abnormal_poweroff);
-
-#endif
-
 /*
  * CardBus controllers have a legacy base address that enables them
  * to respond as i82365 pcmcia controllers.  We don't want them to
@@ -1456,33 +1460,6 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,	0x2609, quirk_intel_pcie_pm);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260a, quirk_intel_pcie_pm);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL,    0x260b, quirk_intel_pcie_pm);
 
-/*
- * Fixup the cardbus bridges on the IBM Dock II docking station
- */
-static void __devinit quirk_ibm_dock2_cardbus(struct pci_dev *dev)
-{
-        u32 val;
-
-        /*
-         * tie the 2 interrupt pins to INTA, and configure the
-         * multifunction routing register to handle this.
-         */
-        if ((dev->subsystem_vendor == PCI_VENDOR_ID_IBM) &&
-                (dev->subsystem_device == 0x0148)) {
-                printk(KERN_INFO "PCI: Found IBM Dock II Cardbus Bridge "
-                        "applying quirk\n");
-                pci_read_config_dword(dev, 0x8c, &val);
-                val = ((val & 0xffffff00) | 0x1002);
-                pci_write_config_dword(dev, 0x8c, val);
-                pci_read_config_dword(dev, 0x80, &val);
-                val = ((val & 0x00ffff00) | 0x2864c077);
-                pci_write_config_dword(dev, 0x80, val);
-        }
-}
-
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_1420,
-                                quirk_ibm_dock2_cardbus);
-
 static void __devinit quirk_netmos(struct pci_dev *dev)
 {
         unsigned int num_parallel = (dev->subsystem_device & 0xf0) >> 4;
@@ -1588,7 +1565,6 @@ static void __devinit fixup_rev1_53c810(struct pci_dev* dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NCR, PCI_DEVICE_ID_NCR_53C810, fixup_rev1_53c810);
 
-
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f, struct pci_fixup *end)
 {
         while (f < end) {
@@ -1764,7 +1740,7 @@ static void __devinit quirk_nvidia_ck804_msi_ht_cap(struct pci_dev *dev)
         /* check HT MSI cap on this chipset and the root one.
          * a single one having MSI is enough to be sure that MSI are supported.
          */
-        pdev = pci_find_slot(dev->bus->number, 0);
+        pdev = pci_get_slot(dev->bus, 0);
         if (dev->subordinate && !msi_ht_cap_enabled(dev)
             && !msi_ht_cap_enabled(pdev)) {
                 printk(KERN_WARNING "PCI: MSI quirk detected. "
@@ -1772,6 +1748,7 @@ static void __devinit quirk_nvidia_ck804_msi_ht_cap(struct pci_dev *dev)
                        pci_name(dev));
                 dev->subordinate->bus_flags |= PCI_BUS_FLAGS_NO_MSI;
         }
+        pci_dev_put(pdev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_CK804_PCIE,
                         quirk_nvidia_ck804_msi_ht_cap);
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index f5ee7ce16fa6..e1dcefc69bb4 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -71,7 +71,11 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
         void __iomem *image;
         int last_image;
 
-        /* IORESOURCE_ROM_SHADOW only set on x86 */
+        /*
+         * IORESOURCE_ROM_SHADOW set on x86, x86_64 and IA64 supports legacy
+         * memory map if the VGA enable bit of the Bridge Control register is
+         * set for embedded VGA.
+         */
         if (res->flags & IORESOURCE_ROM_SHADOW) {
                 /* primary video rom always starts here */
                 start = (loff_t)0xC0000;
diff --git a/drivers/pci/search.c b/drivers/pci/search.c
index d529462d1b53..2f13eba5d5ae 100644
--- a/drivers/pci/search.c
+++ b/drivers/pci/search.c
@@ -140,6 +140,31 @@ struct pci_dev * pci_get_slot(struct pci_bus *bus, unsigned int devfn)
 }
 
 /**
+ * pci_get_bus_and_slot - locate PCI device from a given PCI slot
+ * @bus: number of PCI bus on which desired PCI device resides
+ * @devfn: encodes number of PCI slot in which the desired PCI
+ * device resides and the logical device number within that slot
+ * in case of multi-function devices.
+ *
+ * Given a PCI bus and slot/function number, the desired PCI device
+ * is located in system global list of PCI devices.  If the device
+ * is found, a pointer to its data structure is returned.  If no
+ * device is found, %NULL is returned. The returned device has its
+ * reference count bumped by one.
+ */
+
+struct pci_dev * pci_get_bus_and_slot(unsigned int bus, unsigned int devfn)
+{
+        struct pci_dev *dev = NULL;
+
+        while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+                if (dev->bus->number == bus && dev->devfn == devfn)
+                        return dev;
+        }
+        return NULL;
+}
+
+/**
  * pci_find_subsys - begin or continue searching for a PCI device by vendor/subvendor/device/subdevice id
  * @vendor: PCI vendor id to match, or %PCI_ANY_ID to match all vendor ids
  * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
@@ -274,6 +299,45 @@ pci_get_device(unsigned int vendor, unsigned int device, struct pci_dev *from)
         return pci_get_subsys(vendor, device, PCI_ANY_ID, PCI_ANY_ID, from);
 }
 
+/**
+ * pci_get_device_reverse - begin or continue searching for a PCI device by vendor/device id
+ * @vendor: PCI vendor id to match, or %PCI_ANY_ID to match all vendor ids
+ * @device: PCI device id to match, or %PCI_ANY_ID to match all device ids
+ * @from: Previous PCI device found in search, or %NULL for new search.
+ *
+ * Iterates through the list of known PCI devices in the reverse order of
+ * pci_get_device.
+ * If a PCI device is found with a matching @vendor and @device, the reference
+ * count to the  device is incremented and a pointer to its device structure
+ * is returned Otherwise, %NULL is returned.  A new search is initiated by
+ * passing %NULL as the @from argument.  Otherwise if @from is not %NULL,
+ * searches continue from next device on the global list.  The reference
+ * count for @from is always decremented if it is not %NULL.
+ */
+struct pci_dev *
+pci_get_device_reverse(unsigned int vendor, unsigned int device, struct pci_dev *from)
+{
+        struct list_head *n;
+        struct pci_dev *dev;
+
+        WARN_ON(in_interrupt());
+        down_read(&pci_bus_sem);
+        n = from ? from->global_list.prev : pci_devices.prev;
+
+        while (n && (n != &pci_devices)) {
+                dev = pci_dev_g(n);
+                if ((vendor == PCI_ANY_ID || dev->vendor == vendor) &&
+                    (device == PCI_ANY_ID || dev->device == device))
+                        goto exit;
+                n = n->prev;
+        }
+        dev = NULL;
+exit:
+        dev = pci_dev_get(dev);
+        up_read(&pci_bus_sem);
+        pci_dev_put(from);
+        return dev;
+}
 
 /**
  * pci_find_device_reverse - begin or continue searching for a PCI device by vendor/device id
@@ -382,12 +446,16 @@ exit:
 }
 EXPORT_SYMBOL(pci_dev_present);
 
-EXPORT_SYMBOL(pci_find_bus);
-EXPORT_SYMBOL(pci_find_next_bus);
 EXPORT_SYMBOL(pci_find_device);
 EXPORT_SYMBOL(pci_find_device_reverse);
 EXPORT_SYMBOL(pci_find_slot);
+/* For boot time work */
+EXPORT_SYMBOL(pci_find_bus);
+EXPORT_SYMBOL(pci_find_next_bus);
+/* For everyone */
 EXPORT_SYMBOL(pci_get_device);
+EXPORT_SYMBOL(pci_get_device_reverse);
 EXPORT_SYMBOL(pci_get_subsys);
 EXPORT_SYMBOL(pci_get_slot);
+EXPORT_SYMBOL(pci_get_bus_and_slot);
 EXPORT_SYMBOL(pci_get_class);
diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
index 7f5df9a9f393..3bcb7dc32995 100644
--- a/drivers/pcmcia/at91_cf.c
+++ b/drivers/pcmcia/at91_cf.c
@@ -241,12 +241,6 @@ static int __init at91_cf_probe(struct platform_device *pdev)
         csa = at91_sys_read(AT91_EBI_CSA);
         at91_sys_write(AT91_EBI_CSA, csa | AT91_EBI_CS4A_SMC_COMPACTFLASH);
 
-        /* force poweron defaults for these pins ... */
-        (void) at91_set_A_periph(AT91_PIN_PC9, 0);      /* A25/CFRNW */
-        (void) at91_set_A_periph(AT91_PIN_PC10, 0);     /* NCS4/CFCS */
-        (void) at91_set_A_periph(AT91_PIN_PC11, 0);     /* NCS5/CFCE1 */
-        (void) at91_set_A_periph(AT91_PIN_PC12, 0);     /* NCS6/CFCE2 */
-
         /* nWAIT is _not_ a default setting */
         (void) at91_set_A_periph(AT91_PIN_PC6, 1);      /*  nWAIT */
 
@@ -316,12 +310,14 @@ static int __init at91_cf_probe(struct platform_device *pdev)
         return 0;
 
 fail2:
-        iounmap((void __iomem *) cf->socket.io_offset);
         release_mem_region(io->start, io->end + 1 - io->start);
 fail1:
+        if (cf->socket.io_offset)
+                iounmap((void __iomem *) cf->socket.io_offset);
         if (board->irq_pin)
                 free_irq(board->irq_pin, cf);
 fail0a:
+        device_init_wakeup(&pdev->dev, 0);
         free_irq(board->det_pin, cf);
         device_init_wakeup(&pdev->dev, 0);
 fail0:
@@ -360,26 +356,20 @@ static int at91_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
         struct at91_cf_data     *board = cf->board;
 
         pcmcia_socket_dev_suspend(&pdev->dev, mesg);
-        if (device_may_wakeup(&pdev->dev))
+        if (device_may_wakeup(&pdev->dev)) {
                 enable_irq_wake(board->det_pin);
-        else {
+                if (board->irq_pin)
+                        enable_irq_wake(board->irq_pin);
+        } else {
                 disable_irq_wake(board->det_pin);
-                disable_irq(board->det_pin);
+                if (board->irq_pin)
+                        disable_irq_wake(board->irq_pin);
         }
-        if (board->irq_pin)
-                disable_irq(board->irq_pin);
         return 0;
 }
 
 static int at91_cf_resume(struct platform_device *pdev)
 {
-        struct at91_cf_socket   *cf = platform_get_drvdata(pdev);
-        struct at91_cf_data     *board = cf->board;
-
-        if (board->irq_pin)
-                enable_irq(board->irq_pin);
-        if (!device_may_wakeup(&pdev->dev))
-                enable_irq(board->det_pin);
         pcmcia_socket_dev_resume(&pdev->dev);
         return 0;
 }
diff --git a/drivers/pcmcia/au1000_generic.c b/drivers/pcmcia/au1000_generic.c
index d5dd0ce65536..551bde5d9430 100644
--- a/drivers/pcmcia/au1000_generic.c
+++ b/drivers/pcmcia/au1000_generic.c
@@ -351,6 +351,7 @@ struct skt_dev_info {
 int au1x00_pcmcia_socket_probe(struct device *dev, struct pcmcia_low_level *ops, int first, int nr)
 {
         struct skt_dev_info *sinfo;
+        struct au1000_pcmcia_socket *skt;
         int ret, i;
 
         sinfo = kzalloc(sizeof(struct skt_dev_info), GFP_KERNEL);
@@ -365,7 +366,7 @@ int au1x00_pcmcia_socket_probe(struct device *dev, struct pcmcia_low_level *ops,
          * Initialise the per-socket structure.
          */
         for (i = 0; i < nr; i++) {
-                struct au1000_pcmcia_socket *skt = PCMCIA_SOCKET(i);
+                skt = PCMCIA_SOCKET(i);
                 memset(skt, 0, sizeof(*skt));
 
                 skt->socket.resource_ops = &pccard_static_ops;
@@ -438,17 +439,29 @@ int au1x00_pcmcia_socket_probe(struct device *dev, struct pcmcia_low_level *ops,
         dev_set_drvdata(dev, sinfo);
         return 0;
 
-        do {
-                struct au1000_pcmcia_socket *skt = PCMCIA_SOCKET(i);
+
+out_err:
+        flush_scheduled_work();
+        ops->hw_shutdown(skt);
+        while (i-- > 0) {
+                skt = PCMCIA_SOCKET(i);
 
                 del_timer_sync(&skt->poll_timer);
                 pcmcia_unregister_socket(&skt->socket);
-out_err:
                 flush_scheduled_work();
+                if (i == 0) {
+                        iounmap(skt->virt_io + (u32)mips_io_port_base);
+                        skt->virt_io = NULL;
+                }
+#ifndef CONFIG_MIPS_XXS1500
+                else {
+                        iounmap(skt->virt_io + (u32)mips_io_port_base);
+                        skt->virt_io = NULL;
+                }
+#endif
                 ops->hw_shutdown(skt);
 
-                i--;
-        } while (i > 0);
+        }
         kfree(sinfo);
 out:
         return ret;
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 74b3124e8247..a20d84d707d9 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -717,6 +717,7 @@ static int pcmcia_requery(struct device *dev, void * _data)
 static void pcmcia_bus_rescan(struct pcmcia_socket *skt)
 {
         int no_devices=0;
+        int ret = 0;
         unsigned long flags;
 
         /* must be called with skt_mutex held */
@@ -729,7 +730,7 @@ static void pcmcia_bus_rescan(struct pcmcia_socket *skt)
          * missing resource information or other trouble, we need to
          * do this now. */
         if (no_devices) {
-                int ret = pcmcia_card_add(skt);
+                ret = pcmcia_card_add(skt);
                 if (ret)
                         return;
         }
@@ -741,7 +742,9 @@ static void pcmcia_bus_rescan(struct pcmcia_socket *skt)
 
         /* we re-scan all devices, not just the ones connected to this
          * socket. This does not matter, though. */
-        bus_rescan_devices(&pcmcia_bus_type);
+        ret = bus_rescan_devices(&pcmcia_bus_type);
+        if (ret)
+                printk(KERN_INFO "pcmcia: bus_rescan_devices failed\n");
 }
 
 static inline int pcmcia_devmatch(struct pcmcia_device *dev,
@@ -1001,6 +1004,7 @@ static ssize_t pcmcia_store_allow_func_id_match(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
+        int ret;
 
         if (!count)
                 return -EINVAL;
@@ -1009,7 +1013,10 @@ static ssize_t pcmcia_store_allow_func_id_match(struct device *dev,
         p_dev->allow_func_id_match = 1;
         mutex_unlock(&p_dev->socket->skt_mutex);
 
-        bus_rescan_devices(&pcmcia_bus_type);
+        ret = bus_rescan_devices(&pcmcia_bus_type);
+        if (ret)
+                printk(KERN_INFO "pcmcia: bus_rescan_devices failed after "
+                       "allowing func_id matches\n");
 
         return count;
 }
@@ -1264,6 +1271,9 @@ static void pcmcia_bus_remove_socket(struct class_device *class_dev,
         socket->pcmcia_state.dead = 1;
         pccard_register_pcmcia(socket, NULL);
 
+        /* unregister any unbound devices */
+        pcmcia_card_remove(socket, NULL);
+
         pcmcia_put_socket(socket);
 
         return;
@@ -1292,10 +1302,22 @@ struct bus_type pcmcia_bus_type = {
 
 static int __init init_pcmcia_bus(void)
 {
+        int ret;
+
         spin_lock_init(&pcmcia_dev_list_lock);
 
-        bus_register(&pcmcia_bus_type);
-        class_interface_register(&pcmcia_bus_interface);
+        ret = bus_register(&pcmcia_bus_type);
+        if (ret < 0) {
+                printk(KERN_WARNING "pcmcia: bus_register error: %d\n", ret);
+                return ret;
+        }
+        ret = class_interface_register(&pcmcia_bus_interface);
+        if (ret < 0) {
+                printk(KERN_WARNING
+                        "pcmcia: class_interface_register error: %d\n", ret);
+                bus_unregister(&pcmcia_bus_type);
+                return ret;
+        }
 
         pcmcia_setup_ioctl();
 
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index 82715f448957..c2ea07aa7a12 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -41,6 +41,7 @@ static struct pci_device_id i82092aa_pci_ids[] = {
 };
 MODULE_DEVICE_TABLE(pci, i82092aa_pci_ids);
 
+#ifdef CONFIG_PM
 static int i82092aa_socket_suspend (struct pci_dev *dev, pm_message_t state)
 {
         return pcmcia_socket_dev_suspend(&dev->dev, state);
@@ -50,14 +51,17 @@ static int i82092aa_socket_resume (struct pci_dev *dev)
 {
         return pcmcia_socket_dev_resume(&dev->dev);
 }
+#endif
 
 static struct pci_driver i82092aa_pci_drv = {
         .name           = "i82092aa",
         .id_table       = i82092aa_pci_ids,
         .probe          = i82092aa_pci_probe,
         .remove         = __devexit_p(i82092aa_pci_remove),
+#ifdef CONFIG_PM
         .suspend        = i82092aa_socket_suspend,
         .resume         = i82092aa_socket_resume,
+#endif
 };
 
 
@@ -705,10 +709,7 @@ static int i82092aa_set_mem_map(struct pcmcia_socket *socket, struct pccard_mem_
 
 static int i82092aa_module_init(void)
 {
-        enter("i82092aa_module_init");
-        pci_register_driver(&i82092aa_pci_drv);
-        leave("i82092aa_module_init");
-        return 0;
+        return pci_register_driver(&i82092aa_pci_drv);
 }
 
 static void i82092aa_module_exit(void)
diff --git a/drivers/pcmcia/m8xx_pcmcia.c b/drivers/pcmcia/m8xx_pcmcia.c
index e070a2896769..3b72be880401 100644
--- a/drivers/pcmcia/m8xx_pcmcia.c
+++ b/drivers/pcmcia/m8xx_pcmcia.c
@@ -427,7 +427,7 @@ static int voltage_set(int slot, int vcc, int vpp)
                         reg |= BCSR1_PCCVCC1;
                         break;
                 default:
-                        return 1;
+                        goto out_unmap;
         }
 
         switch(vpp) {
@@ -438,15 +438,15 @@ static int voltage_set(int slot, int vcc, int vpp)
                         if(vcc == vpp)
                                 reg |= BCSR1_PCCVPP1;
                         else
-                                return 1;
+                                goto out_unmap;
                         break;
                 case 120:
                         if ((vcc == 33) || (vcc == 50))
                                 reg |= BCSR1_PCCVPP0;
                         else
-                                return 1;
+                                goto out_unmap;
                 default:
-                        return 1;
+                        goto out_unmap;
         }
 
         /* first, turn off all power */
@@ -457,6 +457,10 @@ static int voltage_set(int slot, int vcc, int vpp)
 
         iounmap(bcsr_io);
         return 0;
+
+out_unmap:
+        iounmap(bcsr_io);
+        return 1;
 }
 
 #define socket_get(_slot_) PCMCIA_SOCKET_KEY_5V
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index c8e838c69766..06bf7f48836e 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -309,9 +309,10 @@ static int __devinit omap_cf_probe(struct device *dev)
         return 0;
 
 fail2:
-        iounmap((void __iomem *) cf->socket.io_offset);
         release_mem_region(cf->phys_cf, SZ_8K);
 fail1:
+        if (cf->socket.io_offset)
+                iounmap((void __iomem *) cf->socket.io_offset);
         free_irq(irq, cf);
 fail0:
         kfree(cf);
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 9ad18e62658d..310ede575caa 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -128,9 +128,12 @@ static int proc_read_drivers(char *buf, char **start, off_t pos,
                              int count, int *eof, void *data)
 {
         char *p = buf;
+        int rc;
 
-        bus_for_each_drv(&pcmcia_bus_type, NULL,
-                         (void *) &p, proc_read_drivers_callback);
+        rc = bus_for_each_drv(&pcmcia_bus_type, NULL,
+                              (void *) &p, proc_read_drivers_callback);
+        if (rc < 0)
+                return rc;
 
         return (p - buf);
 }
@@ -269,8 +272,10 @@ rescan:
          * Prevent this racing with a card insertion.
          */
         mutex_lock(&s->skt_mutex);
-        bus_rescan_devices(&pcmcia_bus_type);
+        ret = bus_rescan_devices(&pcmcia_bus_type);
         mutex_unlock(&s->skt_mutex);
+        if (ret)
+                goto err_put_module;
 
         /* check whether the driver indeed matched. I don't care if this
          * is racy or not, because it can only happen on cardmgr access
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 74cebd424032..b9201c2ec38b 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -95,7 +95,7 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
          * potential conflicts, just the most obvious ones.
          */
         for (i = 0; i < MAX_IO_WIN; i++)
-                if ((s->io[i].res) &&
+                if ((s->io[i].res) && *base &&
                     ((s->io[i].res->start & (align-1)) == *base))
                         return 1;
         for (i = 0; i < MAX_IO_WIN; i++) {
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index c83a0a6b158f..a70f97fdbbdd 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -755,6 +755,7 @@ static void __devexit pd6729_pci_remove(struct pci_dev *dev)
         kfree(socket);
 }
 
+#ifdef CONFIG_PM
 static int pd6729_socket_suspend(struct pci_dev *dev, pm_message_t state)
 {
         return pcmcia_socket_dev_suspend(&dev->dev, state);
@@ -764,6 +765,7 @@ static int pd6729_socket_resume(struct pci_dev *dev)
 {
         return pcmcia_socket_dev_resume(&dev->dev);
 }
+#endif
 
 static struct pci_device_id pd6729_pci_ids[] = {
         {
@@ -781,8 +783,10 @@ static struct pci_driver pd6729_pci_drv = {
         .id_table       = pd6729_pci_ids,
         .probe          = pd6729_pci_probe,
         .remove         = __devexit_p(pd6729_pci_remove),
+#ifdef CONFIG_PM
         .suspend        = pd6729_socket_suspend,
         .resume         = pd6729_socket_resume,
+#endif
 };
 
 static int pd6729_module_init(void)
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index b3518131ea0d..dca9f8549b32 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -166,7 +166,7 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
 
-int pxa2xx_drv_pcmcia_probe(struct device *dev)
+int __pxa2xx_drv_pcmcia_probe(struct device *dev)
 {
         int ret;
         struct pcmcia_low_level *ops;
@@ -203,35 +203,52 @@ int pxa2xx_drv_pcmcia_probe(struct device *dev)
 
         return ret;
 }
-EXPORT_SYMBOL(pxa2xx_drv_pcmcia_probe);
+EXPORT_SYMBOL(__pxa2xx_drv_pcmcia_probe);
 
-static int pxa2xx_drv_pcmcia_resume(struct device *dev)
+
+static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
+{
+        return __pxa2xx_drv_pcmcia_probe(&dev->dev);
+}
+
+static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
+{
+        return soc_common_drv_pcmcia_remove(&dev->dev);
+}
+
+static int pxa2xx_drv_pcmcia_suspend(struct platform_device *dev, pm_message_t state)
+{
+        return pcmcia_socket_dev_suspend(&dev->dev, state);
+}
+
+static int pxa2xx_drv_pcmcia_resume(struct platform_device *dev)
 {
-        struct pcmcia_low_level *ops = dev->platform_data;
+        struct pcmcia_low_level *ops = dev->dev.platform_data;
         int nr = ops ? ops->nr : 0;
 
         MECR = nr > 1 ? MECR_CIT | MECR_NOS : (nr > 0 ? MECR_CIT : 0);
 
-        return pcmcia_socket_dev_resume(dev);
+        return pcmcia_socket_dev_resume(&dev->dev);
 }
 
-static struct device_driver pxa2xx_pcmcia_driver = {
+static struct platform_driver pxa2xx_pcmcia_driver = {
         .probe          = pxa2xx_drv_pcmcia_probe,
-        .remove         = soc_common_drv_pcmcia_remove,
-        .suspend        = pcmcia_socket_dev_suspend,
+        .remove         = pxa2xx_drv_pcmcia_remove,
+        .suspend        = pxa2xx_drv_pcmcia_suspend,
         .resume         = pxa2xx_drv_pcmcia_resume,
-        .name           = "pxa2xx-pcmcia",
-        .bus            = &platform_bus_type,
+        .driver         = {
+                .name   = "pxa2xx-pcmcia",
+        },
 };
 
 static int __init pxa2xx_pcmcia_init(void)
 {
-        return driver_register(&pxa2xx_pcmcia_driver);
+        return platform_driver_register(&pxa2xx_pcmcia_driver);
 }
 
 static void __exit pxa2xx_pcmcia_exit(void)
 {
-        driver_unregister(&pxa2xx_pcmcia_driver);
+        platform_driver_unregister(&pxa2xx_pcmcia_driver);
 }
 
 fs_initcall(pxa2xx_pcmcia_init);
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index e46cff345d47..235d681652c3 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,3 +1,3 @@
 /* temporary measure */
-extern int pxa2xx_drv_pcmcia_probe(struct device *);
+extern int __pxa2xx_drv_pcmcia_probe(struct device *);
 
diff --git a/drivers/pcmcia/pxa2xx_lubbock.c b/drivers/pcmcia/pxa2xx_lubbock.c
index fd1f691c7c2c..a92f11143c43 100644
--- a/drivers/pcmcia/pxa2xx_lubbock.c
+++ b/drivers/pcmcia/pxa2xx_lubbock.c
@@ -260,7 +260,7 @@ int __init pcmcia_lubbock_init(struct sa1111_dev *sadev)
                 lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
 
                 sadev->dev.platform_data = &lubbock_pcmcia_ops;
-                ret = pxa2xx_drv_pcmcia_probe(&sadev->dev);
+                ret = __pxa2xx_drv_pcmcia_probe(&sadev->dev);
         }
 
         return ret;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index 3627e52e0c27..e433704e026a 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -824,3 +824,4 @@ int soc_common_drv_pcmcia_remove(struct device *dev)
 
         return 0;
 }
+EXPORT_SYMBOL(soc_common_drv_pcmcia_remove);
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 26229d9da762..da471bddc972 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -1197,8 +1197,12 @@ static int __devinit yenta_probe (struct pci_dev *dev, const struct pci_device_i
         ret = pcmcia_register_socket(&socket->socket);
         if (ret == 0) {
                 /* Add the yenta register attributes */
-                device_create_file(&dev->dev, &dev_attr_yenta_registers);
-                goto out;
+                ret = device_create_file(&dev->dev, &dev_attr_yenta_registers);
+                if (ret == 0)
+                        goto out;
+
+                /* error path... */
+                pcmcia_unregister_socket(&socket->socket);
         }
 
  unmap:
@@ -1213,7 +1217,7 @@ static int __devinit yenta_probe (struct pci_dev *dev, const struct pci_device_i
         return ret;
 }
 
-
+#ifdef CONFIG_PM
 static int yenta_dev_suspend (struct pci_dev *dev, pm_message_t state)
 {
         struct yenta_socket *socket = pci_get_drvdata(dev);
@@ -1248,12 +1252,18 @@ static int yenta_dev_resume (struct pci_dev *dev)
         struct yenta_socket *socket = pci_get_drvdata(dev);
 
         if (socket) {
+                int rc;
+
                 pci_set_power_state(dev, 0);
                 /* FIXME: pci_restore_state needs to have a better interface */
                 pci_restore_state(dev);
                 pci_write_config_dword(dev, 16*4, socket->saved_state[0]);
                 pci_write_config_dword(dev, 17*4, socket->saved_state[1]);
-                pci_enable_device(dev);
+
+                rc = pci_enable_device(dev);
+                if (rc)
+                        return rc;
+
                 pci_set_master(dev);
 
                 if (socket->type && socket->type->restore_state)
@@ -1262,7 +1272,7 @@ static int yenta_dev_resume (struct pci_dev *dev)
 
         return pcmcia_socket_dev_resume(&dev->dev);
 }
-
+#endif
 
 #define CB_ID(vend,dev,type)                            \
         {                                               \
@@ -1359,8 +1369,10 @@ static struct pci_driver yenta_cardbus_driver = {
         .id_table       = yenta_table,
         .probe          = yenta_probe,
         .remove         = __devexit_p(yenta_close),
+#ifdef CONFIG_PM
         .suspend        = yenta_dev_suspend,
         .resume         = yenta_dev_resume,
+#endif
 };
 
 
diff --git a/drivers/pnp/pnpacpi/rsparser.c b/drivers/pnp/pnpacpi/rsparser.c
index dc79b0a0059f..379048fdf05d 100644
--- a/drivers/pnp/pnpacpi/rsparser.c
+++ b/drivers/pnp/pnpacpi/rsparser.c
@@ -776,21 +776,32 @@ static void pnpacpi_encode_dma(struct acpi_resource *resource,
         struct resource *p)
 {
         /* Note: pnp_assign_dma will copy pnp_dma->flags into p->flags */
-        if (p->flags & IORESOURCE_DMA_COMPATIBLE)
-                resource->data.dma.type = ACPI_COMPATIBILITY;
-        else if (p->flags & IORESOURCE_DMA_TYPEA)
-                resource->data.dma.type = ACPI_TYPE_A;
-        else if (p->flags & IORESOURCE_DMA_TYPEB)
-                resource->data.dma.type = ACPI_TYPE_B;
-        else if (p->flags & IORESOURCE_DMA_TYPEF)
-                resource->data.dma.type = ACPI_TYPE_F;
-        if (p->flags & IORESOURCE_DMA_8BIT)
-                resource->data.dma.transfer = ACPI_TRANSFER_8;
-        else if (p->flags & IORESOURCE_DMA_8AND16BIT)
-                resource->data.dma.transfer = ACPI_TRANSFER_8_16;
-        else if (p->flags & IORESOURCE_DMA_16BIT)
-                resource->data.dma.transfer = ACPI_TRANSFER_16;
-        resource->data.dma.bus_master = p->flags & IORESOURCE_DMA_MASTER;
+        switch (p->flags & IORESOURCE_DMA_SPEED_MASK) {
+                case IORESOURCE_DMA_TYPEA:
+                        resource->data.dma.type = ACPI_TYPE_A;
+                        break;
+                case IORESOURCE_DMA_TYPEB:
+                        resource->data.dma.type = ACPI_TYPE_B;
+                        break;
+                case IORESOURCE_DMA_TYPEF:
+                        resource->data.dma.type = ACPI_TYPE_F;
+                        break;
+                default:
+                        resource->data.dma.type = ACPI_COMPATIBILITY;
+        }
+
+        switch (p->flags & IORESOURCE_DMA_TYPE_MASK) {
+                case IORESOURCE_DMA_8BIT:
+                        resource->data.dma.transfer = ACPI_TRANSFER_8;
+                        break;
+                case IORESOURCE_DMA_8AND16BIT:
+                        resource->data.dma.transfer = ACPI_TRANSFER_8_16;
+                        break;
+                default:
+                        resource->data.dma.transfer = ACPI_TRANSFER_16;
+        }
+
+        resource->data.dma.bus_master = !!(p->flags & IORESOURCE_DMA_MASTER);
         resource->data.dma.channel_count = 1;
         resource->data.dma.channels[0] = p->start;
 }
diff --git a/drivers/rtc/rtc-max6902.c b/drivers/rtc/rtc-max6902.c
index 0b20dfacbf59..d94170728075 100644
--- a/drivers/rtc/rtc-max6902.c
+++ b/drivers/rtc/rtc-max6902.c
@@ -136,7 +136,7 @@ static int max6902_get_datetime(struct device *dev, struct rtc_time *dt)
         dt->tm_min      = BCD2BIN(chip->buf[2]);
         dt->tm_hour     = BCD2BIN(chip->buf[3]);
         dt->tm_mday     = BCD2BIN(chip->buf[4]);
-        dt->tm_mon      = BCD2BIN(chip->buf[5] - 1);
+        dt->tm_mon      = BCD2BIN(chip->buf[5]) - 1;
         dt->tm_wday     = BCD2BIN(chip->buf[6]);
         dt->tm_year = BCD2BIN(chip->buf[7]);
 
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 8b6efcc05058..143302a8e79c 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -160,7 +160,7 @@ static int sh_rtc_open(struct device *dev)
         tmp |= RCR1_CIE;
         writeb(tmp, rtc->regbase + RCR1);
 
-        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, SA_INTERRUPT,
+        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, IRQF_DISABLED,
                           "sh-rtc period", dev);
         if (unlikely(ret)) {
                 dev_err(dev, "request period IRQ failed with %d, IRQ %d\n",
@@ -168,7 +168,7 @@ static int sh_rtc_open(struct device *dev)
                 return ret;
         }
 
-        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, SA_INTERRUPT,
+        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, IRQF_DISABLED,
                           "sh-rtc carry", dev);
         if (unlikely(ret)) {
                 dev_err(dev, "request carry IRQ failed with %d, IRQ %d\n",
@@ -177,7 +177,7 @@ static int sh_rtc_open(struct device *dev)
                 goto err_bad_carry;
         }
 
-        ret = request_irq(rtc->alarm_irq, sh_rtc_interrupt, SA_INTERRUPT,
+        ret = request_irq(rtc->alarm_irq, sh_rtc_interrupt, IRQF_DISABLED,
                           "sh-rtc alarm", dev);
         if (unlikely(ret)) {
                 dev_err(dev, "request alarm IRQ failed with %d, IRQ %d\n",
diff --git a/drivers/rtc/rtc-v3020.c b/drivers/rtc/rtc-v3020.c
index 09b714f1cdc3..3b58d3d5d38a 100644
--- a/drivers/rtc/rtc-v3020.c
+++ b/drivers/rtc/rtc-v3020.c
@@ -195,9 +195,9 @@ static int rtc_probe(struct platform_device *pdev)
          * are all disabled */
         v3020_set_reg(chip, V3020_STATUS_0, 0x0);
 
-        dev_info(&pdev->dev, "Chip available at physical address 0x%p,"
+        dev_info(&pdev->dev, "Chip available at physical address 0x%llx,"
                 "data connected to D%d\n",
-                (void*)pdev->resource[0].start,
+                (unsigned long long)pdev->resource[0].start,
                 chip->leftshift);
 
         platform_set_drvdata(pdev, chip);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index d0647d116eaa..79ffef6bfaf8 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -203,6 +203,7 @@ dasd_state_basic_to_known(struct dasd_device * device)
         rc = dasd_flush_ccw_queue(device, 1);
         if (rc)
                 return rc;
+        dasd_clear_timer(device);
 
         DBF_DEV_EVENT(DBF_EMERG, device, "%p debug area deleted", device);
         if (device->debug_area != NULL) {
diff --git a/drivers/s390/char/monwriter.c b/drivers/s390/char/monwriter.c
index 4362ff260244..b9b0fc3f812b 100644
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -73,12 +73,15 @@ static inline struct mon_buf *monwrite_find_hdr(struct mon_private *monpriv,
         struct mon_buf *entry, *next;
 
         list_for_each_entry_safe(entry, next, &monpriv->list, list)
-                if (entry->hdr.applid == monhdr->applid &&
+                if ((entry->hdr.mon_function == monhdr->mon_function ||
+                     monhdr->mon_function == MONWRITE_STOP_INTERVAL) &&
+                    entry->hdr.applid == monhdr->applid &&
                     entry->hdr.record_num == monhdr->record_num &&
                     entry->hdr.version == monhdr->version &&
                     entry->hdr.release == monhdr->release &&
                     entry->hdr.mod_level == monhdr->mod_level)
                         return entry;
+
         return NULL;
 }
 
@@ -92,7 +95,9 @@ static int monwrite_new_hdr(struct mon_private *monpriv)
             monhdr->mon_function > MONWRITE_START_CONFIG ||
             monhdr->hdrlen != sizeof(struct monwrite_hdr))
                 return -EINVAL;
-        monbuf = monwrite_find_hdr(monpriv, monhdr);
+        monbuf = NULL;
+        if (monhdr->mon_function != MONWRITE_GEN_EVENT)
+                monbuf = monwrite_find_hdr(monpriv, monhdr);
         if (monbuf) {
                 if (monhdr->mon_function == MONWRITE_STOP_INTERVAL) {
                         monhdr->datalen = monbuf->hdr.datalen;
@@ -104,13 +109,13 @@ static int monwrite_new_hdr(struct mon_private *monpriv)
                         kfree(monbuf);
                         monbuf = NULL;
                 }
-        } else {
+        } else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) {
                 if (mon_buf_count >= mon_max_bufs)
                         return -ENOSPC;
                 monbuf = kzalloc(sizeof(struct mon_buf), GFP_KERNEL);
                 if (!monbuf)
                         return -ENOMEM;
-                monbuf->data = kzalloc(monbuf->hdr.datalen,
+                monbuf->data = kzalloc(monhdr->datalen,
                                        GFP_KERNEL | GFP_DMA);
                 if (!monbuf->data) {
                         kfree(monbuf);
@@ -118,7 +123,8 @@ static int monwrite_new_hdr(struct mon_private *monpriv)
                 }
                 monbuf->hdr = *monhdr;
                 list_add_tail(&monbuf->list, &monpriv->list);
-                mon_buf_count++;
+                if (monhdr->mon_function != MONWRITE_GEN_EVENT)
+                        mon_buf_count++;
         }
         monpriv->current_buf = monbuf;
         return 0;
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 07c7f19339d2..2d78f0f4a40f 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -370,7 +370,7 @@ __s390_process_res_acc(struct subchannel_id schid, void *data)
         struct res_acc_data *res_data;
         struct subchannel *sch;
 
-        res_data = (struct res_acc_data *)data;
+        res_data = data;
         sch = get_subchannel_by_schid(schid);
         if (!sch)
                 /* Check if a subchannel is newly available. */
@@ -444,7 +444,7 @@ __get_chpid_from_lir(void *data)
                 u32 isinfo[28];
         } *lir;
 
-        lir = (struct lir*) data;
+        lir = data;
         if (!(lir->iq&0x80))
                 /* NULL link incident record */
                 return -EINVAL;
@@ -628,7 +628,7 @@ __chp_add(struct subchannel_id schid, void *data)
         struct channel_path *chp;
         struct subchannel *sch;
 
-        chp = (struct channel_path *)data;
+        chp = data;
         sch = get_subchannel_by_schid(schid);
         if (!sch)
                 /* Check if the subchannel is now available. */
@@ -707,8 +707,7 @@ chp_process_crw(int chpid, int on)
         return chp_add(chpid);
 }
 
-static inline int
-__check_for_io_and_kill(struct subchannel *sch, int index)
+static inline int check_for_io_on_path(struct subchannel *sch, int index)
 {
         int cc;
 
@@ -718,10 +717,8 @@ __check_for_io_and_kill(struct subchannel *sch, int index)
         cc = stsch(sch->schid, &sch->schib);
         if (cc)
                 return 0;
-        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == (0x80 >> index)) {
-                device_set_waiting(sch);
+        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == (0x80 >> index))
                 return 1;
-        }
         return 0;
 }
 
@@ -750,12 +747,10 @@ __s390_subchannel_vary_chpid(struct subchannel *sch, __u8 chpid, int on)
                 } else {
                         sch->opm &= ~(0x80 >> chp);
                         sch->lpm &= ~(0x80 >> chp);
-                        /*
-                         * Give running I/O a grace period in which it
-                         * can successfully terminate, even using the
-                         * just varied off path. Then kill it.
-                         */
-                        if (!__check_for_io_and_kill(sch, chp) && !sch->lpm) {
+                        if (check_for_io_on_path(sch, chp))
+                                /* Path verification is done after killing. */
+                                device_kill_io(sch);
+                        else if (!sch->lpm) {
                                 if (css_enqueue_subchannel_slow(sch->schid)) {
                                         css_clear_subchannel_slow_list();
                                         need_rescan = 1;
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index f18b1623cad7..8936e460a807 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -609,8 +609,8 @@ do_IRQ (struct pt_regs *regs)
         struct irb *irb;
         struct pt_regs *old_regs;
 
-        irq_enter ();
         old_regs = set_irq_regs(regs);
+        irq_enter();
         asm volatile ("mc 0,0");
         if (S390_lowcore.int_clock >= S390_lowcore.jiffy_timer)
                 /**
@@ -655,8 +655,8 @@ do_IRQ (struct pt_regs *regs)
                  * out of the sie which costs more cycles than it saves.
                  */
         } while (!MACHINE_IS_VM && tpi (NULL) != 0);
+        irq_exit();
         set_irq_regs(old_regs);
-        irq_exit ();
 }
 
 #ifdef CONFIG_CCW_CONSOLE
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 7086a74e9871..ad7f7e1c0163 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -177,7 +177,7 @@ get_subchannel_by_schid(struct subchannel_id schid)
         struct device *dev;
 
         dev = bus_find_device(&css_bus_type, NULL,
-                              (void *)&schid, check_subchannel);
+                              &schid, check_subchannel);
 
         return dev ? to_subchannel(dev) : NULL;
 }
@@ -271,10 +271,6 @@ static int css_evaluate_known_subchannel(struct subchannel *sch, int slow)
                 /* Reset intparm to zeroes. */
                 sch->schib.pmcw.intparm = 0;
                 cio_modify(sch);
-
-                /* Probe if necessary. */
-                if (action == UNREGISTER_PROBE)
-                        ret = css_probe_device(sch->schid);
                 break;
         case REPROBE:
                 device_trigger_reprobe(sch);
@@ -283,6 +279,9 @@ static int css_evaluate_known_subchannel(struct subchannel *sch, int slow)
                 break;
         }
         spin_unlock_irqrestore(&sch->lock, flags);
+        /* Probe if necessary. */
+        if (action == UNREGISTER_PROBE)
+                ret = css_probe_device(sch->schid);
 
         return ret;
 }
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 8aabb4adeb5f..4c2ff8336288 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -76,9 +76,8 @@ struct ccw_device_private {
         int state;              /* device state */
         atomic_t onoff;
         unsigned long registered;
-        __u16 devno;            /* device number */
-        __u16 sch_no;           /* subchannel number */
-        __u8 ssid;              /* subchannel set id */
+        struct ccw_dev_id dev_id;       /* device id */
+        struct subchannel_id schid;     /* subchannel number */
         __u8 imask;             /* lpm mask for SNID/SID/SPGID */
         int iretry;             /* retry counter SNID/SID/SPGID */
         struct {
@@ -171,7 +170,7 @@ void device_trigger_reprobe(struct subchannel *);
 
 /* Helper functions for vary on/off. */
 int device_is_online(struct subchannel *);
-void device_set_waiting(struct subchannel *);
+void device_kill_io(struct subchannel *);
 
 /* Machine check helper function. */
 void device_kill_pending_timer(struct subchannel *);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 688945662c15..39c98f940507 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -532,8 +532,7 @@ device_remove_files(struct device *dev)
 
 /* this is a simple abstraction for device_register that sets the
  * correct bus type and adds the bus specific files */
-int
-ccw_device_register(struct ccw_device *cdev)
+static int ccw_device_register(struct ccw_device *cdev)
 {
         struct device *dev = &cdev->dev;
         int ret;
@@ -552,21 +551,19 @@ ccw_device_register(struct ccw_device *cdev)
 }
 
 struct match_data {
-        unsigned int devno;
-        unsigned int ssid;
+        struct ccw_dev_id dev_id;
         struct ccw_device * sibling;
 };
 
 static int
 match_devno(struct device * dev, void * data)
 {
-        struct match_data * d = (struct match_data *)data;
+        struct match_data * d = data;
         struct ccw_device * cdev;
 
         cdev = to_ccwdev(dev);
         if ((cdev->private->state == DEV_STATE_DISCONNECTED) &&
-            (cdev->private->devno == d->devno) &&
-            (cdev->private->ssid == d->ssid) &&
+            ccw_dev_id_is_equal(&cdev->private->dev_id, &d->dev_id) &&
             (cdev != d->sibling)) {
                 cdev->private->state = DEV_STATE_NOT_OPER;
                 return 1;
@@ -574,15 +571,13 @@ match_devno(struct device * dev, void * data)
         return 0;
 }
 
-static struct ccw_device *
-get_disc_ccwdev_by_devno(unsigned int devno, unsigned int ssid,
-                         struct ccw_device *sibling)
+static struct ccw_device * get_disc_ccwdev_by_dev_id(struct ccw_dev_id *dev_id,
+                                                     struct ccw_device *sibling)
 {
         struct device *dev;
         struct match_data data;
 
-        data.devno = devno;
-        data.ssid = ssid;
+        data.dev_id = *dev_id;
         data.sibling = sibling;
         dev = bus_find_device(&ccw_bus_type, NULL, &data, match_devno);
 
@@ -595,7 +590,7 @@ ccw_device_add_changed(void *data)
 
         struct ccw_device *cdev;
 
-        cdev = (struct ccw_device *)data;
+        cdev = data;
         if (device_add(&cdev->dev)) {
                 put_device(&cdev->dev);
                 return;
@@ -616,9 +611,9 @@ ccw_device_do_unreg_rereg(void *data)
         struct subchannel *sch;
         int need_rename;
 
-        cdev = (struct ccw_device *)data;
+        cdev = data;
         sch = to_subchannel(cdev->dev.parent);
-        if (cdev->private->devno != sch->schib.pmcw.dev) {
+        if (cdev->private->dev_id.devno != sch->schib.pmcw.dev) {
                 /*
                  * The device number has changed. This is usually only when
                  * a device has been detached under VM and then re-appeared
@@ -633,10 +628,12 @@ ccw_device_do_unreg_rereg(void *data)
                  *        get possibly sick...
                  */
                 struct ccw_device *other_cdev;
+                struct ccw_dev_id dev_id;
 
                 need_rename = 1;
-                other_cdev = get_disc_ccwdev_by_devno(sch->schib.pmcw.dev,
-                                                      sch->schid.ssid, cdev);
+                dev_id.devno = sch->schib.pmcw.dev;
+                dev_id.ssid = sch->schid.ssid;
+                other_cdev = get_disc_ccwdev_by_dev_id(&dev_id, cdev);
                 if (other_cdev) {
                         struct subchannel *other_sch;
 
@@ -652,7 +649,7 @@ ccw_device_do_unreg_rereg(void *data)
                 }
                 /* Update ssd info here. */
                 css_get_ssd_info(sch);
-                cdev->private->devno = sch->schib.pmcw.dev;
+                cdev->private->dev_id.devno = sch->schib.pmcw.dev;
         } else
                 need_rename = 0;
         device_remove_files(&cdev->dev);
@@ -662,7 +659,7 @@ ccw_device_do_unreg_rereg(void *data)
                 snprintf (cdev->dev.bus_id, BUS_ID_SIZE, "0.%x.%04x",
                           sch->schid.ssid, sch->schib.pmcw.dev);
         PREPARE_WORK(&cdev->private->kick_work,
-                     ccw_device_add_changed, (void *)cdev);
+                     ccw_device_add_changed, cdev);
         queue_work(ccw_device_work, &cdev->private->kick_work);
 }
 
@@ -687,7 +684,7 @@ io_subchannel_register(void *data)
         int ret;
         unsigned long flags;
 
-        cdev = (struct ccw_device *) data;
+        cdev = data;
         sch = to_subchannel(cdev->dev.parent);
 
         if (klist_node_attached(&cdev->dev.knode_parent)) {
@@ -759,7 +756,7 @@ io_subchannel_recog_done(struct ccw_device *cdev)
                         break;
                 sch = to_subchannel(cdev->dev.parent);
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *) cdev);
+                             ccw_device_call_sch_unregister, cdev);
                 queue_work(slow_path_wq, &cdev->private->kick_work);
                 if (atomic_dec_and_test(&ccw_device_init_count))
                         wake_up(&ccw_device_init_wq);
@@ -774,7 +771,7 @@ io_subchannel_recog_done(struct ccw_device *cdev)
                 if (!get_device(&cdev->dev))
                         break;
                 PREPARE_WORK(&cdev->private->kick_work,
-                             io_subchannel_register, (void *) cdev);
+                             io_subchannel_register, cdev);
                 queue_work(slow_path_wq, &cdev->private->kick_work);
                 break;
         }
@@ -792,9 +789,9 @@ io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
 
         /* Init private data. */
         priv = cdev->private;
-        priv->devno = sch->schib.pmcw.dev;
-        priv->ssid = sch->schid.ssid;
-        priv->sch_no = sch->schid.sch_no;
+        priv->dev_id.devno = sch->schib.pmcw.dev;
+        priv->dev_id.ssid = sch->schid.ssid;
+        priv->schid = sch->schid;
         priv->state = DEV_STATE_NOT_OPER;
         INIT_LIST_HEAD(&priv->cmb_list);
         init_waitqueue_head(&priv->wait_q);
@@ -912,7 +909,7 @@ io_subchannel_remove (struct subchannel *sch)
          */
         if (get_device(&cdev->dev)) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_unregister, (void *) cdev);
+                             ccw_device_unregister, cdev);
                 queue_work(ccw_device_work, &cdev->private->kick_work);
         }
         return 0;
@@ -1055,7 +1052,7 @@ __ccwdev_check_busid(struct device *dev, void *id)
 {
         char *bus_id;
 
-        bus_id = (char *)id;
+        bus_id = id;
 
         return (strncmp(bus_id, dev->bus_id, BUS_ID_SIZE) == 0);
 }
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index 00be9a5b4acd..9233b5c0bcc8 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -21,7 +21,6 @@ enum dev_state {
         /* states to wait for i/o completion before doing something */
         DEV_STATE_CLEAR_VERIFY,
         DEV_STATE_TIMEOUT_KILL,
-        DEV_STATE_WAIT4IO,
         DEV_STATE_QUIESCE,
         /* special states for devices gone not operational */
         DEV_STATE_DISCONNECTED,
@@ -79,7 +78,6 @@ void io_subchannel_recog_done(struct ccw_device *cdev);
 
 int ccw_device_cancel_halt_clear(struct ccw_device *);
 
-int ccw_device_register(struct ccw_device *);
 void ccw_device_do_unreg_rereg(void *);
 void ccw_device_call_sch_unregister(void *);
 
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index b67620208f36..de3d0857db9f 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -59,18 +59,6 @@ device_set_disconnected(struct subchannel *sch)
         cdev->private->state = DEV_STATE_DISCONNECTED;
 }
 
-void
-device_set_waiting(struct subchannel *sch)
-{
-        struct ccw_device *cdev;
-
-        if (!sch->dev.driver_data)
-                return;
-        cdev = sch->dev.driver_data;
-        ccw_device_set_timeout(cdev, 10*HZ);
-        cdev->private->state = DEV_STATE_WAIT4IO;
-}
-
 /*
  * Timeout function. It just triggers a DEV_EVENT_TIMEOUT.
  */
@@ -183,9 +171,9 @@ ccw_device_handle_oper(struct ccw_device *cdev)
             cdev->id.cu_model != cdev->private->senseid.cu_model ||
             cdev->id.dev_type != cdev->private->senseid.dev_type ||
             cdev->id.dev_model != cdev->private->senseid.dev_model ||
-            cdev->private->devno != sch->schib.pmcw.dev) {
+            cdev->private->dev_id.devno != sch->schib.pmcw.dev) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_do_unreg_rereg, (void *)cdev);
+                             ccw_device_do_unreg_rereg, cdev);
                 queue_work(ccw_device_work, &cdev->private->kick_work);
                 return 0;
         }
@@ -255,7 +243,7 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
         case DEV_STATE_NOT_OPER:
                 CIO_DEBUG(KERN_WARNING, 2,
                           "SenseID : unknown device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->devno,
+                          "0.%x.%04x\n", cdev->private->dev_id.devno,
                           sch->schid.ssid, sch->schid.sch_no);
                 break;
         case DEV_STATE_OFFLINE:
@@ -282,14 +270,15 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
                 CIO_DEBUG(KERN_INFO, 2, "SenseID : device 0.%x.%04x reports: "
                           "CU  Type/Mod = %04X/%02X, Dev Type/Mod = "
                           "%04X/%02X\n",
-                          cdev->private->ssid, cdev->private->devno,
+                          cdev->private->dev_id.ssid,
+                          cdev->private->dev_id.devno,
                           cdev->id.cu_type, cdev->id.cu_model,
                           cdev->id.dev_type, cdev->id.dev_model);
                 break;
         case DEV_STATE_BOXED:
                 CIO_DEBUG(KERN_WARNING, 2,
                           "SenseID : boxed device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->devno,
+                          "0.%x.%04x\n", cdev->private->dev_id.devno,
                           sch->schid.ssid, sch->schid.sch_no);
                 break;
         }
@@ -325,13 +314,13 @@ ccw_device_oper_notify(void *data)
         struct subchannel *sch;
         int ret;
 
-        cdev = (struct ccw_device *)data;
+        cdev = data;
         sch = to_subchannel(cdev->dev.parent);
         ret = (sch->driver && sch->driver->notify) ?
                 sch->driver->notify(&sch->dev, CIO_OPER) : 0;
         if (!ret)
                 /* Driver doesn't want device back. */
-                ccw_device_do_unreg_rereg((void *)cdev);
+                ccw_device_do_unreg_rereg(cdev);
         else {
                 /* Reenable channel measurements, if needed. */
                 cmf_reenable(cdev);
@@ -363,12 +352,12 @@ ccw_device_done(struct ccw_device *cdev, int state)
         if (state == DEV_STATE_BOXED)
                 CIO_DEBUG(KERN_WARNING, 2,
                           "Boxed device %04x on subchannel %04x\n",
-                          cdev->private->devno, sch->schid.sch_no);
+                          cdev->private->dev_id.devno, sch->schid.sch_no);
 
         if (cdev->private->flags.donotify) {
                 cdev->private->flags.donotify = 0;
                 PREPARE_WORK(&cdev->private->kick_work, ccw_device_oper_notify,
-                             (void *)cdev);
+                             cdev);
                 queue_work(ccw_device_notify_work, &cdev->private->kick_work);
         }
         wake_up(&cdev->private->wait_q);
@@ -412,7 +401,8 @@ static void __ccw_device_get_common_pgid(struct ccw_device *cdev)
                 /* PGID mismatch, can't pathgroup. */
                 CIO_MSG_EVENT(0, "SNID - pgid mismatch for device "
                               "0.%x.%04x, can't pathgroup\n",
-                              cdev->private->ssid, cdev->private->devno);
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno);
                 cdev->private->options.pgroup = 0;
                 return;
         }
@@ -523,7 +513,7 @@ ccw_device_nopath_notify(void *data)
         struct subchannel *sch;
         int ret;
 
-        cdev = (struct ccw_device *)data;
+        cdev = data;
         sch = to_subchannel(cdev->dev.parent);
         /* Extra sanity. */
         if (sch->lpm)
@@ -537,7 +527,7 @@ ccw_device_nopath_notify(void *data)
                         if (get_device(&cdev->dev)) {
                                 PREPARE_WORK(&cdev->private->kick_work,
                                              ccw_device_call_sch_unregister,
-                                             (void *)cdev);
+                                             cdev);
                                 queue_work(ccw_device_work,
                                            &cdev->private->kick_work);
                         } else
@@ -588,11 +578,15 @@ ccw_device_verify_done(struct ccw_device *cdev, int err)
                 }
                 break;
         case -ETIME:
+                /* Reset oper notify indication after verify error. */
+                cdev->private->flags.donotify = 0;
                 ccw_device_done(cdev, DEV_STATE_BOXED);
                 break;
         default:
+                /* Reset oper notify indication after verify error. */
+                cdev->private->flags.donotify = 0;
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                 queue_work(ccw_device_notify_work, &cdev->private->kick_work);
                 ccw_device_done(cdev, DEV_STATE_NOT_OPER);
                 break;
@@ -723,7 +717,7 @@ ccw_device_offline_notoper(struct ccw_device *cdev, enum dev_event dev_event)
         sch = to_subchannel(cdev->dev.parent);
         if (get_device(&cdev->dev)) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *)cdev);
+                             ccw_device_call_sch_unregister, cdev);
                 queue_work(ccw_device_work, &cdev->private->kick_work);
         }
         wake_up(&cdev->private->wait_q);
@@ -754,7 +748,7 @@ ccw_device_online_notoper(struct ccw_device *cdev, enum dev_event dev_event)
         }
         if (get_device(&cdev->dev)) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *)cdev);
+                             ccw_device_call_sch_unregister, cdev);
                 queue_work(ccw_device_work, &cdev->private->kick_work);
         }
         wake_up(&cdev->private->wait_q);
@@ -859,7 +853,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event)
                 sch = to_subchannel(cdev->dev.parent);
                 if (!sch->lpm) {
                         PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                         queue_work(ccw_device_notify_work,
                                    &cdev->private->kick_work);
                 } else
@@ -885,7 +879,8 @@ ccw_device_w4sense(struct ccw_device *cdev, enum dev_event dev_event)
                         /* Basic sense hasn't started. Try again. */
                         ccw_device_do_sense(cdev, irb);
                 else {
-                        printk("Huh? %s(%s): unsolicited interrupt...\n",
+                        printk(KERN_INFO "Huh? %s(%s): unsolicited "
+                               "interrupt...\n",
                                __FUNCTION__, cdev->dev.bus_id);
                         if (cdev->handler)
                                 cdev->handler (cdev, 0, irb);
@@ -944,10 +939,10 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
         cdev->private->state = DEV_STATE_ONLINE;
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
+                              ERR_PTR(-EIO));
         if (!sch->lpm) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                 queue_work(ccw_device_notify_work, &cdev->private->kick_work);
         } else if (cdev->private->flags.doverify)
                 /* Start delayed path verification. */
@@ -970,7 +965,7 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
                 sch = to_subchannel(cdev->dev.parent);
                 if (!sch->lpm) {
                         PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                         queue_work(ccw_device_notify_work,
                                    &cdev->private->kick_work);
                 } else
@@ -981,51 +976,15 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
         cdev->private->state = DEV_STATE_ONLINE;
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
-}
-
-static void
-ccw_device_wait4io_irq(struct ccw_device *cdev, enum dev_event dev_event)
-{
-        struct irb *irb;
-        struct subchannel *sch;
-
-        irb = (struct irb *) __LC_IRB;
-        /*
-         * Accumulate status and find out if a basic sense is needed.
-         * This is fine since we have already adapted the lpm.
-         */
-        ccw_device_accumulate_irb(cdev, irb);
-        if (cdev->private->flags.dosense) {
-                if (ccw_device_do_sense(cdev, irb) == 0) {
-                        cdev->private->state = DEV_STATE_W4SENSE;
-                }
-                return;
-        }
-
-        /* Iff device is idle, reset timeout. */
-        sch = to_subchannel(cdev->dev.parent);
-        if (!stsch(sch->schid, &sch->schib))
-                if (sch->schib.scsw.actl == 0)
-                        ccw_device_set_timeout(cdev, 0);
-        /* Call the handler. */
-        ccw_device_call_handler(cdev);
-        if (!sch->lpm) {
-                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
-                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
-        } else if (cdev->private->flags.doverify)
-                ccw_device_online_verify(cdev, 0);
+                              ERR_PTR(-EIO));
 }
 
-static void
-ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
+void device_kill_io(struct subchannel *sch)
 {
         int ret;
-        struct subchannel *sch;
+        struct ccw_device *cdev;
 
-        sch = to_subchannel(cdev->dev.parent);
-        ccw_device_set_timeout(cdev, 0);
+        cdev = sch->dev.driver_data;
         ret = ccw_device_cancel_halt_clear(cdev);
         if (ret == -EBUSY) {
                 ccw_device_set_timeout(cdev, 3*HZ);
@@ -1035,7 +994,7 @@ ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
         if (ret == -ENODEV) {
                 if (!sch->lpm) {
                         PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                         queue_work(ccw_device_notify_work,
                                    &cdev->private->kick_work);
                 } else
@@ -1044,12 +1003,12 @@ ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
         }
         if (cdev->handler)
                 cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
+                              ERR_PTR(-EIO));
         if (!sch->lpm) {
                 PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                 queue_work(ccw_device_notify_work, &cdev->private->kick_work);
-        } else if (cdev->private->flags.doverify)
+        } else
                 /* Start delayed path verification. */
                 ccw_device_online_verify(cdev, 0);
 }
@@ -1286,12 +1245,6 @@ fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
                 [DEV_EVENT_TIMEOUT]     = ccw_device_killing_timeout,
                 [DEV_EVENT_VERIFY]      = ccw_device_nop, //FIXME
         },
-        [DEV_STATE_WAIT4IO] = {
-                [DEV_EVENT_NOTOPER]     = ccw_device_online_notoper,
-                [DEV_EVENT_INTERRUPT]   = ccw_device_wait4io_irq,
-                [DEV_EVENT_TIMEOUT]     = ccw_device_wait4io_timeout,
-                [DEV_EVENT_VERIFY]      = ccw_device_delay_verify,
-        },
         [DEV_STATE_QUIESCE] = {
                 [DEV_EVENT_NOTOPER]     = ccw_device_quiesce_done,
                 [DEV_EVENT_INTERRUPT]   = ccw_device_quiesce_done,
diff --git a/drivers/s390/cio/device_id.c b/drivers/s390/cio/device_id.c
index 1398367b5f68..a74785b9e4eb 100644
--- a/drivers/s390/cio/device_id.c
+++ b/drivers/s390/cio/device_id.c
@@ -251,7 +251,7 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                  */
                 CIO_MSG_EVENT(2, "SenseID : device %04x on Subchannel "
                               "0.%x.%04x reports cmd reject\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no);
                 return -EOPNOTSUPP;
         }
@@ -259,7 +259,8 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                 CIO_MSG_EVENT(2, "SenseID : UC on dev 0.%x.%04x, "
                               "lpum %02X, cnt %02d, sns :"
                               " %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid, cdev->private->devno,
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
                               irb->esw.esw0.sublog.lpum,
                               irb->esw.esw0.erw.scnt,
                               irb->ecw[0], irb->ecw[1],
@@ -274,14 +275,15 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                         CIO_MSG_EVENT(2, "SenseID : path %02X for device %04x "
                                       "on subchannel 0.%x.%04x is "
                                       "'not operational'\n", sch->orb.lpm,
-                                      cdev->private->devno, sch->schid.ssid,
-                                      sch->schid.sch_no);
+                                      cdev->private->dev_id.devno,
+                                      sch->schid.ssid, sch->schid.sch_no);
                 return -EACCES;
         }
         /* Hmm, whatever happened, try again. */
         CIO_MSG_EVENT(2, "SenseID : start_IO() for device %04x on "
                       "subchannel 0.%x.%04x returns status %02X%02X\n",
-                      cdev->private->devno, sch->schid.ssid, sch->schid.sch_no,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
+                      sch->schid.sch_no,
                       irb->scsw.dstat, irb->scsw.cstat);
         return -EAGAIN;
 }
@@ -330,7 +332,7 @@ ccw_device_sense_id_irq(struct ccw_device *cdev, enum dev_event dev_event)
                 /* fall through. */
         default:                /* Sense ID failed. Try asking VM. */
                 if (MACHINE_IS_VM) {
-                        VM_virtual_device_info (cdev->private->devno,
+                        VM_virtual_device_info (cdev->private->dev_id.devno,
                                                 &cdev->private->senseid);
                         if (cdev->private->senseid.cu_type != 0xFFFF) {
                                 /* Got the device information from VM. */
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 84b9b18eabc2..b39c1fa48acd 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -50,7 +50,6 @@ ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
         if (cdev->private->state == DEV_STATE_NOT_OPER)
                 return -ENODEV;
         if (cdev->private->state != DEV_STATE_ONLINE &&
-            cdev->private->state != DEV_STATE_WAIT4IO &&
             cdev->private->state != DEV_STATE_W4SENSE)
                 return -EINVAL;
         sch = to_subchannel(cdev->dev.parent);
@@ -155,7 +154,6 @@ ccw_device_halt(struct ccw_device *cdev, unsigned long intparm)
         if (cdev->private->state == DEV_STATE_NOT_OPER)
                 return -ENODEV;
         if (cdev->private->state != DEV_STATE_ONLINE &&
-            cdev->private->state != DEV_STATE_WAIT4IO &&
             cdev->private->state != DEV_STATE_W4SENSE)
                 return -EINVAL;
         sch = to_subchannel(cdev->dev.parent);
@@ -592,13 +590,13 @@ ccw_device_get_chp_desc(struct ccw_device *cdev, int chp_no)
 int
 _ccw_device_get_subchannel_number(struct ccw_device *cdev)
 {
-        return cdev->private->sch_no;
+        return cdev->private->schid.sch_no;
 }
 
 int
 _ccw_device_get_device_number(struct ccw_device *cdev)
 {
-        return cdev->private->devno;
+        return cdev->private->dev_id.devno;
 }
 
 
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index 84917b39de45..2975ce888c19 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -79,7 +79,8 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
                         CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel "
                                       "0.%x.%04x, lpm %02X, became 'not "
                                       "operational'\n",
-                                      cdev->private->devno, sch->schid.ssid,
+                                      cdev->private->dev_id.devno,
+                                      sch->schid.ssid,
                                       sch->schid.sch_no, cdev->private->imask);
 
                 }
@@ -135,7 +136,8 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
                 CIO_MSG_EVENT(2, "SNID - device 0.%x.%04x, unit check, "
                               "lpum %02X, cnt %02d, sns : "
                               "%02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid, cdev->private->devno,
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
                               irb->esw.esw0.sublog.lpum,
                               irb->esw.esw0.erw.scnt,
                               irb->ecw[0], irb->ecw[1],
@@ -147,7 +149,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
         if (irb->scsw.cc == 3) {
                 CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, sch->orb.lpm);
                 return -EACCES;
         }
@@ -155,7 +157,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
         if (cdev->private->pgid[i].inf.ps.state2 == SNID_STATE2_RESVD_ELSE) {
                 CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x "
                               "is reserved by someone else\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no);
                 return -EUSERS;
         }
@@ -261,7 +263,7 @@ __ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
         /* PGID command failed on this path. */
         CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel "
                       "0.%x.%04x, lpm %02X, became 'not operational'\n",
-                      cdev->private->devno, sch->schid.ssid,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
                       sch->schid.sch_no, cdev->private->imask);
         return ret;
 }
@@ -301,7 +303,7 @@ static int __ccw_device_do_nop(struct ccw_device *cdev)
         /* nop command failed on this path. */
         CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel "
                       "0.%x.%04x, lpm %02X, became 'not operational'\n",
-                      cdev->private->devno, sch->schid.ssid,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
                       sch->schid.sch_no, cdev->private->imask);
         return ret;
 }
@@ -328,8 +330,9 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
                 CIO_MSG_EVENT(2, "SPID - device 0.%x.%04x, unit check, "
                               "cnt %02d, "
                               "sns : %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid,
-                              cdev->private->devno, irb->esw.esw0.erw.scnt,
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
+                              irb->esw.esw0.erw.scnt,
                               irb->ecw[0], irb->ecw[1],
                               irb->ecw[2], irb->ecw[3],
                               irb->ecw[4], irb->ecw[5],
@@ -339,7 +342,7 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
         if (irb->scsw.cc == 3) {
                 CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, cdev->private->imask);
                 return -EACCES;
         }
@@ -362,7 +365,7 @@ static int __ccw_device_check_nop(struct ccw_device *cdev)
         if (irb->scsw.cc == 3) {
                 CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel 0.%x.%04x,"
                               " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                               sch->schid.sch_no, cdev->private->imask);
                 return -EACCES;
         }
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index caf148d5caad..3f7cbce4cd87 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -32,19 +32,18 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                                  SCHN_STAT_CHN_CTRL_CHK |
                                  SCHN_STAT_INTF_CTRL_CHK)))
                 return;
-                
         CIO_MSG_EVENT(0, "Channel-Check or Interface-Control-Check "
                       "received"
                       " ... device %04x on subchannel 0.%x.%04x, dev_stat "
                       ": %02X sch_stat : %02X\n",
-                      cdev->private->devno, cdev->private->ssid,
-                      cdev->private->sch_no,
+                      cdev->private->dev_id.devno, cdev->private->schid.ssid,
+                      cdev->private->schid.sch_no,
                       irb->scsw.dstat, irb->scsw.cstat);
 
         if (irb->scsw.cc != 3) {
                 char dbf_text[15];
 
-                sprintf(dbf_text, "chk%x", cdev->private->sch_no);
+                sprintf(dbf_text, "chk%x", cdev->private->schid.sch_no);
                 CIO_TRACE_EVENT(0, dbf_text);
                 CIO_HEX_EVENT(0, irb, sizeof (struct irb));
         }
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index cde822d8b5c8..476aa1da5cbc 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -1741,7 +1741,7 @@ qdio_fill_qs(struct qdio_irq *irq_ptr, struct ccw_device *cdev,
         void *ptr;
         int available;
 
-        sprintf(dbf_text,"qfqs%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qfqs%4x",cdev->private->schid.sch_no);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
         for (i=0;i<no_input_qs;i++) {
                 q=irq_ptr->input_qs[i];
@@ -2924,7 +2924,7 @@ qdio_establish_handle_irq(struct ccw_device *cdev, int cstat, int dstat)
 
         irq_ptr = cdev->private->qdio_data;
 
-        sprintf(dbf_text,"qehi%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qehi%4x",cdev->private->schid.sch_no);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
         QDIO_DBF_TEXT0(0,trace,dbf_text);
 
@@ -2943,7 +2943,7 @@ qdio_initialize(struct qdio_initialize *init_data)
         int rc;
         char dbf_text[15];
 
-        sprintf(dbf_text,"qini%4x",init_data->cdev->private->sch_no);
+        sprintf(dbf_text,"qini%4x",init_data->cdev->private->schid.sch_no);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
         QDIO_DBF_TEXT0(0,trace,dbf_text);
 
@@ -2964,7 +2964,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         struct qdio_irq *irq_ptr;
         char dbf_text[15];
 
-        sprintf(dbf_text,"qalc%4x",init_data->cdev->private->sch_no);
+        sprintf(dbf_text,"qalc%4x",init_data->cdev->private->schid.sch_no);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
         QDIO_DBF_TEXT0(0,trace,dbf_text);
         if ( (init_data->no_input_qs>QDIO_MAX_QUEUES_PER_IRQ) ||
@@ -3187,7 +3187,7 @@ qdio_establish(struct qdio_initialize *init_data)
                 tiqdio_set_delay_target(irq_ptr,TIQDIO_DELAY_TARGET);
         }
 
-        sprintf(dbf_text,"qest%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qest%4x",cdev->private->schid.sch_no);
         QDIO_DBF_TEXT0(0,setup,dbf_text);
         QDIO_DBF_TEXT0(0,trace,dbf_text);
 
@@ -3529,7 +3529,7 @@ do_QDIO(struct ccw_device *cdev,unsigned int callflags,
 #ifdef CONFIG_QDIO_DEBUG
         char dbf_text[20];
 
-        sprintf(dbf_text,"doQD%04x",cdev->private->sch_no);
+        sprintf(dbf_text,"doQD%04x",cdev->private->schid.sch_no);
         QDIO_DBF_TEXT3(0,trace,dbf_text);
 #endif /* CONFIG_QDIO_DEBUG */
 
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index c5ccd20b110c..79d89c368919 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -739,11 +739,16 @@ static void ap_scan_bus(void *data)
                 dev = bus_find_device(&ap_bus_type, NULL,
                                       (void *)(unsigned long)qid,
                                       __ap_scan_bus);
+                rc = ap_query_queue(qid, &queue_depth, &device_type);
+                if (dev && rc) {
+                        put_device(dev);
+                        device_unregister(dev);
+                        continue;
+                }
                 if (dev) {
                         put_device(dev);
                         continue;
                 }
-                rc = ap_query_queue(qid, &queue_depth, &device_type);
                 if (rc)
                         continue;
                 rc = ap_init_queue(qid);
diff --git a/drivers/s390/scsi/zfcp_def.h b/drivers/s390/scsi/zfcp_def.h
index 8f882690994d..74c0eac083e4 100644
--- a/drivers/s390/scsi/zfcp_def.h
+++ b/drivers/s390/scsi/zfcp_def.h
@@ -107,6 +107,10 @@ zfcp_address_to_sg(void *address, struct scatterlist *list)
         (ZFCP_MAX_SBALS_PER_REQ * ZFCP_MAX_SBALES_PER_SBAL - 2)
         /* request ID + QTCB in SBALE 0 + 1 of first SBAL in chain */
 
+#define ZFCP_MAX_SECTORS (ZFCP_MAX_SBALES_PER_REQ * 8)
+        /* max. number of (data buffer) SBALEs in largest SBAL chain
+           multiplied with number of sectors per 4k block */
+
 /* FIXME(tune): free space should be one max. SBAL chain plus what? */
 #define ZFCP_QDIO_PCI_INTERVAL          (QDIO_MAX_BUFFERS_PER_Q \
                                          - (ZFCP_MAX_SBALS_PER_REQ + 4))
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 4d2bc7981324..452d96f92a14 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -58,6 +58,7 @@ struct zfcp_data zfcp_data = {
                 .cmd_per_lun            = 1,
                 .use_clustering         = 1,
                 .sdev_attrs             = zfcp_sysfs_sdev_attrs,
+                .max_sectors            = ZFCP_MAX_SECTORS,
         },
         .driver_version = ZFCP_VERSION,
 };
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index d27e4f6d7045..a54e4140683a 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -4,11 +4,9 @@
  * Copyright (C) 2001 David S. Miller (davem@redhat.com)
  */
 
-#include <linux/kernel.h>
 #include <linux/kthread.h>
-#include <linux/sched.h>
-#include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/kmod.h>
 #include <asm/oplib.h>
 #include <asm/ebus.h>
 
@@ -197,7 +195,7 @@ static void do_envctrl_shutdown(struct bbc_cpu_temperature *tp)
         printk(KERN_CRIT "kenvctrld: Shutting down the system now.\n");
 
         shutting_down = 1;
-        if (kernel_execve("/sbin/shutdown", argv, envp) < 0)
+        if (call_usermodehelper("/sbin/shutdown", argv, envp, 0) < 0)
                 printk(KERN_CRIT "envctrl: shutdown execution failed\n");
 }
 
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 728a133d0fc5..fff4660cdf96 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -20,16 +20,12 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
+#include <linux/init.h>
 #include <linux/kthread.h>
-#include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/init.h>
 #include <linux/miscdevice.h>
-#include <linux/mm.h>
-#include <linux/slab.h>
-#include <linux/kernel.h>
+#include <linux/kmod.h>
 
 #include <asm/ebus.h>
 #include <asm/uaccess.h>
@@ -980,7 +976,7 @@ static void envctrl_do_shutdown(void)
 
         inprog = 1;
         printk(KERN_CRIT "kenvctrld: WARNING: Shutting down the system now.\n");
-        ret = kernel_execve("/sbin/shutdown", argv, envp);
+        ret = call_usermodehelper("/sbin/shutdown", argv, envp, 0);
         if (ret < 0) {
                 printk(KERN_CRIT "kenvctrld: WARNING: system shutdown failed!\n"); 
                 inprog = 0;  /* unlikely to succeed, but we could try again */
diff --git a/drivers/sbus/sbus.c b/drivers/sbus/sbus.c
index 935952ef88f1..98fcbb3d5560 100644
--- a/drivers/sbus/sbus.c
+++ b/drivers/sbus/sbus.c
@@ -61,11 +61,11 @@ static void __init fill_sbus_device(struct device_node *dp, struct sbus_dev *sde
         else
                 sdev->ofdev.dev.parent = &sdev->bus->ofdev.dev;
         sdev->ofdev.dev.bus = &sbus_bus_type;
-        strcpy(sdev->ofdev.dev.bus_id, dp->path_component_name);
+        sprintf(sdev->ofdev.dev.bus_id, "sbus[%08x]", dp->node);
 
         if (of_device_register(&sdev->ofdev) != 0)
                 printk(KERN_DEBUG "sbus: device registration error for %s!\n",
-                       sdev->ofdev.dev.bus_id);
+                       dp->path_component_name);
 }
 
 static void __init sbus_bus_ranges_init(struct device_node *dp, struct sbus_bus *sbus)
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 5f8c26cd66ca..b091a0fc4eb0 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -66,6 +66,9 @@
    2.26.02.006 - Fix 9550SX pchip reset timeout.
                  Add big endian support.
    2.26.02.007 - Disable local interrupts during kmap/unmap_atomic().
+   2.26.02.008 - Free irq handler in __twa_shutdown().
+                 Serialize reset code.
+                 Add support for 9650SE controllers.
 */
 
 #include <linux/module.h>
@@ -89,7 +92,7 @@
 #include "3w-9xxx.h"
 
 /* Globals */
-#define TW_DRIVER_VERSION "2.26.02.007"
+#define TW_DRIVER_VERSION "2.26.02.008"
 static TW_Device_Extension *twa_device_extension_list[TW_MAX_SLOT];
 static unsigned int twa_device_extension_count;
 static int twa_major = -1;
@@ -566,9 +569,9 @@ static int twa_check_srl(TW_Device_Extension *tw_dev, int *flashed)
                 goto out;
         }
 
-        tw_dev->working_srl = fw_on_ctlr_srl;
-        tw_dev->working_branch = fw_on_ctlr_branch;
-        tw_dev->working_build = fw_on_ctlr_build;
+        tw_dev->tw_compat_info.working_srl = fw_on_ctlr_srl;
+        tw_dev->tw_compat_info.working_branch = fw_on_ctlr_branch;
+        tw_dev->tw_compat_info.working_build = fw_on_ctlr_build;
 
         /* Try base mode compatibility */
         if (!(init_connect_result & TW_CTLR_FW_COMPATIBLE)) {
@@ -590,10 +593,23 @@ static int twa_check_srl(TW_Device_Extension *tw_dev, int *flashed)
                         }
                         goto out;
                 }
-                tw_dev->working_srl = TW_BASE_FW_SRL;
-                tw_dev->working_branch = TW_BASE_FW_BRANCH;
-                tw_dev->working_build = TW_BASE_FW_BUILD;
-        }
+                tw_dev->tw_compat_info.working_srl = TW_BASE_FW_SRL;
+                tw_dev->tw_compat_info.working_branch = TW_BASE_FW_BRANCH;
+                tw_dev->tw_compat_info.working_build = TW_BASE_FW_BUILD;
+        }
+
+        /* Load rest of compatibility struct */
+        strncpy(tw_dev->tw_compat_info.driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
+        tw_dev->tw_compat_info.driver_srl_high = TW_CURRENT_DRIVER_SRL;
+        tw_dev->tw_compat_info.driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
+        tw_dev->tw_compat_info.driver_build_high = TW_CURRENT_DRIVER_BUILD;
+        tw_dev->tw_compat_info.driver_srl_low = TW_BASE_FW_SRL;
+        tw_dev->tw_compat_info.driver_branch_low = TW_BASE_FW_BRANCH;
+        tw_dev->tw_compat_info.driver_build_low = TW_BASE_FW_BUILD;
+        tw_dev->tw_compat_info.fw_on_ctlr_srl = fw_on_ctlr_srl;
+        tw_dev->tw_compat_info.fw_on_ctlr_branch = fw_on_ctlr_branch;
+        tw_dev->tw_compat_info.fw_on_ctlr_build = fw_on_ctlr_build;
+
         retval = 0;
 out:
         return retval;
@@ -631,7 +647,7 @@ static int twa_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int
                 goto out2;
 
         /* Check data buffer size */
-        if (driver_command.buffer_length > TW_MAX_SECTORS * 512) {
+        if (driver_command.buffer_length > TW_MAX_SECTORS * 2048) {
                 retval = TW_IOCTL_ERROR_OS_EINVAL;
                 goto out2;
         }
@@ -680,13 +696,6 @@ static int twa_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int
                 /* Now wait for command to complete */
                 timeout = wait_event_timeout(tw_dev->ioctl_wqueue, tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE, timeout);
 
-                /* See if we reset while waiting for the ioctl to complete */
-                if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
-                        clear_bit(TW_IN_RESET, &tw_dev->flags);
-                        retval = TW_IOCTL_ERROR_OS_ERESTARTSYS;
-                        goto out3;
-                }
-
                 /* We timed out, and didn't get an interrupt */
                 if (tw_dev->chrdev_request_id != TW_IOCTL_CHRDEV_FREE) {
                         /* Now we need to reset the board */
@@ -694,11 +703,6 @@ static int twa_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int
                                tw_dev->host->host_no, TW_DRIVER, 0xc,
                                cmd);
                         retval = TW_IOCTL_ERROR_OS_EIO;
-                        spin_lock_irqsave(tw_dev->host->host_lock, flags);
-                        tw_dev->state[request_id] = TW_S_COMPLETED;
-                        twa_free_request_id(tw_dev, request_id);
-                        tw_dev->posted_request_count--;
-                        spin_unlock_irqrestore(tw_dev->host->host_lock, flags);
                         twa_reset_device_extension(tw_dev, 1);
                         goto out3;
                 }
@@ -717,16 +721,7 @@ static int twa_chrdev_ioctl(struct inode *inode, struct file *file, unsigned int
                 tw_ioctl->driver_command.status = 0;
                 /* Copy compatiblity struct into ioctl data buffer */
                 tw_compat_info = (TW_Compatibility_Info *)tw_ioctl->data_buffer;
-                strncpy(tw_compat_info->driver_version, TW_DRIVER_VERSION, strlen(TW_DRIVER_VERSION));
-                tw_compat_info->working_srl = tw_dev->working_srl;
-                tw_compat_info->working_branch = tw_dev->working_branch;
-                tw_compat_info->working_build = tw_dev->working_build;
-                tw_compat_info->driver_srl_high = TW_CURRENT_DRIVER_SRL;
-                tw_compat_info->driver_branch_high = TW_CURRENT_DRIVER_BRANCH;
-                tw_compat_info->driver_build_high = TW_CURRENT_DRIVER_BUILD;
-                tw_compat_info->driver_srl_low = TW_BASE_FW_SRL;
-                tw_compat_info->driver_branch_low = TW_BASE_FW_BRANCH;
-                tw_compat_info->driver_build_low = TW_BASE_FW_BUILD;
+                memcpy(tw_compat_info, &tw_dev->tw_compat_info, sizeof(TW_Compatibility_Info));
                 break;
         case TW_IOCTL_GET_LAST_EVENT:
                 if (tw_dev->event_queue_wrapped) {
@@ -895,7 +890,8 @@ static int twa_decode_bits(TW_Device_Extension *tw_dev, u32 status_reg_value)
         }
 
         if (status_reg_value & TW_STATUS_QUEUE_ERROR) {
-                TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Controller Queue Error: clearing");
+                if ((tw_dev->tw_pci_dev->device != PCI_DEVICE_ID_3WARE_9650SE) || (!test_bit(TW_IN_RESET, &tw_dev->flags)))
+                        TW_PRINTK(tw_dev->host, TW_DRIVER, 0xe, "Controller Queue Error: clearing");
                 writel(TW_CONTROL_CLEAR_QUEUE_ERROR, TW_CONTROL_REG_ADDR(tw_dev));
         }
 
@@ -939,10 +935,12 @@ static int twa_empty_response_queue_large(TW_Device_Extension *tw_dev)
         unsigned long before;
         int retval = 1;
 
-        if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9550SX) {
+        if ((tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9550SX) ||
+            (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE)) {
                 before = jiffies;
                 while ((response_que_value & TW_9550SX_DRAIN_COMPLETED) != TW_9550SX_DRAIN_COMPLETED) {
                         response_que_value = readl(TW_RESPONSE_QUEUE_REG_ADDR_LARGE(tw_dev));
+                        msleep(1);
                         if (time_after(jiffies, before + HZ * 30))
                                 goto out;
                 }
@@ -1214,6 +1212,10 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
 
         handled = 1;
 
+        /* If we are resetting, bail */
+        if (test_bit(TW_IN_RESET, &tw_dev->flags))
+                goto twa_interrupt_bail;
+
         /* Check controller for errors */
         if (twa_check_bits(status_reg_value)) {
                 if (twa_decode_bits(tw_dev, status_reg_value)) {
@@ -1355,8 +1357,8 @@ static void twa_load_sgl(TW_Command_Full *full_command_packet, int request_id, d
 
         if (TW_OP_OUT(full_command_packet->command.newcommand.opcode__reserved) == TW_OP_EXECUTE_SCSI) {
                 newcommand = &full_command_packet->command.newcommand;
-                newcommand->request_id__lunl = 
-                        TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id);
+                newcommand->request_id__lunl =
+                        cpu_to_le16(TW_REQ_LUN_IN(TW_LUN_OUT(newcommand->request_id__lunl), request_id));
                 newcommand->sg_list[0].address = TW_CPU_TO_SGL(dma_handle + sizeof(TW_Ioctl_Buf_Apache) - 1);
                 newcommand->sg_list[0].length = cpu_to_le32(length);
                 newcommand->sgl_entries__lunh =
@@ -1531,6 +1533,13 @@ static int twa_post_command_packet(TW_Device_Extension *tw_dev, int request_id,
         int retval = 1;
 
         command_que_value = tw_dev->command_packet_phys[request_id];
+
+        /* For 9650SE write low 4 bytes first */
+        if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE) {
+                command_que_value += TW_COMMAND_OFFSET;
+                writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR_LARGE(tw_dev));
+        }
+
         status_reg_value = readl(TW_STATUS_REG_ADDR(tw_dev));
 
         if (twa_check_bits(status_reg_value))
@@ -1557,13 +1566,17 @@ static int twa_post_command_packet(TW_Device_Extension *tw_dev, int request_id,
                 TW_UNMASK_COMMAND_INTERRUPT(tw_dev);
                 goto out;
         } else {
-                /* We successfully posted the command packet */
-                if (sizeof(dma_addr_t) > 4) {
-                        command_que_value += TW_COMMAND_OFFSET;
-                        writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
-                        writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR(tw_dev) + 0x4);
+                if (tw_dev->tw_pci_dev->device == PCI_DEVICE_ID_3WARE_9650SE) {
+                        /* Now write upper 4 bytes */
+                        writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR_LARGE(tw_dev) + 0x4);
                 } else {
-                        writel(TW_COMMAND_OFFSET + command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+                        if (sizeof(dma_addr_t) > 4) {
+                                command_que_value += TW_COMMAND_OFFSET;
+                                writel((u32)command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+                                writel((u32)((u64)command_que_value >> 32), TW_COMMAND_QUEUE_REG_ADDR(tw_dev) + 0x4);
+                        } else {
+                                writel(TW_COMMAND_OFFSET + command_que_value, TW_COMMAND_QUEUE_REG_ADDR(tw_dev));
+                        }
                 }
                 tw_dev->state[request_id] = TW_S_POSTED;
                 tw_dev->posted_request_count++;
@@ -1620,14 +1633,9 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
                 goto out;
 
         TW_ENABLE_AND_CLEAR_INTERRUPTS(tw_dev);
+        clear_bit(TW_IN_RESET, &tw_dev->flags);
+        tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
 
-        /* Wake up any ioctl that was pending before the reset */
-        if ((tw_dev->chrdev_request_id == TW_IOCTL_CHRDEV_FREE) || (ioctl_reset)) {
-                clear_bit(TW_IN_RESET, &tw_dev->flags);
-        } else {
-                tw_dev->chrdev_request_id = TW_IOCTL_CHRDEV_FREE;
-                wake_up(&tw_dev->ioctl_wqueue);
-        }
         retval = 0;
 out:
         return retval;
@@ -1736,6 +1744,9 @@ static int twa_scsi_eh_reset(struct scsi_cmnd *SCpnt)
                 "WARNING: (0x%02X:0x%04X): Command (0x%x) timed out, resetting card.\n",
                 TW_DRIVER, 0x2c, SCpnt->cmnd[0]);
 
+        /* Make sure we are not issuing an ioctl or resetting from ioctl */
+        mutex_lock(&tw_dev->ioctl_lock);
+
         /* Now reset the card and some of the device extension data */
         if (twa_reset_device_extension(tw_dev, 0)) {
                 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x2b, "Controller reset failed during scsi host reset");
@@ -1744,6 +1755,7 @@ static int twa_scsi_eh_reset(struct scsi_cmnd *SCpnt)
 
         retval = SUCCESS;
 out:
+        mutex_unlock(&tw_dev->ioctl_lock);
         return retval;
 } /* End twa_scsi_eh_reset() */
 
@@ -1753,8 +1765,14 @@ static int twa_scsi_queue(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_cmnd
         int request_id, retval;
         TW_Device_Extension *tw_dev = (TW_Device_Extension *)SCpnt->device->host->hostdata;
 
+        /* If we are resetting due to timed out ioctl, report as busy */
+        if (test_bit(TW_IN_RESET, &tw_dev->flags)) {
+                retval = SCSI_MLQUEUE_HOST_BUSY;
+                goto out;
+        }
+
         /* Check if this FW supports luns */
-        if ((SCpnt->device->lun != 0) && (tw_dev->working_srl < TW_FW_SRL_LUNS_SUPPORTED)) {
+        if ((SCpnt->device->lun != 0) && (tw_dev->tw_compat_info.working_srl < TW_FW_SRL_LUNS_SUPPORTED)) {
                 SCpnt->result = (DID_BAD_TARGET << 16);
                 done(SCpnt);
                 retval = 0;
@@ -1960,6 +1978,9 @@ static void __twa_shutdown(TW_Device_Extension *tw_dev)
         /* Disable interrupts */
         TW_DISABLE_INTERRUPTS(tw_dev);
 
+        /* Free up the IRQ */
+        free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
+
         printk(KERN_WARNING "3w-9xxx: Shutting down host %d.\n", tw_dev->host->host_no);
 
         /* Tell the card we are shutting down */
@@ -2091,21 +2112,25 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id
 
         /* Initialize the card */
         if (twa_reset_sequence(tw_dev, 0))
-                goto out_release_mem_region;
+                goto out_iounmap;
 
         /* Set host specific parameters */
-        host->max_id = TW_MAX_UNITS;
+        if (pdev->device == PCI_DEVICE_ID_3WARE_9650SE)
+                host->max_id = TW_MAX_UNITS_9650SE;
+        else
+                host->max_id = TW_MAX_UNITS;
+
         host->max_cmd_len = TW_MAX_CDB_LEN;
 
         /* Channels aren't supported by adapter */
-        host->max_lun = TW_MAX_LUNS(tw_dev->working_srl);
+        host->max_lun = TW_MAX_LUNS(tw_dev->tw_compat_info.working_srl);
         host->max_channel = 0;
 
         /* Register the card with the kernel SCSI layer */
         retval = scsi_add_host(host, &pdev->dev);
         if (retval) {
                 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x27, "scsi add host failed");
-                goto out_release_mem_region;
+                goto out_iounmap;
         }
 
         pci_set_drvdata(pdev, host);
@@ -2145,6 +2170,8 @@ static int __devinit twa_probe(struct pci_dev *pdev, const struct pci_device_id
 
 out_remove_host:
         scsi_remove_host(host);
+out_iounmap:
+        iounmap(tw_dev->base_addr);
 out_release_mem_region:
         pci_release_regions(pdev);
 out_free_device_extension:
@@ -2170,12 +2197,12 @@ static void twa_remove(struct pci_dev *pdev)
                 twa_major = -1;
         }
 
-        /* Free up the IRQ */
-        free_irq(tw_dev->tw_pci_dev->irq, tw_dev);
-
         /* Shutdown the card */
         __twa_shutdown(tw_dev);
 
+        /* Free IO remapping */
+        iounmap(tw_dev->base_addr);
+
         /* Free up the mem region */
         pci_release_regions(pdev);
 
@@ -2193,6 +2220,8 @@ static struct pci_device_id twa_pci_tbl[] __devinitdata = {
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9550SX,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_3WARE, PCI_DEVICE_ID_3WARE_9650SE,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
         { }
 };
 MODULE_DEVICE_TABLE(pci, twa_pci_tbl);
diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
index e5685be96f45..7901517d4513 100644
--- a/drivers/scsi/3w-9xxx.h
+++ b/drivers/scsi/3w-9xxx.h
@@ -289,7 +289,6 @@ static twa_message_type twa_error_table[] = {
 #define TW_STATUS_VALID_INTERRUPT              0x00DF0000
 
 /* PCI related defines */
-#define TW_NUMDEVICES 1
 #define TW_PCI_CLEAR_PARITY_ERRORS 0xc100
 #define TW_PCI_CLEAR_PCI_ABORT     0x2000
 
@@ -335,6 +334,7 @@ static twa_message_type twa_error_table[] = {
 #define TW_ALIGNMENT_9000                     4  /* 4 bytes */
 #define TW_ALIGNMENT_9000_SGL                 0x3
 #define TW_MAX_UNITS                          16
+#define TW_MAX_UNITS_9650SE                   32
 #define TW_INIT_MESSAGE_CREDITS               0x100
 #define TW_INIT_COMMAND_PACKET_SIZE           0x3
 #define TW_INIT_COMMAND_PACKET_SIZE_EXTENDED  0x6
@@ -354,7 +354,6 @@ static twa_message_type twa_error_table[] = {
 #define TW_MAX_RESPONSE_DRAIN                 256
 #define TW_MAX_AEN_DRAIN                      40
 #define TW_IN_RESET                           2
-#define TW_IN_CHRDEV_IOCTL                    3
 #define TW_IN_ATTENTION_LOOP                  4
 #define TW_MAX_SECTORS                        256
 #define TW_AEN_WAIT_TIME                      1000
@@ -417,6 +416,9 @@ static twa_message_type twa_error_table[] = {
 #ifndef PCI_DEVICE_ID_3WARE_9550SX
 #define PCI_DEVICE_ID_3WARE_9550SX 0x1003
 #endif
+#ifndef PCI_DEVICE_ID_3WARE_9650SE
+#define PCI_DEVICE_ID_3WARE_9650SE 0x1004
+#endif
 
 /* Bitmask macros to eliminate bitfields */
 
@@ -442,6 +444,7 @@ static twa_message_type twa_error_table[] = {
 #define TW_CONTROL_REG_ADDR(x) (x->base_addr)
 #define TW_STATUS_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0x4)
 #define TW_COMMAND_QUEUE_REG_ADDR(x) (sizeof(dma_addr_t) > 4 ? ((unsigned char __iomem *)x->base_addr + 0x20) : ((unsigned char __iomem *)x->base_addr + 0x8))
+#define TW_COMMAND_QUEUE_REG_ADDR_LARGE(x) ((unsigned char __iomem *)x->base_addr + 0x20)
 #define TW_RESPONSE_QUEUE_REG_ADDR(x) ((unsigned char __iomem *)x->base_addr + 0xC)
 #define TW_RESPONSE_QUEUE_REG_ADDR_LARGE(x) ((unsigned char __iomem *)x->base_addr + 0x30)
 #define TW_CLEAR_ALL_INTERRUPTS(x) (writel(TW_STATUS_VALID_INTERRUPT, TW_CONTROL_REG_ADDR(x)))
@@ -626,6 +629,9 @@ typedef struct TAG_TW_Compatibility_Info
         unsigned short driver_srl_low;
         unsigned short driver_branch_low;
         unsigned short driver_build_low;
+        unsigned short fw_on_ctlr_srl;
+        unsigned short fw_on_ctlr_branch;
+        unsigned short fw_on_ctlr_build;
 } TW_Compatibility_Info;
 
 #pragma pack()
@@ -668,9 +674,7 @@ typedef struct TAG_TW_Device_Extension {
         wait_queue_head_t       ioctl_wqueue;
         struct mutex            ioctl_lock;
         char                    aen_clobber;
-        unsigned short          working_srl;
-        unsigned short          working_branch;
-        unsigned short          working_build;
+        TW_Compatibility_Info   tw_compat_info;
 } TW_Device_Extension;
 
 #endif /* _3W_9XXX_H */
diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c
index 689dc4cc789c..3075204915c8 100644
--- a/drivers/scsi/BusLogic.c
+++ b/drivers/scsi/BusLogic.c
@@ -3600,5 +3600,16 @@ static void __exit BusLogic_exit(void)
 
 __setup("BusLogic=", BusLogic_Setup);
 
+static struct pci_device_id BusLogic_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_BUSLOGIC, PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_BUSLOGIC, PCI_DEVICE_ID_BUSLOGIC_MULTIMASTER_NC,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_BUSLOGIC, PCI_DEVICE_ID_BUSLOGIC_FLASHPOINT,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { }
+};
+MODULE_DEVICE_TABLE(pci, BusLogic_pci_tbl);
+
 module_init(BusLogic_init);
 module_exit(BusLogic_exit);
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index a0d1cee0be77..306f46b85a55 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -238,7 +238,7 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <asm/irq.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/blkdev.h>
 #include <asm/system.h>
 #include <linux/errno.h>
diff --git a/drivers/scsi/aic7xxx/aic79xx.h b/drivers/scsi/aic7xxx/aic79xx.h
index df3346b5caf8..170a4344cbb2 100644
--- a/drivers/scsi/aic7xxx/aic79xx.h
+++ b/drivers/scsi/aic7xxx/aic79xx.h
@@ -53,14 +53,6 @@ struct ahd_platform_data;
 struct scb_platform_data;
 
 /****************************** Useful Macros *********************************/
-#ifndef MAX
-#define MAX(a,b) (((a) > (b)) ? (a) : (b))
-#endif
-
-#ifndef MIN
-#define MIN(a,b) (((a) < (b)) ? (a) : (b))
-#endif
-
 #ifndef TRUE
 #define TRUE 1
 #endif
@@ -972,8 +964,6 @@ int		ahd_read_seeprom(struct ahd_softc *ahd, uint16_t *buf,
 
 int             ahd_write_seeprom(struct ahd_softc *ahd, uint16_t *buf,
                                   u_int start_addr, u_int count);
-int             ahd_wait_seeprom(struct ahd_softc *ahd);
-int             ahd_verify_vpd_cksum(struct vpd_config *vpd);
 int             ahd_verify_cksum(struct seeprom_config *sc);
 int             ahd_acquire_seeprom(struct ahd_softc *ahd);
 void            ahd_release_seeprom(struct ahd_softc *ahd);
@@ -1320,8 +1310,6 @@ struct ahd_pci_identity {
         char                    *name;
         ahd_device_setup_t      *setup;
 };
-extern struct ahd_pci_identity ahd_pci_ident_table [];
-extern const u_int ahd_num_pci_devs;
 
 /***************************** VL/EISA Declarations ***************************/
 struct aic7770_identity {
@@ -1339,15 +1327,6 @@ extern const int ahd_num_aic7770_devs;
 /*************************** Function Declarations ****************************/
 /******************************************************************************/
 void                    ahd_reset_cmds_pending(struct ahd_softc *ahd);
-u_int                   ahd_find_busy_tcl(struct ahd_softc *ahd, u_int tcl);
-void                    ahd_busy_tcl(struct ahd_softc *ahd,
-                                     u_int tcl, u_int busyid);
-static __inline void    ahd_unbusy_tcl(struct ahd_softc *ahd, u_int tcl);
-static __inline void
-ahd_unbusy_tcl(struct ahd_softc *ahd, u_int tcl)
-{
-        ahd_busy_tcl(ahd, tcl, SCB_LIST_NULL);
-}
 
 /***************************** PCI Front End *********************************/
 struct  ahd_pci_identity *ahd_find_pci_device(ahd_dev_softc_t);
@@ -1356,7 +1335,6 @@ int			  ahd_pci_config(struct ahd_softc *,
 int     ahd_pci_test_register_access(struct ahd_softc *);
 
 /************************** SCB and SCB queue management **********************/
-int             ahd_probe_scbs(struct ahd_softc *);
 void            ahd_qinfifo_requeue_tail(struct ahd_softc *ahd,
                                          struct scb *scb);
 int             ahd_match_scb(struct ahd_softc *ahd, struct scb *scb,
@@ -1374,33 +1352,20 @@ int			 ahd_parse_vpddata(struct ahd_softc *ahd,
 int                      ahd_parse_cfgdata(struct ahd_softc *ahd,
                                            struct seeprom_config *sc);
 void                     ahd_intr_enable(struct ahd_softc *ahd, int enable);
-void                     ahd_update_coalescing_values(struct ahd_softc *ahd,
-                                                      u_int timer,
-                                                      u_int maxcmds,
-                                                      u_int mincmds);
-void                     ahd_enable_coalescing(struct ahd_softc *ahd,
-                                               int enable);
 void                     ahd_pause_and_flushwork(struct ahd_softc *ahd);
 int                      ahd_suspend(struct ahd_softc *ahd); 
-int                      ahd_resume(struct ahd_softc *ahd);
 void                     ahd_set_unit(struct ahd_softc *, int);
 void                     ahd_set_name(struct ahd_softc *, char *);
 struct scb              *ahd_get_scb(struct ahd_softc *ahd, u_int col_idx);
 void                     ahd_free_scb(struct ahd_softc *ahd, struct scb *scb);
-void                     ahd_alloc_scbs(struct ahd_softc *ahd);
 void                     ahd_free(struct ahd_softc *ahd);
 int                      ahd_reset(struct ahd_softc *ahd, int reinit);
-void                     ahd_shutdown(void *arg);
 int                      ahd_write_flexport(struct ahd_softc *ahd,
                                             u_int addr, u_int value);
 int                      ahd_read_flexport(struct ahd_softc *ahd, u_int addr,
                                            uint8_t *value);
-int                      ahd_wait_flexport(struct ahd_softc *ahd);
 
 /*************************** Interrupt Services *******************************/
-void                    ahd_pci_intr(struct ahd_softc *ahd);
-void                    ahd_clear_intstat(struct ahd_softc *ahd);
-void                    ahd_flush_qoutfifo(struct ahd_softc *ahd);
 void                    ahd_run_qoutfifo(struct ahd_softc *ahd);
 #ifdef AHD_TARGET_MODE
 void                    ahd_run_tqinfifo(struct ahd_softc *ahd, int paused);
@@ -1409,7 +1374,6 @@ void			ahd_handle_hwerrint(struct ahd_softc *ahd);
 void                    ahd_handle_seqint(struct ahd_softc *ahd, u_int intstat);
 void                    ahd_handle_scsiint(struct ahd_softc *ahd,
                                            u_int intstat);
-void                    ahd_clear_critical_section(struct ahd_softc *ahd);
 
 /***************************** Error Recovery *********************************/
 typedef enum {
@@ -1426,23 +1390,9 @@ int			ahd_search_disc_list(struct ahd_softc *ahd, int target,
                                              char channel, int lun, u_int tag,
                                              int stop_on_first, int remove,
                                              int save_state);
-void                    ahd_freeze_devq(struct ahd_softc *ahd, struct scb *scb);
 int                     ahd_reset_channel(struct ahd_softc *ahd, char channel,
                                           int initiate_reset);
-int                     ahd_abort_scbs(struct ahd_softc *ahd, int target,
-                                       char channel, int lun, u_int tag,
-                                       role_t role, uint32_t status);
-void                    ahd_restart(struct ahd_softc *ahd);
-void                    ahd_clear_fifo(struct ahd_softc *ahd, u_int fifo);
-void                    ahd_handle_scb_status(struct ahd_softc *ahd,
-                                              struct scb *scb);
-void                    ahd_handle_scsi_status(struct ahd_softc *ahd,
-                                               struct scb *scb);
-void                    ahd_calc_residual(struct ahd_softc *ahd,
-                                          struct scb *scb);
 /*************************** Utility Functions ********************************/
-struct ahd_phase_table_entry*
-                        ahd_lookup_phase_entry(int phase);
 void                    ahd_compile_devinfo(struct ahd_devinfo *devinfo,
                                             u_int our_id, u_int target,
                                             u_int lun, char channel,
@@ -1450,14 +1400,6 @@ void			ahd_compile_devinfo(struct ahd_devinfo *devinfo,
 /************************** Transfer Negotiation ******************************/
 void                    ahd_find_syncrate(struct ahd_softc *ahd, u_int *period,
                                           u_int *ppr_options, u_int maxsync);
-void                    ahd_validate_offset(struct ahd_softc *ahd,
-                                            struct ahd_initiator_tinfo *tinfo,
-                                            u_int period, u_int *offset,
-                                            int wide, role_t role);
-void                    ahd_validate_width(struct ahd_softc *ahd,
-                                           struct ahd_initiator_tinfo *tinfo,
-                                           u_int *bus_width,
-                                           role_t role);
 /*
  * Negotiation types.  These are used to qualify if we should renegotiate
  * even if our goal and current transport parameters are identical.
@@ -1486,11 +1428,6 @@ typedef enum {
         AHD_QUEUE_TAGGED
 } ahd_queue_alg;
 
-void                    ahd_set_tags(struct ahd_softc *ahd,
-                                     struct scsi_cmnd *cmd,
-                                     struct ahd_devinfo *devinfo,
-                                     ahd_queue_alg alg);
-
 /**************************** Target Mode *************************************/
 #ifdef AHD_TARGET_MODE
 void            ahd_send_lstate_events(struct ahd_softc *,
@@ -1528,10 +1465,8 @@ extern uint32_t ahd_debug;
 #define AHD_SHOW_INT_COALESCING 0x10000
 #define AHD_DEBUG_SEQUENCER     0x20000
 #endif
-void                    ahd_print_scb(struct scb *scb);
 void                    ahd_print_devinfo(struct ahd_softc *ahd,
                                           struct ahd_devinfo *devinfo);
-void                    ahd_dump_sglist(struct scb *scb);
 void                    ahd_dump_card_state(struct ahd_softc *ahd);
 int                     ahd_print_register(ahd_reg_parse_entry_t *table,
                                            u_int num_entries,
@@ -1540,5 +1475,4 @@ int			ahd_print_register(ahd_reg_parse_entry_t *table,
                                            u_int value,
                                            u_int *cur_column,
                                            u_int wrap_point);
-void                    ahd_dump_scbs(struct ahd_softc *ahd);
 #endif /* _AIC79XX_H_ */
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 653818d2f802..07a86a30f676 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -52,7 +52,7 @@
 
 
 /***************************** Lookup Tables **********************************/
-char *ahd_chip_names[] =
+static char *ahd_chip_names[] =
 {
         "NONE",
         "aic7901",
@@ -237,10 +237,33 @@ static int		ahd_handle_target_cmd(struct ahd_softc *ahd,
                                               struct target_cmd *cmd);
 #endif
 
+static int              ahd_abort_scbs(struct ahd_softc *ahd, int target,
+                                       char channel, int lun, u_int tag,
+                                       role_t role, uint32_t status);
+static void             ahd_alloc_scbs(struct ahd_softc *ahd);
+static void             ahd_busy_tcl(struct ahd_softc *ahd, u_int tcl,
+                                     u_int scbid);
+static void             ahd_calc_residual(struct ahd_softc *ahd,
+                                          struct scb *scb);
+static void             ahd_clear_critical_section(struct ahd_softc *ahd);
+static void             ahd_clear_intstat(struct ahd_softc *ahd);
+static void             ahd_enable_coalescing(struct ahd_softc *ahd,
+                                              int enable);
+static u_int            ahd_find_busy_tcl(struct ahd_softc *ahd, u_int tcl);
+static void             ahd_freeze_devq(struct ahd_softc *ahd,
+                                        struct scb *scb);
+static void             ahd_handle_scb_status(struct ahd_softc *ahd,
+                                              struct scb *scb);
+static struct ahd_phase_table_entry* ahd_lookup_phase_entry(int phase);
+static void             ahd_shutdown(void *arg);
+static void             ahd_update_coalescing_values(struct ahd_softc *ahd,
+                                                     u_int timer,
+                                                     u_int maxcmds,
+                                                     u_int mincmds);
+static int              ahd_verify_vpd_cksum(struct vpd_config *vpd);
+static int              ahd_wait_seeprom(struct ahd_softc *ahd);
+
 /******************************** Private Inlines *****************************/
-static __inline void    ahd_assert_atn(struct ahd_softc *ahd);
-static __inline int     ahd_currently_packetized(struct ahd_softc *ahd);
-static __inline int     ahd_set_active_fifo(struct ahd_softc *ahd);
 
 static __inline void
 ahd_assert_atn(struct ahd_softc *ahd)
@@ -294,11 +317,44 @@ ahd_set_active_fifo(struct ahd_softc *ahd)
         }
 }
 
+static __inline void
+ahd_unbusy_tcl(struct ahd_softc *ahd, u_int tcl)
+{
+        ahd_busy_tcl(ahd, tcl, SCB_LIST_NULL);
+}
+
+/*
+ * Determine whether the sequencer reported a residual
+ * for this SCB/transaction.
+ */
+static __inline void
+ahd_update_residual(struct ahd_softc *ahd, struct scb *scb)
+{
+        uint32_t sgptr;
+
+        sgptr = ahd_le32toh(scb->hscb->sgptr);
+        if ((sgptr & SG_STATUS_VALID) != 0)
+                ahd_calc_residual(ahd, scb);
+}
+
+static __inline void
+ahd_complete_scb(struct ahd_softc *ahd, struct scb *scb)
+{
+        uint32_t sgptr;
+
+        sgptr = ahd_le32toh(scb->hscb->sgptr);
+        if ((sgptr & SG_STATUS_VALID) != 0)
+                ahd_handle_scb_status(ahd, scb);
+        else
+                ahd_done(ahd, scb);
+}
+
+
 /************************* Sequencer Execution Control ************************/
 /*
  * Restart the sequencer program from address zero
  */
-void
+static void
 ahd_restart(struct ahd_softc *ahd)
 {
 
@@ -342,7 +398,7 @@ ahd_restart(struct ahd_softc *ahd)
         ahd_unpause(ahd);
 }
 
-void
+static void
 ahd_clear_fifo(struct ahd_softc *ahd, u_int fifo)
 {
         ahd_mode_state   saved_modes;
@@ -366,7 +422,7 @@ ahd_clear_fifo(struct ahd_softc *ahd, u_int fifo)
  * Flush and completed commands that are sitting in the command
  * complete queues down on the chip but have yet to be dma'ed back up.
  */
-void
+static void
 ahd_flush_qoutfifo(struct ahd_softc *ahd)
 {
         struct          scb *scb;
@@ -905,6 +961,51 @@ ahd_handle_hwerrint(struct ahd_softc *ahd)
         ahd_free(ahd);
 }
 
+#ifdef AHD_DEBUG
+static void
+ahd_dump_sglist(struct scb *scb)
+{
+        int i;
+
+        if (scb->sg_count > 0) {
+                if ((scb->ahd_softc->flags & AHD_64BIT_ADDRESSING) != 0) {
+                        struct ahd_dma64_seg *sg_list;
+
+                        sg_list = (struct ahd_dma64_seg*)scb->sg_list;
+                        for (i = 0; i < scb->sg_count; i++) {
+                                uint64_t addr;
+                                uint32_t len;
+
+                                addr = ahd_le64toh(sg_list[i].addr);
+                                len = ahd_le32toh(sg_list[i].len);
+                                printf("sg[%d] - Addr 0x%x%x : Length %d%s\n",
+                                       i,
+                                       (uint32_t)((addr >> 32) & 0xFFFFFFFF),
+                                       (uint32_t)(addr & 0xFFFFFFFF),
+                                       sg_list[i].len & AHD_SG_LEN_MASK,
+                                       (sg_list[i].len & AHD_DMA_LAST_SEG)
+                                     ? " Last" : "");
+                        }
+                } else {
+                        struct ahd_dma_seg *sg_list;
+
+                        sg_list = (struct ahd_dma_seg*)scb->sg_list;
+                        for (i = 0; i < scb->sg_count; i++) {
+                                uint32_t len;
+
+                                len = ahd_le32toh(sg_list[i].len);
+                                printf("sg[%d] - Addr 0x%x%x : Length %d%s\n",
+                                       i,
+                                       (len & AHD_SG_HIGH_ADDR_MASK) >> 24,
+                                       ahd_le32toh(sg_list[i].addr),
+                                       len & AHD_SG_LEN_MASK,
+                                       len & AHD_DMA_LAST_SEG ? " Last" : "");
+                        }
+                }
+        }
+}
+#endif  /*  AHD_DEBUG  */
+
 void
 ahd_handle_seqint(struct ahd_softc *ahd, u_int intstat)
 {
@@ -1053,10 +1154,12 @@ ahd_handle_seqint(struct ahd_softc *ahd, u_int intstat)
                          * If a target takes us into the command phase
                          * assume that it has been externally reset and
                          * has thus lost our previous packetized negotiation
-                         * agreement.
-                         * Revert to async/narrow transfers until we
-                         * can renegotiate with the device and notify
-                         * the OSM about the reset.
+                         * agreement.  Since we have not sent an identify
+                         * message and may not have fully qualified the
+                         * connection, we change our command to TUR, assert
+                         * ATN and ABORT the task when we go to message in
+                         * phase.  The OSM will see the REQUEUE_REQUEST
+                         * status and retry the command.
                          */
                         scbid = ahd_get_scbptr(ahd);
                         scb = ahd_lookup_scb(ahd, scbid);
@@ -1083,7 +1186,28 @@ ahd_handle_seqint(struct ahd_softc *ahd, u_int intstat)
                         ahd_set_syncrate(ahd, &devinfo, /*period*/0,
                                          /*offset*/0, /*ppr_options*/0,
                                          AHD_TRANS_ACTIVE, /*paused*/TRUE);
-                        scb->flags |= SCB_EXTERNAL_RESET;
+                        /* Hand-craft TUR command */
+                        ahd_outb(ahd, SCB_CDB_STORE, 0);
+                        ahd_outb(ahd, SCB_CDB_STORE+1, 0);
+                        ahd_outb(ahd, SCB_CDB_STORE+2, 0);
+                        ahd_outb(ahd, SCB_CDB_STORE+3, 0);
+                        ahd_outb(ahd, SCB_CDB_STORE+4, 0);
+                        ahd_outb(ahd, SCB_CDB_STORE+5, 0);
+                        ahd_outb(ahd, SCB_CDB_LEN, 6);
+                        scb->hscb->control &= ~(TAG_ENB|SCB_TAG_TYPE);
+                        scb->hscb->control |= MK_MESSAGE;
+                        ahd_outb(ahd, SCB_CONTROL, scb->hscb->control);
+                        ahd_outb(ahd, MSG_OUT, HOST_MSG);
+                        ahd_outb(ahd, SAVED_SCSIID, scb->hscb->scsiid);
+                        /*
+                         * The lun is 0, regardless of the SCB's lun
+                         * as we have not sent an identify message.
+                         */
+                        ahd_outb(ahd, SAVED_LUN, 0);
+                        ahd_outb(ahd, SEQ_FLAGS, 0);
+                        ahd_assert_atn(ahd);
+                        scb->flags &= ~SCB_PACKETIZED;
+                        scb->flags |= SCB_ABORT|SCB_EXTERNAL_RESET;
                         ahd_freeze_devq(ahd, scb);
                         ahd_set_transaction_status(scb, CAM_REQUEUE_REQ);
                         ahd_freeze_scb(scb);
@@ -1519,8 +1643,10 @@ ahd_handle_scsiint(struct ahd_softc *ahd, u_int intstat)
         /*
          * Ignore external resets after a bus reset.
          */
-        if (((status & SCSIRSTI) != 0) && (ahd->flags & AHD_BUS_RESET_ACTIVE))
+        if (((status & SCSIRSTI) != 0) && (ahd->flags & AHD_BUS_RESET_ACTIVE)) {
+                ahd_outb(ahd, CLRSINT1, CLRSCSIRSTI);
                 return;
+        }
 
         /*
          * Clear bus reset flag
@@ -2200,6 +2326,22 @@ ahd_handle_nonpkt_busfree(struct ahd_softc *ahd)
                         if (sent_msg == MSG_ABORT_TAG)
                                 tag = SCB_GET_TAG(scb);
 
+                        if ((scb->flags & SCB_EXTERNAL_RESET) != 0) {
+                                /*
+                                 * This abort is in response to an
+                                 * unexpected switch to command phase
+                                 * for a packetized connection.  Since
+                                 * the identify message was never sent,
+                                 * "saved lun" is 0.  We really want to
+                                 * abort only the SCB that encountered
+                                 * this error, which could have a different
+                                 * lun.  The SCB will be retried so the OS
+                                 * will see the UA after renegotiating to
+                                 * packetized.
+                                 */
+                                tag = SCB_GET_TAG(scb);
+                                saved_lun = scb->hscb->lun;
+                        }
                         found = ahd_abort_scbs(ahd, target, 'A', saved_lun,
                                                tag, ROLE_INITIATOR,
                                                CAM_REQ_ABORTED);
@@ -2523,7 +2665,7 @@ ahd_force_renegotiation(struct ahd_softc *ahd, struct ahd_devinfo *devinfo)
 }
 
 #define AHD_MAX_STEPS 2000
-void
+static void
 ahd_clear_critical_section(struct ahd_softc *ahd)
 {
         ahd_mode_state  saved_modes;
@@ -2646,7 +2788,7 @@ ahd_clear_critical_section(struct ahd_softc *ahd)
 /*
  * Clear any pending interrupt status.
  */
-void
+static void
 ahd_clear_intstat(struct ahd_softc *ahd)
 {
         AHD_ASSERT_MODES(ahd, ~(AHD_MODE_UNKNOWN_MSK|AHD_MODE_CFG_MSK),
@@ -2677,6 +2819,8 @@ ahd_clear_intstat(struct ahd_softc *ahd)
 #ifdef AHD_DEBUG
 uint32_t ahd_debug = AHD_DEBUG_OPTS;
 #endif
+
+#if 0
 void
 ahd_print_scb(struct scb *scb)
 {
@@ -2701,49 +2845,7 @@ ahd_print_scb(struct scb *scb)
                SCB_GET_TAG(scb));
         ahd_dump_sglist(scb);
 }
-
-void
-ahd_dump_sglist(struct scb *scb)
-{
-        int i;
-
-        if (scb->sg_count > 0) {
-                if ((scb->ahd_softc->flags & AHD_64BIT_ADDRESSING) != 0) {
-                        struct ahd_dma64_seg *sg_list;
-
-                        sg_list = (struct ahd_dma64_seg*)scb->sg_list;
-                        for (i = 0; i < scb->sg_count; i++) {
-                                uint64_t addr;
-                                uint32_t len;
-
-                                addr = ahd_le64toh(sg_list[i].addr);
-                                len = ahd_le32toh(sg_list[i].len);
-                                printf("sg[%d] - Addr 0x%x%x : Length %d%s\n",
-                                       i,
-                                       (uint32_t)((addr >> 32) & 0xFFFFFFFF),
-                                       (uint32_t)(addr & 0xFFFFFFFF),
-                                       sg_list[i].len & AHD_SG_LEN_MASK,
-                                       (sg_list[i].len & AHD_DMA_LAST_SEG)
-                                     ? " Last" : "");
-                        }
-                } else {
-                        struct ahd_dma_seg *sg_list;
-
-                        sg_list = (struct ahd_dma_seg*)scb->sg_list;
-                        for (i = 0; i < scb->sg_count; i++) {
-                                uint32_t len;
-
-                                len = ahd_le32toh(sg_list[i].len);
-                                printf("sg[%d] - Addr 0x%x%x : Length %d%s\n",
-                                       i,
-                                       (len & AHD_SG_HIGH_ADDR_MASK) >> 24,
-                                       ahd_le32toh(sg_list[i].addr),
-                                       len & AHD_SG_LEN_MASK,
-                                       len & AHD_DMA_LAST_SEG ? " Last" : "");
-                        }
-                }
-        }
-}
+#endif  /*  0  */
 
 /************************* Transfer Negotiation *******************************/
 /*
@@ -2850,14 +2952,14 @@ ahd_devlimited_syncrate(struct ahd_softc *ahd,
                 transinfo = &tinfo->goal;
         *ppr_options &= (transinfo->ppr_options|MSG_EXT_PPR_PCOMP_EN);
         if (transinfo->width == MSG_EXT_WDTR_BUS_8_BIT) {
-                maxsync = MAX(maxsync, AHD_SYNCRATE_ULTRA2);
+                maxsync = max(maxsync, (u_int)AHD_SYNCRATE_ULTRA2);
                 *ppr_options &= ~MSG_EXT_PPR_DT_REQ;
         }
         if (transinfo->period == 0) {
                 *period = 0;
                 *ppr_options = 0;
         } else {
-                *period = MAX(*period, transinfo->period);
+                *period = max(*period, (u_int)transinfo->period);
                 ahd_find_syncrate(ahd, period, ppr_options, maxsync);
         }
 }
@@ -2906,7 +3008,7 @@ ahd_find_syncrate(struct ahd_softc *ahd, u_int *period,
  * Truncate the given synchronous offset to a value the
  * current adapter type and syncrate are capable of.
  */
-void
+static void
 ahd_validate_offset(struct ahd_softc *ahd,
                     struct ahd_initiator_tinfo *tinfo,
                     u_int period, u_int *offset, int wide,
@@ -2924,12 +3026,12 @@ ahd_validate_offset(struct ahd_softc *ahd,
                         maxoffset = MAX_OFFSET_PACED;
         } else
                 maxoffset = MAX_OFFSET_NON_PACED;
-        *offset = MIN(*offset, maxoffset);
+        *offset = min(*offset, maxoffset);
         if (tinfo != NULL) {
                 if (role == ROLE_TARGET)
-                        *offset = MIN(*offset, tinfo->user.offset);
+                        *offset = min(*offset, (u_int)tinfo->user.offset);
                 else
-                        *offset = MIN(*offset, tinfo->goal.offset);
+                        *offset = min(*offset, (u_int)tinfo->goal.offset);
         }
 }
 
@@ -2937,7 +3039,7 @@ ahd_validate_offset(struct ahd_softc *ahd,
  * Truncate the given transfer width parameter to a value the
  * current adapter type is capable of.
  */
-void
+static void
 ahd_validate_width(struct ahd_softc *ahd, struct ahd_initiator_tinfo *tinfo,
                    u_int *bus_width, role_t role)
 {
@@ -2955,9 +3057,9 @@ ahd_validate_width(struct ahd_softc *ahd, struct ahd_initiator_tinfo *tinfo,
         }
         if (tinfo != NULL) {
                 if (role == ROLE_TARGET)
-                        *bus_width = MIN(tinfo->user.width, *bus_width);
+                        *bus_width = min((u_int)tinfo->user.width, *bus_width);
                 else
-                        *bus_width = MIN(tinfo->goal.width, *bus_width);
+                        *bus_width = min((u_int)tinfo->goal.width, *bus_width);
         }
 }
 
@@ -3210,7 +3312,7 @@ ahd_set_width(struct ahd_softc *ahd, struct ahd_devinfo *devinfo,
 /*
  * Update the current state of tagged queuing for a given target.
  */
-void
+static void
 ahd_set_tags(struct ahd_softc *ahd, struct scsi_cmnd *cmd,
              struct ahd_devinfo *devinfo, ahd_queue_alg alg)
 {
@@ -3466,7 +3568,7 @@ ahd_print_devinfo(struct ahd_softc *ahd, struct ahd_devinfo *devinfo)
                devinfo->target, devinfo->lun);
 }
 
-struct ahd_phase_table_entry*
+static struct ahd_phase_table_entry*
 ahd_lookup_phase_entry(int phase)
 {
         struct ahd_phase_table_entry *entry;
@@ -5351,7 +5453,7 @@ ahd_free(struct ahd_softc *ahd)
         return;
 }
 
-void
+static void
 ahd_shutdown(void *arg)
 {
         struct  ahd_softc *ahd;
@@ -5480,7 +5582,7 @@ ahd_reset(struct ahd_softc *ahd, int reinit)
 /*
  * Determine the number of SCBs available on the controller
  */
-int
+static int
 ahd_probe_scbs(struct ahd_softc *ahd) {
         int i;
 
@@ -5929,7 +6031,7 @@ ahd_free_scb(struct ahd_softc *ahd, struct scb *scb)
         ahd_platform_scb_free(ahd, scb);
 }
 
-void
+static void
 ahd_alloc_scbs(struct ahd_softc *ahd)
 {
         struct scb_data *scb_data;
@@ -6057,9 +6159,9 @@ ahd_alloc_scbs(struct ahd_softc *ahd)
 #endif
         }
 
-        newcount = MIN(scb_data->sense_left, scb_data->scbs_left);
-        newcount = MIN(newcount, scb_data->sgs_left);
-        newcount = MIN(newcount, (AHD_SCB_MAX_ALLOC - scb_data->numscbs));
+        newcount = min(scb_data->sense_left, scb_data->scbs_left);
+        newcount = min(newcount, scb_data->sgs_left);
+        newcount = min(newcount, (AHD_SCB_MAX_ALLOC - scb_data->numscbs));
         for (i = 0; i < newcount; i++) {
                 struct scb_platform_data *pdata;
                 u_int col_tag;
@@ -6982,7 +7084,7 @@ ahd_intr_enable(struct ahd_softc *ahd, int enable)
         ahd_outb(ahd, HCNTRL, hcntrl);
 }
 
-void
+static void
 ahd_update_coalescing_values(struct ahd_softc *ahd, u_int timer, u_int maxcmds,
                              u_int mincmds)
 {
@@ -7000,7 +7102,7 @@ ahd_update_coalescing_values(struct ahd_softc *ahd, u_int timer, u_int maxcmds,
         ahd_outb(ahd, INT_COALESCING_MINCMDS, -mincmds);
 }
 
-void
+static void
 ahd_enable_coalescing(struct ahd_softc *ahd, int enable)
 {
 
@@ -7070,6 +7172,7 @@ ahd_pause_and_flushwork(struct ahd_softc *ahd)
         ahd->flags &= ~AHD_ALL_INTERRUPTS;
 }
 
+#if 0
 int
 ahd_suspend(struct ahd_softc *ahd)
 {
@@ -7083,7 +7186,9 @@ ahd_suspend(struct ahd_softc *ahd)
         ahd_shutdown(ahd);
         return (0);
 }
+#endif  /*  0  */
 
+#if 0
 int
 ahd_resume(struct ahd_softc *ahd)
 {
@@ -7093,6 +7198,7 @@ ahd_resume(struct ahd_softc *ahd)
         ahd_restart(ahd);
         return (0);
 }
+#endif  /*  0  */
 
 /************************** Busy Target Table *********************************/
 /*
@@ -7125,7 +7231,7 @@ ahd_index_busy_tcl(struct ahd_softc *ahd, u_int *saved_scbid, u_int tcl)
 /*
  * Return the untagged transaction id for a given target/channel lun.
  */
-u_int
+static u_int
 ahd_find_busy_tcl(struct ahd_softc *ahd, u_int tcl)
 {
         u_int scbid;
@@ -7138,7 +7244,7 @@ ahd_find_busy_tcl(struct ahd_softc *ahd, u_int tcl)
         return (scbid);
 }
 
-void
+static void
 ahd_busy_tcl(struct ahd_softc *ahd, u_int tcl, u_int scbid)
 {
         u_int scb_offset;
@@ -7186,7 +7292,7 @@ ahd_match_scb(struct ahd_softc *ahd, struct scb *scb, int target,
         return match;
 }
 
-void
+static void
 ahd_freeze_devq(struct ahd_softc *ahd, struct scb *scb)
 {
         int     target;
@@ -7690,7 +7796,7 @@ ahd_add_scb_to_free_list(struct ahd_softc *ahd, u_int scbid)
  * been modified from CAM_REQ_INPROG.  This routine assumes that the sequencer
  * is paused before it is called.
  */
-int
+static int
 ahd_abort_scbs(struct ahd_softc *ahd, int target, char channel,
                int lun, u_int tag, role_t role, uint32_t status)
 {
@@ -7920,6 +8026,11 @@ ahd_reset_channel(struct ahd_softc *ahd, char channel, int initiate_reset)
         ahd_clear_fifo(ahd, 1);
 
         /*
+         * Clear SCSI interrupt status
+         */
+        ahd_outb(ahd, CLRSINT1, CLRSCSIRSTI);
+
+        /*
          * Reenable selections
          */
         ahd_outb(ahd, SIMODE1, ahd_inb(ahd, SIMODE1) | ENSCSIRST);
@@ -7952,10 +8063,6 @@ ahd_reset_channel(struct ahd_softc *ahd, char channel, int initiate_reset)
                 }
         }
 #endif
-        /* Notify the XPT that a bus reset occurred */
-        ahd_send_async(ahd, devinfo.channel, CAM_TARGET_WILDCARD,
-                       CAM_LUN_WILDCARD, AC_BUS_RESET);
-
         /*
          * Revert to async/narrow transfers until we renegotiate.
          */
@@ -7977,6 +8084,10 @@ ahd_reset_channel(struct ahd_softc *ahd, char channel, int initiate_reset)
                 }
         }
 
+        /* Notify the XPT that a bus reset occurred */
+        ahd_send_async(ahd, devinfo.channel, CAM_TARGET_WILDCARD,
+                       CAM_LUN_WILDCARD, AC_BUS_RESET);
+
         ahd_restart(ahd);
 
         return (found);
@@ -8019,18 +8130,8 @@ ahd_stat_timer(void *arg)
 }
 
 /****************************** Status Processing *****************************/
-void
-ahd_handle_scb_status(struct ahd_softc *ahd, struct scb *scb)
-{
-        if (scb->hscb->shared_data.istatus.scsi_status != 0) {
-                ahd_handle_scsi_status(ahd, scb);
-        } else {
-                ahd_calc_residual(ahd, scb);
-                ahd_done(ahd, scb);
-        }
-}
 
-void
+static void
 ahd_handle_scsi_status(struct ahd_softc *ahd, struct scb *scb)
 {
         struct  hardware_scb *hscb;
@@ -8238,10 +8339,21 @@ ahd_handle_scsi_status(struct ahd_softc *ahd, struct scb *scb)
         }
 }
 
+static void
+ahd_handle_scb_status(struct ahd_softc *ahd, struct scb *scb)
+{
+        if (scb->hscb->shared_data.istatus.scsi_status != 0) {
+                ahd_handle_scsi_status(ahd, scb);
+        } else {
+                ahd_calc_residual(ahd, scb);
+                ahd_done(ahd, scb);
+        }
+}
+
 /*
  * Calculate the residual for a just completed SCB.
  */
-void
+static void
 ahd_calc_residual(struct ahd_softc *ahd, struct scb *scb)
 {
         struct hardware_scb *hscb;
@@ -8668,7 +8780,7 @@ ahd_resolve_seqaddr(struct ahd_softc *ahd, u_int address)
                 if (skip_addr > i) {
                         int end_addr;
 
-                        end_addr = MIN(address, skip_addr);
+                        end_addr = min(address, skip_addr);
                         address_offset += end_addr - i;
                         i = skip_addr;
                 } else {
@@ -9092,6 +9204,7 @@ ahd_dump_card_state(struct ahd_softc *ahd)
                 ahd_unpause(ahd);
 }
 
+#if 0
 void
 ahd_dump_scbs(struct ahd_softc *ahd)
 {
@@ -9117,6 +9230,7 @@ ahd_dump_scbs(struct ahd_softc *ahd)
         ahd_set_scbptr(ahd, saved_scb_index);
         ahd_restore_modes(ahd, saved_modes);
 }
+#endif  /*  0  */
 
 /**************************** Flexport Logic **********************************/
 /*
@@ -9219,7 +9333,7 @@ ahd_write_seeprom(struct ahd_softc *ahd, uint16_t *buf,
 /*
  * Wait ~100us for the serial eeprom to satisfy our request.
  */
-int
+static int
 ahd_wait_seeprom(struct ahd_softc *ahd)
 {
         int cnt;
@@ -9237,7 +9351,7 @@ ahd_wait_seeprom(struct ahd_softc *ahd)
  * Validate the two checksums in the per_channel
  * vital product data struct.
  */
-int
+static int
 ahd_verify_vpd_cksum(struct vpd_config *vpd)
 {
         int i;
@@ -9316,6 +9430,24 @@ ahd_release_seeprom(struct ahd_softc *ahd)
         /* Currently a no-op */
 }
 
+/*
+ * Wait at most 2 seconds for flexport arbitration to succeed.
+ */
+static int
+ahd_wait_flexport(struct ahd_softc *ahd)
+{
+        int cnt;
+
+        AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
+        cnt = 1000000 * 2 / 5;
+        while ((ahd_inb(ahd, BRDCTL) & FLXARBACK) == 0 && --cnt)
+                ahd_delay(5);
+
+        if (cnt == 0)
+                return (ETIMEDOUT);
+        return (0);
+}
+
 int
 ahd_write_flexport(struct ahd_softc *ahd, u_int addr, u_int value)
 {
@@ -9357,24 +9489,6 @@ ahd_read_flexport(struct ahd_softc *ahd, u_int addr, uint8_t *value)
         return (0);
 }
 
-/*
- * Wait at most 2 seconds for flexport arbitration to succeed.
- */
-int
-ahd_wait_flexport(struct ahd_softc *ahd)
-{
-        int cnt;
-
-        AHD_ASSERT_MODES(ahd, AHD_MODE_SCSI_MSK, AHD_MODE_SCSI_MSK);
-        cnt = 1000000 * 2 / 5;
-        while ((ahd_inb(ahd, BRDCTL) & FLXARBACK) == 0 && --cnt)
-                ahd_delay(5);
-
-        if (cnt == 0)
-                return (ETIMEDOUT);
-        return (0);
-}
-
 /************************* Target Mode ****************************************/
 #ifdef AHD_TARGET_MODE
 cam_status
diff --git a/drivers/scsi/aic7xxx/aic79xx_inline.h b/drivers/scsi/aic7xxx/aic79xx_inline.h
index a3266e066c00..2ceb67f4af2a 100644
--- a/drivers/scsi/aic7xxx/aic79xx_inline.h
+++ b/drivers/scsi/aic7xxx/aic79xx_inline.h
@@ -418,10 +418,6 @@ ahd_targetcmd_offset(struct ahd_softc *ahd, u_int index)
 }
 
 /*********************** Miscelaneous Support Functions ***********************/
-static __inline void    ahd_complete_scb(struct ahd_softc *ahd,
-                                         struct scb *scb);
-static __inline void    ahd_update_residual(struct ahd_softc *ahd,
-                                            struct scb *scb);
 static __inline struct ahd_initiator_tinfo *
                         ahd_fetch_transinfo(struct ahd_softc *ahd,
                                             char channel, u_int our_id,
@@ -467,32 +463,6 @@ static __inline uint32_t
                         ahd_get_sense_bufaddr(struct ahd_softc *ahd,
                                               struct scb *scb);
 
-static __inline void
-ahd_complete_scb(struct ahd_softc *ahd, struct scb *scb)
-{
-        uint32_t sgptr;
-
-        sgptr = ahd_le32toh(scb->hscb->sgptr);
-        if ((sgptr & SG_STATUS_VALID) != 0)
-                ahd_handle_scb_status(ahd, scb);
-        else
-                ahd_done(ahd, scb);
-}
-
-/*
- * Determine whether the sequencer reported a residual
- * for this SCB/transaction.
- */
-static __inline void
-ahd_update_residual(struct ahd_softc *ahd, struct scb *scb)
-{
-        uint32_t sgptr;
-
-        sgptr = ahd_le32toh(scb->hscb->sgptr);
-        if ((sgptr & SG_STATUS_VALID) != 0)
-                ahd_calc_residual(ahd, scb);
-}
-
 /*
  * Return pointers to the transfer negotiation information
  * for the specified our_id/remote_id pair.
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index f8e60486167d..9bfcca5ede08 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -293,7 +293,7 @@ static uint32_t aic79xx_seltime;
  * force all outstanding transactions to be serviced prior to a new
  * transaction.
  */
-uint32_t aic79xx_periodic_otag;
+static uint32_t aic79xx_periodic_otag;
 
 /* Some storage boxes are using an LSI chip which has a bug making it
  * impossible to use aic79xx Rev B chip in 320 speeds.  The following
@@ -773,6 +773,7 @@ struct scsi_host_template aic79xx_driver_template = {
 #endif
         .can_queue              = AHD_MAX_QUEUE,
         .this_id                = -1,
+        .max_sectors            = 8192,
         .cmd_per_lun            = 2,
         .use_clustering         = ENABLE_CLUSTERING,
         .slave_alloc            = ahd_linux_slave_alloc,
@@ -1813,9 +1814,9 @@ ahd_linux_handle_scsi_status(struct ahd_softc *ahd,
                         u_int sense_offset;
 
                         if (scb->flags & SCB_SENSE) {
-                                sense_size = MIN(sizeof(struct scsi_sense_data)
+                                sense_size = min(sizeof(struct scsi_sense_data)
                                                - ahd_get_sense_residual(scb),
-                                                 sizeof(cmd->sense_buffer));
+                                                 (u_long)sizeof(cmd->sense_buffer));
                                 sense_offset = 0;
                         } else {
                                 /*
@@ -1824,7 +1825,8 @@ ahd_linux_handle_scsi_status(struct ahd_softc *ahd,
                                  */
                                 siu = (struct scsi_status_iu_header *)
                                     scb->sense_data;
-                                sense_size = MIN(scsi_4btoul(siu->sense_length),
+                                sense_size = min_t(size_t,
+                                                scsi_4btoul(siu->sense_length),
                                                 sizeof(cmd->sense_buffer));
                                 sense_offset = SIU_SENSE_OFFSET(siu);
                         }
@@ -2634,8 +2636,22 @@ static void ahd_linux_set_pcomp_en(struct scsi_target *starget, int pcomp)
                        pcomp ? "Enable" : "Disable");
 #endif
 
-        if (pcomp)
+        if (pcomp) {
+                uint8_t precomp;
+
+                if (ahd->unit < ARRAY_SIZE(aic79xx_iocell_info)) {
+                        struct ahd_linux_iocell_opts *iocell_opts;
+
+                        iocell_opts = &aic79xx_iocell_info[ahd->unit];
+                        precomp = iocell_opts->precomp;
+                } else {
+                        precomp = AIC79XX_DEFAULT_PRECOMP;
+                }
                 ppr_options |= MSG_EXT_PPR_PCOMP_EN;
+                AHD_SET_PRECOMP(ahd, precomp);
+        } else {
+                AHD_SET_PRECOMP(ahd, 0);
+        }
 
         ahd_compile_devinfo(&devinfo, shost->this_id, starget->id, 0,
                             starget->channel + 'A', ROLE_INITIATOR);
@@ -2678,7 +2694,25 @@ static void ahd_linux_set_hold_mcs(struct scsi_target *starget, int hold)
         ahd_unlock(ahd, &flags);
 }
 
+static void ahd_linux_get_signalling(struct Scsi_Host *shost)
+{
+        struct ahd_softc *ahd = *(struct ahd_softc **)shost->hostdata;
+        unsigned long flags;
+        u8 mode;
+
+        ahd_lock(ahd, &flags);
+        ahd_pause(ahd);
+        mode = ahd_inb(ahd, SBLKCTL);
+        ahd_unpause(ahd);
+        ahd_unlock(ahd, &flags);
 
+        if (mode & ENAB40)
+                spi_signalling(shost) = SPI_SIGNAL_LVD;
+        else if (mode & ENAB20)
+                spi_signalling(shost) = SPI_SIGNAL_SE;
+        else
+                spi_signalling(shost) = SPI_SIGNAL_UNKNOWN;
+}
 
 static struct spi_function_template ahd_linux_transport_functions = {
         .set_offset     = ahd_linux_set_offset,
@@ -2703,6 +2737,7 @@ static struct spi_function_template ahd_linux_transport_functions = {
         .show_pcomp_en  = 1,
         .set_hold_mcs   = ahd_linux_set_hold_mcs,
         .show_hold_mcs  = 1,
+        .get_signalling = ahd_linux_get_signalling,
 };
 
 static int __init
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.h b/drivers/scsi/aic7xxx/aic79xx_osm.h
index fb3d4dd54413..3a67fc578d78 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.h
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.h
@@ -506,9 +506,6 @@ struct info_str {
         int pos;
 };
 
-void    ahd_format_transinfo(struct info_str *info,
-                             struct ahd_transinfo *tinfo);
-
 /******************************** Locking *************************************/
 static __inline void
 ahd_lockinit(struct ahd_softc *ahd)
@@ -582,8 +579,6 @@ ahd_unlock(struct ahd_softc *ahd, unsigned long *flags)
 #define PCIXM_STATUS_MAXCRDS    0x1C00  /* Maximum Cumulative Read Size */
 #define PCIXM_STATUS_RCVDSCEM   0x2000  /* Received a Split Comp w/Error msg */
 
-extern struct pci_driver aic79xx_pci_driver;
-
 typedef enum
 {
         AHD_POWER_STATE_D0,
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
index 4b5354201807..2001fe890e71 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm_pci.c
@@ -82,7 +82,7 @@ static struct pci_device_id ahd_linux_pci_id_table[] = {
 
 MODULE_DEVICE_TABLE(pci, ahd_linux_pci_id_table);
 
-struct pci_driver aic79xx_pci_driver = {
+static struct pci_driver aic79xx_pci_driver = {
         .name           = "aic79xx",
         .probe          = ahd_linux_pci_dev_probe,
         .remove         = ahd_linux_pci_dev_remove,
diff --git a/drivers/scsi/aic7xxx/aic79xx_pci.c b/drivers/scsi/aic7xxx/aic79xx_pci.c
index 14850f31aafa..c07735819cd1 100644
--- a/drivers/scsi/aic7xxx/aic79xx_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_pci.c
@@ -97,7 +97,7 @@ static ahd_device_setup_t ahd_aic7901A_setup;
 static ahd_device_setup_t ahd_aic7902_setup;
 static ahd_device_setup_t ahd_aic790X_setup;
 
-struct ahd_pci_identity ahd_pci_ident_table [] =
+static struct ahd_pci_identity ahd_pci_ident_table [] =
 {
         /* aic7901 based controllers */
         {
@@ -201,7 +201,7 @@ struct ahd_pci_identity ahd_pci_ident_table [] =
         }
 };
 
-const u_int ahd_num_pci_devs = ARRAY_SIZE(ahd_pci_ident_table);
+static const u_int ahd_num_pci_devs = ARRAY_SIZE(ahd_pci_ident_table);
                 
 #define DEVCONFIG               0x40
 #define         PCIXINITPAT     0x0000E000ul
@@ -245,6 +245,7 @@ static int	ahd_check_extport(struct ahd_softc *ahd);
 static void     ahd_configure_termination(struct ahd_softc *ahd,
                                           u_int adapter_control);
 static void     ahd_pci_split_intr(struct ahd_softc *ahd, u_int intstat);
+static void     ahd_pci_intr(struct ahd_softc *ahd);
 
 struct ahd_pci_identity *
 ahd_find_pci_device(ahd_dev_softc_t pci)
@@ -757,7 +758,7 @@ static const char *pci_status_strings[] =
         "%s: Address or Write Phase Parity Error Detected in %s.\n"
 };
 
-void
+static void
 ahd_pci_intr(struct ahd_softc *ahd)
 {
         uint8_t         pci_status[8];
diff --git a/drivers/scsi/aic7xxx/aic79xx_proc.c b/drivers/scsi/aic7xxx/aic79xx_proc.c
index c5f0ee591509..6b28bebcbca0 100644
--- a/drivers/scsi/aic7xxx/aic79xx_proc.c
+++ b/drivers/scsi/aic7xxx/aic79xx_proc.c
@@ -136,7 +136,7 @@ copy_info(struct info_str *info, char *fmt, ...)
         return (len);
 }
 
-void
+static void
 ahd_format_transinfo(struct info_str *info, struct ahd_transinfo *tinfo)
 {
         u_int speed;
diff --git a/drivers/scsi/aic7xxx/aic7xxx.h b/drivers/scsi/aic7xxx/aic7xxx.h
index 62ff8c3dc2bb..954c7c24501d 100644
--- a/drivers/scsi/aic7xxx/aic7xxx.h
+++ b/drivers/scsi/aic7xxx/aic7xxx.h
@@ -54,14 +54,6 @@ struct scb_platform_data;
 struct seeprom_descriptor;
 
 /****************************** Useful Macros *********************************/
-#ifndef MAX
-#define MAX(a,b) (((a) > (b)) ? (a) : (b))
-#endif
-
-#ifndef MIN
-#define MIN(a,b) (((a) < (b)) ? (a) : (b))
-#endif
-
 #ifndef TRUE
 #define TRUE 1
 #endif
@@ -1135,8 +1127,6 @@ struct ahc_pci_identity {
         char                    *name;
         ahc_device_setup_t      *setup;
 };
-extern struct ahc_pci_identity ahc_pci_ident_table[];
-extern const u_int ahc_num_pci_devs;
 
 /***************************** VL/EISA Declarations ***************************/
 struct aic7770_identity {
@@ -1289,6 +1279,7 @@ typedef enum {
 } ahc_queue_alg;
 
 void                    ahc_set_tags(struct ahc_softc *ahc,
+                                     struct scsi_cmnd *cmd,
                                      struct ahc_devinfo *devinfo,
                                      ahc_queue_alg alg);
 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
index 93e4e40944b6..50ef785224de 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
@@ -1671,7 +1671,7 @@ ahc_devlimited_syncrate(struct ahc_softc *ahc,
                 transinfo = &tinfo->goal;
         *ppr_options &= transinfo->ppr_options;
         if (transinfo->width == MSG_EXT_WDTR_BUS_8_BIT) {
-                maxsync = MAX(maxsync, AHC_SYNCRATE_ULTRA2);
+                maxsync = max(maxsync, (u_int)AHC_SYNCRATE_ULTRA2);
                 *ppr_options &= ~MSG_EXT_PPR_DT_REQ;
         }
         if (transinfo->period == 0) {
@@ -1679,7 +1679,7 @@ ahc_devlimited_syncrate(struct ahc_softc *ahc,
                 *ppr_options = 0;
                 return (NULL);
         }
-        *period = MAX(*period, transinfo->period);
+        *period = max(*period, (u_int)transinfo->period);
         return (ahc_find_syncrate(ahc, period, ppr_options, maxsync));
 }
 
@@ -1804,12 +1804,12 @@ ahc_validate_offset(struct ahc_softc *ahc,
                 else
                         maxoffset = MAX_OFFSET_8BIT;
         }
-        *offset = MIN(*offset, maxoffset);
+        *offset = min(*offset, maxoffset);
         if (tinfo != NULL) {
                 if (role == ROLE_TARGET)
-                        *offset = MIN(*offset, tinfo->user.offset);
+                        *offset = min(*offset, (u_int)tinfo->user.offset);
                 else
-                        *offset = MIN(*offset, tinfo->goal.offset);
+                        *offset = min(*offset, (u_int)tinfo->goal.offset);
         }
 }
 
@@ -1835,9 +1835,9 @@ ahc_validate_width(struct ahc_softc *ahc, struct ahc_initiator_tinfo *tinfo,
         }
         if (tinfo != NULL) {
                 if (role == ROLE_TARGET)
-                        *bus_width = MIN(tinfo->user.width, *bus_width);
+                        *bus_width = min((u_int)tinfo->user.width, *bus_width);
                 else
-                        *bus_width = MIN(tinfo->goal.width, *bus_width);
+                        *bus_width = min((u_int)tinfo->goal.width, *bus_width);
         }
 }
 
@@ -1986,7 +1986,7 @@ ahc_set_syncrate(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                 tinfo->curr.ppr_options = ppr_options;
 
                 ahc_send_async(ahc, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
+                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG);
                 if (bootverbose) {
                         if (offset != 0) {
                                 printf("%s: target %d synchronous at %sMHz%s, "
@@ -2056,7 +2056,7 @@ ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                 tinfo->curr.width = width;
 
                 ahc_send_async(ahc, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG, NULL);
+                               CAM_LUN_WILDCARD, AC_TRANSFER_NEG);
                 if (bootverbose) {
                         printf("%s: target %d using %dbit transfers\n",
                                ahc_name(ahc), devinfo->target,
@@ -2074,12 +2074,14 @@ ahc_set_width(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
  * Update the current state of tagged queuing for a given target.
  */
 void
-ahc_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
-             ahc_queue_alg alg)
+ahc_set_tags(struct ahc_softc *ahc, struct scsi_cmnd *cmd,
+             struct ahc_devinfo *devinfo, ahc_queue_alg alg)
 {
-        ahc_platform_set_tags(ahc, devinfo, alg);
+        struct scsi_device *sdev = cmd->device;
+
+        ahc_platform_set_tags(ahc, sdev, devinfo, alg);
         ahc_send_async(ahc, devinfo->channel, devinfo->target,
-                       devinfo->lun, AC_TRANSFER_NEG, &alg);
+                       devinfo->lun, AC_TRANSFER_NEG);
 }
 
 /*
@@ -3489,7 +3491,7 @@ ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
                         printf("(%s:%c:%d:%d): refuses tagged commands.  "
                                "Performing non-tagged I/O\n", ahc_name(ahc),
                                devinfo->channel, devinfo->target, devinfo->lun);
-                        ahc_set_tags(ahc, devinfo, AHC_QUEUE_NONE);
+                        ahc_set_tags(ahc, scb->io_ctx, devinfo, AHC_QUEUE_NONE);
                         mask = ~0x23;
                 } else {
                         printf("(%s:%c:%d:%d): refuses %s tagged commands.  "
@@ -3497,7 +3499,7 @@ ahc_handle_msg_reject(struct ahc_softc *ahc, struct ahc_devinfo *devinfo)
                                ahc_name(ahc), devinfo->channel, devinfo->target,
                                devinfo->lun, tag_type == MSG_ORDERED_TASK
                                ? "ordered" : "head of queue");
-                        ahc_set_tags(ahc, devinfo, AHC_QUEUE_BASIC);
+                        ahc_set_tags(ahc, scb->io_ctx, devinfo, AHC_QUEUE_BASIC);
                         mask = ~0x03;
                 }
 
@@ -3763,7 +3765,7 @@ ahc_handle_devreset(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
         
         if (status != CAM_SEL_TIMEOUT)
                 ahc_send_async(ahc, devinfo->channel, devinfo->target,
-                               CAM_LUN_WILDCARD, AC_SENT_BDR, NULL);
+                               CAM_LUN_WILDCARD, AC_SENT_BDR);
 
         if (message != NULL
          && (verbose_level <= bootverbose))
@@ -4406,7 +4408,7 @@ ahc_alloc_scbs(struct ahc_softc *ahc)
         physaddr = sg_map->sg_physaddr;
 
         newcount = (PAGE_SIZE / (AHC_NSEG * sizeof(struct ahc_dma_seg)));
-        newcount = MIN(newcount, (AHC_SCB_MAX_ALLOC - scb_data->numscbs));
+        newcount = min(newcount, (AHC_SCB_MAX_ALLOC - scb_data->numscbs));
         for (i = 0; i < newcount; i++) {
                 struct scb_platform_data *pdata;
 #ifndef __linux__
@@ -6018,7 +6020,7 @@ ahc_reset_channel(struct ahc_softc *ahc, char channel, int initiate_reset)
 #endif
         /* Notify the XPT that a bus reset occurred */
         ahc_send_async(ahc, devinfo.channel, CAM_TARGET_WILDCARD,
-                       CAM_LUN_WILDCARD, AC_BUS_RESET, NULL);
+                       CAM_LUN_WILDCARD, AC_BUS_RESET);
 
         /*
          * Revert to async/narrow transfers until we renegotiate.
@@ -6442,7 +6444,7 @@ ahc_download_instr(struct ahc_softc *ahc, u_int instrptr, uint8_t *dconsts)
                         if (skip_addr > i) {
                                 int end_addr;
 
-                                end_addr = MIN(address, skip_addr);
+                                end_addr = min(address, skip_addr);
                                 address_offset += end_addr - i;
                                 i = skip_addr;
                         } else {
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 43ab753d2739..660f26e23a38 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -328,7 +328,7 @@ static uint32_t aic7xxx_seltime;
  * force all outstanding transactions to be serviced prior to a new
  * transaction.
  */
-uint32_t aic7xxx_periodic_otag;
+static uint32_t aic7xxx_periodic_otag;
 
 /*
  * Module information and settable options.
@@ -512,7 +512,6 @@ ahc_linux_target_alloc(struct scsi_target *starget)
         struct seeprom_config *sc = ahc->seep_config;
         unsigned long flags;
         struct scsi_target **ahc_targp = ahc_linux_target_in_softc(starget);
-        struct ahc_linux_target *targ = scsi_transport_target_data(starget);
         unsigned short scsirate;
         struct ahc_devinfo devinfo;
         struct ahc_initiator_tinfo *tinfo;
@@ -533,7 +532,6 @@ ahc_linux_target_alloc(struct scsi_target *starget)
         BUG_ON(*ahc_targp != NULL);
 
         *ahc_targp = starget;
-        memset(targ, 0, sizeof(*targ));
 
         if (sc) {
                 int maxsync = AHC_SYNCRATE_DT;
@@ -594,14 +592,11 @@ ahc_linux_slave_alloc(struct scsi_device *sdev)
         struct  ahc_softc *ahc =
                 *((struct ahc_softc **)sdev->host->hostdata);
         struct scsi_target *starget = sdev->sdev_target;
-        struct ahc_linux_target *targ = scsi_transport_target_data(starget);
         struct ahc_linux_device *dev;
 
         if (bootverbose)
                 printf("%s: Slave Alloc %d\n", ahc_name(ahc), sdev->id);
 
-        BUG_ON(targ->sdev[sdev->lun] != NULL);
-
         dev = scsi_transport_device_data(sdev);
         memset(dev, 0, sizeof(*dev));
 
@@ -618,8 +613,6 @@ ahc_linux_slave_alloc(struct scsi_device *sdev)
          */
         dev->maxtags = 0;
         
-        targ->sdev[sdev->lun] = sdev;
-
         spi_period(starget) = 0;
 
         return 0;
@@ -644,22 +637,6 @@ ahc_linux_slave_configure(struct scsi_device *sdev)
         return 0;
 }
 
-static void
-ahc_linux_slave_destroy(struct scsi_device *sdev)
-{
-        struct  ahc_softc *ahc;
-        struct  ahc_linux_device *dev = scsi_transport_device_data(sdev);
-        struct  ahc_linux_target *targ = scsi_transport_target_data(sdev->sdev_target);
-
-        ahc = *((struct ahc_softc **)sdev->host->hostdata);
-        if (bootverbose)
-                printf("%s: Slave Destroy %d\n", ahc_name(ahc), sdev->id);
-
-        BUG_ON(dev->active);
-
-        targ->sdev[sdev->lun] = NULL;
-}
-
 #if defined(__i386__)
 /*
  * Return the disk geometry for the given SCSI device.
@@ -777,11 +754,11 @@ struct scsi_host_template aic7xxx_driver_template = {
 #endif
         .can_queue              = AHC_MAX_QUEUE,
         .this_id                = -1,
+        .max_sectors            = 8192,
         .cmd_per_lun            = 2,
         .use_clustering         = ENABLE_CLUSTERING,
         .slave_alloc            = ahc_linux_slave_alloc,
         .slave_configure        = ahc_linux_slave_configure,
-        .slave_destroy          = ahc_linux_slave_destroy,
         .target_alloc           = ahc_linux_target_alloc,
         .target_destroy         = ahc_linux_target_destroy,
 };
@@ -1203,21 +1180,13 @@ void
 ahc_platform_free(struct ahc_softc *ahc)
 {
         struct scsi_target *starget;
-        int i, j;
+        int i;
 
         if (ahc->platform_data != NULL) {
                 /* destroy all of the device and target objects */
                 for (i = 0; i < AHC_NUM_TARGETS; i++) {
                         starget = ahc->platform_data->starget[i];
                         if (starget != NULL) {
-                                for (j = 0; j < AHC_NUM_LUNS; j++) {
-                                        struct ahc_linux_target *targ =
-                                                scsi_transport_target_data(starget);
-
-                                        if (targ->sdev[j] == NULL)
-                                                continue;
-                                        targ->sdev[j] = NULL;
-                                }
                                 ahc->platform_data->starget[i] = NULL;
                         }
                 }
@@ -1251,24 +1220,13 @@ ahc_platform_freeze_devq(struct ahc_softc *ahc, struct scb *scb)
 }
 
 void
-ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
-                      ahc_queue_alg alg)
+ahc_platform_set_tags(struct ahc_softc *ahc, struct scsi_device *sdev,
+                      struct ahc_devinfo *devinfo, ahc_queue_alg alg)
 {
-        struct scsi_target *starget;
-        struct ahc_linux_target *targ;
         struct ahc_linux_device *dev;
-        struct scsi_device *sdev;
-        u_int target_offset;
         int was_queuing;
         int now_queuing;
 
-        target_offset = devinfo->target;
-        if (devinfo->channel != 'A')
-                target_offset += 8;
-        starget = ahc->platform_data->starget[target_offset];
-        targ = scsi_transport_target_data(starget);
-        BUG_ON(targ == NULL);
-        sdev = targ->sdev[devinfo->lun];
         if (sdev == NULL)
                 return;
         dev = scsi_transport_device_data(sdev);
@@ -1401,11 +1359,15 @@ ahc_linux_device_queue_depth(struct scsi_device *sdev)
         tags = ahc_linux_user_tagdepth(ahc, &devinfo);
         if (tags != 0 && sdev->tagged_supported != 0) {
 
-                ahc_set_tags(ahc, &devinfo, AHC_QUEUE_TAGGED);
+                ahc_platform_set_tags(ahc, sdev, &devinfo, AHC_QUEUE_TAGGED);
+                ahc_send_async(ahc, devinfo.channel, devinfo.target,
+                               devinfo.lun, AC_TRANSFER_NEG);
                 ahc_print_devinfo(ahc, &devinfo);
                 printf("Tagged Queuing enabled.  Depth %d\n", tags);
         } else {
-                ahc_set_tags(ahc, &devinfo, AHC_QUEUE_NONE);
+                ahc_platform_set_tags(ahc, sdev, &devinfo, AHC_QUEUE_NONE);
+                ahc_send_async(ahc, devinfo.channel, devinfo.target,
+                               devinfo.lun, AC_TRANSFER_NEG);
         }
 }
 
@@ -1629,7 +1591,7 @@ ahc_platform_flushwork(struct ahc_softc *ahc)
 
 void
 ahc_send_async(struct ahc_softc *ahc, char channel,
-               u_int target, u_int lun, ac_code code, void *arg)
+               u_int target, u_int lun, ac_code code)
 {
         switch (code) {
         case AC_TRANSFER_NEG:
@@ -1875,9 +1837,9 @@ ahc_linux_handle_scsi_status(struct ahc_softc *ahc,
                 if (scb->flags & SCB_SENSE) {
                         u_int sense_size;
 
-                        sense_size = MIN(sizeof(struct scsi_sense_data)
+                        sense_size = min(sizeof(struct scsi_sense_data)
                                        - ahc_get_sense_residual(scb),
-                                         sizeof(cmd->sense_buffer));
+                                         (u_long)sizeof(cmd->sense_buffer));
                         memcpy(cmd->sense_buffer,
                                ahc_get_sense_buf(ahc, scb), sense_size);
                         if (sense_size < sizeof(cmd->sense_buffer))
@@ -1946,7 +1908,7 @@ ahc_linux_handle_scsi_status(struct ahc_softc *ahc,
                         }
                         ahc_set_transaction_status(scb, CAM_REQUEUE_REQ);
                         ahc_set_scsi_status(scb, SCSI_STATUS_OK);
-                        ahc_platform_set_tags(ahc, &devinfo,
+                        ahc_platform_set_tags(ahc, sdev, &devinfo,
                                      (dev->flags & AHC_DEV_Q_BASIC)
                                    ? AHC_QUEUE_BASIC : AHC_QUEUE_TAGGED);
                         break;
@@ -1957,7 +1919,7 @@ ahc_linux_handle_scsi_status(struct ahc_softc *ahc,
                  */
                 dev->openings = 1;
                 ahc_set_scsi_status(scb, SCSI_STATUS_BUSY);
-                ahc_platform_set_tags(ahc, &devinfo,
+                ahc_platform_set_tags(ahc, sdev, &devinfo,
                              (dev->flags & AHC_DEV_Q_BASIC)
                            ? AHC_QUEUE_BASIC : AHC_QUEUE_TAGGED);
                 break;
@@ -2599,8 +2561,6 @@ ahc_linux_init(void)
         if (!ahc_linux_transport_template)
                 return -ENODEV;
 
-        scsi_transport_reserve_target(ahc_linux_transport_template,
-                                      sizeof(struct ahc_linux_target));
         scsi_transport_reserve_device(ahc_linux_transport_template,
                                       sizeof(struct ahc_linux_device));
 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.h b/drivers/scsi/aic7xxx/aic7xxx_osm.h
index a87a4ce090df..85ae5d836fa4 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.h
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.h
@@ -256,7 +256,6 @@ typedef enum {
         AHC_DEV_PERIODIC_OTAG    = 0x40, /* Send OTAG to prevent starvation */
 } ahc_linux_dev_flags;
 
-struct ahc_linux_target;
 struct ahc_linux_device {
         /*
          * The number of transactions currently
@@ -329,12 +328,6 @@ struct ahc_linux_device {
 #define AHC_OTAG_THRESH 500
 };
 
-struct ahc_linux_target {
-        struct scsi_device       *sdev[AHC_NUM_LUNS];
-        struct ahc_transinfo      last_tinfo;
-        struct ahc_softc         *ahc;
-};
-
 /********************* Definitions Required by the Core ***********************/
 /*
  * Number of SG segments we require.  So long as the S/G segments for
@@ -533,8 +526,6 @@ ahc_unlock(struct ahc_softc *ahc, unsigned long *flags)
 #define PCIR_SUBVEND_0  0x2c
 #define PCIR_SUBDEV_0   0x2e
 
-extern struct pci_driver aic7xxx_pci_driver;
-
 typedef enum
 {
         AHC_POWER_STATE_D0,
@@ -824,7 +815,7 @@ ahc_freeze_scb(struct scb *scb)
         }
 }
 
-void    ahc_platform_set_tags(struct ahc_softc *ahc,
+void    ahc_platform_set_tags(struct ahc_softc *ahc, struct scsi_device *sdev,
                               struct ahc_devinfo *devinfo, ahc_queue_alg);
 int     ahc_platform_abort_scbs(struct ahc_softc *ahc, int target,
                                 char channel, int lun, u_int tag,
@@ -834,7 +825,7 @@ irqreturn_t
 void    ahc_platform_flushwork(struct ahc_softc *ahc);
 void    ahc_done(struct ahc_softc*, struct scb*);
 void    ahc_send_async(struct ahc_softc *, char channel,
-                       u_int target, u_int lun, ac_code, void *);
+                       u_int target, u_int lun, ac_code);
 void    ahc_print_path(struct ahc_softc *, struct scb *);
 void    ahc_platform_dump_card_state(struct ahc_softc *ahc);
 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
index d20ca514e9f3..ea5687df732d 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm_pci.c
@@ -130,7 +130,7 @@ static struct pci_device_id ahc_linux_pci_id_table[] = {
 
 MODULE_DEVICE_TABLE(pci, ahc_linux_pci_id_table);
 
-struct pci_driver aic7xxx_pci_driver = {
+static struct pci_driver aic7xxx_pci_driver = {
         .name           = "aic7xxx",
         .probe          = ahc_linux_pci_dev_probe,
         .remove         = ahc_linux_pci_dev_remove,
diff --git a/drivers/scsi/aic7xxx/aic7xxx_pci.c b/drivers/scsi/aic7xxx/aic7xxx_pci.c
index 63cab2d74552..09c8172c9e5e 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_pci.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_pci.c
@@ -168,7 +168,7 @@ static ahc_device_setup_t ahc_aha394XX_setup;
 static ahc_device_setup_t ahc_aha494XX_setup;
 static ahc_device_setup_t ahc_aha398XX_setup;
 
-struct ahc_pci_identity ahc_pci_ident_table [] =
+static struct ahc_pci_identity ahc_pci_ident_table [] =
 {
         /* aic7850 based controllers */
         {
@@ -559,7 +559,7 @@ struct ahc_pci_identity ahc_pci_ident_table [] =
         }
 };
 
-const u_int ahc_num_pci_devs = ARRAY_SIZE(ahc_pci_ident_table);
+static const u_int ahc_num_pci_devs = ARRAY_SIZE(ahc_pci_ident_table);
                 
 #define AHC_394X_SLOT_CHANNEL_A 4
 #define AHC_394X_SLOT_CHANNEL_B 5
diff --git a/drivers/scsi/aic7xxx/aic7xxx_proc.c b/drivers/scsi/aic7xxx/aic7xxx_proc.c
index 5914b4aa4a8f..99e5443e7535 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_proc.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_proc.c
@@ -182,7 +182,6 @@ ahc_dump_target_state(struct ahc_softc *ahc, struct info_str *info,
                       u_int our_id, char channel, u_int target_id,
                       u_int target_offset)
 {
-        struct  ahc_linux_target *targ;
         struct  scsi_target *starget;
         struct  ahc_initiator_tinfo *tinfo;
         struct  ahc_tmode_tstate *tstate;
@@ -198,7 +197,6 @@ ahc_dump_target_state(struct ahc_softc *ahc, struct info_str *info,
         starget = ahc->platform_data->starget[target_offset];
         if (!starget)
                 return;
-        targ = scsi_transport_target_data(starget);
 
         copy_info(info, "\tGoal: ");
         ahc_format_transinfo(info, &tinfo->goal);
@@ -208,7 +206,7 @@ ahc_dump_target_state(struct ahc_softc *ahc, struct info_str *info,
         for (lun = 0; lun < AHC_NUM_LUNS; lun++) {
                 struct scsi_device *sdev;
 
-                sdev = targ->sdev[lun];
+                sdev = scsi_device_lookup_by_target(starget, lun);
 
                 if (sdev == NULL)
                         continue;
@@ -383,11 +381,11 @@ ahc_linux_proc_info(struct Scsi_Host *shost, char *buffer, char **start,
         }
         copy_info(&info, "\n");
 
-        max_targ = 15;
+        max_targ = 16;
         if ((ahc->features & (AHC_WIDE|AHC_TWIN)) == 0)
-                max_targ = 7;
+                max_targ = 8;
 
-        for (i = 0; i <= max_targ; i++) {
+        for (i = 0; i < max_targ; i++) {
                 u_int our_id;
                 u_int target_id;
                 char channel;
diff --git a/drivers/scsi/aic7xxx_old.c b/drivers/scsi/aic7xxx_old.c
index bcd7fffab907..46eed10b25d9 100644
--- a/drivers/scsi/aic7xxx_old.c
+++ b/drivers/scsi/aic7xxx_old.c
@@ -2646,7 +2646,7 @@ static void aic7xxx_done_cmds_complete(struct aic7xxx_host *p)
 
         while (p->completeq.head != NULL) {
                 cmd = p->completeq.head;
-                p->completeq.head = (struct scsi_Cmnd *) cmd->host_scribble;
+                p->completeq.head = (struct scsi_cmnd *) cmd->host_scribble;
                 cmd->host_scribble = NULL;
                 cmd->scsi_done(cmd);
         }
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.c b/drivers/scsi/aic94xx/aic94xx_hwi.c
index 3c2d7a379931..af7e01134364 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.c
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.c
@@ -112,6 +112,21 @@ static int asd_init_phy(struct asd_phy *phy)
         return 0;
 }
 
+static void asd_init_ports(struct asd_ha_struct *asd_ha)
+{
+        int i;
+
+        spin_lock_init(&asd_ha->asd_ports_lock);
+        for (i = 0; i < ASD_MAX_PHYS; i++) {
+                struct asd_port *asd_port = &asd_ha->asd_ports[i];
+
+                memset(asd_port->sas_addr, 0, SAS_ADDR_SIZE);
+                memset(asd_port->attached_sas_addr, 0, SAS_ADDR_SIZE);
+                asd_port->phy_mask = 0;
+                asd_port->num_phys = 0;
+        }
+}
+
 static int asd_init_phys(struct asd_ha_struct *asd_ha)
 {
         u8 i;
@@ -121,6 +136,7 @@ static int asd_init_phys(struct asd_ha_struct *asd_ha)
                 struct asd_phy *phy = &asd_ha->phys[i];
 
                 phy->phy_desc = &asd_ha->hw_prof.phy_desc[i];
+                phy->asd_port = NULL;
 
                 phy->sas_phy.enabled = 0;
                 phy->sas_phy.id = i;
@@ -658,6 +674,8 @@ int asd_init_hw(struct asd_ha_struct *asd_ha)
                 goto Out;
         }
 
+        asd_init_ports(asd_ha);
+
         err = asd_init_scbs(asd_ha);
         if (err) {
                 asd_printk("couldn't initialize scbs for %s\n",
diff --git a/drivers/scsi/aic94xx/aic94xx_hwi.h b/drivers/scsi/aic94xx/aic94xx_hwi.h
index 14319d1d6804..c6c3d18222fa 100644
--- a/drivers/scsi/aic94xx/aic94xx_hwi.h
+++ b/drivers/scsi/aic94xx/aic94xx_hwi.h
@@ -46,6 +46,7 @@
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR10 0x410
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR12 0x412
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR1E 0x41E
+#define PCI_DEVICE_ID_ADAPTEC2_RAZOR1F 0x41F
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR30 0x430
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR32 0x432
 #define PCI_DEVICE_ID_ADAPTEC2_RAZOR3E 0x43E
@@ -192,6 +193,16 @@ struct asd_seq_data {
         struct asd_ascb **escb_arr; /* array of pointers to escbs */
 };
 
+/* This is an internal port structure. These are used to get accurate
+ * phy_mask for updating DDB 0.
+ */
+struct asd_port {
+        u8  sas_addr[SAS_ADDR_SIZE];
+        u8  attached_sas_addr[SAS_ADDR_SIZE];
+        u32 phy_mask;
+        int num_phys;
+};
+
 /* This is the Host Adapter structure.  It describes the hardware
  * SAS adapter.
  */
@@ -210,6 +221,8 @@ struct asd_ha_struct {
         struct hw_profile hw_prof;
 
         struct asd_phy    phys[ASD_MAX_PHYS];
+        spinlock_t        asd_ports_lock;
+        struct asd_port   asd_ports[ASD_MAX_PHYS];
         struct asd_sas_port   ports[ASD_MAX_PHYS];
 
         struct dma_pool  *scb_pool;
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index 3a5bbba3976e..42302ef05ee5 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -795,8 +795,6 @@ static void asd_remove_driver_attrs(struct device_driver *driver)
 }
 
 static struct sas_domain_function_template aic94xx_transport_functions = {
-        .lldd_port_formed       = asd_update_port_links,
-
         .lldd_dev_found         = asd_dev_found,
         .lldd_dev_gone          = asd_dev_gone,
 
@@ -823,6 +821,8 @@ static const struct pci_device_id aic94xx_pci_table[] __devinitdata = {
          0, 0, 1},
         {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, PCI_DEVICE_ID_ADAPTEC2_RAZOR1E),
          0, 0, 1},
+        {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, PCI_DEVICE_ID_ADAPTEC2_RAZOR1F),
+         0, 0, 1},
         {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, PCI_DEVICE_ID_ADAPTEC2_RAZOR30),
          0, 0, 2},
         {PCI_DEVICE(PCI_VENDOR_ID_ADAPTEC2, PCI_DEVICE_ID_ADAPTEC2_RAZOR32),
diff --git a/drivers/scsi/aic94xx/aic94xx_sas.h b/drivers/scsi/aic94xx/aic94xx_sas.h
index 64d231712345..9050e93bfd5e 100644
--- a/drivers/scsi/aic94xx/aic94xx_sas.h
+++ b/drivers/scsi/aic94xx/aic94xx_sas.h
@@ -733,6 +733,7 @@ struct asd_phy {
 
         struct sas_identify_frame *identify_frame;
         struct asd_dma_tok  *id_frm_tok;
+        struct asd_port     *asd_port;
 
         u8         frame_rcvd[ASD_EDB_SIZE];
 };
diff --git a/drivers/scsi/aic94xx/aic94xx_scb.c b/drivers/scsi/aic94xx/aic94xx_scb.c
index 52c6ea4fbf71..14d5d8c2ee13 100644
--- a/drivers/scsi/aic94xx/aic94xx_scb.c
+++ b/drivers/scsi/aic94xx/aic94xx_scb.c
@@ -169,6 +169,70 @@ static inline void asd_get_attached_sas_addr(struct asd_phy *phy, u8 *sas_addr)
         }
 }
 
+static void asd_form_port(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
+{
+        int i;
+        struct asd_port *free_port = NULL;
+        struct asd_port *port;
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+        unsigned long flags;
+
+        spin_lock_irqsave(&asd_ha->asd_ports_lock, flags);
+        if (!phy->asd_port) {
+                for (i = 0; i < ASD_MAX_PHYS; i++) {
+                        port = &asd_ha->asd_ports[i];
+
+                        /* Check for wide port */
+                        if (port->num_phys > 0 &&
+                            memcmp(port->sas_addr, sas_phy->sas_addr,
+                                   SAS_ADDR_SIZE) == 0 &&
+                            memcmp(port->attached_sas_addr,
+                                   sas_phy->attached_sas_addr,
+                                   SAS_ADDR_SIZE) == 0) {
+                                break;
+                        }
+
+                        /* Find a free port */
+                        if (port->num_phys == 0 && free_port == NULL) {
+                                free_port = port;
+                        }
+                }
+
+                /* Use a free port if this doesn't form a wide port */
+                if (i >= ASD_MAX_PHYS) {
+                        port = free_port;
+                        BUG_ON(!port);
+                        memcpy(port->sas_addr, sas_phy->sas_addr,
+                               SAS_ADDR_SIZE);
+                        memcpy(port->attached_sas_addr,
+                               sas_phy->attached_sas_addr,
+                               SAS_ADDR_SIZE);
+                }
+                port->num_phys++;
+                port->phy_mask |= (1U << sas_phy->id);
+                phy->asd_port = port;
+        }
+        ASD_DPRINTK("%s: updating phy_mask 0x%x for phy%d\n",
+                    __FUNCTION__, phy->asd_port->phy_mask, sas_phy->id);
+        asd_update_port_links(asd_ha, phy);
+        spin_unlock_irqrestore(&asd_ha->asd_ports_lock, flags);
+}
+
+static void asd_deform_port(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
+{
+        struct asd_port *port = phy->asd_port;
+        struct asd_sas_phy *sas_phy = &phy->sas_phy;
+        unsigned long flags;
+
+        spin_lock_irqsave(&asd_ha->asd_ports_lock, flags);
+        if (port) {
+                port->num_phys--;
+                port->phy_mask &= ~(1U << sas_phy->id);
+                phy->asd_port = NULL;
+        }
+        spin_unlock_irqrestore(&asd_ha->asd_ports_lock, flags);
+}
+
 static inline void asd_bytes_dmaed_tasklet(struct asd_ascb *ascb,
                                            struct done_list_struct *dl,
                                            int edb_id, int phy_id)
@@ -188,6 +252,7 @@ static inline void asd_bytes_dmaed_tasklet(struct asd_ascb *ascb,
         asd_get_attached_sas_addr(phy, phy->sas_phy.attached_sas_addr);
         spin_unlock_irqrestore(&phy->sas_phy.frame_rcvd_lock, flags);
         asd_dump_frame_rcvd(phy, dl);
+        asd_form_port(ascb->ha, phy);
         sas_ha->notify_port_event(&phy->sas_phy, PORTE_BYTES_DMAED);
 }
 
@@ -198,6 +263,7 @@ static inline void asd_link_reset_err_tasklet(struct asd_ascb *ascb,
         struct asd_ha_struct *asd_ha = ascb->ha;
         struct sas_ha_struct *sas_ha = &asd_ha->sas_ha;
         struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+        struct asd_phy *phy = &asd_ha->phys[phy_id];
         u8 lr_error = dl->status_block[1];
         u8 retries_left = dl->status_block[2];
 
@@ -222,6 +288,7 @@ static inline void asd_link_reset_err_tasklet(struct asd_ascb *ascb,
 
         asd_turn_led(asd_ha, phy_id, 0);
         sas_phy_disconnected(sas_phy);
+        asd_deform_port(asd_ha, phy);
         sas_ha->notify_port_event(sas_phy, PORTE_LINK_RESET_ERR);
 
         if (retries_left == 0) {
@@ -249,6 +316,8 @@ static inline void asd_primitive_rcvd_tasklet(struct asd_ascb *ascb,
         unsigned long flags;
         struct sas_ha_struct *sas_ha = &ascb->ha->sas_ha;
         struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+        struct asd_ha_struct *asd_ha = ascb->ha;
+        struct asd_phy *phy = &asd_ha->phys[phy_id];
         u8  reg  = dl->status_block[1];
         u32 cont = dl->status_block[2] << ((reg & 3)*8);
 
@@ -285,6 +354,7 @@ static inline void asd_primitive_rcvd_tasklet(struct asd_ascb *ascb,
                                     phy_id);
                         /* The sequencer disables all phys on that port.
                          * We have to re-enable the phys ourselves. */
+                        asd_deform_port(asd_ha, phy);
                         sas_ha->notify_port_event(sas_phy, PORTE_HARD_RESET);
                         break;
 
@@ -385,6 +455,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
         u8  sb_opcode = dl->status_block[0];
         int phy_id = sb_opcode & DL_PHY_MASK;
         struct asd_sas_phy *sas_phy = sas_ha->sas_phy[phy_id];
+        struct asd_phy *phy = &asd_ha->phys[phy_id];
 
         if (edb > 6 || edb < 0) {
                 ASD_DPRINTK("edb is 0x%x! dl->opcode is 0x%x\n",
@@ -497,6 +568,7 @@ static void escb_tasklet_complete(struct asd_ascb *ascb,
                 asd_turn_led(asd_ha, phy_id, 0);
                 /* the device is gone */
                 sas_phy_disconnected(sas_phy);
+                asd_deform_port(asd_ha, phy);
                 sas_ha->notify_port_event(sas_phy, PORTE_TIMER_EVENT);
                 break;
         default:
diff --git a/drivers/scsi/aic94xx/aic94xx_sds.c b/drivers/scsi/aic94xx/aic94xx_sds.c
index 83574b5b4e69..de7c04d4254d 100644
--- a/drivers/scsi/aic94xx/aic94xx_sds.c
+++ b/drivers/scsi/aic94xx/aic94xx_sds.c
@@ -630,10 +630,6 @@ static int asd_flash_getid(struct asd_ha_struct *asd_ha)
 
         reg = asd_read_reg_dword(asd_ha, EXSICNFGR);
 
-        if (!(reg & FLASHEX)) {
-                ASD_DPRINTK("flash doesn't exist\n");
-                return -ENOENT;
-        }
         if (pci_read_config_dword(asd_ha->pcidev, PCI_CONF_FLSH_BAR,
                                   &asd_ha->hw_prof.flash.bar)) {
                 asd_printk("couldn't read PCI_CONF_FLSH_BAR of %s\n",
diff --git a/drivers/scsi/aic94xx/aic94xx_seq.c b/drivers/scsi/aic94xx/aic94xx_seq.c
index 56e4b3ba6a08..845112539d05 100644
--- a/drivers/scsi/aic94xx/aic94xx_seq.c
+++ b/drivers/scsi/aic94xx/aic94xx_seq.c
@@ -1369,10 +1369,9 @@ int asd_start_seqs(struct asd_ha_struct *asd_ha)
  * port_map_by_links is also used as the conn_mask byte in the
  * initiator/target port DDB.
  */
-void asd_update_port_links(struct asd_sas_phy *sas_phy)
+void asd_update_port_links(struct asd_ha_struct *asd_ha, struct asd_phy *phy)
 {
-        struct asd_ha_struct *asd_ha = sas_phy->ha->lldd_ha;
-        const u8 phy_mask = (u8) sas_phy->port->phy_mask;
+        const u8 phy_mask = (u8) phy->asd_port->phy_mask;
         u8  phy_is_up;
         u8  mask;
         int i, err;
diff --git a/drivers/scsi/aic94xx/aic94xx_seq.h b/drivers/scsi/aic94xx/aic94xx_seq.h
index 42281c36153b..9e715e5496af 100644
--- a/drivers/scsi/aic94xx/aic94xx_seq.h
+++ b/drivers/scsi/aic94xx/aic94xx_seq.h
@@ -64,7 +64,7 @@ int asd_unpause_lseq(struct asd_ha_struct *asd_ha, u8 lseq_mask);
 int asd_init_seqs(struct asd_ha_struct *asd_ha);
 int asd_start_seqs(struct asd_ha_struct *asd_ha);
 
-void asd_update_port_links(struct asd_sas_phy *phy);
+void asd_update_port_links(struct asd_ha_struct *asd_ha, struct asd_phy *phy);
 #endif
 
 #endif
diff --git a/drivers/scsi/dpt/dpti_i2o.h b/drivers/scsi/dpt/dpti_i2o.h
index b3fa7ed71faf..5a49216fe4cf 100644
--- a/drivers/scsi/dpt/dpti_i2o.h
+++ b/drivers/scsi/dpt/dpti_i2o.h
@@ -49,7 +49,7 @@
 
 #include <linux/wait.h>
 typedef wait_queue_head_t adpt_wait_queue_head_t;
-#define ADPT_DECLARE_WAIT_QUEUE_HEAD(wait) DECLARE_WAIT_QUEUE_HEAD(wait)
+#define ADPT_DECLARE_WAIT_QUEUE_HEAD(wait) DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait)
 typedef wait_queue_t adpt_wait_queue_t;
 
 /*
diff --git a/drivers/scsi/dtc.c b/drivers/scsi/dtc.c
index 0d5713dfa204..54756722dd5f 100644
--- a/drivers/scsi/dtc.c
+++ b/drivers/scsi/dtc.c
@@ -82,7 +82,7 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include "scsi.h"
 #include <scsi/scsi_host.h>
 #include "dtc.h"
diff --git a/drivers/scsi/eata_pio.c b/drivers/scsi/eata_pio.c
index 811d8840707e..2dbb66d2f0a7 100644
--- a/drivers/scsi/eata_pio.c
+++ b/drivers/scsi/eata_pio.c
@@ -203,7 +203,7 @@ static irqreturn_t do_eata_pio_int_handler(int irq, void *dev_id)
         irqreturn_t ret;
 
         spin_lock_irqsave(dev->host_lock, flags);
-        ret = eata_pio_int_handler(irq, dev_id, regs);
+        ret = eata_pio_int_handler(irq, dev_id);
         spin_unlock_irqrestore(dev->host_lock, flags);
         return ret;
 }
diff --git a/drivers/scsi/fdomain.c b/drivers/scsi/fdomain.c
index 41b05fc45380..5d4ea6f77953 100644
--- a/drivers/scsi/fdomain.c
+++ b/drivers/scsi/fdomain.c
@@ -278,9 +278,9 @@
 #include <linux/pci.h>
 #include <linux/stat.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <scsi/scsicam.h>
 
-#include <asm/io.h>
 #include <asm/system.h>
 
 #include <scsi/scsi.h>
@@ -387,6 +387,7 @@ static void __iomem *    bios_mem;
 static int               bios_major;
 static int               bios_minor;
 static int               PCI_bus;
+static struct pci_dev   *PCI_dev;
 static int               Quantum;       /* Quantum board variant */
 static int               interrupt_level;
 static volatile int      in_command;
@@ -812,9 +813,10 @@ static int fdomain_pci_bios_detect( int *irq, int *iobase, struct pci_dev **ret_
            PCI_DEVICE_ID_FD_36C70 );
 #endif 
 
-   if ((pdev = pci_find_device(PCI_VENDOR_ID_FD, PCI_DEVICE_ID_FD_36C70, pdev)) == NULL)
+   if ((pdev = pci_get_device(PCI_VENDOR_ID_FD, PCI_DEVICE_ID_FD_36C70, pdev)) == NULL)
                 return 0;
-   if (pci_enable_device(pdev)) return 0;
+   if (pci_enable_device(pdev))
+        goto fail;
        
 #if DEBUG_DETECT
    printk( "scsi: <fdomain> TMC-3260 detect:"
@@ -831,7 +833,7 @@ static int fdomain_pci_bios_detect( int *irq, int *iobase, struct pci_dev **ret_
    pci_irq = pdev->irq;
 
    if (!request_region( pci_base, 0x10, "fdomain" ))
-        return 0;
+        goto fail;
 
    /* Now we have the I/O base address and interrupt from the PCI
       configuration registers. */
@@ -848,17 +850,22 @@ static int fdomain_pci_bios_detect( int *irq, int *iobase, struct pci_dev **ret_
    if (!fdomain_is_valid_port(pci_base)) {
       printk(KERN_ERR "scsi: <fdomain> PCI card detected, but driver not loaded (invalid port)\n" );
       release_region(pci_base, 0x10);
-      return 0;
+      goto fail;
    }
 
                                 /* Fill in a few global variables.  Ugh. */
    bios_major = bios_minor = -1;
    PCI_bus    = 1;
+   PCI_dev    = pdev;
    Quantum    = 0;
    bios_base  = 0;
    
    return 1;
+fail:
+   pci_dev_put(pdev);
+   return 0;
 }
+
 #endif
 
 struct Scsi_Host *__fdomain_16x0_detect(struct scsi_host_template *tpnt )
@@ -909,8 +916,7 @@ struct Scsi_Host *__fdomain_16x0_detect(struct scsi_host_template *tpnt )
       if (setup_called) {
          printk(KERN_ERR "scsi: <fdomain> Bad LILO/INSMOD parameters?\n");
       }
-      release_region(port_base, 0x10);
-      return NULL;
+      goto fail;
    }
 
    if (this_id) {
@@ -942,8 +948,7 @@ struct Scsi_Host *__fdomain_16x0_detect(struct scsi_host_template *tpnt )
    /* Log IRQ with kernel */   
    if (!interrupt_level) {
       printk(KERN_ERR "scsi: <fdomain> Card Detected, but driver not loaded (no IRQ)\n" );
-      release_region(port_base, 0x10);
-      return NULL;
+      goto fail;
    } else {
       /* Register the IRQ with the kernel */
 
@@ -964,11 +969,14 @@ struct Scsi_Host *__fdomain_16x0_detect(struct scsi_host_template *tpnt )
             printk(KERN_ERR "                Send mail to faith@acm.org\n" );
          }
          printk(KERN_ERR "scsi: <fdomain> Detected, but driver not loaded (IRQ)\n" );
-         release_region(port_base, 0x10);
-         return NULL;
+         goto fail;
       }
    }
    return shpnt;
+fail:
+   pci_dev_put(pdev);
+   release_region(port_base, 0x10);
+   return NULL;
 }
 
 static int fdomain_16x0_detect(struct scsi_host_template *tpnt)
@@ -1714,6 +1722,8 @@ static int fdomain_16x0_release(struct Scsi_Host *shpnt)
                 free_irq(shpnt->irq, shpnt);
         if (shpnt->io_port && shpnt->n_io_port)
                 release_region(shpnt->io_port, shpnt->n_io_port);
+        if (PCI_bus)
+                pci_dev_put(PCI_dev);
         return 0;
 }
 
@@ -1736,6 +1746,15 @@ struct scsi_host_template fdomain_driver_template = {
 };
 
 #ifndef PCMCIA
+
+static struct pci_device_id fdomain_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_FD, PCI_DEVICE_ID_FD_36C70,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0UL },
+        { }
+};
+MODULE_DEVICE_TABLE(pci, fdomain_pci_tbl);
+
 #define driver_template fdomain_driver_template
 #include "scsi_module.c"
+
 #endif
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 4bc14ad92e22..4c698a71f66f 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -3531,7 +3531,7 @@ static irqreturn_t gdth_interrupt(int irq,void *dev_id)
                 IStatus &= ~0x80;
 #ifdef INT_COAL
                 if (coalesced)
-                    ha->status = pcs->ext_status && 0xffff;
+                    ha->status = pcs->ext_status & 0xffff;
                 else 
 #endif
                     ha->status = gdth_readw(&dp6m_ptr->i960r.status);
@@ -3543,7 +3543,7 @@ static irqreturn_t gdth_interrupt(int irq,void *dev_id)
             if (coalesced) {    
                 ha->info = pcs->info0;
                 ha->info2 = pcs->info1;
-                ha->service = (pcs->ext_status >> 16) && 0xffff;
+                ha->service = (pcs->ext_status >> 16) & 0xffff;
             } else
 #endif
             {
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 669ea4fff166..fbc1d5c3b0a7 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1213,7 +1213,7 @@ void ibmvscsi_handle_crq(struct viosrp_crq *crq,
                                "ibmvscsi: Re-enabling adapter!\n");
                         purge_requests(hostdata, DID_REQUEUE);
                         if ((ibmvscsi_reenable_crq_queue(&hostdata->queue,
-                                                        hostdata) == 0) ||
+                                                        hostdata)) ||
                             (ibmvscsi_send_crq(hostdata,
                                                0xC001000000000000LL, 0))) {
                                         atomic_set(&hostdata->request_limit,
diff --git a/drivers/scsi/imm.c b/drivers/scsi/imm.c
index 2d95ac9c32c1..e31f6122106f 100644
--- a/drivers/scsi/imm.c
+++ b/drivers/scsi/imm.c
@@ -1153,7 +1153,7 @@ static int __imm_attach(struct parport *pb)
 {
         struct Scsi_Host *host;
         imm_struct *dev;
-        DECLARE_WAIT_QUEUE_HEAD(waiting);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waiting);
         DEFINE_WAIT(wait);
         int ports;
         int modes, ppb;
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index 911f2ff4a1f2..afed293dd7b9 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -142,8 +142,6 @@
 #define i91u_MAXQUEUE           2
 #define i91u_REVID "Initio INI-9X00U/UW SCSI device driver; Revision: 1.04a"
 
-#define INI_VENDOR_ID   0x1101  /* Initio's PCI vendor ID       */
-#define DMX_VENDOR_ID   0x134a  /* Domex's PCI vendor ID        */
 #define I950_DEVICE_ID  0x9500  /* Initio's inic-950 product ID   */
 #define I940_DEVICE_ID  0x9400  /* Initio's inic-940 product ID   */
 #define I935_DEVICE_ID  0x9401  /* Initio's inic-935 product ID   */
@@ -171,13 +169,16 @@ static int setup_debug = 0;
 
 static void i91uSCBPost(BYTE * pHcb, BYTE * pScb);
 
-static const PCI_ID i91u_pci_devices[] = {
-        { INI_VENDOR_ID, I950_DEVICE_ID },
-        { INI_VENDOR_ID, I940_DEVICE_ID },
-        { INI_VENDOR_ID, I935_DEVICE_ID },
-        { INI_VENDOR_ID, I920_DEVICE_ID },
-        { DMX_VENDOR_ID, I920_DEVICE_ID },
+/* PCI Devices supported by this driver */
+static struct pci_device_id i91u_pci_devices[] __devinitdata = {
+        { PCI_VENDOR_ID_INIT,  I950_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_INIT,  I940_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_INIT,  I935_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_INIT,  I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { PCI_VENDOR_ID_DOMEX, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { }
 };
+MODULE_DEVICE_TABLE(pci, i91u_pci_devices);
 
 #define DEBUG_INTERRUPT 0
 #define DEBUG_QUEUE     0
@@ -2771,7 +2772,7 @@ static int tul_NewReturnNumberOfAdapters(void)
 
         for (i = 0; i < ARRAY_SIZE(i91u_pci_devices); i++)
         {
-                while ((pDev = pci_find_device(i91u_pci_devices[i].vendor_id, i91u_pci_devices[i].device_id, pDev)) != NULL) {
+                while ((pDev = pci_find_device(i91u_pci_devices[i].vendor, i91u_pci_devices[i].device, pDev)) != NULL) {
                         if (pci_enable_device(pDev))
                                 continue;
                         pci_read_config_dword(pDev, 0x44, (u32 *) & dRegValue);
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 0a9dbc59663f..d0b139cccbbc 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -415,8 +415,8 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         iscsi_solicit_data_init(conn, ctask, r2t);
 
         tcp_ctask->exp_r2tsn = r2tsn + 1;
-        tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
         __kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
+        tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
         list_move_tail(&ctask->running, &conn->xmitqueue);
 
         scsi_queue_work(session->host, &conn->xmitwork);
@@ -1627,9 +1627,12 @@ static int iscsi_send_sol_pdu(struct iscsi_conn *conn,
         if (tcp_ctask->xmstate & XMSTATE_SOL_HDR) {
                 tcp_ctask->xmstate &= ~XMSTATE_SOL_HDR;
                 tcp_ctask->xmstate |= XMSTATE_SOL_DATA;
-                if (!tcp_ctask->r2t)
+                if (!tcp_ctask->r2t) {
+                        spin_lock_bh(&session->lock);
                         __kfifo_get(tcp_ctask->r2tqueue, (void*)&tcp_ctask->r2t,
                                     sizeof(void*));
+                        spin_unlock_bh(&session->lock);
+                }
 send_hdr:
                 r2t = tcp_ctask->r2t;
                 dtask = &r2t->dtask;
@@ -1816,21 +1819,14 @@ iscsi_tcp_conn_destroy(struct iscsi_cls_conn *cls_conn)
 {
         struct iscsi_conn *conn = cls_conn->dd_data;
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
-        int digest = 0;
-
-        if (conn->hdrdgst_en || conn->datadgst_en)
-                digest = 1;
 
         iscsi_tcp_release_conn(conn);
         iscsi_conn_teardown(cls_conn);
 
-        /* now free tcp_conn */
-        if (digest) {
-                if (tcp_conn->tx_hash.tfm)
-                        crypto_free_hash(tcp_conn->tx_hash.tfm);
-                if (tcp_conn->rx_hash.tfm)
-                        crypto_free_hash(tcp_conn->rx_hash.tfm);
-        }
+        if (tcp_conn->tx_hash.tfm)
+                crypto_free_hash(tcp_conn->tx_hash.tfm);
+        if (tcp_conn->rx_hash.tfm)
+                crypto_free_hash(tcp_conn->rx_hash.tfm);
 
         kfree(tcp_conn);
 }
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index c542d0e95e68..5d8862189485 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -481,8 +481,8 @@ int __iscsi_complete_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
                         break;
                 case ISCSI_OP_ASYNC_EVENT:
                         conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1;
-                        /* we need sth like iscsi_async_event_rsp() */
-                        rc = ISCSI_ERR_BAD_OPCODE;
+                        if (iscsi_recv_pdu(conn->cls_conn, hdr, data, datalen))
+                                rc = ISCSI_ERR_CONN_FAILED;
                         break;
                 default:
                         rc = ISCSI_ERR_BAD_OPCODE;
@@ -578,6 +578,27 @@ void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err)
 }
 EXPORT_SYMBOL_GPL(iscsi_conn_failure);
 
+static int iscsi_xmit_imm_task(struct iscsi_conn *conn)
+{
+        struct iscsi_hdr *hdr = conn->mtask->hdr;
+        int rc, was_logout = 0;
+
+        if ((hdr->opcode & ISCSI_OPCODE_MASK) == ISCSI_OP_LOGOUT) {
+                conn->session->state = ISCSI_STATE_IN_RECOVERY;
+                iscsi_block_session(session_to_cls(conn->session));
+                was_logout = 1;
+        }
+        rc = conn->session->tt->xmit_mgmt_task(conn, conn->mtask);
+        if (rc)
+                return rc;
+
+        if (was_logout) {
+                set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx);
+                return -ENODATA;
+        }
+        return 0;
+}
+
 /**
  * iscsi_data_xmit - xmit any command into the scheduled connection
  * @conn: iscsi connection
@@ -623,7 +644,7 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
                 conn->ctask = NULL;
         }
         if (conn->mtask) {
-                rc = tt->xmit_mgmt_task(conn, conn->mtask);
+                rc = iscsi_xmit_imm_task(conn);
                 if (rc)
                         goto again;
                 /* done with this in-progress mtask */
@@ -638,7 +659,7 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
                         list_add_tail(&conn->mtask->running,
                                       &conn->mgmt_run_list);
                         spin_unlock_bh(&conn->session->lock);
-                        rc = tt->xmit_mgmt_task(conn, conn->mtask);
+                        rc = iscsi_xmit_imm_task(conn);
                         if (rc)
                                 goto again;
                 }
@@ -661,8 +682,6 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
                 spin_unlock_bh(&conn->session->lock);
 
                 rc = tt->xmit_cmd_task(conn, conn->ctask);
-                if (rc)
-                        goto again;
 
                 spin_lock_bh(&conn->session->lock);
                 __iscsi_put_ctask(conn->ctask);
@@ -778,6 +797,10 @@ int iscsi_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
         }
 
         conn = session->leadconn;
+        if (!conn) {
+                reason = FAILURE_SESSION_FREED;
+                goto fault;
+        }
 
         if (!__kfifo_get(session->cmdpool.queue, (void*)&ctask,
                          sizeof(void*))) {
@@ -952,13 +975,13 @@ int iscsi_eh_host_reset(struct scsi_cmnd *sc)
         if (session->state == ISCSI_STATE_TERMINATE) {
 failed:
                 debug_scsi("failing host reset: session terminated "
-                           "[CID %d age %d]", conn->id, session->age);
+                           "[CID %d age %d]\n", conn->id, session->age);
                 spin_unlock_bh(&session->lock);
                 return FAILED;
         }
 
         if (sc->SCp.phase == session->age) {
-                debug_scsi("failing connection CID %d due to SCSI host reset",
+                debug_scsi("failing connection CID %d due to SCSI host reset\n",
                            conn->id);
                 fail_session = 1;
         }
@@ -1031,7 +1054,8 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
                                      NULL, 0);
         if (rc) {
                 iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
-                debug_scsi("abort sent failure [itt 0x%x] %d", ctask->itt, rc);
+                debug_scsi("abort sent failure [itt 0x%x] %d\n", ctask->itt,
+                           rc);
                 return rc;
         }
 
@@ -1048,7 +1072,7 @@ static int iscsi_exec_abort_task(struct scsi_cmnd *sc,
                 conn->tmabort_timer.function = iscsi_tmabort_timedout;
                 conn->tmabort_timer.data = (unsigned long)ctask;
                 add_timer(&conn->tmabort_timer);
-                debug_scsi("abort set timeout [itt 0x%x]", ctask->itt);
+                debug_scsi("abort set timeout [itt 0x%x]\n", ctask->itt);
         }
         spin_unlock_bh(&session->lock);
         mutex_unlock(&conn->xmitmutex);
@@ -1377,7 +1401,6 @@ iscsi_session_setup(struct iscsi_transport *iscsit,
         }
 
         spin_lock_init(&session->lock);
-        INIT_LIST_HEAD(&session->connections);
 
         /* initialize immediate command pool */
         if (iscsi_pool_init(&session->mgmtpool, session->mgmtpool_max,
@@ -1580,16 +1603,11 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
         kfree(conn->persistent_address);
         __kfifo_put(session->mgmtpool.queue, (void*)&conn->login_mtask,
                     sizeof(void*));
-        list_del(&conn->item);
-        if (list_empty(&session->connections))
+        if (session->leadconn == conn) {
                 session->leadconn = NULL;
-        if (session->leadconn && session->leadconn == conn)
-                session->leadconn = container_of(session->connections.next,
-                        struct iscsi_conn, item);
-
-        if (session->leadconn == NULL)
                 /* no connections exits.. reset sequencing */
                 session->cmdsn = session->max_cmdsn = session->exp_cmdsn = 1;
+        }
         spin_unlock_bh(&session->lock);
 
         kfifo_free(conn->immqueue);
@@ -1777,32 +1795,12 @@ int iscsi_conn_bind(struct iscsi_cls_session *cls_session,
                     struct iscsi_cls_conn *cls_conn, int is_leading)
 {
         struct iscsi_session *session = class_to_transport_session(cls_session);
-        struct iscsi_conn *tmp = ERR_PTR(-EEXIST), *conn = cls_conn->dd_data;
+        struct iscsi_conn *conn = cls_conn->dd_data;
 
-        /* lookup for existing connection */
         spin_lock_bh(&session->lock);
-        list_for_each_entry(tmp, &session->connections, item) {
-                if (tmp == conn) {
-                        if (conn->c_stage != ISCSI_CONN_STOPPED ||
-                            conn->stop_stage == STOP_CONN_TERM) {
-                                printk(KERN_ERR "iscsi: can't bind "
-                                       "non-stopped connection (%d:%d)\n",
-                                       conn->c_stage, conn->stop_stage);
-                                spin_unlock_bh(&session->lock);
-                                return -EIO;
-                        }
-                        break;
-                }
-        }
-        if (tmp != conn) {
-                /* bind new iSCSI connection to session */
-                conn->session = session;
-                list_add(&conn->item, &session->connections);
-        }
-        spin_unlock_bh(&session->lock);
-
         if (is_leading)
                 session->leadconn = conn;
+        spin_unlock_bh(&session->lock);
 
         /*
          * Unblock xmitworker(), Login Phase will pass through.
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 30b8014bcc7a..e34a93435497 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -71,55 +71,65 @@ static void smp_task_done(struct sas_task *task)
 static int smp_execute_task(struct domain_device *dev, void *req, int req_size,
                             void *resp, int resp_size)
 {
-        int res;
-        struct sas_task *task = sas_alloc_task(GFP_KERNEL);
+        int res, retry;
+        struct sas_task *task = NULL;
         struct sas_internal *i =
                 to_sas_internal(dev->port->ha->core.shost->transportt);
 
-        if (!task)
-                return -ENOMEM;
-
-        task->dev = dev;
-        task->task_proto = dev->tproto;
-        sg_init_one(&task->smp_task.smp_req, req, req_size);
-        sg_init_one(&task->smp_task.smp_resp, resp, resp_size);
+        for (retry = 0; retry < 3; retry++) {
+                task = sas_alloc_task(GFP_KERNEL);
+                if (!task)
+                        return -ENOMEM;
 
-        task->task_done = smp_task_done;
+                task->dev = dev;
+                task->task_proto = dev->tproto;
+                sg_init_one(&task->smp_task.smp_req, req, req_size);
+                sg_init_one(&task->smp_task.smp_resp, resp, resp_size);
 
-        task->timer.data = (unsigned long) task;
-        task->timer.function = smp_task_timedout;
-        task->timer.expires = jiffies + SMP_TIMEOUT*HZ;
-        add_timer(&task->timer);
+                task->task_done = smp_task_done;
 
-        res = i->dft->lldd_execute_task(task, 1, GFP_KERNEL);
+                task->timer.data = (unsigned long) task;
+                task->timer.function = smp_task_timedout;
+                task->timer.expires = jiffies + SMP_TIMEOUT*HZ;
+                add_timer(&task->timer);
 
-        if (res) {
-                del_timer(&task->timer);
-                SAS_DPRINTK("executing SMP task failed:%d\n", res);
-                goto ex_err;
-        }
+                res = i->dft->lldd_execute_task(task, 1, GFP_KERNEL);
 
-        wait_for_completion(&task->completion);
-        res = -ETASK;
-        if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
-                SAS_DPRINTK("smp task timed out or aborted\n");
-                i->dft->lldd_abort_task(task);
-                if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
-                        SAS_DPRINTK("SMP task aborted and not done\n");
+                if (res) {
+                        del_timer(&task->timer);
+                        SAS_DPRINTK("executing SMP task failed:%d\n", res);
                         goto ex_err;
                 }
+
+                wait_for_completion(&task->completion);
+                res = -ETASK;
+                if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+                        SAS_DPRINTK("smp task timed out or aborted\n");
+                        i->dft->lldd_abort_task(task);
+                        if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) {
+                                SAS_DPRINTK("SMP task aborted and not done\n");
+                                goto ex_err;
+                        }
+                }
+                if (task->task_status.resp == SAS_TASK_COMPLETE &&
+                    task->task_status.stat == SAM_GOOD) {
+                        res = 0;
+                        break;
+                } else {
+                        SAS_DPRINTK("%s: task to dev %016llx response: 0x%x "
+                                    "status 0x%x\n", __FUNCTION__,
+                                    SAS_ADDR(dev->sas_addr),
+                                    task->task_status.resp,
+                                    task->task_status.stat);
+                        sas_free_task(task);
+                        task = NULL;
+                }
         }
-        if (task->task_status.resp == SAS_TASK_COMPLETE &&
-            task->task_status.stat == SAM_GOOD)
-                res = 0;
-        else
-                SAS_DPRINTK("%s: task to dev %016llx response: 0x%x "
-                            "status 0x%x\n", __FUNCTION__,
-                            SAS_ADDR(dev->sas_addr),
-                            task->task_status.resp,
-                            task->task_status.stat);
 ex_err:
-        sas_free_task(task);
+        BUG_ON(retry == 3 && task != NULL);
+        if (task != NULL) {
+                sas_free_task(task);
+        }
         return res;
 }
 
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 9496e87c135e..2a4e02e7a392 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -594,7 +594,8 @@ lpfc_soft_wwpn_show(struct class_device *cdev, char *buf)
 {
         struct Scsi_Host *host = class_to_shost(cdev);
         struct lpfc_hba *phba = (struct lpfc_hba*)host->hostdata;
-        return snprintf(buf, PAGE_SIZE, "0x%llx\n", phba->cfg_soft_wwpn);
+        return snprintf(buf, PAGE_SIZE, "0x%llx\n",
+                        (unsigned long long)phba->cfg_soft_wwpn);
 }
 
 
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 1b53afb1cb57..3add7c237859 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -188,7 +188,8 @@ lpfc_alloc_ct_rsp(struct lpfc_hba * phba, int cmdcode, struct ulp_bde64 * bpl,
 
                 if (!mp->virt) {
                         kfree(mp);
-                        lpfc_free_ct_rsp(phba, mlist);
+                        if (mlist)
+                                lpfc_free_ct_rsp(phba, mlist);
                         return NULL;
                 }
 
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index d586c3d3b0d0..19c79a0549a7 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -305,7 +305,7 @@ lpfc_do_work(void *p)
 {
         struct lpfc_hba *phba = p;
         int rc;
-        DECLARE_WAIT_QUEUE_HEAD(work_waitq);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(work_waitq);
 
         set_user_nice(current, -20);
         phba->work_wait = &work_waitq;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 24a1779b9af4..582f5ea4e84e 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -2983,7 +2983,7 @@ lpfc_sli_issue_iocb_wait(struct lpfc_hba * phba,
                          struct lpfc_iocbq * prspiocbq,
                          uint32_t timeout)
 {
-        DECLARE_WAIT_QUEUE_HEAD(done_q);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_q);
         long timeleft, timeout_req = 0;
         int retval = IOCB_SUCCESS;
         uint32_t creg_val;
@@ -3061,7 +3061,7 @@ int
 lpfc_sli_issue_mbox_wait(struct lpfc_hba * phba, LPFC_MBOXQ_t * pmboxq,
                          uint32_t timeout)
 {
-        DECLARE_WAIT_QUEUE_HEAD(done_q);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_q);
         DECLARE_WAITQUEUE(wq_entry, current);
         uint32_t timeleft = 0;
         int retval;
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index c0edb662d863..7bac86dda88f 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -884,7 +884,7 @@ megaraid_init_mbox(adapter_t *adapter)
 
         if (((magic64 == HBA_SIGNATURE_64_BIT) &&
                 ((adapter->pdev->subsystem_device !=
-                PCI_SUBSYS_ID_MEGARAID_SATA_150_6) ||
+                PCI_SUBSYS_ID_MEGARAID_SATA_150_6) &&
                 (adapter->pdev->subsystem_device !=
                 PCI_SUBSYS_ID_MEGARAID_SATA_150_4))) ||
                 (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index b1d346049525..f2d79c3f0b8e 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -183,7 +183,7 @@ static void nsp_cs_dmessage(const char *func, int line, int mask, char *fmt, ...
  * Clenaup parameters and call done() functions.
  * You must be set SCpnt->result before call this function.
  */
-static void nsp_scsi_done(Scsi_Cmnd *SCpnt)
+static void nsp_scsi_done(struct scsi_cmnd *SCpnt)
 {
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
 
@@ -192,7 +192,8 @@ static void nsp_scsi_done(Scsi_Cmnd *SCpnt)
         SCpnt->scsi_done(SCpnt);
 }
 
-static int nsp_queuecommand(Scsi_Cmnd *SCpnt, void (*done)(Scsi_Cmnd *))
+static int nsp_queuecommand(struct scsi_cmnd *SCpnt,
+                            void (*done)(struct scsi_cmnd *))
 {
 #ifdef NSP_DEBUG
         /*unsigned int host_id = SCpnt->device->host->this_id;*/
@@ -365,7 +366,7 @@ static int nsphw_init(nsp_hw_data *data)
 /*
  * Start selection phase
  */
-static int nsphw_start_selection(Scsi_Cmnd *SCpnt)
+static int nsphw_start_selection(struct scsi_cmnd *SCpnt)
 {
         unsigned int  host_id    = SCpnt->device->host->this_id;
         unsigned int  base       = SCpnt->device->host->io_port;
@@ -446,7 +447,7 @@ static struct nsp_sync_table nsp_sync_table_20M[] = {
 /*
  * setup synchronous data transfer mode
  */
-static int nsp_analyze_sdtr(Scsi_Cmnd *SCpnt)
+static int nsp_analyze_sdtr(struct scsi_cmnd *SCpnt)
 {
         unsigned char          target = scmd_id(SCpnt);
 //      unsigned char          lun    = SCpnt->device->lun;
@@ -504,7 +505,7 @@ static int nsp_analyze_sdtr(Scsi_Cmnd *SCpnt)
 /*
  * start ninja hardware timer
  */
-static void nsp_start_timer(Scsi_Cmnd *SCpnt, int time)
+static void nsp_start_timer(struct scsi_cmnd *SCpnt, int time)
 {
         unsigned int base = SCpnt->device->host->io_port;
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
@@ -517,7 +518,8 @@ static void nsp_start_timer(Scsi_Cmnd *SCpnt, int time)
 /*
  * wait for bus phase change
  */
-static int nsp_negate_signal(Scsi_Cmnd *SCpnt, unsigned char mask, char *str)
+static int nsp_negate_signal(struct scsi_cmnd *SCpnt, unsigned char mask,
+                             char *str)
 {
         unsigned int  base = SCpnt->device->host->io_port;
         unsigned char reg;
@@ -544,9 +546,9 @@ static int nsp_negate_signal(Scsi_Cmnd *SCpnt, unsigned char mask, char *str)
 /*
  * expect Ninja Irq
  */
-static int nsp_expect_signal(Scsi_Cmnd     *SCpnt,
-                             unsigned char  current_phase,
-                             unsigned char  mask)
+static int nsp_expect_signal(struct scsi_cmnd *SCpnt,
+                             unsigned char current_phase,
+                             unsigned char mask)
 {
         unsigned int  base       = SCpnt->device->host->io_port;
         int           time_out;
@@ -579,7 +581,7 @@ static int nsp_expect_signal(Scsi_Cmnd	   *SCpnt,
 /*
  * transfer SCSI message
  */
-static int nsp_xfer(Scsi_Cmnd *SCpnt, int phase)
+static int nsp_xfer(struct scsi_cmnd *SCpnt, int phase)
 {
         unsigned int  base = SCpnt->device->host->io_port;
         nsp_hw_data  *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
@@ -619,7 +621,7 @@ static int nsp_xfer(Scsi_Cmnd *SCpnt, int phase)
 /*
  * get extra SCSI data from fifo
  */
-static int nsp_dataphase_bypass(Scsi_Cmnd *SCpnt)
+static int nsp_dataphase_bypass(struct scsi_cmnd *SCpnt)
 {
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
         unsigned int count;
@@ -651,7 +653,7 @@ static int nsp_dataphase_bypass(Scsi_Cmnd *SCpnt)
 /*
  * accept reselection
  */
-static int nsp_reselected(Scsi_Cmnd *SCpnt)
+static int nsp_reselected(struct scsi_cmnd *SCpnt)
 {
         unsigned int  base    = SCpnt->device->host->io_port;
         unsigned int  host_id = SCpnt->device->host->this_id;
@@ -690,7 +692,7 @@ static int nsp_reselected(Scsi_Cmnd *SCpnt)
 /*
  * count how many data transferd
  */
-static int nsp_fifo_count(Scsi_Cmnd *SCpnt)
+static int nsp_fifo_count(struct scsi_cmnd *SCpnt)
 {
         unsigned int base = SCpnt->device->host->io_port;
         unsigned int count;
@@ -717,7 +719,7 @@ static int nsp_fifo_count(Scsi_Cmnd *SCpnt)
 /*
  * read data in DATA IN phase
  */
-static void nsp_pio_read(Scsi_Cmnd *SCpnt)
+static void nsp_pio_read(struct scsi_cmnd *SCpnt)
 {
         unsigned int  base      = SCpnt->device->host->io_port;
         unsigned long mmio_base = SCpnt->device->host->base;
@@ -812,7 +814,7 @@ static void nsp_pio_read(Scsi_Cmnd *SCpnt)
 /*
  * write data in DATA OUT phase
  */
-static void nsp_pio_write(Scsi_Cmnd *SCpnt)
+static void nsp_pio_write(struct scsi_cmnd *SCpnt)
 {
         unsigned int  base      = SCpnt->device->host->io_port;
         unsigned long mmio_base = SCpnt->device->host->base;
@@ -905,7 +907,7 @@ static void nsp_pio_write(Scsi_Cmnd *SCpnt)
 /*
  * setup synchronous/asynchronous data transfer mode
  */
-static int nsp_nexus(Scsi_Cmnd *SCpnt)
+static int nsp_nexus(struct scsi_cmnd *SCpnt)
 {
         unsigned int   base   = SCpnt->device->host->io_port;
         unsigned char  target = scmd_id(SCpnt);
@@ -952,7 +954,7 @@ static irqreturn_t nspintr(int irq, void *dev_id)
 {
         unsigned int   base;
         unsigned char  irq_status, irq_phase, phase;
-        Scsi_Cmnd     *tmpSC;
+        struct scsi_cmnd *tmpSC;
         unsigned char  target, lun;
         unsigned int  *sync_neg;
         int            i, tmp;
@@ -1530,7 +1532,7 @@ nsp_proc_info(
 /*---------------------------------------------------------------*/
 
 /*
-static int nsp_eh_abort(Scsi_Cmnd *SCpnt)
+static int nsp_eh_abort(struct scsi_cmnd *SCpnt)
 {
         nsp_dbg(NSP_DEBUG_BUSRESET, "SCpnt=0x%p", SCpnt);
 
@@ -1558,7 +1560,7 @@ static int nsp_bus_reset(nsp_hw_data *data)
         return SUCCESS;
 }
 
-static int nsp_eh_bus_reset(Scsi_Cmnd *SCpnt)
+static int nsp_eh_bus_reset(struct scsi_cmnd *SCpnt)
 {
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
 
@@ -1567,7 +1569,7 @@ static int nsp_eh_bus_reset(Scsi_Cmnd *SCpnt)
         return nsp_bus_reset(data);
 }
 
-static int nsp_eh_host_reset(Scsi_Cmnd *SCpnt)
+static int nsp_eh_host_reset(struct scsi_cmnd *SCpnt)
 {
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
 
diff --git a/drivers/scsi/pcmcia/nsp_cs.h b/drivers/scsi/pcmcia/nsp_cs.h
index a88714f4c05b..625ca97da52d 100644
--- a/drivers/scsi/pcmcia/nsp_cs.h
+++ b/drivers/scsi/pcmcia/nsp_cs.h
@@ -266,7 +266,7 @@ typedef struct _nsp_hw_data {
 
         int           TimerCount;
         int           SelectionTimeOut;
-        Scsi_Cmnd    *CurrentSC;
+        struct scsi_cmnd *CurrentSC;
         //int           CurrnetTarget;
 
         int           FifoCount;
@@ -319,30 +319,34 @@ static        int        nsp_proc_info  (
                                          int     hostno,
 #endif
                                          int     inout);
-static        int        nsp_queuecommand(Scsi_Cmnd *SCpnt, void (* done)(Scsi_Cmnd *SCpnt));
+static int nsp_queuecommand(struct scsi_cmnd *SCpnt,
+                            void (* done)(struct scsi_cmnd *SCpnt));
 
 /* Error handler */
-/*static int nsp_eh_abort       (Scsi_Cmnd *SCpnt);*/
-/*static int nsp_eh_device_reset(Scsi_Cmnd *SCpnt);*/
-static int nsp_eh_bus_reset    (Scsi_Cmnd *SCpnt);
-static int nsp_eh_host_reset   (Scsi_Cmnd *SCpnt);
+/*static int nsp_eh_abort       (struct scsi_cmnd *SCpnt);*/
+/*static int nsp_eh_device_reset(struct scsi_cmnd *SCpnt);*/
+static int nsp_eh_bus_reset    (struct scsi_cmnd *SCpnt);
+static int nsp_eh_host_reset   (struct scsi_cmnd *SCpnt);
 static int nsp_bus_reset       (nsp_hw_data *data);
 
 /* */
 static int  nsphw_init           (nsp_hw_data *data);
-static int  nsphw_start_selection(Scsi_Cmnd *SCpnt);
-static void nsp_start_timer      (Scsi_Cmnd *SCpnt, int time);
-static int  nsp_fifo_count       (Scsi_Cmnd *SCpnt);
-static void nsp_pio_read         (Scsi_Cmnd *SCpnt);
-static void nsp_pio_write        (Scsi_Cmnd *SCpnt);
-static int  nsp_nexus            (Scsi_Cmnd *SCpnt);
-static void nsp_scsi_done        (Scsi_Cmnd *SCpnt);
-static int  nsp_analyze_sdtr     (Scsi_Cmnd *SCpnt);
-static int  nsp_negate_signal    (Scsi_Cmnd *SCpnt, unsigned char mask, char *str);
-static int  nsp_expect_signal    (Scsi_Cmnd *SCpnt, unsigned char current_phase, unsigned char  mask);
-static int  nsp_xfer             (Scsi_Cmnd *SCpnt, int phase);
-static int  nsp_dataphase_bypass (Scsi_Cmnd *SCpnt);
-static int  nsp_reselected       (Scsi_Cmnd *SCpnt);
+static int  nsphw_start_selection(struct scsi_cmnd *SCpnt);
+static void nsp_start_timer      (struct scsi_cmnd *SCpnt, int time);
+static int  nsp_fifo_count       (struct scsi_cmnd *SCpnt);
+static void nsp_pio_read         (struct scsi_cmnd *SCpnt);
+static void nsp_pio_write        (struct scsi_cmnd *SCpnt);
+static int  nsp_nexus            (struct scsi_cmnd *SCpnt);
+static void nsp_scsi_done        (struct scsi_cmnd *SCpnt);
+static int  nsp_analyze_sdtr     (struct scsi_cmnd *SCpnt);
+static int  nsp_negate_signal    (struct scsi_cmnd *SCpnt,
+                                  unsigned char mask, char *str);
+static int  nsp_expect_signal    (struct scsi_cmnd *SCpnt,
+                                  unsigned char current_phase,
+                                  unsigned char  mask);
+static int  nsp_xfer             (struct scsi_cmnd *SCpnt, int phase);
+static int  nsp_dataphase_bypass (struct scsi_cmnd *SCpnt);
+static int  nsp_reselected       (struct scsi_cmnd *SCpnt);
 static struct Scsi_Host *nsp_detect(struct scsi_host_template *sht);
 
 /* Interrupt handler */
@@ -355,8 +359,8 @@ static void __exit nsp_cs_exit(void);
 
 /* Debug */
 #ifdef NSP_DEBUG
-static void show_command (Scsi_Cmnd *SCpnt);
-static void show_phase   (Scsi_Cmnd *SCpnt);
+static void show_command (struct scsi_cmnd *SCpnt);
+static void show_phase   (struct scsi_cmnd *SCpnt);
 static void show_busphase(unsigned char stat);
 static void show_message (nsp_hw_data *data);
 #else
diff --git a/drivers/scsi/pcmcia/nsp_debug.c b/drivers/scsi/pcmcia/nsp_debug.c
index 62e5c60067fd..2f75fe6e35a7 100644
--- a/drivers/scsi/pcmcia/nsp_debug.c
+++ b/drivers/scsi/pcmcia/nsp_debug.c
@@ -138,12 +138,12 @@ static void print_commandk (unsigned char *command)
         printk("\n");
 }
 
-static void show_command(Scsi_Cmnd *SCpnt)
+static void show_command(struct scsi_cmnd *SCpnt)
 {
         print_commandk(SCpnt->cmnd);
 }
 
-static void show_phase(Scsi_Cmnd *SCpnt)
+static void show_phase(struct scsi_cmnd *SCpnt)
 {
         int i = SCpnt->SCp.phase;
 
diff --git a/drivers/scsi/pcmcia/nsp_message.c b/drivers/scsi/pcmcia/nsp_message.c
index d7057737ff34..ef593b70d0f0 100644
--- a/drivers/scsi/pcmcia/nsp_message.c
+++ b/drivers/scsi/pcmcia/nsp_message.c
@@ -8,7 +8,7 @@
 
 /* $Id: nsp_message.c,v 1.6 2003/07/26 14:21:09 elca Exp $ */
 
-static void nsp_message_in(Scsi_Cmnd *SCpnt)
+static void nsp_message_in(struct scsi_cmnd *SCpnt)
 {
         unsigned int  base = SCpnt->device->host->io_port;
         nsp_hw_data  *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
@@ -50,7 +50,7 @@ static void nsp_message_in(Scsi_Cmnd *SCpnt)
 
 }
 
-static void nsp_message_out(Scsi_Cmnd *SCpnt)
+static void nsp_message_out(struct scsi_cmnd *SCpnt)
 {
         nsp_hw_data *data = (nsp_hw_data *)SCpnt->device->host->hostdata;
         int ret = 1;
diff --git a/drivers/scsi/ppa.c b/drivers/scsi/ppa.c
index b0eba39f208a..89a2a9f11e41 100644
--- a/drivers/scsi/ppa.c
+++ b/drivers/scsi/ppa.c
@@ -1012,7 +1012,7 @@ static LIST_HEAD(ppa_hosts);
 static int __ppa_attach(struct parport *pb)
 {
         struct Scsi_Host *host;
-        DECLARE_WAIT_QUEUE_HEAD(waiting);
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(waiting);
         DEFINE_WAIT(wait);
         ppa_struct *dev;
         int ports;
diff --git a/drivers/scsi/psi240i.c b/drivers/scsi/psi240i.c
index a720c9265e66..899e89d6fe67 100644
--- a/drivers/scsi/psi240i.c
+++ b/drivers/scsi/psi240i.c
@@ -87,11 +87,11 @@ typedef struct
         {
         USHORT           ports[13];
         OUR_DEVICE       device[8];
-        Scsi_Cmnd       *pSCmnd;
+        struct scsi_cmnd *pSCmnd;
         IDE_STRUCT       ide;
         ULONG            startSector;
         USHORT           sectorCount;
-        Scsi_Cmnd       *SCpnt;
+        struct scsi_cmnd *SCpnt;
         VOID            *buffer;
         USHORT           expectingIRQ;
         }       ADAPTER240I, *PADAPTER240I;
@@ -253,12 +253,12 @@ static ULONG DecodeError (struct Scsi_Host *pshost, UCHAR status)
  ****************************************************************/
 static void Irq_Handler (int irq, void *dev_id)
         {
-        struct Scsi_Host   *shost;                      // Pointer to host data block
-        PADAPTER240I            padapter;               // Pointer to adapter control structure
-        USHORT                     *pports;                     // I/O port array
-        Scsi_Cmnd                  *SCpnt;
-        UCHAR                           status;
-        int                                     z;
+        struct Scsi_Host *shost;        // Pointer to host data block
+        PADAPTER240I padapter;          // Pointer to adapter control structure
+        USHORT *pports;                 // I/O port array
+        struct scsi_cmnd *SCpnt;
+        UCHAR status;
+        int z;
 
         DEB(printk ("\npsi240i received interrupt\n"));
 
@@ -328,7 +328,7 @@ static void Irq_Handler (int irq, void *dev_id)
                                 pinquiryData->AdditionalLength = 35 - 4;
 
                                 // Fill in vendor identification fields.
-                                for ( z = 0;  z < 20;  z += 2 )
+                                for ( z = 0;  z < 8;  z += 2 )
                                         {
                                         pinquiryData->VendorId[z]         = ((UCHAR *)identifyData.ModelNumber)[z + 1];
                                         pinquiryData->VendorId[z + 1] = ((UCHAR *)identifyData.ModelNumber)[z];
@@ -389,12 +389,17 @@ static irqreturn_t do_Irq_Handler (int irq, void *dev_id)
  *      Returns:                Status code.
  *
  ****************************************************************/
-static int Psi240i_QueueCommand (Scsi_Cmnd *SCpnt, void (*done)(Scsi_Cmnd *))
+static int Psi240i_QueueCommand(struct scsi_cmnd *SCpnt,
+                                void (*done)(struct scsi_cmnd *))
         {
-        UCHAR              *cdb = (UCHAR *)SCpnt->cmnd;                                 // Pointer to SCSI CDB
-        PADAPTER240I    padapter = HOSTDATA (SCpnt->device->host);                      // Pointer to adapter control structure
-        POUR_DEVICE             pdev     = &padapter->device [SCpnt->device->id];// Pointer to device information
-        UCHAR                   rc;                                                                                     // command return code
+        UCHAR *cdb = (UCHAR *)SCpnt->cmnd;
+        // Pointer to SCSI CDB
+        PADAPTER240I padapter = HOSTDATA (SCpnt->device->host);
+        // Pointer to adapter control structure
+        POUR_DEVICE pdev = &padapter->device [SCpnt->device->id];
+        // Pointer to device information
+        UCHAR rc;
+        // command return code
 
         SCpnt->scsi_done = done;
         padapter->ide.ide.ides.spigot = pdev->spigot;
diff --git a/drivers/scsi/psi240i.h b/drivers/scsi/psi240i.h
index 6a598766df51..21ebb9214004 100644
--- a/drivers/scsi/psi240i.h
+++ b/drivers/scsi/psi240i.h
@@ -309,7 +309,7 @@ typedef struct _IDENTIFY_DATA2 {
 #endif  // PSI_EIDE_SCSIOP
 
 // function prototypes
-int Psi240i_Command                     (Scsi_Cmnd *SCpnt);
-int Psi240i_Abort                       (Scsi_Cmnd *SCpnt);
-int Psi240i_Reset                       (Scsi_Cmnd *SCpnt, unsigned int flags);
+int Psi240i_Command(struct scsi_cmnd *SCpnt);
+int Psi240i_Abort(struct scsi_cmnd *SCpnt);
+int Psi240i_Reset(struct scsi_cmnd *SCpnt, unsigned int flags);
 #endif
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 2521d548dd59..16af5b79e587 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -931,11 +931,10 @@ qla1280_error_action(struct scsi_cmnd *cmd, enum action action)
 
         case BUS_RESET:
                 if (qla1280_verbose)
-                        printk(KERN_INFO "qla1280(%ld:%d): Issuing BUS "
-                               "DEVICE RESET\n", ha->host_no, bus);
-                if (qla1280_bus_reset(ha, bus == 0))
+                        printk(KERN_INFO "qla1280(%ld:%d): Issued bus "
+                               "reset.\n", ha->host_no, bus);
+                if (qla1280_bus_reset(ha, bus) == 0)
                         result = SUCCESS;
-
                 break;
 
         case ADAPTER_RESET:
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index ee75a71f3c66..285c8e8ff1a0 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -379,21 +379,37 @@ static struct bin_attribute sysfs_sfp_attr = {
         .read = qla2x00_sysfs_read_sfp,
 };
 
+static struct sysfs_entry {
+        char *name;
+        struct bin_attribute *attr;
+        int is4GBp_only;
+} bin_file_entries[] = {
+        { "fw_dump", &sysfs_fw_dump_attr, },
+        { "nvram", &sysfs_nvram_attr, },
+        { "optrom", &sysfs_optrom_attr, },
+        { "optrom_ctl", &sysfs_optrom_ctl_attr, },
+        { "vpd", &sysfs_vpd_attr, 1 },
+        { "sfp", &sysfs_sfp_attr, 1 },
+        { 0 },
+};
+
 void
 qla2x00_alloc_sysfs_attr(scsi_qla_host_t *ha)
 {
         struct Scsi_Host *host = ha->host;
+        struct sysfs_entry *iter;
+        int ret;
 
-        sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_fw_dump_attr);
-        sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_nvram_attr);
-        sysfs_create_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
-        sysfs_create_bin_file(&host->shost_gendev.kobj,
-            &sysfs_optrom_ctl_attr);
-        if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
-                sysfs_create_bin_file(&host->shost_gendev.kobj,
-                    &sysfs_vpd_attr);
-                sysfs_create_bin_file(&host->shost_gendev.kobj,
-                    &sysfs_sfp_attr);
+        for (iter = bin_file_entries; iter->name; iter++) {
+                if (iter->is4GBp_only && (!IS_QLA24XX(ha) && !IS_QLA54XX(ha)))
+                        continue;
+
+                ret = sysfs_create_bin_file(&host->shost_gendev.kobj,
+                    iter->attr);
+                if (ret)
+                        qla_printk(KERN_INFO, ha,
+                            "Unable to create sysfs %s binary attribute "
+                            "(%d).\n", iter->name, ret);
         }
 }
 
@@ -401,17 +417,14 @@ void
 qla2x00_free_sysfs_attr(scsi_qla_host_t *ha)
 {
         struct Scsi_Host *host = ha->host;
+        struct sysfs_entry *iter;
+
+        for (iter = bin_file_entries; iter->name; iter++) {
+                if (iter->is4GBp_only && (!IS_QLA24XX(ha) && !IS_QLA54XX(ha)))
+                        continue;
 
-        sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_fw_dump_attr);
-        sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_nvram_attr);
-        sysfs_remove_bin_file(&host->shost_gendev.kobj, &sysfs_optrom_attr);
-        sysfs_remove_bin_file(&host->shost_gendev.kobj,
-            &sysfs_optrom_ctl_attr);
-        if (IS_QLA24XX(ha) || IS_QLA54XX(ha)) {
-                sysfs_remove_bin_file(&host->shost_gendev.kobj,
-                    &sysfs_vpd_attr);
                 sysfs_remove_bin_file(&host->shost_gendev.kobj,
-                    &sysfs_sfp_attr);
+                    iter->attr);
         }
 
         if (ha->beacon_blink_led == 1)
diff --git a/drivers/scsi/qla2xxx/qla_dbg.h b/drivers/scsi/qla2xxx/qla_dbg.h
index 90dad7e88985..5b12278968e0 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.h
+++ b/drivers/scsi/qla2xxx/qla_dbg.h
@@ -38,7 +38,7 @@
 * Macros use for debugging the driver.
 */
 
-#define DEBUG(x)        do { if (qla2_extended_error_logging) { x; } } while (0)
+#define DEBUG(x)        do { if (ql2xextended_error_logging) { x; } } while (0)
 
 #if defined(QL_DEBUG_LEVEL_1)
 #define DEBUG1(x)       do {x;} while (0)
@@ -46,12 +46,12 @@
 #define DEBUG1(x)       do {} while (0)
 #endif
 
-#define DEBUG2(x)       do { if (qla2_extended_error_logging) { x; } } while (0)
-#define DEBUG2_3(x)     do { if (qla2_extended_error_logging) { x; } } while (0)
-#define DEBUG2_3_11(x)  do { if (qla2_extended_error_logging) { x; } } while (0)
-#define DEBUG2_9_10(x)  do { if (qla2_extended_error_logging) { x; } } while (0)
-#define DEBUG2_11(x)    do { if (qla2_extended_error_logging) { x; } } while (0)
-#define DEBUG2_13(x)    do { if (qla2_extended_error_logging) { x; } } while (0)
+#define DEBUG2(x)       do { if (ql2xextended_error_logging) { x; } } while (0)
+#define DEBUG2_3(x)     do { if (ql2xextended_error_logging) { x; } } while (0)
+#define DEBUG2_3_11(x)  do { if (ql2xextended_error_logging) { x; } } while (0)
+#define DEBUG2_9_10(x)  do { if (ql2xextended_error_logging) { x; } } while (0)
+#define DEBUG2_11(x)    do { if (ql2xextended_error_logging) { x; } } while (0)
+#define DEBUG2_13(x)    do { if (ql2xextended_error_logging) { x; } } while (0)
 
 #if defined(QL_DEBUG_LEVEL_3)
 #define DEBUG3(x)       do {x;} while (0)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index bab33f6d0bdb..c4fc40f8e8ca 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -1545,6 +1545,9 @@ typedef struct fc_port {
         spinlock_t rport_lock;
         struct fc_rport *rport, *drport;
         u32 supported_classes;
+
+        unsigned long last_queue_full;
+        unsigned long last_ramp_up;
 } fc_port_t;
 
 /*
@@ -2255,6 +2258,7 @@ typedef struct scsi_qla_host {
         uint16_t        mgmt_svr_loop_id;
 
         uint32_t        login_retry_count;
+        int             max_q_depth;
 
         /* Fibre Channel Device List. */
         struct list_head        fcports;
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 7da69832d74c..32ebeec45ff0 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -48,6 +48,7 @@ extern void qla2x00_update_fcport(scsi_qla_host_t *, fc_port_t *);
 extern void qla2x00_reg_remote_port(scsi_qla_host_t *, fc_port_t *);
 
 extern void qla2x00_alloc_fw_dump(scsi_qla_host_t *);
+extern void qla2x00_try_to_stop_firmware(scsi_qla_host_t *);
 
 /*
  * Global Data in qla_os.c source file.
@@ -60,7 +61,8 @@ extern int ql2xplogiabsentdevice;
 extern int ql2xloginretrycount;
 extern int ql2xfdmienable;
 extern int ql2xallocfwdump;
-extern int qla2_extended_error_logging;
+extern int ql2xextended_error_logging;
+extern int ql2xqfullrampup;
 
 extern void qla2x00_sp_compl(scsi_qla_host_t *, srb_t *);
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 833b93085fd3..08cb5e3fb553 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -1644,7 +1644,7 @@ qla2x00_nvram_config(scsi_qla_host_t *ha)
          * Set host adapter parameters.
          */
         if (nv->host_p[0] & BIT_7)
-                qla2_extended_error_logging = 1;
+                ql2xextended_error_logging = 1;
         ha->flags.disable_risc_code_load = ((nv->host_p[0] & BIT_4) ? 1 : 0);
         /* Always load RISC code on non ISP2[12]00 chips. */
         if (!IS_QLA2100(ha) && !IS_QLA2200(ha))
@@ -3948,3 +3948,24 @@ qla24xx_load_risc(scsi_qla_host_t *ha, uint32_t *srisc_addr)
 fail_fw_integrity:
         return QLA_FUNCTION_FAILED;
 }
+
+void
+qla2x00_try_to_stop_firmware(scsi_qla_host_t *ha)
+{
+        int ret, retries;
+
+        if (!IS_QLA24XX(ha) && !IS_QLA54XX(ha))
+                return;
+
+        ret = qla2x00_stop_firmware(ha);
+        for (retries = 5; ret != QLA_SUCCESS && retries ; retries--) {
+                qla2x00_reset_chip(ha);
+                if (qla2x00_chip_diag(ha) != QLA_SUCCESS)
+                        continue;
+                if (qla2x00_setup_chip(ha) != QLA_SUCCESS)
+                        continue;
+                qla_printk(KERN_INFO, ha,
+                    "Attempting retry of stop-firmware command...\n");
+                ret = qla2x00_stop_firmware(ha);
+        }
+}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 626c7178a434..d3b6df4d55c8 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -6,6 +6,8 @@
  */
 #include "qla_def.h"
 
+#include <scsi/scsi_tcq.h>
+
 static void qla2x00_mbx_completion(scsi_qla_host_t *, uint16_t);
 static void qla2x00_async_event(scsi_qla_host_t *, uint16_t *);
 static void qla2x00_process_completed_request(struct scsi_qla_host *, uint32_t);
@@ -593,6 +595,67 @@ qla2x00_async_event(scsi_qla_host_t *ha, uint16_t *mb)
         }
 }
 
+static void
+qla2x00_adjust_sdev_qdepth_up(struct scsi_device *sdev, void *data)
+{
+        fc_port_t *fcport = data;
+
+        if (fcport->ha->max_q_depth <= sdev->queue_depth)
+                return;
+
+        if (sdev->ordered_tags)
+                scsi_adjust_queue_depth(sdev, MSG_ORDERED_TAG,
+                    sdev->queue_depth + 1);
+        else
+                scsi_adjust_queue_depth(sdev, MSG_SIMPLE_TAG,
+                    sdev->queue_depth + 1);
+
+        fcport->last_ramp_up = jiffies;
+
+        DEBUG2(qla_printk(KERN_INFO, fcport->ha,
+            "scsi(%ld:%d:%d:%d): Queue depth adjusted-up to %d.\n",
+            fcport->ha->host_no, sdev->channel, sdev->id, sdev->lun,
+            sdev->queue_depth));
+}
+
+static void
+qla2x00_adjust_sdev_qdepth_down(struct scsi_device *sdev, void *data)
+{
+        fc_port_t *fcport = data;
+
+        if (!scsi_track_queue_full(sdev, sdev->queue_depth - 1))
+                return;
+
+        DEBUG2(qla_printk(KERN_INFO, fcport->ha,
+            "scsi(%ld:%d:%d:%d): Queue depth adjusted-down to %d.\n",
+            fcport->ha->host_no, sdev->channel, sdev->id, sdev->lun,
+            sdev->queue_depth));
+}
+
+static inline void
+qla2x00_ramp_up_queue_depth(scsi_qla_host_t *ha, srb_t *sp)
+{
+        fc_port_t *fcport;
+        struct scsi_device *sdev;
+
+        sdev = sp->cmd->device;
+        if (sdev->queue_depth >= ha->max_q_depth)
+                return;
+
+        fcport = sp->fcport;
+        if (time_before(jiffies,
+            fcport->last_ramp_up + ql2xqfullrampup * HZ))
+                return;
+        if (time_before(jiffies,
+            fcport->last_queue_full + ql2xqfullrampup * HZ))
+                return;
+
+        spin_unlock_irq(&ha->hardware_lock);
+        starget_for_each_device(sdev->sdev_target, fcport,
+            qla2x00_adjust_sdev_qdepth_up);
+        spin_lock_irq(&ha->hardware_lock);
+}
+
 /**
  * qla2x00_process_completed_request() - Process a Fast Post response.
  * @ha: SCSI driver HA context
@@ -624,6 +687,8 @@ qla2x00_process_completed_request(struct scsi_qla_host *ha, uint32_t index)
 
                 /* Save ISP completion status */
                 sp->cmd->result = DID_OK << 16;
+
+                qla2x00_ramp_up_queue_depth(ha, sp);
                 qla2x00_sp_compl(ha, sp);
         } else {
                 DEBUG2(printk("scsi(%ld): Invalid ISP SCSI completion handle\n",
@@ -823,6 +888,7 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
          */
         switch (comp_status) {
         case CS_COMPLETE:
+        case CS_QUEUE_FULL:
                 if (scsi_status == 0) {
                         cp->result = DID_OK << 16;
                         break;
@@ -849,6 +915,20 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                 }
                 cp->result = DID_OK << 16 | lscsi_status;
 
+                if (lscsi_status == SAM_STAT_TASK_SET_FULL) {
+                        DEBUG2(printk(KERN_INFO
+                            "scsi(%ld): QUEUE FULL status detected "
+                            "0x%x-0x%x.\n", ha->host_no, comp_status,
+                            scsi_status));
+
+                        /* Adjust queue depth for all luns on the port. */
+                        fcport->last_queue_full = jiffies;
+                        spin_unlock_irq(&ha->hardware_lock);
+                        starget_for_each_device(cp->device->sdev_target,
+                            fcport, qla2x00_adjust_sdev_qdepth_down);
+                        spin_lock_irq(&ha->hardware_lock);
+                        break;
+                }
                 if (lscsi_status != SS_CHECK_CONDITION)
                         break;
 
@@ -1066,17 +1146,6 @@ qla2x00_status_entry(scsi_qla_host_t *ha, void *pkt)
                         qla2x00_mark_device_lost(ha, fcport, 1, 1);
                 break;
 
-        case CS_QUEUE_FULL:
-                DEBUG2(printk(KERN_INFO
-                    "scsi(%ld): QUEUE FULL status detected 0x%x-0x%x.\n",
-                    ha->host_no, comp_status, scsi_status));
-
-                /* SCSI Mid-Layer handles device queue full */
-
-                cp->result = DID_OK << 16 | lscsi_status;
-
-                break;
-
         default:
                 DEBUG3(printk("scsi(%ld): Error detected (unknown status) "
                     "0x%x-0x%x.\n", ha->host_no, comp_status, scsi_status));
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5e70c49fdf84..3eb4cd2cbc78 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -61,9 +61,9 @@ MODULE_PARM_DESC(ql2xallocfwdump,
                 "during HBA initialization.  Memory allocation requirements "
                 "vary by ISP type.  Default is 1 - allocate memory.");
 
-int qla2_extended_error_logging;
-module_param(qla2_extended_error_logging, int, S_IRUGO|S_IRUSR);
-MODULE_PARM_DESC(qla2_extended_error_logging,
+int ql2xextended_error_logging;
+module_param(ql2xextended_error_logging, int, S_IRUGO|S_IRUSR);
+MODULE_PARM_DESC(ql2xextended_error_logging,
                 "Option to enable extended error logging, "
                 "Default is 0 - no logging. 1 - log errors.");
 
@@ -77,6 +77,19 @@ MODULE_PARM_DESC(ql2xfdmienable,
                 "Enables FDMI registratons "
                 "Default is 0 - no FDMI. 1 - perfom FDMI.");
 
+#define MAX_Q_DEPTH    32
+static int ql2xmaxqdepth = MAX_Q_DEPTH;
+module_param(ql2xmaxqdepth, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(ql2xmaxqdepth,
+                "Maximum queue depth to report for target devices.");
+
+int ql2xqfullrampup = 120;
+module_param(ql2xqfullrampup, int, S_IRUGO|S_IWUSR);
+MODULE_PARM_DESC(ql2xqfullrampup,
+                "Number of seconds to wait to begin to ramp-up the queue "
+                "depth for a device after a queue-full condition has been "
+                "detected.  Default is 120 seconds.");
+
 /*
  * SCSI host template entry points
  */
@@ -1104,9 +1117,9 @@ qla2xxx_slave_configure(struct scsi_device *sdev)
         struct fc_rport *rport = starget_to_rport(sdev->sdev_target);
 
         if (sdev->tagged_supported)
-                scsi_activate_tcq(sdev, 32);
+                scsi_activate_tcq(sdev, ha->max_q_depth);
         else
-                scsi_deactivate_tcq(sdev, 32);
+                scsi_deactivate_tcq(sdev, ha->max_q_depth);
 
         rport->dev_loss_tmo = ha->port_down_retry_count + 5;
 
@@ -1413,6 +1426,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
         ha->link_data_rate = PORT_SPEED_UNKNOWN;
         ha->optrom_size = OPTROM_SIZE_2300;
 
+        ha->max_q_depth = MAX_Q_DEPTH;
+        if (ql2xmaxqdepth != 0 && ql2xmaxqdepth <= 0xffffU)
+                ha->max_q_depth = ql2xmaxqdepth;
+
         /* Assign ISP specific operations. */
         ha->isp_ops.pci_config          = qla2100_pci_config;
         ha->isp_ops.reset_chip          = qla2x00_reset_chip;
@@ -1712,8 +1729,10 @@ qla2x00_free_device(scsi_qla_host_t *ha)
         if (ha->eft)
                 qla2x00_trace_control(ha, TC_DISABLE, 0, 0);
 
+        ha->flags.online = 0;
+
         /* Stop currently executing firmware. */
-        qla2x00_stop_firmware(ha);
+        qla2x00_try_to_stop_firmware(ha);
 
         /* turn-off interrupts on the card */
         if (ha->interrupts_on)
@@ -1721,8 +1740,6 @@ qla2x00_free_device(scsi_qla_host_t *ha)
 
         qla2x00_mem_free(ha);
 
-        ha->flags.online = 0;
-
         /* Detach interrupts */
         if (ha->host->irq)
                 free_irq(ha->host->irq, ha);
@@ -2697,7 +2714,7 @@ qla2x00_module_init(void)
 
         /* Derive version string. */
         strcpy(qla2x00_version_str, QLA2XXX_VERSION);
-        if (qla2_extended_error_logging)
+        if (ql2xextended_error_logging)
                 strcat(qla2x00_version_str, "-debug");
 
         qla2xxx_transport_template =
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index e57bf45a3393..1fa0bce6b24e 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.01.07-k2"
+#define QLA2XXX_VERSION      "8.01.07-k3"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    1
diff --git a/drivers/scsi/qla4xxx/Kconfig b/drivers/scsi/qla4xxx/Kconfig
index 08a07f0b8d94..69cbff3f57cf 100644
--- a/drivers/scsi/qla4xxx/Kconfig
+++ b/drivers/scsi/qla4xxx/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_QLA_ISCSI
         tristate "QLogic ISP4XXX host adapter family support"
-        depends on PCI && SCSI
+        depends on PCI && SCSI && NET
         select SCSI_ISCSI_ATTRS
         ---help---
         This driver supports the QLogic 40xx (ISP4XXX) iSCSI host
diff --git a/drivers/scsi/qla4xxx/ql4_dbg.h b/drivers/scsi/qla4xxx/ql4_dbg.h
index 3e99dcfd5a9f..d861c3b411c8 100644
--- a/drivers/scsi/qla4xxx/ql4_dbg.h
+++ b/drivers/scsi/qla4xxx/ql4_dbg.h
@@ -22,14 +22,14 @@
 #endif
 
 #if defined(QL_DEBUG_LEVEL_2)
-#define DEBUG2(x)      do {if(qla4_extended_error_logging == 2) x;} while (0);
+#define DEBUG2(x)      do {if(ql4xextended_error_logging == 2) x;} while (0);
 #define DEBUG2_3(x)   do {x;} while (0);
 #else                           /*  */
 #define DEBUG2(x)       do {} while (0);
 #endif                          /*  */
 
 #if defined(QL_DEBUG_LEVEL_3)
-#define DEBUG3(x)      do {if(qla4_extended_error_logging == 3) x;} while (0);
+#define DEBUG3(x)      do {if(ql4xextended_error_logging == 3) x;} while (0);
 #else                           /*  */
 #define DEBUG3(x)       do {} while (0);
 #if !defined(QL_DEBUG_LEVEL_2)
diff --git a/drivers/scsi/qla4xxx/ql4_glbl.h b/drivers/scsi/qla4xxx/ql4_glbl.h
index 2c803edf2de8..eeefdcb1edb5 100644
--- a/drivers/scsi/qla4xxx/ql4_glbl.h
+++ b/drivers/scsi/qla4xxx/ql4_glbl.h
@@ -8,6 +8,7 @@
 #ifndef __QLA4x_GBL_H
 #define __QLA4x_GBL_H
 
+int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a);
 int qla4xxx_send_tgts(struct scsi_qla_host *ha, char *ip, uint16_t port);
 int qla4xxx_send_command_to_isp(struct scsi_qla_host *ha, struct srb * srb);
 int qla4xxx_initialize_adapter(struct scsi_qla_host * ha,
@@ -72,7 +73,7 @@ int qla4xxx_reinitialize_ddb_list(struct scsi_qla_host * ha);
 int qla4xxx_process_ddb_changed(struct scsi_qla_host * ha,
                                 uint32_t fw_ddb_index, uint32_t state);
 
-extern int qla4_extended_error_logging;
+extern int ql4xextended_error_logging;
 extern int ql4xdiscoverywait;
 extern int ql4xdontresethba;
 #endif                          /* _QLA4x_GBL_H */
diff --git a/drivers/scsi/qla4xxx/ql4_init.c b/drivers/scsi/qla4xxx/ql4_init.c
index bb3a1c11f44c..9e81b810dc88 100644
--- a/drivers/scsi/qla4xxx/ql4_init.c
+++ b/drivers/scsi/qla4xxx/ql4_init.c
@@ -978,7 +978,7 @@ static int qla4xxx_start_firmware_from_flash(struct scsi_qla_host *ha)
         return status;
 }
 
-static int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a)
+int ql4xxx_lock_drvr_wait(struct scsi_qla_host *a)
 {
 #define QL4_LOCK_DRVR_WAIT      300
 #define QL4_LOCK_DRVR_SLEEP     100
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index ef82399c0858..b721dc5dd711 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -701,7 +701,7 @@ void qla4xxx_get_conn_event_log(struct scsi_qla_host * ha)
         DEBUG3(printk("scsi%ld: Connection Event Log Dump (%d entries):\n",
                       ha->host_no, num_valid_entries));
 
-        if (qla4_extended_error_logging == 3) {
+        if (ql4xextended_error_logging == 3) {
                 if (oldest_entry == 0) {
                         /* Circular Buffer has not wrapped around */
                         for (i=0; i < num_valid_entries; i++) {
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 178fcddcfd81..bab434ee774b 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -34,9 +34,9 @@ MODULE_PARM_DESC(ql4xdontresethba,
                  " default it will reset hba :0"
                  " set to 1 to avoid resetting HBA");
 
-int qla4_extended_error_logging = 0; /* 0 = off, 1 = log errors */
-module_param(qla4_extended_error_logging, int, S_IRUGO | S_IRUSR);
-MODULE_PARM_DESC(qla4_extended_error_logging,
+int ql4xextended_error_logging = 0; /* 0 = off, 1 = log errors */
+module_param(ql4xextended_error_logging, int, S_IRUGO | S_IRUSR);
+MODULE_PARM_DESC(ql4xextended_error_logging,
                  "Option to enable extended error logging, "
                  "Default is 0 - no logging, 1 - debug logging");
 
@@ -919,18 +919,11 @@ static int qla4xxx_recover_adapter(struct scsi_qla_host *ha,
         if (status == QLA_SUCCESS) {
                 DEBUG2(printk("scsi%ld: %s - Performing soft reset..\n",
                               ha->host_no, __func__));
-                status = qla4xxx_soft_reset(ha);
-        }
-        /* FIXMEkaren: Do we want to keep interrupts enabled and process
-           AENs after soft reset */
-
-        /* If firmware (SOFT) reset failed, or if all outstanding
-         * commands have not returned, then do a HARD reset.
-         */
-        if (status == QLA_ERROR) {
-                DEBUG2(printk("scsi%ld: %s - Performing hard reset..\n",
-                              ha->host_no, __func__));
-                status = qla4xxx_hard_reset(ha);
+                qla4xxx_flush_active_srbs(ha);
+                if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
+                        status = qla4xxx_soft_reset(ha);
+                else
+                        status = QLA_ERROR;
         }
 
         /* Flush any pending ddb changed AENs */
@@ -1016,13 +1009,9 @@ static void qla4xxx_do_dpc(void *data)
         struct scsi_qla_host *ha = (struct scsi_qla_host *) data;
         struct ddb_entry *ddb_entry, *dtemp;
 
-        DEBUG2(printk("scsi%ld: %s: DPC handler waking up.\n",
-                      ha->host_no, __func__));
-
-        DEBUG2(printk("scsi%ld: %s: ha->flags = 0x%08lx\n",
-                      ha->host_no, __func__, ha->flags));
-        DEBUG2(printk("scsi%ld: %s: ha->dpc_flags = 0x%08lx\n",
-                      ha->host_no, __func__, ha->dpc_flags));
+        DEBUG2(printk("scsi%ld: %s: DPC handler waking up."
+                "flags = 0x%08lx, dpc_flags = 0x%08lx\n",
+                ha->host_no, __func__, ha->flags, ha->dpc_flags));
 
         /* Initialization not yet finished. Don't do anything yet. */
         if (!test_bit(AF_INIT_DONE, &ha->flags))
@@ -1032,16 +1021,8 @@ static void qla4xxx_do_dpc(void *data)
             test_bit(DPC_RESET_HA, &ha->dpc_flags) ||
             test_bit(DPC_RESET_HA_INTR, &ha->dpc_flags) ||
             test_bit(DPC_RESET_HA_DESTROY_DDB_LIST, &ha->dpc_flags)) {
-                if (test_bit(DPC_RESET_HA_DESTROY_DDB_LIST, &ha->dpc_flags))
-                        /*
-                         * dg 09/23 Never initialize ddb list
-                         * once we up and running
-                         * qla4xxx_recover_adapter(ha,
-                         *    REBUILD_DDB_LIST);
-                         */
-                        qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST);
-
-                if (test_bit(DPC_RESET_HA, &ha->dpc_flags))
+                if (test_bit(DPC_RESET_HA_DESTROY_DDB_LIST, &ha->dpc_flags) ||
+                        test_bit(DPC_RESET_HA, &ha->dpc_flags))
                         qla4xxx_recover_adapter(ha, PRESERVE_DDB_LIST);
 
                 if (test_and_clear_bit(DPC_RESET_HA_INTR, &ha->dpc_flags)) {
@@ -1122,7 +1103,8 @@ static void qla4xxx_free_adapter(struct scsi_qla_host *ha)
                 destroy_workqueue(ha->dpc_thread);
 
         /* Issue Soft Reset to put firmware in unknown state */
-        qla4xxx_soft_reset(ha);
+        if (ql4xxx_lock_drvr_wait(ha) == QLA_SUCCESS)
+                qla4xxx_soft_reset(ha);
 
         /* Remove timer thread, if present */
         if (ha->timer_active)
@@ -1714,7 +1696,7 @@ static int __init qla4xxx_module_init(void)
 
         /* Derive version string. */
         strcpy(qla4xxx_version_str, QLA4XXX_DRIVER_VERSION);
-        if (qla4_extended_error_logging)
+        if (ql4xextended_error_logging)
                 strcat(qla4xxx_version_str, "-debug");
 
         qla4xxx_scsi_transport =
@@ -1724,13 +1706,13 @@ static int __init qla4xxx_module_init(void)
                 goto release_srb_cache;
         }
 
-        printk(KERN_INFO "QLogic iSCSI HBA Driver\n");
         ret = pci_register_driver(&qla4xxx_pci_driver);
         if (ret)
                 goto unregister_transport;
 
         printk(KERN_INFO "QLogic iSCSI HBA Driver\n");
         return 0;
+
 unregister_transport:
         iscsi_unregister_transport(&qla4xxx_iscsi_transport);
 release_srb_cache:
diff --git a/drivers/scsi/qla4xxx/ql4_version.h b/drivers/scsi/qla4xxx/ql4_version.h
index b3fe7e68988e..d05048b4e88a 100644
--- a/drivers/scsi/qla4xxx/ql4_version.h
+++ b/drivers/scsi/qla4xxx/ql4_version.h
@@ -5,9 +5,4 @@
  * See LICENSE.qla4xxx for copyright and licensing details.
  */
 
-#define QLA4XXX_DRIVER_VERSION  "5.00.05b9-k"
-
-#define QL4_DRIVER_MAJOR_VER    5
-#define QL4_DRIVER_MINOR_VER    0
-#define QL4_DRIVER_PATCH_VER    5
-#define QL4_DRIVER_BETA_VER     9
+#define QLA4XXX_DRIVER_VERSION  "5.00.06-k"
diff --git a/drivers/scsi/qlogicfas408.c b/drivers/scsi/qlogicfas408.c
index e0725353c99c..2e7db18f5aef 100644
--- a/drivers/scsi/qlogicfas408.c
+++ b/drivers/scsi/qlogicfas408.c
@@ -209,7 +209,7 @@ static int ql_wai(struct qlogicfas408_priv *priv)
  *      caller must hold host lock
  */
 
-static void ql_icmd(Scsi_Cmnd * cmd)
+static void ql_icmd(struct scsi_cmnd *cmd)
 {
         struct qlogicfas408_priv *priv = get_priv_by_cmd(cmd);
         int     qbase = priv->qbase;
@@ -256,7 +256,7 @@ static void ql_icmd(Scsi_Cmnd * cmd)
  *      Process scsi command - usually after interrupt 
  */
 
-static unsigned int ql_pcmd(Scsi_Cmnd * cmd)
+static unsigned int ql_pcmd(struct scsi_cmnd *cmd)
 {
         unsigned int i, j;
         unsigned long k;
@@ -407,7 +407,7 @@ static unsigned int ql_pcmd(Scsi_Cmnd * cmd)
 
 static void ql_ihandl(void *dev_id)
 {
-        Scsi_Cmnd *icmd;
+        struct scsi_cmnd *icmd;
         struct Scsi_Host *host = dev_id;
         struct qlogicfas408_priv *priv = get_priv_by_host(host);
         int qbase = priv->qbase;
@@ -447,7 +447,8 @@ irqreturn_t qlogicfas408_ihandl(int irq, void *dev_id)
  *      Queued command
  */
 
-int qlogicfas408_queuecommand(Scsi_Cmnd * cmd, void (*done) (Scsi_Cmnd *))
+int qlogicfas408_queuecommand(struct scsi_cmnd *cmd,
+                              void (*done) (struct scsi_cmnd *))
 {
         struct qlogicfas408_priv *priv = get_priv_by_cmd(cmd);
         if (scmd_id(cmd) == priv->qinitid) {
@@ -470,9 +471,8 @@ int qlogicfas408_queuecommand(Scsi_Cmnd * cmd, void (*done) (Scsi_Cmnd *))
  *      Return bios parameters 
  */
 
-int qlogicfas408_biosparam(struct scsi_device * disk,
-                        struct block_device *dev,
-                        sector_t capacity, int ip[])
+int qlogicfas408_biosparam(struct scsi_device *disk, struct block_device *dev,
+                           sector_t capacity, int ip[])
 {
 /* This should mimic the DOS Qlogic driver's behavior exactly */
         ip[0] = 0x40;
@@ -494,7 +494,7 @@ int qlogicfas408_biosparam(struct scsi_device * disk,
  *      Abort a command in progress
  */
  
-int qlogicfas408_abort(Scsi_Cmnd * cmd)
+int qlogicfas408_abort(struct scsi_cmnd *cmd)
 {
         struct qlogicfas408_priv *priv = get_priv_by_cmd(cmd);
         priv->qabort = 1;
@@ -508,7 +508,7 @@ int qlogicfas408_abort(Scsi_Cmnd * cmd)
  *      the PCMCIA qlogic_stub code. This wants fixing
  */
 
-int qlogicfas408_bus_reset(Scsi_Cmnd * cmd)
+int qlogicfas408_bus_reset(struct scsi_cmnd *cmd)
 {
         struct qlogicfas408_priv *priv = get_priv_by_cmd(cmd);
         unsigned long flags;
diff --git a/drivers/scsi/qlogicfas408.h b/drivers/scsi/qlogicfas408.h
index 8fd5555c75b1..260626427a32 100644
--- a/drivers/scsi/qlogicfas408.h
+++ b/drivers/scsi/qlogicfas408.h
@@ -75,15 +75,15 @@
 /*----------------------------------------------------------------*/
 
 struct qlogicfas408_priv {
-         int            qbase;          /* Port */
-         int            qinitid;        /* initiator ID */
-         int            qabort;         /* Flag to cause an abort */
-         int            qlirq;          /* IRQ being used */
-         int            int_type;       /* type of irq, 2 for ISA board, 0 for PCMCIA */
-         char           qinfo[80];      /* description */
-         Scsi_Cmnd      *qlcmd;         /* current command being processed */
-         struct Scsi_Host *shost;       /* pointer back to host */
-         struct qlogicfas408_priv *next; /* next private struct */
+        int qbase;              /* Port */
+        int qinitid;            /* initiator ID */
+        int qabort;             /* Flag to cause an abort */
+        int qlirq;              /* IRQ being used */
+        int int_type;           /* type of irq, 2 for ISA board, 0 for PCMCIA */
+        char qinfo[80];         /* description */
+        struct scsi_cmnd *qlcmd;        /* current command being processed */
+        struct Scsi_Host *shost;        /* pointer back to host */
+        struct qlogicfas408_priv *next; /* next private struct */
 };
 
 /* The qlogic card uses two register maps - These macros select which one */
@@ -103,12 +103,13 @@ struct qlogicfas408_priv {
 #define get_priv_by_host(x) (struct qlogicfas408_priv *)&((x)->hostdata[0])
 
 irqreturn_t qlogicfas408_ihandl(int irq, void *dev_id);
-int qlogicfas408_queuecommand(Scsi_Cmnd * cmd, void (*done) (Scsi_Cmnd *));
+int qlogicfas408_queuecommand(struct scsi_cmnd * cmd,
+                              void (*done) (struct scsi_cmnd *));
 int qlogicfas408_biosparam(struct scsi_device * disk,
-                        struct block_device *dev,
-                        sector_t capacity, int ip[]);
-int qlogicfas408_abort(Scsi_Cmnd * cmd);
-int qlogicfas408_bus_reset(Scsi_Cmnd * cmd);
+                           struct block_device *dev,
+                           sector_t capacity, int ip[]);
+int qlogicfas408_abort(struct scsi_cmnd * cmd);
+int qlogicfas408_bus_reset(struct scsi_cmnd * cmd);
 const char *qlogicfas408_info(struct Scsi_Host *host);
 int qlogicfas408_get_chip_type(int qbase, int int_type);
 void qlogicfas408_setup(int qbase, int id, int int_type);
diff --git a/drivers/scsi/qlogicpti.c b/drivers/scsi/qlogicpti.c
index ed58bb489889..9b827ceec501 100644
--- a/drivers/scsi/qlogicpti.c
+++ b/drivers/scsi/qlogicpti.c
@@ -461,7 +461,7 @@ static int qlogicpti_reset_hardware(struct Scsi_Host *host)
 
 #define PTI_RESET_LIMIT 400
 
-static int __init qlogicpti_load_firmware(struct qlogicpti *qpti)
+static int __devinit qlogicpti_load_firmware(struct qlogicpti *qpti)
 {
         struct Scsi_Host *host = qpti->qhost;
         unsigned short csum = 0;
diff --git a/drivers/scsi/qlogicpti_asm.c b/drivers/scsi/qlogicpti_asm.c
index 1545b30681b4..19aa84f46018 100644
--- a/drivers/scsi/qlogicpti_asm.c
+++ b/drivers/scsi/qlogicpti_asm.c
@@ -1,5 +1,5 @@
 /* Version 1.31.00 ISP1000 Initiator RISC firmware */
-unsigned short sbus_risc_code01[] __initdata = {
+unsigned short sbus_risc_code01[] __devinitdata = {
         0x0078, 0x1030, 0x0000, 0x2419, 0x0000, 0x12ff, 0x2043, 0x4f50,
         0x5952, 0x4947, 0x4854, 0x2031, 0x3939, 0x312c, 0x3139, 0x3932,
         0x2c31, 0x3939, 0x332c, 0x3139, 0x3934, 0x2051, 0x4c4f, 0x4749,
@@ -1157,4 +1157,4 @@ unsigned short sbus_risc_code01[] __initdata = {
         0x003c, 0x0040, 0x3415, 0x2019, 0x2626, 0x7b22, 0x7b26, 0x007c,
         0x92a7
 };
-unsigned short sbus_risc_code_length01 = 0x2419;
+unsigned short __devinitdata sbus_risc_code_length01 = 0x2419;
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 9c0f35820e3e..30ee3d72c021 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -52,7 +52,7 @@
 #include "scsi_debug.h"
 
 #define SCSI_DEBUG_VERSION "1.80"
-static const char * scsi_debug_version_date = "20060914";
+static const char * scsi_debug_version_date = "20061018";
 
 /* Additional Sense Code (ASC) used */
 #define NO_ADDITIONAL_SENSE 0x0
@@ -254,6 +254,8 @@ static int resp_requests(struct scsi_cmnd * SCpnt,
                          struct sdebug_dev_info * devip);
 static int resp_start_stop(struct scsi_cmnd * scp,
                            struct sdebug_dev_info * devip);
+static int resp_report_tgtpgs(struct scsi_cmnd * scp,
+                              struct sdebug_dev_info * devip);
 static int resp_readcap(struct scsi_cmnd * SCpnt,
                         struct sdebug_dev_info * devip);
 static int resp_readcap16(struct scsi_cmnd * SCpnt,
@@ -287,9 +289,9 @@ static void __init sdebug_build_parts(unsigned char * ramp);
 static void __init init_all_queued(void);
 static void stop_all_queued(void);
 static int stop_queued_cmnd(struct scsi_cmnd * cmnd);
-static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
-                           int dev_id_num, const char * dev_id_str,
-                           int dev_id_str_len);
+static int inquiry_evpd_83(unsigned char * arr, int port_group_id,
+                           int target_dev_id, int dev_id_num,
+                           const char * dev_id_str, int dev_id_str_len);
 static int inquiry_evpd_88(unsigned char * arr, int target_dev_id);
 static int do_create_driverfs_files(void);
 static void do_remove_driverfs_files(void);
@@ -422,6 +424,15 @@ int scsi_debug_queuecommand(struct scsi_cmnd * SCpnt, done_funct_t done)
                 }
                 errsts = resp_readcap16(SCpnt, devip);
                 break;
+        case MAINTENANCE_IN:
+                if (MI_REPORT_TARGET_PGS != cmd[1]) {
+                        mk_sense_buffer(devip, ILLEGAL_REQUEST,
+                                        INVALID_OPCODE, 0);
+                        errsts = check_condition_result;
+                        break;
+                }
+                errsts = resp_report_tgtpgs(SCpnt, devip);
+                break;
         case READ_16:
         case READ_12:
         case READ_10:
@@ -665,8 +676,9 @@ static const char * inq_vendor_id = "Linux   ";
 static const char * inq_product_id = "scsi_debug      ";
 static const char * inq_product_rev = "0004";
 
-static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
-                           int dev_id_num, const char * dev_id_str,
+static int inquiry_evpd_83(unsigned char * arr, int port_group_id,
+                           int target_dev_id, int dev_id_num,
+                           const char * dev_id_str,
                            int dev_id_str_len)
 {
         int num, port_a;
@@ -720,6 +732,15 @@ static int inquiry_evpd_83(unsigned char * arr, int target_dev_id,
         arr[num++] = (port_a >> 16) & 0xff;
         arr[num++] = (port_a >> 8) & 0xff;
         arr[num++] = port_a & 0xff;
+        /* NAA-5, Target port group identifier */
+        arr[num++] = 0x61;      /* proto=sas, binary */
+        arr[num++] = 0x95;      /* piv=1, target port group id */
+        arr[num++] = 0x0;
+        arr[num++] = 0x4;
+        arr[num++] = 0;
+        arr[num++] = 0;
+        arr[num++] = (port_group_id >> 8) & 0xff;
+        arr[num++] = port_group_id & 0xff;
         /* NAA-5, Target device identifier */
         arr[num++] = 0x61;      /* proto=sas, binary */
         arr[num++] = 0xa3;      /* piv=1, target device, naa */
@@ -928,12 +949,12 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
                         struct sdebug_dev_info * devip)
 {
         unsigned char pq_pdt;
-        unsigned char arr[SDEBUG_MAX_INQ_ARR_SZ];
+        unsigned char * arr;
         unsigned char *cmd = (unsigned char *)scp->cmnd;
-        int alloc_len, n;
+        int alloc_len, n, ret;
 
         alloc_len = (cmd[3] << 8) + cmd[4];
-        memset(arr, 0, SDEBUG_MAX_INQ_ARR_SZ);
+        arr = kzalloc(SDEBUG_MAX_INQ_ARR_SZ, GFP_KERNEL);
         if (devip->wlun)
                 pq_pdt = 0x1e;  /* present, wlun */
         else if (scsi_debug_no_lun_0 && (0 == devip->lun))
@@ -944,12 +965,15 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
         if (0x2 & cmd[1]) {  /* CMDDT bit set */
                 mk_sense_buffer(devip, ILLEGAL_REQUEST, INVALID_FIELD_IN_CDB,
                                 0);
+                kfree(arr);
                 return check_condition_result;
         } else if (0x1 & cmd[1]) {  /* EVPD bit set */
-                int lu_id_num, target_dev_id, len;
+                int lu_id_num, port_group_id, target_dev_id, len;
                 char lu_id_str[6];
                 int host_no = devip->sdbg_host->shost->host_no;
                 
+                port_group_id = (((host_no + 1) & 0x7f) << 8) +
+                    (devip->channel & 0x7f);
                 if (0 == scsi_debug_vpd_use_hostno)
                         host_no = 0;
                 lu_id_num = devip->wlun ? -1 : (((host_no + 1) * 2000) +
@@ -977,8 +1001,9 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
                         memcpy(&arr[4], lu_id_str, len);
                 } else if (0x83 == cmd[2]) { /* device identification */
                         arr[1] = cmd[2];        /*sanity */
-                        arr[3] = inquiry_evpd_83(&arr[4], target_dev_id,
-                                                 lu_id_num, lu_id_str, len);
+                        arr[3] = inquiry_evpd_83(&arr[4], port_group_id,
+                                                 target_dev_id, lu_id_num,
+                                                 lu_id_str, len);
                 } else if (0x84 == cmd[2]) { /* Software interface ident. */
                         arr[1] = cmd[2];        /*sanity */
                         arr[3] = inquiry_evpd_84(&arr[4]);
@@ -1012,17 +1037,22 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
                         /* Illegal request, invalid field in cdb */
                         mk_sense_buffer(devip, ILLEGAL_REQUEST,
                                         INVALID_FIELD_IN_CDB, 0);
+                        kfree(arr);
                         return check_condition_result;
                 }
                 len = min(((arr[2] << 8) + arr[3]) + 4, alloc_len);
-                return fill_from_dev_buffer(scp, arr,
+                ret = fill_from_dev_buffer(scp, arr,
                             min(len, SDEBUG_MAX_INQ_ARR_SZ));
+                kfree(arr);
+                return ret;
         }
         /* drops through here for a standard inquiry */
         arr[1] = DEV_REMOVEABLE(target) ? 0x80 : 0;     /* Removable disk */
         arr[2] = scsi_debug_scsi_level;
         arr[3] = 2;    /* response_data_format==2 */
         arr[4] = SDEBUG_LONG_INQ_SZ - 5;
+        if (0 == scsi_debug_vpd_use_hostno)
+                arr[5] = 0x10; /* claim: implicit TGPS */
         arr[6] = 0x10; /* claim: MultiP */
         /* arr[6] |= 0x40; ... claim: EncServ (enclosure services) */
         arr[7] = 0xa; /* claim: LINKED + CMDQUE */
@@ -1039,8 +1069,10 @@ static int resp_inquiry(struct scsi_cmnd * scp, int target,
                 arr[n++] = 0x3; arr[n++] = 0x60; /* SSC-2 no version */
         }
         arr[n++] = 0xc; arr[n++] = 0xf;  /* SAS-1.1 rev 10 */
-        return fill_from_dev_buffer(scp, arr,
+        ret = fill_from_dev_buffer(scp, arr,
                             min(alloc_len, SDEBUG_LONG_INQ_SZ));
+        kfree(arr);
+        return ret;
 }
 
 static int resp_requests(struct scsi_cmnd * scp,
@@ -1171,6 +1203,87 @@ static int resp_readcap16(struct scsi_cmnd * scp,
                                     min(alloc_len, SDEBUG_READCAP16_ARR_SZ));
 }
 
+#define SDEBUG_MAX_TGTPGS_ARR_SZ 1412
+
+static int resp_report_tgtpgs(struct scsi_cmnd * scp,
+                              struct sdebug_dev_info * devip)
+{
+        unsigned char *cmd = (unsigned char *)scp->cmnd;
+        unsigned char * arr;
+        int host_no = devip->sdbg_host->shost->host_no;
+        int n, ret, alen, rlen;
+        int port_group_a, port_group_b, port_a, port_b;
+
+        alen = ((cmd[6] << 24) + (cmd[7] << 16) + (cmd[8] << 8)
+                + cmd[9]);
+
+        arr = kzalloc(SDEBUG_MAX_TGTPGS_ARR_SZ, GFP_KERNEL);
+        /*
+         * EVPD page 0x88 states we have two ports, one
+         * real and a fake port with no device connected.
+         * So we create two port groups with one port each
+         * and set the group with port B to unavailable.
+         */
+        port_a = 0x1; /* relative port A */
+        port_b = 0x2; /* relative port B */
+        port_group_a = (((host_no + 1) & 0x7f) << 8) +
+            (devip->channel & 0x7f);
+        port_group_b = (((host_no + 1) & 0x7f) << 8) +
+            (devip->channel & 0x7f) + 0x80;
+
+        /*
+         * The asymmetric access state is cycled according to the host_id.
+         */
+        n = 4;
+        if (0 == scsi_debug_vpd_use_hostno) {
+            arr[n++] = host_no % 3; /* Asymm access state */
+            arr[n++] = 0x0F; /* claim: all states are supported */
+        } else {
+            arr[n++] = 0x0; /* Active/Optimized path */
+            arr[n++] = 0x01; /* claim: only support active/optimized paths */
+        }
+        arr[n++] = (port_group_a >> 8) & 0xff;
+        arr[n++] = port_group_a & 0xff;
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = 0;    /* Status code */
+        arr[n++] = 0;    /* Vendor unique */
+        arr[n++] = 0x1;  /* One port per group */
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = (port_a >> 8) & 0xff;
+        arr[n++] = port_a & 0xff;
+        arr[n++] = 3;    /* Port unavailable */
+        arr[n++] = 0x08; /* claim: only unavailalbe paths are supported */
+        arr[n++] = (port_group_b >> 8) & 0xff;
+        arr[n++] = port_group_b & 0xff;
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = 0;    /* Status code */
+        arr[n++] = 0;    /* Vendor unique */
+        arr[n++] = 0x1;  /* One port per group */
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = 0;    /* Reserved */
+        arr[n++] = (port_b >> 8) & 0xff;
+        arr[n++] = port_b & 0xff;
+
+        rlen = n - 4;
+        arr[0] = (rlen >> 24) & 0xff;
+        arr[1] = (rlen >> 16) & 0xff;
+        arr[2] = (rlen >> 8) & 0xff;
+        arr[3] = rlen & 0xff;
+
+        /*
+         * Return the smallest value of either
+         * - The allocated length
+         * - The constructed command length
+         * - The maximum array size
+         */
+        rlen = min(alen,n);
+        ret = fill_from_dev_buffer(scp, arr,
+                                   min(rlen, SDEBUG_MAX_TGTPGS_ARR_SZ));
+        kfree(arr);
+        return ret;
+}
+
 /* <<Following mode page info copied from ST318451LW>> */
 
 static int resp_err_recov_pg(unsigned char * p, int pcontrol, int target)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ee35a62bb7a2..2f12f9f12fcb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -410,6 +410,7 @@ int scsi_execute_async(struct scsi_device *sdev, const unsigned char *cmd,
                 goto free_req;
 
         req->cmd_len = cmd_len;
+        memset(req->cmd, 0, BLK_MAX_CDB); /* ATAPI hates garbage after CDB */
         memcpy(req->cmd, cmd, req->cmd_len);
         req->sense = sioc->sense;
         req->sense_len = 0;
@@ -1119,7 +1120,7 @@ static int scsi_setup_blk_pc_cmnd(struct scsi_device *sdev, struct request *req)
                 req->buffer = NULL;
         }
 
-        BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
+        BUILD_BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
         memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
         cmd->cmd_len = req->cmd_len;
         if (!req->data_len)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 148e24cc3222..aa1b1e0e9d22 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -700,12 +700,22 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
          * scanning run at their own risk, or supply a user level program
          * that can correctly scan.
          */
-        sdev->inquiry = kmalloc(sdev->inquiry_len, GFP_ATOMIC);
-        if (sdev->inquiry == NULL) {
+
+        /*
+         * Copy at least 36 bytes of INQUIRY data, so that we don't
+         * dereference unallocated memory when accessing the Vendor,
+         * Product, and Revision strings.  Badly behaved devices may set
+         * the INQUIRY Additional Length byte to a small value, indicating
+         * these strings are invalid, but often they contain plausible data
+         * nonetheless.  It doesn't matter if the device sent < 36 bytes
+         * total, since scsi_probe_lun() initializes inq_result with 0s.
+         */
+        sdev->inquiry = kmemdup(inq_result,
+                                max_t(size_t, sdev->inquiry_len, 36),
+                                GFP_ATOMIC);
+        if (sdev->inquiry == NULL)
                 return SCSI_SCAN_NO_RESPONSE;
-        }
 
-        memcpy(sdev->inquiry, inq_result, sdev->inquiry_len);
         sdev->vendor = (char *) (sdev->inquiry + 8);
         sdev->model = (char *) (sdev->inquiry + 16);
         sdev->rev = (char *) (sdev->inquiry + 32);
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index e7fe565b96de..e1a91665d1c2 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -192,6 +192,7 @@ static CLASS_DEVICE_ATTR(state, S_IRUGO | S_IWUSR, show_shost_state, store_shost
 shost_rd_attr(unique_id, "%u\n");
 shost_rd_attr(host_busy, "%hu\n");
 shost_rd_attr(cmd_per_lun, "%hd\n");
+shost_rd_attr(can_queue, "%hd\n");
 shost_rd_attr(sg_tablesize, "%hu\n");
 shost_rd_attr(unchecked_isa_dma, "%d\n");
 shost_rd_attr2(proc_name, hostt->proc_name, "%s\n");
@@ -200,6 +201,7 @@ static struct class_device_attribute *scsi_sysfs_shost_attrs[] = {
         &class_device_attr_unique_id,
         &class_device_attr_host_busy,
         &class_device_attr_cmd_per_lun,
+        &class_device_attr_can_queue,
         &class_device_attr_sg_tablesize,
         &class_device_attr_unchecked_isa_dma,
         &class_device_attr_proc_name,
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 7b0019cccce3..9b25124a989e 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -21,7 +21,6 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  */
 #include <linux/module.h>
-#include <linux/mempool.h>
 #include <linux/mutex.h>
 #include <net/tcp.h>
 #include <scsi/scsi.h>
@@ -34,7 +33,7 @@
 #define ISCSI_SESSION_ATTRS 11
 #define ISCSI_CONN_ATTRS 11
 #define ISCSI_HOST_ATTRS 0
-#define ISCSI_TRANSPORT_VERSION "2.0-685"
+#define ISCSI_TRANSPORT_VERSION "2.0-724"
 
 struct iscsi_internal {
         int daemon_pid;
@@ -149,30 +148,6 @@ static DECLARE_TRANSPORT_CLASS(iscsi_connection_class,
 static struct sock *nls;
 static DEFINE_MUTEX(rx_queue_mutex);
 
-struct mempool_zone {
-        mempool_t *pool;
-        atomic_t allocated;
-        int size;
-        int hiwat;
-        struct list_head freequeue;
-        spinlock_t freelock;
-};
-
-static struct mempool_zone *z_reply;
-
-/*
- * Z_MAX_* - actual mempool size allocated at the mempool_zone_init() time
- * Z_HIWAT_* - zone's high watermark when if_error bit will be set to -ENOMEM
- *             so daemon will notice OOM on NETLINK tranposrt level and will
- *             be able to predict or change operational behavior
- */
-#define Z_MAX_REPLY     8
-#define Z_HIWAT_REPLY   6
-#define Z_MAX_PDU       8
-#define Z_HIWAT_PDU     6
-#define Z_MAX_ERROR     16
-#define Z_HIWAT_ERROR   12
-
 static LIST_HEAD(sesslist);
 static DEFINE_SPINLOCK(sesslock);
 static LIST_HEAD(connlist);
@@ -414,59 +389,11 @@ int iscsi_destroy_session(struct iscsi_cls_session *session)
 }
 EXPORT_SYMBOL_GPL(iscsi_destroy_session);
 
-static void mempool_zone_destroy(struct mempool_zone *zp)
-{
-        mempool_destroy(zp->pool);
-        kfree(zp);
-}
-
-static void*
-mempool_zone_alloc_skb(gfp_t gfp_mask, void *pool_data)
-{
-        struct mempool_zone *zone = pool_data;
-
-        return alloc_skb(zone->size, gfp_mask);
-}
-
-static void
-mempool_zone_free_skb(void *element, void *pool_data)
-{
-        kfree_skb(element);
-}
-
-static struct mempool_zone *
-mempool_zone_init(unsigned max, unsigned size, unsigned hiwat)
-{
-        struct mempool_zone *zp;
-
-        zp = kzalloc(sizeof(*zp), GFP_KERNEL);
-        if (!zp)
-                return NULL;
-
-        zp->size = size;
-        zp->hiwat = hiwat;
-        INIT_LIST_HEAD(&zp->freequeue);
-        spin_lock_init(&zp->freelock);
-        atomic_set(&zp->allocated, 0);
-
-        zp->pool = mempool_create(max, mempool_zone_alloc_skb,
-                                  mempool_zone_free_skb, zp);
-        if (!zp->pool) {
-                kfree(zp);
-                return NULL;
-        }
-
-        return zp;
-}
-
 static void iscsi_conn_release(struct device *dev)
 {
         struct iscsi_cls_conn *conn = iscsi_dev_to_conn(dev);
         struct device *parent = conn->dev.parent;
 
-        mempool_zone_destroy(conn->z_pdu);
-        mempool_zone_destroy(conn->z_error);
-
         kfree(conn);
         put_device(parent);
 }
@@ -476,31 +403,6 @@ static int iscsi_is_conn_dev(const struct device *dev)
         return dev->release == iscsi_conn_release;
 }
 
-static int iscsi_create_event_pools(struct iscsi_cls_conn *conn)
-{
-        conn->z_pdu = mempool_zone_init(Z_MAX_PDU,
-                        NLMSG_SPACE(sizeof(struct iscsi_uevent) +
-                                    sizeof(struct iscsi_hdr) +
-                                    DEFAULT_MAX_RECV_DATA_SEGMENT_LENGTH),
-                        Z_HIWAT_PDU);
-        if (!conn->z_pdu) {
-                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
-                           "pdu zone for new conn\n");
-                return -ENOMEM;
-        }
-
-        conn->z_error = mempool_zone_init(Z_MAX_ERROR,
-                        NLMSG_SPACE(sizeof(struct iscsi_uevent)),
-                        Z_HIWAT_ERROR);
-        if (!conn->z_error) {
-                dev_printk(KERN_ERR, &conn->dev, "iscsi: can not allocate "
-                           "error zone for new conn\n");
-                mempool_zone_destroy(conn->z_pdu);
-                return -ENOMEM;
-        }
-        return 0;
-}
-
 /**
  * iscsi_create_conn - create iscsi class connection
  * @session: iscsi cls session
@@ -533,12 +435,9 @@ iscsi_create_conn(struct iscsi_cls_session *session, uint32_t cid)
         conn->transport = transport;
         conn->cid = cid;
 
-        if (iscsi_create_event_pools(conn))
-                goto free_conn;
-
         /* this is released in the dev's release function */
         if (!get_device(&session->dev))
-                goto free_conn_pools;
+                goto free_conn;
 
         snprintf(conn->dev.bus_id, BUS_ID_SIZE, "connection%d:%u",
                  session->sid, cid);
@@ -555,8 +454,6 @@ iscsi_create_conn(struct iscsi_cls_session *session, uint32_t cid)
 
 release_parent_ref:
         put_device(&session->dev);
-free_conn_pools:
-
 free_conn:
         kfree(conn);
         return NULL;
@@ -599,81 +496,31 @@ iscsi_if_transport_lookup(struct iscsi_transport *tt)
         return NULL;
 }
 
-static inline struct list_head *skb_to_lh(struct sk_buff *skb)
-{
-        return (struct list_head *)&skb->cb;
-}
-
-static void
-mempool_zone_complete(struct mempool_zone *zone)
-{
-        unsigned long flags;
-        struct list_head *lh, *n;
-
-        spin_lock_irqsave(&zone->freelock, flags);
-        list_for_each_safe(lh, n, &zone->freequeue) {
-                struct sk_buff *skb = (struct sk_buff *)((char *)lh -
-                                offsetof(struct sk_buff, cb));
-                if (!skb_shared(skb)) {
-                        list_del(skb_to_lh(skb));
-                        mempool_free(skb, zone->pool);
-                        atomic_dec(&zone->allocated);
-                }
-        }
-        spin_unlock_irqrestore(&zone->freelock, flags);
-}
-
-static struct sk_buff*
-mempool_zone_get_skb(struct mempool_zone *zone)
-{
-        struct sk_buff *skb;
-
-        skb = mempool_alloc(zone->pool, GFP_ATOMIC);
-        if (skb)
-                atomic_inc(&zone->allocated);
-        return skb;
-}
-
 static int
-iscsi_broadcast_skb(struct mempool_zone *zone, struct sk_buff *skb, gfp_t gfp)
+iscsi_broadcast_skb(struct sk_buff *skb, gfp_t gfp)
 {
-        unsigned long flags;
         int rc;
 
-        skb_get(skb);
         rc = netlink_broadcast(nls, skb, 0, 1, gfp);
         if (rc < 0) {
-                mempool_free(skb, zone->pool);
                 printk(KERN_ERR "iscsi: can not broadcast skb (%d)\n", rc);
                 return rc;
         }
 
-        spin_lock_irqsave(&zone->freelock, flags);
-        INIT_LIST_HEAD(skb_to_lh(skb));
-        list_add(skb_to_lh(skb), &zone->freequeue);
-        spin_unlock_irqrestore(&zone->freelock, flags);
         return 0;
 }
 
 static int
-iscsi_unicast_skb(struct mempool_zone *zone, struct sk_buff *skb, int pid)
+iscsi_unicast_skb(struct sk_buff *skb, int pid)
 {
-        unsigned long flags;
         int rc;
 
-        skb_get(skb);
         rc = netlink_unicast(nls, skb, pid, MSG_DONTWAIT);
         if (rc < 0) {
-                mempool_free(skb, zone->pool);
                 printk(KERN_ERR "iscsi: can not unicast skb (%d)\n", rc);
                 return rc;
         }
 
-        spin_lock_irqsave(&zone->freelock, flags);
-        INIT_LIST_HEAD(skb_to_lh(skb));
-        list_add(skb_to_lh(skb), &zone->freequeue);
-        spin_unlock_irqrestore(&zone->freelock, flags);
-
         return 0;
 }
 
@@ -692,9 +539,7 @@ int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
         if (!priv)
                 return -EINVAL;
 
-        mempool_zone_complete(conn->z_pdu);
-
-        skb = mempool_zone_get_skb(conn->z_pdu);
+        skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
                 iscsi_conn_error(conn, ISCSI_ERR_CONN_FAILED);
                 dev_printk(KERN_ERR, &conn->dev, "iscsi: can not deliver "
@@ -707,15 +552,13 @@ int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr,
         memset(ev, 0, sizeof(*ev));
         ev->transport_handle = iscsi_handle(conn->transport);
         ev->type = ISCSI_KEVENT_RECV_PDU;
-        if (atomic_read(&conn->z_pdu->allocated) >= conn->z_pdu->hiwat)
-                ev->iferror = -ENOMEM;
         ev->r.recv_req.cid = conn->cid;
         ev->r.recv_req.sid = iscsi_conn_get_sid(conn);
         pdu = (char*)ev + sizeof(*ev);
         memcpy(pdu, hdr, sizeof(struct iscsi_hdr));
         memcpy(pdu + sizeof(struct iscsi_hdr), data, data_size);
 
-        return iscsi_unicast_skb(conn->z_pdu, skb, priv->daemon_pid);
+        return iscsi_unicast_skb(skb, priv->daemon_pid);
 }
 EXPORT_SYMBOL_GPL(iscsi_recv_pdu);
 
@@ -731,9 +574,7 @@ void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
         if (!priv)
                 return;
 
-        mempool_zone_complete(conn->z_error);
-
-        skb = mempool_zone_get_skb(conn->z_error);
+        skb = alloc_skb(len, GFP_ATOMIC);
         if (!skb) {
                 dev_printk(KERN_ERR, &conn->dev, "iscsi: gracefully ignored "
                           "conn error (%d)\n", error);
@@ -744,13 +585,11 @@ void iscsi_conn_error(struct iscsi_cls_conn *conn, enum iscsi_err error)
         ev = NLMSG_DATA(nlh);
         ev->transport_handle = iscsi_handle(conn->transport);
         ev->type = ISCSI_KEVENT_CONN_ERROR;
-        if (atomic_read(&conn->z_error->allocated) >= conn->z_error->hiwat)
-                ev->iferror = -ENOMEM;
         ev->r.connerror.error = error;
         ev->r.connerror.cid = conn->cid;
         ev->r.connerror.sid = iscsi_conn_get_sid(conn);
 
-        iscsi_broadcast_skb(conn->z_error, skb, GFP_ATOMIC);
+        iscsi_broadcast_skb(skb, GFP_ATOMIC);
 
         dev_printk(KERN_INFO, &conn->dev, "iscsi: detected conn error (%d)\n",
                    error);
@@ -767,9 +606,7 @@ iscsi_if_send_reply(int pid, int seq, int type, int done, int multi,
         int flags = multi ? NLM_F_MULTI : 0;
         int t = done ? NLMSG_DONE : type;
 
-        mempool_zone_complete(z_reply);
-
-        skb = mempool_zone_get_skb(z_reply);
+        skb = alloc_skb(len, GFP_ATOMIC);
         /*
          * FIXME:
          * user is supposed to react on iferror == -ENOMEM;
@@ -780,7 +617,7 @@ iscsi_if_send_reply(int pid, int seq, int type, int done, int multi,
         nlh = __nlmsg_put(skb, pid, seq, t, (len - sizeof(*nlh)), 0);
         nlh->nlmsg_flags = flags;
         memcpy(NLMSG_DATA(nlh), payload, size);
-        return iscsi_unicast_skb(z_reply, skb, pid);
+        return iscsi_unicast_skb(skb, pid);
 }
 
 static int
@@ -810,9 +647,7 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
         do {
                 int actual_size;
 
-                mempool_zone_complete(conn->z_pdu);
-
-                skbstat = mempool_zone_get_skb(conn->z_pdu);
+                skbstat = alloc_skb(len, GFP_ATOMIC);
                 if (!skbstat) {
                         dev_printk(KERN_ERR, &conn->dev, "iscsi: can not "
                                    "deliver stats: OOM\n");
@@ -825,8 +660,6 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
                 memset(evstat, 0, sizeof(*evstat));
                 evstat->transport_handle = iscsi_handle(conn->transport);
                 evstat->type = nlh->nlmsg_type;
-                if (atomic_read(&conn->z_pdu->allocated) >= conn->z_pdu->hiwat)
-                        evstat->iferror = -ENOMEM;
                 evstat->u.get_stats.cid =
                         ev->u.get_stats.cid;
                 evstat->u.get_stats.sid =
@@ -845,7 +678,7 @@ iscsi_if_get_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
                 skb_trim(skbstat, NLMSG_ALIGN(actual_size));
                 nlhstat->nlmsg_len = actual_size;
 
-                err = iscsi_unicast_skb(conn->z_pdu, skbstat, priv->daemon_pid);
+                err = iscsi_unicast_skb(skbstat, priv->daemon_pid);
         } while (err < 0 && err != -ECONNREFUSED);
 
         return err;
@@ -876,9 +709,7 @@ int iscsi_if_destroy_session_done(struct iscsi_cls_conn *conn)
         session = iscsi_dev_to_session(conn->dev.parent);
         shost = iscsi_session_to_shost(session);
 
-        mempool_zone_complete(conn->z_pdu);
-
-        skb = mempool_zone_get_skb(conn->z_pdu);
+        skb = alloc_skb(len, GFP_KERNEL);
         if (!skb) {
                 dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
                           "session creation event\n");
@@ -896,7 +727,7 @@ int iscsi_if_destroy_session_done(struct iscsi_cls_conn *conn)
          * this will occur if the daemon is not up, so we just warn
          * the user and when the daemon is restarted it will handle it
          */
-        rc = iscsi_broadcast_skb(conn->z_pdu, skb, GFP_KERNEL);
+        rc = iscsi_broadcast_skb(skb, GFP_KERNEL);
         if (rc < 0)
                 dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
                           "session destruction event. Check iscsi daemon\n");
@@ -939,9 +770,7 @@ int iscsi_if_create_session_done(struct iscsi_cls_conn *conn)
         session = iscsi_dev_to_session(conn->dev.parent);
         shost = iscsi_session_to_shost(session);
 
-        mempool_zone_complete(conn->z_pdu);
-
-        skb = mempool_zone_get_skb(conn->z_pdu);
+        skb = alloc_skb(len, GFP_KERNEL);
         if (!skb) {
                 dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
                           "session creation event\n");
@@ -959,7 +788,7 @@ int iscsi_if_create_session_done(struct iscsi_cls_conn *conn)
          * this will occur if the daemon is not up, so we just warn
          * the user and when the daemon is restarted it will handle it
          */
-        rc = iscsi_broadcast_skb(conn->z_pdu, skb, GFP_KERNEL);
+        rc = iscsi_broadcast_skb(skb, GFP_KERNEL);
         if (rc < 0)
                 dev_printk(KERN_ERR, &conn->dev, "Cannot notify userspace of "
                           "session creation event. Check iscsi daemon\n");
@@ -1278,9 +1107,6 @@ iscsi_if_rx(struct sock *sk, int len)
                                 err = iscsi_if_send_reply(
                                         NETLINK_CREDS(skb)->pid, nlh->nlmsg_seq,
                                         nlh->nlmsg_type, 0, 0, ev, sizeof(*ev));
-                                if (atomic_read(&z_reply->allocated) >=
-                                                z_reply->hiwat)
-                                        ev->iferror = -ENOMEM;
                         } while (err < 0 && err != -ECONNREFUSED);
                         skb_pull(skb, rlen);
                 }
@@ -1584,32 +1410,6 @@ int iscsi_unregister_transport(struct iscsi_transport *tt)
 }
 EXPORT_SYMBOL_GPL(iscsi_unregister_transport);
 
-static int
-iscsi_rcv_nl_event(struct notifier_block *this, unsigned long event, void *ptr)
-{
-        struct netlink_notify *n = ptr;
-
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_ISCSI && n->pid) {
-                struct iscsi_cls_conn *conn;
-                unsigned long flags;
-
-                mempool_zone_complete(z_reply);
-                spin_lock_irqsave(&connlock, flags);
-                list_for_each_entry(conn, &connlist, conn_list) {
-                        mempool_zone_complete(conn->z_error);
-                        mempool_zone_complete(conn->z_pdu);
-                }
-                spin_unlock_irqrestore(&connlock, flags);
-        }
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block iscsi_nl_notifier = {
-        .notifier_call  = iscsi_rcv_nl_event,
-};
-
 static __init int iscsi_transport_init(void)
 {
         int err;
@@ -1633,25 +1433,15 @@ static __init int iscsi_transport_init(void)
         if (err)
                 goto unregister_conn_class;
 
-        err = netlink_register_notifier(&iscsi_nl_notifier);
-        if (err)
-                goto unregister_session_class;
-
         nls = netlink_kernel_create(NETLINK_ISCSI, 1, iscsi_if_rx,
                         THIS_MODULE);
         if (!nls) {
                 err = -ENOBUFS;
-                goto unregister_notifier;
+                goto unregister_session_class;
         }
 
-        z_reply = mempool_zone_init(Z_MAX_REPLY,
-                NLMSG_SPACE(sizeof(struct iscsi_uevent)), Z_HIWAT_REPLY);
-        if (z_reply)
-                return 0;
+        return 0;
 
-        sock_release(nls->sk_socket);
-unregister_notifier:
-        netlink_unregister_notifier(&iscsi_nl_notifier);
 unregister_session_class:
         transport_class_unregister(&iscsi_session_class);
 unregister_conn_class:
@@ -1665,9 +1455,7 @@ unregister_transport_class:
 
 static void __exit iscsi_transport_exit(void)
 {
-        mempool_zone_destroy(z_reply);
         sock_release(nls->sk_socket);
-        netlink_unregister_notifier(&iscsi_nl_notifier);
         transport_class_unregister(&iscsi_connection_class);
         transport_class_unregister(&iscsi_session_class);
         transport_class_unregister(&iscsi_host_class);
diff --git a/drivers/scsi/seagate.c b/drivers/scsi/seagate.c
index 8ff1f2866f7b..5ffec2721b28 100644
--- a/drivers/scsi/seagate.c
+++ b/drivers/scsi/seagate.c
@@ -97,8 +97,8 @@
 #include <linux/blkdev.h>
 #include <linux/stat.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 
-#include <asm/io.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 3f8b93188567..81e3bc7b02a1 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -60,7 +60,7 @@ static int sg_version_num = 30534;	/* 2 digits for each component */
 
 #ifdef CONFIG_SCSI_PROC_FS
 #include <linux/proc_fs.h>
-static char *sg_version_date = "20060920";
+static char *sg_version_date = "20061027";
 
 static int sg_proc_init(void);
 static void sg_proc_cleanup(void);
@@ -710,12 +710,12 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                           (int) cmnd[0], (int) hp->cmd_len));
 
         if ((k = sg_start_req(srp))) {
-                SCSI_LOG_TIMEOUT(1, printk("sg_write: start_req err=%d\n", k));
+                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: start_req err=%d\n", k));
                 sg_finish_rem_req(srp);
                 return k;       /* probably out of space --> ENOMEM */
         }
         if ((k = sg_write_xfer(srp))) {
-                SCSI_LOG_TIMEOUT(1, printk("sg_write: write_xfer, bad address\n"));
+                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: write_xfer, bad address\n"));
                 sg_finish_rem_req(srp);
                 return k;
         }
@@ -746,7 +746,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
                                 hp->dxfer_len, srp->data.k_use_sg, timeout,
                                 SG_DEFAULT_RETRIES, srp, sg_cmd_done,
                                 GFP_ATOMIC)) {
-                SCSI_LOG_TIMEOUT(1, printk("sg_write: scsi_execute_async failed\n"));
+                SCSI_LOG_TIMEOUT(1, printk("sg_common_write: scsi_execute_async failed\n"));
                 /*
                  * most likely out of mem, but could also be a bad map
                  */
@@ -1283,7 +1283,7 @@ sg_cmd_done(void *data, char *sense, int result, int resid)
                 sg_finish_rem_req(srp);
                 srp = NULL;
                 if (NULL == sfp->headrp) {
-                        SCSI_LOG_TIMEOUT(1, printk("sg...bh: already closed, final cleanup\n"));
+                        SCSI_LOG_TIMEOUT(1, printk("sg_cmd_done: already closed, final cleanup\n"));
                         if (0 == sg_remove_sfp(sdp, sfp)) {     /* device still present */
                                 scsi_device_put(sdp->device);
                         }
@@ -1512,12 +1512,12 @@ sg_remove(struct class_device *cl_dev, struct class_interface *cl_intf)
                                                     POLL_HUP);
                                 }
                         }
-                        SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d, dirty\n", k));
+                        SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d, dirty\n", k));
                         if (NULL == sdp->headfp) {
                                 sg_dev_arr[k] = NULL;
                         }
                 } else {        /* nothing active, simple case */
-                        SCSI_LOG_TIMEOUT(3, printk("sg_detach: dev=%d\n", k));
+                        SCSI_LOG_TIMEOUT(3, printk("sg_remove: dev=%d\n", k));
                         sg_dev_arr[k] = NULL;
                 }
                 sg_nr_dev--;
@@ -1876,14 +1876,15 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size)
                         }
                 }
                 sg->page = p;
-                sg->length = ret_sz;
+                sg->length = (ret_sz > num) ? num : ret_sz;
 
-                SCSI_LOG_TIMEOUT(5, printk("sg_build_build: k=%d, a=0x%p, len=%d\n",
-                                  k, p, ret_sz));
+                SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k=%d, num=%d, "
+                                 "ret_sz=%d\n", k, num, ret_sz));
         }               /* end of for loop */
 
         schp->k_use_sg = k;
-        SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, rem_sz=%d\n", k, rem_sz));
+        SCSI_LOG_TIMEOUT(5, printk("sg_build_indirect: k_use_sg=%d, "
+                         "rem_sz=%d\n", k, rem_sz));
 
         schp->bufflen = blk_size;
         if (rem_sz > 0) /* must have failed */
@@ -2014,7 +2015,7 @@ sg_remove_scat(Sg_scatter_hold * schp)
                         for (k = 0; (k < schp->k_use_sg) && sg->page;
                              ++k, ++sg) {
                                 SCSI_LOG_TIMEOUT(5, printk(
-                                    "sg_remove_scat: k=%d, a=0x%p, len=%d\n",
+                                    "sg_remove_scat: k=%d, pg=0x%p, len=%d\n",
                                     k, sg->page, sg->length));
                                 sg_page_free(sg->page, sg->length);
                         }
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index febfac97ad38..587274dd7059 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -1177,7 +1177,10 @@ static int st_open(struct inode *inode, struct file *filp)
                 goto err_out;
         if ((filp->f_flags & O_NONBLOCK) == 0 &&
             retval != CHKRES_READY) {
-                retval = (-EIO);
+                if (STp->ready == NO_TAPE)
+                        retval = (-ENOMEDIUM);
+                else
+                        retval = (-EIO);
                 goto err_out;
         }
         return 0;
diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
index 5ec5af8e3379..3b3f3050a877 100644
--- a/drivers/scsi/sun3_NCR5380.c
+++ b/drivers/scsi/sun3_NCR5380.c
@@ -266,8 +266,8 @@ static struct scsi_host_template *the_template = NULL;
         (struct NCR5380_hostdata *)(in)->hostdata
 #define HOSTDATA(in) ((struct NCR5380_hostdata *)(in)->hostdata)
 
-#define NEXT(cmd)       ((Scsi_Cmnd *)((cmd)->host_scribble))
-#define NEXTADDR(cmd)   ((Scsi_Cmnd **)&((cmd)->host_scribble))
+#define NEXT(cmd)       ((struct scsi_cmnd *)((cmd)->host_scribble))
+#define NEXTADDR(cmd)   ((struct scsi_cmnd **)&((cmd)->host_scribble))
 
 #define HOSTNO          instance->host_no
 #define H_NO(cmd)       (cmd)->device->host->host_no
@@ -360,7 +360,7 @@ static void __init init_tags( void )
  * conditions.
  */ 
 
-static int is_lun_busy( Scsi_Cmnd *cmd, int should_be_tagged )
+static int is_lun_busy(struct scsi_cmnd *cmd, int should_be_tagged)
 {
     SETUP_HOSTDATA(cmd->device->host);
 
@@ -384,7 +384,7 @@ static int is_lun_busy( Scsi_Cmnd *cmd, int should_be_tagged )
  * untagged.
  */
 
-static void cmd_get_tag( Scsi_Cmnd *cmd, int should_be_tagged )
+static void cmd_get_tag(struct scsi_cmnd *cmd, int should_be_tagged)
 {
     SETUP_HOSTDATA(cmd->device->host);
 
@@ -416,7 +416,7 @@ static void cmd_get_tag( Scsi_Cmnd *cmd, int should_be_tagged )
  * unlock the LUN.
  */
 
-static void cmd_free_tag( Scsi_Cmnd *cmd )
+static void cmd_free_tag(struct scsi_cmnd *cmd)
 {
     SETUP_HOSTDATA(cmd->device->host);
 
@@ -460,18 +460,18 @@ static void free_all_tags( void )
 
 
 /*
- * Function: void merge_contiguous_buffers( Scsi_Cmnd *cmd )
+ * Function: void merge_contiguous_buffers(struct scsi_cmnd *cmd)
  *
  * Purpose: Try to merge several scatter-gather requests into one DMA
  *    transfer. This is possible if the scatter buffers lie on
  *    physical contiguous addresses.
  *
- * Parameters: Scsi_Cmnd *cmd
+ * Parameters: struct scsi_cmnd *cmd
  *    The command to work on. The first scatter buffer's data are
  *    assumed to be already transfered into ptr/this_residual.
  */
 
-static void merge_contiguous_buffers( Scsi_Cmnd *cmd )
+static void merge_contiguous_buffers(struct scsi_cmnd *cmd)
 {
     unsigned long endaddr;
 #if (NDEBUG & NDEBUG_MERGING)
@@ -501,15 +501,15 @@ static void merge_contiguous_buffers( Scsi_Cmnd *cmd )
 }
 
 /*
- * Function : void initialize_SCp(Scsi_Cmnd *cmd)
+ * Function : void initialize_SCp(struct scsi_cmnd *cmd)
  *
  * Purpose : initialize the saved data pointers for cmd to point to the 
  *      start of the buffer.
  *
- * Inputs : cmd - Scsi_Cmnd structure to have pointers reset.
+ * Inputs : cmd - struct scsi_cmnd structure to have pointers reset.
  */
 
-static __inline__ void initialize_SCp(Scsi_Cmnd *cmd)
+static __inline__ void initialize_SCp(struct scsi_cmnd *cmd)
 {
     /* 
      * Initialize the Scsi Pointer field so that all of the commands in the 
@@ -753,14 +753,15 @@ static void NCR5380_print_status (struct Scsi_Host *instance)
   do { if (pos + strlen(fmt) + 20 /* slop */ < buffer + length) \
          pos += sprintf(pos, fmt , ## args); } while(0)
 static
-char *lprint_Scsi_Cmnd (Scsi_Cmnd *cmd, char *pos, char *buffer, int length);
+char *lprint_Scsi_Cmnd(struct scsi_cmnd *cmd, char *pos, char *buffer,
+                       int length);
 
-static int NCR5380_proc_info (struct Scsi_Host *instance, char *buffer, char **start,
-                       off_t offset, int length, int inout)
+static int NCR5380_proc_info(struct Scsi_Host *instance, char *buffer,
+                             char **start, off_t offset, int length, int inout)
 {
     char *pos = buffer;
     struct NCR5380_hostdata *hostdata;
-    Scsi_Cmnd *ptr;
+    struct scsi_cmnd *ptr;
     unsigned long flags;
     off_t begin = 0;
 #define check_offset()                          \
@@ -784,18 +785,19 @@ static int NCR5380_proc_info (struct Scsi_Host *instance, char *buffer, char **s
     if (!hostdata->connected)
         SPRINTF("scsi%d: no currently connected command\n", HOSTNO);
     else
-        pos = lprint_Scsi_Cmnd ((Scsi_Cmnd *) hostdata->connected,
+        pos = lprint_Scsi_Cmnd ((struct scsi_cmnd *) hostdata->connected,
                                 pos, buffer, length);
     SPRINTF("scsi%d: issue_queue\n", HOSTNO);
     check_offset();
-    for (ptr = (Scsi_Cmnd *) hostdata->issue_queue; ptr; ptr = NEXT(ptr)) {
+    for (ptr = (struct scsi_cmnd *) hostdata->issue_queue; ptr; ptr = NEXT(ptr))
+    {
         pos = lprint_Scsi_Cmnd (ptr, pos, buffer, length);
         check_offset();
     }
 
     SPRINTF("scsi%d: disconnected_queue\n", HOSTNO);
     check_offset();
-    for (ptr = (Scsi_Cmnd *) hostdata->disconnected_queue; ptr;
+    for (ptr = (struct scsi_cmnd *) hostdata->disconnected_queue; ptr;
          ptr = NEXT(ptr)) {
         pos = lprint_Scsi_Cmnd (ptr, pos, buffer, length);
         check_offset();
@@ -810,8 +812,8 @@ static int NCR5380_proc_info (struct Scsi_Host *instance, char *buffer, char **s
     return length;
 }
 
-static char *
-lprint_Scsi_Cmnd (Scsi_Cmnd *cmd, char *pos, char *buffer, int length)
+static char *lprint_Scsi_Cmnd(struct scsi_cmnd *cmd, char *pos, char *buffer,
+                              int length)
 {
     int i, s;
     unsigned char *command;
@@ -888,8 +890,8 @@ static int NCR5380_init (struct Scsi_Host *instance, int flags)
 }
 
 /* 
- * Function : int NCR5380_queue_command (Scsi_Cmnd *cmd, 
- *      void (*done)(Scsi_Cmnd *)) 
+ * Function : int NCR5380_queue_command (struct scsi_cmnd *cmd,
+ *      void (*done)(struct scsi_cmnd *))
  *
  * Purpose :  enqueues a SCSI command
  *
@@ -906,10 +908,11 @@ static int NCR5380_init (struct Scsi_Host *instance, int flags)
  */
 
 /* Only make static if a wrapper function is used */
-static int NCR5380_queue_command (Scsi_Cmnd *cmd, void (*done)(Scsi_Cmnd *))
+static int NCR5380_queue_command(struct scsi_cmnd *cmd,
+                                 void (*done)(struct scsi_cmnd *))
 {
     SETUP_HOSTDATA(cmd->device->host);
-    Scsi_Cmnd *tmp;
+    struct scsi_cmnd *tmp;
     unsigned long flags;
 
 #if (NDEBUG & NDEBUG_NO_WRITE)
@@ -990,7 +993,7 @@ static int NCR5380_queue_command (Scsi_Cmnd *cmd, void (*done)(Scsi_Cmnd *))
         NEXT(cmd) = hostdata->issue_queue;
         hostdata->issue_queue = cmd;
     } else {
-        for (tmp = (Scsi_Cmnd *)hostdata->issue_queue;
+        for (tmp = (struct scsi_cmnd *)hostdata->issue_queue;
              NEXT(tmp); tmp = NEXT(tmp))
             ;
         LIST(cmd, tmp);
@@ -1030,7 +1033,7 @@ static int NCR5380_queue_command (Scsi_Cmnd *cmd, void (*done)(Scsi_Cmnd *))
     
 static void NCR5380_main (void *bl)
 {
-    Scsi_Cmnd *tmp, *prev;
+    struct scsi_cmnd *tmp, *prev;
     struct Scsi_Host *instance = first_instance;
     struct NCR5380_hostdata *hostdata = HOSTDATA(instance);
     int done;
@@ -1073,12 +1076,12 @@ static void NCR5380_main (void *bl)
              * for a target that's not busy.
              */
 #if (NDEBUG & NDEBUG_LISTS)
-            for (tmp = (Scsi_Cmnd *) hostdata->issue_queue, prev = NULL;
+            for (tmp = (struct scsi_cmnd *) hostdata->issue_queue, prev = NULL;
                  tmp && (tmp != prev); prev = tmp, tmp = NEXT(tmp))
                 ;
             if ((tmp == prev) && tmp) printk(" LOOP\n");/* else printk("\n");*/
 #endif
-            for (tmp = (Scsi_Cmnd *) hostdata->issue_queue, 
+            for (tmp = (struct scsi_cmnd *) hostdata->issue_queue,
                  prev = NULL; tmp; prev = tmp, tmp = NEXT(tmp) ) {
 
 #if (NDEBUG & NDEBUG_LISTS)
@@ -1339,7 +1342,8 @@ static irqreturn_t NCR5380_intr (int irq, void *dev_id)
 }
 
 #ifdef NCR5380_STATS
-static void collect_stats(struct NCR5380_hostdata* hostdata, Scsi_Cmnd* cmd)
+static void collect_stats(struct NCR5380_hostdata *hostdata,
+                          struct scsi_cmnd *cmd)
 {
 # ifdef NCR5380_STAT_LIMIT
     if (cmd->request_bufflen > NCR5380_STAT_LIMIT)
@@ -1365,8 +1369,8 @@ static void collect_stats(struct NCR5380_hostdata* hostdata, Scsi_Cmnd* cmd)
 #endif
 
 /* 
- * Function : int NCR5380_select (struct Scsi_Host *instance, Scsi_Cmnd *cmd, 
- *      int tag);
+ * Function : int NCR5380_select(struct Scsi_Host *instance,
+ *                               struct scsi_cmnd *cmd, int tag);
  *
  * Purpose : establishes I_T_L or I_T_L_Q nexus for new or existing command,
  *      including ARBITRATION, SELECTION, and initial message out for 
@@ -1395,7 +1399,8 @@ static void collect_stats(struct NCR5380_hostdata* hostdata, Scsi_Cmnd* cmd)
  *              cmd->result host byte set to DID_BAD_TARGET.
  */
 
-static int NCR5380_select (struct Scsi_Host *instance, Scsi_Cmnd *cmd, int tag)
+static int NCR5380_select(struct Scsi_Host *instance, struct scsi_cmnd *cmd,
+                          int tag)
 {
     SETUP_HOSTDATA(instance);
     unsigned char tmp[3], phase;
@@ -1985,7 +1990,7 @@ static void NCR5380_information_transfer (struct Scsi_Host *instance)
 #endif
     unsigned char *data;
     unsigned char phase, tmp, extended_msg[10], old_phase=0xff;
-    Scsi_Cmnd *cmd = (Scsi_Cmnd *) hostdata->connected;
+    struct scsi_cmnd *cmd = (struct scsi_cmnd *) hostdata->connected;
 
 #ifdef SUN3_SCSI_VME
     dregs->csr |= CSR_INTR;
@@ -2272,7 +2277,7 @@ static void NCR5380_information_transfer (struct Scsi_Host *instance)
                         local_irq_save(flags);
                         LIST(cmd,hostdata->issue_queue);
                         NEXT(cmd) = hostdata->issue_queue;
-                        hostdata->issue_queue = (Scsi_Cmnd *) cmd;
+                        hostdata->issue_queue = (struct scsi_cmnd *) cmd;
                         local_irq_restore(flags);
                         QU_PRINTK("scsi%d: REQUEST SENSE added to head of "
                                   "issue queue\n", H_NO(cmd));
@@ -2502,7 +2507,7 @@ static void NCR5380_information_transfer (struct Scsi_Host *instance)
  * Function : void NCR5380_reselect (struct Scsi_Host *instance)
  *
  * Purpose : does reselection, initializing the instance->connected 
- *      field to point to the Scsi_Cmnd for which the I_T_L or I_T_L_Q 
+ *      field to point to the struct scsi_cmnd for which the I_T_L or I_T_L_Q
  *      nexus has been reestablished,
  *      
  * Inputs : instance - this instance of the NCR5380.
@@ -2521,7 +2526,7 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
     unsigned char tag;
 #endif
     unsigned char msg[3];
-    Scsi_Cmnd *tmp = NULL, *prev;
+    struct scsi_cmnd *tmp = NULL, *prev;
 /*    unsigned long flags; */
 
     /*
@@ -2577,7 +2582,7 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
      * just reestablished, and remove it from the disconnected queue.
      */
 
-    for (tmp = (Scsi_Cmnd *) hostdata->disconnected_queue, prev = NULL; 
+    for (tmp = (struct scsi_cmnd *) hostdata->disconnected_queue, prev = NULL;
          tmp; prev = tmp, tmp = NEXT(tmp) ) {
         if ((target_mask == (1 << tmp->device->id)) && (lun == tmp->device->lun)
 #ifdef SUPPORT_TAGS
@@ -2668,11 +2673,11 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
 
 
 /*
- * Function : int NCR5380_abort (Scsi_Cmnd *cmd)
+ * Function : int NCR5380_abort(struct scsi_cmnd *cmd)
  *
  * Purpose : abort a command
  *
- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the 
+ * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
  *      host byte of the result field to, if zero DID_ABORTED is 
  *      used.
  *
@@ -2684,11 +2689,11 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
  *       called where the loop started in NCR5380_main().
  */
 
-static int NCR5380_abort (Scsi_Cmnd *cmd)
+static int NCR5380_abort(struct scsi_cmnd *cmd)
 {
     struct Scsi_Host *instance = cmd->device->host;
     SETUP_HOSTDATA(instance);
-    Scsi_Cmnd *tmp, **prev;
+    struct scsi_cmnd *tmp, **prev;
     unsigned long flags;
 
     printk(KERN_NOTICE "scsi%d: aborting command\n", HOSTNO);
@@ -2753,9 +2758,9 @@ static int NCR5380_abort (Scsi_Cmnd *cmd)
  * Case 2 : If the command hasn't been issued yet, we simply remove it 
  *          from the issue queue.
  */
-    for (prev = (Scsi_Cmnd **) &(hostdata->issue_queue), 
-        tmp = (Scsi_Cmnd *) hostdata->issue_queue;
-        tmp; prev = NEXTADDR(tmp), tmp = NEXT(tmp) )
+    for (prev = (struct scsi_cmnd **) &(hostdata->issue_queue),
+        tmp = (struct scsi_cmnd *) hostdata->issue_queue;
+        tmp; prev = NEXTADDR(tmp), tmp = NEXT(tmp))
         if (cmd == tmp) {
             REMOVE(5, *prev, tmp, NEXT(tmp));
             (*prev) = NEXT(tmp);
@@ -2812,7 +2817,7 @@ static int NCR5380_abort (Scsi_Cmnd *cmd)
  * it from the disconnected queue.
  */
 
-    for (tmp = (Scsi_Cmnd *) hostdata->disconnected_queue; tmp;
+    for (tmp = (struct scsi_cmnd *) hostdata->disconnected_queue; tmp;
          tmp = NEXT(tmp)) 
         if (cmd == tmp) {
             local_irq_restore(flags);
@@ -2826,8 +2831,8 @@ static int NCR5380_abort (Scsi_Cmnd *cmd)
             do_abort (instance);
 
             local_irq_save(flags);
-            for (prev = (Scsi_Cmnd **) &(hostdata->disconnected_queue), 
-                tmp = (Scsi_Cmnd *) hostdata->disconnected_queue;
+            for (prev = (struct scsi_cmnd **) &(hostdata->disconnected_queue),
+                tmp = (struct scsi_cmnd *) hostdata->disconnected_queue;
                 tmp; prev = NEXTADDR(tmp), tmp = NEXT(tmp) )
                     if (cmd == tmp) {
                     REMOVE(5, *prev, tmp, NEXT(tmp));
@@ -2868,7 +2873,7 @@ static int NCR5380_abort (Scsi_Cmnd *cmd)
 
 
 /* 
- * Function : int NCR5380_bus_reset (Scsi_Cmnd *cmd)
+ * Function : int NCR5380_bus_reset(struct scsi_cmnd *cmd)
  * 
  * Purpose : reset the SCSI bus.
  *
@@ -2876,13 +2881,13 @@ static int NCR5380_abort (Scsi_Cmnd *cmd)
  *
  */ 
 
-static int NCR5380_bus_reset( Scsi_Cmnd *cmd)
+static int NCR5380_bus_reset(struct scsi_cmnd *cmd)
 {
     SETUP_HOSTDATA(cmd->device->host);
     int           i;
     unsigned long flags;
 #if 1
-    Scsi_Cmnd *connected, *disconnected_queue;
+    struct scsi_cmnd *connected, *disconnected_queue;
 #endif
 
 
@@ -2914,9 +2919,9 @@ static int NCR5380_bus_reset( Scsi_Cmnd *cmd)
      * remembered in local variables first.
      */
     local_irq_save(flags);
-    connected = (Scsi_Cmnd *)hostdata->connected;
+    connected = (struct scsi_cmnd *)hostdata->connected;
     hostdata->connected = NULL;
-    disconnected_queue = (Scsi_Cmnd *)hostdata->disconnected_queue;
+    disconnected_queue = (struct scsi_cmnd *)hostdata->disconnected_queue;
     hostdata->disconnected_queue = NULL;
 #ifdef SUPPORT_TAGS
     free_all_tags();
diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c
index e625b4c5833a..d56d85dd9ba0 100644
--- a/drivers/scsi/sun3_scsi.c
+++ b/drivers/scsi/sun3_scsi.c
@@ -119,7 +119,7 @@ module_param(setup_use_tagged_queuing, int, 0);
 static int setup_hostid = -1;
 module_param(setup_hostid, int, 0);
 
-static Scsi_Cmnd *sun3_dma_setup_done = NULL;
+static struct scsi_cmnd *sun3_dma_setup_done = NULL;
 
 #define AFTER_RESET_DELAY       (HZ/2)
 
@@ -521,8 +521,9 @@ static inline unsigned long sun3scsi_dma_residual(struct Scsi_Host *instance)
         return last_residual;
 }
 
-static inline unsigned long sun3scsi_dma_xfer_len(unsigned long wanted, Scsi_Cmnd *cmd,
-                                    int write_flag)
+static inline unsigned long sun3scsi_dma_xfer_len(unsigned long wanted,
+                                                  struct scsi_cmnd *cmd,
+                                                  int write_flag)
 {
         if(blk_fs_request(cmd->request))
                 return wanted;
diff --git a/drivers/scsi/sun3_scsi.h b/drivers/scsi/sun3_scsi.h
index 834dab428019..a1103b3e2034 100644
--- a/drivers/scsi/sun3_scsi.h
+++ b/drivers/scsi/sun3_scsi.h
@@ -47,11 +47,12 @@
 
 #define IOBASE_SUN3_VMESCSI 0xff200000
 
-static int sun3scsi_abort (Scsi_Cmnd *);
+static int sun3scsi_abort(struct scsi_cmnd *);
 static int sun3scsi_detect (struct scsi_host_template *);
 static const char *sun3scsi_info (struct Scsi_Host *);
-static int sun3scsi_bus_reset(Scsi_Cmnd *);
-static int sun3scsi_queue_command (Scsi_Cmnd *, void (*done)(Scsi_Cmnd *));
+static int sun3scsi_bus_reset(struct scsi_cmnd *);
+static int sun3scsi_queue_command(struct scsi_cmnd *,
+                                  void (*done)(struct scsi_cmnd *));
 static int sun3scsi_release (struct Scsi_Host *);
 
 #ifndef CMD_PER_LUN
diff --git a/drivers/scsi/sun3_scsi_vme.c b/drivers/scsi/sun3_scsi_vme.c
index e8faab16567b..92def310a84c 100644
--- a/drivers/scsi/sun3_scsi_vme.c
+++ b/drivers/scsi/sun3_scsi_vme.c
@@ -84,7 +84,7 @@ module_param(setup_use_tagged_queuing, int, 0);
 static int setup_hostid = -1;
 module_param(setup_hostid, int, 0);
 
-static Scsi_Cmnd *sun3_dma_setup_done = NULL;
+static struct scsi_cmnd *sun3_dma_setup_done = NULL;
 
 #define AFTER_RESET_DELAY       (HZ/2)
 
@@ -455,8 +455,9 @@ static inline unsigned long sun3scsi_dma_residual(struct Scsi_Host *instance)
         return last_residual;
 }
 
-static inline unsigned long sun3scsi_dma_xfer_len(unsigned long wanted, Scsi_Cmnd *cmd,
-                                    int write_flag)
+static inline unsigned long sun3scsi_dma_xfer_len(unsigned long wanted,
+                                                  struct scsi_cmnd *cmd,
+                                                  int write_flag)
 {
         if(blk_fs_request(cmd->request))
                 return wanted;
diff --git a/drivers/scsi/t128.c b/drivers/scsi/t128.c
index 2df6747cb76f..0b7a70f61e0d 100644
--- a/drivers/scsi/t128.c
+++ b/drivers/scsi/t128.c
@@ -109,7 +109,7 @@
 #include <asm/system.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/blkdev.h>
 #include <linux/interrupt.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/tmscsim.c b/drivers/scsi/tmscsim.c
index d03aa6ce8fe8..fa5382e354be 100644
--- a/drivers/scsi/tmscsim.c
+++ b/drivers/scsi/tmscsim.c
@@ -2304,6 +2304,7 @@ static struct scsi_host_template driver_template = {
         .sg_tablesize           = SG_ALL,
         .cmd_per_lun            = 1,
         .use_clustering         = ENABLE_CLUSTERING,
+        .max_sectors            = 0x4000, /* 8MiB = 16 * 1024 * 512 */
 };
 
 /***********************************************************************
diff --git a/drivers/scsi/wd7000.c b/drivers/scsi/wd7000.c
index 331e1cf159b0..30be76514c43 100644
--- a/drivers/scsi/wd7000.c
+++ b/drivers/scsi/wd7000.c
@@ -178,10 +178,10 @@
 #include <linux/blkdev.h>
 #include <linux/init.h>
 #include <linux/stat.h>
+#include <linux/io.h>
 
 #include <asm/system.h>
 #include <asm/dma.h>
-#include <asm/io.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index b0d502622d94..0b71e7d18903 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -767,37 +767,37 @@ config SERIAL_CPM_SCC1
         bool "Support for SCC1 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SCC1 as a serial port
+          Select this option to use SCC1 as a serial port
 
 config SERIAL_CPM_SCC2
         bool "Support for SCC2 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SCC2 as a serial port
+          Select this option to use SCC2 as a serial port
 
 config SERIAL_CPM_SCC3
         bool "Support for SCC3 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SCC3 as a serial port
+          Select this option to use SCC3 as a serial port
 
 config SERIAL_CPM_SCC4
         bool "Support for SCC4 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SCC4 as a serial port
+          Select this option to use SCC4 as a serial port
 
 config SERIAL_CPM_SMC1
         bool "Support for SMC1 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SMC1 as a serial port
+          Select this option to use SMC1 as a serial port
 
 config SERIAL_CPM_SMC2
         bool "Support for SMC2 serial port"
         depends on SERIAL_CPM=y
         help
-          Select the is option to use SMC2 as a serial port
+          Select this option to use SMC2 as a serial port
 
 config SERIAL_SGI_L1_CONSOLE
         bool "SGI Altix L1 serial console support"
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index a8f894c78194..69715e556506 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -88,7 +88,7 @@ extern struct uart_cpm_port cpm_uart_ports[UART_NR];
 
 /* these are located in their respective files */
 void cpm_line_cr_cmd(int line, int cmd);
-int cpm_uart_init_portdesc(void);
+int __init cpm_uart_init_portdesc(void);
 int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con);
 void cpm_uart_freebuf(struct uart_cpm_port *pinfo);
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 0abb544ae63d..7a3b97fdf8d1 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -195,10 +195,8 @@ static void cpm_uart_start_tx(struct uart_port *port)
         if (cpm_uart_tx_pump(port) != 0) {
                 if (IS_SMC(pinfo)) {
                         smcp->smc_smcm |= SMCM_TX;
-                        smcp->smc_smcmr |= SMCMR_TEN;
                 } else {
                         sccp->scc_sccm |= UART_SCCM_TX;
-                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
                 }
         }
 }
@@ -421,9 +419,10 @@ static int cpm_uart_startup(struct uart_port *port)
         /* Startup rx-int */
         if (IS_SMC(pinfo)) {
                 pinfo->smcp->smc_smcm |= SMCM_RX;
-                pinfo->smcp->smc_smcmr |= SMCMR_REN;
+                pinfo->smcp->smc_smcmr |= (SMCMR_REN | SMCMR_TEN);
         } else {
                 pinfo->sccp->scc_sccm |= UART_SCCM_RX;
+                pinfo->sccp->scc_gsmrl |= (SCC_GSMRL_ENR | SCC_GSMRL_ENT);
         }
 
         if (!(pinfo->flags & FLAG_CONSOLE))
@@ -1350,11 +1349,10 @@ static int cpm_uart_init(void) {
                 pr_info("cpm_uart: WARNING: no UART devices found on platform bus!\n");
                 pr_info(
                 "cpm_uart: the driver will guess configuration, but this mode is no longer supported.\n");
-#ifndef CONFIG_SERIAL_CPM_CONSOLE
-                ret = cpm_uart_init_portdesc();
-                if (ret)
-                        return ret;
-#endif
+
+                /* Don't run this again, if the console driver did it already */
+                if (cpm_uart_nr == 0)
+                        cpm_uart_init_portdesc();
 
                 cpm_reg.nr = cpm_uart_nr;
                 ret = uart_register_driver(&cpm_reg);
@@ -1366,6 +1364,8 @@ static int cpm_uart_init(void) {
                         int con = cpm_uart_port_map[i];
                         cpm_uart_ports[con].port.line = i;
                         cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
+                        if (cpm_uart_ports[con].set_lineif)
+                                cpm_uart_ports[con].set_lineif(&cpm_uart_ports[con]);
                         uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
                 }
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 95afc37297a8..08e55fdc882a 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -184,7 +184,7 @@ void cpm_uart_freebuf(struct uart_cpm_port *pinfo)
 }
 
 /* Setup any dynamic params in the uart desc */
-int cpm_uart_init_portdesc(void)
+int __init cpm_uart_init_portdesc(void)
 {
         pr_debug("CPM uart[-]:init portdesc\n");
 
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 98ce88d80207..711bd1511439 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -921,7 +921,7 @@ static void handle_dma_error_intr(void *arg, uint32_t other_ir)
 {
         struct ioc4_port *port = (struct ioc4_port *)arg;
         struct hooks *hooks = port->ip_hooks;
-        unsigned int flags;
+        unsigned long flags;
 
         spin_lock_irqsave(&port->ip_lock, flags);
 
@@ -1834,7 +1834,7 @@ static void handle_intr(void *arg, uint32_t sio_ir)
         struct ioc4_port *port = (struct ioc4_port *)arg;
         struct hooks *hooks = port->ip_hooks;
         unsigned int rx_high_rd_aborted = 0;
-        unsigned int flags;
+        unsigned long flags;
         struct uart_port *the_port;
         int loop_counter;
 
@@ -2935,7 +2935,7 @@ static void __devexit ioc4_serial_exit(void)
         uart_unregister_driver(&ioc4_uart_rs422);
 }
 
-module_init(ioc4_serial_init);
+late_initcall(ioc4_serial_init); /* Call only after tty init is done */
 module_exit(ioc4_serial_exit);
 
 MODULE_AUTHOR("Pat Gefre - Silicon Graphics Inc. (SGI) <pfg@sgi.com>");
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 266aa325569e..cfcc3caf49d8 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -808,7 +808,7 @@ static int sci_request_irq(struct sci_port *port)
                 }
 
                 if (request_irq(port->irqs[0], sci_mpxed_interrupt,
-                                SA_INTERRUPT, "sci", port)) {
+                                IRQF_DISABLED, "sci", port)) {
                         printk(KERN_ERR "sci: Cannot allocate irq.\n");
                         return -ENODEV;
                 }
@@ -817,7 +817,7 @@ static int sci_request_irq(struct sci_port *port)
                         if (!port->irqs[i])
                                 continue;
                         if (request_irq(port->irqs[i], handlers[i],
-                                        SA_INTERRUPT, desc[i], port)) {
+                                        IRQF_DISABLED, desc[i], port)) {
                                 printk(KERN_ERR "sci: Cannot allocate irq.\n");
                                 return -ENODEV;
                         }
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 73dd2eedaaad..b2cc703b2b9e 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1182,7 +1182,7 @@ static int __init sunzilog_console_setup(struct console *con, char *options)
         return 0;
 }
 
-static struct console sunzilog_console = {
+static struct console sunzilog_console_ops = {
         .name   =       "ttyS",
         .write  =       sunzilog_console_write,
         .device =       uart_console_device,
@@ -1208,10 +1208,10 @@ static inline struct console *SUNZILOG_CONSOLE(void)
         if (i == NUM_CHANNELS)
                 return NULL;
 
-        sunzilog_console.index = i;
+        sunzilog_console_ops.index = i;
         sunzilog_port_table[i].flags |= SUNZILOG_FLAG_IS_CONS;
 
-        return &sunzilog_console;
+        return &sunzilog_console_ops;
 }
 
 #else
diff --git a/drivers/sn/Kconfig b/drivers/sn/Kconfig
index a34731625877..c66ba9ad833d 100644
--- a/drivers/sn/Kconfig
+++ b/drivers/sn/Kconfig
@@ -5,19 +5,6 @@
 menu "SN Devices"
         depends on SGI_SN
 
-config SGI_IOC4
-        tristate "SGI IOC4 Base IO support"
-        depends on MMTIMER
-        default m
-        ---help---
-        This option enables basic support for the SGI IOC4-based Base IO
-        controller card.  This option does not enable any specific
-        functions on such a card, but provides necessary infrastructure
-        for other drivers to utilize.
-
-        If you have an SGI Altix with an IOC4-based
-        I/O controller say Y.  Otherwise say N.
-
 config SGI_IOC3
         tristate "SGI IOC3 Base IO support"
         default m
diff --git a/drivers/sn/Makefile b/drivers/sn/Makefile
index 2cda011597c0..693db8bb8d9c 100644
--- a/drivers/sn/Makefile
+++ b/drivers/sn/Makefile
@@ -3,5 +3,4 @@
 #
 #
 
-obj-$(CONFIG_SGI_IOC4) += ioc4.o
 obj-$(CONFIG_SGI_IOC3) += ioc3.o
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 146298ad7371..c3c0626f550b 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -281,7 +281,6 @@ spi_register_board_info(struct spi_board_info const *info, unsigned n)
         up(&board_lock);
         return 0;
 }
-EXPORT_SYMBOL_GPL(spi_register_board_info);
 
 /* FIXME someone should add support for a __setup("spi", ...) that
  * creates board info from kernel command lines
diff --git a/drivers/telephony/ixj.c b/drivers/telephony/ixj.c
index f6b2948ab288..1b601b6cf2a2 100644
--- a/drivers/telephony/ixj.c
+++ b/drivers/telephony/ixj.c
@@ -284,6 +284,14 @@ static int samplerate = 100;
 
 module_param(ixjdebug, int, 0);
 
+static struct pci_device_id ixj_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_QUICKNET, PCI_DEVICE_ID_QUICKNET_XJ,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { }
+};
+
+MODULE_DEVICE_TABLE(pci, ixj_pci_tbl);
+
 /************************************************************************
 *
 * ixjdebug meanings are now bit mapped instead of level based
@@ -7683,7 +7691,8 @@ static int __init ixj_probe_pci(int *cnt)
         IXJ *j = NULL;
 
         for (i = 0; i < IXJMAX - *cnt; i++) {
-                pci = pci_find_device(0x15E2, 0x0500, pci);
+                pci = pci_find_device(PCI_VENDOR_ID_QUICKNET,
+                                      PCI_DEVICE_ID_QUICKNET_XJ, pci);
                 if (!pci)
                         break;
 
diff --git a/drivers/telephony/ixj.h b/drivers/telephony/ixj.h
index fbea4541c234..8d69bcdc29c9 100644
--- a/drivers/telephony/ixj.h
+++ b/drivers/telephony/ixj.h
@@ -1295,7 +1295,7 @@ typedef struct {
         Proc_Info_Type Info_write;
         unsigned short frame_count;
         unsigned int filter_hist[4];
-        unsigned char filter_en[4];
+        unsigned char filter_en[6];
         unsigned short proc_load;
         unsigned long framesread;
         unsigned long frameswritten;
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 97d57cfc343b..825bf884537a 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -33,7 +33,6 @@ obj-$(CONFIG_USB_KBTAB)		+= input/
 obj-$(CONFIG_USB_MOUSE)         += input/
 obj-$(CONFIG_USB_MTOUCH)        += input/
 obj-$(CONFIG_USB_POWERMATE)     += input/
-obj-$(CONFIG_USB_TRANCEVIBRATOR)+= input/
 obj-$(CONFIG_USB_WACOM)         += input/
 obj-$(CONFIG_USB_XPAD)          += input/
 
@@ -66,6 +65,7 @@ obj-$(CONFIG_USB_PHIDGETSERVO)	+= misc/
 obj-$(CONFIG_USB_RIO500)        += misc/
 obj-$(CONFIG_USB_SISUSBVGA)     += misc/
 obj-$(CONFIG_USB_TEST)          += misc/
+obj-$(CONFIG_USB_TRANCEVIBRATOR)+= misc/
 obj-$(CONFIG_USB_USS720)        += misc/
 
 obj-$(CONFIG_USB_ATM)           += atm/
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 3892a9e9aee3..e6565633ba0f 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -793,6 +793,9 @@ static const struct usb_device_id cxacru_usb_ids[] = {
         { /* V = Conexant                       P = ADSL modem                          */
                 USB_DEVICE(0x0572, 0xcb06),     .driver_info = (unsigned long) &cxacru_cb00
         },
+        { /* V = Conexant                       P = ADSL modem (ZTE ZXDSL 852)          */
+                USB_DEVICE(0x0572, 0xcb07),     .driver_info = (unsigned long) &cxacru_cb00
+        },
         { /* V = Olitec                         P = ADSL modem version 2                */
                 USB_DEVICE(0x08e3, 0x0100),     .driver_info = (unsigned long) &cxacru_cafe
         },
diff --git a/drivers/usb/atm/speedtch.c b/drivers/usb/atm/speedtch.c
index 7c7b507af29d..c870c804470f 100644
--- a/drivers/usb/atm/speedtch.c
+++ b/drivers/usb/atm/speedtch.c
@@ -55,7 +55,6 @@ static const char speedtch_driver_name[] = "speedtch";
 #define OFFSET_d        9               /* size 4 */
 #define OFFSET_e        13              /* size 1 */
 #define OFFSET_f        14              /* size 1 */
-#define TOTAL           15
 
 #define SIZE_7          1
 #define SIZE_b          8
@@ -79,6 +78,18 @@ static int dl_512_first = DEFAULT_DL_512_FIRST;
 static int enable_isoc = DEFAULT_ENABLE_ISOC;
 static int sw_buffering = DEFAULT_SW_BUFFERING;
 
+#define DEFAULT_B_MAX_DSL       8128
+#define DEFAULT_MODEM_MODE      11
+#define MODEM_OPTION_LENGTH     16
+static const unsigned char DEFAULT_MODEM_OPTION[MODEM_OPTION_LENGTH] = {
+        0x10, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+};
+
+static unsigned int BMaxDSL = DEFAULT_B_MAX_DSL;
+static unsigned char ModemMode = DEFAULT_MODEM_MODE;
+static unsigned char ModemOption[MODEM_OPTION_LENGTH];
+static int num_ModemOption;
+
 module_param(altsetting, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(altsetting,
                 "Alternative setting for data interface (bulk_default: "
@@ -100,6 +111,17 @@ MODULE_PARM_DESC(sw_buffering,
                  "Enable software buffering (default: "
                  __MODULE_STRING(DEFAULT_SW_BUFFERING) ")");
 
+module_param(BMaxDSL, uint, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(BMaxDSL,
+                "default: " __MODULE_STRING(DEFAULT_B_MAX_DSL));
+
+module_param(ModemMode, byte, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(ModemMode,
+                "default: " __MODULE_STRING(DEFAULT_MODEM_MODE));
+
+module_param_array(ModemOption, byte, &num_ModemOption, S_IRUGO);
+MODULE_PARM_DESC(ModemOption, "default: 0x10,0x00,0x00,0x00,0x20");
+
 #define INTERFACE_DATA          1
 #define ENDPOINT_INT            0x81
 #define ENDPOINT_BULK_DATA      0x07
@@ -108,10 +130,17 @@ MODULE_PARM_DESC(sw_buffering,
 
 #define hex2int(c) ( (c >= '0') && (c <= '9') ? (c - '0') : ((c & 0xf) + 9) )
 
+struct speedtch_params {
+        unsigned int altsetting;
+        unsigned int BMaxDSL;
+        unsigned char ModemMode;
+        unsigned char ModemOption[MODEM_OPTION_LENGTH];
+};
+
 struct speedtch_instance_data {
         struct usbatm_data *usbatm;
 
-        unsigned int altsetting;
+        struct speedtch_params params; /* set in probe, constant afterwards */
 
         struct work_struct status_checker;
 
@@ -123,7 +152,7 @@ struct speedtch_instance_data {
         struct urb *int_urb;
         unsigned char int_data[16];
 
-        unsigned char scratch_buffer[TOTAL];
+        unsigned char scratch_buffer[16];
 };
 
 /***************
@@ -186,6 +215,34 @@ static void speedtch_test_sequence(struct speedtch_instance_data *instance)
                               0x01, 0x40, 0x04, 0x00, buf, 3, CTRL_TIMEOUT);
         if (ret < 0)
                 usb_warn(usbatm, "%s failed on URB150: %d\n", __func__, ret);
+
+        /* Extra initialisation in recent drivers - gives higher speeds */
+
+        /* URBext1 */
+        buf[0] = instance->params.ModemMode;
+        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
+                              0x01, 0x40, 0x11, 0x00, buf, 1, CTRL_TIMEOUT);
+        if (ret < 0)
+                usb_warn(usbatm, "%s failed on URBext1: %d\n", __func__, ret);
+
+        /* URBext2 */
+        /* This seems to be the one which actually triggers the higher sync
+           rate -- it does require the new firmware too, although it works OK
+           with older firmware */
+        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
+                              0x01, 0x40, 0x14, 0x00,
+                              instance->params.ModemOption,
+                              MODEM_OPTION_LENGTH, CTRL_TIMEOUT);
+        if (ret < 0)
+                usb_warn(usbatm, "%s failed on URBext2: %d\n", __func__, ret);
+
+        /* URBext3 */
+        buf[0] = instance->params.BMaxDSL & 0xff;
+        buf[1] = instance->params.BMaxDSL >> 8;
+        ret = usb_control_msg(usb_dev, usb_sndctrlpipe(usb_dev, 0),
+                              0x01, 0x40, 0x12, 0x00, buf, 2, CTRL_TIMEOUT);
+        if (ret < 0)
+                usb_warn(usbatm, "%s failed on URBext3: %d\n", __func__, ret);
 }
 
 static int speedtch_upload_firmware(struct speedtch_instance_data *instance,
@@ -285,8 +342,8 @@ static int speedtch_upload_firmware(struct speedtch_instance_data *instance,
            because we're in our own kernel thread anyway. */
         msleep_interruptible(1000);
 
-        if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->altsetting)) < 0) {
-                usb_err(usbatm, "%s: setting interface to %d failed (%d)!\n", __func__, instance->altsetting, ret);
+        if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->params.altsetting)) < 0) {
+                usb_err(usbatm, "%s: setting interface to %d failed (%d)!\n", __func__, instance->params.altsetting, ret);
                 goto out_free;
         }
 
@@ -372,7 +429,7 @@ static int speedtch_read_status(struct speedtch_instance_data *instance)
         unsigned char *buf = instance->scratch_buffer;
         int ret;
 
-        memset(buf, 0, TOTAL);
+        memset(buf, 0, 16);
 
         ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
                               0x12, 0xc0, 0x07, 0x00, buf + OFFSET_7, SIZE_7,
@@ -746,17 +803,21 @@ static int speedtch_bind(struct usbatm_data *usbatm,
 
         instance->usbatm = usbatm;
 
-        /* altsetting and enable_isoc may change at any moment, so take a snapshot */
-        instance->altsetting = altsetting;
+        /* module parameters may change at any moment, so take a snapshot */
+        instance->params.altsetting = altsetting;
+        instance->params.BMaxDSL = BMaxDSL;
+        instance->params.ModemMode = ModemMode;
+        memcpy(instance->params.ModemOption, DEFAULT_MODEM_OPTION, MODEM_OPTION_LENGTH);
+        memcpy(instance->params.ModemOption, ModemOption, num_ModemOption);
         use_isoc = enable_isoc;
 
-        if (instance->altsetting)
-                if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->altsetting)) < 0) {
-                        usb_err(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, instance->altsetting, ret);
-                        instance->altsetting = 0; /* fall back to default */
+        if (instance->params.altsetting)
+                if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, instance->params.altsetting)) < 0) {
+                        usb_err(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, instance->params.altsetting, ret);
+                        instance->params.altsetting = 0; /* fall back to default */
                 }
 
-        if (!instance->altsetting && use_isoc)
+        if (!instance->params.altsetting && use_isoc)
                 if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, DEFAULT_ISOC_ALTSETTING)) < 0) {
                         usb_dbg(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, DEFAULT_ISOC_ALTSETTING, ret);
                         use_isoc = 0; /* fall back to bulk */
@@ -783,14 +844,14 @@ static int speedtch_bind(struct usbatm_data *usbatm,
                         usb_info(usbatm, "isochronous transfer not supported - using bulk\n");
         }
 
-        if (!use_isoc && !instance->altsetting)
+        if (!use_isoc && !instance->params.altsetting)
                 if ((ret = usb_set_interface(usb_dev, INTERFACE_DATA, DEFAULT_BULK_ALTSETTING)) < 0) {
                         usb_err(usbatm, "%s: setting interface to %2d failed (%d)!\n", __func__, DEFAULT_BULK_ALTSETTING, ret);
                         goto fail_free;
                 }
 
-        if (!instance->altsetting)
-                instance->altsetting = use_isoc ? DEFAULT_ISOC_ALTSETTING : DEFAULT_BULK_ALTSETTING;
+        if (!instance->params.altsetting)
+                instance->params.altsetting = use_isoc ? DEFAULT_ISOC_ALTSETTING : DEFAULT_BULK_ALTSETTING;
 
         usbatm->flags |= (use_isoc ? UDSL_USE_ISOC : 0);
 
diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c
index f5434b1cbb1e..f6b9f7e1f716 100644
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -68,7 +68,7 @@
 
 #include "usbatm.h"
 
-#define EAGLEUSBVERSION "ueagle 1.3"
+#define EAGLEUSBVERSION "ueagle 1.4"
 
 
 /*
@@ -80,14 +80,14 @@
                         dev_dbg(&(usb_dev)->dev, \
                                 "[ueagle-atm dbg] %s: " format, \
                                         __FUNCTION__, ##args); \
-       } while (0)
+        } while (0)
 
 #define uea_vdbg(usb_dev, format, args...)      \
         do { \
                 if (debug >= 2) \
                         dev_dbg(&(usb_dev)->dev, \
                                 "[ueagle-atm vdbg]  " format, ##args); \
-       } while (0)
+        } while (0)
 
 #define uea_enters(usb_dev) \
         uea_vdbg(usb_dev, "entering %s\n", __FUNCTION__)
@@ -218,8 +218,8 @@ enum {
 #define UEA_CHIP_VERSION(x) \
         ((x)->driver_info & 0xf)
 
-#define IS_ISDN(sc) \
-        (le16_to_cpu(sc->usb_dev->descriptor.bcdDevice) & 0x80)
+#define IS_ISDN(usb_dev) \
+        (le16_to_cpu((usb_dev)->descriptor.bcdDevice) & 0x80)
 
 #define INS_TO_USBDEV(ins) ins->usb_dev
 
@@ -625,12 +625,12 @@ static int request_dsp(struct uea_softc *sc)
         char *dsp_name;
 
         if (UEA_CHIP_VERSION(sc) == ADI930) {
-                if (IS_ISDN(sc))
+                if (IS_ISDN(sc->usb_dev))
                         dsp_name = FW_DIR "DSP9i.bin";
                 else
                         dsp_name = FW_DIR "DSP9p.bin";
         } else {
-                if (IS_ISDN(sc))
+                if (IS_ISDN(sc->usb_dev))
                         dsp_name = FW_DIR "DSPei.bin";
                 else
                         dsp_name = FW_DIR "DSPep.bin";
@@ -744,7 +744,7 @@ static inline void wake_up_cmv_ack(struct uea_softc *sc)
 
 static inline int wait_cmv_ack(struct uea_softc *sc)
 {
-        int ret = wait_event_timeout(sc->cmv_ack_wait,
+        int ret = wait_event_interruptible_timeout(sc->cmv_ack_wait,
                                                    sc->cmv_ack, ACK_TIMEOUT);
         sc->cmv_ack = 0;
 
@@ -885,7 +885,8 @@ static int uea_stat(struct uea_softc *sc)
                 break;
 
         case 3:         /* fail ... */
-                uea_info(INS_TO_USBDEV(sc), "modem synchronization failed\n");
+                uea_info(INS_TO_USBDEV(sc), "modem synchronization failed"
+                                " (may be try other cmv/dsp)\n");
                 return -EAGAIN;
 
         case 4 ... 6:   /* test state */
@@ -913,12 +914,6 @@ static int uea_stat(struct uea_softc *sc)
                         release_firmware(sc->dsp_firm);
                         sc->dsp_firm = NULL;
                 }
-
-                ret = uea_read_cmv(sc, SA_INFO, 10, &sc->stats.phy.firmid);
-                if (ret < 0)
-                        return ret;
-                uea_info(INS_TO_USBDEV(sc), "ATU-R firmware version : %x\n",
-                                sc->stats.phy.firmid);
         }
 
         /* always update it as atm layer could not be init when we switch to
@@ -1033,9 +1028,9 @@ static int request_cmvs(struct uea_softc *sc,
 
         if (cmv_file[sc->modem_index] == NULL) {
                 if (UEA_CHIP_VERSION(sc) == ADI930)
-                        file = (IS_ISDN(sc)) ? "CMV9i.bin" : "CMV9p.bin";
+                        file = (IS_ISDN(sc->usb_dev)) ? "CMV9i.bin" : "CMV9p.bin";
                 else
-                        file = (IS_ISDN(sc)) ? "CMVei.bin" : "CMVep.bin";
+                        file = (IS_ISDN(sc->usb_dev)) ? "CMVei.bin" : "CMVep.bin";
         } else
                 file = cmv_file[sc->modem_index];
 
@@ -1131,6 +1126,13 @@ static int uea_start_reset(struct uea_softc *sc)
         if (ret < 0)
                 return ret;
 
+        /* Dump firmware version */
+        ret = uea_read_cmv(sc, SA_INFO, 10, &sc->stats.phy.firmid);
+        if (ret < 0)
+                return ret;
+        uea_info(INS_TO_USBDEV(sc), "ATU-R firmware version : %x\n",
+                        sc->stats.phy.firmid);
+
         /* get options */
         ret = len = request_cmvs(sc, &cmvs, &cmvs_fw);
         if (ret < 0)
@@ -1147,6 +1149,8 @@ static int uea_start_reset(struct uea_softc *sc)
         /* Enter in R-ACT-REQ */
         ret = uea_write_cmv(sc, SA_CNTL, 0, 2);
         uea_vdbg(INS_TO_USBDEV(sc), "Entering in R-ACT-REQ state\n");
+        uea_info(INS_TO_USBDEV(sc), "Modem started, "
+                "waiting synchronization\n");
 out:
         release_firmware(cmvs_fw);
         sc->reset = 0;
@@ -1172,7 +1176,10 @@ static int uea_kthread(void *data)
                 if (!ret)
                         ret = uea_stat(sc);
                 if (ret != -EAGAIN)
-                        msleep(1000);
+                        msleep_interruptible(1000);
+                if (try_to_freeze())
+                        uea_err(INS_TO_USBDEV(sc), "suspend/resume not supported, "
+                                "please unplug/replug your modem\n");
         }
         uea_leaves(INS_TO_USBDEV(sc));
         return ret;
@@ -1566,6 +1573,7 @@ UEA_ATTR(uscorr, 0);
 UEA_ATTR(dscorr, 0);
 UEA_ATTR(usunc, 0);
 UEA_ATTR(dsunc, 0);
+UEA_ATTR(firmid, 0);
 
 /* Retrieve the device End System Identifier (MAC) */
 
@@ -1597,7 +1605,7 @@ static int uea_heavy(struct usbatm_data *usbatm, struct usb_interface *intf)
 {
         struct uea_softc *sc = usbatm->driver_data;
 
-        wait_event(sc->sync_q, IS_OPERATIONAL(sc));
+        wait_event_interruptible(sc->sync_q, IS_OPERATIONAL(sc));
 
         return 0;
 
@@ -1639,16 +1647,13 @@ static struct attribute *attrs[] = {
         &dev_attr_stat_dscorr.attr,
         &dev_attr_stat_usunc.attr,
         &dev_attr_stat_dsunc.attr,
+        &dev_attr_stat_firmid.attr,
+        NULL,
 };
 static struct attribute_group attr_grp = {
         .attrs = attrs,
 };
 
-static int create_fs_entries(struct usb_interface *intf)
-{
-        return sysfs_create_group(&intf->dev.kobj, &attr_grp);
-}
-
 static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
                    const struct usb_device_id *id)
 {
@@ -1708,31 +1713,25 @@ static int uea_bind(struct usbatm_data *usbatm, struct usb_interface *intf,
                 }
         }
 
+        ret = sysfs_create_group(&intf->dev.kobj, &attr_grp);
+        if (ret < 0)
+                goto error;
+
         ret = uea_boot(sc);
-        if (ret < 0) {
-                kfree(sc);
-                return ret;
-        }
+        if (ret < 0)
+                goto error;
 
-        ret = create_fs_entries(intf);
-        if (ret) {
-                uea_stop(sc);
-                kfree(sc);
-                return ret;
-        }
         return 0;
-}
-
-static void destroy_fs_entries(struct usb_interface *intf)
-{
-        sysfs_remove_group(&intf->dev.kobj, &attr_grp);
+error:
+        kfree(sc);
+        return ret;
 }
 
 static void uea_unbind(struct usbatm_data *usbatm, struct usb_interface *intf)
 {
         struct uea_softc *sc = usbatm->driver_data;
 
-        destroy_fs_entries(intf);
+        sysfs_remove_group(&intf->dev.kobj, &attr_grp);
         uea_stop(sc);
         kfree(sc);
 }
@@ -1753,10 +1752,10 @@ static int uea_probe(struct usb_interface *intf, const struct usb_device_id *id)
         struct usb_device *usb = interface_to_usbdev(intf);
 
         uea_enters(usb);
-        uea_info(usb, "ADSL device founded vid (%#X) pid (%#X) : %s\n",
+        uea_info(usb, "ADSL device founded vid (%#X) pid (%#X) : %s %s\n",
                le16_to_cpu(usb->descriptor.idVendor),
                le16_to_cpu(usb->descriptor.idProduct),
-               chip_name[UEA_CHIP_VERSION(id)]);
+               chip_name[UEA_CHIP_VERSION(id)], IS_ISDN(usb)?"isdn":"pots");
 
         usb_reset_device(usb);
 
diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index 309073f6433a..ec63b0ee0743 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1001,6 +1001,7 @@ static int usbatm_do_heavy_init(void *arg)
 
         daemonize(instance->driver->driver_name);
         allow_signal(SIGTERM);
+        instance->thread_pid = current->pid;
 
         complete(&instance->thread_started);
 
@@ -1025,10 +1026,6 @@ static int usbatm_heavy_init(struct usbatm_data *instance)
                 return ret;
         }
 
-        mutex_lock(&instance->serialize);
-        instance->thread_pid = ret;
-        mutex_unlock(&instance->serialize);
-
         wait_for_completion(&instance->thread_started);
 
         return 0;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index ec4d1d756725..9a9012fd284b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -325,7 +325,7 @@ static void acm_rx_tasklet(unsigned long _acm)
         struct acm_rb *buf;
         struct tty_struct *tty = acm->tty;
         struct acm_ru *rcv;
-        //unsigned long flags;
+        unsigned long flags;
         int i = 0;
         dbg("Entering acm_rx_tasklet");
 
@@ -333,15 +333,15 @@ static void acm_rx_tasklet(unsigned long _acm)
                 return;
 
 next_buffer:
-        spin_lock(&acm->read_lock);
+        spin_lock_irqsave(&acm->read_lock, flags);
         if (list_empty(&acm->filled_read_bufs)) {
-                spin_unlock(&acm->read_lock);
+                spin_unlock_irqrestore(&acm->read_lock, flags);
                 goto urbs;
         }
         buf = list_entry(acm->filled_read_bufs.next,
                          struct acm_rb, list);
         list_del(&buf->list);
-        spin_unlock(&acm->read_lock);
+        spin_unlock_irqrestore(&acm->read_lock, flags);
 
         dbg("acm_rx_tasklet: procesing buf 0x%p, size = %d", buf, buf->size);
 
@@ -356,29 +356,29 @@ next_buffer:
                 memmove(buf->base, buf->base + i, buf->size - i);
                 buf->size -= i;
                 spin_unlock(&acm->throttle_lock);
-                spin_lock(&acm->read_lock);
+                spin_lock_irqsave(&acm->read_lock, flags);
                 list_add(&buf->list, &acm->filled_read_bufs);
-                spin_unlock(&acm->read_lock);
+                spin_unlock_irqrestore(&acm->read_lock, flags);
                 return;
         }
         spin_unlock(&acm->throttle_lock);
 
-        spin_lock(&acm->read_lock);
+        spin_lock_irqsave(&acm->read_lock, flags);
         list_add(&buf->list, &acm->spare_read_bufs);
-        spin_unlock(&acm->read_lock);
+        spin_unlock_irqrestore(&acm->read_lock, flags);
         goto next_buffer;
 
 urbs:
         while (!list_empty(&acm->spare_read_bufs)) {
-                spin_lock(&acm->read_lock);
+                spin_lock_irqsave(&acm->read_lock, flags);
                 if (list_empty(&acm->spare_read_urbs)) {
-                        spin_unlock(&acm->read_lock);
+                        spin_unlock_irqrestore(&acm->read_lock, flags);
                         return;
                 }
                 rcv = list_entry(acm->spare_read_urbs.next,
                                  struct acm_ru, list);
                 list_del(&rcv->list);
-                spin_unlock(&acm->read_lock);
+                spin_unlock_irqrestore(&acm->read_lock, flags);
 
                 buf = list_entry(acm->spare_read_bufs.next,
                                  struct acm_rb, list);
@@ -400,9 +400,9 @@ urbs:
                    free-urbs-pool and resubmited ASAP */
                 if (usb_submit_urb(rcv->urb, GFP_ATOMIC) < 0) {
                         list_add(&buf->list, &acm->spare_read_bufs);
-                        spin_lock(&acm->read_lock);
+                        spin_lock_irqsave(&acm->read_lock, flags);
                         list_add(&rcv->list, &acm->spare_read_urbs);
-                        spin_unlock(&acm->read_lock);
+                        spin_unlock_irqrestore(&acm->read_lock, flags);
                         return;
                 }
         }
@@ -1083,6 +1083,9 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0482, 0x0203), /* KYOCERA AH-K3001V */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x079b, 0x000f), /* BT On-Air USB MODEM */
+        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+        },
         { USB_DEVICE(0x0ace, 0x1608), /* ZyDAS 56K USB MODEM */
         .driver_info = SINGLE_RX_URB, /* firmware bug */
         },
diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
index a161d70e1e42..6303970e93c1 100644
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -154,6 +154,7 @@ struct usblp {
         unsigned char           used;                   /* True if open */
         unsigned char           present;                /* True if not disconnected */
         unsigned char           bidir;                  /* interface is bidirectional */
+        unsigned char           sleeping;               /* interface is suspended */
         unsigned char           *device_id_string;      /* IEEE 1284 DEVICE ID string (ptr) */
                                                         /* first 2 bytes are (big-endian) length */
 };
@@ -183,6 +184,7 @@ static void usblp_dump(struct usblp *usblp) {
         dbg("quirks=%d", usblp->quirks);
         dbg("used=%d", usblp->used);
         dbg("bidir=%d", usblp->bidir);
+        dbg("sleeping=%d", usblp->sleeping);
         dbg("device_id_string=\"%s\"",
                 usblp->device_id_string ?
                         usblp->device_id_string + 2 :
@@ -338,6 +340,20 @@ static int usblp_check_status(struct usblp *usblp, int err)
         return newerr;
 }
 
+static int handle_bidir (struct usblp *usblp)
+{
+        if (usblp->bidir && usblp->used && !usblp->sleeping) {
+                usblp->readcount = 0;
+                usblp->readurb->dev = usblp->dev;
+                if (usb_submit_urb(usblp->readurb, GFP_KERNEL) < 0) {
+                        usblp->used = 0;
+                        return -EIO;
+                }
+        }
+
+        return 0;
+}
+
 /*
  * File op functions.
  */
@@ -390,14 +406,9 @@ static int usblp_open(struct inode *inode, struct file *file)
         usblp->writeurb->status = 0;
         usblp->readurb->status = 0;
 
-        if (usblp->bidir) {
-                usblp->readcount = 0;
-                usblp->readurb->dev = usblp->dev;
-                if (usb_submit_urb(usblp->readurb, GFP_KERNEL) < 0) {
-                        retval = -EIO;
-                        usblp->used = 0;
-                        file->private_data = NULL;
-                }
+        if (handle_bidir(usblp) < 0) {
+                file->private_data = NULL;
+                retval = -EIO;
         }
 out:
         mutex_unlock (&usblp_mutex);
@@ -460,6 +471,11 @@ static long usblp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 goto done;
         }
 
+        if (usblp->sleeping) {
+                retval = -ENODEV;
+                goto done;
+        }
+
         dbg("usblp_ioctl: cmd=0x%x (%c nr=%d len=%d dir=%d)", cmd, _IOC_TYPE(cmd),
                 _IOC_NR(cmd), _IOC_SIZE(cmd), _IOC_DIR(cmd) );
 
@@ -658,6 +674,11 @@ static ssize_t usblp_write(struct file *file, const char __user *buffer, size_t
                         return -ENODEV;
                 }
 
+                if (usblp->sleeping) {
+                        up (&usblp->sem);
+                        return writecount ? writecount : -ENODEV;
+                }
+
                 if (usblp->writeurb->status != 0) {
                         if (usblp->quirks & USBLP_QUIRK_BIDIR) {
                                 if (!usblp->wcomplete)
@@ -701,6 +722,7 @@ static ssize_t usblp_write(struct file *file, const char __user *buffer, size_t
                 usblp->wcomplete = 0;
                 err = usb_submit_urb(usblp->writeurb, GFP_KERNEL);
                 if (err) {
+                        usblp->wcomplete = 1;
                         if (err != -ENOMEM)
                                 count = -EIO;
                         else
@@ -749,6 +771,11 @@ static ssize_t usblp_read(struct file *file, char __user *buffer, size_t count,
                 goto done;
         }
 
+        if (usblp->sleeping) {
+                count = -ENODEV;
+                goto done;
+        }
+
         if (usblp->readurb->status) {
                 err("usblp%d: error %d reading from printer",
                         usblp->minor, usblp->readurb->status);
@@ -1167,6 +1194,39 @@ static void usblp_disconnect(struct usb_interface *intf)
         mutex_unlock (&usblp_mutex);
 }
 
+static int usblp_suspend (struct usb_interface *intf, pm_message_t message)
+{
+        struct usblp *usblp = usb_get_intfdata (intf);
+
+        /* this races against normal access and open */
+        mutex_lock (&usblp_mutex);
+        down (&usblp->sem);
+        /* we take no more IO */
+        usblp->sleeping = 1;
+        usblp_unlink_urbs(usblp);
+        up (&usblp->sem);
+        mutex_unlock (&usblp_mutex);
+
+        return 0;
+}
+
+static int usblp_resume (struct usb_interface *intf)
+{
+        struct usblp *usblp = usb_get_intfdata (intf);
+        int r;
+
+        mutex_lock (&usblp_mutex);
+        down (&usblp->sem);
+
+        usblp->sleeping = 0;
+        r = handle_bidir (usblp);
+
+        up (&usblp->sem);
+        mutex_unlock (&usblp_mutex);
+
+        return r;
+}
+
 static struct usb_device_id usblp_ids [] = {
         { USB_DEVICE_INFO(7, 1, 1) },
         { USB_DEVICE_INFO(7, 1, 2) },
@@ -1183,6 +1243,8 @@ static struct usb_driver usblp_driver = {
         .name =         "usblp",
         .probe =        usblp_probe,
         .disconnect =   usblp_disconnect,
+        .suspend =      usblp_suspend,
+        .resume =       usblp_resume,
         .id_table =     usblp_ids,
 };
 
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 724822cac2b1..fed92be63b5e 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1588,15 +1588,18 @@ const struct file_operations usbfs_device_file_operations = {
         .release =      usbdev_release,
 };
 
-static void usbdev_add(struct usb_device *dev)
+static int usbdev_add(struct usb_device *dev)
 {
         int minor = ((dev->bus->busnum-1) * 128) + (dev->devnum-1);
 
         dev->class_dev = class_device_create(usb_device_class, NULL,
                                 MKDEV(USB_DEVICE_MAJOR, minor), &dev->dev,
                                 "usbdev%d.%d", dev->bus->busnum, dev->devnum);
+        if (IS_ERR(dev->class_dev))
+                return PTR_ERR(dev->class_dev);
 
         dev->class_dev->class_data = dev;
+        return 0;
 }
 
 static void usbdev_remove(struct usb_device *dev)
@@ -1609,7 +1612,8 @@ static int usbdev_notify(struct notifier_block *self, unsigned long action,
 {
         switch (action) {
         case USB_DEVICE_ADD:
-                usbdev_add(dev);
+                if (usbdev_add(dev))
+                        return NOTIFY_BAD;
                 break;
         case USB_DEVICE_REMOVE:
                 usbdev_remove(dev);
diff --git a/drivers/usb/core/endpoint.c b/drivers/usb/core/endpoint.c
index 3ebb90149e93..3b2d137912be 100644
--- a/drivers/usb/core/endpoint.c
+++ b/drivers/usb/core/endpoint.c
@@ -223,7 +223,7 @@ int usb_create_ep_files(struct device *parent,
         ep_dev = kzalloc(sizeof(*ep_dev), GFP_KERNEL);
         if (!ep_dev) {
                 retval = -ENOMEM;
-                goto exit;
+                goto error_alloc;
         }
 
         /* fun calculation to determine the minor of this endpoint */
@@ -241,33 +241,31 @@ int usb_create_ep_files(struct device *parent,
 
         retval = device_register(&ep_dev->dev);
         if (retval)
-                goto error;
+                goto error_register;
         retval = sysfs_create_group(&ep_dev->dev.kobj, &ep_dev_attr_grp);
         if (retval)
                 goto error_group;
 
-        endpoint->ep_dev = ep_dev;
-
         /* create the symlink to the old-style "ep_XX" directory */
         sprintf(name, "ep_%02x", endpoint->desc.bEndpointAddress);
-        retval = sysfs_create_link(&parent->kobj,
-                                   &endpoint->ep_dev->dev.kobj, name);
+        retval = sysfs_create_link(&parent->kobj, &ep_dev->dev.kobj, name);
         if (retval)
                 goto error_link;
-exit:
+        endpoint->ep_dev = ep_dev;
         return retval;
 
 error_link:
         sysfs_remove_group(&ep_dev->dev.kobj, &ep_dev_attr_grp);
-
 error_group:
         device_unregister(&ep_dev->dev);
-        endpoint->ep_dev = NULL;
         destroy_endpoint_class();
         return retval;
-error:
+
+error_register:
         kfree(ep_dev);
+error_alloc:
         destroy_endpoint_class();
+exit:
         return retval;
 }
 
@@ -282,8 +280,6 @@ void usb_remove_ep_files(struct usb_host_endpoint *endpoint)
                 sysfs_remove_group(&endpoint->ep_dev->dev.kobj, &ep_dev_attr_grp);
                 device_unregister(&endpoint->ep_dev->dev);
                 endpoint->ep_dev = NULL;
+                destroy_endpoint_class();
         }
-        destroy_endpoint_class();
 }
-
-
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 66bff184a30c..ba165aff9ea4 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1188,6 +1188,7 @@ static inline void show_string(struct usb_device *udev, char *id, char *string)
 
 #ifdef  CONFIG_USB_OTG
 #include "otg_whitelist.h"
+static int __usb_port_suspend(struct usb_device *, int port1);
 #endif
 
 /**
@@ -1289,8 +1290,6 @@ int usb_new_device(struct usb_device *udev)
                  * (Includes HNP test device.)
                  */
                 if (udev->bus->b_hnp_enable || udev->bus->is_b_host) {
-                        static int __usb_port_suspend(struct usb_device *,
-                                                int port1);
                         err = __usb_port_suspend(udev, udev->bus->otg_port);
                         if (err < 0)
                                 dev_dbg(&udev->dev, "HNP fail, %d\n", err);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index fccd1952bad3..7729c0744886 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -828,10 +828,7 @@ char *usb_cache_string(struct usb_device *udev, int index)
  * Context: !in_interrupt ()
  *
  * Updates the copy of the device descriptor stored in the device structure,
- * which dedicates space for this purpose.  Note that several fields are
- * converted to the host CPU's byte order:  the USB version (bcdUSB), and
- * vendors product and version fields (idVendor, idProduct, and bcdDevice).
- * That lets device drivers compare against non-byteswapped constants.
+ * which dedicates space for this purpose.
  *
  * Not exported, only for use by the core.  If drivers really want to read
  * the device descriptor directly, they can call usb_get_descriptor() with
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index d954daa8e9e0..3acc896a5d4c 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -1774,8 +1774,8 @@ static DEVICE_ATTR (queues, S_IRUGO, show_queues, NULL);
 
 #else
 
-#define device_create_file(a,b) do {} while (0)
-#define device_remove_file      device_create_file
+#define device_create_file(a,b) (0)
+#define device_remove_file(a,b) do { } while (0)
 
 #endif
 
@@ -2044,8 +2044,10 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
                 return retval;
         }
 
-        device_create_file (&dev->pdev->dev, &dev_attr_function);
-        device_create_file (&dev->pdev->dev, &dev_attr_queues);
+        retval = device_create_file (&dev->pdev->dev, &dev_attr_function);
+        if (retval) goto err_unbind;
+        retval = device_create_file (&dev->pdev->dev, &dev_attr_queues);
+        if (retval) goto err_func;
 
         /* ... then enable host detection and ep0; and we're ready
          * for set_configuration as well as eventual disconnect.
@@ -2060,6 +2062,14 @@ int usb_gadget_register_driver (struct usb_gadget_driver *driver)
 
         /* pci writes may still be posted */
         return 0;
+
+err_func:
+        device_remove_file (&dev->pdev->dev, &dev_attr_function);
+err_unbind:
+        driver->unbind (&dev->gadget);
+        dev->gadget.dev.driver = NULL;
+        dev->driver = NULL;
+        return retval;
 }
 EXPORT_SYMBOL (usb_gadget_register_driver);
 
@@ -2974,8 +2984,10 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
                                 : "disabled");
         the_controller = dev;
 
-        device_register (&dev->gadget.dev);
-        device_create_file (&pdev->dev, &dev_attr_registers);
+        retval = device_register (&dev->gadget.dev);
+        if (retval) goto done;
+        retval = device_create_file (&pdev->dev, &dev_attr_registers);
+        if (retval) goto done;
 
         return 0;
 
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index f42c00ef0bca..671c24bc6d75 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -43,11 +43,11 @@
 #include <linux/mm.h>
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
+#include <linux/irq.h>
 
 #include <asm/byteorder.h>
 #include <asm/dma.h>
 #include <asm/io.h>
-#include <asm/irq.h>
 #include <asm/system.h>
 #include <asm/mach-types.h>
 #include <asm/unaligned.h>
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 23b95b2bfe15..34b7a31cd85b 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -754,7 +754,9 @@ show_registers (struct class_device *class_dev, char *buf)
         }
 
         if (ehci->reclaim) {
-                temp = scnprintf (next, size, "reclaim qh %p\n", ehci->reclaim);
+                temp = scnprintf (next, size, "reclaim qh %p%s\n",
+                                ehci->reclaim,
+                                ehci->reclaim_ready ? " ready" : "");
                 size -= temp;
                 next += temp;
         }
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index aac6ec5dd7cf..9030994aba98 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -111,7 +111,7 @@ static const char	hcd_name [] = "ehci_hcd";
 #define EHCI_TUNE_MULT_TT       1
 #define EHCI_TUNE_FLS           2       /* (small) 256 frame schedule */
 
-#define EHCI_IAA_MSECS          10              /* arbitrary */
+#define EHCI_IAA_JIFFIES        (HZ/100)        /* arbitrary; ~10 msec */
 #define EHCI_IO_JIFFIES         (HZ/10)         /* io watchdog > irq_thresh */
 #define EHCI_ASYNC_JIFFIES      (HZ/20)         /* async idle timeout */
 #define EHCI_SHRINK_JIFFIES     (HZ/200)        /* async qh unlink delay */
@@ -254,7 +254,6 @@ static void ehci_quiesce (struct ehci_hcd *ehci)
 
 /*-------------------------------------------------------------------------*/
 
-static void end_unlink_async (struct ehci_hcd *ehci);
 static void ehci_work(struct ehci_hcd *ehci);
 
 #include "ehci-hub.c"
@@ -264,37 +263,25 @@ static void ehci_work(struct ehci_hcd *ehci);
 
 /*-------------------------------------------------------------------------*/
 
-static void ehci_iaa_watchdog (unsigned long param)
+static void ehci_watchdog (unsigned long param)
 {
         struct ehci_hcd         *ehci = (struct ehci_hcd *) param;
         unsigned long           flags;
-        u32                     status;
 
         spin_lock_irqsave (&ehci->lock, flags);
-        WARN_ON(!ehci->reclaim);
 
-        /* lost IAA irqs wedge things badly; seen first with a vt8235 */
+        /* lost IAA irqs wedge things badly; seen with a vt8235 */
         if (ehci->reclaim) {
-                status = readl (&ehci->regs->status);
+                u32             status = readl (&ehci->regs->status);
                 if (status & STS_IAA) {
                         ehci_vdbg (ehci, "lost IAA\n");
                         COUNT (ehci->stats.lost_iaa);
                         writel (STS_IAA, &ehci->regs->status);
-                        end_unlink_async (ehci);
+                        ehci->reclaim_ready = 1;
                 }
         }
 
-        spin_unlock_irqrestore (&ehci->lock, flags);
-}
-
-static void ehci_watchdog (unsigned long param)
-{
-        struct ehci_hcd         *ehci = (struct ehci_hcd *) param;
-        unsigned long           flags;
-
-        spin_lock_irqsave (&ehci->lock, flags);
-
-        /* stop async processing after it's idled a bit */
+        /* stop async processing after it's idled a bit */
         if (test_bit (TIMER_ASYNC_OFF, &ehci->actions))
                 start_unlink_async (ehci, ehci->async);
 
@@ -345,6 +332,8 @@ static void ehci_port_power (struct ehci_hcd *ehci, int is_on)
 static void ehci_work (struct ehci_hcd *ehci)
 {
         timer_action_done (ehci, TIMER_IO_WATCHDOG);
+        if (ehci->reclaim_ready)
+                end_unlink_async (ehci);
 
         /* another CPU may drop ehci->lock during a schedule scan while
          * it reports urb completions.  this flag guards against bogus
@@ -379,7 +368,6 @@ static void ehci_stop (struct usb_hcd *hcd)
 
         /* no more interrupts ... */
         del_timer_sync (&ehci->watchdog);
-        del_timer_sync (&ehci->iaa_watchdog);
 
         spin_lock_irq(&ehci->lock);
         if (HC_IS_RUNNING (hcd->state))
@@ -426,10 +414,6 @@ static int ehci_init(struct usb_hcd *hcd)
         ehci->watchdog.function = ehci_watchdog;
         ehci->watchdog.data = (unsigned long) ehci;
 
-        init_timer(&ehci->iaa_watchdog);
-        ehci->iaa_watchdog.function = ehci_iaa_watchdog;
-        ehci->iaa_watchdog.data = (unsigned long) ehci;
-
         /*
          * hw default: 1K periodic list heads, one per frame.
          * periodic_size can shrink by USBCMD update if hcc_params allows.
@@ -446,6 +430,7 @@ static int ehci_init(struct usb_hcd *hcd)
                 ehci->i_thresh = 2 + HCC_ISOC_THRES(hcc_params);
 
         ehci->reclaim = NULL;
+        ehci->reclaim_ready = 0;
         ehci->next_uframe = -1;
 
         /*
@@ -619,7 +604,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
         /* complete the unlinking of some qh [4.15.2.3] */
         if (status & STS_IAA) {
                 COUNT (ehci->stats.reclaim);
-                end_unlink_async (ehci);
+                ehci->reclaim_ready = 1;
                 bh = 1;
         }
 
@@ -723,14 +708,10 @@ static int ehci_urb_enqueue (
 
 static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
 {
-        // BUG_ON(qh->qh_state != QH_STATE_LINKED);
-
-        /* failfast */
-        if (!HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
-                end_unlink_async (ehci);
-
-        /* defer till later if busy */
-        else if (ehci->reclaim) {
+        /* if we need to use IAA and it's busy, defer */
+        if (qh->qh_state == QH_STATE_LINKED
+                        && ehci->reclaim
+                        && HC_IS_RUNNING (ehci_to_hcd(ehci)->state)) {
                 struct ehci_qh          *last;
 
                 for (last = ehci->reclaim;
@@ -740,8 +721,12 @@ static void unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 qh->qh_state = QH_STATE_UNLINK_WAIT;
                 last->reclaim = qh;
 
-        /* start IAA cycle */
-        } else
+        /* bypass IAA if the hc can't care */
+        } else if (!HC_IS_RUNNING (ehci_to_hcd(ehci)->state) && ehci->reclaim)
+                end_unlink_async (ehci);
+
+        /* something else might have unlinked the qh by now */
+        if (qh->qh_state == QH_STATE_LINKED)
                 start_unlink_async (ehci, qh);
 }
 
@@ -763,19 +748,7 @@ static int ehci_urb_dequeue (struct usb_hcd *hcd, struct urb *urb)
                 qh = (struct ehci_qh *) urb->hcpriv;
                 if (!qh)
                         break;
-                switch (qh->qh_state) {
-                case QH_STATE_LINKED:
-                case QH_STATE_COMPLETING:
-                        unlink_async (ehci, qh);
-                        break;
-                case QH_STATE_UNLINK:
-                case QH_STATE_UNLINK_WAIT:
-                        /* already started */
-                        break;
-                case QH_STATE_IDLE:
-                        WARN_ON(1);
-                        break;
-                }
+                unlink_async (ehci, qh);
                 break;
 
         case PIPE_INTERRUPT:
@@ -867,7 +840,6 @@ rescan:
                 unlink_async (ehci, qh);
                 /* FALL THROUGH */
         case QH_STATE_UNLINK:           /* wait for hw to finish? */
-        case QH_STATE_UNLINK_WAIT:
 idle_timeout:
                 spin_unlock_irqrestore (&ehci->lock, flags);
                 schedule_timeout_uninterruptible(1);
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 2012213c0a25..1b20722c102b 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -48,7 +48,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
         }
         ehci->command = readl (&ehci->regs->command);
         if (ehci->reclaim)
-                end_unlink_async (ehci);
+                ehci->reclaim_ready = 1;
         ehci_work(ehci);
 
         /* suspend any active/unsuspended ports, maybe allow wakeup */
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 35e3fab6fc4e..e51c1ed81ac4 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -303,7 +303,7 @@ restart:
         /* emptying the schedule aborts any urbs */
         spin_lock_irq(&ehci->lock);
         if (ehci->reclaim)
-                end_unlink_async (ehci);
+                ehci->reclaim_ready = 1;
         ehci_work(ehci);
         spin_unlock_irq(&ehci->lock);
 
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 46327272f614..62e46dc60e86 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -967,7 +967,7 @@ static void end_unlink_async (struct ehci_hcd *ehci)
         struct ehci_qh          *qh = ehci->reclaim;
         struct ehci_qh          *next;
 
-        iaa_watchdog_done (ehci);
+        timer_action_done (ehci, TIMER_IAA_WATCHDOG);
 
         // qh->hw_next = cpu_to_le32 (qh->qh_dma);
         qh->qh_state = QH_STATE_IDLE;
@@ -977,6 +977,7 @@ static void end_unlink_async (struct ehci_hcd *ehci)
         /* other unlink(s) may be pending (in QH_STATE_UNLINK_WAIT) */
         next = qh->reclaim;
         ehci->reclaim = next;
+        ehci->reclaim_ready = 0;
         qh->reclaim = NULL;
 
         qh_completions (ehci, qh);
@@ -1051,10 +1052,11 @@ static void start_unlink_async (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 return;
         }
 
+        ehci->reclaim_ready = 0;
         cmd |= CMD_IAAD;
         writel (cmd, &ehci->regs->command);
         (void) readl (&ehci->regs->command);
-        iaa_watchdog_start (ehci);
+        timer_action (ehci, TIMER_IAA_WATCHDOG);
 }
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 6aac39f50e07..bbc3082a73d7 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -58,6 +58,7 @@ struct ehci_hcd {			/* one per controller */
         /* async schedule support */
         struct ehci_qh          *async;
         struct ehci_qh          *reclaim;
+        unsigned                reclaim_ready : 1;
         unsigned                scanning : 1;
 
         /* periodic schedule support */
@@ -80,7 +81,6 @@ struct ehci_hcd {			/* one per controller */
         struct dma_pool         *itd_pool;      /* itd per iso urb */
         struct dma_pool         *sitd_pool;     /* sitd per split iso urb */
 
-        struct timer_list       iaa_watchdog;
         struct timer_list       watchdog;
         unsigned long           actions;
         unsigned                stamp;
@@ -114,21 +114,9 @@ static inline struct usb_hcd *ehci_to_hcd (struct ehci_hcd *ehci)
 }
 
 
-static inline void
-iaa_watchdog_start (struct ehci_hcd *ehci)
-{
-        WARN_ON(timer_pending(&ehci->iaa_watchdog));
-        mod_timer (&ehci->iaa_watchdog,
-                        jiffies + msecs_to_jiffies(EHCI_IAA_MSECS));
-}
-
-static inline void iaa_watchdog_done (struct ehci_hcd *ehci)
-{
-        del_timer (&ehci->iaa_watchdog);
-}
-
 enum ehci_timer_action {
         TIMER_IO_WATCHDOG,
+        TIMER_IAA_WATCHDOG,
         TIMER_ASYNC_SHRINK,
         TIMER_ASYNC_OFF,
 };
@@ -146,6 +134,9 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action)
                 unsigned long t;
 
                 switch (action) {
+                case TIMER_IAA_WATCHDOG:
+                        t = EHCI_IAA_JIFFIES;
+                        break;
                 case TIMER_IO_WATCHDOG:
                         t = EHCI_IO_JIFFIES;
                         break;
@@ -162,7 +153,8 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action)
                 // async queue SHRINK often precedes IAA.  while it's ready
                 // to go OFF neither can matter, and afterwards the IO
                 // watchdog stops unless there's still periodic traffic.
-                if (time_before_eq(t, ehci->watchdog.expires)
+                if (action != TIMER_IAA_WATCHDOG
+                                && t > ehci->watchdog.expires
                                 && timer_pending (&ehci->watchdog))
                         return;
                 mod_timer (&ehci->watchdog, t);
diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
index 9be6b303e784..ea4714e557e4 100644
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -715,13 +715,6 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
                 return IRQ_NOTMINE;
         }
 
-        if (ints & OHCI_INTR_RHSC) {
-                ohci_vdbg (ohci, "rhsc\n");
-                ohci->next_statechange = jiffies + STATECHANGE_DELAY;
-                ohci_writel (ohci, OHCI_INTR_RHSC, &regs->intrstatus);
-                usb_hcd_poll_rh_status(hcd);
-        }
-
         if (ints & OHCI_INTR_UE) {
                 disable (ohci);
                 ohci_err (ohci, "OHCI Unrecoverable Error, disabled\n");
@@ -731,9 +724,21 @@ static irqreturn_t ohci_irq (struct usb_hcd *hcd)
                 ohci_usb_reset (ohci);
         }
 
-        if (ints & OHCI_INTR_RD) {
-                ohci_vdbg (ohci, "resume detect\n");
-                ohci_writel (ohci, OHCI_INTR_RD, &regs->intrstatus);
+        if (ints & OHCI_INTR_RHSC) {
+                ohci_vdbg(ohci, "rhsc\n");
+                ohci->next_statechange = jiffies + STATECHANGE_DELAY;
+                ohci_writel(ohci, OHCI_INTR_RD | OHCI_INTR_RHSC,
+                                &regs->intrstatus);
+                usb_hcd_poll_rh_status(hcd);
+        }
+
+        /* For connect and disconnect events, we expect the controller
+         * to turn on RHSC along with RD.  But for remote wakeup events
+         * this might not happen.
+         */
+        else if (ints & OHCI_INTR_RD) {
+                ohci_vdbg(ohci, "resume detect\n");
+                ohci_writel(ohci, OHCI_INTR_RD, &regs->intrstatus);
                 hcd->poll_rh = 1;
                 if (ohci->autostop) {
                         spin_lock (&ohci->lock);
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 6f113596af66..6995ea36f2e8 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -169,7 +169,8 @@ __acquires(ohci->lock)
                 break;
         case OHCI_USB_RESUME:
                 /* HCFS changes sometime after INTR_RD */
-                ohci_info (ohci, "wakeup\n");
+                ohci_info(ohci, "%swakeup\n",
+                                autostopped ? "auto-" : "");
                 break;
         case OHCI_USB_OPER:
                 /* this can happen after resuming a swsusp snapshot */
@@ -422,7 +423,8 @@ ohci_hub_status_data (struct usb_hcd *hcd, char *buf)
                                 ohci->autostop = 0;
                                 ohci->next_statechange = jiffies +
                                                 STATECHANGE_DELAY;
-                        } else if (time_after_eq (jiffies,
+                        } else if (device_may_wakeup(&hcd->self.root_hub->dev)
+                                        && time_after_eq(jiffies,
                                                 ohci->next_statechange)
                                         && !ohci->ed_rm_list
                                         && !(ohci->hc_control &
diff --git a/drivers/usb/host/ohci-pnx4008.c b/drivers/usb/host/ohci-pnx4008.c
index 82cb22f002e7..2dbb77414905 100644
--- a/drivers/usb/host/ohci-pnx4008.c
+++ b/drivers/usb/host/ohci-pnx4008.c
@@ -262,6 +262,7 @@ static const struct hc_driver ohci_pnx4008_hc_driver = {
          */
         .start = ohci_pnx4008_start,
         .stop = ohci_stop,
+        .shutdown = ohci_shutdown,
 
         /*
          * managing i/o requests and associated device resources
@@ -280,7 +281,11 @@ static const struct hc_driver ohci_pnx4008_hc_driver = {
          */
         .hub_status_data = ohci_hub_status_data,
         .hub_control = ohci_hub_control,
-
+        .hub_irq_enable = ohci_rhsc_enable,
+#ifdef  CONFIG_PM
+        .bus_suspend = ohci_bus_suspend,
+        .bus_resume = ohci_bus_resume,
+#endif
         .start_port_reset = ohci_start_port_reset,
 };
 
@@ -410,8 +415,6 @@ static int __devinit usb_hcd_pnx4008_probe(struct platform_device *pdev)
                 goto out4;
         }
 
-        hcd->self.hcpriv = (void *)hcd;
-
         pnx4008_start_hc();
         platform_set_drvdata(pdev, hcd);
         ohci = hcd_to_ohci(hcd);
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 45ee6920a850..226bf3de8edd 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -40,6 +40,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/usb.h>
 #include <linux/bitops.h>
+#include <linux/dmi.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -196,12 +197,42 @@ static int resume_detect_interrupts_are_broken(struct uhci_hcd *uhci)
         return 0;
 }
 
+static int remote_wakeup_is_broken(struct uhci_hcd *uhci)
+{
+        static struct dmi_system_id broken_wakeup_table[] = {
+                {
+                        .ident = "Asus A7V8X",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK"),
+                                DMI_MATCH(DMI_BOARD_NAME, "A7V8X"),
+                                DMI_MATCH(DMI_BOARD_VERSION, "REV 1.xx"),
+                        }
+                },
+                { }
+        };
+        int port;
+
+        /* One of Asus's motherboards has a bug which causes it to
+         * wake up immediately from suspend-to-RAM if any of the ports
+         * are connected.  In such cases we will not set EGSM.
+         */
+        if (dmi_check_system(broken_wakeup_table)) {
+                for (port = 0; port < uhci->rh_numports; ++port) {
+                        if (inw(uhci->io_addr + USBPORTSC1 + port * 2) &
+                                        USBPORTSC_CCS)
+                                return 1;
+                }
+        }
+
+        return 0;
+}
+
 static void suspend_rh(struct uhci_hcd *uhci, enum uhci_rh_state new_state)
 __releases(uhci->lock)
 __acquires(uhci->lock)
 {
         int auto_stop;
-        int int_enable;
+        int int_enable, egsm_enable;
 
         auto_stop = (new_state == UHCI_RH_AUTO_STOPPED);
         dev_dbg(&uhci_to_hcd(uhci)->self.root_hub->dev,
@@ -217,15 +248,18 @@ __acquires(uhci->lock)
         }
 
         /* Enable resume-detect interrupts if they work.
-         * Then enter Global Suspend mode, still configured.
+         * Then enter Global Suspend mode if _it_ works, still configured.
          */
+        egsm_enable = USBCMD_EGSM;
         uhci->working_RD = 1;
         int_enable = USBINTR_RESUME;
-        if (resume_detect_interrupts_are_broken(uhci)) {
+        if (remote_wakeup_is_broken(uhci))
+                egsm_enable = 0;
+        if (resume_detect_interrupts_are_broken(uhci) || !egsm_enable)
                 uhci->working_RD = int_enable = 0;
-        }
+
         outw(int_enable, uhci->io_addr + USBINTR);
-        outw(USBCMD_EGSM | USBCMD_CF, uhci->io_addr + USBCMD);
+        outw(egsm_enable | USBCMD_CF, uhci->io_addr + USBCMD);
         mb();
         udelay(5);
 
diff --git a/drivers/usb/input/Kconfig b/drivers/usb/input/Kconfig
index 21cd22640080..20db36448ab3 100644
--- a/drivers/usb/input/Kconfig
+++ b/drivers/usb/input/Kconfig
@@ -348,13 +348,3 @@ config USB_APPLETOUCH
 
           To compile this driver as a module, choose M here: the
           module will be called appletouch.
-
-config USB_TRANCEVIBRATOR
-        tristate "PlayStation 2 Trance Vibrator driver support"
-        depends on USB
-        help
-          Say Y here if you want to connect a PlayStation 2 Trance Vibrator
-          device to your computer's USB port.
-
-          To compile this driver as a module, choose M here: the
-          module will be called trancevibrator.
diff --git a/drivers/usb/input/Makefile b/drivers/usb/input/Makefile
index 295f459d1079..d946d5213b30 100644
--- a/drivers/usb/input/Makefile
+++ b/drivers/usb/input/Makefile
@@ -3,7 +3,7 @@
 #
 
 # Multipart objects.
-wacom-objs      := wacom_sys.o wacom_wac.o
+wacom-objs      := wacom_wac.o wacom_sys.o
 usbhid-objs     := hid-core.o
 
 # Optional parts of multipart objects.
@@ -48,7 +48,6 @@ obj-$(CONFIG_USB_ACECAD)	+= acecad.o
 obj-$(CONFIG_USB_YEALINK)       += yealink.o
 obj-$(CONFIG_USB_XPAD)          += xpad.o
 obj-$(CONFIG_USB_APPLETOUCH)    += appletouch.o
-obj-$(CONFIG_USB_TRANCEVIBRATOR)        += trancevibrator.o
 
 ifeq ($(CONFIG_USB_DEBUG),y)
 EXTRA_CFLAGS += -DDEBUG
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index a6738a83ff5b..6d08a3bcc952 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -270,7 +270,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign
  * Read data value from item.
  */
 
-static __inline__ __u32 item_udata(struct hid_item *item)
+static u32 item_udata(struct hid_item *item)
 {
         switch (item->size) {
                 case 1: return item->data.u8;
@@ -280,7 +280,7 @@ static __inline__ __u32 item_udata(struct hid_item *item)
         return 0;
 }
 
-static __inline__ __s32 item_sdata(struct hid_item *item)
+static s32 item_sdata(struct hid_item *item)
 {
         switch (item->size) {
                 case 1: return item->data.s8;
@@ -727,7 +727,7 @@ static struct hid_device *hid_parse_report(__u8 *start, unsigned size)
  * done by hand.
  */
 
-static __inline__ __s32 snto32(__u32 value, unsigned n)
+static s32 snto32(__u32 value, unsigned n)
 {
         switch (n) {
                 case 8:  return ((__s8)value);
@@ -741,30 +741,65 @@ static __inline__ __s32 snto32(__u32 value, unsigned n)
  * Convert a signed 32-bit integer to a signed n-bit integer.
  */
 
-static __inline__ __u32 s32ton(__s32 value, unsigned n)
+static u32 s32ton(__s32 value, unsigned n)
 {
-        __s32 a = value >> (n - 1);
+        s32 a = value >> (n - 1);
         if (a && a != -1)
                 return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1;
         return value & ((1 << n) - 1);
 }
 
 /*
- * Extract/implement a data field from/to a report.
+ * Extract/implement a data field from/to a little endian report (bit array).
+ *
+ * Code sort-of follows HID spec:
+ *     http://www.usb.org/developers/devclass_docs/HID1_11.pdf
+ *
+ * While the USB HID spec allows unlimited length bit fields in "report
+ * descriptors", most devices never use more than 16 bits.
+ * One model of UPS is claimed to report "LINEV" as a 32-bit field.
+ * Search linux-kernel and linux-usb-devel archives for "hid-core extract".
  */
 
 static __inline__ __u32 extract(__u8 *report, unsigned offset, unsigned n)
 {
-        report += (offset >> 5) << 2; offset &= 31;
-        return (le64_to_cpu(get_unaligned((__le64*)report)) >> offset) & ((1ULL << n) - 1);
+        u64 x;
+
+        WARN_ON(n > 32);
+
+        report += offset >> 3;  /* adjust byte index */
+        offset &= 7;            /* now only need bit offset into one byte */
+        x = get_unaligned((u64 *) report);
+        x = le64_to_cpu(x);
+        x = (x >> offset) & ((1ULL << n) - 1);  /* extract bit field */
+        return (u32) x;
 }
 
+/*
+ * "implement" : set bits in a little endian bit stream.
+ * Same concepts as "extract" (see comments above).
+ * The data mangled in the bit stream remains in little endian
+ * order the whole time. It make more sense to talk about
+ * endianness of register values by considering a register
+ * a "cached" copy of the little endiad bit stream.
+ */
 static __inline__ void implement(__u8 *report, unsigned offset, unsigned n, __u32 value)
 {
-        report += (offset >> 5) << 2; offset &= 31;
-        put_unaligned((get_unaligned((__le64*)report)
-                & cpu_to_le64(~((((__u64) 1 << n) - 1) << offset)))
-                | cpu_to_le64((__u64)value << offset), (__le64*)report);
+        u64 x;
+        u64 m = (1ULL << n) - 1;
+
+        WARN_ON(n > 32);
+
+        WARN_ON(value > m);
+        value &= m;
+
+        report += offset >> 3;
+        offset &= 7;
+
+        x = get_unaligned((u64 *)report);
+        x &= cpu_to_le64(~(m << offset));
+        x |= cpu_to_le64(((u64) value) << offset);
+        put_unaligned(x, (u64 *) report);
 }
 
 /*
@@ -1381,6 +1416,9 @@ void hid_close(struct hid_device *hid)
 
 #define USB_VENDOR_ID_PANJIT            0x134c
 
+#define USB_VENDOR_ID_TURBOX            0x062a
+#define USB_DEVICE_ID_TURBOX_KEYBOARD   0x0201
+
 /*
  * Initialize all reports
  */
@@ -1602,6 +1640,9 @@ void hid_init_reports(struct hid_device *hid)
 #define USB_VENDOR_ID_SUN               0x0430
 #define USB_DEVICE_ID_RARITAN_KVM_DONGLE        0xcdab
 
+#define USB_VENDOR_ID_AIRCABLE          0x16CA
+#define USB_DEVICE_ID_AIRCABLE1         0x1502
+
 /*
  * Alphabetically sorted blacklist by quirk type.
  */
@@ -1619,6 +1660,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_22, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_23, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_24, HID_QUIRK_IGNORE },
+        { USB_VENDOR_ID_AIRCABLE, USB_DEVICE_ID_AIRCABLE1, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_BERKSHIRE, USB_DEVICE_ID_BERKSHIRE_PCWD, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_CODEMERCS, USB_DEVICE_ID_CODEMERCS_IOW40, HID_QUIRK_IGNORE },
@@ -1755,11 +1797,12 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_APPLE, 0x020E, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x020F, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x0214, HID_QUIRK_POWERBOOK_HAS_FN },
-        { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0215, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
         { USB_VENDOR_ID_APPLE, 0x0216, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x0217, HID_QUIRK_POWERBOOK_HAS_FN },
-        { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x0218, HID_QUIRK_POWERBOOK_HAS_FN | HID_QUIRK_POWERBOOK_ISO_KEYBOARD},
         { USB_VENDOR_ID_APPLE, 0x0219, HID_QUIRK_POWERBOOK_HAS_FN },
+        { USB_VENDOR_ID_APPLE, 0x021B, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x030A, HID_QUIRK_POWERBOOK_HAS_FN },
         { USB_VENDOR_ID_APPLE, 0x030B, HID_QUIRK_POWERBOOK_HAS_FN },
 
@@ -1768,6 +1811,8 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PANJIT, 0x0003, HID_QUIRK_IGNORE },
         { USB_VENDOR_ID_PANJIT, 0x0004, HID_QUIRK_IGNORE },
 
+        { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
+        
         { 0, 0 }
 };
 
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index 9a808a3b4d37..68e7ebb978a9 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -121,6 +121,12 @@ static struct hidinput_key_translation powerbook_numlock_keys[] = {
         { }
 };
 
+static struct hidinput_key_translation powerbook_iso_keyboard[] = {
+        { KEY_GRAVE,    KEY_102ND },
+        { KEY_102ND,    KEY_GRAVE },
+        { }
+};
+
 static int usbhid_pb_fnmode = 1;
 module_param_named(pb_fnmode, usbhid_pb_fnmode, int, 0644);
 MODULE_PARM_DESC(pb_fnmode,
@@ -195,6 +201,14 @@ static int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
                 }
         }
 
+        if (hid->quirks & HID_QUIRK_POWERBOOK_ISO_KEYBOARD) {
+                trans = find_translation(powerbook_iso_keyboard, usage->code);
+                if (trans) {
+                        input_event(input, usage->type, trans->to, value);
+                        return 1;
+                }
+        }
+
         return 0;
 }
 
@@ -210,6 +224,9 @@ static void hidinput_pb_setup(struct input_dev *input)
 
         for (trans = powerbook_numlock_keys; trans->from; trans++)
                 set_bit(trans->to, input->keybit);
+
+        for (trans = powerbook_iso_keyboard; trans->from; trans++)
+                set_bit(trans->to, input->keybit);
 }
 #else
 static inline int hidinput_pb_event(struct hid_device *hid, struct input_dev *input,
diff --git a/drivers/usb/input/hid.h b/drivers/usb/input/hid.h
index 9b50effef758..0e76e6dcac37 100644
--- a/drivers/usb/input/hid.h
+++ b/drivers/usb/input/hid.h
@@ -260,6 +260,7 @@ struct hid_item {
 #define HID_QUIRK_POWERBOOK_HAS_FN              0x00001000
 #define HID_QUIRK_POWERBOOK_FN_ON               0x00002000
 #define HID_QUIRK_INVERT_HWHEEL                 0x00004000
+#define HID_QUIRK_POWERBOOK_ISO_KEYBOARD        0x00008000
 
 /*
  * This is the global environment of the parser. This information is
diff --git a/drivers/usb/input/usbtouchscreen.c b/drivers/usb/input/usbtouchscreen.c
index f26c1cd1129f..933ceddf3dee 100644
--- a/drivers/usb/input/usbtouchscreen.c
+++ b/drivers/usb/input/usbtouchscreen.c
@@ -256,10 +256,10 @@ static int itm_read_data(unsigned char *pkt, int *x, int *y, int *touch, int *pr
 {
         *x = ((pkt[0] & 0x1F) << 7) | (pkt[3] & 0x7F);
         *y = ((pkt[1] & 0x1F) << 7) | (pkt[4] & 0x7F);
-        *press = ((pkt[2] & 0x1F) << 7) | (pkt[5] & 0x7F);
+        *press = ((pkt[2] & 0x01) << 7) | (pkt[5] & 0x7F);
         *touch = ~pkt[7] & 0x20;
 
-        return 1;
+        return *touch;
 }
 #endif
 
@@ -640,7 +640,7 @@ static int usbtouch_probe(struct usb_interface *intf,
                                      type->max_press, 0, 0);
 
         usb_fill_int_urb(usbtouch->irq, usbtouch->udev,
-                         usb_rcvintpipe(usbtouch->udev, 0x81),
+                         usb_rcvintpipe(usbtouch->udev, endpoint->bEndpointAddress),
                          usbtouch->data, type->rept_size,
                          usbtouch_irq, usbtouch, endpoint->bInterval);
 
diff --git a/drivers/usb/input/wacom.h b/drivers/usb/input/wacom.h
index 7b3840e378a8..1cf08f02c50e 100644
--- a/drivers/usb/input/wacom.h
+++ b/drivers/usb/input/wacom.h
@@ -63,6 +63,7 @@
  *      v1.46 (pc) - Split wacom.c into wacom_sys.c and wacom_wac.c,
  *                 - where wacom_sys.c deals with system specific code,
  *                 - and wacom_wac.c deals with Wacom specific code
+ *                 - Support Intuos3 4x6
  */
 
 /*
@@ -118,6 +119,7 @@ extern void wacom_input_sync(void *wcombo);
 extern void wacom_init_input_dev(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_g4(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_g(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
+extern void input_dev_i3s(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_i3(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_i(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
 extern void input_dev_pl(struct input_dev *input_dev, struct wacom_wac *wacom_wac);
diff --git a/drivers/usb/input/wacom_sys.c b/drivers/usb/input/wacom_sys.c
index d233c37bd533..3498b893b53b 100644
--- a/drivers/usb/input/wacom_sys.c
+++ b/drivers/usb/input/wacom_sys.c
@@ -110,7 +110,7 @@ __u16 wacom_be16_to_cpu(unsigned char *data)
 __u16 wacom_le16_to_cpu(unsigned char *data)
 {
         __u16 value;
-        value = be16_to_cpu(*(__be16 *) data);
+        value = le16_to_cpu(*(__le16 *) data);
         return value;
 }
 
@@ -143,7 +143,7 @@ void input_dev_g4(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
         input_dev->evbit[0] |= BIT(EV_MSC);
         input_dev->mscbit[0] |= BIT(MSC_SERIAL);
         input_dev->keybit[LONG(BTN_DIGI)] |= BIT(BTN_TOOL_FINGER);
-        input_dev->keybit[LONG(BTN_LEFT)] |= BIT(BTN_0) | BIT(BTN_1) | BIT(BTN_2) | BIT(BTN_3) | BIT(BTN_4) | BIT(BTN_5) | BIT(BTN_6) | BIT(BTN_7);
+        input_dev->keybit[LONG(BTN_LEFT)] |= BIT(BTN_0) | BIT(BTN_4);
 }
 
 void input_dev_g(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
@@ -155,11 +155,16 @@ void input_dev_g(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
         input_set_abs_params(input_dev, ABS_DISTANCE, 0, wacom_wac->features->distance_max, 0, 0);
 }
 
-void input_dev_i3(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
+void input_dev_i3s(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
 {
         input_dev->keybit[LONG(BTN_DIGI)] |= BIT(BTN_TOOL_FINGER);
-        input_dev->keybit[LONG(BTN_LEFT)] |= BIT(BTN_0) | BIT(BTN_1) | BIT(BTN_2) | BIT(BTN_3) | BIT(BTN_4) | BIT(BTN_5) | BIT(BTN_6) | BIT(BTN_7);
+        input_dev->keybit[LONG(BTN_LEFT)] |= BIT(BTN_0) | BIT(BTN_1) | BIT(BTN_2) | BIT(BTN_3);
         input_set_abs_params(input_dev, ABS_RX, 0, 4097, 0, 0);
+}
+
+void input_dev_i3(struct input_dev *input_dev, struct wacom_wac *wacom_wac)
+{
+        input_dev->keybit[LONG(BTN_LEFT)] |= BIT(BTN_4) | BIT(BTN_5) | BIT(BTN_6) | BIT(BTN_7);
         input_set_abs_params(input_dev, ABS_RY, 0, 4097, 0, 0);
 }
 
@@ -218,8 +223,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
         strlcat(wacom->phys, "/input0", sizeof(wacom->phys));
 
         wacom_wac->features = get_wacom_feature(id);
-        if (wacom_wac->features->pktlen > 10)
-                BUG();
+        BUG_ON(wacom_wac->features->pktlen > 10);
 
         input_dev->name = wacom_wac->features->name;
         wacom->wacom_wac = wacom_wac;
@@ -244,7 +248,7 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
         usb_fill_int_urb(wacom->irq, dev,
                          usb_rcvintpipe(dev, endpoint->bEndpointAddress),
                          wacom_wac->data, wacom_wac->features->pktlen,
-                         wacom_wac->features->irq, wacom, endpoint->bInterval);
+                         wacom_sys_irq, wacom, endpoint->bInterval);
         wacom->irq->transfer_dma = wacom->data_dma;
         wacom->irq->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 
@@ -278,8 +282,8 @@ static void wacom_disconnect(struct usb_interface *intf)
                 input_unregister_device(wacom->dev);
                 usb_free_urb(wacom->irq);
                 usb_buffer_free(interface_to_usbdev(intf), 10, wacom->wacom_wac->data, wacom->data_dma);
-                kfree(wacom);
                 kfree(wacom->wacom_wac);
+                kfree(wacom);
         }
 }
 
diff --git a/drivers/usb/input/wacom_wac.c b/drivers/usb/input/wacom_wac.c
index aa31d22d4f05..92726fe89379 100644
--- a/drivers/usb/input/wacom_wac.c
+++ b/drivers/usb/input/wacom_wac.c
@@ -191,9 +191,9 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
                                 wacom_report_key(wcombo, BTN_LEFT, data[1] & 0x01);
                                 wacom_report_key(wcombo, BTN_RIGHT, data[1] & 0x02);
                                 if (wacom->features->type == WACOM_G4)
-                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[6]);
+                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[6] & 0x3f);
                                 else
-                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[7]);
+                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[7] & 0x3f);
                                 break;
                 }
         }
@@ -303,8 +303,9 @@ static int wacom_intuos_inout(struct wacom_wac *wacom, void *wcombo)
                                 wacom->tool[idx] = BTN_TOOL_PEN;
                 }
                 /* only large I3 support Lens Cursor */
-                if(!((wacom->tool[idx] == BTN_TOOL_LENS) &&
-                                (wacom->features->type == INTUOS3))) {
+                if(!((wacom->tool[idx] == BTN_TOOL_LENS)
+                                 && ((wacom->features->type == INTUOS3)
+                                 || (wacom->features->type == INTUOS3S)))) {
                         wacom_report_abs(wcombo, ABS_MISC, wacom->id[idx]); /* report tool id */
                         wacom_report_key(wcombo, wacom->tool[idx], 1);
                         wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, wacom->serial[idx]);
@@ -315,10 +316,14 @@ static int wacom_intuos_inout(struct wacom_wac *wacom, void *wcombo)
 
         /* Exit report */
         if ((data[1] & 0xfe) == 0x80) {
-                wacom_report_key(wcombo, wacom->tool[idx], 0);
-                wacom_report_abs(wcombo, ABS_MISC, 0); /* reset tool id */
-                wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, wacom->serial[idx]);
-                return 2;
+                if(!((wacom->tool[idx] == BTN_TOOL_LENS)
+                                 && ((wacom->features->type == INTUOS3)
+                                 || (wacom->features->type == INTUOS3S)))) {
+                        wacom_report_key(wcombo, wacom->tool[idx], 0);
+                        wacom_report_abs(wcombo, ABS_MISC, 0); /* reset tool id */
+                        wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, wacom->serial[idx]);
+                        return 2;
+                }
         }
         return 0;
 }
@@ -382,7 +387,8 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
                 wacom_report_abs(wcombo, ABS_RX, ((data[1] & 0x1f) << 8) | data[2]);
                 wacom_report_abs(wcombo, ABS_RY, ((data[3] & 0x1f) << 8) | data[4]);
 
-                if((data[5] & 0x0f) | (data[6] & 0x0f) | (data[1] & 0x1f) | data[2])
+                if((data[5] & 0x0f) | (data[6] & 0x0f) | (data[1] & 0x1f) |
+                        data[2] | (data[3] & 0x1f) | data[4])
                         wacom_report_key(wcombo, wacom->tool[1], 1);
                 else
                         wacom_report_key(wcombo, wacom->tool[1], 0);
@@ -432,7 +438,7 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
                                         ((t - 1) / 2) : -t / 2);
                         }
 
-                } else if (!(data[1] & 0x10) && wacom->features->type < INTUOS3) {
+                } else if (!(data[1] & 0x10) && wacom->features->type < INTUOS3S) {
                         /* 4D mouse packet */
                         wacom_report_key(wcombo, BTN_LEFT,   data[8] & 0x01);
                         wacom_report_key(wcombo, BTN_MIDDLE, data[8] & 0x02);
@@ -452,12 +458,12 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
                                                  - ((data[8] & 0x02) >> 1));
 
                         /* I3 2D mouse side buttons */
-                        if (wacom->features->type == INTUOS3) {
+                        if (wacom->features->type >= INTUOS3S && wacom->features->type <= INTUOS3L) {
                                 wacom_report_key(wcombo, BTN_SIDE,   data[8] & 0x40);
                                 wacom_report_key(wcombo, BTN_EXTRA,  data[8] & 0x20);
                         }
 
-                } else if (wacom->features->type < INTUOS3) {
+                } else if (wacom->features->type < INTUOS3S || wacom->features->type == INTUOS3L) {
                         /* Lens cursor packets */
                         wacom_report_key(wcombo, BTN_LEFT,   data[8] & 0x01);
                         wacom_report_key(wcombo, BTN_MIDDLE, data[8] & 0x02);
@@ -490,6 +496,7 @@ int wacom_wac_irq(struct wacom_wac *wacom_wac, void *wcombo)
                         return (wacom_ptu_irq(wacom_wac, wcombo));
                         break;
                 case INTUOS:
+                case INTUOS3S:
                 case INTUOS3:
                 case INTUOS3L:
                 case CINTIQ:
@@ -515,6 +522,8 @@ void wacom_init_input_dev(struct input_dev *input_dev, struct wacom_wac *wacom_w
                 case CINTIQ:
                         input_dev_i3(input_dev, wacom_wac);
                         /* fall through */
+                case INTUOS3S:
+                        input_dev_i3s(input_dev, wacom_wac);
                 case INTUOS:
                         input_dev_i(input_dev, wacom_wac);
                         break;
@@ -530,49 +539,50 @@ void wacom_init_input_dev(struct input_dev *input_dev, struct wacom_wac *wacom_w
 }
 
 static struct wacom_features wacom_features[] = {
-        { "Wacom Penpartner",    7,   5040,  3780,  255, 32, PENPARTNER,        wacom_sys_irq },
-        { "Wacom Graphire",      8,  10206,  7422,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Graphire2 4x5", 8,  10206,  7422,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Graphire2 5x7", 8,  13918, 10206,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Graphire3",     8,  10208,  7424,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Graphire3 6x8", 8,  16704, 12064,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Graphire4 4x5", 8,  10208,  7424,  511, 32, WACOM_G4,  wacom_sys_irq },
-        { "Wacom Graphire4 6x8", 8,  16704, 12064,  511, 32, WACOM_G4,  wacom_sys_irq },
-        { "Wacom Volito",        8,   5104,  3712,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom PenStation2",   8,   3250,  2320,  255, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Volito2 4x5",   8,   5104,  3712,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Volito2 2x3",   8,   3248,  2320,  511, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom PenPartner2",   8,   3250,  2320,  255, 32, GRAPHIRE,  wacom_sys_irq },
-        { "Wacom Intuos 4x5",   10,  12700, 10600, 1023, 15, INTUOS,    wacom_sys_irq},
-        { "Wacom Intuos 6x8",   10,  20320, 16240, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos 9x12",  10,  30480, 24060, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos 12x12", 10,  30480, 31680, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos 12x18", 10,  45720, 31680, 1023, 15, INTUOS,    wacom_sys_irq},
-        { "Wacom PL400",         8,   5408,  4056,  255, 32, PL,        wacom_sys_irq },
-        { "Wacom PL500",         8,   6144,  4608,  255, 32, PL,        wacom_sys_irq },
-        { "Wacom PL600",         8,   6126,  4604,  255, 32, PL,        wacom_sys_irq },
-        { "Wacom PL600SX",       8,   6260,  5016,  255, 32, PL,        wacom_sys_irq },
-        { "Wacom PL550",         8,   6144,  4608,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom PL800",         8,   7220,  5780,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom PL700",         8,   6758,  5406,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom PL510",         8,   6282,  4762,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom DTU710",        8,  34080, 27660,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom DTF521",        8,   6282,  4762,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom DTF720",        8,   6858,  5506,  511, 32, PL,        wacom_sys_irq },
-        { "Wacom Cintiq Partner",8,  20480, 15360,  511, 32, PTU,       wacom_sys_irq },
-        { "Wacom Intuos2 4x5",   10, 12700, 10600, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos2 9x12",  10, 30480, 24060, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos2 12x12", 10, 30480, 31680, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos2 12x18", 10, 45720, 31680, 1023, 15, INTUOS,    wacom_sys_irq },
-        { "Wacom Intuos3 4x5",   10, 25400, 20320, 1023, 15, INTUOS3,   wacom_sys_irq },
-        { "Wacom Intuos3 6x8",   10, 40640, 30480, 1023, 15, INTUOS3,   wacom_sys_irq },
-        { "Wacom Intuos3 9x12",  10, 60960, 45720, 1023, 15, INTUOS3,   wacom_sys_irq },
-        { "Wacom Intuos3 12x12", 10, 60960, 60960, 1023, 15, INTUOS3L,  wacom_sys_irq },
-        { "Wacom Intuos3 12x19", 10, 97536, 60960, 1023, 15, INTUOS3L,  wacom_sys_irq },
-        { "Wacom Intuos3 6x11",  10, 54204, 31750, 1023, 15, INTUOS3,   wacom_sys_irq },
-        { "Wacom Cintiq 21UX",   10, 87200, 65600, 1023, 15, CINTIQ,    wacom_sys_irq },
-        { "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 15, INTUOS,    wacom_sys_irq },
+        { "Wacom Penpartner",    7,   5040,  3780,  255,  0, PENPARTNER },
+        { "Wacom Graphire",      8,  10206,  7422,  511, 63, GRAPHIRE },
+        { "Wacom Graphire2 4x5", 8,  10206,  7422,  511, 63, GRAPHIRE },
+        { "Wacom Graphire2 5x7", 8,  13918, 10206,  511, 63, GRAPHIRE },
+        { "Wacom Graphire3",     8,  10208,  7424,  511, 63, GRAPHIRE },
+        { "Wacom Graphire3 6x8", 8,  16704, 12064,  511, 63, GRAPHIRE },
+        { "Wacom Graphire4 4x5", 8,  10208,  7424,  511, 63, WACOM_G4 },
+        { "Wacom Graphire4 6x8", 8,  16704, 12064,  511, 63, WACOM_G4 },
+        { "Wacom Volito",        8,   5104,  3712,  511,  0, GRAPHIRE },
+        { "Wacom PenStation2",   8,   3250,  2320,  255,  0, GRAPHIRE },
+        { "Wacom Volito2 4x5",   8,   5104,  3712,  511,  0, GRAPHIRE },
+        { "Wacom Volito2 2x3",   8,   3248,  2320,  511,  0, GRAPHIRE },
+        { "Wacom PenPartner2",   8,   3250,  2320,  255,  0, GRAPHIRE },
+        { "Wacom Intuos 4x5",   10,  12700, 10600, 1023, 63, INTUOS },
+        { "Wacom Intuos 6x8",   10,  20320, 16240, 1023, 63, INTUOS },
+        { "Wacom Intuos 9x12",  10,  30480, 24060, 1023, 63, INTUOS },
+        { "Wacom Intuos 12x12", 10,  30480, 31680, 1023, 63, INTUOS },
+        { "Wacom Intuos 12x18", 10,  45720, 31680, 1023, 63, INTUOS },
+        { "Wacom PL400",         8,   5408,  4056,  255,  0, PL },
+        { "Wacom PL500",         8,   6144,  4608,  255,  0, PL },
+        { "Wacom PL600",         8,   6126,  4604,  255,  0, PL },
+        { "Wacom PL600SX",       8,   6260,  5016,  255,  0, PL },
+        { "Wacom PL550",         8,   6144,  4608,  511,  0, PL },
+        { "Wacom PL800",         8,   7220,  5780,  511,  0, PL },
+        { "Wacom PL700",         8,   6758,  5406,  511,  0, PL },
+        { "Wacom PL510",         8,   6282,  4762,  511,  0, PL },
+        { "Wacom DTU710",        8,  34080, 27660,  511,  0, PL },
+        { "Wacom DTF521",        8,   6282,  4762,  511,  0, PL },
+        { "Wacom DTF720",        8,   6858,  5506,  511,  0, PL },
+        { "Wacom Cintiq Partner",8,  20480, 15360,  511,  0, PTU },
+        { "Wacom Intuos2 4x5",   10, 12700, 10600, 1023, 63, INTUOS },
+        { "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 63, INTUOS },
+        { "Wacom Intuos2 9x12",  10, 30480, 24060, 1023, 63, INTUOS },
+        { "Wacom Intuos2 12x12", 10, 30480, 31680, 1023, 63, INTUOS },
+        { "Wacom Intuos2 12x18", 10, 45720, 31680, 1023, 63, INTUOS },
+        { "Wacom Intuos3 4x5",   10, 25400, 20320, 1023, 63, INTUOS3S },
+        { "Wacom Intuos3 6x8",   10, 40640, 30480, 1023, 63, INTUOS3 },
+        { "Wacom Intuos3 9x12",  10, 60960, 45720, 1023, 63, INTUOS3 },
+        { "Wacom Intuos3 12x12", 10, 60960, 60960, 1023, 63, INTUOS3L },
+        { "Wacom Intuos3 12x19", 10, 97536, 60960, 1023, 63, INTUOS3L },
+        { "Wacom Intuos3 6x11",  10, 54204, 31750, 1023, 63, INTUOS3 },
+        { "Wacom Intuos3 4x6",   10, 31496, 19685, 1023, 15, INTUOS3S },
+        { "Wacom Cintiq 21UX",   10, 87200, 65600, 1023, 63, CINTIQ },
+        { "Wacom Intuos2 6x8",   10, 20320, 16240, 1023, 63, INTUOS },
         { }
 };
 
@@ -618,6 +628,7 @@ static struct usb_device_id wacom_ids[] = {
         { USB_DEVICE(USB_VENDOR_ID_WACOM, 0xB3) },
         { USB_DEVICE(USB_VENDOR_ID_WACOM, 0xB4) },
         { USB_DEVICE(USB_VENDOR_ID_WACOM, 0xB5) },
+        { USB_DEVICE(USB_VENDOR_ID_WACOM, 0xB7) },
         { USB_DEVICE(USB_VENDOR_ID_WACOM, 0x3F) },
         { USB_DEVICE(USB_VENDOR_ID_WACOM, 0x47) },
         { }
diff --git a/drivers/usb/input/wacom_wac.h b/drivers/usb/input/wacom_wac.h
index ceae7bf59d9f..a1d9ce007970 100644
--- a/drivers/usb/input/wacom_wac.h
+++ b/drivers/usb/input/wacom_wac.h
@@ -20,6 +20,7 @@ enum {
         PTU,
         PL,
         INTUOS,
+        INTUOS3S,
         INTUOS3,
         INTUOS3L,
         CINTIQ,
@@ -34,7 +35,6 @@ struct wacom_features {
         int pressure_max;
         int distance_max;
         int type;
-        usb_complete_t irq;
 };
 
 struct wacom_wac {
diff --git a/drivers/usb/input/xpad.c b/drivers/usb/input/xpad.c
index cebb6c463bfb..df97e5c803f9 100644
--- a/drivers/usb/input/xpad.c
+++ b/drivers/usb/input/xpad.c
@@ -1,8 +1,13 @@
 /*
- * X-Box gamepad - v0.0.5
+ * X-Box gamepad - v0.0.6
  *
  * Copyright (c) 2002 Marko Friedemann <mfr@bmx-chemnitz.de>
- *
+ *               2004 Oliver Schwartz <Oliver.Schwartz@gmx.de>,
+ *                    Steven Toth <steve@toth.demon.co.uk>,
+ *                    Franz Lehner <franz@caos.at>,
+ *                    Ivan Hawkes <blackhawk@ivanhawkes.com>
+ *               2005 Dominic Cerquetti <binary1230@yahoo.com>
+ *               2006 Adam Buchbinder <adam.buchbinder@gmail.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -28,11 +33,13 @@
  *  - ITO Takayuki for providing essential xpad information on his website
  *  - Vojtech Pavlik     - iforce driver / input subsystem
  *  - Greg Kroah-Hartman - usb-skeleton driver
+ *  - XBOX Linux project - extra USB id's
  *
  * TODO:
- *  - fine tune axes
+ *  - fine tune axes (especially trigger axes)
  *  - fix "analog" buttons (reported as digital now)
  *  - get rumble working
+ *  - need USB IDs for other dance pads
  *
  * History:
  *
@@ -52,30 +59,79 @@
  *  - fixed d-pad to axes mapping
  *
  * 2002-07-17 - 0.0.5 : simplified d-pad handling
+ *
+ * 2004-10-02 - 0.0.6 : DDR pad support
+ *  - borrowed from the XBOX linux kernel
+ *  - USB id's for commonly used dance pads are present
+ *  - dance pads will map D-PAD to buttons, not axes
+ *  - pass the module paramater 'dpad_to_buttons' to force
+ *    the D-PAD to map to buttons if your pad is not detected
  */
 
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/stat.h>
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/smp_lock.h>
 #include <linux/usb/input.h>
 
-#define DRIVER_VERSION "v0.0.5"
+#define DRIVER_VERSION "v0.0.6"
 #define DRIVER_AUTHOR "Marko Friedemann <mfr@bmx-chemnitz.de>"
 #define DRIVER_DESC "X-Box pad driver"
 
 #define XPAD_PKT_LEN 32
 
+/* xbox d-pads should map to buttons, as is required for DDR pads
+   but we map them to axes when possible to simplify things */
+#define MAP_DPAD_TO_BUTTONS    0
+#define MAP_DPAD_TO_AXES       1
+#define MAP_DPAD_UNKNOWN       -1
+
+static int dpad_to_buttons;
+module_param(dpad_to_buttons, bool, S_IRUGO);
+MODULE_PARM_DESC(dpad_to_buttons, "Map D-PAD to buttons rather than axes for unknown pads");
+
 static const struct xpad_device {
         u16 idVendor;
         u16 idProduct;
         char *name;
+        u8 dpad_mapping;
 } xpad_device[] = {
-        { 0x045e, 0x0202, "Microsoft X-Box pad (US)" },
-        { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)" },
-        { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)" },
-        { 0x0000, 0x0000, "X-Box pad" }
+        { 0x045e, 0x0202, "Microsoft X-Box pad v1 (US)", MAP_DPAD_TO_AXES },
+        { 0x045e, 0x0289, "Microsoft X-Box pad v2 (US)", MAP_DPAD_TO_AXES },
+        { 0x045e, 0x0285, "Microsoft X-Box pad (Japan)", MAP_DPAD_TO_AXES },
+        { 0x045e, 0x0287, "Microsoft Xbox Controller S", MAP_DPAD_TO_AXES },
+        { 0x0c12, 0x8809, "RedOctane Xbox Dance Pad", MAP_DPAD_TO_BUTTONS },
+        { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", MAP_DPAD_TO_AXES },
+        { 0x046d, 0xca84, "Logitech Xbox Cordless Controller", MAP_DPAD_TO_AXES },
+        { 0x046d, 0xca88, "Logitech Compact Controller for Xbox", MAP_DPAD_TO_AXES },
+        { 0x05fd, 0x1007, "Mad Catz Controller (unverified)", MAP_DPAD_TO_AXES },
+        { 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x4516, "Mad Catz Control Pad", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x4522, "Mad Catz LumiCON", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x4526, "Mad Catz Control Pad Pro", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x4536, "Mad Catz MicroCON", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x4540, "Mad Catz Beat Pad", MAP_DPAD_TO_BUTTONS },
+        { 0x0738, 0x4556, "Mad Catz Lynx Wireless Controller", MAP_DPAD_TO_AXES },
+        { 0x0738, 0x6040, "Mad Catz Beat Pad Pro", MAP_DPAD_TO_BUTTONS },
+        { 0x0c12, 0x8802, "Zeroplus Xbox Controller", MAP_DPAD_TO_AXES },
+        { 0x0c12, 0x8810, "Zeroplus Xbox Controller", MAP_DPAD_TO_AXES },
+        { 0x0c12, 0x9902, "HAMA VibraX - *FAULTY HARDWARE*", MAP_DPAD_TO_AXES },
+        { 0x0e4c, 0x1097, "Radica Gamester Controller", MAP_DPAD_TO_AXES },
+        { 0x0e4c, 0x2390, "Radica Games Jtech Controller", MAP_DPAD_TO_AXES},
+        { 0x0e6f, 0x0003, "Logic3 Freebird wireless Controller", MAP_DPAD_TO_AXES },
+        { 0x0e6f, 0x0005, "Eclipse wireless Controller", MAP_DPAD_TO_AXES },
+        { 0x0e6f, 0x0006, "Edge wireless Controller", MAP_DPAD_TO_AXES },
+        { 0x0e8f, 0x0201, "SmartJoy Frag Xpad/PS2 adaptor", MAP_DPAD_TO_AXES },
+        { 0x0f30, 0x0202, "Joytech Advanced Controller", MAP_DPAD_TO_AXES },
+        { 0x0f30, 0x8888, "BigBen XBMiniPad Controller", MAP_DPAD_TO_AXES },
+        { 0x102c, 0xff0c, "Joytech Wireless Advanced Controller", MAP_DPAD_TO_AXES },
+        { 0x12ab, 0x8809, "Xbox DDR dancepad", MAP_DPAD_TO_BUTTONS },
+        { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS },
+        { 0xffff, 0xffff, "Chinese-made Xbox Controller", MAP_DPAD_TO_AXES },
+        { 0x0000, 0x0000, "Generic X-Box pad", MAP_DPAD_UNKNOWN }
 };
 
 static const signed short xpad_btn[] = {
@@ -84,11 +140,23 @@ static const signed short xpad_btn[] = {
         -1                                              /* terminating entry */
 };
 
+/* only used if MAP_DPAD_TO_BUTTONS */
+static const signed short xpad_btn_pad[] = {
+        BTN_LEFT, BTN_RIGHT,            /* d-pad left, right */
+        BTN_0, BTN_1,                   /* d-pad up, down (XXX names??) */
+        -1                              /* terminating entry */
+};
+
 static const signed short xpad_abs[] = {
         ABS_X, ABS_Y,           /* left stick */
         ABS_RX, ABS_RY,         /* right stick */
         ABS_Z, ABS_RZ,          /* triggers left/right */
-        ABS_HAT0X, ABS_HAT0Y,   /* digital pad */
+        -1                      /* terminating entry */
+};
+
+/* only used if MAP_DPAD_TO_AXES */
+static const signed short xpad_abs_pad[] = {
+        ABS_HAT0X, ABS_HAT0Y,   /* d-pad axes */
         -1                      /* terminating entry */
 };
 
@@ -100,14 +168,16 @@ static struct usb_device_id xpad_table [] = {
 MODULE_DEVICE_TABLE (usb, xpad_table);
 
 struct usb_xpad {
-        struct input_dev *dev;                  /* input device interface */
-        struct usb_device *udev;                /* usb device */
+        struct input_dev *dev;          /* input device interface */
+        struct usb_device *udev;        /* usb device */
 
-        struct urb *irq_in;                     /* urb for interrupt in report */
-        unsigned char *idata;                   /* input data */
+        struct urb *irq_in;             /* urb for interrupt in report */
+        unsigned char *idata;           /* input data */
         dma_addr_t idata_dma;
 
-        char phys[65];                          /* physical device path */
+        char phys[65];                  /* physical device path */
+
+        int dpad_mapping;               /* map d-pad to buttons or to axes */
 };
 
 /*
@@ -137,14 +207,21 @@ static void xpad_process_packet(struct usb_xpad *xpad, u16 cmd, unsigned char *d
         input_report_abs(dev, ABS_RZ, data[11]);
 
         /* digital pad */
-        input_report_abs(dev, ABS_HAT0X, !!(data[2] & 0x08) - !!(data[2] & 0x04));
-        input_report_abs(dev, ABS_HAT0Y, !!(data[2] & 0x02) - !!(data[2] & 0x01));
+        if (xpad->dpad_mapping == MAP_DPAD_TO_AXES) {
+                input_report_abs(dev, ABS_HAT0X, !!(data[2] & 0x08) - !!(data[2] & 0x04));
+                input_report_abs(dev, ABS_HAT0Y, !!(data[2] & 0x02) - !!(data[2] & 0x01));
+        } else /* xpad->dpad_mapping == MAP_DPAD_TO_BUTTONS */ {
+                input_report_key(dev, BTN_LEFT,  data[2] & 0x04);
+                input_report_key(dev, BTN_RIGHT, data[2] & 0x08);
+                input_report_key(dev, BTN_0,     data[2] & 0x01); // up
+                input_report_key(dev, BTN_1,     data[2] & 0x02); // down
+        }
 
         /* start/back buttons and stick press left/right */
-        input_report_key(dev, BTN_START, (data[2] & 0x10) >> 4);
-        input_report_key(dev, BTN_BACK, (data[2] & 0x20) >> 5);
-        input_report_key(dev, BTN_THUMBL, (data[2] & 0x40) >> 6);
-        input_report_key(dev, BTN_THUMBR, data[2] >> 7);
+        input_report_key(dev, BTN_START,  data[2] & 0x10);
+        input_report_key(dev, BTN_BACK,   data[2] & 0x20);
+        input_report_key(dev, BTN_THUMBL, data[2] & 0x40);
+        input_report_key(dev, BTN_THUMBR, data[2] & 0x80);
 
         /* "analog" buttons A, B, X, Y */
         input_report_key(dev, BTN_A, data[4]);
@@ -206,6 +283,28 @@ static void xpad_close (struct input_dev *dev)
         usb_kill_urb(xpad->irq_in);
 }
 
+static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)
+{
+        set_bit(abs, input_dev->absbit);
+
+        switch (abs) {
+        case ABS_X:
+        case ABS_Y:
+        case ABS_RX:
+        case ABS_RY:    /* the two sticks */
+                input_set_abs_params(input_dev, abs, -32768, 32767, 16, 128);
+                break;
+        case ABS_Z:
+        case ABS_RZ:    /* the triggers */
+                input_set_abs_params(input_dev, abs, 0, 255, 0, 0);
+                break;
+        case ABS_HAT0X:
+        case ABS_HAT0Y: /* the d-pad (only if MAP_DPAD_TO_AXES) */
+                input_set_abs_params(input_dev, abs, -1, 1, 0, 0);
+                break;
+        }
+}
+
 static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
         struct usb_device *udev = interface_to_usbdev (intf);
@@ -235,6 +334,9 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
                 goto fail2;
 
         xpad->udev = udev;
+        xpad->dpad_mapping = xpad_device[i].dpad_mapping;
+        if (xpad->dpad_mapping == MAP_DPAD_UNKNOWN)
+                xpad->dpad_mapping = dpad_to_buttons;
         xpad->dev = input_dev;
         usb_make_path(udev, xpad->phys, sizeof(xpad->phys));
         strlcat(xpad->phys, "/input0", sizeof(xpad->phys));
@@ -249,32 +351,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
 
         input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
 
+        /* set up buttons */
         for (i = 0; xpad_btn[i] >= 0; i++)
                 set_bit(xpad_btn[i], input_dev->keybit);
+        if (xpad->dpad_mapping == MAP_DPAD_TO_BUTTONS)
+                for (i = 0; xpad_btn_pad[i] >= 0; i++)
+                        set_bit(xpad_btn_pad[i], input_dev->keybit);
 
-        for (i = 0; xpad_abs[i] >= 0; i++) {
-
-                signed short t = xpad_abs[i];
-
-                set_bit(t, input_dev->absbit);
-
-                switch (t) {
-                        case ABS_X:
-                        case ABS_Y:
-                        case ABS_RX:
-                        case ABS_RY:    /* the two sticks */
-                                input_set_abs_params(input_dev, t, -32768, 32767, 16, 128);
-                                break;
-                        case ABS_Z:
-                        case ABS_RZ:    /* the triggers */
-                                input_set_abs_params(input_dev, t, 0, 255, 0, 0);
-                                break;
-                        case ABS_HAT0X:
-                        case ABS_HAT0Y: /* the d-pad */
-                                input_set_abs_params(input_dev, t, -1, 1, 0, 0);
-                                break;
-                }
-        }
+        /* set up axes */
+        for (i = 0; xpad_abs[i] >= 0; i++)
+                xpad_set_up_abs(input_dev, xpad_abs[i]);
+        if (xpad->dpad_mapping == MAP_DPAD_TO_AXES)
+                for (i = 0; xpad_abs_pad[i] >= 0; i++)
+                    xpad_set_up_abs(input_dev, xpad_abs_pad[i]);
 
         ep_irq_in = &intf->cur_altsetting->endpoint[0].desc;
         usb_fill_int_urb(xpad->irq_in, udev,
@@ -305,7 +394,8 @@ static void xpad_disconnect(struct usb_interface *intf)
                 usb_kill_urb(xpad->irq_in);
                 input_unregister_device(xpad->dev);
                 usb_free_urb(xpad->irq_in);
-                usb_buffer_free(interface_to_usbdev(intf), XPAD_PKT_LEN, xpad->idata, xpad->idata_dma);
+                usb_buffer_free(interface_to_usbdev(intf), XPAD_PKT_LEN,
+                                xpad->idata, xpad->idata_dma);
                 kfree(xpad);
         }
 }
diff --git a/drivers/usb/misc/Kconfig b/drivers/usb/misc/Kconfig
index c29658f69e2a..a74bf8617e7f 100644
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -223,6 +223,16 @@ config USB_LD
           To compile this driver as a module, choose M here: the
           module will be called ldusb.
 
+config USB_TRANCEVIBRATOR
+        tristate "PlayStation 2 Trance Vibrator driver support"
+        depends on USB
+        help
+          Say Y here if you want to connect a PlayStation 2 Trance Vibrator
+          device to your computer's USB port.
+
+          To compile this driver as a module, choose M here: the
+          module will be called trancevibrator.
+
 config USB_TEST
         tristate "USB testing driver (DEVELOPMENT)"
         depends on USB && USB_DEVICEFS && EXPERIMENTAL
diff --git a/drivers/usb/misc/Makefile b/drivers/usb/misc/Makefile
index 2be70fa259bf..11dc59540cda 100644
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -21,6 +21,7 @@ obj-$(CONFIG_USB_PHIDGETMOTORCONTROL)	+= phidgetmotorcontrol.o
 obj-$(CONFIG_USB_PHIDGETSERVO)  += phidgetservo.o
 obj-$(CONFIG_USB_RIO500)        += rio500.o
 obj-$(CONFIG_USB_TEST)          += usbtest.o
+obj-$(CONFIG_USB_TRANCEVIBRATOR)        += trancevibrator.o
 obj-$(CONFIG_USB_USS720)        += uss720.o
 
 obj-$(CONFIG_USB_SISUSBVGA)     += sisusbvga/
diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
index aecd633fe9f6..af2934e016a7 100644
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -370,7 +370,8 @@ static int adu_release(struct inode *inode, struct file *file)
         retval = adu_release_internal(dev);
 
 exit:
-        up(&dev->sem);
+        if (dev)
+                up(&dev->sem);
         dbg(2," %s : leave, return value %d", __FUNCTION__, retval);
         return retval;
 }
diff --git a/drivers/usb/misc/auerswald.c b/drivers/usb/misc/auerswald.c
index 0be9d62d62ae..e4971d6aaafb 100644
--- a/drivers/usb/misc/auerswald.c
+++ b/drivers/usb/misc/auerswald.c
@@ -780,7 +780,7 @@ static int auerbuf_setup (pauerbufctl_t bcp, unsigned int numElements, unsigned
 
 bl_fail:/* not enough memory. Free allocated elements */
         dbg ("auerbuf_setup: no more memory");
-        kfree(bep);
+        auerbuf_free(bep);
         auerbuf_free_buffers (bcp);
         return -ENOMEM;
 }
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index 0eb26a26115b..9b591b8b9369 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -513,8 +513,6 @@ static void ftdi_elan_respond_work(void *data)
                         ftdi->disconnected += 1;
                 } else if (retval == -ENODEV) {
                         ftdi->disconnected += 1;
-                } else if (retval == -ENODEV) {
-                        ftdi->disconnected += 1;
                 } else if (retval == -EILSEQ) {
                         ftdi->disconnected += 1;
                 } else {
@@ -1186,11 +1184,8 @@ static ssize_t ftdi_elan_write(struct file *file,
         int retval = 0;
         struct urb *urb;
         char *buf;
-        char data[30 *3 + 4];
-        char *d = data;
-        const char __user *s = user_buffer;
-        int m = (sizeof(data) - 1) / 3;
-        struct usb_ftdi *ftdi = (struct usb_ftdi *)file->private_data;
+        struct usb_ftdi *ftdi = file->private_data;
+
         if (ftdi->disconnected > 0) {
                 return -ENODEV;
         }
@@ -1220,27 +1215,18 @@ static ssize_t ftdi_elan_write(struct file *file,
         if (retval) {
                 dev_err(&ftdi->udev->dev, "failed submitting write urb, error %"
                         "d\n", retval);
-                goto error_4;
+                goto error_3;
         }
         usb_free_urb(urb);
-      exit:;
-        if (count > m) {
-                int I = m - 1;
-                while (I-- > 0) {
-                        d += sprintf(d, " %02X", 0x000000FF & *s++);
-                }
-                d += sprintf(d, " ..");
-        } else {
-                int I = count;
-                while (I-- > 0) {
-                        d += sprintf(d, " %02X", 0x000000FF & *s++);
-                }
-        }
+
+exit:
         return count;
-      error_4: error_3:usb_buffer_free(ftdi->udev, count, buf,
-              urb->transfer_dma);
-      error_2:usb_free_urb(urb);
-      error_1:return retval;
+error_3:
+        usb_buffer_free(ftdi->udev, count, buf, urb->transfer_dma);
+error_2:
+        usb_free_urb(urb);
+error_1:
+        return retval;
 }
 
 static struct file_operations ftdi_elan_fops = {
diff --git a/drivers/usb/input/trancevibrator.c b/drivers/usb/misc/trancevibrator.c
index 33cd91d11eca..33cd91d11eca 100644
--- a/drivers/usb/input/trancevibrator.c
+++ b/drivers/usb/misc/trancevibrator.c
diff --git a/drivers/usb/net/Kconfig b/drivers/usb/net/Kconfig
index 054059632a21..e081836014ac 100644
--- a/drivers/usb/net/Kconfig
+++ b/drivers/usb/net/Kconfig
@@ -92,8 +92,13 @@ config USB_RTL8150
           To compile this driver as a module, choose M here: the
           module will be called rtl8150.
 
+config USB_USBNET_MII
+        tristate
+        default n
+
 config USB_USBNET
         tristate "Multi-purpose USB Networking Framework"
+        select MII if USBNET_MII != n
         ---help---
           This driver supports several kinds of network links over USB,
           with "minidrivers" built around a common network driver core
@@ -129,7 +134,7 @@ config USB_NET_AX8817X
         tristate "ASIX AX88xxx Based USB 2.0 Ethernet Adapters"
         depends on USB_USBNET && NET_ETHERNET
         select CRC32
-        select MII
+        select USB_USBNET_MII
         default y
         help
           This option adds support for ASIX AX88xxx based USB 2.0
@@ -207,6 +212,15 @@ config USB_NET_PLUSB
           Choose this option if you're using a host-to-host cable
           with one of these chips.
 
+config USB_NET_MCS7830
+        tristate "MosChip MCS7830 based Ethernet adapters"
+        depends on USB_USBNET
+        select USB_USBNET_MII
+        help
+          Choose this option if you're using a 10/100 Ethernet USB2
+          adapter based on the MosChip 7830 controller. This includes
+          adapters marketed under the DeLOCK brand.
+
 config USB_NET_RNDIS_HOST
         tristate "Host for RNDIS devices (EXPERIMENTAL)"
         depends on USB_USBNET && EXPERIMENTAL
diff --git a/drivers/usb/net/Makefile b/drivers/usb/net/Makefile
index 160f19dbdf12..7b51964de171 100644
--- a/drivers/usb/net/Makefile
+++ b/drivers/usb/net/Makefile
@@ -14,6 +14,7 @@ obj-$(CONFIG_USB_NET_PLUSB)	+= plusb.o
 obj-$(CONFIG_USB_NET_RNDIS_HOST)        += rndis_host.o
 obj-$(CONFIG_USB_NET_CDC_SUBSET)        += cdc_subset.o
 obj-$(CONFIG_USB_NET_ZAURUS)    += zaurus.o
+obj-$(CONFIG_USB_NET_MCS7830)   += mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 
 ifeq ($(CONFIG_USB_DEBUG),y)
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index c73dd224aa76..881841e600de 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -569,10 +569,12 @@ static int asix_mdio_read(struct net_device *netdev, int phy_id, int loc)
         struct usbnet *dev = netdev_priv(netdev);
         u16 res;
 
+        mutex_lock(&dev->phy_mutex);
         asix_set_sw_mii(dev);
         asix_read_cmd(dev, AX_CMD_READ_MII_REG, phy_id,
                                 (__u16)loc, 2, (u16 *)&res);
         asix_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
 
         devdbg(dev, "asix_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x", phy_id, loc, le16_to_cpu(res & 0xffff));
 
@@ -586,10 +588,12 @@ asix_mdio_write(struct net_device *netdev, int phy_id, int loc, int val)
         u16 res = cpu_to_le16(val);
 
         devdbg(dev, "asix_mdio_write() phy_id=0x%02x, loc=0x%02x, val=0x%04x", phy_id, loc, val);
+        mutex_lock(&dev->phy_mutex);
         asix_set_sw_mii(dev);
         asix_write_cmd(dev, AX_CMD_WRITE_MII_REG, phy_id,
                                 (__u16)loc, 2, (u16 *)&res);
         asix_set_hw_mii(dev);
+        mutex_unlock(&dev->phy_mutex);
 }
 
 /* Get the PHY Identifier from the PHYSID1 & PHYSID2 MII registers */
@@ -700,32 +704,6 @@ static void asix_get_drvinfo (struct net_device *net,
         info->eedump_len = data->eeprom_len;
 }
 
-static int asix_get_settings(struct net_device *net, struct ethtool_cmd *cmd)
-{
-        struct usbnet *dev = netdev_priv(net);
-
-        return mii_ethtool_gset(&dev->mii,cmd);
-}
-
-static int asix_set_settings(struct net_device *net, struct ethtool_cmd *cmd)
-{
-        struct usbnet *dev = netdev_priv(net);
-        int res = mii_ethtool_sset(&dev->mii,cmd);
-
-        /* link speed/duplex might have changed */
-        if (dev->driver_info->link_reset)
-                dev->driver_info->link_reset(dev);
-
-        return res;
-}
-
-static int asix_nway_reset(struct net_device *net)
-{
-        struct usbnet *dev = netdev_priv(net);
-
-        return mii_nway_restart(&dev->mii);
-}
-
 static u32 asix_get_link(struct net_device *net)
 {
         struct usbnet *dev = netdev_priv(net);
@@ -746,15 +724,15 @@ static int asix_ioctl (struct net_device *net, struct ifreq *rq, int cmd)
 static struct ethtool_ops ax88172_ethtool_ops = {
         .get_drvinfo            = asix_get_drvinfo,
         .get_link               = asix_get_link,
-        .nway_reset             = asix_nway_reset,
         .get_msglevel           = usbnet_get_msglevel,
         .set_msglevel           = usbnet_set_msglevel,
         .get_wol                = asix_get_wol,
         .set_wol                = asix_set_wol,
         .get_eeprom_len         = asix_get_eeprom_len,
         .get_eeprom             = asix_get_eeprom,
-        .get_settings           = asix_get_settings,
-        .set_settings           = asix_set_settings,
+        .get_settings           = usbnet_get_settings,
+        .set_settings           = usbnet_set_settings,
+        .nway_reset             = usbnet_nway_reset,
 };
 
 static void ax88172_set_multicast(struct net_device *net)
@@ -885,15 +863,15 @@ out1:
 static struct ethtool_ops ax88772_ethtool_ops = {
         .get_drvinfo            = asix_get_drvinfo,
         .get_link               = asix_get_link,
-        .nway_reset             = asix_nway_reset,
         .get_msglevel           = usbnet_get_msglevel,
         .set_msglevel           = usbnet_set_msglevel,
         .get_wol                = asix_get_wol,
         .set_wol                = asix_set_wol,
         .get_eeprom_len         = asix_get_eeprom_len,
         .get_eeprom             = asix_get_eeprom,
-        .get_settings           = asix_get_settings,
-        .set_settings           = asix_set_settings,
+        .get_settings           = usbnet_get_settings,
+        .set_settings           = usbnet_set_settings,
+        .nway_reset             = usbnet_nway_reset,
 };
 
 static int ax88772_link_reset(struct usbnet *dev)
@@ -1046,15 +1024,15 @@ out1:
 static struct ethtool_ops ax88178_ethtool_ops = {
         .get_drvinfo            = asix_get_drvinfo,
         .get_link               = asix_get_link,
-        .nway_reset             = asix_nway_reset,
         .get_msglevel           = usbnet_get_msglevel,
         .set_msglevel           = usbnet_set_msglevel,
         .get_wol                = asix_get_wol,
         .set_wol                = asix_set_wol,
         .get_eeprom_len         = asix_get_eeprom_len,
         .get_eeprom             = asix_get_eeprom,
-        .get_settings           = asix_get_settings,
-        .set_settings           = asix_set_settings,
+        .get_settings           = usbnet_get_settings,
+        .set_settings           = usbnet_set_settings,
+        .nway_reset             = usbnet_nway_reset,
 };
 
 static int marvell_phy_init(struct usbnet *dev)
diff --git a/drivers/usb/net/cdc_ether.c b/drivers/usb/net/cdc_ether.c
index 82ce0358d9a3..f6971b88349d 100644
--- a/drivers/usb/net/cdc_ether.c
+++ b/drivers/usb/net/cdc_ether.c
@@ -498,7 +498,7 @@ static struct usb_driver cdc_driver = {
 
 static int __init cdc_init(void)
 {
-        BUG_ON((sizeof(((struct usbnet *)0)->data)
+        BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
                         < sizeof(struct cdc_state)));
 
         return usb_register(&cdc_driver);
diff --git a/drivers/usb/net/kaweth.c b/drivers/usb/net/kaweth.c
index 957d4ad316f9..7c906a43e497 100644
--- a/drivers/usb/net/kaweth.c
+++ b/drivers/usb/net/kaweth.c
@@ -65,16 +65,6 @@
 
 #undef DEBUG
 
-#ifdef DEBUG
-#define kaweth_dbg(format, arg...) printk(KERN_DEBUG __FILE__ ": " format "\n" ,##arg)
-#else
-#define kaweth_dbg(format, arg...) do {} while (0)
-#endif
-#define kaweth_err(format, arg...) printk(KERN_ERR __FILE__ ": " format "\n" ,##arg)
-#define kaweth_info(format, arg...) printk(KERN_INFO __FILE__ ": " format "\n" , ##arg)
-#define kaweth_warn(format, arg...) printk(KERN_WARNING __FILE__ ": " format "\n" , ##arg)
-
-
 #include "kawethfw.h"
 
 #define KAWETH_MTU                      1514
@@ -86,6 +76,9 @@
 
 #define KAWETH_STATUS_BROKEN            0x0000001
 #define KAWETH_STATUS_CLOSING           0x0000002
+#define KAWETH_STATUS_SUSPENDING        0x0000004
+
+#define KAWETH_STATUS_BLOCKED (KAWETH_STATUS_CLOSING | KAWETH_STATUS_SUSPENDING)
 
 #define KAWETH_PACKET_FILTER_PROMISCUOUS        0x01
 #define KAWETH_PACKET_FILTER_ALL_MULTICAST      0x02
@@ -112,6 +105,8 @@
 #define STATE_MASK                              0x40
 #define STATE_SHIFT                             5
 
+#define IS_BLOCKED(s) (s & KAWETH_STATUS_BLOCKED)
+
 
 MODULE_AUTHOR("Michael Zappe <zapman@interlan.net>, Stephane Alnet <stephane@u-picardie.fr>, Brad Hards <bhards@bigpond.net.au> and Oliver Neukum <oliver@neukum.org>");
 MODULE_DESCRIPTION("KL5USB101 USB Ethernet driver");
@@ -128,6 +123,8 @@ static int kaweth_internal_control_msg(struct usb_device *usb_dev,
                                        unsigned int pipe,
                                        struct usb_ctrlrequest *cmd, void *data,
                                        int len, int timeout);
+static int kaweth_suspend(struct usb_interface *intf, pm_message_t message);
+static int kaweth_resume(struct usb_interface *intf);
 
 /****************************************************************
  *     usb_device_id
@@ -179,6 +176,8 @@ static struct usb_driver kaweth_driver = {
         .name =         driver_name,
         .probe =        kaweth_probe,
         .disconnect =   kaweth_disconnect,
+        .suspend =      kaweth_suspend,
+        .resume =       kaweth_resume,
         .id_table =     usb_klsi_table,
 };
 
@@ -222,6 +221,7 @@ struct kaweth_device
         int suspend_lowmem_rx;
         int suspend_lowmem_ctrl;
         int linkstate;
+        int opened;
         struct work_struct lowmem_work;
 
         struct usb_device *dev;
@@ -265,17 +265,17 @@ static int kaweth_control(struct kaweth_device *kaweth,
 {
         struct usb_ctrlrequest *dr;
 
-        kaweth_dbg("kaweth_control()");
+        dbg("kaweth_control()");
 
         if(in_interrupt()) {
-                kaweth_dbg("in_interrupt()");
+                dbg("in_interrupt()");
                 return -EBUSY;
         }
 
         dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
 
         if (!dr) {
-                kaweth_dbg("kmalloc() failed");
+                dbg("kmalloc() failed");
                 return -ENOMEM;
         }
 
@@ -300,7 +300,7 @@ static int kaweth_read_configuration(struct kaweth_device *kaweth)
 {
         int retval;
 
-        kaweth_dbg("Reading kaweth configuration");
+        dbg("Reading kaweth configuration");
 
         retval = kaweth_control(kaweth,
                                 usb_rcvctrlpipe(kaweth->dev, 0),
@@ -322,7 +322,7 @@ static int kaweth_set_urb_size(struct kaweth_device *kaweth, __u16 urb_size)
 {
         int retval;
 
-        kaweth_dbg("Setting URB size to %d", (unsigned)urb_size);
+        dbg("Setting URB size to %d", (unsigned)urb_size);
 
         retval = kaweth_control(kaweth,
                                 usb_sndctrlpipe(kaweth->dev, 0),
@@ -344,7 +344,7 @@ static int kaweth_set_sofs_wait(struct kaweth_device *kaweth, __u16 sofs_wait)
 {
         int retval;
 
-        kaweth_dbg("Set SOFS wait to %d", (unsigned)sofs_wait);
+        dbg("Set SOFS wait to %d", (unsigned)sofs_wait);
 
         retval = kaweth_control(kaweth,
                                 usb_sndctrlpipe(kaweth->dev, 0),
@@ -367,7 +367,7 @@ static int kaweth_set_receive_filter(struct kaweth_device *kaweth,
 {
         int retval;
 
-        kaweth_dbg("Set receive filter to %d", (unsigned)receive_filter);
+        dbg("Set receive filter to %d", (unsigned)receive_filter);
 
         retval = kaweth_control(kaweth,
                                 usb_sndctrlpipe(kaweth->dev, 0),
@@ -392,7 +392,7 @@ static int kaweth_download_firmware(struct kaweth_device *kaweth,
                                     __u8 type)
 {
         if(data_len > KAWETH_FIRMWARE_BUF_SIZE) {
-                kaweth_err("Firmware too big: %d", data_len);
+                err("Firmware too big: %d", data_len);
                 return -ENOSPC;
         }
 
@@ -403,13 +403,13 @@ static int kaweth_download_firmware(struct kaweth_device *kaweth,
         kaweth->firmware_buf[4] = type;
         kaweth->firmware_buf[5] = interrupt;
 
-        kaweth_dbg("High: %i, Low:%i", kaweth->firmware_buf[3],
+        dbg("High: %i, Low:%i", kaweth->firmware_buf[3],
                    kaweth->firmware_buf[2]);
 
-        kaweth_dbg("Downloading firmware at %p to kaweth device at %p",
+        dbg("Downloading firmware at %p to kaweth device at %p",
             data,
             kaweth);
-        kaweth_dbg("Firmware length: %d", data_len);
+        dbg("Firmware length: %d", data_len);
 
         return kaweth_control(kaweth,
                               usb_sndctrlpipe(kaweth->dev, 0),
@@ -437,7 +437,7 @@ static int kaweth_trigger_firmware(struct kaweth_device *kaweth,
         kaweth->firmware_buf[6] = 0x00;
         kaweth->firmware_buf[7] = 0x00;
 
-        kaweth_dbg("Triggering firmware");
+        dbg("Triggering firmware");
 
         return kaweth_control(kaweth,
                               usb_sndctrlpipe(kaweth->dev, 0),
@@ -457,7 +457,7 @@ static int kaweth_reset(struct kaweth_device *kaweth)
 {
         int result;
 
-        kaweth_dbg("kaweth_reset(%p)", kaweth);
+        dbg("kaweth_reset(%p)", kaweth);
         result = kaweth_control(kaweth,
                                 usb_sndctrlpipe(kaweth->dev, 0),
                                 USB_REQ_SET_CONFIGURATION,
@@ -470,7 +470,7 @@ static int kaweth_reset(struct kaweth_device *kaweth)
 
         mdelay(10);
 
-        kaweth_dbg("kaweth_reset() returns %d.",result);
+        dbg("kaweth_reset() returns %d.",result);
 
         return result;
 }
@@ -534,7 +534,7 @@ static void kaweth_resubmit_tl(void *d)
 {
         struct kaweth_device *kaweth = (struct kaweth_device *)d;
 
-        if (kaweth->status | KAWETH_STATUS_CLOSING)
+        if (IS_BLOCKED(kaweth->status))
                 return;
 
         if (kaweth->suspend_lowmem_rx)
@@ -568,7 +568,7 @@ static int kaweth_resubmit_rx_urb(struct kaweth_device *kaweth,
                         kaweth->suspend_lowmem_rx = 1;
                         schedule_delayed_work(&kaweth->lowmem_work, HZ/4);
                 }
-                kaweth_err("resubmitting rx_urb %d failed", result);
+                err("resubmitting rx_urb %d failed", result);
         } else {
                 kaweth->suspend_lowmem_rx = 0;
         }
@@ -601,11 +601,15 @@ static void kaweth_usb_receive(struct urb *urb)
                 return;
         }
 
-        if (kaweth->status & KAWETH_STATUS_CLOSING)
+        spin_lock(&kaweth->device_lock);
+        if (IS_BLOCKED(kaweth->status)) {
+                spin_unlock(&kaweth->device_lock);
                 return;
+        }
+        spin_unlock(&kaweth->device_lock);
 
         if(urb->status && urb->status != -EREMOTEIO && count != 1) {
-                kaweth_err("%s RX status: %d count: %d packet_len: %d",
+                err("%s RX status: %d count: %d packet_len: %d",
                            net->name,
                            urb->status,
                            count,
@@ -616,9 +620,9 @@ static void kaweth_usb_receive(struct urb *urb)
 
         if(kaweth->net && (count > 2)) {
                 if(pkt_len > (count - 2)) {
-                        kaweth_err("Packet length too long for USB frame (pkt_len: %x, count: %x)",pkt_len, count);
-                        kaweth_err("Packet len & 2047: %x", pkt_len & 2047);
-                        kaweth_err("Count 2: %x", count2);
+                        err("Packet length too long for USB frame (pkt_len: %x, count: %x)",pkt_len, count);
+                        err("Packet len & 2047: %x", pkt_len & 2047);
+                        err("Count 2: %x", count2);
                         kaweth_resubmit_rx_urb(kaweth, GFP_ATOMIC);
                         return;
                 }
@@ -655,7 +659,7 @@ static int kaweth_open(struct net_device *net)
         struct kaweth_device *kaweth = netdev_priv(net);
         int res;
 
-        kaweth_dbg("Opening network device.");
+        dbg("Opening network device.");
 
         res = kaweth_resubmit_rx_urb(kaweth, GFP_KERNEL);
         if (res)
@@ -678,6 +682,7 @@ static int kaweth_open(struct net_device *net)
                 usb_kill_urb(kaweth->rx_urb);
                 return -EIO;
         }
+        kaweth->opened = 1;
 
         netif_start_queue(net);
 
@@ -688,14 +693,8 @@ static int kaweth_open(struct net_device *net)
 /****************************************************************
  *     kaweth_close
  ****************************************************************/
-static int kaweth_close(struct net_device *net)
+static void kaweth_kill_urbs(struct kaweth_device *kaweth)
 {
-        struct kaweth_device *kaweth = netdev_priv(net);
-
-        netif_stop_queue(net);
-
-        kaweth->status |= KAWETH_STATUS_CLOSING;
-
         usb_kill_urb(kaweth->irq_urb);
         usb_kill_urb(kaweth->rx_urb);
         usb_kill_urb(kaweth->tx_urb);
@@ -706,6 +705,21 @@ static int kaweth_close(struct net_device *net)
            we hit them again */
         usb_kill_urb(kaweth->irq_urb);
         usb_kill_urb(kaweth->rx_urb);
+}
+
+/****************************************************************
+ *     kaweth_close
+ ****************************************************************/
+static int kaweth_close(struct net_device *net)
+{
+        struct kaweth_device *kaweth = netdev_priv(net);
+
+        netif_stop_queue(net);
+        kaweth->opened = 0;
+
+        kaweth->status |= KAWETH_STATUS_CLOSING;
+
+        kaweth_kill_urbs(kaweth);
 
         kaweth->status &= ~KAWETH_STATUS_CLOSING;
 
@@ -732,7 +746,7 @@ static void kaweth_usb_transmit_complete(struct urb *urb)
 
         if (unlikely(urb->status != 0))
                 if (urb->status != -ENOENT)
-                        kaweth_dbg("%s: TX status %d.", kaweth->net->name, urb->status);
+                        dbg("%s: TX status %d.", kaweth->net->name, urb->status);
 
         netif_wake_queue(kaweth->net);
         dev_kfree_skb_irq(skb);
@@ -752,6 +766,9 @@ static int kaweth_start_xmit(struct sk_buff *skb, struct net_device *net)
 
         kaweth_async_set_rx_mode(kaweth);
         netif_stop_queue(net);
+        if (IS_BLOCKED(kaweth->status)) {
+                goto skip;
+        }
 
         /* We now decide whether we can put our special header into the sk_buff */
         if (skb_cloned(skb) || skb_headroom(skb) < 2) {
@@ -783,7 +800,8 @@ static int kaweth_start_xmit(struct sk_buff *skb, struct net_device *net)
 
         if((res = usb_submit_urb(kaweth->tx_urb, GFP_ATOMIC)))
         {
-                kaweth_warn("kaweth failed tx_urb %d", res);
+                warn("kaweth failed tx_urb %d", res);
+skip:
                 kaweth->stats.tx_errors++;
 
                 netif_start_queue(net);
@@ -812,7 +830,7 @@ static void kaweth_set_rx_mode(struct net_device *net)
                                      KAWETH_PACKET_FILTER_BROADCAST |
                                      KAWETH_PACKET_FILTER_MULTICAST;
 
-        kaweth_dbg("Setting Rx mode to %d", packet_filter_bitmap);
+        dbg("Setting Rx mode to %d", packet_filter_bitmap);
 
         netif_stop_queue(net);
 
@@ -850,10 +868,10 @@ static void kaweth_async_set_rx_mode(struct kaweth_device *kaweth)
                                 KAWETH_CONTROL_TIMEOUT);
 
         if(result < 0) {
-                kaweth_err("Failed to set Rx mode: %d", result);
+                err("Failed to set Rx mode: %d", result);
         }
         else {
-                kaweth_dbg("Set Rx mode to %d", packet_filter_bitmap);
+                dbg("Set Rx mode to %d", packet_filter_bitmap);
         }
         }
 }
@@ -874,7 +892,7 @@ static void kaweth_tx_timeout(struct net_device *net)
 {
         struct kaweth_device *kaweth = netdev_priv(net);
 
-        kaweth_warn("%s: Tx timed out. Resetting.", net->name);
+        warn("%s: Tx timed out. Resetting.", net->name);
         kaweth->stats.tx_errors++;
         net->trans_start = jiffies;
 
@@ -882,6 +900,42 @@ static void kaweth_tx_timeout(struct net_device *net)
 }
 
 /****************************************************************
+ *     kaweth_suspend
+ ****************************************************************/
+static int kaweth_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct kaweth_device *kaweth = usb_get_intfdata(intf);
+        unsigned long flags;
+
+        spin_lock_irqsave(&kaweth->device_lock, flags);
+        kaweth->status |= KAWETH_STATUS_SUSPENDING;
+        spin_unlock_irqrestore(&kaweth->device_lock, flags);
+
+        kaweth_kill_urbs(kaweth);
+        return 0;
+}
+
+/****************************************************************
+ *     kaweth_resume
+ ****************************************************************/
+static int kaweth_resume(struct usb_interface *intf)
+{
+        struct kaweth_device *kaweth = usb_get_intfdata(intf);
+        unsigned long flags;
+
+        spin_lock_irqsave(&kaweth->device_lock, flags);
+        kaweth->status &= ~KAWETH_STATUS_SUSPENDING;
+        spin_unlock_irqrestore(&kaweth->device_lock, flags);
+
+        if (!kaweth->opened)
+                return 0;
+        kaweth_resubmit_rx_urb(kaweth, GFP_NOIO);
+        kaweth_resubmit_int_urb(kaweth, GFP_NOIO);
+
+        return 0;
+}
+
+/****************************************************************
  *     kaweth_probe
  ****************************************************************/
 static int kaweth_probe(
@@ -895,15 +949,15 @@ static int kaweth_probe(
         const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
         int result = 0;
 
-        kaweth_dbg("Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x",
+        dbg("Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x",
                  dev->devnum,
                  le16_to_cpu(dev->descriptor.idVendor),
                  le16_to_cpu(dev->descriptor.idProduct),
                  le16_to_cpu(dev->descriptor.bcdDevice));
 
-        kaweth_dbg("Device at %p", dev);
+        dbg("Device at %p", dev);
 
-        kaweth_dbg("Descriptor length: %x type: %x",
+        dbg("Descriptor length: %x type: %x",
                  (int)dev->descriptor.bLength,
                  (int)dev->descriptor.bDescriptorType);
 
@@ -918,7 +972,7 @@ static int kaweth_probe(
         spin_lock_init(&kaweth->device_lock);
         init_waitqueue_head(&kaweth->term_wait);
 
-        kaweth_dbg("Resetting.");
+        dbg("Resetting.");
 
         kaweth_reset(kaweth);
 
@@ -928,17 +982,17 @@ static int kaweth_probe(
          */
 
         if (le16_to_cpu(dev->descriptor.bcdDevice) >> 8) {
-                kaweth_info("Firmware present in device.");
+                info("Firmware present in device.");
         } else {
                 /* Download the firmware */
-                kaweth_info("Downloading firmware...");
+                info("Downloading firmware...");
                 kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
                 if ((result = kaweth_download_firmware(kaweth,
                                                       kaweth_new_code,
                                                       len_kaweth_new_code,
                                                       100,
                                                       2)) < 0) {
-                        kaweth_err("Error downloading firmware (%d)", result);
+                        err("Error downloading firmware (%d)", result);
                         goto err_fw;
                 }
 
@@ -947,7 +1001,7 @@ static int kaweth_probe(
                                                       len_kaweth_new_code_fix,
                                                       100,
                                                       3)) < 0) {
-                        kaweth_err("Error downloading firmware fix (%d)", result);
+                        err("Error downloading firmware fix (%d)", result);
                         goto err_fw;
                 }
 
@@ -956,7 +1010,7 @@ static int kaweth_probe(
                                                       len_kaweth_trigger_code,
                                                       126,
                                                       2)) < 0) {
-                        kaweth_err("Error downloading trigger code (%d)", result);
+                        err("Error downloading trigger code (%d)", result);
                         goto err_fw;
 
                 }
@@ -966,18 +1020,18 @@ static int kaweth_probe(
                                                       len_kaweth_trigger_code_fix,
                                                       126,
                                                       3)) < 0) {
-                        kaweth_err("Error downloading trigger code fix (%d)", result);
+                        err("Error downloading trigger code fix (%d)", result);
                         goto err_fw;
                 }
 
 
                 if ((result = kaweth_trigger_firmware(kaweth, 126)) < 0) {
-                        kaweth_err("Error triggering firmware (%d)", result);
+                        err("Error triggering firmware (%d)", result);
                         goto err_fw;
                 }
 
                 /* Device will now disappear for a moment...  */
-                kaweth_info("Firmware loaded.  I'll be back...");
+                info("Firmware loaded.  I'll be back...");
 err_fw:
                 free_page((unsigned long)kaweth->firmware_buf);
                 free_netdev(netdev);
@@ -987,14 +1041,14 @@ err_fw:
         result = kaweth_read_configuration(kaweth);
 
         if(result < 0) {
-                kaweth_err("Error reading configuration (%d), no net device created", result);
+                err("Error reading configuration (%d), no net device created", result);
                 goto err_free_netdev;
         }
 
-        kaweth_info("Statistics collection: %x", kaweth->configuration.statistics_mask);
-        kaweth_info("Multicast filter limit: %x", kaweth->configuration.max_multicast_filters & ((1 << 15) - 1));
-        kaweth_info("MTU: %d", le16_to_cpu(kaweth->configuration.segment_size));
-        kaweth_info("Read MAC address %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
+        info("Statistics collection: %x", kaweth->configuration.statistics_mask);
+        info("Multicast filter limit: %x", kaweth->configuration.max_multicast_filters & ((1 << 15) - 1));
+        info("MTU: %d", le16_to_cpu(kaweth->configuration.segment_size));
+        info("Read MAC address %2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x",
                  (int)kaweth->configuration.hw_addr[0],
                  (int)kaweth->configuration.hw_addr[1],
                  (int)kaweth->configuration.hw_addr[2],
@@ -1005,17 +1059,17 @@ err_fw:
         if(!memcmp(&kaweth->configuration.hw_addr,
                    &bcast_addr,
                    sizeof(bcast_addr))) {
-                kaweth_err("Firmware not functioning properly, no net device created");
+                err("Firmware not functioning properly, no net device created");
                 goto err_free_netdev;
         }
 
         if(kaweth_set_urb_size(kaweth, KAWETH_BUF_SIZE) < 0) {
-                kaweth_dbg("Error setting URB size");
+                dbg("Error setting URB size");
                 goto err_free_netdev;
         }
 
         if(kaweth_set_sofs_wait(kaweth, KAWETH_SOFS_TO_WAIT) < 0) {
-                kaweth_err("Error setting SOFS wait");
+                err("Error setting SOFS wait");
                 goto err_free_netdev;
         }
 
@@ -1025,11 +1079,11 @@ err_fw:
                                            KAWETH_PACKET_FILTER_MULTICAST);
 
         if(result < 0) {
-                kaweth_err("Error setting receive filter");
+                err("Error setting receive filter");
                 goto err_free_netdev;
         }
 
-        kaweth_dbg("Initializing net device.");
+        dbg("Initializing net device.");
 
         kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!kaweth->tx_urb)
@@ -1086,13 +1140,13 @@ err_fw:
 
         SET_NETDEV_DEV(netdev, &intf->dev);
         if (register_netdev(netdev) != 0) {
-                kaweth_err("Error registering netdev.");
+                err("Error registering netdev.");
                 goto err_intfdata;
         }
 
-        kaweth_info("kaweth interface created at %s", kaweth->net->name);
+        info("kaweth interface created at %s", kaweth->net->name);
 
-        kaweth_dbg("Kaweth probe returning.");
+        dbg("Kaweth probe returning.");
 
         return 0;
 
@@ -1121,16 +1175,16 @@ static void kaweth_disconnect(struct usb_interface *intf)
         struct kaweth_device *kaweth = usb_get_intfdata(intf);
         struct net_device *netdev;
 
-        kaweth_info("Unregistering");
+        info("Unregistering");
 
         usb_set_intfdata(intf, NULL);
         if (!kaweth) {
-                kaweth_warn("unregistering non-existant device");
+                warn("unregistering non-existant device");
                 return;
         }
         netdev = kaweth->net;
 
-        kaweth_dbg("Unregistering net device");
+        dbg("Unregistering net device");
         unregister_netdev(netdev);
 
         usb_free_urb(kaweth->rx_urb);
@@ -1185,7 +1239,7 @@ static int usb_start_wait_urb(struct urb *urb, int timeout, int* actual_length)
 
         if (!wait_event_timeout(awd.wqh, awd.done, timeout)) {
                 // timeout
-                kaweth_warn("usb_control/bulk_msg: timeout");
+                warn("usb_control/bulk_msg: timeout");
                 usb_kill_urb(urb);  // remove urb safely
                 status = -ETIMEDOUT;
         }
@@ -1234,7 +1288,7 @@ static int kaweth_internal_control_msg(struct usb_device *usb_dev,
  ****************************************************************/
 static int __init kaweth_init(void)
 {
-        kaweth_dbg("Driver loading");
+        dbg("Driver loading");
         return usb_register(&kaweth_driver);
 }
 
diff --git a/drivers/usb/net/mcs7830.c b/drivers/usb/net/mcs7830.c
new file mode 100644
index 000000000000..6240b978fe3d
--- /dev/null
+++ b/drivers/usb/net/mcs7830.c
@@ -0,0 +1,534 @@
+/*
+ * MosChips MCS7830 based USB 2.0 Ethernet Devices
+ *
+ * based on usbnet.c, asix.c and the vendor provided mcs7830 driver
+ *
+ * Copyright (C) 2006 Arnd Bergmann <arnd@arndb.de>
+ * Copyright (C) 2003-2005 David Hollis <dhollis@davehollis.com>
+ * Copyright (C) 2005 Phil Chang <pchang23@sbcglobal.net>
+ * Copyright (c) 2002-2003 TiVo Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/crc32.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/init.h>
+#include <linux/mii.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/usb.h>
+
+#include "usbnet.h"
+
+/* requests */
+#define MCS7830_RD_BMREQ        (USB_DIR_IN  | USB_TYPE_VENDOR | \
+                                 USB_RECIP_DEVICE)
+#define MCS7830_WR_BMREQ        (USB_DIR_OUT | USB_TYPE_VENDOR | \
+                                 USB_RECIP_DEVICE)
+#define MCS7830_RD_BREQ         0x0E
+#define MCS7830_WR_BREQ         0x0D
+
+#define MCS7830_CTRL_TIMEOUT    1000
+#define MCS7830_MAX_MCAST       64
+
+#define MCS7830_VENDOR_ID       0x9710
+#define MCS7830_PRODUCT_ID      0x7830
+
+#define MCS7830_MII_ADVERTISE   (ADVERTISE_PAUSE_CAP | ADVERTISE_100FULL | \
+                                 ADVERTISE_100HALF | ADVERTISE_10FULL | \
+                                 ADVERTISE_10HALF | ADVERTISE_CSMA)
+
+/* HIF_REG_XX coressponding index value */
+enum {
+        HIF_REG_MULTICAST_HASH                  = 0x00,
+        HIF_REG_PACKET_GAP1                     = 0x08,
+        HIF_REG_PACKET_GAP2                     = 0x09,
+        HIF_REG_PHY_DATA                        = 0x0a,
+        HIF_REG_PHY_CMD1                        = 0x0c,
+           HIF_REG_PHY_CMD1_READ                = 0x40,
+           HIF_REG_PHY_CMD1_WRITE               = 0x20,
+           HIF_REG_PHY_CMD1_PHYADDR             = 0x01,
+        HIF_REG_PHY_CMD2                        = 0x0d,
+           HIF_REG_PHY_CMD2_PEND_FLAG_BIT       = 0x80,
+           HIF_REG_PHY_CMD2_READY_FLAG_BIT      = 0x40,
+        HIF_REG_CONFIG                          = 0x0e,
+           HIF_REG_CONFIG_CFG                   = 0x80,
+           HIF_REG_CONFIG_SPEED100              = 0x40,
+           HIF_REG_CONFIG_FULLDUPLEX_ENABLE     = 0x20,
+           HIF_REG_CONFIG_RXENABLE              = 0x10,
+           HIF_REG_CONFIG_TXENABLE              = 0x08,
+           HIF_REG_CONFIG_SLEEPMODE             = 0x04,
+           HIF_REG_CONFIG_ALLMULTICAST          = 0x02,
+           HIF_REG_CONFIG_PROMISCIOUS           = 0x01,
+        HIF_REG_ETHERNET_ADDR                   = 0x0f,
+        HIF_REG_22                              = 0x15,
+        HIF_REG_PAUSE_THRESHOLD                 = 0x16,
+           HIF_REG_PAUSE_THRESHOLD_DEFAULT      = 0,
+};
+
+struct mcs7830_data {
+        u8 multi_filter[8];
+        u8 config;
+};
+
+static const char driver_name[] = "MOSCHIP usb-ethernet driver";
+
+static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data)
+{
+        struct usb_device *xdev = dev->udev;
+        int ret;
+
+        ret = usb_control_msg(xdev, usb_rcvctrlpipe(xdev, 0), MCS7830_RD_BREQ,
+                              MCS7830_RD_BMREQ, 0x0000, index, data,
+                              size, msecs_to_jiffies(MCS7830_CTRL_TIMEOUT));
+        return ret;
+}
+
+static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, void *data)
+{
+        struct usb_device *xdev = dev->udev;
+        int ret;
+
+        ret = usb_control_msg(xdev, usb_sndctrlpipe(xdev, 0), MCS7830_WR_BREQ,
+                              MCS7830_WR_BMREQ, 0x0000, index, data,
+                              size, msecs_to_jiffies(MCS7830_CTRL_TIMEOUT));
+        return ret;
+}
+
+static void mcs7830_async_cmd_callback(struct urb *urb)
+{
+        struct usb_ctrlrequest *req = (struct usb_ctrlrequest *)urb->context;
+
+        if (urb->status < 0)
+                printk(KERN_DEBUG "mcs7830_async_cmd_callback() failed with %d",
+                        urb->status);
+
+        kfree(req);
+        usb_free_urb(urb);
+}
+
+static void mcs7830_set_reg_async(struct usbnet *dev, u16 index, u16 size, void *data)
+{
+        struct usb_ctrlrequest *req;
+        int ret;
+        struct urb *urb;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb) {
+                dev_dbg(&dev->udev->dev, "Error allocating URB "
+                                "in write_cmd_async!");
+                return;
+        }
+
+        req = kmalloc(sizeof *req, GFP_ATOMIC);
+        if (!req) {
+                dev_err(&dev->udev->dev, "Failed to allocate memory for "
+                                "control request");
+                goto out;
+        }
+        req->bRequestType = MCS7830_WR_BMREQ;
+        req->bRequest = MCS7830_WR_BREQ;
+        req->wValue = 0;
+        req->wIndex = cpu_to_le16(index);
+        req->wLength = cpu_to_le16(size);
+
+        usb_fill_control_urb(urb, dev->udev,
+                             usb_sndctrlpipe(dev->udev, 0),
+                             (void *)req, data, size,
+                             mcs7830_async_cmd_callback, req);
+
+        ret = usb_submit_urb(urb, GFP_ATOMIC);
+        if (ret < 0) {
+                dev_err(&dev->udev->dev, "Error submitting the control "
+                                "message: ret=%d", ret);
+                goto out;
+        }
+        return;
+out:
+        kfree(req);
+        usb_free_urb(urb);
+}
+
+static int mcs7830_get_address(struct usbnet *dev)
+{
+        int ret;
+        ret = mcs7830_get_reg(dev, HIF_REG_ETHERNET_ADDR, ETH_ALEN,
+                                   dev->net->dev_addr);
+        if (ret < 0)
+                return ret;
+        return 0;
+}
+
+static int mcs7830_read_phy(struct usbnet *dev, u8 index)
+{
+        int ret;
+        int i;
+        __le16 val;
+
+        u8 cmd[2] = {
+                HIF_REG_PHY_CMD1_READ | HIF_REG_PHY_CMD1_PHYADDR,
+                HIF_REG_PHY_CMD2_PEND_FLAG_BIT | index,
+        };
+
+        mutex_lock(&dev->phy_mutex);
+        /* write the MII command */
+        ret = mcs7830_set_reg(dev, HIF_REG_PHY_CMD1, 2, cmd);
+        if (ret < 0)
+                goto out;
+
+        /* wait for the data to become valid, should be within < 1ms */
+        for (i = 0; i < 10; i++) {
+                ret = mcs7830_get_reg(dev, HIF_REG_PHY_CMD1, 2, cmd);
+                if ((ret < 0) || (cmd[1] & HIF_REG_PHY_CMD2_READY_FLAG_BIT))
+                        break;
+                ret = -EIO;
+                msleep(1);
+        }
+        if (ret < 0)
+                goto out;
+
+        /* read actual register contents */
+        ret = mcs7830_get_reg(dev, HIF_REG_PHY_DATA, 2, &val);
+        if (ret < 0)
+                goto out;
+        ret = le16_to_cpu(val);
+        dev_dbg(&dev->udev->dev, "read PHY reg %02x: %04x (%d tries)\n",
+                index, val, i);
+out:
+        mutex_unlock(&dev->phy_mutex);
+        return ret;
+}
+
+static int mcs7830_write_phy(struct usbnet *dev, u8 index, u16 val)
+{
+        int ret;
+        int i;
+        __le16 le_val;
+
+        u8 cmd[2] = {
+                HIF_REG_PHY_CMD1_WRITE | HIF_REG_PHY_CMD1_PHYADDR,
+                HIF_REG_PHY_CMD2_PEND_FLAG_BIT | (index & 0x1F),
+        };
+
+        mutex_lock(&dev->phy_mutex);
+
+        /* write the new register contents */
+        le_val = cpu_to_le16(val);
+        ret = mcs7830_set_reg(dev, HIF_REG_PHY_DATA, 2, &le_val);
+        if (ret < 0)
+                goto out;
+
+        /* write the MII command */
+        ret = mcs7830_set_reg(dev, HIF_REG_PHY_CMD1, 2, cmd);
+        if (ret < 0)
+                goto out;
+
+        /* wait for the command to be accepted by the PHY */
+        for (i = 0; i < 10; i++) {
+                ret = mcs7830_get_reg(dev, HIF_REG_PHY_CMD1, 2, cmd);
+                if ((ret < 0) || (cmd[1] & HIF_REG_PHY_CMD2_READY_FLAG_BIT))
+                        break;
+                ret = -EIO;
+                msleep(1);
+        }
+        if (ret < 0)
+                goto out;
+
+        ret = 0;
+        dev_dbg(&dev->udev->dev, "write PHY reg %02x: %04x (%d tries)\n",
+                index, val, i);
+out:
+        mutex_unlock(&dev->phy_mutex);
+        return ret;
+}
+
+/*
+ * This algorithm comes from the original mcs7830 version 1.4 driver,
+ * not sure if it is needed.
+ */
+static int mcs7830_set_autoneg(struct usbnet *dev, int ptrUserPhyMode)
+{
+        int ret;
+        /* Enable all media types */
+        ret = mcs7830_write_phy(dev, MII_ADVERTISE, MCS7830_MII_ADVERTISE);
+
+        /* First reset BMCR */
+        if (!ret)
+                ret = mcs7830_write_phy(dev, MII_BMCR, 0x0000);
+        /* Enable Auto Neg */
+        if (!ret)
+                ret = mcs7830_write_phy(dev, MII_BMCR, BMCR_ANENABLE);
+        /* Restart Auto Neg (Keep the Enable Auto Neg Bit Set) */
+        if (!ret)
+                ret = mcs7830_write_phy(dev, MII_BMCR,
+                                BMCR_ANENABLE | BMCR_ANRESTART  );
+        return ret < 0 ? : 0;
+}
+
+
+/*
+ * if we can read register 22, the chip revision is C or higher
+ */
+static int mcs7830_get_rev(struct usbnet *dev)
+{
+        u8 dummy[2];
+        int ret;
+        ret = mcs7830_get_reg(dev, HIF_REG_22, 2, dummy);
+        if (ret > 0)
+                return 2; /* Rev C or later */
+        return 1; /* earlier revision */
+}
+
+/*
+ * On rev. C we need to set the pause threshold
+ */
+static void mcs7830_rev_C_fixup(struct usbnet *dev)
+{
+        u8 pause_threshold = HIF_REG_PAUSE_THRESHOLD_DEFAULT;
+        int retry;
+
+        for (retry = 0; retry < 2; retry++) {
+                if (mcs7830_get_rev(dev) == 2) {
+                        dev_info(&dev->udev->dev, "applying rev.C fixup\n");
+                        mcs7830_set_reg(dev, HIF_REG_PAUSE_THRESHOLD,
+                                        1, &pause_threshold);
+                }
+                msleep(1);
+        }
+}
+
+static int mcs7830_init_dev(struct usbnet *dev)
+{
+        int ret;
+        int retry;
+
+        /* Read MAC address from EEPROM */
+        ret = -EINVAL;
+        for (retry = 0; retry < 5 && ret; retry++)
+                ret = mcs7830_get_address(dev);
+        if (ret) {
+                dev_warn(&dev->udev->dev, "Cannot read MAC address\n");
+                goto out;
+        }
+
+        /* Set up PHY */
+        ret = mcs7830_set_autoneg(dev, 0);
+        if (ret) {
+                dev_info(&dev->udev->dev, "Cannot set autoneg\n");
+                goto out;
+        }
+
+        mcs7830_rev_C_fixup(dev);
+        ret = 0;
+out:
+        return ret;
+}
+
+static int mcs7830_mdio_read(struct net_device *netdev, int phy_id,
+                             int location)
+{
+        struct usbnet *dev = netdev->priv;
+        return mcs7830_read_phy(dev, location);
+}
+
+static void mcs7830_mdio_write(struct net_device *netdev, int phy_id,
+                                int location, int val)
+{
+        struct usbnet *dev = netdev->priv;
+        mcs7830_write_phy(dev, location, val);
+}
+
+static int mcs7830_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+
+/* credits go to asix_set_multicast */
+static void mcs7830_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct mcs7830_data *data = (struct mcs7830_data *)&dev->data;
+
+        data->config = HIF_REG_CONFIG_TXENABLE;
+
+        /* this should not be needed, but it doesn't work otherwise */
+        data->config |= HIF_REG_CONFIG_ALLMULTICAST;
+
+        if (net->flags & IFF_PROMISC) {
+                data->config |= HIF_REG_CONFIG_PROMISCIOUS;
+        } else if (net->flags & IFF_ALLMULTI
+                   || net->mc_count > MCS7830_MAX_MCAST) {
+                data->config |= HIF_REG_CONFIG_ALLMULTICAST;
+        } else if (net->mc_count == 0) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data
+                 * for our 8 byte filter buffer
+                 * to avoid allocating memory that
+                 * is tricky to free later */
+                struct dev_mc_list *mc_list = net->mc_list;
+                u32 crc_bits;
+                int i;
+
+                memset(data->multi_filter, 0, sizeof data->multi_filter);
+
+                /* Build the multicast hash filter. */
+                for (i = 0; i < net->mc_count; i++) {
+                        crc_bits = ether_crc(ETH_ALEN, mc_list->dmi_addr) >> 26;
+                        data->multi_filter[crc_bits >> 3] |= 1 << (crc_bits & 7);
+                        mc_list = mc_list->next;
+                }
+
+                mcs7830_set_reg_async(dev, HIF_REG_MULTICAST_HASH,
+                                sizeof data->multi_filter,
+                                data->multi_filter);
+        }
+
+        mcs7830_set_reg_async(dev, HIF_REG_CONFIG, 1, &data->config);
+}
+
+static int mcs7830_get_regs_len(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        switch (mcs7830_get_rev(dev)) {
+        case 1:
+                return 21;
+        case 2:
+                return 32;
+        }
+        return 0;
+}
+
+static void mcs7830_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *drvinfo)
+{
+        usbnet_get_drvinfo(net, drvinfo);
+        drvinfo->regdump_len = mcs7830_get_regs_len(net);
+}
+
+static void mcs7830_get_regs(struct net_device *net, struct ethtool_regs *regs, void *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        regs->version = mcs7830_get_rev(dev);
+        mcs7830_get_reg(dev, 0, regs->len, data);
+}
+
+static struct ethtool_ops mcs7830_ethtool_ops = {
+        .get_drvinfo            = mcs7830_get_drvinfo,
+        .get_regs_len           = mcs7830_get_regs_len,
+        .get_regs               = mcs7830_get_regs,
+
+        /* common usbnet calls */
+        .get_link               = usbnet_get_link,
+        .get_msglevel           = usbnet_get_msglevel,
+        .set_msglevel           = usbnet_set_msglevel,
+        .get_settings           = usbnet_get_settings,
+        .set_settings           = usbnet_set_settings,
+        .nway_reset             = usbnet_nway_reset,
+};
+
+static int mcs7830_bind(struct usbnet *dev, struct usb_interface *udev)
+{
+        struct net_device *net = dev->net;
+        int ret;
+
+        ret = mcs7830_init_dev(dev);
+        if (ret)
+                goto out;
+
+        net->do_ioctl = mcs7830_ioctl;
+        net->ethtool_ops = &mcs7830_ethtool_ops;
+        net->set_multicast_list = mcs7830_set_multicast;
+        mcs7830_set_multicast(net);
+
+        /* reserve space for the status byte on rx */
+        dev->rx_urb_size = ETH_FRAME_LEN + 1;
+
+        dev->mii.mdio_read = mcs7830_mdio_read;
+        dev->mii.mdio_write = mcs7830_mdio_write;
+        dev->mii.dev = net;
+        dev->mii.phy_id_mask = 0x3f;
+        dev->mii.reg_num_mask = 0x1f;
+        dev->mii.phy_id = *((u8 *) net->dev_addr + 1);
+
+        ret = usbnet_get_endpoints(dev, udev);
+out:
+        return ret;
+}
+
+/* The chip always appends a status bytes that we need to strip */
+static int mcs7830_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        u8 status;
+
+        if (skb->len == 0) {
+                dev_err(&dev->udev->dev, "unexpected empty rx frame\n");
+                return 0;
+        }
+
+        skb_trim(skb, skb->len - 1);
+        status = skb->data[skb->len];
+
+        if (status != 0x20)
+                dev_dbg(&dev->udev->dev, "rx fixup status %x\n", status);
+
+        return skb->len > 0;
+}
+
+static const struct driver_info moschip_info = {
+        .description    = "MOSCHIP 7830 usb-NET adapter",
+        .bind           = mcs7830_bind,
+        .rx_fixup       = mcs7830_rx_fixup,
+        .flags          = FLAG_ETHER,
+        .in             = 1,
+        .out            = 2,
+};
+
+static const struct usb_device_id products[] = {
+        {
+                USB_DEVICE(MCS7830_VENDOR_ID, MCS7830_PRODUCT_ID),
+                .driver_info = (unsigned long) &moschip_info,
+        },
+        {},
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver mcs7830_driver = {
+        .name = driver_name,
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+};
+
+static int __init mcs7830_init(void)
+{
+        return usb_register(&mcs7830_driver);
+}
+module_init(mcs7830_init);
+
+static void __exit mcs7830_exit(void)
+{
+        usb_deregister(&mcs7830_driver);
+}
+module_exit(mcs7830_exit);
+
+MODULE_DESCRIPTION("USB to network adapter MCS7830)");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index 24bd3486ee63..760b5327b81b 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -554,7 +554,7 @@ static int usbnet_stop (struct net_device *net)
 {
         struct usbnet           *dev = netdev_priv(net);
         int                     temp;
-        DECLARE_WAIT_QUEUE_HEAD (unlink_wakeup); 
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK (unlink_wakeup);
         DECLARE_WAITQUEUE (wait, current);
 
         netif_stop_queue (net);
@@ -669,20 +669,40 @@ done:
  * they'll probably want to use this base set.
  */
 
-void usbnet_get_drvinfo (struct net_device *net, struct ethtool_drvinfo *info)
+#if defined(CONFIG_MII) || defined(CONFIG_MII_MODULE)
+#define HAVE_MII
+
+int usbnet_get_settings (struct net_device *net, struct ethtool_cmd *cmd)
 {
         struct usbnet *dev = netdev_priv(net);
 
-        /* REVISIT don't always return "usbnet" */
-        strncpy (info->driver, driver_name, sizeof info->driver);
-        strncpy (info->version, DRIVER_VERSION, sizeof info->version);
-        strncpy (info->fw_version, dev->driver_info->description,
-                sizeof info->fw_version);
-        usb_make_path (dev->udev, info->bus_info, sizeof info->bus_info);
+        if (!dev->mii.mdio_read)
+                return -EOPNOTSUPP;
+
+        return mii_ethtool_gset(&dev->mii, cmd);
 }
-EXPORT_SYMBOL_GPL(usbnet_get_drvinfo);
+EXPORT_SYMBOL_GPL(usbnet_get_settings);
+
+int usbnet_set_settings (struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        int retval;
+
+        if (!dev->mii.mdio_write)
+                return -EOPNOTSUPP;
 
-static u32 usbnet_get_link (struct net_device *net)
+        retval = mii_ethtool_sset(&dev->mii, cmd);
+
+        /* link speed/duplex might have changed */
+        if (dev->driver_info->link_reset)
+                dev->driver_info->link_reset(dev);
+
+        return retval;
+
+}
+EXPORT_SYMBOL_GPL(usbnet_set_settings);
+
+u32 usbnet_get_link (struct net_device *net)
 {
         struct usbnet *dev = netdev_priv(net);
 
@@ -690,9 +710,40 @@ static u32 usbnet_get_link (struct net_device *net)
         if (dev->driver_info->check_connect)
                 return dev->driver_info->check_connect (dev) == 0;
 
+        /* if the device has mii operations, use those */
+        if (dev->mii.mdio_read)
+                return mii_link_ok(&dev->mii);
+
         /* Otherwise, say we're up (to avoid breaking scripts) */
         return 1;
 }
+EXPORT_SYMBOL_GPL(usbnet_get_link);
+
+int usbnet_nway_reset(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        if (!dev->mii.mdio_write)
+                return -EOPNOTSUPP;
+
+        return mii_nway_restart(&dev->mii);
+}
+EXPORT_SYMBOL_GPL(usbnet_nway_reset);
+
+#endif  /* HAVE_MII */
+
+void usbnet_get_drvinfo (struct net_device *net, struct ethtool_drvinfo *info)
+{
+        struct usbnet *dev = netdev_priv(net);
+
+        /* REVISIT don't always return "usbnet" */
+        strncpy (info->driver, driver_name, sizeof info->driver);
+        strncpy (info->version, DRIVER_VERSION, sizeof info->version);
+        strncpy (info->fw_version, dev->driver_info->description,
+                sizeof info->fw_version);
+        usb_make_path (dev->udev, info->bus_info, sizeof info->bus_info);
+}
+EXPORT_SYMBOL_GPL(usbnet_get_drvinfo);
 
 u32 usbnet_get_msglevel (struct net_device *net)
 {
@@ -712,8 +763,13 @@ EXPORT_SYMBOL_GPL(usbnet_set_msglevel);
 
 /* drivers may override default ethtool_ops in their bind() routine */
 static struct ethtool_ops usbnet_ethtool_ops = {
-        .get_drvinfo            = usbnet_get_drvinfo,
+#ifdef  HAVE_MII
+        .get_settings           = usbnet_get_settings,
+        .set_settings           = usbnet_set_settings,
         .get_link               = usbnet_get_link,
+        .nway_reset             = usbnet_nway_reset,
+#endif
+        .get_drvinfo            = usbnet_get_drvinfo,
         .get_msglevel           = usbnet_get_msglevel,
         .set_msglevel           = usbnet_set_msglevel,
 };
@@ -1094,6 +1150,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
         dev->delay.function = usbnet_bh;
         dev->delay.data = (unsigned long) dev;
         init_timer (&dev->delay);
+        mutex_init (&dev->phy_mutex);
 
         SET_MODULE_OWNER (net);
         dev->net = net;
@@ -1225,7 +1282,7 @@ EXPORT_SYMBOL_GPL(usbnet_resume);
 static int __init usbnet_init(void)
 {
         /* compiler should optimize this out */
-        BUG_ON (sizeof (((struct sk_buff *)0)->cb)
+        BUILD_BUG_ON (sizeof (((struct sk_buff *)0)->cb)
                         < sizeof (struct skb_data));
 
         random_ether_addr(node_id);
diff --git a/drivers/usb/net/usbnet.h b/drivers/usb/net/usbnet.h
index c0746f0454af..07c70abbe0ec 100644
--- a/drivers/usb/net/usbnet.h
+++ b/drivers/usb/net/usbnet.h
@@ -30,6 +30,7 @@ struct usbnet {
         struct usb_device       *udev;
         struct driver_info      *driver_info;
         wait_queue_head_t       *wait;
+        struct mutex            phy_mutex;
 
         /* i/o info: pipes etc */
         unsigned                in, out;
@@ -168,9 +169,13 @@ extern void usbnet_defer_kevent (struct usbnet *, int);
 extern void usbnet_skb_return (struct usbnet *, struct sk_buff *);
 extern void usbnet_unlink_rx_urbs(struct usbnet *);
 
+extern int usbnet_get_settings (struct net_device *net, struct ethtool_cmd *cmd);
+extern int usbnet_set_settings (struct net_device *net, struct ethtool_cmd *cmd);
+extern u32 usbnet_get_link (struct net_device *net);
 extern u32 usbnet_get_msglevel (struct net_device *);
 extern void usbnet_set_msglevel (struct net_device *, u32);
 extern void usbnet_get_drvinfo (struct net_device *, struct ethtool_drvinfo *);
+extern int usbnet_nway_reset(struct net_device *net);
 
 /* messaging support includes the interface name, so it must not be
  * used before it has one ... notably, in minidriver bind() calls.
diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
index 5076b9d97057..2a8dd4cc943d 100644
--- a/drivers/usb/serial/Kconfig
+++ b/drivers/usb/serial/Kconfig
@@ -54,10 +54,10 @@ config USB_SERIAL_GENERIC
           properly.
 
 config USB_SERIAL_AIRCABLE
-        tristate "AIRcable USB Bluetooth Dongle Driver (EXPERIMENTAL)"
+        tristate "USB AIRcable Bluetooth Dongle Driver (EXPERIMENTAL)"
         depends on USB_SERIAL && EXPERIMENTAL
         help
-            Say Y here if you want to use AIRcable USB Bluetoot Dongle.
+            Say Y here if you want to use USB AIRcable Bluetooth Dongle.
 
             To compile this driver as a module, choose M here: the module
             will be called aircable.
@@ -422,6 +422,16 @@ config USB_SERIAL_MCT_U232
           To compile this driver as a module, choose M here: the
           module will be called mct_u232.
 
+config USB_SERIAL_MOS7720
+        tristate "USB Moschip 7720 Single Port Serial Driver"
+        depends on USB_SERIAL
+        ---help---
+          Say Y here if you want to use a USB Serial single port adapter from
+          Moschip Semiconductor Tech.
+
+          To compile this driver as a module, choose M here: the
+          module will be called mos7720.
+
 config USB_SERIAL_MOS7840
         tristate "USB Moschip 7840/7820 USB Serial Driver"
         depends on USB_SERIAL
@@ -527,8 +537,7 @@ config USB_SERIAL_OPTION
           The USB bus on these cards is not accessible externally.
 
           Supported devices include (some of?) those made by:
-          Option, Huawei, Audiovox, Sierra Wireless, Novatel Wireless, or
-          Anydata.
+          Option, Huawei, Audiovox, Novatel Wireless, or Anydata.
 
           To compile this driver as a module, choose M here: the
           module will be called option.
diff --git a/drivers/usb/serial/Makefile b/drivers/usb/serial/Makefile
index 8dce83340e31..a5047dc599bb 100644
--- a/drivers/usb/serial/Makefile
+++ b/drivers/usb/serial/Makefile
@@ -34,6 +34,7 @@ obj-$(CONFIG_USB_SERIAL_KEYSPAN_PDA)		+= keyspan_pda.o
 obj-$(CONFIG_USB_SERIAL_KLSI)                   += kl5kusb105.o
 obj-$(CONFIG_USB_SERIAL_KOBIL_SCT)              += kobil_sct.o
 obj-$(CONFIG_USB_SERIAL_MCT_U232)               += mct_u232.o
+obj-$(CONFIG_USB_SERIAL_MOS7720)                += mos7720.o
 obj-$(CONFIG_USB_SERIAL_MOS7840)                += mos7840.o
 obj-$(CONFIG_USB_SERIAL_NAVMAN)                 += navman.o
 obj-$(CONFIG_USB_SERIAL_OMNINET)                += omninet.o
diff --git a/drivers/usb/serial/airprime.c b/drivers/usb/serial/airprime.c
index 2c19f19b255c..7f5d546da39a 100644
--- a/drivers/usb/serial/airprime.c
+++ b/drivers/usb/serial/airprime.c
@@ -18,12 +18,8 @@
 
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
-        { USB_DEVICE(0x0f3d, 0x0112) }, /* AirPrime CDMA Wireless PC Card */
-        { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
-        { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
-        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless Aircard 580 */
-        { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
         { USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
+        { USB_DEVICE(0x1410, 0x1100) }, /* ExpressCard34 Qualcomm 3G CDMA */
         { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
@@ -133,6 +129,7 @@ static int airprime_open(struct usb_serial_port *port, struct file *filp)
                 }
                 urb = usb_alloc_urb(0, GFP_KERNEL);
                 if (!urb) {
+                        kfree(buffer);
                         dev_err(&port->dev, "%s - no more urbs?\n",
                                 __FUNCTION__);
                         result = -ENOMEM;
diff --git a/drivers/usb/serial/cp2101.c b/drivers/usb/serial/cp2101.c
index 486c7411b9a7..f95d42c0d16a 100644
--- a/drivers/usb/serial/cp2101.c
+++ b/drivers/usb/serial/cp2101.c
@@ -64,7 +64,11 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
         { USB_DEVICE(0x10C4, 0x813D) }, /* Burnside Telecom Deskmobile */
         { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */
+        { USB_DEVICE(0x10C4, 0x81C8) }, /* Lipowsky Industrie Elektronik GmbH, Baby-JTAG */
+        { USB_DEVICE(0x10C4, 0x81E2) }, /* Lipowsky Industrie Elektronik GmbH, Baby-LIN */
+        { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
         { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+        { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
         { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
         { } /* Terminating Entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d3dc1a15ec6c..c186b4e73c72 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1,16 +1,16 @@
 /*
  * USB FTDI SIO driver
  *
- *      Copyright (C) 1999 - 2001
- *          Greg Kroah-Hartman (greg@kroah.com)
+ *      Copyright (C) 1999 - 2001
+ *          Greg Kroah-Hartman (greg@kroah.com)
  *          Bill Ryder (bryder@sgi.com)
  *      Copyright (C) 2002
  *          Kuba Ober (kuba@mareimbrium.org)
  *
- *      This program is free software; you can redistribute it and/or modify
- *      it under the terms of the GNU General Public License as published by
- *      the Free Software Foundation; either version 2 of the License, or
- *      (at your option) any later version.
+ *      This program is free software; you can redistribute it and/or modify
+ *      it under the terms of the GNU General Public License as published by
+ *      the Free Software Foundation; either version 2 of the License, or
+ *      (at your option) any later version.
  *
  * See Documentation/usb/usb-serial.txt for more information on using this driver
  *
@@ -32,7 +32,7 @@
  *      Changed full name of USB-UIRT device to avoid "/" character.
  *      Added FTDI's alternate PID (0x6006) for FT232/245 devices.
  *      Added PID for "ELV USB Module UO100" from Stefan Frings.
- * 
+ *
  * (21/Oct/2003) Ian Abbott
  *      Renamed some VID/PID macros for Matrix Orbital and Perle Systems
  *      devices.  Removed Matrix Orbital and Perle Systems devices from the
@@ -69,7 +69,7 @@
  *      does not incure any measurable overhead.  This also relies on the fact
  *      that we have proper reference counting logic for urbs.  I nicked this
  *      from Greg KH's Visor driver.
- *      
+ *
  * (23/Jun/2003) Ian Abbott
  *      Reduced flip buffer pushes and corrected a data length test in
  *      ftdi_read_bulk_callback.
@@ -77,7 +77,7 @@
  *
  * (21/Jun/2003) Erik Nygren
  *      Added support for Home Electronics Tira-1 IR transceiver using FT232BM chip.
- *      See <http://www.home-electro.com/tira1.htm>.  Only operates properly 
+ *      See <http://www.home-electro.com/tira1.htm>.  Only operates properly
  *      at 100000 and RTS-CTS, so set custom divisor mode on startup.
  *      Also force the Tira-1 and USB-UIRT to only use their custom baud rates.
  *
@@ -137,17 +137,17 @@
  * (17/Feb/2003) Bill Ryder
  *      Added write urb buffer pool on a per device basis
  *      Added more checking for open file on callbacks (fixed OOPS)
- *      Added CrystalFontz 632 and 634 PIDs 
+ *      Added CrystalFontz 632 and 634 PIDs
  *         (thanx to CrystalFontz for the sample devices - they flushed out
  *           some driver bugs)
  *      Minor debugging message changes
  *      Added throttle, unthrottle and chars_in_buffer functions
  *      Fixed FTDI_SIO (the original device) bug
  *      Fixed some shutdown handling
- *      
- * 
- * 
- * 
+ *
+ *
+ *
+ *
  * (07/Jun/2002) Kuba Ober
  *      Changed FTDI_SIO_BASE_BAUD_TO_DIVISOR macro into ftdi_baud_to_divisor
  *      function. It was getting too complex.
@@ -158,7 +158,7 @@
  *
  * (25/Jul/2002) Bill Ryder inserted Dmitri's TIOCMIWAIT patch
  *      Not tested by me but it doesn't break anything I use.
- * 
+ *
  * (04/Jan/2002) Kuba Ober
  *      Implemented 38400 baudrate kludge, where it can be substituted with other
  *        values. That's the only way to set custom baudrates.
@@ -179,7 +179,7 @@
  *        (the previous version caused panics)
  *      Removed port iteration code since the device only has one I/O port and it
  *        was wrong anyway.
- * 
+ *
  * (31/May/2001) gkh
  *      Switched from using spinlock to a semaphore, which fixes lots of problems.
  *
@@ -188,16 +188,16 @@
  *      Cleaned up comments for 8U232
  *      Added parity, framing and overrun error handling
  *      Added receive break handling.
- * 
+ *
  * (04/08/2001) gb
  *      Identify version on module load.
- *       
+ *
  * (18/March/2001) Bill Ryder
  *      (Not released)
  *      Added send break handling. (requires kernel patch too)
  *      Fixed 8U232AM hardware RTS/CTS etc status reporting.
  *      Added flipbuf fix copied from generic device
- * 
+ *
  * (12/3/2000) Bill Ryder
  *      Added support for 8U232AM device.
  *      Moved PID and VIDs into header file only.
@@ -211,14 +211,14 @@
  *      Cleaned up comments. Removed multiple PID/VID definitions.
  *      Factorised cts/dtr code
  *      Made use of __FUNCTION__ in dbg's
- *      
+ *
  * (11/01/2000) Adam J. Richter
  *      usb_device_id table support
- * 
+ *
  * (10/05/2000) gkh
  *      Fixed bug with urb->dev not being set properly, now that the usb
  *      core needs it.
- * 
+ *
  * (09/11/2000) gkh
  *      Removed DEBUG #ifdefs with call to usb_serial_debug_data
  *
@@ -226,11 +226,11 @@
  *      Added module_init and module_exit functions to handle the fact that this
  *      driver is a loadable module now.
  *
- * (04/04/2000) Bill Ryder 
+ * (04/04/2000) Bill Ryder
  *      Fixed bugs in TCGET/TCSET ioctls (by removing them - they are
  *        handled elsewhere in the tty io driver chain).
  *
- * (03/30/2000) Bill Ryder 
+ * (03/30/2000) Bill Ryder
  *      Implemented lots of ioctls
  *      Fixed a race condition in write
  *      Changed some dbg's to errs
@@ -311,6 +311,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_ACTZWAVE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_DMX4ALL) },
         { USB_DEVICE(FTDI_VID, FTDI_SIO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
@@ -444,13 +445,13 @@ static struct usb_device_id id_table_combined [] = {
         /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) }, */
         /* { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) }, */
         /* { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) }, */
-        { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
-        { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
-        { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
-        { USB_DEVICE(FTDI_VID, LINX_FUTURE_1_PID) },
-        { USB_DEVICE(FTDI_VID, LINX_FUTURE_2_PID) },
-        { USB_DEVICE(FTDI_VID, FTDI_CCSICDU20_0_PID) },
-        { USB_DEVICE(FTDI_VID, FTDI_CCSICDU40_1_PID) },
+        { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
+        { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
+        { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
+        { USB_DEVICE(FTDI_VID, LINX_FUTURE_1_PID) },
+        { USB_DEVICE(FTDI_VID, LINX_FUTURE_2_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CCSICDU20_0_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_CCSICDU40_1_PID) },
         { USB_DEVICE(FTDI_VID, INSIDE_ACCESSO) },
         { USB_DEVICE(INTREPID_VID, INTREPID_VALUECAN_PID) },
         { USB_DEVICE(INTREPID_VID, INTREPID_NEOVI_PID) },
@@ -511,6 +512,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13M_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13U_PID) },
+        { USB_DEVICE(ELEKTOR_VID, ELEKTOR_FT323R_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -522,7 +524,7 @@ static struct usb_driver ftdi_driver = {
         .probe =        usb_serial_probe,
         .disconnect =   usb_serial_disconnect,
         .id_table =     id_table_combined,
-        .no_dynamic_id =        1,
+        .no_dynamic_id =        1,
 };
 
 static const char *ftdi_chip_name[] = {
@@ -548,13 +550,13 @@ struct ftdi_private {
         int custom_divisor;     /* custom_divisor kludge, this is for baud_base (different from what goes to the chip!) */
         __u16 last_set_data_urb_value ;
                                 /* the last data state set - needed for doing a break */
-        int write_offset;       /* This is the offset in the usb data block to write the serial data - 
+        int write_offset;       /* This is the offset in the usb data block to write the serial data -
                                  * it is different between devices
                                  */
         int flags;              /* some ASYNC_xxxx flags are supported */
         unsigned long last_dtr_rts;     /* saved modem control outputs */
         wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
-        char prev_status, diff_status;        /* Used for TIOCMIWAIT */
+        char prev_status, diff_status;        /* Used for TIOCMIWAIT */
         __u8 rx_flags;          /* receive state flags (throttling) */
         spinlock_t rx_lock;     /* spinlock for receive state */
         struct work_struct rx_work;
@@ -721,7 +723,7 @@ static int update_mctrl(struct usb_serial_port *port, unsigned int set, unsigned
                 urb_value |= FTDI_SIO_SET_RTS_HIGH;
         rv = usb_control_msg(port->serial->dev,
                                usb_sndctrlpipe(port->serial->dev, 0),
-                               FTDI_SIO_SET_MODEM_CTRL_REQUEST, 
+                               FTDI_SIO_SET_MODEM_CTRL_REQUEST,
                                FTDI_SIO_SET_MODEM_CTRL_REQUEST_TYPE,
                                urb_value, priv->interface,
                                buf, 0, WDR_TIMEOUT);
@@ -768,7 +770,7 @@ static int change_speed(struct usb_serial_port *port)
         if (priv->interface) {  /* FT2232C */
                 urb_index = (__u16)((urb_index << 8) | priv->interface);
         }
-        
+
         rv = usb_control_msg(port->serial->dev,
                             usb_sndctrlpipe(port->serial->dev, 0),
                             FTDI_SIO_SET_BAUDRATE_REQUEST,
@@ -827,7 +829,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
 
         /* 3. Convert baudrate to device-specific divisor */
 
-        if (!baud) baud = 9600; 
+        if (!baud) baud = 9600;
         switch(priv->chip_type) {
         case SIO: /* SIO chip */
                 switch(baud) {
@@ -843,7 +845,7 @@ static __u32 get_ftdi_divisor(struct usb_serial_port * port)
                 case 115200: div_value = ftdi_sio_b115200; break;
                 } /* baud */
                 if (div_value == 0) {
-                        dbg("%s - Baudrate (%d) requested is not supported", __FUNCTION__,  baud);
+                        dbg("%s - Baudrate (%d) requested is not supported", __FUNCTION__,  baud);
                         div_value = ftdi_sio_b9600;
                         div_okay = 0;
                 }
@@ -925,7 +927,7 @@ static int set_serial_info(struct usb_serial_port * port, struct serial_struct _
         /* Make the changes - these are privileged changes! */
 
         priv->flags = ((priv->flags & ~ASYNC_FLAGS) |
-                       (new_serial.flags & ASYNC_FLAGS));       
+                       (new_serial.flags & ASYNC_FLAGS));
         priv->custom_divisor = new_serial.custom_divisor;
 
         port->tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
@@ -950,7 +952,7 @@ check_and_exit:
              (old_priv.custom_divisor != priv->custom_divisor))) {
                 change_speed(port);
         }
-        
+
         return (0);
 
 } /* set_serial_info */
@@ -1022,18 +1024,18 @@ static ssize_t show_latency_timer(struct device *dev, struct device_attribute *a
         struct usb_device *udev;
         unsigned short latency = 0;
         int rv = 0;
-        
+
         udev = to_usb_device(dev);
-        
+
         dbg("%s",__FUNCTION__);
-        
+
         rv = usb_control_msg(udev,
                              usb_rcvctrlpipe(udev, 0),
                              FTDI_SIO_GET_LATENCY_TIMER_REQUEST,
                              FTDI_SIO_GET_LATENCY_TIMER_REQUEST_TYPE,
-                             0, priv->interface, 
+                             0, priv->interface,
                              (char*) &latency, 1, WDR_TIMEOUT);
-        
+
         if (rv < 0) {
                 dev_err(dev, "Unable to read latency timer: %i", rv);
                 return -EIO;
@@ -1051,23 +1053,23 @@ static ssize_t store_latency_timer(struct device *dev, struct device_attribute *
         char buf[1];
         int v = simple_strtoul(valbuf, NULL, 10);
         int rv = 0;
-        
+
         udev = to_usb_device(dev);
-        
+
         dbg("%s: setting latency timer = %i", __FUNCTION__, v);
-        
+
         rv = usb_control_msg(udev,
                              usb_sndctrlpipe(udev, 0),
                              FTDI_SIO_SET_LATENCY_TIMER_REQUEST,
                              FTDI_SIO_SET_LATENCY_TIMER_REQUEST_TYPE,
-                             v, priv->interface, 
+                             v, priv->interface,
                              buf, 0, WDR_TIMEOUT);
-        
+
         if (rv < 0) {
                 dev_err(dev, "Unable to write latency timer: %i", rv);
                 return -EIO;
         }
-        
+
         return count;
 }
 
@@ -1082,23 +1084,23 @@ static ssize_t store_event_char(struct device *dev, struct device_attribute *att
         char buf[1];
         int v = simple_strtoul(valbuf, NULL, 10);
         int rv = 0;
-        
+
         udev = to_usb_device(dev);
-        
+
         dbg("%s: setting event char = %i", __FUNCTION__, v);
-        
+
         rv = usb_control_msg(udev,
                              usb_sndctrlpipe(udev, 0),
                              FTDI_SIO_SET_EVENT_CHAR_REQUEST,
                              FTDI_SIO_SET_EVENT_CHAR_REQUEST_TYPE,
-                             v, priv->interface, 
+                             v, priv->interface,
                              buf, 0, WDR_TIMEOUT);
-        
+
         if (rv < 0) {
                 dbg("Unable to write event character: %i", rv);
                 return -EIO;
         }
-        
+
         return count;
 }
 
@@ -1135,11 +1137,11 @@ static void remove_sysfs_attrs(struct usb_serial *serial)
         struct ftdi_private *priv;
         struct usb_device *udev;
 
-        dbg("%s",__FUNCTION__); 
+        dbg("%s",__FUNCTION__);
 
         priv = usb_get_serial_port_data(serial->port[0]);
         udev = serial->dev;
-        
+
         /* XXX see create_sysfs_attrs */
         if (priv->chip_type != SIO) {
                 device_remove_file(&udev->dev, &dev_attr_event_char);
@@ -1147,7 +1149,7 @@ static void remove_sysfs_attrs(struct usb_serial *serial)
                         device_remove_file(&udev->dev, &dev_attr_latency_timer);
                 }
         }
-        
+
 }
 
 /*
@@ -1258,7 +1260,7 @@ static void ftdi_HE_TIRA1_setup (struct usb_serial *serial)
 } /* ftdi_HE_TIRA1_setup */
 
 
-/* ftdi_shutdown is called from usbserial:usb_serial_disconnect 
+/* ftdi_shutdown is called from usbserial:usb_serial_disconnect
  *   it is called when the usb device is disconnected
  *
  *   usbserial:usb_serial_disconnect
@@ -1269,16 +1271,16 @@ static void ftdi_HE_TIRA1_setup (struct usb_serial *serial)
 
 static void ftdi_shutdown (struct usb_serial *serial)
 { /* ftdi_shutdown */
-        
+
         struct usb_serial_port *port = serial->port[0];
         struct ftdi_private *priv = usb_get_serial_port_data(port);
 
         dbg("%s", __FUNCTION__);
 
         remove_sysfs_attrs(serial);
-        
-        /* all open ports are closed at this point 
-         *    (by usbserial.c:__serial_close, which calls ftdi_close)  
+
+        /* all open ports are closed at this point
+         *    (by usbserial.c:__serial_close, which calls ftdi_close)
          */
 
         if (priv) {
@@ -1293,7 +1295,7 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
         struct usb_device *dev = port->serial->dev;
         struct ftdi_private *priv = usb_get_serial_port_data(port);
         unsigned long flags;
-        
+
         int result = 0;
         char buf[1]; /* Needed for the usb_control_msg I think */
 
@@ -1312,8 +1314,8 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
         /* No error checking for this (will get errors later anyway) */
         /* See ftdi_sio.h for description of what is reset */
         usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                        FTDI_SIO_RESET_REQUEST, FTDI_SIO_RESET_REQUEST_TYPE, 
-                        FTDI_SIO_RESET_SIO, 
+                        FTDI_SIO_RESET_REQUEST, FTDI_SIO_RESET_REQUEST_TYPE,
+                        FTDI_SIO_RESET_SIO,
                         priv->interface, buf, 0, WDR_TIMEOUT);
 
         /* Termios defaults are set by usb_serial_init. We don't change
@@ -1350,12 +1352,12 @@ static int  ftdi_open (struct usb_serial_port *port, struct file *filp)
 
 
 
-/* 
+/*
  * usbserial:__serial_close  only calls ftdi_close if the point is open
  *
  *   This only gets called when it is the last close
- *   
- *   
+ *
+ *
  */
 
 static void ftdi_close (struct usb_serial_port *port, struct file *filp)
@@ -1368,14 +1370,14 @@ static void ftdi_close (struct usb_serial_port *port, struct file *filp)
 
         if (c_cflag & HUPCL){
                 /* Disable flow control */
-                if (usb_control_msg(port->serial->dev, 
+                if (usb_control_msg(port->serial->dev,
                                     usb_sndctrlpipe(port->serial->dev, 0),
                                     FTDI_SIO_SET_FLOW_CTRL_REQUEST,
                                     FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE,
                                     0, priv->interface, buf, 0,
                                     WDR_TIMEOUT) < 0) {
                         err("error from flowcontrol urb");
-                }           
+                }
 
                 /* drop RTS and DTR */
                 clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
@@ -1384,14 +1386,14 @@ static void ftdi_close (struct usb_serial_port *port, struct file *filp)
         /* cancel any scheduled reading */
         cancel_delayed_work(&priv->rx_work);
         flush_scheduled_work();
-        
+
         /* shutdown our bulk read */
         if (port->read_urb)
                 usb_kill_urb(port->read_urb);
 } /* ftdi_close */
 
 
-  
+
 /* The SIO requires the first byte to have:
  *  B0 1
  *  B1 0
@@ -1423,7 +1425,7 @@ static int ftdi_write (struct usb_serial_port *port,
                 return 0;
         }
         spin_unlock_irqrestore(&priv->tx_lock, flags);
-        
+
         data_offset = priv->write_offset;
         dbg("data_offset set to %d",data_offset);
 
@@ -1462,7 +1464,7 @@ static int ftdi_write (struct usb_serial_port *port,
                                 user_pktsz = todo;
                         }
                         /* Write the control byte at the front of the packet*/
-                        *first_byte = 1 | ((user_pktsz) << 2); 
+                        *first_byte = 1 | ((user_pktsz) << 2);
                         /* Copy data for packet */
                         memcpy (first_byte + data_offset,
                                 current_position, user_pktsz);
@@ -1479,7 +1481,7 @@ static int ftdi_write (struct usb_serial_port *port,
         usb_serial_debug_data(debug, &port->dev, __FUNCTION__, transfer_size, buffer);
 
         /* fill the buffer and send it */
-        usb_fill_bulk_urb(urb, port->serial->dev, 
+        usb_fill_bulk_urb(urb, port->serial->dev,
                       usb_sndbulkpipe(port->serial->dev, port->bulk_out_endpointAddress),
                       buffer, transfer_size,
                       ftdi_write_bulk_callback, port);
@@ -1520,7 +1522,7 @@ static void ftdi_write_bulk_callback (struct urb *urb)
         kfree (urb->transfer_buffer);
 
         dbg("%s - port %d", __FUNCTION__, port->number);
-        
+
         if (urb->status) {
                 dbg("nonzero write bulk status received: %d", urb->status);
                 return;
@@ -1651,7 +1653,7 @@ static void ftdi_process_read (void *param)
         struct tty_struct *tty;
         struct ftdi_private *priv;
         char error_flag;
-        unsigned char *data;
+        unsigned char *data;
 
         int i;
         int result;
@@ -1759,7 +1761,7 @@ static void ftdi_process_read (void *param)
                 }
                 if (length > 0) {
                         for (i = 2; i < length+2; i++) {
-                                /* Note that the error flag is duplicated for 
+                                /* Note that the error flag is duplicated for
                                    every character received since we don't know
                                    which character it applied to */
                                 tty_insert_flip_char(tty, data[packet_offset+i], error_flag);
@@ -1773,7 +1775,7 @@ static void ftdi_process_read (void *param)
                    This doesn't work well since the application receives a never
                    ending stream of bad data - even though new data hasn't been sent.
                    Therefore I (bill) have taken this out.
-                   However - this might make sense for framing errors and so on 
+                   However - this might make sense for framing errors and so on
                    so I am leaving the code in for now.
                 */
                 else {
@@ -1827,7 +1829,7 @@ static void ftdi_process_read (void *param)
         /* if the port is closed stop trying to read */
         if (port->open_count > 0){
                 /* Continue trying to always read  */
-                usb_fill_bulk_urb(port->read_urb, port->serial->dev, 
+                usb_fill_bulk_urb(port->read_urb, port->serial->dev,
                               usb_rcvbulkpipe(port->serial->dev, port->bulk_in_endpointAddress),
                               port->read_urb->transfer_buffer, port->read_urb->transfer_buffer_length,
                               ftdi_read_bulk_callback, port);
@@ -1844,9 +1846,9 @@ static void ftdi_process_read (void *param)
 static void ftdi_break_ctl( struct usb_serial_port *port, int break_state )
 {
         struct ftdi_private *priv = usb_get_serial_port_data(port);
-        __u16 urb_value = 0; 
+        __u16 urb_value = 0;
         char buf[1];
-        
+
         /* break_state = -1 to turn on break, and 0 to turn off break */
         /* see drivers/char/tty_io.c to see it used */
         /* last_set_data_urb_value NEVER has the break bit set in it */
@@ -1854,20 +1856,20 @@ static void ftdi_break_ctl( struct usb_serial_port *port, int break_state )
         if (break_state) {
                 urb_value = priv->last_set_data_urb_value | FTDI_SIO_SET_BREAK;
         } else {
-                urb_value = priv->last_set_data_urb_value; 
+                urb_value = priv->last_set_data_urb_value;
         }
 
-        
+
         if (usb_control_msg(port->serial->dev, usb_sndctrlpipe(port->serial->dev, 0),
-                            FTDI_SIO_SET_DATA_REQUEST, 
+                            FTDI_SIO_SET_DATA_REQUEST,
                             FTDI_SIO_SET_DATA_REQUEST_TYPE,
                             urb_value , priv->interface,
                             buf, 0, WDR_TIMEOUT) < 0) {
                 err("%s FAILED to enable/disable break state (state was %d)", __FUNCTION__,break_state);
-        }          
+        }
 
         dbg("%s break state is %d - urb is %d", __FUNCTION__,break_state, urb_value);
-        
+
 }
 
 
@@ -1883,12 +1885,12 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
         struct ftdi_private *priv = usb_get_serial_port_data(port);
         __u16 urb_value; /* will hold the new flags */
         char buf[1]; /* Perhaps I should dynamically alloc this? */
-        
+
         // Added for xon/xoff support
         unsigned int iflag = port->tty->termios->c_iflag;
         unsigned char vstop;
         unsigned char vstart;
-        
+
         dbg("%s", __FUNCTION__);
 
         /* Force baud rate if this device requires it, unless it is set to B0. */
@@ -1906,20 +1908,20 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
 
         cflag = port->tty->termios->c_cflag;
 
-        /* FIXME -For this cut I don't care if the line is really changing or 
-           not  - so just do the change regardless  - should be able to 
+        /* FIXME -For this cut I don't care if the line is really changing or
+           not  - so just do the change regardless  - should be able to
            compare old_termios and tty->termios */
-        /* NOTE These routines can get interrupted by 
-           ftdi_sio_read_bulk_callback  - need to examine what this 
+        /* NOTE These routines can get interrupted by
+           ftdi_sio_read_bulk_callback  - need to examine what this
            means - don't see any problems yet */
-        
+
         /* Set number of data bits, parity, stop bits */
-        
+
         urb_value = 0;
         urb_value |= (cflag & CSTOPB ? FTDI_SIO_SET_DATA_STOP_BITS_2 :
                       FTDI_SIO_SET_DATA_STOP_BITS_1);
-        urb_value |= (cflag & PARENB ? 
-                      (cflag & PARODD ? FTDI_SIO_SET_DATA_PARITY_ODD : 
+        urb_value |= (cflag & PARENB ?
+                      (cflag & PARODD ? FTDI_SIO_SET_DATA_PARITY_ODD :
                        FTDI_SIO_SET_DATA_PARITY_EVEN) :
                       FTDI_SIO_SET_DATA_PARITY_NONE);
         if (cflag & CSIZE) {
@@ -1936,25 +1938,25 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
         /* This is needed by the break command since it uses the same command - but is
          *  or'ed with this value  */
         priv->last_set_data_urb_value = urb_value;
-        
+
         if (usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                            FTDI_SIO_SET_DATA_REQUEST, 
+                            FTDI_SIO_SET_DATA_REQUEST,
                             FTDI_SIO_SET_DATA_REQUEST_TYPE,
                             urb_value , priv->interface,
                             buf, 0, WDR_SHORT_TIMEOUT) < 0) {
                 err("%s FAILED to set databits/stopbits/parity", __FUNCTION__);
-        }          
+        }
 
         /* Now do the baudrate */
         if ((cflag & CBAUD) == B0 ) {
                 /* Disable flow control */
                 if (usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
-                                    FTDI_SIO_SET_FLOW_CTRL_REQUEST, 
+                                    FTDI_SIO_SET_FLOW_CTRL_REQUEST,
                                     FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE,
-                                    0, priv->interface, 
+                                    0, priv->interface,
                                     buf, 0, WDR_TIMEOUT) < 0) {
                         err("%s error from disable flowcontrol urb", __FUNCTION__);
-                }           
+                }
                 /* Drop RTS and DTR */
                 clear_mctrl(port, TIOCM_DTR | TIOCM_RTS);
         } else {
@@ -1972,16 +1974,16 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
         /* Note device also supports DTR/CD (ugh) and Xon/Xoff in hardware */
         if (cflag & CRTSCTS) {
                 dbg("%s Setting to CRTSCTS flow control", __FUNCTION__);
-                if (usb_control_msg(dev, 
+                if (usb_control_msg(dev,
                                     usb_sndctrlpipe(dev, 0),
-                                    FTDI_SIO_SET_FLOW_CTRL_REQUEST, 
+                                    FTDI_SIO_SET_FLOW_CTRL_REQUEST,
                                     FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE,
                                     0 , (FTDI_SIO_RTS_CTS_HS | priv->interface),
                                     buf, 0, WDR_TIMEOUT) < 0) {
                         err("urb failed to set to rts/cts flow control");
-                }               
-                
-        } else { 
+                }
+
+        } else {
                 /*
                  * Xon/Xoff code
                  *
@@ -2011,16 +2013,16 @@ static void ftdi_set_termios (struct usb_serial_port *port, struct termios *old_
                         /* else clause to only run if cfag ! CRTSCTS and iflag ! XOFF */
                         /* CHECKME Assuming XON/XOFF handled by tty stack - not by device */
                         dbg("%s Turning off hardware flow control", __FUNCTION__);
-                        if (usb_control_msg(dev, 
+                        if (usb_control_msg(dev,
                                             usb_sndctrlpipe(dev, 0),
-                                            FTDI_SIO_SET_FLOW_CTRL_REQUEST, 
+                                            FTDI_SIO_SET_FLOW_CTRL_REQUEST,
                                             FTDI_SIO_SET_FLOW_CTRL_REQUEST_TYPE,
-                                            0, priv->interface, 
+                                            0, priv->interface,
                                             buf, 0, WDR_TIMEOUT) < 0) {
                                 err("urb failed to clear flow control");
-                        }                               
+                        }
                 }
-                
+
         }
         return;
 } /* ftdi_termios */
@@ -2036,11 +2038,11 @@ static int ftdi_tiocmget (struct usb_serial_port *port, struct file *file)
         switch (priv->chip_type) {
         case SIO:
                 /* Request the status from the device */
-                if ((ret = usb_control_msg(port->serial->dev, 
+                if ((ret = usb_control_msg(port->serial->dev,
                                            usb_rcvctrlpipe(port->serial->dev, 0),
-                                           FTDI_SIO_GET_MODEM_STATUS_REQUEST, 
+                                           FTDI_SIO_GET_MODEM_STATUS_REQUEST,
                                            FTDI_SIO_GET_MODEM_STATUS_REQUEST_TYPE,
-                                           0, 0, 
+                                           0, 0,
                                            buf, 1, WDR_TIMEOUT)) < 0 ) {
                         err("%s Could not get modem status of device - err: %d", __FUNCTION__,
                             ret);
@@ -2052,11 +2054,11 @@ static int ftdi_tiocmget (struct usb_serial_port *port, struct file *file)
         case FT2232C:
                 /* the 8U232AM returns a two byte value (the sio is a 1 byte value) - in the same
                    format as the data returned from the in point */
-                if ((ret = usb_control_msg(port->serial->dev, 
+                if ((ret = usb_control_msg(port->serial->dev,
                                            usb_rcvctrlpipe(port->serial->dev, 0),
-                                           FTDI_SIO_GET_MODEM_STATUS_REQUEST, 
+                                           FTDI_SIO_GET_MODEM_STATUS_REQUEST,
                                            FTDI_SIO_GET_MODEM_STATUS_REQUEST_TYPE,
-                                           0, priv->interface, 
+                                           0, priv->interface,
                                            buf, 2, WDR_TIMEOUT)) < 0 ) {
                         err("%s Could not get modem status of device - err: %d", __FUNCTION__,
                             ret);
@@ -2067,12 +2069,12 @@ static int ftdi_tiocmget (struct usb_serial_port *port, struct file *file)
                 return -EFAULT;
                 break;
         }
-        
+
         return  (buf[0] & FTDI_SIO_DSR_MASK ? TIOCM_DSR : 0) |
                 (buf[0] & FTDI_SIO_CTS_MASK ? TIOCM_CTS : 0) |
                 (buf[0]  & FTDI_SIO_RI_MASK  ? TIOCM_RI  : 0) |
                 (buf[0]  & FTDI_SIO_RLSD_MASK ? TIOCM_CD  : 0) |
-                priv->last_dtr_rts;                     
+                priv->last_dtr_rts;
 }
 
 static int ftdi_tiocmset(struct usb_serial_port *port, struct file * file, unsigned int set, unsigned int clear)
@@ -2138,11 +2140,11 @@ static int ftdi_ioctl (struct usb_serial_port *port, struct file * file, unsigne
                 break;
         default:
                 break;
-                
+
         }
 
 
-        /* This is not necessarily an error - turns out the higher layers will do 
+        /* This is not necessarily an error - turns out the higher layers will do
          *  some ioctls itself (see comment above)
          */
         dbg("%s arg not supported - it was 0x%04x - check /usr/include/asm/ioctls.h", __FUNCTION__, cmd);
@@ -2199,7 +2201,7 @@ static int __init ftdi_init (void)
         if (retval)
                 goto failed_sio_register;
         retval = usb_register(&ftdi_driver);
-        if (retval) 
+        if (retval)
                 goto failed_usb_register;
 
         info(DRIVER_VERSION ":" DRIVER_DESC);
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index f0edb87d2dd5..bae117d359af 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -55,6 +55,9 @@
 /* iPlus device */
 #define FTDI_IPLUS_PID 0xD070 /* Product Id */
 
+/* DMX4ALL DMX Interfaces */
+#define FTDI_DMX4ALL 0xC850
+
 /* www.crystalfontz.com devices - thanx for providing free devices for evaluation ! */
 /* they use the ftdi chipset for the USB interface and the vendor id is the same */
 #define FTDI_XF_632_PID 0xFC08  /* 632: 16x2 Character Display */
@@ -175,9 +178,15 @@
 #define FTDI_ASK_RDR400_PID     0xC991  /* ASK RDR 400 series card reader */
 
 /*
+ * FTDI USB UART chips used in construction projects from the
+ * Elektor Electronics magazine (http://elektor-electronics.co.uk)
+ */
+#define ELEKTOR_VID             0x0C7D
+#define ELEKTOR_FT323R_PID      0x0005  /* RFID-Reader, issue 09-2006 */
+
+/*
  * DSS-20 Sync Station for Sony Ericsson P800
  */
- 
 #define FTDI_DSS20_PID          0xFC82  
 
 /*
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index 6238aff1e772..d72cf8bc7f76 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -320,6 +320,7 @@ static struct usb_device_id ipaq_id_table [] = {
         { USB_DEVICE(0x0B05, 0x9200) }, /* ASUS USB Sync */
         { USB_DEVICE(0x0B05, 0x9202) }, /* ASUS USB Sync */
         { USB_DEVICE(0x0BB4, 0x00CE) }, /* HTC USB Sync */
+        { USB_DEVICE(0x0BB4, 0x00CF) }, /* HTC USB Modem */
         { USB_DEVICE(0x0BB4, 0x0A01) }, /* PocketPC USB Sync */
         { USB_DEVICE(0x0BB4, 0x0A02) }, /* PocketPC USB Sync */
         { USB_DEVICE(0x0BB4, 0x0A03) }, /* PocketPC USB Sync */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
new file mode 100644
index 000000000000..82cd15b894b0
--- /dev/null
+++ b/drivers/usb/serial/mos7720.c
@@ -0,0 +1,1683 @@
+/*
+ * mos7720.c
+ *   Controls the Moschip 7720 usb to dual port serial convertor
+ *
+ * Copyright 2006 Moschip Semiconductor Tech. Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ *
+ * Developed by:
+ *      VijayaKumar.G.N. <vijaykumar@aspirecom.net>
+ *      AjayKumar <ajay@aspirecom.net>
+ *      Gurudeva.N. <gurudev@aspirecom.net>
+ *
+ * Cleaned up from the original by:
+ *      Greg Kroah-Hartman <gregkh@suse.de>
+ *
+ * Originally based on drivers/usb/serial/io_edgeport.c which is:
+ *      Copyright (C) 2000 Inside Out Networks, All rights reserved.
+ *      Copyright (C) 2001-2002 Greg Kroah-Hartman <greg@kroah.com>
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/tty.h>
+#include <linux/tty_driver.h>
+#include <linux/tty_flip.h>
+#include <linux/module.h>
+#include <linux/spinlock.h>
+#include <linux/serial.h>
+#include <linux/serial_reg.h>
+#include <linux/usb.h>
+#include <linux/usb/serial.h>
+#include <asm/uaccess.h>
+
+
+/*
+ * Version Information
+ */
+#define DRIVER_VERSION "1.0.0.4F"
+#define DRIVER_AUTHOR "Aspire Communications pvt Ltd."
+#define DRIVER_DESC "Moschip USB Serial Driver"
+
+/* default urb timeout */
+#define MOS_WDR_TIMEOUT (HZ * 5)
+
+#define MOS_PORT1       0x0200
+#define MOS_PORT2       0x0300
+#define MOS_VENREG      0x0000
+#define MOS_MAX_PORT    0x02
+#define MOS_WRITE       0x0E
+#define MOS_READ        0x0D
+
+/* Interrupt Rotinue Defines    */
+#define SERIAL_IIR_RLS  0x06
+#define SERIAL_IIR_RDA  0x04
+#define SERIAL_IIR_CTI  0x0c
+#define SERIAL_IIR_THR  0x02
+#define SERIAL_IIR_MS   0x00
+
+#define NUM_URBS                        16      /* URB Count */
+#define URB_TRANSFER_BUFFER_SIZE        32      /* URB Size */
+
+/* This structure holds all of the local port information */
+struct moschip_port
+{
+        __u8    shadowLCR;              /* last LCR value received */
+        __u8    shadowMCR;              /* last MCR value received */
+        __u8    shadowMSR;              /* last MSR value received */
+        char                    open;
+        struct async_icount     icount;
+        struct usb_serial_port  *port;  /* loop back to the owner */
+        struct urb              *write_urb_pool[NUM_URBS];
+};
+
+/* This structure holds all of the individual serial device information */
+struct moschip_serial
+{
+        int interrupt_started;
+};
+
+static int debug;
+
+#define USB_VENDOR_ID_MOSCHIP           0x9710
+#define MOSCHIP_DEVICE_ID_7720          0x7720
+#define MOSCHIP_DEVICE_ID_7715          0x7715
+
+static struct usb_device_id moschip_port_id_table [] = {
+        { USB_DEVICE(USB_VENDOR_ID_MOSCHIP,MOSCHIP_DEVICE_ID_7720) },
+        { } /* terminating entry */
+};
+MODULE_DEVICE_TABLE(usb, moschip_port_id_table);
+
+
+/*
+ * mos7720_interrupt_callback
+ *      this is the callback function for when we have received data on the
+ *      interrupt endpoint.
+ */
+static void mos7720_interrupt_callback(struct urb *urb)
+{
+        int result;
+        int length;
+        __u32 *data;
+        unsigned int status;
+        __u8 sp1;
+        __u8 sp2;
+        __u8 st;
+
+        dbg("%s"," : Entering\n");
+
+        if (!urb) {
+                dbg("%s","Invalid Pointer !!!!:\n");
+                return;
+        }
+
+        switch (urb->status) {
+        case 0:
+                /* success */
+                break;
+        case -ECONNRESET:
+        case -ENOENT:
+        case -ESHUTDOWN:
+                /* this urb is terminated, clean up */
+                dbg("%s - urb shutting down with status: %d", __FUNCTION__,
+                    urb->status);
+                return;
+        default:
+                dbg("%s - nonzero urb status received: %d", __FUNCTION__,
+                    urb->status);
+                goto exit;
+        }
+
+        length = urb->actual_length;
+        data = urb->transfer_buffer;
+
+        /* Moschip get 4 bytes
+         * Byte 1 IIR Port 1 (port.number is 0)
+         * Byte 2 IIR Port 2 (port.number is 1)
+         * Byte 3 --------------
+         * Byte 4 FIFO status for both */
+        if (length && length > 4) {
+                dbg("Wrong data !!!");
+                return;
+        }
+
+        status = *data;
+
+        sp1 = (status & 0xff000000)>>24;
+        sp2 = (status & 0x00ff0000)>>16;
+        st = status & 0x000000ff;
+
+        if ((sp1 & 0x01) || (sp2 & 0x01)) {
+                /* No Interrupt Pending in both the ports */
+                dbg("No Interrupt !!!");
+        } else {
+                switch (sp1 & 0x0f) {
+                case SERIAL_IIR_RLS:
+                        dbg("Serial Port 1: Receiver status error or address "
+                            "bit detected in 9-bit mode\n");
+                        break;
+                case SERIAL_IIR_CTI:
+                        dbg("Serial Port 1: Receiver time out");
+                        break;
+                case SERIAL_IIR_MS:
+                        dbg("Serial Port 1: Modem status change");
+                        break;
+                }
+
+                switch (sp2 & 0x0f) {
+                case SERIAL_IIR_RLS:
+                        dbg("Serial Port 2: Receiver status error or address "
+                            "bit detected in 9-bit mode");
+                        break;
+                case SERIAL_IIR_CTI:
+                        dbg("Serial Port 2: Receiver time out");
+                        break;
+                case SERIAL_IIR_MS:
+                        dbg("Serial Port 2: Modem status change");
+                        break;
+                }
+        }
+
+exit:
+        result = usb_submit_urb(urb, GFP_ATOMIC);
+        if (result)
+                dev_err(&urb->dev->dev,
+                        "%s - Error %d submitting control urb\n",
+                        __FUNCTION__, result);
+        return;
+}
+
+/*
+ * mos7720_bulk_in_callback
+ *      this is the callback function for when we have received data on the
+ *      bulk in endpoint.
+ */
+static void mos7720_bulk_in_callback(struct urb *urb)
+{
+        int status;
+        unsigned char *data ;
+        struct usb_serial_port *port;
+        struct moschip_port *mos7720_port;
+        struct tty_struct *tty;
+
+        if (urb->status) {
+                dbg("nonzero read bulk status received: %d",urb->status);
+                return;
+        }
+
+        mos7720_port = urb->context;
+        if (!mos7720_port) {
+                dbg("%s","NULL mos7720_port pointer \n");
+                return ;
+        }
+
+        port = mos7720_port->port;
+
+        dbg("Entering...%s", __FUNCTION__);
+
+        data = urb->transfer_buffer;
+
+        tty = port->tty;
+        if (tty && urb->actual_length) {
+                tty_buffer_request_room(tty, urb->actual_length);
+                tty_insert_flip_string(tty, data, urb->actual_length);
+                tty_flip_buffer_push(tty);
+        }
+
+        if (!port->read_urb) {
+                dbg("URB KILLED !!!");
+                return;
+        }
+
+        if (port->read_urb->status != -EINPROGRESS) {
+                port->read_urb->dev = port->serial->dev;
+
+                status = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+                if (status)
+                        dbg("usb_submit_urb(read bulk) failed, status = %d",
+                            status);
+        }
+}
+
+/*
+ * mos7720_bulk_out_data_callback
+ *      this is the callback function for when we have finished sending serial
+ *      data on the bulk out endpoint.
+ */
+static void mos7720_bulk_out_data_callback(struct urb *urb)
+{
+        struct moschip_port *mos7720_port;
+        struct tty_struct *tty;
+
+        if (urb->status) {
+                dbg("nonzero write bulk status received:%d", urb->status);
+                return;
+        }
+
+        mos7720_port = urb->context;
+        if (!mos7720_port) {
+                dbg("NULL mos7720_port pointer");
+                return ;
+        }
+
+        dbg("Entering .........");
+
+        tty = mos7720_port->port->tty;
+
+        if (tty && mos7720_port->open) {
+                /* let the tty driver wakeup if it has a special *
+                 * write_wakeup function */
+                if ((tty->flags & (1 << TTY_DO_WRITE_WAKEUP)) &&
+                     tty->ldisc.write_wakeup)
+                        (tty->ldisc.write_wakeup)(tty);
+
+                /* tell the tty driver that something has changed */
+                wake_up_interruptible(&tty->write_wait);
+        }
+
+        /* schedule_work(&mos7720_port->port->work); */
+}
+
+/*
+ * send_mos_cmd
+ *      this function will be used for sending command to device
+ */
+static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
+                        __u16 index, void *data)
+{
+        int status;
+        unsigned int pipe;
+        u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
+        __u8 requesttype;
+        __u16 size = 0x0000;
+
+        if (value < MOS_MAX_PORT) {
+                if (product == MOSCHIP_DEVICE_ID_7715) {
+                        value = value*0x100+0x100;
+                } else {
+                        value = value*0x100+0x200;
+                }
+        } else {
+                value = 0x0000;
+                if ((product == MOSCHIP_DEVICE_ID_7715) &&
+                    (index != 0x08)) {
+                        dbg("serial->product== MOSCHIP_DEVICE_ID_7715");
+                        //index = 0x01 ;
+                }
+        }
+
+        if (request == MOS_WRITE) {
+                request = (__u8)MOS_WRITE;
+                requesttype = (__u8)0x40;
+                value  = value + (__u16)*((unsigned char *)data);
+                data = NULL;
+                pipe = usb_sndctrlpipe(serial->dev, 0);
+        } else {
+                request = (__u8)MOS_READ;
+                requesttype = (__u8)0xC0;
+                size = 0x01;
+                pipe = usb_rcvctrlpipe(serial->dev,0);
+        }
+
+        status = usb_control_msg(serial->dev, pipe, request, requesttype,
+                                 value, index, data, size, MOS_WDR_TIMEOUT);
+
+        if (status < 0)
+                dbg("Command Write failed Value %x index %x\n",value,index);
+
+        return status;
+}
+
+static int mos7720_open(struct usb_serial_port *port, struct file * filp)
+{
+        struct usb_serial *serial;
+        struct usb_serial_port *port0;
+        struct urb *urb;
+        struct moschip_serial *mos7720_serial;
+        struct moschip_port *mos7720_port;
+        int response;
+        int port_number;
+        char data;
+        int j;
+
+        serial = port->serial;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL)
+                return -ENODEV;
+
+        port0 = serial->port[0];
+
+        mos7720_serial = usb_get_serial_data(serial);
+
+        if (mos7720_serial == NULL || port0 == NULL)
+                return -ENODEV;
+
+        usb_clear_halt(serial->dev, port->write_urb->pipe);
+        usb_clear_halt(serial->dev, port->read_urb->pipe);
+
+        /* Initialising the write urb pool */
+        for (j = 0; j < NUM_URBS; ++j) {
+                urb = usb_alloc_urb(0,SLAB_ATOMIC);
+                mos7720_port->write_urb_pool[j] = urb;
+
+                if (urb == NULL) {
+                        err("No more urbs???");
+                        continue;
+                }
+
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                               GFP_KERNEL);
+                if (!urb->transfer_buffer) {
+                        err("%s-out of memory for urb buffers.", __FUNCTION__);
+                        continue;
+                }
+        }
+
+         /* Initialize MCS7720 -- Write Init values to corresponding Registers
+          *
+          * Register Index
+          * 1 : IER
+          * 2 : FCR
+          * 3 : LCR
+          * 4 : MCR
+          *
+          * 0x08 : SP1/2 Control Reg
+          */
+        port_number = port->number - port->serial->minor;
+        send_mos_cmd(port->serial, MOS_READ, port_number, UART_LSR, &data);
+        dbg("SS::%p LSR:%x\n",mos7720_port, data);
+
+        dbg("Check:Sending Command ..........");
+
+        data = 0x02;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x01, &data);
+        data = 0x02;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x02, &data);
+
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x02, &data);
+
+        data = 0xCF;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x02, &data);
+        data = 0x03;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x03, &data);
+        data = 0x0b;
+        mos7720_port->shadowMCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+        data = 0x0b;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+
+        data = 0x00;
+        send_mos_cmd(serial, MOS_READ, MOS_MAX_PORT, 0x08, &data);
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x08, &data);
+
+/*      data = 0x00;
+        send_mos_cmd(serial, MOS_READ, MOS_MAX_PORT, port_number + 1, &data);
+        data = 0x03;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, port_number + 1, &data);
+        data = 0x00;
+        send_mos_cmd(port->serial, MOS_WRITE, MOS_MAX_PORT, port_number + 1, &data);
+*/
+        data = 0x00;
+        send_mos_cmd(serial, MOS_READ, MOS_MAX_PORT, 0x08, &data);
+
+        data = data | (port->number - port->serial->minor + 1);
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x08, &data);
+
+        data = 0x83;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x03, &data);
+        data = 0x0c;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x00, &data);
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+        data = 0x03;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x03, &data);
+        data = 0x0c;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+        data = 0x0c;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+
+//Matrix
+
+        /* force low_latency on so that our tty_push actually forces *
+         * the data through,otherwise it is scheduled, and with      *
+         * high data rates (like with OHCI) data can get lost.       */
+
+        if (port->tty)
+                port->tty->low_latency = 1;
+
+        /* see if we've set up our endpoint info yet   *
+         * (can't set it up in mos7720_startup as the  *
+         * structures were not set up at that time.)   */
+        if (!mos7720_serial->interrupt_started) {
+                dbg("Interrupt buffer NULL !!!");
+
+                /* not set up yet, so do it now */
+                mos7720_serial->interrupt_started = 1;
+
+                dbg("To Submit URB !!!");
+
+                /* set up our interrupt urb */
+                usb_fill_int_urb(port0->interrupt_in_urb, serial->dev,
+                                 usb_rcvintpipe(serial->dev,
+                                                port->interrupt_in_endpointAddress),
+                                 port0->interrupt_in_buffer,
+                                 port0->interrupt_in_urb->transfer_buffer_length,
+                                 mos7720_interrupt_callback, mos7720_port,
+                                 port0->interrupt_in_urb->interval);
+
+                /* start interrupt read for this mos7720 this interrupt *
+                 * will continue as long as the mos7720 is connected    */
+                dbg("Submit URB over !!!");
+                response = usb_submit_urb(port0->interrupt_in_urb, GFP_KERNEL);
+                if (response)
+                        dev_err(&port->dev,
+                                "%s - Error %d submitting control urb",
+                                __FUNCTION__, response);
+        }
+
+        /* set up our bulk in urb */
+        usb_fill_bulk_urb(port->read_urb, serial->dev,
+                          usb_rcvbulkpipe(serial->dev,
+                                          port->bulk_in_endpointAddress),
+                          port->bulk_in_buffer,
+                          port->read_urb->transfer_buffer_length,
+                          mos7720_bulk_in_callback, mos7720_port);
+        response = usb_submit_urb(port->read_urb, GFP_KERNEL);
+        if (response)
+                dev_err(&port->dev,
+                        "%s - Error %d submitting read urb", __FUNCTION__, response);
+
+        /* initialize our icount structure */
+        memset(&(mos7720_port->icount), 0x00, sizeof(mos7720_port->icount));
+
+        /* initialize our port settings */
+        mos7720_port->shadowMCR = UART_MCR_OUT2; /* Must set to enable ints! */
+
+        /* send a open port command */
+        mos7720_port->open = 1;
+
+        return 0;
+}
+
+/*
+ * mos7720_chars_in_buffer
+ *      this function is called by the tty driver when it wants to know how many
+ *      bytes of data we currently have outstanding in the port (data that has
+ *      been written, but hasn't made it out the port yet)
+ *      If successful, we return the number of bytes left to be written in the
+ *      system,
+ *      Otherwise we return a negative error number.
+ */
+static int mos7720_chars_in_buffer(struct usb_serial_port *port)
+{
+        int i;
+        int chars = 0;
+        struct moschip_port *mos7720_port;
+
+        dbg("%s:entering ...........", __FUNCTION__);
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL) {
+                dbg("%s:leaving ...........", __FUNCTION__);
+                return -ENODEV;
+        }
+
+        for (i = 0; i < NUM_URBS; ++i) {
+                if (mos7720_port->write_urb_pool[i]->status == -EINPROGRESS)
+                        chars += URB_TRANSFER_BUFFER_SIZE;
+        }
+        dbg("%s - returns %d", __FUNCTION__, chars);
+        return chars;
+}
+
+static void mos7720_close(struct usb_serial_port *port, struct file *filp)
+{
+        struct usb_serial *serial;
+        struct moschip_port *mos7720_port;
+        char data;
+        int j;
+
+        dbg("mos7720_close:entering...");
+
+        serial = port->serial;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL)
+                return;
+
+        for (j = 0; j < NUM_URBS; ++j)
+                usb_kill_urb(mos7720_port->write_urb_pool[j]);
+
+        /* Freeing Write URBs */
+        for (j = 0; j < NUM_URBS; ++j) {
+                if (mos7720_port->write_urb_pool[j]) {
+                        kfree(mos7720_port->write_urb_pool[j]->transfer_buffer);
+                        usb_free_urb(mos7720_port->write_urb_pool[j]);
+                }
+        }
+
+        /* While closing port, shutdown all bulk read, write  *
+         * and interrupt read if they exists                  */
+        if (serial->dev) {
+                dbg("Shutdown bulk write");
+                usb_kill_urb(port->write_urb);
+                dbg("Shutdown bulk read");
+                usb_kill_urb(port->read_urb);
+        }
+
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port->number - port->serial->minor,
+                     0x04, &data);
+
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port->number - port->serial->minor,
+                     0x01, &data);
+
+        mos7720_port->open = 0;
+
+        dbg("Leaving %s", __FUNCTION__);
+}
+
+static void mos7720_break(struct usb_serial_port *port, int break_state)
+{
+        unsigned char data;
+        struct usb_serial *serial;
+        struct moschip_port *mos7720_port;
+
+        dbg("Entering %s", __FUNCTION__);
+
+        serial = port->serial;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL)
+                return;
+
+        if (break_state == -1)
+                data = mos7720_port->shadowLCR | UART_LCR_SBC;
+        else
+                data = mos7720_port->shadowLCR & ~UART_LCR_SBC;
+
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port->number - port->serial->minor,
+                     0x03, &data);
+
+        return;
+}
+
+/*
+ * mos7720_write_room
+ *      this function is called by the tty driver when it wants to know how many
+ *      bytes of data we can accept for a specific port.
+ *      If successful, we return the amount of room that we have for this port
+ *      Otherwise we return a negative error number.
+ */
+static int mos7720_write_room(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7720_port;
+        int room = 0;
+        int i;
+
+        dbg("%s:entering ...........", __FUNCTION__);
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL) {
+                dbg("%s:leaving ...........", __FUNCTION__);
+                return -ENODEV;
+        }
+
+        for (i = 0; i < NUM_URBS; ++i) {
+                if (mos7720_port->write_urb_pool[i]->status != -EINPROGRESS)
+                        room += URB_TRANSFER_BUFFER_SIZE;
+        }
+
+        dbg("%s - returns %d", __FUNCTION__, room);
+        return room;
+}
+
+static int mos7720_write(struct usb_serial_port *port,
+                         const unsigned char *data, int count)
+{
+        int status;
+        int i;
+        int bytes_sent = 0;
+        int transfer_size;
+
+        struct moschip_port *mos7720_port;
+        struct usb_serial *serial;
+        struct urb    *urb;
+        const unsigned char *current_position = data;
+
+        dbg("%s:entering ...........", __FUNCTION__);
+
+        serial = port->serial;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL) {
+                dbg("mos7720_port is NULL");
+                return -ENODEV;
+        }
+
+        /* try to find a free urb in the list */
+        urb = NULL;
+
+        for (i = 0; i < NUM_URBS; ++i) {
+                if (mos7720_port->write_urb_pool[i]->status != -EINPROGRESS) {
+                        urb = mos7720_port->write_urb_pool[i];
+                        dbg("URB:%d",i);
+                        break;
+                }
+        }
+
+        if (urb == NULL) {
+                dbg("%s - no more free urbs", __FUNCTION__);
+                goto exit;
+        }
+
+        if (urb->transfer_buffer == NULL) {
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                               GFP_KERNEL);
+                if (urb->transfer_buffer == NULL) {
+                        err("%s no more kernel memory...", __FUNCTION__);
+                        goto exit;
+                }
+        }
+        transfer_size = min (count, URB_TRANSFER_BUFFER_SIZE);
+
+        memcpy(urb->transfer_buffer, current_position, transfer_size);
+        usb_serial_debug_data(debug, &port->dev, __FUNCTION__, transfer_size,
+                              urb->transfer_buffer);
+
+        /* fill urb with data and submit  */
+        usb_fill_bulk_urb(urb, serial->dev,
+                          usb_sndbulkpipe(serial->dev,
+                                          port->bulk_out_endpointAddress),
+                          urb->transfer_buffer, transfer_size,
+                          mos7720_bulk_out_data_callback, mos7720_port);
+
+        /* send it down the pipe */
+        status = usb_submit_urb(urb,GFP_ATOMIC);
+        if (status) {
+                err("%s - usb_submit_urb(write bulk) failed with status = %d",
+                    __FUNCTION__, status);
+                bytes_sent = status;
+                goto exit;
+        }
+        bytes_sent = transfer_size;
+
+exit:
+        return bytes_sent;
+}
+
+static void mos7720_throttle(struct usb_serial_port *port)
+{
+        struct moschip_port *mos7720_port;
+        struct tty_struct *tty;
+        int status;
+
+        dbg("%s- port %d\n", __FUNCTION__, port->number);
+
+        mos7720_port = usb_get_serial_port_data(port);
+
+        if (mos7720_port == NULL)
+                return;
+
+        if (!mos7720_port->open) {
+                dbg("port not opened");
+                return;
+        }
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        tty = port->tty;
+        if (!tty) {
+                dbg("%s - no tty available", __FUNCTION__);
+                return;
+        }
+
+        /* if we are implementing XON/XOFF, send the stop character */
+        if (I_IXOFF(tty)) {
+                unsigned char stop_char = STOP_CHAR(tty);
+                status = mos7720_write(port, &stop_char, 1);
+                if (status <= 0)
+                        return;
+        }
+
+        /* if we are implementing RTS/CTS, toggle that line */
+        if (tty->termios->c_cflag & CRTSCTS) {
+                mos7720_port->shadowMCR &= ~UART_MCR_RTS;
+                status = send_mos_cmd(port->serial, MOS_WRITE,
+                                      port->number - port->serial->minor,
+                                      UART_MCR, &mos7720_port->shadowMCR);
+                if (status != 0)
+                        return;
+        }
+}
+
+static void mos7720_unthrottle(struct usb_serial_port *port)
+{
+        struct tty_struct *tty;
+        int status;
+        struct moschip_port *mos7720_port = usb_get_serial_port_data(port);
+
+        if (mos7720_port == NULL)
+                return;
+
+        if (!mos7720_port->open) {
+                dbg("%s - port not opened", __FUNCTION__);
+                return;
+        }
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        tty = port->tty;
+        if (!tty) {
+                dbg("%s - no tty available", __FUNCTION__);
+                return;
+        }
+
+        /* if we are implementing XON/XOFF, send the start character */
+        if (I_IXOFF(tty)) {
+                unsigned char start_char = START_CHAR(tty);
+                status = mos7720_write(port, &start_char, 1);
+                if (status <= 0)
+                        return;
+        }
+
+        /* if we are implementing RTS/CTS, toggle that line */
+        if (tty->termios->c_cflag & CRTSCTS) {
+                mos7720_port->shadowMCR |= UART_MCR_RTS;
+                status = send_mos_cmd(port->serial, MOS_WRITE,
+                                      port->number - port->serial->minor,
+                                      UART_MCR, &mos7720_port->shadowMCR);
+                if (status != 0)
+                        return;
+        }
+}
+
+static int set_higher_rates(struct moschip_port *mos7720_port,
+                            unsigned int baud)
+{
+        unsigned char data;
+        struct usb_serial_port *port;
+        struct usb_serial *serial;
+        int port_number;
+
+        if (mos7720_port == NULL)
+                return -EINVAL;
+
+        port = mos7720_port->port;
+        serial = port->serial;
+
+        /***********************************************
+         *      Init Sequence for higher rates
+         ***********************************************/
+        dbg("Sending Setting Commands ..........");
+        port_number = port->number - port->serial->minor;
+
+        data = 0x000;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+        data = 0x000;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x02, &data);
+        data = 0x0CF;
+        send_mos_cmd(serial, MOS_WRITE, port->number, 0x02, &data);
+        data = 0x00b;
+        mos7720_port->shadowMCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+        data = 0x00b;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+
+        data = 0x000;
+        send_mos_cmd(serial, MOS_READ, MOS_MAX_PORT, 0x08, &data);
+        data = 0x000;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x08, &data);
+
+
+        /***********************************************
+         *              Set for higher rates           *
+         ***********************************************/
+
+        data = baud * 0x10;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, port_number + 1,&data);
+
+        data = 0x003;
+        send_mos_cmd(serial, MOS_READ, MOS_MAX_PORT, 0x08, &data);
+        data = 0x003;
+        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT, 0x08, &data);
+
+        data = 0x02b;
+        mos7720_port->shadowMCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+        data = 0x02b;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+
+        /***********************************************
+         *              Set DLL/DLM
+         ***********************************************/
+
+        data = mos7720_port->shadowLCR | UART_LCR_DLAB;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x03, &data);
+
+        data =  0x001; /* DLL */
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x00, &data);
+        data =  0x000; /* DLM */
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x01, &data);
+
+        data = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x03, &data);
+
+        return 0;
+}
+
+/* baud rate information */
+struct divisor_table_entry
+{
+        __u32  baudrate;
+        __u16  divisor;
+};
+
+/* Define table of divisors for moschip 7720 hardware      *
+ * These assume a 3.6864MHz crystal, the standard /16, and *
+ * MCR.7 = 0.                                              */
+static struct divisor_table_entry divisor_table[] = {
+        {   50,         2304},
+        {   110,        1047},  /* 2094.545455 => 230450   => .0217 % over */
+        {   134,        857},   /* 1713.011152 => 230398.5 => .00065% under */
+        {   150,        768},
+        {   300,        384},
+        {   600,        192},
+        {   1200,       96},
+        {   1800,       64},
+        {   2400,       48},
+        {   4800,       24},
+        {   7200,       16},
+        {   9600,       12},
+        {   19200,      6},
+        {   38400,      3},
+        {   57600,      2},
+        {   115200,     1},
+};
+
+/*****************************************************************************
+ * calc_baud_rate_divisor
+ *      this function calculates the proper baud rate divisor for the specified
+ *      baud rate.
+ *****************************************************************************/
+static int calc_baud_rate_divisor(int baudrate, int *divisor)
+{
+        int i;
+        __u16 custom;
+        __u16 round1;
+        __u16 round;
+
+
+        dbg("%s - %d", __FUNCTION__, baudrate);
+
+        for (i = 0; i < ARRAY_SIZE(divisor_table); i++) {
+                if (divisor_table[i].baudrate == baudrate) {
+                        *divisor = divisor_table[i].divisor;
+                        return 0;
+                }
+        }
+
+        /* After trying for all the standard baud rates    *
+         * Try calculating the divisor for this baud rate  */
+        if (baudrate > 75 &&  baudrate < 230400) {
+                /* get the divisor */
+                custom = (__u16)(230400L  / baudrate);
+
+                /* Check for round off */
+                round1 = (__u16)(2304000L / baudrate);
+                round = (__u16)(round1 - (custom * 10));
+                if (round > 4)
+                        custom++;
+                *divisor = custom;
+
+                dbg("Baud %d = %d",baudrate, custom);
+                return 0;
+        }
+
+        dbg("Baud calculation Failed...");
+        return -EINVAL;
+}
+
+/*
+ * send_cmd_write_baud_rate
+ *      this function sends the proper command to change the baud rate of the
+ *      specified port.
+ */
+static int send_cmd_write_baud_rate(struct moschip_port *mos7720_port,
+                                    int baudrate)
+{
+        struct usb_serial_port *port;
+        struct usb_serial *serial;
+        int divisor;
+        int status;
+        unsigned char data;
+        unsigned char number;
+
+        if (mos7720_port == NULL)
+                return -1;
+
+        port = mos7720_port->port;
+        serial = port->serial;
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        number = port->number - port->serial->minor;
+        dbg("%s - port = %d, baud = %d", __FUNCTION__, port->number, baudrate);
+
+        /* Calculate the Divisor */
+        status = calc_baud_rate_divisor(baudrate, &divisor);
+        if (status) {
+                err("%s - bad baud rate", __FUNCTION__);
+                return status;
+        }
+
+        /* Enable access to divisor latch */
+        data = mos7720_port->shadowLCR | UART_LCR_DLAB;
+        mos7720_port->shadowLCR  = data;
+        send_mos_cmd(serial, MOS_WRITE, number, UART_LCR, &data);
+
+        /* Write the divisor */
+        data = ((unsigned char)(divisor & 0xff));
+        send_mos_cmd(serial, MOS_WRITE, number, 0x00, &data);
+
+        data = ((unsigned char)((divisor & 0xff00) >> 8));
+        send_mos_cmd(serial, MOS_WRITE, number, 0x01, &data);
+
+        /* Disable access to divisor latch */
+        data = mos7720_port->shadowLCR & ~UART_LCR_DLAB;
+        mos7720_port->shadowLCR = data;
+        send_mos_cmd(serial, MOS_WRITE, number, 0x03, &data);
+
+        return status;
+}
+
+/*
+ * change_port_settings
+ *      This routine is called to set the UART on the device to match
+ *      the specified new settings.
+ */
+static void change_port_settings(struct moschip_port *mos7720_port,
+                                 struct termios *old_termios)
+{
+        struct usb_serial_port *port;
+        struct usb_serial *serial;
+        struct tty_struct *tty;
+        int baud;
+        unsigned cflag;
+        unsigned iflag;
+        __u8 mask = 0xff;
+        __u8 lData;
+        __u8 lParity;
+        __u8 lStop;
+        int status;
+        int port_number;
+        char data;
+
+        if (mos7720_port == NULL)
+                return ;
+
+        port = mos7720_port->port;
+        serial = port->serial;
+        port_number = port->number - port->serial->minor;
+
+        dbg("%s - port %d", __FUNCTION__, port->number);
+
+        if (!mos7720_port->open) {
+                dbg("%s - port not opened", __FUNCTION__);
+                return;
+        }
+
+        tty = mos7720_port->port->tty;
+
+        if ((!tty) || (!tty->termios)) {
+                dbg("%s - no tty structures", __FUNCTION__);
+                return;
+        }
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        lData = UART_LCR_WLEN8;
+        lStop = 0x00;   /* 1 stop bit */
+        lParity = 0x00; /* No parity */
+
+        cflag = tty->termios->c_cflag;
+        iflag = tty->termios->c_iflag;
+
+        /* Change the number of bits */
+        switch (cflag & CSIZE) {
+        case CS5:
+                lData = UART_LCR_WLEN5;
+                mask = 0x1f;
+                break;
+
+        case CS6:
+                lData = UART_LCR_WLEN6;
+                mask = 0x3f;
+                break;
+
+        case CS7:
+                lData = UART_LCR_WLEN7;
+                mask = 0x7f;
+                break;
+        default:
+        case CS8:
+                lData = UART_LCR_WLEN8;
+                break;
+        }
+
+        /* Change the Parity bit */
+        if (cflag & PARENB) {
+                if (cflag & PARODD) {
+                        lParity = UART_LCR_PARITY;
+                        dbg("%s - parity = odd", __FUNCTION__);
+                } else {
+                        lParity = (UART_LCR_EPAR | UART_LCR_PARITY);
+                        dbg("%s - parity = even", __FUNCTION__);
+                }
+
+        } else {
+                dbg("%s - parity = none", __FUNCTION__);
+        }
+
+        if (cflag & CMSPAR)
+                lParity = lParity | 0x20;
+
+        /* Change the Stop bit */
+        if (cflag & CSTOPB) {
+                lStop = UART_LCR_STOP;
+                dbg("%s - stop bits = 2", __FUNCTION__);
+        } else {
+                lStop = 0x00;
+                dbg("%s - stop bits = 1", __FUNCTION__);
+        }
+
+#define LCR_BITS_MASK           0x03    /* Mask for bits/char field */
+#define LCR_STOP_MASK           0x04    /* Mask for stop bits field */
+#define LCR_PAR_MASK            0x38    /* Mask for parity field */
+
+        /* Update the LCR with the correct value */
+        mos7720_port->shadowLCR &= ~(LCR_BITS_MASK | LCR_STOP_MASK | LCR_PAR_MASK);
+        mos7720_port->shadowLCR |= (lData | lParity | lStop);
+
+
+        /* Disable Interrupts */
+        data = 0x00;
+        send_mos_cmd(serial,MOS_WRITE,port->number - port->serial->minor, UART_IER, &data);
+
+        data = 0x00;
+        send_mos_cmd(serial, MOS_WRITE, port_number, UART_FCR, &data);
+
+        data = 0xcf;
+        send_mos_cmd(serial, MOS_WRITE, port_number, UART_FCR, &data);
+
+        /* Send the updated LCR value to the mos7720 */
+        data = mos7720_port->shadowLCR;
+        send_mos_cmd(serial, MOS_WRITE, port_number, UART_LCR, &data);
+
+        data = 0x00b;
+        mos7720_port->shadowMCR = data;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+        data = 0x00b;
+        send_mos_cmd(serial, MOS_WRITE, port_number, 0x04, &data);
+
+        /* set up the MCR register and send it to the mos7720 */
+        mos7720_port->shadowMCR = UART_MCR_OUT2;
+        if (cflag & CBAUD)
+                mos7720_port->shadowMCR |= (UART_MCR_DTR | UART_MCR_RTS);
+
+        if (cflag & CRTSCTS) {
+                mos7720_port->shadowMCR |= (UART_MCR_XONANY);
+
+                /* To set hardware flow control to the specified *
+                 * serial port, in SP1/2_CONTROL_REG             */
+                if (port->number) {
+                        data = 0x001;
+                        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT,
+                                     0x08, &data);
+                } else {
+                        data = 0x002;
+                        send_mos_cmd(serial, MOS_WRITE, MOS_MAX_PORT,
+                                     0x08, &data);
+                }
+        } else {
+                mos7720_port->shadowMCR &= ~(UART_MCR_XONANY);
+        }
+
+        data = mos7720_port->shadowMCR;
+        send_mos_cmd(serial, MOS_WRITE, port_number, UART_MCR, &data);
+
+        /* Determine divisor based on baud rate */
+        baud = tty_get_baud_rate(tty);
+        if (!baud) {
+                /* pick a default, any default... */
+                dbg("Picked default baud...");
+                baud = 9600;
+        }
+
+        if (baud >= 230400) {
+                set_higher_rates(mos7720_port, baud);
+                /* Enable Interrupts */
+                data = 0x0c;
+                send_mos_cmd(serial, MOS_WRITE, port_number, UART_IER, &data);
+                return;
+        }
+
+        dbg("%s - baud rate = %d", __FUNCTION__, baud);
+        status = send_cmd_write_baud_rate(mos7720_port, baud);
+
+        /* Enable Interrupts */
+        data = 0x0c;
+        send_mos_cmd(serial, MOS_WRITE, port_number, UART_IER, &data);
+
+        if (port->read_urb->status != -EINPROGRESS) {
+                port->read_urb->dev = serial->dev;
+
+                status = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+                if (status)
+                        dbg("usb_submit_urb(read bulk) failed, status = %d",
+                            status);
+        }
+        return;
+}
+
+/*
+ * mos7720_set_termios
+ *      this function is called by the tty driver when it wants to change the
+ *      termios structure.
+ */
+static void mos7720_set_termios(struct usb_serial_port *port,
+                                struct termios *old_termios)
+{
+        int status;
+        unsigned int cflag;
+        struct usb_serial *serial;
+        struct moschip_port *mos7720_port;
+        struct tty_struct *tty;
+
+        serial = port->serial;
+
+        mos7720_port = usb_get_serial_port_data(port);
+
+        if (mos7720_port == NULL)
+                return;
+
+        tty = port->tty;
+
+        if (!port->tty || !port->tty->termios) {
+                dbg("%s - no tty or termios", __FUNCTION__);
+                return;
+        }
+
+        if (!mos7720_port->open) {
+                dbg("%s - port not opened", __FUNCTION__);
+                return;
+        }
+
+        dbg("%s\n","setting termios - ASPIRE");
+
+        cflag = tty->termios->c_cflag;
+
+        if (!cflag) {
+                printk("%s %s\n",__FUNCTION__,"cflag is NULL");
+                return;
+        }
+
+        /* check that they really want us to change something */
+        if (old_termios) {
+                if ((cflag == old_termios->c_cflag) &&
+                    (RELEVANT_IFLAG(tty->termios->c_iflag) ==
+                     RELEVANT_IFLAG(old_termios->c_iflag))) {
+                        dbg("Nothing to change");
+                        return;
+                }
+        }
+
+        dbg("%s - clfag %08x iflag %08x", __FUNCTION__,
+            tty->termios->c_cflag,
+            RELEVANT_IFLAG(tty->termios->c_iflag));
+
+        if (old_termios)
+                dbg("%s - old clfag %08x old iflag %08x", __FUNCTION__,
+                    old_termios->c_cflag,
+                    RELEVANT_IFLAG(old_termios->c_iflag));
+
+        dbg("%s - port %d", __FUNCTION__, port->number);
+
+        /* change the port settings to the new ones specified */
+        change_port_settings(mos7720_port, old_termios);
+
+        if(!port->read_urb) {
+                dbg("%s","URB KILLED !!!!!\n");
+                return;
+        }
+
+        if(port->read_urb->status != -EINPROGRESS) {
+                port->read_urb->dev = serial->dev;
+                status = usb_submit_urb(port->read_urb, GFP_ATOMIC);
+                if (status)
+                        dbg("usb_submit_urb(read bulk) failed, status = %d",
+                            status);
+        }
+        return;
+}
+
+/*
+ * get_lsr_info - get line status register info
+ *
+ * Purpose: Let user call ioctl() to get info when the UART physically
+ *          is emptied.  On bus types like RS485, the transmitter must
+ *          release the bus after transmitting. This must be done when
+ *          the transmit shift register is empty, not be done when the
+ *          transmit holding register is empty.  This functionality
+ *          allows an RS485 driver to be written in user space.
+ */
+static int get_lsr_info(struct moschip_port *mos7720_port,
+                        unsigned int __user *value)
+{
+        int count;
+        unsigned int result = 0;
+
+        count = mos7720_chars_in_buffer(mos7720_port->port);
+        if (count == 0) {
+                dbg("%s -- Empty", __FUNCTION__);
+                result = TIOCSER_TEMT;
+        }
+
+        if (copy_to_user(value, &result, sizeof(int)))
+                return -EFAULT;
+        return 0;
+}
+
+/*
+ * get_number_bytes_avail - get number of bytes available
+ *
+ * Purpose: Let user call ioctl to get the count of number of bytes available.
+ */
+static int get_number_bytes_avail(struct moschip_port *mos7720_port,
+                                  unsigned int __user *value)
+{
+        unsigned int result = 0;
+        struct tty_struct *tty = mos7720_port->port->tty;
+
+        if (!tty)
+                return -ENOIOCTLCMD;
+
+        result = tty->read_cnt;
+
+        dbg("%s(%d) = %d", __FUNCTION__,  mos7720_port->port->number, result);
+        if (copy_to_user(value, &result, sizeof(int)))
+                return -EFAULT;
+
+        return -ENOIOCTLCMD;
+}
+
+static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
+                          unsigned int __user *value)
+{
+        unsigned int mcr ;
+        unsigned int arg;
+        unsigned char data;
+
+        struct usb_serial_port *port;
+
+        if (mos7720_port == NULL)
+                return -1;
+
+        port = (struct usb_serial_port*)mos7720_port->port;
+        mcr = mos7720_port->shadowMCR;
+
+        if (copy_from_user(&arg, value, sizeof(int)))
+                return -EFAULT;
+
+        switch (cmd) {
+        case TIOCMBIS:
+                if (arg & TIOCM_RTS)
+                        mcr |= UART_MCR_RTS;
+                if (arg & TIOCM_DTR)
+                        mcr |= UART_MCR_RTS;
+                if (arg & TIOCM_LOOP)
+                        mcr |= UART_MCR_LOOP;
+                break;
+
+        case TIOCMBIC:
+                if (arg & TIOCM_RTS)
+                        mcr &= ~UART_MCR_RTS;
+                if (arg & TIOCM_DTR)
+                        mcr &= ~UART_MCR_RTS;
+                if (arg & TIOCM_LOOP)
+                        mcr &= ~UART_MCR_LOOP;
+                break;
+
+        case TIOCMSET:
+                /* turn off the RTS and DTR and LOOPBACK
+                 * and then only turn on what was asked to */
+                mcr &=  ~(UART_MCR_RTS | UART_MCR_DTR | UART_MCR_LOOP);
+                mcr |= ((arg & TIOCM_RTS) ? UART_MCR_RTS : 0);
+                mcr |= ((arg & TIOCM_DTR) ? UART_MCR_DTR : 0);
+                mcr |= ((arg & TIOCM_LOOP) ? UART_MCR_LOOP : 0);
+                break;
+        }
+
+        mos7720_port->shadowMCR = mcr;
+
+        data = mos7720_port->shadowMCR;
+        send_mos_cmd(port->serial, MOS_WRITE,
+                     port->number - port->serial->minor, UART_MCR, &data);
+
+        return 0;
+}
+
+static int get_modem_info(struct moschip_port *mos7720_port,
+                          unsigned int __user *value)
+{
+        unsigned int result = 0;
+        unsigned int msr = mos7720_port->shadowMSR;
+        unsigned int mcr = mos7720_port->shadowMCR;
+
+        result = ((mcr & UART_MCR_DTR)  ? TIOCM_DTR: 0)   /* 0x002 */
+                  | ((mcr & UART_MCR_RTS)       ? TIOCM_RTS: 0)   /* 0x004 */
+                  | ((msr & UART_MSR_CTS)       ? TIOCM_CTS: 0)   /* 0x020 */
+                  | ((msr & UART_MSR_DCD)       ? TIOCM_CAR: 0)   /* 0x040 */
+                  | ((msr & UART_MSR_RI)        ? TIOCM_RI:  0)   /* 0x080 */
+                  | ((msr & UART_MSR_DSR)       ? TIOCM_DSR: 0);  /* 0x100 */
+
+
+        dbg("%s -- %x", __FUNCTION__, result);
+
+        if (copy_to_user(value, &result, sizeof(int)))
+                return -EFAULT;
+        return 0;
+}
+
+static int get_serial_info(struct moschip_port *mos7720_port,
+                           struct serial_struct __user *retinfo)
+{
+        struct serial_struct tmp;
+
+        if (!retinfo)
+                return -EFAULT;
+
+        memset(&tmp, 0, sizeof(tmp));
+
+        tmp.type                = PORT_16550A;
+        tmp.line                = mos7720_port->port->serial->minor;
+        tmp.port                = mos7720_port->port->number;
+        tmp.irq                 = 0;
+        tmp.flags               = ASYNC_SKIP_TEST | ASYNC_AUTO_IRQ;
+        tmp.xmit_fifo_size      = NUM_URBS * URB_TRANSFER_BUFFER_SIZE;
+        tmp.baud_base           = 9600;
+        tmp.close_delay         = 5*HZ;
+        tmp.closing_wait        = 30*HZ;
+
+        if (copy_to_user(retinfo, &tmp, sizeof(*retinfo)))
+                return -EFAULT;
+        return 0;
+}
+
+static int mos7720_ioctl(struct usb_serial_port *port, struct file *file,
+                         unsigned int cmd, unsigned long arg)
+{
+        struct moschip_port *mos7720_port;
+        struct async_icount cnow;
+        struct async_icount cprev;
+        struct serial_icounter_struct icount;
+
+        mos7720_port = usb_get_serial_port_data(port);
+        if (mos7720_port == NULL)
+                return -ENODEV;
+
+        dbg("%s - port %d, cmd = 0x%x", __FUNCTION__, port->number, cmd);
+
+        switch (cmd) {
+        case TIOCINQ:
+                /* return number of bytes available */
+                dbg("%s (%d) TIOCINQ", __FUNCTION__,  port->number);
+                return get_number_bytes_avail(mos7720_port,
+                                              (unsigned int __user *)arg);
+                break;
+
+        case TIOCSERGETLSR:
+                dbg("%s (%d) TIOCSERGETLSR", __FUNCTION__,  port->number);
+                return get_lsr_info(mos7720_port, (unsigned int __user *)arg);
+                return 0;
+
+        case TIOCMBIS:
+        case TIOCMBIC:
+        case TIOCMSET:
+                dbg("%s (%d) TIOCMSET/TIOCMBIC/TIOCMSET", __FUNCTION__,
+                    port->number);
+                return set_modem_info(mos7720_port, cmd,
+                                      (unsigned int __user *)arg);
+
+        case TIOCMGET:
+                dbg("%s (%d) TIOCMGET", __FUNCTION__,  port->number);
+                return get_modem_info(mos7720_port,
+                                      (unsigned int __user *)arg);
+
+        case TIOCGSERIAL:
+                dbg("%s (%d) TIOCGSERIAL", __FUNCTION__,  port->number);
+                return get_serial_info(mos7720_port,
+                                       (struct serial_struct __user *)arg);
+
+        case TIOCSSERIAL:
+                dbg("%s (%d) TIOCSSERIAL", __FUNCTION__,  port->number);
+                break;
+
+        case TIOCMIWAIT:
+                dbg("%s (%d) TIOCMIWAIT", __FUNCTION__,  port->number);
+                cprev = mos7720_port->icount;
+                while (1) {
+                        if (signal_pending(current))
+                                return -ERESTARTSYS;
+                        cnow = mos7720_port->icount;
+                        if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+                            cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+                                return -EIO; /* no change => error */
+                        if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+                            ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+                            ((arg & TIOCM_CD)  && (cnow.dcd != cprev.dcd)) ||
+                            ((arg & TIOCM_CTS) && (cnow.cts != cprev.cts)) ) {
+                                return 0;
+                        }
+                        cprev = cnow;
+                }
+                /* NOTREACHED */
+                break;
+
+        case TIOCGICOUNT:
+                cnow = mos7720_port->icount;
+                icount.cts = cnow.cts;
+                icount.dsr = cnow.dsr;
+                icount.rng = cnow.rng;
+                icount.dcd = cnow.dcd;
+                icount.rx = cnow.rx;
+                icount.tx = cnow.tx;
+                icount.frame = cnow.frame;
+                icount.overrun = cnow.overrun;
+                icount.parity = cnow.parity;
+                icount.brk = cnow.brk;
+                icount.buf_overrun = cnow.buf_overrun;
+
+                dbg("%s (%d) TIOCGICOUNT RX=%d, TX=%d", __FUNCTION__,
+                    port->number, icount.rx, icount.tx );
+                if (copy_to_user((void __user *)arg, &icount, sizeof(icount)))
+                        return -EFAULT;
+                return 0;
+        }
+
+        return -ENOIOCTLCMD;
+}
+
+static int mos7720_startup(struct usb_serial *serial)
+{
+        struct moschip_serial *mos7720_serial;
+        struct moschip_port *mos7720_port;
+        struct usb_device *dev;
+        int i;
+        char data;
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        if (!serial) {
+                dbg("Invalid Handler");
+                return -ENODEV;
+        }
+
+        dev = serial->dev;
+
+        /* create our private serial structure */
+        mos7720_serial = kzalloc(sizeof(struct moschip_serial), GFP_KERNEL);
+        if (mos7720_serial == NULL) {
+                err("%s - Out of memory", __FUNCTION__);
+                return -ENOMEM;
+        }
+
+        usb_set_serial_data(serial, mos7720_serial);
+
+        /* we set up the pointers to the endpoints in the mos7720_open *
+         * function, as the structures aren't created yet.             */
+
+        /* set up port private structures */
+        for (i = 0; i < serial->num_ports; ++i) {
+                mos7720_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL);
+                if (mos7720_port == NULL) {
+                        err("%s - Out of memory", __FUNCTION__);
+                        usb_set_serial_data(serial, NULL);
+                        kfree(mos7720_serial);
+                        return -ENOMEM;
+                }
+
+                /* Initialize all port interrupt end point to port 0 int
+                 * endpoint.  Our device has only one interrupt endpoint
+                 * comman to all ports */
+                serial->port[i]->interrupt_in_endpointAddress = serial->port[0]->interrupt_in_endpointAddress;
+
+                mos7720_port->port = serial->port[i];
+                usb_set_serial_port_data(serial->port[i], mos7720_port);
+
+                dbg("port number is %d", serial->port[i]->number);
+                dbg("serial number is %d", serial->minor);
+        }
+
+
+        /* setting configuration feature to one */
+        usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
+                        (__u8)0x03, 0x00,0x01,0x00, NULL, 0x00, 5*HZ);
+
+        send_mos_cmd(serial,MOS_READ,0x00, UART_LSR, &data);  // LSR For Port 1
+        dbg("LSR:%x",data);
+
+        send_mos_cmd(serial,MOS_READ,0x01, UART_LSR, &data);  // LSR For Port 2
+        dbg("LSR:%x",data);
+
+        return 0;
+}
+
+static void mos7720_shutdown(struct usb_serial *serial)
+{
+        int i;
+
+        /* free private structure allocated for serial port */
+        for (i=0; i < serial->num_ports; ++i) {
+                kfree(usb_get_serial_port_data(serial->port[i]));
+                usb_set_serial_port_data(serial->port[i], NULL);
+        }
+
+        /* free private structure allocated for serial device */
+        kfree(usb_get_serial_data(serial));
+        usb_set_serial_data(serial, NULL);
+}
+
+static struct usb_serial_driver moschip7720_2port_driver = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         "moschip7720",
+        },
+        .description            = "Moschip 2 port adapter",
+        .id_table               = moschip_port_id_table,
+        .num_interrupt_in       = 1,
+        .num_bulk_in            = 2,
+        .num_bulk_out           = 2,
+        .num_ports              = 2,
+        .open                   = mos7720_open,
+        .close                  = mos7720_close,
+        .throttle               = mos7720_throttle,
+        .unthrottle             = mos7720_unthrottle,
+        .attach                 = mos7720_startup,
+        .shutdown               = mos7720_shutdown,
+        .ioctl                  = mos7720_ioctl,
+        .set_termios            = mos7720_set_termios,
+        .write                  = mos7720_write,
+        .write_room             = mos7720_write_room,
+        .chars_in_buffer        = mos7720_chars_in_buffer,
+        .break_ctl              = mos7720_break,
+        .read_bulk_callback     = mos7720_bulk_in_callback,
+};
+
+static struct usb_driver usb_driver = {
+        .name =         "moschip7720",
+        .probe =        usb_serial_probe,
+        .disconnect =   usb_serial_disconnect,
+        .id_table =     moschip_port_id_table,
+};
+
+static int __init moschip7720_init(void)
+{
+        int retval;
+
+        dbg("%s: Entering ..........", __FUNCTION__);
+
+        /* Register with the usb serial */
+        retval = usb_serial_register(&moschip7720_2port_driver);
+        if (retval)
+                goto failed_port_device_register;
+
+        info(DRIVER_DESC " " DRIVER_VERSION);
+
+        /* Register with the usb */
+        retval = usb_register(&usb_driver);
+        if (retval)
+                goto failed_usb_register;
+
+        return 0;
+
+failed_usb_register:
+        usb_serial_deregister(&moschip7720_2port_driver);
+
+failed_port_device_register:
+        return retval;
+}
+
+static void __exit moschip7720_exit(void)
+{
+        usb_deregister(&usb_driver);
+        usb_serial_deregister(&moschip7720_2port_driver);
+}
+
+module_init(moschip7720_init);
+module_exit(moschip7720_exit);
+
+/* Module information */
+MODULE_AUTHOR( DRIVER_AUTHOR );
+MODULE_DESCRIPTION( DRIVER_DESC );
+MODULE_LICENSE("GPL");
+
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 021be39fe16e..5b71962d0351 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2413,11 +2413,12 @@ static int mos7840_ioctl(struct usb_serial_port *port, struct file *file,
         }
 
         mos7840_port = mos7840_get_port_private(port);
-        tty = mos7840_port->port->tty;
 
         if (mos7840_port == NULL)
                 return -1;
 
+        tty = mos7840_port->port->tty;
+
         dbg("%s - port %d, cmd = 0x%x", __FUNCTION__, port->number, cmd);
 
         switch (cmd) {
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index d29638daa987..4b5097fa48d7 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -1,75 +1,713 @@
 /*
- * Sierra Wireless CDMA Wireless Serial USB driver
- *
- * Current Copy modified by: Kevin Lloyd <linux@sierrawireless.com>
- * Original Copyright (C) 2005-2006 Greg Kroah-Hartman <gregkh@suse.de>
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License version
- *      2 as published by the Free Software Foundation.
- */
+  USB Driver for Sierra Wireless
+
+  Copyright (C) 2006  Kevin Lloyd <linux@sierrawireless.com>
+
+  IMPORTANT DISCLAIMER: This driver is not commercially supported by
+  Sierra Wireless. Use at your own risk.
+
+  This driver is free software; you can redistribute it and/or modify
+  it under the terms of Version 2 of the GNU General Public License as
+  published by the Free Software Foundation.
+
+  Portions based on the option driver by Matthias Urlichs <smurf@smurf.noris.de>
+  Whom based his on the Keyspan driver by Hugh Blemings <hugh@blemings.org>
+
+  History:
+*/
+
+#define DRIVER_VERSION "v.1.0.5"
+#define DRIVER_AUTHOR "Kevin Lloyd <linux@sierrawireless.com>"
+#define DRIVER_DESC "USB Driver for Sierra Wireless USB modems"
 
 #include <linux/kernel.h>
-#include <linux/init.h>
+#include <linux/jiffies.h>
+#include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/module.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
 
+
 static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
         { USB_DEVICE(0x1199, 0x0020) }, /* Sierra Wireless MC5725 */
         { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
         { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
+        { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
         { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
         { USB_DEVICE(0x1199, 0x6803) }, /* Sierra Wireless MC8765 */
+        { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 for Europe */
         { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 */
         { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
-        /* Following devices are supported in the airprime.c driver */
-        /* { USB_DEVICE(0x1199, 0x0112) }, */   /* Sierra Wireless AirCard 580 */
-        /* { USB_DEVICE(0x0F3D, 0x0112) }, */   /* AirPrime/Sierra PC 5220 */
+
+        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
+        { USB_DEVICE(0x0F3D, 0x0112) }, /* AirPrime/Sierra PC 5220 */
         { }
 };
 MODULE_DEVICE_TABLE(usb, id_table);
 
+static struct usb_device_id id_table_1port [] = {
+        { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless AirCard 580 */
+        { USB_DEVICE(0x0F3D, 0x0112) }, /* AirPrime/Sierra PC 5220 */
+        { }
+};
+
+static struct usb_device_id id_table_3port [] = {
+        { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
+        { USB_DEVICE(0x1199, 0x0020) }, /* Sierra Wireless MC5725 */
+        { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
+        { USB_DEVICE(0x1199, 0x0019) }, /* Sierra Wireless AirCard 595 */
+        { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
+        { USB_DEVICE(0x1199, 0x6802) }, /* Sierra Wireless MC8755 */
+        { USB_DEVICE(0x1199, 0x6803) }, /* Sierra Wireless MC8765 */
+        { USB_DEVICE(0x1199, 0x6804) }, /* Sierra Wireless MC8755 for Europe */
+        { USB_DEVICE(0x1199, 0x6812) }, /* Sierra Wireless MC8775 */
+        { USB_DEVICE(0x1199, 0x6820) }, /* Sierra Wireless AirCard 875 */
+        { }
+};
+
 static struct usb_driver sierra_driver = {
-        .name =         "sierra_wireless",
-        .probe =        usb_serial_probe,
-        .disconnect =   usb_serial_disconnect,
-        .id_table =     id_table,
+        .name       = "sierra",
+        .probe      = usb_serial_probe,
+        .disconnect = usb_serial_disconnect,
+        .id_table   = id_table,
+        .no_dynamic_id =        1,
+};
+
+
+static int debug;
+
+/* per port private data */
+#define N_IN_URB        4
+#define N_OUT_URB       1
+#define IN_BUFLEN       4096
+#define OUT_BUFLEN      128
+
+struct sierra_port_private {
+        /* Input endpoints and buffer for this port */
+        struct urb *in_urbs[N_IN_URB];
+        char in_buffer[N_IN_URB][IN_BUFLEN];
+        /* Output endpoints and buffer for this port */
+        struct urb *out_urbs[N_OUT_URB];
+        char out_buffer[N_OUT_URB][OUT_BUFLEN];
+
+        /* Settings for the port */
+        int rts_state;  /* Handshaking pins (outputs) */
+        int dtr_state;
+        int cts_state;  /* Handshaking pins (inputs) */
+        int dsr_state;
+        int dcd_state;
+        int ri_state;
+
+        unsigned long tx_start_time[N_OUT_URB];
+};
+
+static int sierra_send_setup(struct usb_serial_port *port)
+{
+        struct usb_serial *serial = port->serial;
+        struct sierra_port_private *portdata;
+
+        dbg("%s", __FUNCTION__);
+
+        portdata = usb_get_serial_port_data(port);
+
+        if (port->tty) {
+                int val = 0;
+                if (portdata->dtr_state)
+                        val |= 0x01;
+                if (portdata->rts_state)
+                        val |= 0x02;
+
+                return usb_control_msg(serial->dev,
+                                usb_rcvctrlpipe(serial->dev, 0),
+                                0x22,0x21,val,0,NULL,0,USB_CTRL_SET_TIMEOUT);
+        }
+
+        return 0;
+}
+
+static void sierra_rx_throttle(struct usb_serial_port *port)
+{
+        dbg("%s", __FUNCTION__);
+}
+
+static void sierra_rx_unthrottle(struct usb_serial_port *port)
+{
+        dbg("%s", __FUNCTION__);
+}
+
+static void sierra_break_ctl(struct usb_serial_port *port, int break_state)
+{
+        /* Unfortunately, I don't know how to send a break */
+        dbg("%s", __FUNCTION__);
+}
+
+static void sierra_set_termios(struct usb_serial_port *port,
+                        struct termios *old_termios)
+{
+        dbg("%s", __FUNCTION__);
+
+        sierra_send_setup(port);
+}
+
+static int sierra_tiocmget(struct usb_serial_port *port, struct file *file)
+{
+        unsigned int value;
+        struct sierra_port_private *portdata;
+
+        portdata = usb_get_serial_port_data(port);
+
+        value = ((portdata->rts_state) ? TIOCM_RTS : 0) |
+                ((portdata->dtr_state) ? TIOCM_DTR : 0) |
+                ((portdata->cts_state) ? TIOCM_CTS : 0) |
+                ((portdata->dsr_state) ? TIOCM_DSR : 0) |
+                ((portdata->dcd_state) ? TIOCM_CAR : 0) |
+                ((portdata->ri_state) ? TIOCM_RNG : 0);
+
+        return value;
+}
+
+static int sierra_tiocmset(struct usb_serial_port *port, struct file *file,
+                        unsigned int set, unsigned int clear)
+{
+        struct sierra_port_private *portdata;
+
+        portdata = usb_get_serial_port_data(port);
+
+        if (set & TIOCM_RTS)
+                portdata->rts_state = 1;
+        if (set & TIOCM_DTR)
+                portdata->dtr_state = 1;
+
+        if (clear & TIOCM_RTS)
+                portdata->rts_state = 0;
+        if (clear & TIOCM_DTR)
+                portdata->dtr_state = 0;
+        return sierra_send_setup(port);
+}
+
+static int sierra_ioctl(struct usb_serial_port *port, struct file *file,
+                        unsigned int cmd, unsigned long arg)
+{
+        return -ENOIOCTLCMD;
+}
+
+/* Write */
+static int sierra_write(struct usb_serial_port *port,
+                        const unsigned char *buf, int count)
+{
+        struct sierra_port_private *portdata;
+        int i;
+        int left, todo;
+        struct urb *this_urb = NULL; /* spurious */
+        int err;
+
+        portdata = usb_get_serial_port_data(port);
+
+        dbg("%s: write (%d chars)", __FUNCTION__, count);
+
+        i = 0;
+        left = count;
+        for (i=0; left > 0 && i < N_OUT_URB; i++) {
+                todo = left;
+                if (todo > OUT_BUFLEN)
+                        todo = OUT_BUFLEN;
+
+                this_urb = portdata->out_urbs[i];
+                if (this_urb->status == -EINPROGRESS) {
+                        if (time_before(jiffies,
+                                        portdata->tx_start_time[i] + 10 * HZ))
+                                continue;
+                        usb_unlink_urb(this_urb);
+                        continue;
+                }
+                if (this_urb->status != 0)
+                        dbg("usb_write %p failed (err=%d)",
+                                this_urb, this_urb->status);
+
+                dbg("%s: endpoint %d buf %d", __FUNCTION__,
+                        usb_pipeendpoint(this_urb->pipe), i);
+
+                /* send the data */
+                memcpy (this_urb->transfer_buffer, buf, todo);
+                this_urb->transfer_buffer_length = todo;
+
+                this_urb->dev = port->serial->dev;
+                err = usb_submit_urb(this_urb, GFP_ATOMIC);
+                if (err) {
+                        dbg("usb_submit_urb %p (write bulk) failed "
+                                "(%d, has %d)", this_urb,
+                                err, this_urb->status);
+                        continue;
+                }
+                portdata->tx_start_time[i] = jiffies;
+                buf += todo;
+                left -= todo;
+        }
+
+        count -= left;
+        dbg("%s: wrote (did %d)", __FUNCTION__, count);
+        return count;
+}
+
+static void sierra_indat_callback(struct urb *urb)
+{
+        int err;
+        int endpoint;
+        struct usb_serial_port *port;
+        struct tty_struct *tty;
+        unsigned char *data = urb->transfer_buffer;
+
+        dbg("%s: %p", __FUNCTION__, urb);
+
+        endpoint = usb_pipeendpoint(urb->pipe);
+        port = (struct usb_serial_port *) urb->context;
+
+        if (urb->status) {
+                dbg("%s: nonzero status: %d on endpoint %02x.",
+                    __FUNCTION__, urb->status, endpoint);
+        } else {
+                tty = port->tty;
+                if (urb->actual_length) {
+                        tty_buffer_request_room(tty, urb->actual_length);
+                        tty_insert_flip_string(tty, data, urb->actual_length);
+                        tty_flip_buffer_push(tty);
+                } else {
+                        dbg("%s: empty read urb received", __FUNCTION__);
+                }
+
+                /* Resubmit urb so we continue receiving */
+                if (port->open_count && urb->status != -ESHUTDOWN) {
+                        err = usb_submit_urb(urb, GFP_ATOMIC);
+                        if (err)
+                                printk(KERN_ERR "%s: resubmit read urb failed. "
+                                        "(%d)", __FUNCTION__, err);
+                }
+        }
+        return;
+}
+
+static void sierra_outdat_callback(struct urb *urb)
+{
+        struct usb_serial_port *port;
+
+        dbg("%s", __FUNCTION__);
+
+        port = (struct usb_serial_port *) urb->context;
+
+        usb_serial_port_softint(port);
+}
+
+static void sierra_instat_callback(struct urb *urb)
+{
+        int err;
+        struct usb_serial_port *port = (struct usb_serial_port *) urb->context;
+        struct sierra_port_private *portdata = usb_get_serial_port_data(port);
+        struct usb_serial *serial = port->serial;
+
+        dbg("%s", __FUNCTION__);
+        dbg("%s: urb %p port %p has data %p", __FUNCTION__,urb,port,portdata);
+
+        if (urb->status == 0) {
+                struct usb_ctrlrequest *req_pkt =
+                                (struct usb_ctrlrequest *)urb->transfer_buffer;
+
+                if (!req_pkt) {
+                        dbg("%s: NULL req_pkt\n", __FUNCTION__);
+                        return;
+                }
+                if ((req_pkt->bRequestType == 0xA1) &&
+                                (req_pkt->bRequest == 0x20)) {
+                        int old_dcd_state;
+                        unsigned char signals = *((unsigned char *)
+                                        urb->transfer_buffer +
+                                        sizeof(struct usb_ctrlrequest));
+
+                        dbg("%s: signal x%x", __FUNCTION__, signals);
+
+                        old_dcd_state = portdata->dcd_state;
+                        portdata->cts_state = 1;
+                        portdata->dcd_state = ((signals & 0x01) ? 1 : 0);
+                        portdata->dsr_state = ((signals & 0x02) ? 1 : 0);
+                        portdata->ri_state = ((signals & 0x08) ? 1 : 0);
+
+                        if (port->tty && !C_CLOCAL(port->tty) &&
+                                        old_dcd_state && !portdata->dcd_state)
+                                tty_hangup(port->tty);
+                } else {
+                        dbg("%s: type %x req %x", __FUNCTION__,
+                                req_pkt->bRequestType,req_pkt->bRequest);
+                }
+        } else
+                dbg("%s: error %d", __FUNCTION__, urb->status);
+
+        /* Resubmit urb so we continue receiving IRQ data */
+        if (urb->status != -ESHUTDOWN) {
+                urb->dev = serial->dev;
+                err = usb_submit_urb(urb, GFP_ATOMIC);
+                if (err)
+                        dbg("%s: resubmit intr urb failed. (%d)",
+                                __FUNCTION__, err);
+        }
+}
+
+static int sierra_write_room(struct usb_serial_port *port)
+{
+        struct sierra_port_private *portdata;
+        int i;
+        int data_len = 0;
+        struct urb *this_urb;
+
+        portdata = usb_get_serial_port_data(port);
+
+        for (i=0; i < N_OUT_URB; i++) {
+                this_urb = portdata->out_urbs[i];
+                if (this_urb && this_urb->status != -EINPROGRESS)
+                        data_len += OUT_BUFLEN;
+        }
+
+        dbg("%s: %d", __FUNCTION__, data_len);
+        return data_len;
+}
+
+static int sierra_chars_in_buffer(struct usb_serial_port *port)
+{
+        struct sierra_port_private *portdata;
+        int i;
+        int data_len = 0;
+        struct urb *this_urb;
+
+        portdata = usb_get_serial_port_data(port);
+
+        for (i=0; i < N_OUT_URB; i++) {
+                this_urb = portdata->out_urbs[i];
+                if (this_urb && this_urb->status == -EINPROGRESS)
+                        data_len += this_urb->transfer_buffer_length;
+        }
+        dbg("%s: %d", __FUNCTION__, data_len);
+        return data_len;
+}
+
+static int sierra_open(struct usb_serial_port *port, struct file *filp)
+{
+        struct sierra_port_private *portdata;
+        struct usb_serial *serial = port->serial;
+        int i, err;
+        struct urb *urb;
+
+        portdata = usb_get_serial_port_data(port);
+
+        dbg("%s", __FUNCTION__);
+
+        /* Set some sane defaults */
+        portdata->rts_state = 1;
+        portdata->dtr_state = 1;
+
+        /* Reset low level data toggle and start reading from endpoints */
+        for (i = 0; i < N_IN_URB; i++) {
+                urb = portdata->in_urbs[i];
+                if (! urb)
+                        continue;
+                if (urb->dev != serial->dev) {
+                        dbg("%s: dev %p != %p", __FUNCTION__,
+                                urb->dev, serial->dev);
+                        continue;
+                }
+
+                /*
+                 * make sure endpoint data toggle is synchronized with the
+                 * device
+                 */
+                usb_clear_halt(urb->dev, urb->pipe);
+
+                err = usb_submit_urb(urb, GFP_KERNEL);
+                if (err) {
+                        dbg("%s: submit urb %d failed (%d) %d",
+                                __FUNCTION__, i, err,
+                                urb->transfer_buffer_length);
+                }
+        }
+
+        /* Reset low level data toggle on out endpoints */
+        for (i = 0; i < N_OUT_URB; i++) {
+                urb = portdata->out_urbs[i];
+                if (! urb)
+                        continue;
+                urb->dev = serial->dev;
+                /* usb_settoggle(urb->dev, usb_pipeendpoint(urb->pipe),
+                                usb_pipeout(urb->pipe), 0); */
+        }
+
+        port->tty->low_latency = 1;
+
+        sierra_send_setup(port);
+
+        return (0);
+}
+
+static inline void stop_urb(struct urb *urb)
+{
+        if (urb && urb->status == -EINPROGRESS)
+                usb_kill_urb(urb);
+}
+
+static void sierra_close(struct usb_serial_port *port, struct file *filp)
+{
+        int i;
+        struct usb_serial *serial = port->serial;
+        struct sierra_port_private *portdata;
+
+        dbg("%s", __FUNCTION__);
+        portdata = usb_get_serial_port_data(port);
+
+        portdata->rts_state = 0;
+        portdata->dtr_state = 0;
+
+        if (serial->dev) {
+                sierra_send_setup(port);
+
+                /* Stop reading/writing urbs */
+                for (i = 0; i < N_IN_URB; i++)
+                        stop_urb(portdata->in_urbs[i]);
+                for (i = 0; i < N_OUT_URB; i++)
+                        stop_urb(portdata->out_urbs[i]);
+        }
+        port->tty = NULL;
+}
+
+/* Helper functions used by sierra_setup_urbs */
+static struct urb *sierra_setup_urb(struct usb_serial *serial, int endpoint,
+                                    int dir, void *ctx, char *buf, int len,
+                                    usb_complete_t callback)
+{
+        struct urb *urb;
+
+        if (endpoint == -1)
+                return NULL;            /* endpoint not needed */
+
+        urb = usb_alloc_urb(0, GFP_KERNEL);             /* No ISO */
+        if (urb == NULL) {
+                dbg("%s: alloc for endpoint %d failed.", __FUNCTION__, endpoint);
+                return NULL;
+        }
+
+                /* Fill URB using supplied data. */
+        usb_fill_bulk_urb(urb, serial->dev,
+                      usb_sndbulkpipe(serial->dev, endpoint) | dir,
+                      buf, len, callback, ctx);
+
+        return urb;
+}
+
+/* Setup urbs */
+static void sierra_setup_urbs(struct usb_serial *serial)
+{
+        int i,j;
+        struct usb_serial_port *port;
+        struct sierra_port_private *portdata;
+
+        dbg("%s", __FUNCTION__);
+
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
+
+        /* Do indat endpoints first */
+                for (j = 0; j < N_IN_URB; ++j) {
+                        portdata->in_urbs[j] = sierra_setup_urb (serial,
+                        port->bulk_in_endpointAddress, USB_DIR_IN, port,
+                        portdata->in_buffer[j], IN_BUFLEN, sierra_indat_callback);
+                }
+
+                /* outdat endpoints */
+                for (j = 0; j < N_OUT_URB; ++j) {
+                        portdata->out_urbs[j] = sierra_setup_urb (serial,
+                        port->bulk_out_endpointAddress, USB_DIR_OUT, port,
+                        portdata->out_buffer[j], OUT_BUFLEN, sierra_outdat_callback);
+                }
+        }
+}
+
+static int sierra_startup(struct usb_serial *serial)
+{
+        int i, err;
+        struct usb_serial_port *port;
+        struct sierra_port_private *portdata;
+
+        dbg("%s", __FUNCTION__);
+
+        /* Now setup per port private data */
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
+                if (!portdata) {
+                        dbg("%s: kmalloc for sierra_port_private (%d) failed!.",
+                                        __FUNCTION__, i);
+                        return (1);
+                }
+
+                usb_set_serial_port_data(port, portdata);
+
+                if (! port->interrupt_in_urb)
+                        continue;
+                err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
+                if (err)
+                        dbg("%s: submit irq_in urb failed %d",
+                                __FUNCTION__, err);
+        }
+
+        sierra_setup_urbs(serial);
+
+        return (0);
+}
+
+static void sierra_shutdown(struct usb_serial *serial)
+{
+        int i, j;
+        struct usb_serial_port *port;
+        struct sierra_port_private *portdata;
+
+        dbg("%s", __FUNCTION__);
+
+        /* Stop reading/writing urbs */
+        for (i = 0; i < serial->num_ports; ++i) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
+                for (j = 0; j < N_IN_URB; j++)
+                        stop_urb(portdata->in_urbs[j]);
+                for (j = 0; j < N_OUT_URB; j++)
+                        stop_urb(portdata->out_urbs[j]);
+        }
+
+        /* Now free them */
+        for (i = 0; i < serial->num_ports; ++i) {
+                port = serial->port[i];
+                portdata = usb_get_serial_port_data(port);
+
+                for (j = 0; j < N_IN_URB; j++) {
+                        if (portdata->in_urbs[j]) {
+                                usb_free_urb(portdata->in_urbs[j]);
+                                portdata->in_urbs[j] = NULL;
+                        }
+                }
+                for (j = 0; j < N_OUT_URB; j++) {
+                        if (portdata->out_urbs[j]) {
+                                usb_free_urb(portdata->out_urbs[j]);
+                                portdata->out_urbs[j] = NULL;
+                        }
+                }
+        }
+
+        /* Now free per port private data */
+        for (i = 0; i < serial->num_ports; i++) {
+                port = serial->port[i];
+                kfree(usb_get_serial_port_data(port));
+        }
+}
+
+static struct usb_serial_driver sierra_1port_device = {
+        .driver = {
+                .owner =        THIS_MODULE,
+                .name =         "sierra1",
+        },
+        .description       = "Sierra USB modem (1 port)",
+        .id_table          = id_table_1port,
+        .num_interrupt_in  = NUM_DONT_CARE,
+        .num_bulk_in       = 1,
+        .num_bulk_out      = 1,
+        .num_ports         = 1,
+        .open              = sierra_open,
+        .close             = sierra_close,
+        .write             = sierra_write,
+        .write_room        = sierra_write_room,
+        .chars_in_buffer   = sierra_chars_in_buffer,
+        .throttle          = sierra_rx_throttle,
+        .unthrottle        = sierra_rx_unthrottle,
+        .ioctl             = sierra_ioctl,
+        .set_termios       = sierra_set_termios,
+        .break_ctl         = sierra_break_ctl,
+        .tiocmget          = sierra_tiocmget,
+        .tiocmset          = sierra_tiocmset,
+        .attach            = sierra_startup,
+        .shutdown          = sierra_shutdown,
+        .read_int_callback = sierra_instat_callback,
 };
 
-static struct usb_serial_driver sierra_device = {
+static struct usb_serial_driver sierra_3port_device = {
         .driver = {
-        .owner =                THIS_MODULE,
-        .name =                 "Sierra_Wireless",
+                .owner =        THIS_MODULE,
+                .name =         "sierra3",
         },
-        .id_table =             id_table,
-        .num_interrupt_in =     NUM_DONT_CARE,
-        .num_bulk_in =          NUM_DONT_CARE,
-        .num_bulk_out =         NUM_DONT_CARE,
-        .num_ports =            3,
+        .description       = "Sierra USB modem (3 port)",
+        .id_table          = id_table_3port,
+        .num_interrupt_in  = NUM_DONT_CARE,
+        .num_bulk_in       = 3,
+        .num_bulk_out      = 3,
+        .num_ports         = 3,
+        .open              = sierra_open,
+        .close             = sierra_close,
+        .write             = sierra_write,
+        .write_room        = sierra_write_room,
+        .chars_in_buffer   = sierra_chars_in_buffer,
+        .throttle          = sierra_rx_throttle,
+        .unthrottle        = sierra_rx_unthrottle,
+        .ioctl             = sierra_ioctl,
+        .set_termios       = sierra_set_termios,
+        .break_ctl         = sierra_break_ctl,
+        .tiocmget          = sierra_tiocmget,
+        .tiocmset          = sierra_tiocmset,
+        .attach            = sierra_startup,
+        .shutdown          = sierra_shutdown,
+        .read_int_callback = sierra_instat_callback,
 };
 
+/* Functions used by new usb-serial code. */
 static int __init sierra_init(void)
 {
         int retval;
-
-        retval = usb_serial_register(&sierra_device);
+        retval = usb_serial_register(&sierra_1port_device);
+        if (retval)
+                goto failed_1port_device_register;
+        retval = usb_serial_register(&sierra_3port_device);
         if (retval)
-                return retval;
+                goto failed_3port_device_register;
+
+
         retval = usb_register(&sierra_driver);
         if (retval)
-                usb_serial_deregister(&sierra_device);
+                goto failed_driver_register;
+
+        info(DRIVER_DESC ": " DRIVER_VERSION);
+
+        return 0;
+
+failed_driver_register:
+        usb_serial_deregister(&sierra_3port_device);
+failed_3port_device_register:
+        usb_serial_deregister(&sierra_1port_device);
+failed_1port_device_register:
         return retval;
 }
 
 static void __exit sierra_exit(void)
 {
-        usb_deregister(&sierra_driver);
-        usb_serial_deregister(&sierra_device);
+        usb_deregister (&sierra_driver);
+        usb_serial_deregister(&sierra_1port_device);
+        usb_serial_deregister(&sierra_3port_device);
 }
 
 module_init(sierra_init);
 module_exit(sierra_exit);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
 MODULE_LICENSE("GPL");
+
+#ifdef CONFIG_USB_DEBUG
+module_param(debug, bool, S_IRUGO | S_IWUSR);
+MODULE_PARM_DESC(debug, "Debug messages");
+#endif
+
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c9a8d50106d1..efb047f431e8 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -55,7 +55,8 @@ UNUSUAL_DEV(  0x03eb, 0x2002, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE),
 
-UNUSUAL_DEV(  0x03ee, 0x6901, 0x0000, 0x0100,
+/* modified by Tobias Lorenz <tobias.lorenz@gmx.net> */
+UNUSUAL_DEV(  0x03ee, 0x6901, 0x0000, 0x0200,
                 "Mitsumi",
                 "USB FDD",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
@@ -182,6 +183,20 @@ UNUSUAL_DEV(  0x0421, 0x044e, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE | US_FL_FIX_CAPACITY ),
 
+/* Reported by Bardur Arantsson <bardur@scientician.net> */
+UNUSUAL_DEV(  0x0421, 0x047c, 0x0370, 0x0370,
+                "Nokia",
+                "6131",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 ),
+
+/* Reported by Alex Corcoles <alex@corcoles.net> */
+UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+                "Nokia",
+                "6234",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_MAX_SECTORS_64 ),
+
 /* Reported by Olaf Hering <olh@suse.de> from novell bug #105878 */
 UNUSUAL_DEV(  0x0424, 0x0fdc, 0x0210, 0x0210,
                 "SMSC",
@@ -1221,7 +1236,7 @@ UNUSUAL_DEV( 0x0e21, 0x0520, 0x0100, 0x0100,
                 "Cowon Systems",
                 "iAUDIO M5",
                 US_SC_DEVICE, US_PR_BULK, NULL,
-                0 ),
+                US_FL_NEED_OVERRIDE ),
 
 /* Submitted by Antoine Mairesse <antoine.mairesse@free.fr> */
 UNUSUAL_DEV( 0x0ed1, 0x6660, 0x0100, 0x0300,
@@ -1294,8 +1309,10 @@ UNUSUAL_DEV(  0x0fce, 0xe030, 0x0000, 0x0000,
 /* Reported by Kevin Cernekee <kpc-usbdev@gelato.uiuc.edu>
  * Tested on hardware version 1.10.
  * Entry is needed only for the initializer function override.
+ * Devices with bcd > 110 seem to not need it while those
+ * with bcd < 110 appear to need it.
  */
-UNUSUAL_DEV(  0x1019, 0x0c55, 0x0110, 0x0110,
+UNUSUAL_DEV(  0x1019, 0x0c55, 0x0000, 0x0110,
                 "Desknote",
                 "UCR-61S2B",
                 US_SC_DEVICE, US_PR_DEVICE, usb_stor_ucr61s2b_init,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index daaa486159cf..7a43020fa583 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -701,7 +701,6 @@ config FB_NVIDIA
         depends on FB && PCI
         select I2C_ALGOBIT if FB_NVIDIA_I2C
         select I2C if FB_NVIDIA_I2C
-        select FB_DDC if FB_NVIDIA_I2C
         select FB_MODE_HELPERS
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index b77b30923928..e815b354c09d 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -406,7 +406,7 @@ static struct {
         { PCI_CHIP_MACH64LB, "3D RAGE LT PRO (Mach64 LB, AGP)", 236, 75, 100, 135, ATI_CHIP_264LTPRO },
         { PCI_CHIP_MACH64LD, "3D RAGE LT PRO (Mach64 LD, AGP)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
         { PCI_CHIP_MACH64LI, "3D RAGE LT PRO (Mach64 LI, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1_1 | M64F_G3_PB_1024x768 },
-        { PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
+        { PCI_CHIP_MACH64LP, "3D RAGE LT PRO (Mach64 LP, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO | M64F_G3_PB_1024x768 },
         { PCI_CHIP_MACH64LQ, "3D RAGE LT PRO (Mach64 LQ, PCI)", 230, 100, 100, 135, ATI_CHIP_264LTPRO },
 
         { PCI_CHIP_MACH64GM, "3D RAGE XL (Mach64 GM, AGP 2x)", 230, 83, 63, 135, ATI_CHIP_264XL },
diff --git a/drivers/video/aty/radeon_i2c.c b/drivers/video/aty/radeon_i2c.c
index 676754520099..869725a13c21 100644
--- a/drivers/video/aty/radeon_i2c.c
+++ b/drivers/video/aty/radeon_i2c.c
@@ -139,7 +139,13 @@ void radeon_delete_i2c_busses(struct radeonfb_info *rinfo)
 int radeon_probe_i2c_connector(struct radeonfb_info *rinfo, int conn,
                                u8 **out_edid)
 {
-        u8 *edid = fb_ddc_read(&rinfo->i2c[conn-1].adapter);
+        u32 reg = rinfo->i2c[conn-1].ddc_reg;
+        u8 *edid;
+
+        OUTREG(reg, INREG(reg) &
+                        ~(VGA_DDC_DATA_OUTPUT | VGA_DDC_CLK_OUTPUT));
+
+        edid = fb_ddc_read(&rinfo->i2c[conn-1].adapter);
 
         if (out_edid)
                 *out_edid = edid;
diff --git a/drivers/video/backlight/corgi_bl.c b/drivers/video/backlight/corgi_bl.c
index 2ebbfd95145f..d07ecb53c68b 100644
--- a/drivers/video/backlight/corgi_bl.c
+++ b/drivers/video/backlight/corgi_bl.c
@@ -111,7 +111,7 @@ static struct backlight_properties corgibl_data = {
         .update_status  = corgibl_set_intensity,
 };
 
-static int __init corgibl_probe(struct platform_device *pdev)
+static int corgibl_probe(struct platform_device *pdev)
 {
         struct corgibl_machinfo *machinfo = pdev->dev.platform_data;
 
@@ -166,4 +166,4 @@ module_exit(corgibl_exit);
 
 MODULE_AUTHOR("Richard Purdie <rpurdie@rpsys.net>");
 MODULE_DESCRIPTION("Corgi Backlight Driver");
-MODULE_LICENSE("GPLv2");
+MODULE_LICENSE("GPL");
diff --git a/drivers/video/backlight/hp680_bl.c b/drivers/video/backlight/hp680_bl.c
index fe1488374f62..e3993213d10e 100644
--- a/drivers/video/backlight/hp680_bl.c
+++ b/drivers/video/backlight/hp680_bl.c
@@ -19,7 +19,7 @@
 #include <linux/backlight.h>
 
 #include <asm/cpu/dac.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 #include <asm/hd64461.h>
 
 #define HP680_MAX_INTENSITY 255
diff --git a/drivers/video/controlfb.c b/drivers/video/controlfb.c
index 8cc6c0e2d27a..04c6d928189b 100644
--- a/drivers/video/controlfb.c
+++ b/drivers/video/controlfb.c
@@ -415,13 +415,15 @@ static int __init init_control(struct fb_info_control *p)
         full = p->total_vram == 0x400000;
 
         /* Try to pick a video mode out of NVRAM if we have one. */
+#ifdef CONFIG_NVRAM
         if (default_cmode == CMODE_NVRAM){
                 cmode = nvram_read_byte(NV_CMODE);
                 if(cmode < CMODE_8 || cmode > CMODE_32)
                         cmode = CMODE_8;
         } else
+#endif
                 cmode=default_cmode;
-
+#ifdef CONFIG_NVRAM
         if (default_vmode == VMODE_NVRAM) {
                 vmode = nvram_read_byte(NV_VMODE);
                 if (vmode < 1 || vmode > VMODE_MAX ||
@@ -432,7 +434,9 @@ static int __init init_control(struct fb_info_control *p)
                         if (control_mac_modes[vmode - 1].m[full] < cmode)
                                 vmode = VMODE_640_480_60;
                 }
-        } else {
+        } else
+#endif
+        {
                 vmode=default_vmode;
                 if (control_mac_modes[vmode - 1].m[full] < cmode) {
                         if (cmode > CMODE_8)
diff --git a/drivers/video/fb_ddc.c b/drivers/video/fb_ddc.c
index 3aa6ebf68f17..f836137a0eda 100644
--- a/drivers/video/fb_ddc.c
+++ b/drivers/video/fb_ddc.c
@@ -20,26 +20,26 @@
 static unsigned char *fb_do_probe_ddc_edid(struct i2c_adapter *adapter)
 {
         unsigned char start = 0x0;
+        unsigned char *buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
         struct i2c_msg msgs[] = {
                 {
                         .addr   = DDC_ADDR,
+                        .flags  = 0,
                         .len    = 1,
                         .buf    = &start,
                 }, {
                         .addr   = DDC_ADDR,
                         .flags  = I2C_M_RD,
                         .len    = EDID_LENGTH,
+                        .buf    = buf,
                 }
         };
-        unsigned char *buf;
 
-        buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
         if (!buf) {
                 dev_warn(&adapter->dev, "unable to allocate memory for EDID "
                          "block.\n");
                 return NULL;
         }
-        msgs[1].buf = buf;
 
         if (i2c_transfer(adapter, msgs, 2) == 2)
                 return buf;
diff --git a/drivers/video/hitfb.c b/drivers/video/hitfb.c
index 3afb472763c0..3dc49424dc75 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/hitfb.c
@@ -29,7 +29,6 @@
 #include <asm/io.h>
 #include <asm/hd64461.h>
 #include <asm/cpu/dac.h>
-#include <asm/hp6xx/hp6xx.h>
 
 #define WIDTH 640
 
diff --git a/drivers/video/igafb.c b/drivers/video/igafb.c
index 67f384f86758..e6df492c22a5 100644
--- a/drivers/video/igafb.c
+++ b/drivers/video/igafb.c
@@ -573,3 +573,10 @@ int __init igafb_setup(char *options)
 
 module_init(igafb_init);
 MODULE_LICENSE("GPL");
+static struct pci_device_id igafb_pci_tbl[] __devinitdata = {
+        { PCI_VENDOR_ID_INTERG, PCI_DEVICE_ID_INTERG_1682,
+          PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
+        { }
+};
+
+MODULE_DEVICE_TABLE(pci, igafb_pci_tbl);
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c
index eeeeff9a09eb..a95836839e1e 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/intelfb/intelfbhw.c
@@ -161,7 +161,7 @@ intelfbhw_get_memory(struct pci_dev *pdev, int *aperture_size,
                 return 1;
 
         /* Find the bridge device.  It is always 0:0.0 */
-        if (!(bridge_dev = pci_find_slot(0, PCI_DEVFN(0, 0)))) {
+        if (!(bridge_dev = pci_get_bus_and_slot(0, PCI_DEVFN(0, 0)))) {
                 ERR_MSG("cannot find bridge device\n");
                 return 1;
         }
@@ -169,6 +169,8 @@ intelfbhw_get_memory(struct pci_dev *pdev, int *aperture_size,
         /* Get the fb aperture size and "stolen" memory amount. */
         tmp = 0;
         pci_read_config_word(bridge_dev, INTEL_GMCH_CTRL, &tmp);
+        pci_dev_put(bridge_dev);
+
         switch (pdev->device) {
         case PCI_DEVICE_ID_INTEL_915G:
         case PCI_DEVICE_ID_INTEL_915GM:
@@ -662,7 +664,7 @@ intelfbhw_print_hw_state(struct intelfb_info *dinfo, struct intelfb_hwstate *hw)
         int index = dinfo->pll_index;
         DBG_MSG("intelfbhw_print_hw_state\n");
 
-        if (!hw || !dinfo)
+        if (!hw)
                 return;
         /* Read in as much of the HW state as possible. */
         printk("hw state dump start\n");
diff --git a/drivers/video/nvidia/nv_hw.c b/drivers/video/nvidia/nv_hw.c
index 9ed640d35728..ea426115c6f9 100644
--- a/drivers/video/nvidia/nv_hw.c
+++ b/drivers/video/nvidia/nv_hw.c
@@ -145,12 +145,18 @@ static void nvGetClocks(struct nvidia_par *par, unsigned int *MClk,
 
         if (par->Architecture >= NV_ARCH_40) {
                 pll = NV_RD32(par->PMC, 0x4020);
-                P = (pll >> 16) & 0x03;
+                P = (pll >> 16) & 0x07;
                 pll = NV_RD32(par->PMC, 0x4024);
                 M = pll & 0xFF;
                 N = (pll >> 8) & 0xFF;
-                MB = (pll >> 16) & 0xFF;
-                NB = (pll >> 24) & 0xFF;
+                if (((par->Chipset & 0xfff0) == 0x0290) ||
+                                ((par->Chipset & 0xfff0) == 0x0390)) {
+                        MB = 1;
+                        NB = 1;
+                } else {
+                        MB = (pll >> 16) & 0xFF;
+                        NB = (pll >> 24) & 0xFF;
+                }
                 *MClk = ((N * NB * par->CrystalFreqKHz) / (M * MB)) >> P;
 
                 pll = NV_RD32(par->PMC, 0x4000);
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index e48de3c9fd13..19eef3a09023 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -160,12 +160,51 @@ void nvidia_delete_i2c_busses(struct nvidia_par *par)
 
 }
 
+static u8 *nvidia_do_probe_i2c_edid(struct nvidia_i2c_chan *chan)
+{
+        u8 start = 0x0;
+        struct i2c_msg msgs[] = {
+                {
+                 .addr = 0x50,
+                 .len = 1,
+                 .buf = &start,
+                 }, {
+                     .addr = 0x50,
+                     .flags = I2C_M_RD,
+                     .len = EDID_LENGTH,
+                     },
+        };
+        u8 *buf;
+
+        if (!chan->par)
+                return NULL;
+
+        buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
+        if (!buf) {
+                dev_warn(&chan->par->pci_dev->dev, "Out of memory!\n");
+                return NULL;
+        }
+        msgs[1].buf = buf;
+
+        if (i2c_transfer(&chan->adapter, msgs, 2) == 2)
+                return buf;
+        dev_dbg(&chan->par->pci_dev->dev, "Unable to read EDID block.\n");
+        kfree(buf);
+        return NULL;
+}
+
 int nvidia_probe_i2c_connector(struct fb_info *info, int conn, u8 **out_edid)
 {
         struct nvidia_par *par = info->par;
-        u8 *edid;
-
-        edid = fb_ddc_read(&par->chan[conn - 1].adapter);
+        u8 *edid = NULL;
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                /* Do the real work */
+                edid = nvidia_do_probe_i2c_edid(&par->chan[conn - 1]);
+                if (edid)
+                        break;
+        }
 
         if (!edid && conn == 1) {
                 /* try to get from firmware */
diff --git a/drivers/video/nvidia/nv_setup.c b/drivers/video/nvidia/nv_setup.c
index a18a9aebf05f..eab3e282a4de 100644
--- a/drivers/video/nvidia/nv_setup.c
+++ b/drivers/video/nvidia/nv_setup.c
@@ -262,7 +262,7 @@ static void nv10GetConfig(struct nvidia_par *par)
 #endif
 
         dev = pci_find_slot(0, 1);
-        if ((par->Chipset && 0xffff) == 0x01a0) {
+        if ((par->Chipset & 0xffff) == 0x01a0) {
                 int amt = 0;
 
                 pci_read_config_dword(dev, 0x7c, &amt);
@@ -359,6 +359,7 @@ int NVCommonSetup(struct fb_info *info)
         case 0x0186:
         case 0x0187:
         case 0x018D:
+        case 0x0228:
         case 0x0286:
         case 0x028C:
         case 0x0316:
@@ -382,6 +383,10 @@ int NVCommonSetup(struct fb_info *info)
         case 0x034C:
         case 0x0160:
         case 0x0166:
+        case 0x0169:
+        case 0x016B:
+        case 0x016C:
+        case 0x016D:
         case 0x00C8:
         case 0x00CC:
         case 0x0144:
@@ -639,12 +644,23 @@ int NVCommonSetup(struct fb_info *info)
                 par->fpHeight = NV_RD32(par->PRAMDAC, 0x0800) + 1;
                 par->fpSyncs = NV_RD32(par->PRAMDAC, 0x0848) & 0x30000033;
 
-                printk("Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
+                printk("nvidiafb: Panel size is %i x %i\n", par->fpWidth, par->fpHeight);
         }
 
         if (monA)
                 info->monspecs = *monA;
 
+        if (!par->FlatPanel || !par->twoHeads)
+                par->FPDither = 0;
+
+        par->LVDS = 0;
+        if (par->FlatPanel && par->twoHeads) {
+                NV_WR32(par->PRAMDAC0, 0x08B0, 0x00010004);
+                if (par->PRAMDAC0[0x08b4] & 1)
+                        par->LVDS = 1;
+                printk("nvidiafb: Panel is %s\n", par->LVDS ? "LVDS" : "TMDS");
+        }
+
         kfree(edidA);
         kfree(edidB);
 done:
diff --git a/drivers/video/nvidia/nv_type.h b/drivers/video/nvidia/nv_type.h
index acdc26693402..86e65dea60d3 100644
--- a/drivers/video/nvidia/nv_type.h
+++ b/drivers/video/nvidia/nv_type.h
@@ -129,6 +129,7 @@ struct nvidia_par {
         int fpHeight;
         int PanelTweak;
         int paneltweak;
+        int LVDS;
         int pm_state;
         u32 crtcSync_read;
         u32 fpSyncs;
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index eb24107bcc81..538e947610e1 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1160,20 +1160,20 @@ static u32 __devinit nvidia_get_arch(struct fb_info *info)
         case 0x0340:            /* GeForceFX 5700 */
                 arch = NV_ARCH_30;
                 break;
-        case 0x0040:
-        case 0x00C0:
-        case 0x0120:
+        case 0x0040:            /* GeForce 6800 */
+        case 0x00C0:            /* GeForce 6800 */
+        case 0x0120:            /* GeForce 6800 */
         case 0x0130:
-        case 0x0140:
-        case 0x0160:
-        case 0x01D0:
-        case 0x0090:
-        case 0x0210:
-        case 0x0220:
+        case 0x0140:            /* GeForce 6600 */
+        case 0x0160:            /* GeForce 6200 */
+        case 0x01D0:            /* GeForce 7200, 7300, 7400 */
+        case 0x0090:            /* GeForce 7800 */
+        case 0x0210:            /* GeForce 6800 */
+        case 0x0220:            /* GeForce 6200 */
         case 0x0230:
-        case 0x0240:
-        case 0x0290:
-        case 0x0390:
+        case 0x0240:            /* GeForce 6100 */
+        case 0x0290:            /* GeForce 7900 */
+        case 0x0390:            /* GeForce 7600 */
                 arch = NV_ARCH_40;
                 break;
         case 0x0020:            /* TNT, TNT2 */
diff --git a/drivers/video/offb.c b/drivers/video/offb.c
index bad0e98fb3b6..9a40bbecf76b 100644
--- a/drivers/video/offb.c
+++ b/drivers/video/offb.c
@@ -157,7 +157,7 @@ static int offb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
                 out_le32(par->cmap_adr + 0xb4, (red << 16 | green << 8 | blue));
                 break;
         case cmap_gxt2000:
-                out_le32((unsigned __iomem *) par->cmap_adr + regno,
+                out_le32(((unsigned __iomem *) par->cmap_adr) + regno,
                          (red << 16 | green << 8 | blue));
                 break;
         }
@@ -213,7 +213,7 @@ static int offb_blank(int blank, struct fb_info *info)
                                 out_le32(par->cmap_adr + 0xb4, 0);
                                 break;
                         case cmap_gxt2000:
-                                out_le32((unsigned __iomem *) par->cmap_adr + i,
+                                out_le32(((unsigned __iomem *) par->cmap_adr) + i,
                                          0);
                                 break;
                         }
@@ -226,13 +226,23 @@ static int offb_blank(int blank, struct fb_info *info)
 static void __iomem *offb_map_reg(struct device_node *np, int index,
                                   unsigned long offset, unsigned long size)
 {
-        struct resource r;
-
-        if (of_address_to_resource(np, index, &r))
-                return 0;
-        if ((r.start + offset + size) > r.end)
-                return 0;
-        return ioremap(r.start + offset, size);
+        const u32 *addrp;
+        u64 asize, taddr;
+        unsigned int flags;
+
+        addrp = of_get_pci_address(np, index, &asize, &flags);
+        if (addrp == NULL)
+                addrp = of_get_address(np, index, &asize, &flags);
+        if (addrp == NULL)
+                return NULL;
+        if ((flags & (IORESOURCE_IO | IORESOURCE_MEM)) == 0)
+                return NULL;
+        if ((offset + size) > asize)
+                return NULL;
+        taddr = of_translate_address(np, addrp);
+        if (taddr == OF_BAD_ADDR)
+                return NULL;
+        return ioremap(taddr + offset, size);
 }
 
 static void __init offb_init_fb(const char *name, const char *full_name,
@@ -289,7 +299,6 @@ static void __init offb_init_fb(const char *name, const char *full_name,
 
         par->cmap_type = cmap_unknown;
         if (depth == 8) {
-                /* Palette hacks disabled for now */
                 if (dp && !strncmp(name, "ATY,Rage128", 11)) {
                         par->cmap_adr = offb_map_reg(dp, 2, 0, 0x1fff);
                         if (par->cmap_adr)
@@ -313,7 +322,8 @@ static void __init offb_init_fb(const char *name, const char *full_name,
                             ioremap(base + 0x7ff000, 0x1000) + 0xcc0;
                         par->cmap_data = par->cmap_adr + 1;
                         par->cmap_type = cmap_m64;
-                } else if (dp && device_is_compatible(dp, "pci1014,b7")) {
+                } else if (dp && (device_is_compatible(dp, "pci1014,b7") ||
+                                  device_is_compatible(dp, "pci1014,21c"))) {
                         par->cmap_adr = offb_map_reg(dp, 0, 0x6000, 0x1000);
                         if (par->cmap_adr)
                                 par->cmap_type = cmap_gxt2000;
@@ -433,7 +443,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
         pp = get_property(dp, "linux,bootx-linebytes", &len);
         if (pp == NULL)
                 pp = get_property(dp, "linebytes", &len);
-        if (pp && len == sizeof(u32))
+        if (pp && len == sizeof(u32) && (*pp != 0xffffffffu))
                 pitch = *pp;
         else
                 pitch = width * ((depth + 7) / 8);
@@ -496,7 +506,7 @@ static void __init offb_init_nodriver(struct device_node *dp, int no_real_node)
                 offb_init_fb(no_real_node ? "bootx" : dp->name,
                              no_real_node ? "display" : dp->full_name,
                              width, height, depth, pitch, address,
-                             no_real_node ? dp : NULL);
+                             no_real_node ? NULL : dp);
         }
 }
 
diff --git a/drivers/video/platinumfb.c b/drivers/video/platinumfb.c
index 983be3ec2345..fdb33cd21a27 100644
--- a/drivers/video/platinumfb.c
+++ b/drivers/video/platinumfb.c
@@ -339,11 +339,12 @@ static int __devinit platinum_init_fb(struct fb_info *info)
 
         sense = read_platinum_sense(pinfo);
         printk(KERN_INFO "platinumfb: Monitor sense value = 0x%x, ", sense);
-
         if (default_vmode == VMODE_NVRAM) {
+#ifdef CONFIG_NVRAM
                 default_vmode = nvram_read_byte(NV_VMODE);
                 if (default_vmode <= 0 || default_vmode > VMODE_MAX ||
                     !platinum_reg_init[default_vmode-1])
+#endif
                         default_vmode = VMODE_CHOOSE;
         }
         if (default_vmode == VMODE_CHOOSE) {
@@ -351,8 +352,10 @@ static int __devinit platinum_init_fb(struct fb_info *info)
         }
         if (default_vmode <= 0 || default_vmode > VMODE_MAX)
                 default_vmode = VMODE_640_480_60;
+#ifdef CONFIG_NVRAM
         if (default_cmode == CMODE_NVRAM)
                 default_cmode = nvram_read_byte(NV_CMODE);
+#endif
         if (default_cmode < CMODE_8 || default_cmode > CMODE_32)
                 default_cmode = CMODE_8;
         /*
diff --git a/drivers/video/pnx4008/pnxrgbfb.c b/drivers/video/pnx4008/pnxrgbfb.c
index 7d9453c91a42..f29e66e2d774 100644
--- a/drivers/video/pnx4008/pnxrgbfb.c
+++ b/drivers/video/pnx4008/pnxrgbfb.c
@@ -154,7 +154,8 @@ static int __devinit rgbfb_probe(struct platform_device *pdev)
                         goto err1;
         }
 
-        if (!fb_get_options("pnxrgbfb", &option) && !strcmp(option, "nocursor"))
+        if (!fb_get_options("pnxrgbfb", &option) && option &&
+                        !strcmp(option, "nocursor"))
                 rgbfb_ops.fb_cursor = no_cursor;
 
         info->node = -1;
@@ -191,7 +192,7 @@ err:
 
 static struct platform_driver rgbfb_driver = {
         .driver = {
-                .name = "rgbfb",
+                .name = "pnx4008-rgbfb",
         },
         .probe = rgbfb_probe,
         .remove = rgbfb_remove,
diff --git a/drivers/video/pnx4008/sdum.c b/drivers/video/pnx4008/sdum.c
index 51f0ecc2a511..d23bf0d659b6 100644
--- a/drivers/video/pnx4008/sdum.c
+++ b/drivers/video/pnx4008/sdum.c
@@ -848,7 +848,7 @@ static int sdum_remove(struct platform_device *pdev)
 
 static struct platform_driver sdum_driver = {
         .driver = {
-                .name = "sdum",
+                .name = "pnx4008-sdum",
         },
         .probe = sdum_probe,
         .remove = sdum_remove,
diff --git a/drivers/video/valkyriefb.c b/drivers/video/valkyriefb.c
index 47f27924a7d7..06fc19a61192 100644
--- a/drivers/video/valkyriefb.c
+++ b/drivers/video/valkyriefb.c
@@ -284,7 +284,7 @@ static void __init valkyrie_choose_mode(struct fb_info_valkyrie *p)
         printk(KERN_INFO "Monitor sense value = 0x%x\n", p->sense);
 
         /* Try to pick a video mode out of NVRAM if we have one. */
-#ifndef CONFIG_MAC
+#if !defined(CONFIG_MAC) && defined(CONFIG_NVRAM)
         if (default_vmode == VMODE_NVRAM) {
                 default_vmode = nvram_read_byte(NV_VMODE);
                 if (default_vmode <= 0
@@ -297,7 +297,7 @@ static void __init valkyrie_choose_mode(struct fb_info_valkyrie *p)
                 default_vmode = mac_map_monitor_sense(p->sense);
         if (!valkyrie_reg_init[default_vmode - 1])
                 default_vmode = VMODE_640_480_67;
-#ifndef CONFIG_MAC
+#if !defined(CONFIG_MAC) && defined(CONFIG_NVRAM)
         if (default_cmode == CMODE_NVRAM)
                 default_cmode = nvram_read_byte(NV_CMODE);
 #endif
diff --git a/drivers/w1/Kconfig b/drivers/w1/Kconfig
index 27c9d05d03ef..c287a9ae4fdd 100644
--- a/drivers/w1/Kconfig
+++ b/drivers/w1/Kconfig
@@ -2,7 +2,6 @@ menu "Dallas's 1-wire bus"
 
 config W1
         tristate "Dallas's 1-wire support"
-        depends on CONNECTOR
         ---help---
           Dallas' 1-wire bus is useful to connect slow 1-pin devices
           such as iButtons and thermal sensors.
diff --git a/drivers/w1/masters/matrox_w1.c b/drivers/w1/masters/matrox_w1.c
index 2788b8ca9bb1..6f9d880ab2e9 100644
--- a/drivers/w1/masters/matrox_w1.c
+++ b/drivers/w1/masters/matrox_w1.c
@@ -215,6 +215,8 @@ static int __devinit matrox_w1_probe(struct pci_dev *pdev, const struct pci_devi
         return 0;
 
 err_out_free_device:
+        if (dev->virt_addr)
+                iounmap(dev->virt_addr);
         kfree(dev);
 
         return err;
diff --git a/fs/Kconfig b/fs/Kconfig
index 599de54451af..7b1511d50b05 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -140,6 +140,73 @@ config EXT3_FS_SECURITY
           If you are not using a security module that requires using
           extended attributes for file security labels, say N.
 
+config EXT4DEV_FS
+        tristate "Ext4dev/ext4 extended fs support development (EXPERIMENTAL)"
+        depends on EXPERIMENTAL
+        select JBD2
+        help
+          Ext4dev is a predecessor filesystem of the next generation
+          extended fs ext4, based on ext3 filesystem code. It will be
+          renamed ext4 fs later, once ext4dev is mature and stabilized.
+
+          Unlike the change from ext2 filesystem to ext3 filesystem,
+          the on-disk format of ext4dev is not the same as ext3 any more:
+          it is based on extent maps and it supports 48-bit physical block
+          numbers. These combined on-disk format changes will allow
+          ext4dev/ext4 to handle more than 16 TB filesystem volumes --
+          a hard limit that ext3 cannot overcome without changing the
+          on-disk format.
+
+          Other than extent maps and 48-bit block numbers, ext4dev also is
+          likely to have other new features such as persistent preallocation,
+          high resolution time stamps, and larger file support etc.  These
+          features will be added to ext4dev gradually.
+
+          To compile this file system support as a module, choose M here. The
+          module will be called ext4dev.  Be aware, however, that the filesystem
+          of your root partition (the one containing the directory /) cannot
+          be compiled as a module, and so this could be dangerous.
+
+          If unsure, say N.
+
+config EXT4DEV_FS_XATTR
+        bool "Ext4dev extended attributes"
+        depends on EXT4DEV_FS
+        default y
+        help
+          Extended attributes are name:value pairs associated with inodes by
+          the kernel or by users (see the attr(5) manual page, or visit
+          <http://acl.bestbits.at/> for details).
+
+          If unsure, say N.
+
+          You need this for POSIX ACL support on ext4dev/ext4.
+
+config EXT4DEV_FS_POSIX_ACL
+        bool "Ext4dev POSIX Access Control Lists"
+        depends on EXT4DEV_FS_XATTR
+        select FS_POSIX_ACL
+        help
+          POSIX Access Control Lists (ACLs) support permissions for users and
+          groups beyond the owner/group/world scheme.
+
+          To learn more about Access Control Lists, visit the POSIX ACLs for
+          Linux website <http://acl.bestbits.at/>.
+
+          If you don't know what Access Control Lists are, say N
+
+config EXT4DEV_FS_SECURITY
+        bool "Ext4dev Security Labels"
+        depends on EXT4DEV_FS_XATTR
+        help
+          Security labels support alternative access control models
+          implemented by security modules like SELinux.  This option
+          enables an extended attribute handler for file security
+          labels in the ext4dev/ext4 filesystem.
+
+          If you are not using a security module that requires using
+          extended attributes for file security labels, say N.
+
 config JBD
         tristate
         help
@@ -172,12 +239,44 @@ config JBD_DEBUG
           generated.  To turn debugging off again, do
           "echo 0 > /proc/sys/fs/jbd-debug".
 
+config JBD2
+        tristate
+        help
+          This is a generic journaling layer for block devices that support
+          both 32-bit and 64-bit block numbers.  It is currently used by
+          the ext4dev/ext4 filesystem, but it could also be used to add
+          journal support to other file systems or block devices such
+          as RAID or LVM.
+
+          If you are using ext4dev/ext4, you need to say Y here. If you are not
+          using ext4dev/ext4 then you will probably want to say N.
+
+          To compile this device as a module, choose M here. The module will be
+          called jbd2.  If you are compiling ext4dev/ext4 into the kernel,
+          you cannot compile this code as a module.
+
+config JBD2_DEBUG
+        bool "JBD2 (ext4dev/ext4) debugging support"
+        depends on JBD2
+        help
+          If you are using the ext4dev/ext4 journaled file system (or
+          potentially any other filesystem/device using JBD2), this option
+          allows you to enable debugging output while the system is running,
+          in order to help track down any problems you are having.
+          By default, the debugging output will be turned off.
+
+          If you select Y here, then you will be able to turn on debugging
+          with "echo N > /proc/sys/fs/jbd2-debug", where N is a number between
+          1 and 5. The higher the number, the more debugging output is
+          generated.  To turn debugging off again, do
+          "echo 0 > /proc/sys/fs/jbd2-debug".
+
 config FS_MBCACHE
-# Meta block cache for Extended Attributes (ext2/ext3)
+# Meta block cache for Extended Attributes (ext2/ext3/ext4)
         tristate
-        depends on EXT2_FS_XATTR || EXT3_FS_XATTR
-        default y if EXT2_FS=y || EXT3_FS=y
-        default m if EXT2_FS=m || EXT3_FS=m
+        depends on EXT2_FS_XATTR || EXT3_FS_XATTR || EXT4DEV_FS_XATTR
+        default y if EXT2_FS=y || EXT3_FS=y || EXT4DEV_FS=y
+        default m if EXT2_FS=m || EXT3_FS=m || EXT4DEV_FS=m
 
 config REISERFS_FS
         tristate "Reiserfs support"
@@ -535,6 +634,10 @@ config FUSE_FS
           If you want to develop a userspace FS, or if you want to use
           a filesystem based on FUSE, answer Y or M.
 
+config GENERIC_ACL
+        bool
+        select FS_POSIX_ACL
+
 if BLOCK
 menu "CD-ROM/DVD Filesystems"
 
@@ -1674,6 +1777,7 @@ config RPCSEC_GSS_KRB5
         select CRYPTO
         select CRYPTO_MD5
         select CRYPTO_DES
+        select CRYPTO_CBC
         help
           Provides for secure RPC calls by means of a gss-api
           mechanism based on Kerberos V5. This is required for
@@ -1692,6 +1796,7 @@ config RPCSEC_GSS_SPKM3
         select CRYPTO_MD5
         select CRYPTO_DES
         select CRYPTO_CAST5
+        select CRYPTO_CBC
         help
           Provides for secure RPC calls by means of a gss-api
           mechanism based on the SPKM3 public-key mechanism.
@@ -1887,7 +1992,7 @@ config CIFS_EXPERIMENTAL
 config CIFS_UPCALL
           bool "Kerberos/SPNEGO advanced session setup (EXPERIMENTAL)"
           depends on CIFS_EXPERIMENTAL
-          select CONNECTOR
+          depends on CONNECTOR
           help
             Enables an upcall mechanism for CIFS which will be used to contact
             userspace helper utilities to provide SPNEGO packaged Kerberos
@@ -1955,8 +2060,7 @@ config CODA_FS_OLD_API
           For most cases you probably want to say N.
 
 config AFS_FS
-# for fs/nls/Config.in
-        tristate "Andrew File System support (AFS) (Experimental)"
+        tristate "Andrew File System support (AFS) (EXPERIMENTAL)"
         depends on INET && EXPERIMENTAL
         select RXRPC
         help
@@ -1981,10 +2085,6 @@ config 9P_FS
 
           If unsure, say N.
 
-config GENERIC_ACL
-        bool
-        select FS_POSIX_ACL
-
 endmenu
 
 if BLOCK
diff --git a/fs/Makefile b/fs/Makefile
index df614eacee86..9a5ce9323bfd 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -62,7 +62,9 @@ obj-$(CONFIG_DLM)		+= dlm/
 # Do not add any filesystems before this line
 obj-$(CONFIG_REISERFS_FS)       += reiserfs/
 obj-$(CONFIG_EXT3_FS)           += ext3/ # Before ext2 so root fs can be ext3
+obj-$(CONFIG_EXT4DEV_FS)        += ext4/ # Before ext2 so root fs can be ext4dev
 obj-$(CONFIG_JBD)               += jbd/
+obj-$(CONFIG_JBD2)              += jbd2/
 obj-$(CONFIG_EXT2_FS)           += ext2/
 obj-$(CONFIG_CRAMFS)            += cramfs/
 obj-$(CONFIG_RAMFS)             += ramfs/
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index cf8a2cb28505..a6ec75c56fcf 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -211,8 +211,8 @@ static int afs_dir_open(struct inode *inode, struct file *file)
 {
         _enter("{%lu}", inode->i_ino);
 
-        BUG_ON(sizeof(union afs_dir_block) != 2048);
-        BUG_ON(sizeof(union afs_dirent) != 32);
+        BUILD_BUG_ON(sizeof(union afs_dir_block) != 2048);
+        BUILD_BUG_ON(sizeof(union afs_dirent) != 32);
 
         if (AFS_FS_I(inode)->flags & AFS_VNODE_DELETED)
                 return -ENOENT;
@@ -446,8 +446,8 @@ static struct dentry *afs_dir_lookup(struct inode *dir, struct dentry *dentry,
         _enter("{%lu},%p{%s}", dir->i_ino, dentry, dentry->d_name.name);
 
         /* insanity checks first */
-        BUG_ON(sizeof(union afs_dir_block) != 2048);
-        BUG_ON(sizeof(union afs_dirent) != 32);
+        BUILD_BUG_ON(sizeof(union afs_dir_block) != 2048);
+        BUILD_BUG_ON(sizeof(union afs_dirent) != 32);
 
         if (dentry->d_name.len > 255) {
                 _leave(" = -ENAMETOOLONG");
diff --git a/fs/autofs/autofs_i.h b/fs/autofs/autofs_i.h
index c7700d9b3f96..906ba5ce2261 100644
--- a/fs/autofs/autofs_i.h
+++ b/fs/autofs/autofs_i.h
@@ -149,6 +149,7 @@ extern const struct file_operations autofs_root_operations;
 /* Initializing function */
 
 int autofs_fill_super(struct super_block *, void *, int);
+void autofs_kill_sb(struct super_block *sb);
 
 /* Queue management functions */
 
diff --git a/fs/autofs/dirhash.c b/fs/autofs/dirhash.c
index 3fded389d06b..bf8c8af98004 100644
--- a/fs/autofs/dirhash.c
+++ b/fs/autofs/dirhash.c
@@ -246,5 +246,4 @@ void autofs_hash_nuke(struct autofs_sb_info *sbi)
                         kfree(ent);
                 }
         }
-        shrink_dcache_sb(sbi->sb);
 }
diff --git a/fs/autofs/init.c b/fs/autofs/init.c
index aca123752406..cea5219b4f37 100644
--- a/fs/autofs/init.c
+++ b/fs/autofs/init.c
@@ -24,7 +24,7 @@ static struct file_system_type autofs_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "autofs",
         .get_sb         = autofs_get_sb,
-        .kill_sb        = kill_anon_super,
+        .kill_sb        = autofs_kill_sb,
 };
 
 static int __init init_autofs_fs(void)
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 2c9759baad61..38ede5c9d6fd 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -20,11 +20,19 @@
 #include "autofs_i.h"
 #include <linux/module.h>
 
-static void autofs_put_super(struct super_block *sb)
+void autofs_kill_sb(struct super_block *sb)
 {
         struct autofs_sb_info *sbi = autofs_sbi(sb);
         unsigned int n;
 
+        /*
+         * In the event of a failure in get_sb_nodev the superblock
+         * info is not present so nothing else has been setup, so
+         * just exit when we are called from deactivate_super.
+         */
+        if (!sbi)
+                return;
+
         if ( !sbi->catatonic )
                 autofs_catatonic_mode(sbi); /* Free wait queues, close pipe */
 
@@ -37,13 +45,13 @@ static void autofs_put_super(struct super_block *sb)
         kfree(sb->s_fs_info);
 
         DPRINTK(("autofs: shutting down\n"));
+        kill_anon_super(sb);
 }
 
 static void autofs_read_inode(struct inode *inode);
 
 static struct super_operations autofs_sops = {
         .read_inode     = autofs_read_inode,
-        .put_super      = autofs_put_super,
         .statfs         = simple_statfs,
 };
 
@@ -136,7 +144,8 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
 
         s->s_fs_info = sbi;
         sbi->magic = AUTOFS_SBI_MAGIC;
-        sbi->catatonic = 0;
+        sbi->pipe = NULL;
+        sbi->catatonic = 1;
         sbi->exp_timeout = 0;
         sbi->oz_pgrp = process_group(current);
         autofs_initialize_hash(&sbi->dirhash);
@@ -180,6 +189,7 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
         if ( !pipe->f_op || !pipe->f_op->write )
                 goto fail_fput;
         sbi->pipe = pipe;
+        sbi->catatonic = 0;
 
         /*
          * Success! Install the root dentry now to indicate completion.
@@ -198,6 +208,8 @@ fail_iput:
         iput(root_inode);
 fail_free:
         kfree(sbi);
+        s->s_fs_info = NULL;
+        kill_anon_super(s);
 fail_unlock:
         return -EINVAL;
 }
diff --git a/fs/autofs/waitq.c b/fs/autofs/waitq.c
index 633f628005b4..19a9cafb5ddf 100644
--- a/fs/autofs/waitq.c
+++ b/fs/autofs/waitq.c
@@ -41,6 +41,7 @@ void autofs_catatonic_mode(struct autofs_sb_info *sbi)
                 wq = nwq;
         }
         fput(sbi->pipe);        /* Close the pipe */
+        sbi->pipe = NULL;
         autofs_hash_dputall(&sbi->dirhash); /* Remove all dentry pointers */
 }
 
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 480ab178cba5..b13f32c8aeee 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -94,7 +94,6 @@ struct autofs_wait_queue {
 
 struct autofs_sb_info {
         u32 magic;
-        struct dentry *root;
         int pipefd;
         struct file *pipe;
         pid_t oz_pgrp;
@@ -229,4 +228,4 @@ out:
 }
 
 void autofs4_dentry_release(struct dentry *);
-
+extern void autofs4_kill_sb(struct super_block *);
diff --git a/fs/autofs4/init.c b/fs/autofs4/init.c
index 5d9193332bef..723a1c5e361b 100644
--- a/fs/autofs4/init.c
+++ b/fs/autofs4/init.c
@@ -24,7 +24,7 @@ static struct file_system_type autofs_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "autofs",
         .get_sb         = autofs_get_sb,
-        .kill_sb        = kill_anon_super,
+        .kill_sb        = autofs4_kill_sb,
 };
 
 static int __init init_autofs4_fs(void)
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index 800ce876caec..ce7c0f1dd529 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -96,9 +96,12 @@ void autofs4_free_ino(struct autofs_info *ino)
  */
 static void autofs4_force_release(struct autofs_sb_info *sbi)
 {
-        struct dentry *this_parent = sbi->root;
+        struct dentry *this_parent = sbi->sb->s_root;
         struct list_head *next;
 
+        if (!sbi->sb->s_root)
+                return;
+
         spin_lock(&dcache_lock);
 repeat:
         next = this_parent->d_subdirs.next;
@@ -127,7 +130,7 @@ resume:
                 spin_lock(&dcache_lock);
         }
 
-        if (this_parent != sbi->root) {
+        if (this_parent != sbi->sb->s_root) {
                 struct dentry *dentry = this_parent;
 
                 next = this_parent->d_u.d_child.next;
@@ -140,18 +143,20 @@ resume:
                 goto resume;
         }
         spin_unlock(&dcache_lock);
-
-        dput(sbi->root);
-        sbi->root = NULL;
-        shrink_dcache_sb(sbi->sb);
-
-        return;
 }
 
-static void autofs4_put_super(struct super_block *sb)
+void autofs4_kill_sb(struct super_block *sb)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(sb);
 
+        /*
+         * In the event of a failure in get_sb_nodev the superblock
+         * info is not present so nothing else has been setup, so
+         * just exit when we are called from deactivate_super.
+         */
+        if (!sbi)
+                return;
+
         sb->s_fs_info = NULL;
 
         if ( !sbi->catatonic )
@@ -163,6 +168,7 @@ static void autofs4_put_super(struct super_block *sb)
         kfree(sbi);
 
         DPRINTK("shutting down");
+        kill_anon_super(sb);
 }
 
 static int autofs4_show_options(struct seq_file *m, struct vfsmount *mnt)
@@ -189,7 +195,6 @@ static int autofs4_show_options(struct seq_file *m, struct vfsmount *mnt)
 }
 
 static struct super_operations autofs4_sops = {
-        .put_super      = autofs4_put_super,
         .statfs         = simple_statfs,
         .show_options   = autofs4_show_options,
 };
@@ -315,9 +320,9 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
 
         s->s_fs_info = sbi;
         sbi->magic = AUTOFS_SBI_MAGIC;
-        sbi->root = NULL;
         sbi->pipefd = -1;
-        sbi->catatonic = 0;
+        sbi->pipe = NULL;
+        sbi->catatonic = 1;
         sbi->exp_timeout = 0;
         sbi->oz_pgrp = process_group(current);
         sbi->sb = s;
@@ -395,13 +400,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
                 goto fail_fput;
         sbi->pipe = pipe;
         sbi->pipefd = pipefd;
-
-        /*
-         * Take a reference to the root dentry so we get a chance to
-         * clean up the dentry tree on umount.
-         * See autofs4_force_release.
-         */
-        sbi->root = dget(root);
+        sbi->catatonic = 0;
 
         /*
          * Success! Install the root dentry now to indicate completion.
@@ -426,6 +425,8 @@ fail_ino:
         kfree(ino);
 fail_free:
         kfree(sbi);
+        s->s_fs_info = NULL;
+        kill_anon_super(s);
 fail_unlock:
         return -EINVAL;
 }
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index ce103e7b0bc3..1e4a539f4417 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -41,11 +41,8 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
                 wake_up_interruptible(&wq->queue);
                 wq = nwq;
         }
-        if (sbi->pipe) {
-                fput(sbi->pipe);        /* Close the pipe */
-                sbi->pipe = NULL;
-        }
-        shrink_dcache_sb(sbi->sb);
+        fput(sbi->pipe);        /* Close the pipe */
+        sbi->pipe = NULL;
 }
 
 static int autofs4_write(struct file *file, const void *addr, int bytes)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 06435f3665f4..79b05a1a4365 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1152,7 +1152,7 @@ static int dump_write(struct file *file, const void *addr, int nr)
 static int dump_seek(struct file *file, loff_t off)
 {
         if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
-                if (file->f_op->llseek(file, off, 1) != off)
+                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
                         return 0;
         } else {
                 char *buf = (char *)get_zeroed_page(GFP_KERNEL);
@@ -1220,7 +1220,7 @@ static int notesize(struct memelfnote *en)
 
 static int alignfile(struct file *file, loff_t *foffset)
 {
-        char buf[4] = { 0, };
+        static const char buf[4] = { 0, };
         DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
         return 1;
 }
@@ -1569,7 +1569,8 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
 
         DUMP_WRITE(elf, sizeof(*elf));
         offset += sizeof(*elf);                         /* Elf header */
-        offset += (segs+1) * sizeof(struct elf_phdr);   /* Program headers */
+        offset += (segs + 1) * sizeof(struct elf_phdr); /* Program headers */
+        foffset = offset;
 
         /* Write notes phdr entry */
         {
@@ -1586,8 +1587,6 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
                 DUMP_WRITE(&phdr, sizeof(phdr));
         }
 
-        foffset = offset;
-
         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
 
         /* Write program headers for segments dump */
@@ -1612,7 +1611,6 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
                 phdr.p_align = ELF_EXEC_PAGESIZE;
 
                 DUMP_WRITE(&phdr, sizeof(phdr));
-                foffset += sizeof(phdr);
         }
 
 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
diff --git a/fs/bio.c b/fs/bio.c
index 8f93e939f213..f95c8749499f 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -79,7 +79,6 @@ static struct bio_set *fs_bio_set;
 static inline struct bio_vec *bvec_alloc_bs(gfp_t gfp_mask, int nr, unsigned long *idx, struct bio_set *bs)
 {
         struct bio_vec *bvl;
-        struct biovec_slab *bp;
 
         /*
          * see comment near bvec_array define!
@@ -98,10 +97,12 @@ static inline struct bio_vec *bvec_alloc_bs(gfp_t gfp_mask, int nr, unsigned lon
          * idx now points to the pool we want to allocate from
          */
 
-        bp = bvec_slabs + *idx;
         bvl = mempool_alloc(bs->bvec_pools[*idx], gfp_mask);
-        if (bvl)
+        if (bvl) {
+                struct biovec_slab *bp = bvec_slabs + *idx;
+
                 memset(bvl, 0, bp->nr_vecs * sizeof(struct bio_vec));
+        }
 
         return bvl;
 }
@@ -166,7 +167,7 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 
                 bio_init(bio);
                 if (likely(nr_iovecs)) {
-                        unsigned long idx;
+                        unsigned long idx = 0; /* shut up gcc */
 
                         bvl = bvec_alloc_bs(gfp_mask, nr_iovecs, &idx, bs);
                         if (unlikely(!bvl)) {
diff --git a/fs/block_dev.c b/fs/block_dev.c
index bc8f27cc4483..36c0e7af9d0f 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -642,34 +642,47 @@ static void free_bd_holder(struct bd_holder *bo)
 }
 
 /**
+ * find_bd_holder - find matching struct bd_holder from the block device
+ *
+ * @bdev:       struct block device to be searched
+ * @bo:         target struct bd_holder
+ *
+ * Returns matching entry with @bo in @bdev->bd_holder_list.
+ * If found, increment the reference count and return the pointer.
+ * If not found, returns NULL.
+ */
+static struct bd_holder *find_bd_holder(struct block_device *bdev,
+                                        struct bd_holder *bo)
+{
+        struct bd_holder *tmp;
+
+        list_for_each_entry(tmp, &bdev->bd_holder_list, list)
+                if (tmp->sdir == bo->sdir) {
+                        tmp->count++;
+                        return tmp;
+                }
+
+        return NULL;
+}
+
+/**
  * add_bd_holder - create sysfs symlinks for bd_claim() relationship
  *
  * @bdev:       block device to be bd_claimed
  * @bo:         preallocated and initialized by alloc_bd_holder()
  *
- * If there is no matching entry with @bo in @bdev->bd_holder_list,
- * add @bo to the list, create symlinks.
+ * Add @bo to @bdev->bd_holder_list, create symlinks.
  *
- * Returns 0 if symlinks are created or already there.
- * Returns -ve if something fails and @bo can be freed.
+ * Returns 0 if symlinks are created.
+ * Returns -ve if something fails.
  */
 static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo)
 {
-        struct bd_holder *tmp;
         int ret;
 
         if (!bo)
                 return -EINVAL;
 
-        list_for_each_entry(tmp, &bdev->bd_holder_list, list) {
-                if (tmp->sdir == bo->sdir) {
-                        tmp->count++;
-                        /* We've already done what we need to do here. */
-                        free_bd_holder(bo);
-                        return 0;
-                }
-        }
-
         if (!bd_holder_grab_dirs(bdev, bo))
                 return -EBUSY;
 
@@ -740,7 +753,7 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder,
                                 struct kobject *kobj)
 {
         int res;
-        struct bd_holder *bo;
+        struct bd_holder *bo, *found;
 
         if (!kobj)
                 return -EINVAL;
@@ -751,9 +764,16 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder,
 
         mutex_lock_nested(&bdev->bd_mutex, BD_MUTEX_PARTITION);
         res = bd_claim(bdev, holder);
-        if (res == 0)
-                res = add_bd_holder(bdev, bo);
-        if (res)
+        if (res == 0) {
+                found = find_bd_holder(bdev, bo);
+                if (found == NULL) {
+                        res = add_bd_holder(bdev, bo);
+                        if (res)
+                                bd_release(bdev);
+                }
+        }
+
+        if (res || found)
                 free_bd_holder(bo);
         mutex_unlock(&bdev->bd_mutex);
 
@@ -1131,6 +1151,8 @@ static int blkdev_open(struct inode * inode, struct file * filp)
         filp->f_flags |= O_LARGEFILE;
 
         bdev = bd_acquire(inode);
+        if (bdev == NULL)
+                return -ENOMEM;
 
         res = do_open(bdev, filp, BD_MUTEX_NORMAL);
         if (res)
diff --git a/fs/buffer.c b/fs/buffer.c
index eeb8ac1aa856..35527dca1dbc 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -452,6 +452,7 @@ static void end_buffer_async_write(struct buffer_head *bh, int uptodate)
                                bdevname(bh->b_bdev, b));
                 }
                 set_bit(AS_EIO, &page->mapping->flags);
+                set_buffer_write_io_error(bh);
                 clear_buffer_uptodate(bh);
                 SetPageError(page);
         }
@@ -571,6 +572,10 @@ EXPORT_SYMBOL(mark_buffer_async_write);
 static inline void __remove_assoc_queue(struct buffer_head *bh)
 {
         list_del_init(&bh->b_assoc_buffers);
+        WARN_ON(!bh->b_assoc_map);
+        if (buffer_write_io_error(bh))
+                set_bit(AS_EIO, &bh->b_assoc_map->flags);
+        bh->b_assoc_map = NULL;
 }
 
 int inode_has_buffers(struct inode *inode)
@@ -669,6 +674,7 @@ void mark_buffer_dirty_inode(struct buffer_head *bh, struct inode *inode)
                 spin_lock(&buffer_mapping->private_lock);
                 list_move_tail(&bh->b_assoc_buffers,
                                 &mapping->private_list);
+                bh->b_assoc_map = mapping;
                 spin_unlock(&buffer_mapping->private_lock);
         }
 }
@@ -765,7 +771,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
         spin_lock(lock);
         while (!list_empty(list)) {
                 bh = BH_ENTRY(list->next);
-                list_del_init(&bh->b_assoc_buffers);
+                __remove_assoc_queue(bh);
                 if (buffer_dirty(bh) || buffer_locked(bh)) {
                         list_add(&bh->b_assoc_buffers, &tmp);
                         if (buffer_dirty(bh)) {
@@ -786,7 +792,7 @@ static int fsync_buffers_list(spinlock_t *lock, struct list_head *list)
 
         while (!list_empty(&tmp)) {
                 bh = BH_ENTRY(tmp.prev);
-                __remove_assoc_queue(bh);
+                list_del_init(&bh->b_assoc_buffers);
                 get_bh(bh);
                 spin_unlock(lock);
                 wait_on_buffer(bh);
@@ -1042,8 +1048,21 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
         } while ((size << sizebits) < PAGE_SIZE);
 
         index = block >> sizebits;
-        block = index << sizebits;
 
+        /*
+         * Check for a block which wants to lie outside our maximum possible
+         * pagecache index.  (this comparison is done using sector_t types).
+         */
+        if (unlikely(index != block >> sizebits)) {
+                char b[BDEVNAME_SIZE];
+
+                printk(KERN_ERR "%s: requested out-of-range block %llu for "
+                        "device %s\n",
+                        __FUNCTION__, (unsigned long long)block,
+                        bdevname(bdev, b));
+                return -EIO;
+        }
+        block = index << sizebits;
         /* Create a page with the proper size buffers.. */
         page = grow_dev_page(bdev, block, index, size);
         if (!page)
@@ -1070,12 +1089,16 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
 
         for (;;) {
                 struct buffer_head * bh;
+                int ret;
 
                 bh = __find_get_block(bdev, block, size);
                 if (bh)
                         return bh;
 
-                if (!grow_buffers(bdev, block, size))
+                ret = grow_buffers(bdev, block, size);
+                if (ret < 0)
+                        return NULL;
+                if (ret == 0)
                         free_more_memory();
         }
 }
@@ -1150,6 +1173,7 @@ void __bforget(struct buffer_head *bh)
 
                 spin_lock(&buffer_mapping->private_lock);
                 list_del_init(&bh->b_assoc_buffers);
+                bh->b_assoc_map = NULL;
                 spin_unlock(&buffer_mapping->private_lock);
         }
         __brelse(bh);
@@ -1837,6 +1861,7 @@ static int __block_prepare_write(struct inode *inode, struct page *page,
                         clear_buffer_new(bh);
                         kaddr = kmap_atomic(page, KM_USER0);
                         memset(kaddr+block_start, 0, bh->b_size);
+                        flush_dcache_page(page);
                         kunmap_atomic(kaddr, KM_USER0);
                         set_buffer_uptodate(bh);
                         mark_buffer_dirty(bh);
@@ -2343,6 +2368,7 @@ failed:
          */
         kaddr = kmap_atomic(page, KM_USER0);
         memset(kaddr, 0, PAGE_CACHE_SIZE);
+        flush_dcache_page(page);
         kunmap_atomic(kaddr, KM_USER0);
         SetPageUptodate(page);
         set_page_dirty(page);
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 1eb9a2ec0a3b..0b3c37ef52e0 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,6 +1,11 @@
 Version 1.46
 ------------
 Support deep tree mounts.  Better support OS/2, Win9x (DOS) time stamps.
+Allow null user to be specified on mount ("username="). Do not return
+EINVAL on readdir when filldir fails due to overwritten blocksize
+(fixes FC problem).  Return error in rename 2nd attempt retry (ie report
+if rename by handle also fails, after rename by path fails, we were
+not reporting whether the retry worked or not).
 
 Version 1.45
 ------------
diff --git a/fs/cifs/cifsacl.h b/fs/cifs/cifsacl.h
index d0776ac2b804..5eff35d6e564 100644
--- a/fs/cifs/cifsacl.h
+++ b/fs/cifs/cifsacl.h
@@ -31,8 +31,8 @@ struct cifs_sid {
 } __attribute__((packed));
 
 /* everyone */
-extern const struct cifs_sid sid_everyone;
+/* extern const struct cifs_sid sid_everyone;*/
 /* group users */
-extern const struct cifs_sid sid_user;
+/* extern const struct cifs_sid sid_user;*/
 
 #endif /* _CIFSACL_H */
diff --git a/fs/cifs/cifsencrypt.h b/fs/cifs/cifsencrypt.h
index 03e359b32861..152fa2dcfc6c 100644
--- a/fs/cifs/cifsencrypt.h
+++ b/fs/cifs/cifsencrypt.h
@@ -27,8 +27,6 @@ extern void mdfour(unsigned char *out, unsigned char *in, int n);
 /* smbdes.c */
 extern void E_P16(unsigned char *p14, unsigned char *p16);
 extern void E_P24(unsigned char *p21, unsigned char *c8, unsigned char *p24);
-extern void D_P16(unsigned char *p14, unsigned char *in, unsigned char *out);
-extern void E_old_pw_hash(unsigned char *, unsigned char *, unsigned char *);
 
 
 
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index c00c654f2e11..84976cdbe713 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -63,6 +63,7 @@ extern struct task_struct * oplockThread; /* remove sparse warning */
 struct task_struct * oplockThread = NULL;
 extern struct task_struct * dnotifyThread; /* remove sparse warning */
 struct task_struct * dnotifyThread = NULL;
+static struct super_operations cifs_super_ops; 
 unsigned int CIFSMaxBufSize = CIFS_MAX_MSGSIZE;
 module_param(CIFSMaxBufSize, int, 0);
 MODULE_PARM_DESC(CIFSMaxBufSize,"Network buffer size (not including header). Default: 16384 Range: 8192 to 130048");
@@ -198,10 +199,12 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf)
     /* Only need to call the old QFSInfo if failed
     on newer one */
     if(rc)
-        rc = CIFSSMBQFSInfo(xid, pTcon, buf);
+        if(pTcon->ses->capabilities & CAP_NT_SMBS)
+                rc = CIFSSMBQFSInfo(xid, pTcon, buf); /* not supported by OS2 */
 
-        /* Old Windows servers do not support level 103, retry with level 
-           one if old server failed the previous call */ 
+        /* Some old Windows servers also do not support level 103, retry with
+           older level one if old server failed the previous call or we
+           bypassed it because we detected that this was an older LANMAN sess */
         if(rc)
                 rc = SMBOldQFSInfo(xid, pTcon, buf);
         /*     
@@ -435,13 +438,21 @@ static void cifs_umount_begin(struct vfsmount * vfsmnt, int flags)
         return;
 }
 
+#ifdef CONFIG_CIFS_STATS2
+static int cifs_show_stats(struct seq_file *s, struct vfsmount *mnt)
+{
+        /* BB FIXME */
+        return 0;
+}
+#endif
+
 static int cifs_remount(struct super_block *sb, int *flags, char *data)
 {
         *flags |= MS_NODIRATIME;
         return 0;
 }
 
-struct super_operations cifs_super_ops = {
+static struct super_operations cifs_super_ops = {
         .read_inode = cifs_read_inode,
         .put_super = cifs_put_super,
         .statfs = cifs_statfs,
@@ -454,6 +465,9 @@ struct super_operations cifs_super_ops = {
         .show_options = cifs_show_options,
         .umount_begin   = cifs_umount_begin,
         .remount_fs = cifs_remount,
+#ifdef CONFIG_CIFS_STATS2
+        .show_stats = cifs_show_stats,
+#endif
 };
 
 static int
@@ -495,7 +509,7 @@ static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
 static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
 {
         /* origin == SEEK_END => we must revalidate the cached file length */
-        if (origin == 2) {
+        if (origin == SEEK_END) {
                 int retval = cifs_revalidate(file->f_dentry);
                 if (retval < 0)
                         return (loff_t)retval;
@@ -903,7 +917,7 @@ init_cifs(void)
 #ifdef CONFIG_PROC_FS
         cifs_proc_init();
 #endif
-        INIT_LIST_HEAD(&GlobalServerList);      /* BB not implemented yet */
+/*      INIT_LIST_HEAD(&GlobalServerList);*/    /* BB not implemented yet */
         INIT_LIST_HEAD(&GlobalSMBSessionList);
         INIT_LIST_HEAD(&GlobalTreeConnectionList);
         INIT_LIST_HEAD(&GlobalOplock_Q);
@@ -931,6 +945,7 @@ init_cifs(void)
         GlobalCurrentXid = 0;
         GlobalTotalActiveXid = 0;
         GlobalMaxActiveXid = 0;
+        memset(Local_System_Name, 0, 15);
         rwlock_init(&GlobalSMBSeslock);
         spin_lock_init(&GlobalMid_Lock);
 
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index bea875d9a46a..a243f779b363 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -36,7 +36,7 @@ extern const struct address_space_operations cifs_addr_ops;
 extern const struct address_space_operations cifs_addr_ops_smallbuf;
 
 /* Functions related to super block operations */
-extern struct super_operations cifs_super_ops;
+/* extern struct super_operations cifs_super_ops;*/
 extern void cifs_read_inode(struct inode *);
 extern void cifs_delete_inode(struct inode *);
 /* extern void cifs_write_inode(struct inode *); *//* BB not needed yet */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b24006c47df1..74d3ccbb103b 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -153,7 +153,7 @@ struct TCP_Server_Info {
         char sessid[4];         /* unique token id for this session */
         /* (returned on Negotiate */
         int capabilities; /* allow selective disabling of caps by smb sess */
-        __u16 timeZone;
+        int timeAdj;  /* Adjust for difference in server time zone in sec */
         __u16 CurrentMid;         /* multiplex id - rotating counter */
         char cryptKey[CIFS_CRYPTO_KEY_SIZE];
         /* 16th byte of RFC1001 workstation name is always null */
@@ -203,9 +203,14 @@ struct cifsSesInfo {
         char * domainName;
         char * password;
 };
-/* session flags */
+/* no more than one of the following three session flags may be set */
 #define CIFS_SES_NT4 1
-
+#define CIFS_SES_OS2 2
+#define CIFS_SES_W9X 4
+/* following flag is set for old servers such as OS2 (and Win95?)
+   which do not negotiate NTLM or POSIX dialects, but instead
+   negotiate one of the older LANMAN dialects */
+#define CIFS_SES_LANMAN 8
 /*
  * there is one of these for each connection to a resource on a particular
  * session 
@@ -512,7 +517,8 @@ require use of the stronger protocol */
  * This list helps improve performance and eliminate the messages indicating
  * that we had a communications error talking to the server in this list. 
  */
-GLOBAL_EXTERN struct servers_not_supported *NotSuppList;        /*@z4a */
+/* Feature not supported */
+/* GLOBAL_EXTERN struct servers_not_supported *NotSuppList; */
 
 /*
  * The following is a hash table of all the users we know about.
@@ -568,7 +574,6 @@ GLOBAL_EXTERN unsigned int lookupCacheEnabled;
 GLOBAL_EXTERN unsigned int extended_security;   /* if on, session setup sent 
                                 with more secure ntlmssp2 challenge/resp */
 GLOBAL_EXTERN unsigned int sign_CIFS_PDUs;  /* enable smb packet signing */
-GLOBAL_EXTERN unsigned int secFlags;
 GLOBAL_EXTERN unsigned int linuxExtEnabled;/*enable Linux/Unix CIFS extensions*/
 GLOBAL_EXTERN unsigned int CIFSMaxBufSize;  /* max size not including hdr */
 GLOBAL_EXTERN unsigned int cifs_min_rcv;    /* min size of big ntwrk buf pool */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 81df2bf8e75a..6df9dadba647 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -26,7 +26,8 @@
 
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 #define LANMAN_PROT 0
-#define CIFS_PROT   1
+#define LANMAN2_PROT 1
+#define CIFS_PROT   2
 #else
 #define CIFS_PROT   0
 #endif
@@ -408,6 +409,8 @@ typedef struct negotiate_req {
 
 /* Dialect index is 13 for LANMAN */
 
+#define MIN_TZ_ADJ (15 * 60) /* minimum grid for timezones in seconds */
+
 typedef struct lanman_neg_rsp {
         struct smb_hdr hdr;     /* wct = 13 */
         __le16 DialectIndex;
@@ -417,7 +420,10 @@ typedef struct lanman_neg_rsp {
         __le16 MaxNumberVcs;
         __le16 RawMode;
         __le32 SessionKey;
-        __le32 ServerTime;
+        struct {
+                __le16 Time;
+                __le16 Date;
+        } __attribute__((packed)) SrvTime;
         __le16 ServerTimeZone;
         __le16 EncryptionKeyLength;
         __le16 Reserved;
@@ -674,7 +680,7 @@ typedef union smb_com_tree_disconnect {	/* as an altetnative can use flag on
 typedef struct smb_com_close_req {
         struct smb_hdr hdr;     /* wct = 3 */
         __u16 FileID;
-        __u32 LastWriteTime;    /* should be zero */
+        __u32 LastWriteTime;    /* should be zero or -1 */
         __u16 ByteCount;        /* 0 */
 } __attribute__((packed)) CLOSE_REQ;
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index b35c55c3c8bb..f1f8225102f0 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -50,12 +50,12 @@ extern int SendReceive(const unsigned int /* xid */ , struct cifsSesInfo *,
 extern int SendReceive2(const unsigned int /* xid */ , struct cifsSesInfo *,
                         struct kvec *, int /* nvec to send */, 
                         int * /* type of buf returned */ , const int long_op);
-extern int SendReceiveBlockingLock(const unsigned int /* xid */ , struct cifsTconInfo *,
+extern int SendReceiveBlockingLock(const unsigned int /* xid */ , 
+                                        struct cifsTconInfo *,
                                 struct smb_hdr * /* input */ ,
                                 struct smb_hdr * /* out */ ,
                                 int * /* bytes returned */);
-extern int checkSMBhdr(struct smb_hdr *smb, __u16 mid);
-extern int checkSMB(struct smb_hdr *smb, __u16 mid, int length);
+extern int checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length);
 extern int is_valid_oplock_break(struct smb_hdr *smb, struct TCP_Server_Info *);
 extern int is_size_safe_to_change(struct cifsInodeInfo *);
 extern struct cifsFileInfo *find_writable_file(struct cifsInodeInfo *);
@@ -80,6 +80,9 @@ extern struct oplock_q_entry * AllocOplockQEntry(struct inode *, u16,
 extern void DeleteOplockQEntry(struct oplock_q_entry *);
 extern struct timespec cifs_NTtimeToUnix(u64 /* utc nanoseconds since 1601 */ );
 extern u64 cifs_UnixTimeToNT(struct timespec);
+extern __le64 cnvrtDosCifsTm(__u16 date, __u16 time);
+extern struct timespec cnvrtDosUnixTm(__u16 date, __u16 time);
+
 extern int cifs_get_inode_info(struct inode **pinode,
                         const unsigned char *search_path, 
                         FILE_ALL_INFO * pfile_info,
@@ -116,6 +119,7 @@ extern int CIFSFindClose(const int, struct cifsTconInfo *tcon,
 extern int CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
                         FILE_ALL_INFO * findData,
+                        int legacy /* whether to use old info level */,
                         const struct nls_table *nls_codepage, int remap);
 extern int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
                         const unsigned char *searchName,
@@ -279,8 +283,6 @@ extern void sesInfoFree(struct cifsSesInfo *);
 extern struct cifsTconInfo *tconInfoAlloc(void);
 extern void tconInfoFree(struct cifsTconInfo *);
 
-extern int cifs_reconnect(struct TCP_Server_Info *server);
-
 extern int cifs_sign_smb(struct smb_hdr *, struct TCP_Server_Info *,__u32 *);
 extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *,
                           __u32 *);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 075d8fb3d376..098790eb2aa1 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -46,6 +46,7 @@ static struct {
 } protocols[] = {
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
         {LANMAN_PROT, "\2LM1.2X002"},
+        {LANMAN2_PROT, "\2LANMAN2.1"},
 #endif /* weak password hashing for legacy clients */
         {CIFS_PROT, "\2NT LM 0.12"}, 
         {POSIX_PROT, "\2POSIX 2"},
@@ -58,6 +59,7 @@ static struct {
 } protocols[] = {
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
         {LANMAN_PROT, "\2LM1.2X002"},
+        {LANMAN2_PROT, "\2LANMAN2.1"},
 #endif /* weak password hashing for legacy clients */
         {CIFS_PROT, "\2NT LM 0.12"}, 
         {BAD_PROT, "\2"}
@@ -67,13 +69,13 @@ static struct {
 /* define the number of elements in the cifs dialect array */
 #ifdef CONFIG_CIFS_POSIX
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
-#define CIFS_NUM_PROT 3
+#define CIFS_NUM_PROT 4
 #else
 #define CIFS_NUM_PROT 2
 #endif /* CIFS_WEAK_PW_HASH */
 #else /* not posix */
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
-#define CIFS_NUM_PROT 2
+#define CIFS_NUM_PROT 3
 #else
 #define CIFS_NUM_PROT 1
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
@@ -397,6 +399,7 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
         struct TCP_Server_Info * server;
         u16 count;
         unsigned int secFlags;
+        u16 dialect;
 
         if(ses->server)
                 server = ses->server;
@@ -436,9 +439,10 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
         if (rc != 0) 
                 goto neg_err_exit;
 
-        cFYI(1,("Dialect: %d", pSMBr->DialectIndex));
+        dialect = le16_to_cpu(pSMBr->DialectIndex);
+        cFYI(1,("Dialect: %d", dialect));
         /* Check wct = 1 error case */
-        if((pSMBr->hdr.WordCount < 13) || (pSMBr->DialectIndex == BAD_PROT)) {
+        if((pSMBr->hdr.WordCount < 13) || (dialect == BAD_PROT)) {
                 /* core returns wct = 1, but we do not ask for core - otherwise
                 small wct just comes when dialect index is -1 indicating we 
                 could not negotiate a common dialect */
@@ -446,7 +450,9 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                 goto neg_err_exit;
 #ifdef CONFIG_CIFS_WEAK_PW_HASH 
         } else if((pSMBr->hdr.WordCount == 13)
-                        && (pSMBr->DialectIndex == LANMAN_PROT)) {
+                        && ((dialect == LANMAN_PROT)
+                                || (dialect == LANMAN2_PROT))) {
+                __s16 tmp;
                 struct lanman_neg_rsp * rsp = (struct lanman_neg_rsp *)pSMBr;
 
                 if((secFlags & CIFSSEC_MAY_LANMAN) || 
@@ -472,12 +478,44 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         server->maxRw = 0;/* we do not need to use raw anyway */
                         server->capabilities = CAP_MPX_MODE;
                 }
-                server->timeZone = le16_to_cpu(rsp->ServerTimeZone);
+                tmp = (__s16)le16_to_cpu(rsp->ServerTimeZone);
+                if (tmp == -1) {
+                        /* OS/2 often does not set timezone therefore
+                         * we must use server time to calc time zone.
+                         * Could deviate slightly from the right zone.
+                         * Smallest defined timezone difference is 15 minutes
+                         * (i.e. Nepal).  Rounding up/down is done to match
+                         * this requirement.
+                         */
+                        int val, seconds, remain, result;
+                        struct timespec ts, utc;
+                        utc = CURRENT_TIME;
+                        ts = cnvrtDosUnixTm(le16_to_cpu(rsp->SrvTime.Date),
+                                                le16_to_cpu(rsp->SrvTime.Time));
+                        cFYI(1,("SrvTime: %d sec since 1970 (utc: %d) diff: %d",
+                                (int)ts.tv_sec, (int)utc.tv_sec, 
+                                (int)(utc.tv_sec - ts.tv_sec)));
+                        val = (int)(utc.tv_sec - ts.tv_sec);
+                        seconds = val < 0 ? -val : val;
+                        result = (seconds / MIN_TZ_ADJ) * MIN_TZ_ADJ;
+                        remain = seconds % MIN_TZ_ADJ;
+                        if(remain >= (MIN_TZ_ADJ / 2))
+                                result += MIN_TZ_ADJ;
+                        if(val < 0)
+                                result = - result;
+                        server->timeAdj = result;
+                } else {
+                        server->timeAdj = (int)tmp;
+                        server->timeAdj *= 60; /* also in seconds */
+                }
+                cFYI(1,("server->timeAdj: %d seconds", server->timeAdj));
+
 
                 /* BB get server time for time conversions and add
                 code to use it and timezone since this is not UTC */    
 
-                if (rsp->EncryptionKeyLength == cpu_to_le16(CIFS_CRYPTO_KEY_SIZE)) {
+                if (rsp->EncryptionKeyLength == 
+                                cpu_to_le16(CIFS_CRYPTO_KEY_SIZE)) {
                         memcpy(server->cryptKey, rsp->EncryptionKey,
                                 CIFS_CRYPTO_KEY_SIZE);
                 } else if (server->secMode & SECMODE_PW_ENCRYPT) {
@@ -531,7 +569,8 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
         cFYI(0, ("Max buf = %d", ses->server->maxBuf));
         GETU32(ses->server->sessid) = le32_to_cpu(pSMBr->SessionKey);
         server->capabilities = le32_to_cpu(pSMBr->Capabilities);
-        server->timeZone = le16_to_cpu(pSMBr->ServerTimeZone);  
+        server->timeAdj = (int)(__s16)le16_to_cpu(pSMBr->ServerTimeZone);
+        server->timeAdj *= 60;
         if (pSMBr->EncryptionKeyLength == CIFS_CRYPTO_KEY_SIZE) {
                 memcpy(server->cryptKey, pSMBr->u.EncryptionKey,
                        CIFS_CRYPTO_KEY_SIZE);
@@ -1617,7 +1656,7 @@ CIFSSMBClose(const int xid, struct cifsTconInfo *tcon, int smb_file_id)
         pSMBr = (CLOSE_RSP *)pSMB; /* BB removeme BB */
 
         pSMB->FileID = (__u16) smb_file_id;
-        pSMB->LastWriteTime = 0;
+        pSMB->LastWriteTime = 0xFFFFFFFF;
         pSMB->ByteCount = 0;
         rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                          (struct smb_hdr *) pSMBr, &bytes_returned, 0);
@@ -2773,9 +2812,11 @@ GetExtAttrOut:
 
 
 /* security id for everyone */
-const struct cifs_sid sid_everyone = {1, 1, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0}};
+const static struct cifs_sid sid_everyone = 
+                {1, 1, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0}};
 /* group users */
-const struct cifs_sid sid_user = {1, 2 , {0, 0, 0, 0, 0, 5}, {32, 545, 0, 0}};
+const static struct cifs_sid sid_user = 
+                {1, 2 , {0, 0, 0, 0, 0, 5}, {32, 545, 0, 0}};
 
 /* Convert CIFS ACL to POSIX form */
 static int parse_sec_desc(struct cifs_sid * psec_desc, int acl_len)
@@ -2856,7 +2897,6 @@ qsec_out:
         return rc;
 }
 
-
 /* Legacy Query Path Information call for lookup to old servers such
    as Win9x/WinME */
 int SMBQueryInformation(const int xid, struct cifsTconInfo *tcon,
@@ -2898,7 +2938,16 @@ QInfRetry:
         if (rc) {
                 cFYI(1, ("Send error in QueryInfo = %d", rc));
         } else if (pFinfo) {            /* decode response */
+                struct timespec ts;
+                __u32 time = le32_to_cpu(pSMBr->last_write_time);
+                /* BB FIXME - add time zone adjustment BB */
                 memset(pFinfo, 0, sizeof(FILE_ALL_INFO));
+                ts.tv_nsec = 0;
+                ts.tv_sec = time;
+                /* decode time fields */
+                pFinfo->ChangeTime = cpu_to_le64(cifs_UnixTimeToNT(ts));
+                pFinfo->LastWriteTime = pFinfo->ChangeTime;
+                pFinfo->LastAccessTime = 0;
                 pFinfo->AllocationSize =
                         cpu_to_le64(le32_to_cpu(pSMBr->size));
                 pFinfo->EndOfFile = pFinfo->AllocationSize;
@@ -2922,6 +2971,7 @@ int
 CIFSSMBQPathInfo(const int xid, struct cifsTconInfo *tcon,
                  const unsigned char *searchName,
                  FILE_ALL_INFO * pFindData,
+                 int legacy /* old style infolevel */,
                  const struct nls_table *nls_codepage, int remap)
 {
 /* level 263 SMB_QUERY_FILE_ALL_INFO */
@@ -2970,7 +3020,10 @@ QPathInfoRetry:
         byte_count = params + 1 /* pad */ ;
         pSMB->TotalParameterCount = cpu_to_le16(params);
         pSMB->ParameterCount = pSMB->TotalParameterCount;
-        pSMB->InformationLevel = cpu_to_le16(SMB_QUERY_FILE_ALL_INFO);
+        if(legacy)
+                pSMB->InformationLevel = cpu_to_le16(SMB_INFO_STANDARD);
+        else
+                pSMB->InformationLevel = cpu_to_le16(SMB_QUERY_FILE_ALL_INFO);
         pSMB->Reserved4 = 0;
         pSMB->hdr.smb_buf_length += byte_count;
         pSMB->ByteCount = cpu_to_le16(byte_count);
@@ -2982,13 +3035,24 @@ QPathInfoRetry:
         } else {                /* decode response */
                 rc = validate_t2((struct smb_t2_rsp *)pSMBr);
 
-                if (rc || (pSMBr->ByteCount < 40)) 
+                if (rc) /* BB add auto retry on EOPNOTSUPP? */
+                        rc = -EIO;
+                else if (!legacy && (pSMBr->ByteCount < 40)) 
                         rc = -EIO;      /* bad smb */
+                else if(legacy && (pSMBr->ByteCount < 24))
+                        rc = -EIO;  /* 24 or 26 expected but we do not read last field */
                 else if (pFindData){
+                        int size;
                         __u16 data_offset = le16_to_cpu(pSMBr->t2.DataOffset);
+                        if(legacy) /* we do not read the last field, EAsize, fortunately
+                                           since it varies by subdialect and on Set vs. Get, is  
+                                           two bytes or 4 bytes depending but we don't care here */
+                                size = sizeof(FILE_INFO_STANDARD);
+                        else
+                                size = sizeof(FILE_ALL_INFO);
                         memcpy((char *) pFindData,
                                (char *) &pSMBr->hdr.Protocol +
-                               data_offset, sizeof (FILE_ALL_INFO));
+                               data_offset, size);
                 } else
                     rc = -ENOMEM;
         }
@@ -3613,6 +3677,14 @@ getDFSRetry:
                 strncpy(pSMB->RequestFileName, searchName, name_len);
         }
 
+        if(ses->server) {
+                if(ses->server->secMode &
+                   (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                        pSMB->hdr.Flags2 |= SMBFLG2_SECURITY_SIGNATURE;
+        }
+
+        pSMB->hdr.Uid = ses->Suid;
+
         params = 2 /* level */  + name_len /*includes null */ ;
         pSMB->TotalDataCount = 0;
         pSMB->DataCount = 0;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c78762051da4..71f77914ce93 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -109,7 +109,7 @@ static int ipv6_connect(struct sockaddr_in6 *psin_server,
          * wake up waiters on reconnection? - (not needed currently)
          */
 
-int
+static int
 cifs_reconnect(struct TCP_Server_Info *server)
 {
         int rc = 0;
@@ -771,13 +771,18 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
         separator[0] = ',';
         separator[1] = 0; 
 
-        memset(vol->source_rfc1001_name,0x20,15);
-        for(i=0;i < strnlen(utsname()->nodename,15);i++) {
-                /* does not have to be a perfect mapping since the field is
-                informational, only used for servers that do not support
-                port 445 and it can be overridden at mount time */
-                vol->source_rfc1001_name[i] = 
-                        toupper(utsname()->nodename[i]);
+        if (Local_System_Name[0] != 0)
+                memcpy(vol->source_rfc1001_name, Local_System_Name,15);
+        else {
+                char *nodename = utsname()->nodename;
+                int n = strnlen(nodename,15);
+                memset(vol->source_rfc1001_name,0x20,15);
+                for(i=0 ; i < n ; i++) {
+                        /* does not have to be perfect mapping since field is
+                        informational, only used for servers that do not support
+                        port 445 and it can be overridden at mount time */
+                        vol->source_rfc1001_name[i] = toupper(nodename[i]);
+                }
         }
         vol->source_rfc1001_name[15] = 0;
         /* null target name indicates to use *SMBSERVR default called name
@@ -817,10 +822,13 @@ cifs_parse_mount_options(char *options, const char *devname,struct smb_vol *vol)
                 } else if (strnicmp(data, "nouser_xattr",12) == 0) {
                         vol->no_xattr = 1;
                 } else if (strnicmp(data, "user", 4) == 0) {
-                        if (!value || !*value) {
+                        if (!value) {
                                 printk(KERN_WARNING
                                        "CIFS: invalid or missing username\n");
                                 return 1;       /* needs_arg; */
+                        } else if(!*value) {
+                                /* null user, ie anonymous, authentication */
+                                vol->nullauth = 1;
                         }
                         if (strnlen(value, 200) < 200) {
                                 vol->username = value;
@@ -1637,6 +1645,8 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
                 /* BB fixme parse for domain name here */
                 cFYI(1, ("Username: %s ", volume_info.username));
 
+        } else if (volume_info.nullauth) {
+                cFYI(1,("null user"));
         } else {
                 cifserror("No username specified");
         /* In userspace mount helper we can get user name from alternate
@@ -3215,7 +3225,9 @@ CIFSTCon(unsigned int xid, struct cifsSesInfo *ses,
                         }
                         /* else do not bother copying these informational fields */
                 }
-                if(smb_buffer_response->WordCount == 3)
+                if((smb_buffer_response->WordCount == 3) ||
+                         (smb_buffer_response->WordCount == 7))
+                        /* field is in same location */
                         tcon->Flags = le16_to_cpu(pSMBr->OptionalSupport);
                 else
                         tcon->Flags = 0;
@@ -3312,19 +3324,21 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                 first_time = 1;
         }
         if (!rc) {
+                pSesInfo->flags = 0;
                 pSesInfo->capabilities = pSesInfo->server->capabilities;
                 if(linuxExtEnabled == 0)
                         pSesInfo->capabilities &= (~CAP_UNIX);
         /*      pSesInfo->sequence_number = 0;*/
-                cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x Time Zone: %d",
+                cFYI(1,("Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d",
                         pSesInfo->server->secMode,
                         pSesInfo->server->capabilities,
-                        pSesInfo->server->timeZone));
+                        pSesInfo->server->timeAdj));
                 if(experimEnabled < 2)
                         rc = CIFS_SessSetup(xid, pSesInfo,
                                             first_time, nls_info);
                 else if (extended_security
-                                && (pSesInfo->capabilities & CAP_EXTENDED_SECURITY)
+                                && (pSesInfo->capabilities 
+                                        & CAP_EXTENDED_SECURITY)
                                 && (pSesInfo->server->secType == NTLMSSP)) {
                         rc = -EOPNOTSUPP;
                 } else if (extended_security
@@ -3338,7 +3352,7 @@ int cifs_setup_session(unsigned int xid, struct cifsSesInfo *pSesInfo,
                         if (!rc) {
                                 if(ntlmv2_flag) {
                                         char * v2_response;
-                                        cFYI(1,("Can use more secure NTLM version 2 password hash"));
+                                        cFYI(1,("more secure NTLM ver2 hash"));
                                         if(CalcNTLMv2_partial_mac_key(pSesInfo, 
                                                 nls_info)) {
                                                 rc = -ENOMEM;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 976a691c5a68..2436ed8fc840 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -492,10 +492,14 @@ int cifs_close(struct inode *inode, struct file *file)
                                         the struct would be in each open file,
                                         but this should give enough time to 
                                         clear the socket */
-                                        cERROR(1,("close with pending writes"));
+#ifdef CONFIG_CIFS_DEBUG2
+                                        cFYI(1,("close delay, write pending"));
+#endif /* DEBUG2 */
                                         msleep(timeout);
                                         timeout *= 4;
-                                } 
+                                }
+                                if(atomic_read(&pSMBFile->wrtPending))
+                                        cERROR(1,("close with pending writes"));
                                 rc = CIFSSMBClose(xid, pTcon,
                                                   pSMBFile->netfid);
                         }
@@ -1806,13 +1810,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                 }
                 if ((rc < 0) || (smb_read_data == NULL)) {
                         cFYI(1, ("Read error in readpages: %d", rc));
-                        /* clean up remaing pages off list */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-                                page_cache_release(page);
-                        }
                         break;
                 } else if (bytes_read > 0) {
                         pSMBr = (struct smb_com_read_rsp *)smb_read_data;
@@ -1831,13 +1828,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                    this case is ok - if we are at server EOF 
                                    we will hit it on next read */
 
-                        /* while (!list_empty(page_list) && (i < num_pages)) {
-                                        page = list_entry(page_list->prev, 
-                                                          struct page, list);
-                                        list_del(&page->list);
-                                        page_cache_release(page);
-                                }
-                                break; */
+                                /* break; */
                         }
                 } else {
                         cFYI(1, ("No bytes read (%d) at offset %lld . "
@@ -1845,14 +1836,6 @@ static int cifs_readpages(struct file *file, struct address_space *mapping,
                                  bytes_read, offset));
                         /* BB turn off caching and do new lookup on 
                            file size at server? */
-                        while (!list_empty(page_list) && (i < num_pages)) {
-                                page = list_entry(page_list->prev, struct page,
-                                                  lru);
-                                list_del(&page->lru);
-
-                                /* BB removeme - replace with zero of page? */
-                                page_cache_release(page);
-                        }
                         break;
                 }
                 if (smb_read_data) {
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 6b90ef98e4cf..1ad8c9fcc742 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -337,6 +337,7 @@ int cifs_get_inode_info(struct inode **pinode,
                 pfindData = (FILE_ALL_INFO *)buf;
                 /* could do find first instead but this returns more info */
                 rc = CIFSSMBQPathInfo(xid, pTcon, search_path, pfindData,
+                              0 /* not legacy */,
                               cifs_sb->local_nls, cifs_sb->mnt_cifs_flags &
                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
                 /* BB optimize code so we do not make the above call
@@ -384,8 +385,10 @@ int cifs_get_inode_info(struct inode **pinode,
                 /* get new inode */
                 if (*pinode == NULL) {
                         *pinode = new_inode(sb);
-                        if (*pinode == NULL)
+                        if (*pinode == NULL) {
+                                kfree(buf);
                                 return -ENOMEM;
+                        }
                         /* Is an i_ino of zero legal? Can we use that to check
                            if the server supports returning inode numbers?  Are
                            there other sanity checks we can use to ensure that
@@ -431,8 +434,11 @@ int cifs_get_inode_info(struct inode **pinode,
                 (pTcon->ses->server->maxBuf - MAX_CIFS_HDR_SIZE) & 0xFFFFFE00;*/
 
                 /* Linux can not store file creation time so ignore it */
-                inode->i_atime =
-                    cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastAccessTime));
+                if(pfindData->LastAccessTime)
+                        inode->i_atime = cifs_NTtimeToUnix
+                                (le64_to_cpu(pfindData->LastAccessTime));
+                else /* do not need to use current_fs_time - time not stored */
+                        inode->i_atime = CURRENT_TIME;
                 inode->i_mtime =
                     cifs_NTtimeToUnix(le64_to_cpu(pfindData->LastWriteTime));
                 inode->i_ctime =
@@ -879,10 +885,14 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                         kmalloc(2 * sizeof(FILE_UNIX_BASIC_INFO), GFP_KERNEL);
                 if (info_buf_source != NULL) {
                         info_buf_target = info_buf_source + 1;
-                        rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
-                                info_buf_source, cifs_sb_source->local_nls, 
-                                cifs_sb_source->mnt_cifs_flags &
-                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
+                        if (pTcon->ses->capabilities & CAP_UNIX)
+                                rc = CIFSSMBUnixQPathInfo(xid, pTcon, fromName,
+                                        info_buf_source, 
+                                        cifs_sb_source->local_nls,
+                                        cifs_sb_source->mnt_cifs_flags &
+                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+                        /* else rc is still EEXIST so will fall through to
+                           unlink the target and retry rename */
                         if (rc == 0) {
                                 rc = CIFSSMBUnixQPathInfo(xid, pTcon, toName,
                                                 info_buf_target,
@@ -931,7 +941,7 @@ int cifs_rename(struct inode *source_inode, struct dentry *source_direntry,
                                  cifs_sb_source->mnt_cifs_flags & 
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if (rc==0) {
-                        CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
+                        rc = CIFSSMBRenameOpenFile(xid, pTcon, netfid, toName,
                                               cifs_sb_source->local_nls, 
                                               cifs_sb_source->mnt_cifs_flags &
                                                 CIFS_MOUNT_MAP_SPECIAL_CHR);
@@ -1079,8 +1089,10 @@ int cifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         struct kstat *stat)
 {
         int err = cifs_revalidate(dentry);
-        if (!err)
+        if (!err) {
                 generic_fillattr(dentry->d_inode, stat);
+                stat->blksize = CIFS_MAX_MSGSIZE;
+        }
         return err;
 }
 
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index a57f5d6e6213..0bee8b7e521a 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -254,7 +254,11 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
                                 tmpbuffer,
                                 len - 1,
                                 cifs_sb->local_nls);
-        else {
+        else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL) {
+                cERROR(1,("SFU style symlinks not implemented yet"));
+                /* add open and read as in fs/cifs/inode.c */
+        
+        } else {
                 rc = CIFSSMBOpen(xid, pTcon, full_path, FILE_OPEN, GENERIC_READ,
                                 OPEN_REPARSE_POINT,&fid, &oplock, NULL, 
                                 cifs_sb->local_nls, 
diff --git a/fs/cifs/md5.c b/fs/cifs/md5.c
index 7aa23490541f..ccebf9b7eb86 100644
--- a/fs/cifs/md5.c
+++ b/fs/cifs/md5.c
@@ -252,10 +252,11 @@ MD5Transform(__u32 buf[4], __u32 const in[16])
         buf[3] += d;
 }
 
+#if 0   /* currently unused */
 /***********************************************************************
  the rfc 2104 version of hmac_md5 initialisation.
 ***********************************************************************/
-void
+static void
 hmac_md5_init_rfc2104(unsigned char *key, int key_len,
                       struct HMACMD5Context *ctx)
 {
@@ -289,6 +290,7 @@ hmac_md5_init_rfc2104(unsigned char *key, int key_len,
         MD5Init(&ctx->ctx);
         MD5Update(&ctx->ctx, ctx->k_ipad, 64);
 }
+#endif
 
 /***********************************************************************
  the microsoft version of hmac_md5 initialisation.
@@ -350,7 +352,8 @@ hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx)
  single function to calculate an HMAC MD5 digest from data.
  use the microsoft hmacmd5 init method because the key is 16 bytes.
 ************************************************************/
-void
+#if 0 /* currently unused */
+static void
 hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
          unsigned char *digest)
 {
@@ -361,3 +364,4 @@ hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
         }
         hmac_md5_final(digest, &ctx);
 }
+#endif
diff --git a/fs/cifs/md5.h b/fs/cifs/md5.h
index 00e1c5394fe1..f7d4f4197bac 100644
--- a/fs/cifs/md5.h
+++ b/fs/cifs/md5.h
@@ -27,12 +27,12 @@ void MD5Final(unsigned char digest[16], struct MD5Context *context);
 
 /* The following definitions come from lib/hmacmd5.c  */
 
-void hmac_md5_init_rfc2104(unsigned char *key, int key_len,
-                        struct HMACMD5Context *ctx);
+/* void hmac_md5_init_rfc2104(unsigned char *key, int key_len,
+                        struct HMACMD5Context *ctx);*/
 void hmac_md5_init_limK_to_64(const unsigned char *key, int key_len,
                         struct HMACMD5Context *ctx);
 void hmac_md5_update(const unsigned char *text, int text_len,
                         struct HMACMD5Context *ctx);
 void hmac_md5_final(unsigned char *digest, struct HMACMD5Context *ctx);
-void hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
-                        unsigned char *digest);
+/* void hmac_md5(unsigned char key[16], unsigned char *data, int data_len,
+                        unsigned char *digest);*/
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 22c937e5884f..bbc9cd34b6ea 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -389,7 +389,7 @@ header_assemble(struct smb_hdr *buffer, char smb_command /* command */ ,
         return;
 }
 
-int
+static int
 checkSMBhdr(struct smb_hdr *smb, __u16 mid)
 {
         /* Make sure that this really is an SMB, that it is a response, 
@@ -418,26 +418,42 @@ checkSMBhdr(struct smb_hdr *smb, __u16 mid)
 }
 
 int
-checkSMB(struct smb_hdr *smb, __u16 mid, int length)
+checkSMB(struct smb_hdr *smb, __u16 mid, unsigned int length)
 {
         __u32 len = smb->smb_buf_length;
         __u32 clc_len;  /* calculated length */
         cFYI(0, ("checkSMB Length: 0x%x, smb_buf_length: 0x%x", length, len));
-        if (((unsigned int)length < 2 + sizeof (struct smb_hdr)) ||
-            (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)) {
-                if ((unsigned int)length < 2 + sizeof (struct smb_hdr)) {
-                        if (((unsigned int)length >= 
-                                sizeof (struct smb_hdr) - 1)
+
+        if (length < 2 + sizeof (struct smb_hdr)) {
+                if ((length >= sizeof (struct smb_hdr) - 1)
                             && (smb->Status.CifsError != 0)) {
-                                smb->WordCount = 0;
-                                /* some error cases do not return wct and bcc */
+                        smb->WordCount = 0;
+                        /* some error cases do not return wct and bcc */
+                        return 0;
+                } else if ((length == sizeof(struct smb_hdr) + 1) && 
+                                (smb->WordCount == 0)) {
+                        char * tmp = (char *)smb;
+                        /* Need to work around a bug in two servers here */
+                        /* First, check if the part of bcc they sent was zero */
+                        if (tmp[sizeof(struct smb_hdr)] == 0) {
+                                /* some servers return only half of bcc
+                                 * on simple responses (wct, bcc both zero)
+                                 * in particular have seen this on
+                                 * ulogoffX and FindClose. This leaves
+                                 * one byte of bcc potentially unitialized
+                                 */
+                                /* zero rest of bcc */
+                                tmp[sizeof(struct smb_hdr)+1] = 0;
                                 return 0;
-                        } else {
-                                cERROR(1, ("Length less than smb header size"));
                         }
+                        cERROR(1,("rcvd invalid byte count (bcc)"));
+                } else {
+                        cERROR(1, ("Length less than smb header size"));
                 }
-                if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4)
-                        cERROR(1, ("smb length greater than MaxBufSize, mid=%d",
+                return 1;
+        }
+        if (len > CIFSMaxBufSize + MAX_CIFS_HDR_SIZE - 4) {
+                cERROR(1, ("smb length greater than MaxBufSize, mid=%d",
                                    smb->Mid));
                 return 1;
         }
@@ -446,7 +462,7 @@ checkSMB(struct smb_hdr *smb, __u16 mid, int length)
                 return 1;
         clc_len = smbCalcSize_LE(smb);
 
-        if(4 + len != (unsigned int)length) {
+        if(4 + len != length) {
                 cERROR(1, ("Length read does not match RFC1001 length %d",len));
                 return 1;
         }
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index ce87550e918f..992e80edc720 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -909,3 +909,61 @@ cifs_UnixTimeToNT(struct timespec t)
         /* Convert to 100ns intervals and then add the NTFS time offset. */
         return (u64) t.tv_sec * 10000000 + t.tv_nsec/100 + NTFS_TIME_OFFSET;
 }
+
+static int total_days_of_prev_months[] =
+{0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334};
+
+
+__le64 cnvrtDosCifsTm(__u16 date, __u16 time)
+{
+        return cpu_to_le64(cifs_UnixTimeToNT(cnvrtDosUnixTm(date, time)));
+}
+
+struct timespec cnvrtDosUnixTm(__u16 date, __u16 time)
+{
+        struct timespec ts;
+        int sec, min, days, month, year;
+        SMB_TIME * st = (SMB_TIME *)&time;
+        SMB_DATE * sd = (SMB_DATE *)&date;
+
+        cFYI(1,("date %d time %d",date, time));
+
+        sec = 2 * st->TwoSeconds;
+        min = st->Minutes;
+        if((sec > 59) || (min > 59))
+                cERROR(1,("illegal time min %d sec %d", min, sec));
+        sec += (min * 60);
+        sec += 60 * 60 * st->Hours;
+        if(st->Hours > 24)
+                cERROR(1,("illegal hours %d",st->Hours));
+        days = sd->Day;
+        month = sd->Month;
+        if((days > 31) || (month > 12))
+                cERROR(1,("illegal date, month %d day: %d", month, days));
+        month -= 1;
+        days += total_days_of_prev_months[month];
+        days += 3652; /* account for difference in days between 1980 and 1970 */
+        year = sd->Year;
+        days += year * 365;
+        days += (year/4); /* leap year */
+        /* generalized leap year calculation is more complex, ie no leap year
+        for years/100 except for years/400, but since the maximum number for DOS
+         year is 2**7, the last year is 1980+127, which means we need only
+         consider 2 special case years, ie the years 2000 and 2100, and only
+         adjust for the lack of leap year for the year 2100, as 2000 was a 
+         leap year (divisable by 400) */
+        if(year >= 120)  /* the year 2100 */
+                days = days - 1;  /* do not count leap year for the year 2100 */
+
+        /* adjust for leap year where we are still before leap day */
+        if(year != 120)
+                days -= ((year & 0x03) == 0) && (month < 2 ? 1 : 0);
+        sec += 24 * 60 * 60 * days; 
+
+        ts.tv_sec = sec;
+
+        /* cFYI(1,("sec after cnvrt dos to unix time %d",sec)); */
+
+        ts.tv_nsec = 0;
+        return ts;
+} 
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index b27b34537bf2..ed18c3965f7b 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -106,6 +106,17 @@ static int construct_dentry(struct qstr *qstring, struct file *file,
         return rc;
 }
 
+static void AdjustForTZ(struct cifsTconInfo * tcon, struct inode * inode)
+{
+        if((tcon) && (tcon->ses) && (tcon->ses->server)) {
+                inode->i_ctime.tv_sec += tcon->ses->server->timeAdj;
+                inode->i_mtime.tv_sec += tcon->ses->server->timeAdj;
+                inode->i_atime.tv_sec += tcon->ses->server->timeAdj;
+        }
+        return;
+}
+
+
 static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
                 char * buf, int *pobject_type, int isNewInode)
 {
@@ -135,16 +146,23 @@ static void fill_in_inode(struct inode *tmp_inode, int new_buf_type,
                 tmp_inode->i_ctime =
                       cifs_NTtimeToUnix(le64_to_cpu(pfindData->ChangeTime));
         } else { /* legacy, OS2 and DOS style */
+/*              struct timespec ts;*/
                 FIND_FILE_STANDARD_INFO * pfindData = 
                         (FIND_FILE_STANDARD_INFO *)buf;
 
+                tmp_inode->i_mtime = cnvrtDosUnixTm(
+                                le16_to_cpu(pfindData->LastWriteDate),
+                                le16_to_cpu(pfindData->LastWriteTime));
+                tmp_inode->i_atime = cnvrtDosUnixTm(
+                                le16_to_cpu(pfindData->LastAccessDate),
+                                le16_to_cpu(pfindData->LastAccessTime));
+                tmp_inode->i_ctime = cnvrtDosUnixTm(
+                                le16_to_cpu(pfindData->LastWriteDate),
+                                le16_to_cpu(pfindData->LastWriteTime));
+                AdjustForTZ(cifs_sb->tcon, tmp_inode);
                 attr = le16_to_cpu(pfindData->Attributes);
                 allocation_size = le32_to_cpu(pfindData->AllocationSize);
                 end_of_file = le32_to_cpu(pfindData->DataSize);
-                tmp_inode->i_atime = CURRENT_TIME;
-                /* tmp_inode->i_mtime =  BB FIXME - add dos time handling
-                tmp_inode->i_ctime = 0;   BB FIXME */
-
         }
 
         /* Linux can not store file creation time unfortunately so ignore it */
@@ -878,6 +896,10 @@ static int cifs_filldir(char *pfindEntry, struct file *file,
                      tmp_inode->i_ino,obj_type);
         if(rc) {
                 cFYI(1,("filldir rc = %d",rc));
+                /* we can not return filldir errors to the caller
+                since they are "normal" when the stat blocksize
+                is too small - we return remapped error instead */
+                rc = -EOVERFLOW;
         }
 
         dput(tmp_dentry);
@@ -938,6 +960,7 @@ static int cifs_save_resume_key(const char *current_entry,
                 filename = &pFindData->FileName[0];
                 /* one byte length, no name conversion */
                 len = (unsigned int)pFindData->FileNameLength;
+                cifsFile->srch_inf.resume_key = pFindData->ResumeKey;
         } else {
                 cFYI(1,("Unknown findfirst level %d",level));
                 return -EINVAL;
@@ -1055,6 +1078,11 @@ int cifs_readdir(struct file *file, void *direntry, filldir_t filldir)
                         we want to check for that here? */
                         rc = cifs_filldir(current_entry, file,
                                         filldir, direntry, tmp_buf, max_len);
+                        if(rc == -EOVERFLOW) {
+                                rc = 0;
+                                break;
+                        }
+
                         file->f_pos++;
                         if(file->f_pos == 
                                 cifsFile->srch_inf.index_of_last_entry) {
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 22b4c35dcfe3..bbdda99dce61 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -90,7 +90,9 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
         } */
         /* copy user */
         if(ses->userName == NULL) {
-                /* BB what about null user mounts - check that we do this BB */
+                /* null user mount */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
         } else { /* 300 should be long enough for any conceivable user name */
                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
                                           300, nls_cp);
@@ -98,10 +100,13 @@ static void unicode_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
         bcc_ptr += 2 * bytes_ret;
         bcc_ptr += 2; /* account for null termination */
         /* copy domain */
-        if(ses->domainName == NULL)
-                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr,
-                                          "CIFS_LINUX_DOM", 32, nls_cp);
-        else
+        if(ses->domainName == NULL) {
+                /* Sending null domain better than using a bogus domain name (as
+                we did briefly in 2.6.18) since server will use its default */
+                *bcc_ptr = 0;
+                *(bcc_ptr+1) = 0;
+                bytes_ret = 0;
+        } else
                 bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName, 
                                           256, nls_cp);
         bcc_ptr += 2 * bytes_ret;
@@ -144,13 +149,11 @@ static void ascii_ssetup_strings(char ** pbcc_area, struct cifsSesInfo *ses,
 
         /* copy domain */
         
-        if(ses->domainName == NULL) {
-                strcpy(bcc_ptr, "CIFS_LINUX_DOM");
-                bcc_ptr += 14;  /* strlen(CIFS_LINUX_DOM) */
-        } else {
+        if(ses->domainName != NULL) {
                 strncpy(bcc_ptr, ses->domainName, 256); 
                 bcc_ptr += strnlen(ses->domainName, 256);
-        }
+        } /* else we will send a null domain name 
+             so the server will default to its own domain */
         *bcc_ptr = 0;
         bcc_ptr++;
 
@@ -268,6 +271,10 @@ static int decode_ascii_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo
         ses->serverOS = kzalloc(len + 1, GFP_KERNEL);
         if(ses->serverOS)
                 strncpy(ses->serverOS, bcc_ptr, len);
+        if(strncmp(ses->serverOS, "OS/2",4) == 0) {
+                        cFYI(1,("OS/2 server"));
+                        ses->flags |= CIFS_SES_OS2;
+        }
 
         bcc_ptr += len + 1;
         bleft -= len + 1;
@@ -290,16 +297,11 @@ static int decode_ascii_ssetup(char ** pbcc_area, int bleft, struct cifsSesInfo
         if(len > bleft)
                 return rc;
 
-        if(ses->serverDomain)
-                kfree(ses->serverDomain);
-
-        ses->serverDomain = kzalloc(len + 1, GFP_KERNEL);
-        if(ses->serverOS)
-                strncpy(ses->serverOS, bcc_ptr, len);
-
-        bcc_ptr += len + 1;
-        bleft -= len + 1;
-
+        /* No domain field in LANMAN case. Domain is
+           returned by old servers in the SMB negprot response */
+        /* BB For newer servers which do not support Unicode,
+           but thus do return domain here we could add parsing
+           for it later, but it is not very important */
         cFYI(1,("ascii: bytes left %d",bleft));
 
         return rc;
@@ -366,6 +368,8 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
         str_area = kmalloc(2000, GFP_KERNEL);
         bcc_ptr = str_area;
 
+        ses->flags &= ~CIFS_SES_LANMAN;
+
         if(type == LANMAN) {
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
                 char lnm_session_key[CIFS_SESS_KEY_SIZE];
@@ -377,7 +381,7 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, int first_time,
                 /* and copy into bcc */
 
                 calc_lanman_hash(ses, lnm_session_key);
-
+                ses->flags |= CIFS_SES_LANMAN; 
 /* #ifdef CONFIG_CIFS_DEBUG2
                 cifs_dump_mem("cryptkey: ",ses->server->cryptKey,
                         CIFS_SESS_KEY_SIZE);
diff --git a/fs/cifs/smbdes.c b/fs/cifs/smbdes.c
index efaa044523a7..7a1b2b961ec8 100644
--- a/fs/cifs/smbdes.c
+++ b/fs/cifs/smbdes.c
@@ -364,20 +364,20 @@ E_P24(unsigned char *p21, unsigned char *c8, unsigned char *p24)
         smbhash(p24 + 16, c8, p21 + 14, 1);
 }
 
-void
+#if 0 /* currently unsued */
+static void
 D_P16(unsigned char *p14, unsigned char *in, unsigned char *out)
 {
         smbhash(out, in, p14, 0);
         smbhash(out + 8, in + 8, p14 + 7, 0);
 }
 
-void
+static void
 E_old_pw_hash(unsigned char *p14, unsigned char *in, unsigned char *out)
 {
         smbhash(out, in, p14, 1);
         smbhash(out + 8, in + 8, p14 + 7, 1);
 }
-#if 0
 /* these routines are currently unneeded, but may be
         needed later */
 void
diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c
index f518c5e45035..4b25ba92180d 100644
--- a/fs/cifs/smbencrypt.c
+++ b/fs/cifs/smbencrypt.c
@@ -51,11 +51,8 @@
 
 void SMBencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24);
 void E_md4hash(const unsigned char *passwd, unsigned char *p16);
-void nt_lm_owf_gen(char *pwd, unsigned char nt_p16[16], unsigned char p16[16]);
 static void SMBOWFencrypt(unsigned char passwd[16], unsigned char *c8,
                    unsigned char p24[24]);
-void NTLMSSPOWFencrypt(unsigned char passwd[8],
-                       unsigned char *ntlmchalresp, unsigned char p24[24]);
 void SMBNTencrypt(unsigned char *passwd, unsigned char *c8, unsigned char *p24);
 
 /*
@@ -144,8 +141,9 @@ E_md4hash(const unsigned char *passwd, unsigned char *p16)
         memset(wpwd,0,129 * 2);
 }
 
+#if 0 /* currently unused */
 /* Does both the NT and LM owfs of a user's password */
-void
+static void
 nt_lm_owf_gen(char *pwd, unsigned char nt_p16[16], unsigned char p16[16])
 {
         char passwd[514];
@@ -171,6 +169,7 @@ nt_lm_owf_gen(char *pwd, unsigned char nt_p16[16], unsigned char p16[16])
         /* clear out local copy of user's password (just being paranoid). */
         memset(passwd, '\0', sizeof (passwd));
 }
+#endif
 
 /* Does the NTLMv2 owfs of a user's password */
 #if 0  /* function not needed yet - but will be soon */
@@ -223,7 +222,8 @@ SMBOWFencrypt(unsigned char passwd[16], unsigned char *c8,
 }
 
 /* Does the des encryption from the FIRST 8 BYTES of the NT or LM MD4 hash. */
-void
+#if 0 /* currently unused */
+static void
 NTLMSSPOWFencrypt(unsigned char passwd[8],
                   unsigned char *ntlmchalresp, unsigned char p24[24])
 {
@@ -235,6 +235,7 @@ NTLMSSPOWFencrypt(unsigned char passwd[8],
 
         E_P24(p21, ntlmchalresp, p24);
 }
+#endif
 
 /* Does the NT MD4 hash then des encryption. */
 
diff --git a/fs/compat.c b/fs/compat.c
index 50624d4a70c6..8d0a0018a7d2 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1835,9 +1835,12 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
 
         } while (!ret && !timeout && tsp && (ts.tv_sec || ts.tv_nsec));
 
-        if (ret == 0 && tsp && !(current->personality & STICKY_TIMEOUTS)) {
+        if (tsp) {
                 struct compat_timespec rts;
 
+                if (current->personality & STICKY_TIMEOUTS)
+                        goto sticky;
+
                 rts.tv_sec = timeout / HZ;
                 rts.tv_nsec = (timeout % HZ) * (NSEC_PER_SEC/HZ);
                 if (rts.tv_nsec >= NSEC_PER_SEC) {
@@ -1846,8 +1849,19 @@ asmlinkage long compat_sys_pselect7(int n, compat_ulong_t __user *inp,
                 }
                 if (compat_timespec_compare(&rts, &ts) >= 0)
                         rts = ts;
-                if (copy_to_user(tsp, &rts, sizeof(rts)))
-                        ret = -EFAULT;
+                if (copy_to_user(tsp, &rts, sizeof(rts))) {
+sticky:
+                        /*
+                         * If an application puts its timeval in read-only
+                         * memory, we don't want the Linux-specific update to
+                         * the timeval to cause a fault after the select has
+                         * completed successfully. However, because we're not
+                         * updating the timeval, we can't restart the system
+                         * call.
+                         */
+                        if (ret == -ERESTARTNOHAND)
+                                ret = -EINTR;
+                }
         }
 
         if (ret == -ERESTARTNOHAND) {
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 27ca1aa30562..a91f2628c981 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -2438,13 +2438,17 @@ HANDLE_IOCTL(0x1260, broken_blkgetsize)
 HANDLE_IOCTL(BLKFRAGET, w_long)
 HANDLE_IOCTL(BLKSECTGET, w_long)
 HANDLE_IOCTL(BLKPG, blkpg_ioctl_trans)
-HANDLE_IOCTL(HDIO_GET_KEEPSETTINGS, hdio_ioctl_trans)
 HANDLE_IOCTL(HDIO_GET_UNMASKINTR, hdio_ioctl_trans)
-HANDLE_IOCTL(HDIO_GET_DMA, hdio_ioctl_trans)
-HANDLE_IOCTL(HDIO_GET_32BIT, hdio_ioctl_trans)
 HANDLE_IOCTL(HDIO_GET_MULTCOUNT, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_KEEPSETTINGS, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_32BIT, hdio_ioctl_trans)
 HANDLE_IOCTL(HDIO_GET_NOWERR, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_DMA, hdio_ioctl_trans)
 HANDLE_IOCTL(HDIO_GET_NICE, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_WCACHE, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_ACOUSTIC, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_ADDRESS, hdio_ioctl_trans)
+HANDLE_IOCTL(HDIO_GET_BUSSTATE, hdio_ioctl_trans)
 HANDLE_IOCTL(FDSETPRM32, fd_ioctl_trans)
 HANDLE_IOCTL(FDDEFPRM32, fd_ioctl_trans)
 HANDLE_IOCTL(FDGETPRM32, fd_ioctl_trans)
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index e6d5754a715e..cf33fac68c84 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -275,13 +275,14 @@ static int check_perm(struct inode * inode, struct file * file)
          * it in file->private_data for easy access.
          */
         buffer = kzalloc(sizeof(struct configfs_buffer),GFP_KERNEL);
-        if (buffer) {
-                init_MUTEX(&buffer->sem);
-                buffer->needs_read_fill = 1;
-                buffer->ops = ops;
-                file->private_data = buffer;
-        } else
+        if (!buffer) {
                 error = -ENOMEM;
+                goto Enomem;
+        }
+        init_MUTEX(&buffer->sem);
+        buffer->needs_read_fill = 1;
+        buffer->ops = ops;
+        file->private_data = buffer;
         goto Done;
 
  Einval:
@@ -289,6 +290,7 @@ static int check_perm(struct inode * inode, struct file * file)
         goto Done;
  Eaccess:
         error = -EACCES;
+ Enomem:
         module_put(attr->ca_owner);
  Done:
         if (error && item)
diff --git a/fs/dcache.c b/fs/dcache.c
index 2355bddad8de..fd4a428998ef 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -478,11 +478,12 @@ static void prune_dcache(int count, struct super_block *sb)
                         up_read(s_umount);
                 }
                 spin_unlock(&dentry->d_lock);
-                /* Cannot remove the first dentry, and it isn't appropriate
-                 * to move it to the head of the list, so give up, and try
-                 * later
+                /*
+                 * Insert dentry at the head of the list as inserting at the
+                 * tail leads to a cycle.
                  */
-                break;
+                list_add(&dentry->d_lru, &dentry_unused);
+                dentry_stat.nr_unused++;
         }
         spin_unlock(&dcache_lock);
 }
@@ -549,6 +550,142 @@ repeat:
 }
 
 /*
+ * destroy a single subtree of dentries for unmount
+ * - see the comments on shrink_dcache_for_umount() for a description of the
+ *   locking
+ */
+static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
+{
+        struct dentry *parent;
+        unsigned detached = 0;
+
+        BUG_ON(!IS_ROOT(dentry));
+
+        /* detach this root from the system */
+        spin_lock(&dcache_lock);
+        if (!list_empty(&dentry->d_lru)) {
+                dentry_stat.nr_unused--;
+                list_del_init(&dentry->d_lru);
+        }
+        __d_drop(dentry);
+        spin_unlock(&dcache_lock);
+
+        for (;;) {
+                /* descend to the first leaf in the current subtree */
+                while (!list_empty(&dentry->d_subdirs)) {
+                        struct dentry *loop;
+
+                        /* this is a branch with children - detach all of them
+                         * from the system in one go */
+                        spin_lock(&dcache_lock);
+                        list_for_each_entry(loop, &dentry->d_subdirs,
+                                            d_u.d_child) {
+                                if (!list_empty(&loop->d_lru)) {
+                                        dentry_stat.nr_unused--;
+                                        list_del_init(&loop->d_lru);
+                                }
+
+                                __d_drop(loop);
+                                cond_resched_lock(&dcache_lock);
+                        }
+                        spin_unlock(&dcache_lock);
+
+                        /* move to the first child */
+                        dentry = list_entry(dentry->d_subdirs.next,
+                                            struct dentry, d_u.d_child);
+                }
+
+                /* consume the dentries from this leaf up through its parents
+                 * until we find one with children or run out altogether */
+                do {
+                        struct inode *inode;
+
+                        if (atomic_read(&dentry->d_count) != 0) {
+                                printk(KERN_ERR
+                                       "BUG: Dentry %p{i=%lx,n=%s}"
+                                       " still in use (%d)"
+                                       " [unmount of %s %s]\n",
+                                       dentry,
+                                       dentry->d_inode ?
+                                       dentry->d_inode->i_ino : 0UL,
+                                       dentry->d_name.name,
+                                       atomic_read(&dentry->d_count),
+                                       dentry->d_sb->s_type->name,
+                                       dentry->d_sb->s_id);
+                                BUG();
+                        }
+
+                        parent = dentry->d_parent;
+                        if (parent == dentry)
+                                parent = NULL;
+                        else
+                                atomic_dec(&parent->d_count);
+
+                        list_del(&dentry->d_u.d_child);
+                        detached++;
+
+                        inode = dentry->d_inode;
+                        if (inode) {
+                                dentry->d_inode = NULL;
+                                list_del_init(&dentry->d_alias);
+                                if (dentry->d_op && dentry->d_op->d_iput)
+                                        dentry->d_op->d_iput(dentry, inode);
+                                else
+                                        iput(inode);
+                        }
+
+                        d_free(dentry);
+
+                        /* finished when we fall off the top of the tree,
+                         * otherwise we ascend to the parent and move to the
+                         * next sibling if there is one */
+                        if (!parent)
+                                goto out;
+
+                        dentry = parent;
+
+                } while (list_empty(&dentry->d_subdirs));
+
+                dentry = list_entry(dentry->d_subdirs.next,
+                                    struct dentry, d_u.d_child);
+        }
+out:
+        /* several dentries were freed, need to correct nr_dentry */
+        spin_lock(&dcache_lock);
+        dentry_stat.nr_dentry -= detached;
+        spin_unlock(&dcache_lock);
+}
+
+/*
+ * destroy the dentries attached to a superblock on unmounting
+ * - we don't need to use dentry->d_lock, and only need dcache_lock when
+ *   removing the dentry from the system lists and hashes because:
+ *   - the superblock is detached from all mountings and open files, so the
+ *     dentry trees will not be rearranged by the VFS
+ *   - s_umount is write-locked, so the memory pressure shrinker will ignore
+ *     any dentries belonging to this superblock that it comes across
+ *   - the filesystem itself is no longer permitted to rearrange the dentries
+ *     in this superblock
+ */
+void shrink_dcache_for_umount(struct super_block *sb)
+{
+        struct dentry *dentry;
+
+        if (down_read_trylock(&sb->s_umount))
+                BUG();
+
+        dentry = sb->s_root;
+        sb->s_root = NULL;
+        atomic_dec(&dentry->d_count);
+        shrink_dcache_for_umount_subtree(dentry);
+
+        while (!hlist_empty(&sb->s_anon)) {
+                dentry = hlist_entry(sb->s_anon.first, struct dentry, d_hash);
+                shrink_dcache_for_umount_subtree(dentry);
+        }
+}
+
+/*
  * Search for at least 1 mount point in the dentry's subdirs.
  * We descend to the next level whenever the d_subdirs
  * list is non-empty and continue searching.
@@ -1339,23 +1476,21 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
  * deleted it.
  */
  
-/**
- * d_move - move a dentry
+/*
+ * d_move_locked - move a dentry
  * @dentry: entry to move
  * @target: new dentry
  *
  * Update the dcache to reflect the move of a file name. Negative
  * dcache entries should not be moved in this way.
  */
-
-void d_move(struct dentry * dentry, struct dentry * target)
+static void d_move_locked(struct dentry * dentry, struct dentry * target)
 {
         struct hlist_head *list;
 
         if (!dentry->d_inode)
                 printk(KERN_WARNING "VFS: moving negative dcache entry\n");
 
-        spin_lock(&dcache_lock);
         write_seqlock(&rename_lock);
         /*
          * XXXX: do we really need to take target->d_lock?
@@ -1406,7 +1541,81 @@ already_unhashed:
         fsnotify_d_move(dentry);
         spin_unlock(&dentry->d_lock);
         write_sequnlock(&rename_lock);
+}
+
+/**
+ * d_move - move a dentry
+ * @dentry: entry to move
+ * @target: new dentry
+ *
+ * Update the dcache to reflect the move of a file name. Negative
+ * dcache entries should not be moved in this way.
+ */
+
+void d_move(struct dentry * dentry, struct dentry * target)
+{
+        spin_lock(&dcache_lock);
+        d_move_locked(dentry, target);
+        spin_unlock(&dcache_lock);
+}
+
+/*
+ * Helper that returns 1 if p1 is a parent of p2, else 0
+ */
+static int d_isparent(struct dentry *p1, struct dentry *p2)
+{
+        struct dentry *p;
+
+        for (p = p2; p->d_parent != p; p = p->d_parent) {
+                if (p->d_parent == p1)
+                        return 1;
+        }
+        return 0;
+}
+
+/*
+ * This helper attempts to cope with remotely renamed directories
+ *
+ * It assumes that the caller is already holding
+ * dentry->d_parent->d_inode->i_mutex and the dcache_lock
+ *
+ * Note: If ever the locking in lock_rename() changes, then please
+ * remember to update this too...
+ *
+ * On return, dcache_lock will have been unlocked.
+ */
+static struct dentry *__d_unalias(struct dentry *dentry, struct dentry *alias)
+{
+        struct mutex *m1 = NULL, *m2 = NULL;
+        struct dentry *ret;
+
+        /* If alias and dentry share a parent, then no extra locks required */
+        if (alias->d_parent == dentry->d_parent)
+                goto out_unalias;
+
+        /* Check for loops */
+        ret = ERR_PTR(-ELOOP);
+        if (d_isparent(alias, dentry))
+                goto out_err;
+
+        /* See lock_rename() */
+        ret = ERR_PTR(-EBUSY);
+        if (!mutex_trylock(&dentry->d_sb->s_vfs_rename_mutex))
+                goto out_err;
+        m1 = &dentry->d_sb->s_vfs_rename_mutex;
+        if (!mutex_trylock(&alias->d_parent->d_inode->i_mutex))
+                goto out_err;
+        m2 = &alias->d_parent->d_inode->i_mutex;
+out_unalias:
+        d_move_locked(alias, dentry);
+        ret = alias;
+out_err:
         spin_unlock(&dcache_lock);
+        if (m2)
+                mutex_unlock(m2);
+        if (m1)
+                mutex_unlock(m1);
+        return ret;
 }
 
 /*
@@ -1451,7 +1660,7 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
  */
 struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
 {
-        struct dentry *alias, *actual;
+        struct dentry *actual;
 
         BUG_ON(!d_unhashed(dentry));
 
@@ -1463,26 +1672,27 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                 goto found_lock;
         }
 
-        /* See if a disconnected directory already exists as an anonymous root
-         * that we should splice into the tree instead */
-        if (S_ISDIR(inode->i_mode) && (alias = __d_find_alias(inode, 1))) {
-                spin_lock(&alias->d_lock);
-
-                /* Is this a mountpoint that we could splice into our tree? */
-                if (IS_ROOT(alias))
-                        goto connect_mountpoint;
-
-                if (alias->d_name.len == dentry->d_name.len &&
-                    alias->d_parent == dentry->d_parent &&
-                    memcmp(alias->d_name.name,
-                           dentry->d_name.name,
-                           dentry->d_name.len) == 0)
-                        goto replace_with_alias;
-
-                spin_unlock(&alias->d_lock);
-
-                /* Doh! Seem to be aliasing directories for some reason... */
-                dput(alias);
+        if (S_ISDIR(inode->i_mode)) {
+                struct dentry *alias;
+
+                /* Does an aliased dentry already exist? */
+                alias = __d_find_alias(inode, 0);
+                if (alias) {
+                        actual = alias;
+                        /* Is this an anonymous mountpoint that we could splice
+                         * into our tree? */
+                        if (IS_ROOT(alias)) {
+                                spin_lock(&alias->d_lock);
+                                __d_materialise_dentry(dentry, alias);
+                                __d_drop(alias);
+                                goto found;
+                        }
+                        /* Nope, but we must(!) avoid directory aliasing */
+                        actual = __d_unalias(dentry, alias);
+                        if (IS_ERR(actual))
+                                dput(alias);
+                        goto out_nolock;
+                }
         }
 
         /* Add a unique reference */
@@ -1498,7 +1708,7 @@ found:
         _d_rehash(actual);
         spin_unlock(&actual->d_lock);
         spin_unlock(&dcache_lock);
-
+out_nolock:
         if (actual == dentry) {
                 security_d_instantiate(dentry, inode);
                 return NULL;
@@ -1507,16 +1717,6 @@ found:
         iput(inode);
         return actual;
 
-        /* Convert the anonymous/root alias into an ordinary dentry */
-connect_mountpoint:
-        __d_materialise_dentry(dentry, alias);
-
-        /* Replace the candidate dentry with the alias in the tree */
-replace_with_alias:
-        __d_drop(alias);
-        actual = alias;
-        goto found;
-
 shouldnt_be_hashed:
         spin_unlock(&dcache_lock);
         BUG();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index e77676df6713..a736d44989c4 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -147,13 +147,13 @@ static int debugfs_create_by_name(const char *name, mode_t mode,
         *dentry = NULL;
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                 if ((mode & S_IFMT) == S_IFDIR)
                         error = debugfs_mkdir(parent->d_inode, *dentry, mode);
                 else 
                         error = debugfs_create(parent->d_inode, *dentry, mode);
         } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         return error;
diff --git a/fs/dlm/Kconfig b/fs/dlm/Kconfig
index 490f85b3fa59..81b2c6465eeb 100644
--- a/fs/dlm/Kconfig
+++ b/fs/dlm/Kconfig
@@ -1,10 +1,9 @@
 menu "Distributed Lock Manager"
-        depends on INET && EXPERIMENTAL
+        depends on INET && IP_SCTP && EXPERIMENTAL
 
 config DLM
         tristate "Distributed Lock Manager (DLM)"
         depends on IPV6 || IPV6=n
-        depends on IP_SCTP
         select CONFIGFS_FS
         help
         A general purpose distributed lock manager for kernel or userspace
diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
index 109333c8ecb9..f8842ca443c2 100644
--- a/fs/dlm/lockspace.c
+++ b/fs/dlm/lockspace.c
@@ -43,6 +43,10 @@ static ssize_t dlm_control_store(struct dlm_ls *ls, const char *buf, size_t len)
         ssize_t ret = len;
         int n = simple_strtol(buf, NULL, 0);
 
+        ls = dlm_find_lockspace_local(ls->ls_local_handle);
+        if (!ls)
+                return -EINVAL;
+
         switch (n) {
         case 0:
                 dlm_ls_stop(ls);
@@ -53,6 +57,7 @@ static ssize_t dlm_control_store(struct dlm_ls *ls, const char *buf, size_t len)
         default:
                 ret = -EINVAL;
         }
+        dlm_put_lockspace(ls);
         return ret;
 }
 
@@ -143,6 +148,12 @@ static ssize_t dlm_attr_store(struct kobject *kobj, struct attribute *attr,
         return a->store ? a->store(ls, buf, len) : len;
 }
 
+static void lockspace_kobj_release(struct kobject *k)
+{
+        struct dlm_ls *ls  = container_of(k, struct dlm_ls, ls_kobj);
+        kfree(ls);
+}
+
 static struct sysfs_ops dlm_attr_ops = {
         .show  = dlm_attr_show,
         .store = dlm_attr_store,
@@ -151,6 +162,7 @@ static struct sysfs_ops dlm_attr_ops = {
 static struct kobj_type dlm_ktype = {
         .default_attrs = dlm_attrs,
         .sysfs_ops     = &dlm_attr_ops,
+        .release       = lockspace_kobj_release,
 };
 
 static struct kset dlm_kset = {
@@ -678,7 +690,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
         dlm_clear_members_gone(ls);
         kfree(ls->ls_node_array);
         kobject_unregister(&ls->ls_kobj);
-        kfree(ls);
+        /* The ls structure will be freed when the kobject is done with */
 
         mutex_lock(&ls_lock);
         ls_count--;
diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c
index 7bcea7c5addb..6da6b14d5a61 100644
--- a/fs/dlm/lowcomms.c
+++ b/fs/dlm/lowcomms.c
@@ -519,6 +519,7 @@ static int receive_from_sock(void)
         msg.msg_flags = 0;
         msg.msg_control = incmsg;
         msg.msg_controllen = sizeof(incmsg);
+        msg.msg_iovlen = 1;
 
         /* I don't see why this circular buffer stuff is necessary for SCTP
          * which is a packet-based protocol, but the whole thing breaks under
@@ -548,7 +549,7 @@ static int receive_from_sock(void)
         }
         len = iov[0].iov_len + iov[1].iov_len;
 
-        r = ret = kernel_recvmsg(sctp_con.sock, &msg, iov, 1, len,
+        r = ret = kernel_recvmsg(sctp_con.sock, &msg, iov, msg.msg_iovlen, len,
                                  MSG_NOSIGNAL | MSG_DONTWAIT);
         if (ret <= 0)
                 goto out_close;
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index ed35a9712fa1..136175a69332 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -94,25 +94,53 @@ static int ecryptfs_calculate_md5(char *dst,
                                   struct ecryptfs_crypt_stat *crypt_stat,
                                   char *src, int len)
 {
-        int rc = 0;
         struct scatterlist sg;
+        struct hash_desc desc = {
+                .tfm = crypt_stat->hash_tfm,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
-        mutex_lock(&crypt_stat->cs_md5_tfm_mutex);
+        mutex_lock(&crypt_stat->cs_hash_tfm_mutex);
         sg_init_one(&sg, (u8 *)src, len);
-        if (!crypt_stat->md5_tfm) {
-                crypt_stat->md5_tfm =
-                        crypto_alloc_tfm("md5", CRYPTO_TFM_REQ_MAY_SLEEP);
-                if (!crypt_stat->md5_tfm) {
-                        rc = -ENOMEM;
+        if (!desc.tfm) {
+                desc.tfm = crypto_alloc_hash(ECRYPTFS_DEFAULT_HASH, 0,
+                                             CRYPTO_ALG_ASYNC);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
                         ecryptfs_printk(KERN_ERR, "Error attempting to "
-                                        "allocate crypto context\n");
+                                        "allocate crypto context; rc = [%d]\n",
+                                        rc);
                         goto out;
                 }
+                crypt_stat->hash_tfm = desc.tfm;
         }
-        crypto_digest_init(crypt_stat->md5_tfm);
-        crypto_digest_update(crypt_stat->md5_tfm, &sg, 1);
-        crypto_digest_final(crypt_stat->md5_tfm, dst);
-        mutex_unlock(&crypt_stat->cs_md5_tfm_mutex);
+        crypto_hash_init(&desc);
+        crypto_hash_update(&desc, &sg, len);
+        crypto_hash_final(&desc, dst);
+        mutex_unlock(&crypt_stat->cs_hash_tfm_mutex);
+out:
+        return rc;
+}
+
+int ecryptfs_crypto_api_algify_cipher_name(char **algified_name,
+                                           char *cipher_name,
+                                           char *chaining_modifier)
+{
+        int cipher_name_len = strlen(cipher_name);
+        int chaining_modifier_len = strlen(chaining_modifier);
+        int algified_name_len;
+        int rc;
+
+        algified_name_len = (chaining_modifier_len + cipher_name_len + 3);
+        (*algified_name) = kmalloc(algified_name_len, GFP_KERNEL);
+        if (!(*algified_name)) {
+                rc = -ENOMEM;
+                goto out;
+        }
+        snprintf((*algified_name), algified_name_len, "%s(%s)",
+                 chaining_modifier, cipher_name);
+        rc = 0;
 out:
         return rc;
 }
@@ -178,7 +206,7 @@ ecryptfs_init_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
         memset((void *)crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));
         mutex_init(&crypt_stat->cs_mutex);
         mutex_init(&crypt_stat->cs_tfm_mutex);
-        mutex_init(&crypt_stat->cs_md5_tfm_mutex);
+        mutex_init(&crypt_stat->cs_hash_tfm_mutex);
         ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_STRUCT_INITIALIZED);
 }
 
@@ -191,9 +219,9 @@ ecryptfs_init_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
 void ecryptfs_destruct_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat)
 {
         if (crypt_stat->tfm)
-                crypto_free_tfm(crypt_stat->tfm);
-        if (crypt_stat->md5_tfm)
-                crypto_free_tfm(crypt_stat->md5_tfm);
+                crypto_free_blkcipher(crypt_stat->tfm);
+        if (crypt_stat->hash_tfm)
+                crypto_free_hash(crypt_stat->hash_tfm);
         memset(crypt_stat, 0, sizeof(struct ecryptfs_crypt_stat));
 }
 
@@ -203,7 +231,7 @@ void ecryptfs_destruct_mount_crypt_stat(
         if (mount_crypt_stat->global_auth_tok_key)
                 key_put(mount_crypt_stat->global_auth_tok_key);
         if (mount_crypt_stat->global_key_tfm)
-                crypto_free_tfm(mount_crypt_stat->global_key_tfm);
+                crypto_free_blkcipher(mount_crypt_stat->global_key_tfm);
         memset(mount_crypt_stat, 0, sizeof(struct ecryptfs_mount_crypt_stat));
 }
 
@@ -269,6 +297,11 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                                struct scatterlist *src_sg, int size,
                                unsigned char *iv)
 {
+        struct blkcipher_desc desc = {
+                .tfm = crypt_stat->tfm,
+                .info = iv,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
         int rc = 0;
 
         BUG_ON(!crypt_stat || !crypt_stat->tfm
@@ -282,8 +315,8 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
         }
         /* Consider doing this once, when the file is opened */
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        rc = crypto_cipher_setkey(crypt_stat->tfm, crypt_stat->key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(crypt_stat->tfm, crypt_stat->key,
+                                     crypt_stat->key_size);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error setting key; rc = [%d]\n",
                                 rc);
@@ -292,7 +325,7 @@ static int encrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                 goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "Encrypting [%d] bytes.\n", size);
-        crypto_cipher_encrypt_iv(crypt_stat->tfm, dest_sg, src_sg, size, iv);
+        crypto_blkcipher_encrypt_iv(&desc, dest_sg, src_sg, size);
         mutex_unlock(&crypt_stat->cs_tfm_mutex);
 out:
         return rc;
@@ -675,12 +708,17 @@ static int decrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                                struct scatterlist *src_sg, int size,
                                unsigned char *iv)
 {
+        struct blkcipher_desc desc = {
+                .tfm = crypt_stat->tfm,
+                .info = iv,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
         int rc = 0;
 
         /* Consider doing this once, when the file is opened */
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        rc = crypto_cipher_setkey(crypt_stat->tfm, crypt_stat->key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(crypt_stat->tfm, crypt_stat->key,
+                                     crypt_stat->key_size);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error setting key; rc = [%d]\n",
                                 rc);
@@ -689,8 +727,7 @@ static int decrypt_scatterlist(struct ecryptfs_crypt_stat *crypt_stat,
                 goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "Decrypting [%d] bytes.\n", size);
-        rc = crypto_cipher_decrypt_iv(crypt_stat->tfm, dest_sg, src_sg, size,
-                                      iv);
+        rc = crypto_blkcipher_decrypt_iv(&desc, dest_sg, src_sg, size);
         mutex_unlock(&crypt_stat->cs_tfm_mutex);
         if (rc) {
                 ecryptfs_printk(KERN_ERR, "Error decrypting; rc = [%d]\n",
@@ -759,6 +796,7 @@ ecryptfs_decrypt_page_offset(struct ecryptfs_crypt_stat *crypt_stat,
  */
 int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
 {
+        char *full_alg_name;
         int rc = -EINVAL;
 
         if (!crypt_stat->cipher) {
@@ -775,16 +813,24 @@ int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat)
                 goto out;
         }
         mutex_lock(&crypt_stat->cs_tfm_mutex);
-        crypt_stat->tfm = crypto_alloc_tfm(crypt_stat->cipher,
-                                           ECRYPTFS_DEFAULT_CHAINING_MODE
-                                           | CRYPTO_TFM_REQ_WEAK_KEY);
-        mutex_unlock(&crypt_stat->cs_tfm_mutex);
+        rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                    crypt_stat->cipher, "cbc");
+        if (rc)
+                goto out;
+        crypt_stat->tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                 CRYPTO_ALG_ASYNC);
+        kfree(full_alg_name);
         if (!crypt_stat->tfm) {
                 ecryptfs_printk(KERN_ERR, "cryptfs: init_crypt_ctx(): "
                                 "Error initializing cipher [%s]\n",
                                 crypt_stat->cipher);
+                mutex_unlock(&crypt_stat->cs_tfm_mutex);
                 goto out;
         }
+        crypto_blkcipher_set_flags(crypt_stat->tfm,
+                                   (ECRYPTFS_DEFAULT_CHAINING_MODE
+                                    | CRYPTO_TFM_REQ_WEAK_KEY));
+        mutex_unlock(&crypt_stat->cs_tfm_mutex);
         rc = 0;
 out:
         return rc;
@@ -1145,28 +1191,28 @@ int ecryptfs_cipher_code_to_string(char *str, u16 cipher_code)
 int ecryptfs_read_header_region(char *data, struct dentry *dentry,
                                 struct vfsmount *mnt)
 {
-        struct file *file;
+        struct file *lower_file;
         mm_segment_t oldfs;
         int rc;
 
-        mnt = mntget(mnt);
-        file = dentry_open(dentry, mnt, O_RDONLY);
-        if (IS_ERR(file)) {
-                ecryptfs_printk(KERN_DEBUG, "Error opening file to "
-                                "read header region\n");
-                mntput(mnt);
-                rc = PTR_ERR(file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, dentry, mnt,
+                                           O_RDONLY))) {
+                printk(KERN_ERR
+                       "Error opening lower_file to read header region\n");
                 goto out;
         }
-        file->f_pos = 0;
+        lower_file->f_pos = 0;
         oldfs = get_fs();
         set_fs(get_ds());
         /* For releases 0.1 and 0.2, all of the header information
          * fits in the first data extent-sized region. */
-        rc = file->f_op->read(file, (char __user *)data,
-                              ECRYPTFS_DEFAULT_EXTENT_SIZE, &file->f_pos);
+        rc = lower_file->f_op->read(lower_file, (char __user *)data,
+                              ECRYPTFS_DEFAULT_EXTENT_SIZE, &lower_file->f_pos);
         set_fs(oldfs);
-        fput(file);
+        if ((rc = ecryptfs_close_lower_file(lower_file))) {
+                printk(KERN_ERR "Error closing lower_file\n");
+                goto out;
+        }
         rc = 0;
 out:
         return rc;
@@ -1573,84 +1619,52 @@ out:
 
 /**
  * ecryptfs_process_cipher - Perform cipher initialization.
- * @tfm: Crypto context set by this function
  * @key_tfm: Crypto context for key material, set by this function
- * @cipher_name: Name of the cipher.
- * @key_size: Size of the key in bytes.
+ * @cipher_name: Name of the cipher
+ * @key_size: Size of the key in bytes
  *
  * Returns zero on success. Any crypto_tfm structs allocated here
  * should be released by other functions, such as on a superblock put
  * event, regardless of whether this function succeeds for fails.
  */
 int
-ecryptfs_process_cipher(struct crypto_tfm **tfm, struct crypto_tfm **key_tfm,
-                        char *cipher_name, size_t key_size)
+ecryptfs_process_cipher(struct crypto_blkcipher **key_tfm, char *cipher_name,
+                        size_t *key_size)
 {
         char dummy_key[ECRYPTFS_MAX_KEY_BYTES];
+        char *full_alg_name;
         int rc;
 
-        *tfm = *key_tfm = NULL;
-        if (key_size > ECRYPTFS_MAX_KEY_BYTES) {
+        *key_tfm = NULL;
+        if (*key_size > ECRYPTFS_MAX_KEY_BYTES) {
                 rc = -EINVAL;
                 printk(KERN_ERR "Requested key size is [%Zd] bytes; maximum "
-                       "allowable is [%d]\n", key_size, ECRYPTFS_MAX_KEY_BYTES);
+                      "allowable is [%d]\n", *key_size, ECRYPTFS_MAX_KEY_BYTES);
                 goto out;
         }
-        *tfm = crypto_alloc_tfm(cipher_name, (ECRYPTFS_DEFAULT_CHAINING_MODE
-                                              | CRYPTO_TFM_REQ_WEAK_KEY));
-        if (!(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Unable to allocate crypto cipher with name "
-                       "[%s]\n", cipher_name);
+        rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name, cipher_name,
+                                                    "ecb");
+        if (rc)
                 goto out;
-        }
-        *key_tfm = crypto_alloc_tfm(cipher_name, CRYPTO_TFM_REQ_WEAK_KEY);
-        if (!(*key_tfm)) {
-                rc = -EINVAL;
+        *key_tfm = crypto_alloc_blkcipher(full_alg_name, 0, CRYPTO_ALG_ASYNC);
+        kfree(full_alg_name);
+        if (IS_ERR(*key_tfm)) {
+                rc = PTR_ERR(*key_tfm);
                 printk(KERN_ERR "Unable to allocate crypto cipher with name "
-                       "[%s]\n", cipher_name);
-                goto out;
-        }
-        if (key_size < crypto_tfm_alg_min_keysize(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; minimum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*tfm));
-                goto out;
-        }
-        if (key_size < crypto_tfm_alg_min_keysize(*key_tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; minimum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*key_tfm));
+                       "[%s]; rc = [%d]\n", cipher_name, rc);
                 goto out;
         }
-        if (key_size > crypto_tfm_alg_max_keysize(*tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; maximum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*tfm));
-                goto out;
-        }
-        if (key_size > crypto_tfm_alg_max_keysize(*key_tfm)) {
-                rc = -EINVAL;
-                printk(KERN_ERR "Request key size is [%Zd]; maximum key size "
-                       "supported by cipher [%s] is [%d]\n", key_size,
-                       cipher_name, crypto_tfm_alg_min_keysize(*key_tfm));
-                goto out;
-        }
-        get_random_bytes(dummy_key, key_size);
-        rc = crypto_cipher_setkey(*tfm, dummy_key, key_size);
-        if (rc) {
-                printk(KERN_ERR "Error attempting to set key of size [%Zd] for "
-                       "cipher [%s]; rc = [%d]\n", key_size, cipher_name, rc);
-                rc = -EINVAL;
-                goto out;
+        crypto_blkcipher_set_flags(*key_tfm, CRYPTO_TFM_REQ_WEAK_KEY);
+        if (*key_size == 0) {
+                struct blkcipher_alg *alg = crypto_blkcipher_alg(*key_tfm);
+
+                *key_size = alg->max_keysize;
         }
-        rc = crypto_cipher_setkey(*key_tfm, dummy_key, key_size);
+        get_random_bytes(dummy_key, *key_size);
+        rc = crypto_blkcipher_setkey(*key_tfm, dummy_key, *key_size);
         if (rc) {
                 printk(KERN_ERR "Error attempting to set key of size [%Zd] for "
-                       "cipher [%s]; rc = [%d]\n", key_size, cipher_name, rc);
+                       "cipher [%s]; rc = [%d]\n", *key_size, cipher_name, rc);
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
index f0d2a433242b..52d1e36dc746 100644
--- a/fs/ecryptfs/dentry.c
+++ b/fs/ecryptfs/dentry.c
@@ -24,6 +24,7 @@
 
 #include <linux/dcache.h>
 #include <linux/namei.h>
+#include <linux/mount.h>
 #include "ecryptfs_kernel.h"
 
 /**
@@ -56,6 +57,12 @@ static int ecryptfs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
         rc = lower_dentry->d_op->d_revalidate(lower_dentry, nd);
         nd->dentry = dentry_save;
         nd->mnt = vfsmount_save;
+        if (dentry->d_inode) {
+                struct inode *lower_inode =
+                        ecryptfs_inode_to_lower(dentry->d_inode);
+
+                ecryptfs_copy_attr_all(dentry->d_inode, lower_inode);
+        }
 out:
         return rc;
 }
@@ -76,8 +83,13 @@ static void ecryptfs_d_release(struct dentry *dentry)
         if (ecryptfs_dentry_to_private(dentry))
                 kmem_cache_free(ecryptfs_dentry_info_cache,
                                 ecryptfs_dentry_to_private(dentry));
-        if (lower_dentry)
+        if (lower_dentry) {
+                struct vfsmount *lower_mnt =
+                        ecryptfs_dentry_to_lower_mnt(dentry);
+
+                mntput(lower_mnt);
                 dput(lower_dentry);
+        }
         return;
 }
 
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 872c9958531a..f992533d1692 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -175,6 +175,7 @@ ecryptfs_get_key_payload_data(struct key *key)
 #define ECRYPTFS_DEFAULT_CIPHER "aes"
 #define ECRYPTFS_DEFAULT_KEY_BYTES 16
 #define ECRYPTFS_DEFAULT_CHAINING_MODE CRYPTO_TFM_MODE_CBC
+#define ECRYPTFS_DEFAULT_HASH "md5"
 #define ECRYPTFS_TAG_3_PACKET_TYPE 0x8C
 #define ECRYPTFS_TAG_11_PACKET_TYPE 0xED
 #define MD5_DIGEST_SIZE 16
@@ -204,15 +205,15 @@ struct ecryptfs_crypt_stat {
         size_t extent_shift;
         unsigned int extent_mask;
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
-        struct crypto_tfm *tfm;
-        struct crypto_tfm *md5_tfm; /* Crypto context for generating
-                                     * the initialization vectors */
+        struct crypto_blkcipher *tfm;
+        struct crypto_hash *hash_tfm; /* Crypto context for generating
+                                       * the initialization vectors */
         unsigned char cipher[ECRYPTFS_MAX_CIPHER_NAME_SIZE];
         unsigned char key[ECRYPTFS_MAX_KEY_BYTES];
         unsigned char root_iv[ECRYPTFS_MAX_IV_BYTES];
         unsigned char keysigs[ECRYPTFS_MAX_NUM_KEYSIGS][ECRYPTFS_SIG_SIZE_HEX];
         struct mutex cs_tfm_mutex;
-        struct mutex cs_md5_tfm_mutex;
+        struct mutex cs_hash_tfm_mutex;
         struct mutex cs_mutex;
 };
 
@@ -244,7 +245,7 @@ struct ecryptfs_mount_crypt_stat {
         struct ecryptfs_auth_tok *global_auth_tok;
         struct key *global_auth_tok_key;
         size_t global_default_cipher_key_size;
-        struct crypto_tfm *global_key_tfm;
+        struct crypto_blkcipher *global_key_tfm;
         struct mutex global_key_tfm_mutex;
         unsigned char global_default_cipher_name[ECRYPTFS_MAX_CIPHER_NAME_SIZE
                                                  + 1];
@@ -425,6 +426,9 @@ void ecryptfs_destruct_crypt_stat(struct ecryptfs_crypt_stat *crypt_stat);
 void ecryptfs_destruct_mount_crypt_stat(
         struct ecryptfs_mount_crypt_stat *mount_crypt_stat);
 int ecryptfs_init_crypt_ctx(struct ecryptfs_crypt_stat *crypt_stat);
+int ecryptfs_crypto_api_algify_cipher_name(char **algified_name,
+                                           char *cipher_name,
+                                           char *chaining_modifier);
 int ecryptfs_write_inode_size_to_header(struct file *lower_file,
                                         struct inode *lower_inode,
                                         struct inode *inode);
@@ -473,10 +477,14 @@ ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
                           unsigned char *src, struct dentry *ecryptfs_dentry);
 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length);
 int
-ecryptfs_process_cipher(struct crypto_tfm **tfm, struct crypto_tfm **key_tfm,
-                        char *cipher_name, size_t key_size);
+ecryptfs_process_cipher(struct crypto_blkcipher **key_tfm, char *cipher_name,
+                        size_t *key_size);
 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode);
 int ecryptfs_inode_set(struct inode *inode, void *lower_inode);
 void ecryptfs_init_inode(struct inode *inode, struct inode *lower_inode);
+int ecryptfs_open_lower_file(struct file **lower_file,
+                             struct dentry *lower_dentry,
+                             struct vfsmount *lower_mnt, int flags);
+int ecryptfs_close_lower_file(struct file *lower_file);
 
 #endif /* #ifndef ECRYPTFS_KERNEL_H */
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index c8550c9f9cd2..a92ef05eff8f 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -198,6 +198,33 @@ retry:
 
 struct kmem_cache *ecryptfs_file_info_cache;
 
+int ecryptfs_open_lower_file(struct file **lower_file,
+                             struct dentry *lower_dentry,
+                             struct vfsmount *lower_mnt, int flags)
+{
+        int rc = 0;
+
+        dget(lower_dentry);
+        mntget(lower_mnt);
+        *lower_file = dentry_open(lower_dentry, lower_mnt, flags);
+        if (IS_ERR(*lower_file)) {
+                printk(KERN_ERR "Error opening lower file for lower_dentry "
+                       "[0x%p], lower_mnt [0x%p], and flags [0x%x]\n",
+                       lower_dentry, lower_mnt, flags);
+                rc = PTR_ERR(*lower_file);
+                *lower_file = NULL;
+                goto out;
+        }
+out:
+        return rc;
+}
+
+int ecryptfs_close_lower_file(struct file *lower_file)
+{
+        fput(lower_file);
+        return 0;
+}
+
 /**
  * ecryptfs_open
  * @inode: inode speciying file to open
@@ -244,19 +271,15 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                 ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
         }
         mutex_unlock(&crypt_stat->cs_mutex);
-        /* This mntget & dget is undone via fput when the file is released */
-        dget(lower_dentry);
         lower_flags = file->f_flags;
         if ((lower_flags & O_ACCMODE) == O_WRONLY)
                 lower_flags = (lower_flags & O_ACCMODE) | O_RDWR;
         if (file->f_flags & O_APPEND)
                 lower_flags &= ~O_APPEND;
         lower_mnt = ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
-        mntget(lower_mnt);
         /* Corresponding fput() in ecryptfs_release() */
-        lower_file = dentry_open(lower_dentry, lower_mnt, lower_flags);
-        if (IS_ERR(lower_file)) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           lower_flags))) {
                 ecryptfs_printk(KERN_ERR, "Error opening lower file\n");
                 goto out_puts;
         }
@@ -341,11 +364,16 @@ static int ecryptfs_release(struct inode *inode, struct file *file)
         struct file *lower_file = ecryptfs_file_to_lower(file);
         struct ecryptfs_file_info *file_info = ecryptfs_file_to_private(file);
         struct inode *lower_inode = ecryptfs_inode_to_lower(inode);
+        int rc;
 
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file))) {
+                printk(KERN_ERR "Error closing lower_file\n");
+                goto out;
+        }
         inode->i_blocks = lower_inode->i_blocks;
         kmem_cache_free(ecryptfs_file_info_cache, file_info);
-        return 0;
+out:
+        return rc;
 }
 
 static int
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index efdd2b7b62d7..dfcc68484f47 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -231,7 +231,6 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
         int lower_flags;
         struct ecryptfs_crypt_stat *crypt_stat;
         struct dentry *lower_dentry;
-        struct dentry *tlower_dentry = NULL;
         struct file *lower_file;
         struct inode *inode, *lower_inode;
         struct vfsmount *lower_mnt;
@@ -241,30 +240,19 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
                         lower_dentry->d_name.name);
         inode = ecryptfs_dentry->d_inode;
         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
-        tlower_dentry = dget(lower_dentry);
-        if (!tlower_dentry) {
-                rc = -ENOMEM;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing lower_dentry\n");
-                goto out;
-        }
         lower_flags = ((O_CREAT | O_WRONLY | O_TRUNC) & O_ACCMODE) | O_RDWR;
 #if BITS_PER_LONG != 32
         lower_flags |= O_LARGEFILE;
 #endif
         lower_mnt = ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
-        mntget(lower_mnt);
         /* Corresponding fput() at end of this function */
-        lower_file = dentry_open(tlower_dentry, lower_mnt, lower_flags);
-        if (IS_ERR(lower_file)) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           lower_flags))) {
                 ecryptfs_printk(KERN_ERR,
                                 "Error opening dentry; rc = [%i]\n", rc);
                 goto out;
         }
-        /* fput(lower_file) should handle the puts if we do this */
-        lower_file->f_dentry = tlower_dentry;
-        lower_file->f_vfsmnt = lower_mnt;
-        lower_inode = tlower_dentry->d_inode;
+        lower_inode = lower_dentry->d_inode;
         if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
                 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
                 ECRYPTFS_CLEAR_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
@@ -285,7 +273,8 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
         }
         rc = grow_file(ecryptfs_dentry, lower_file, inode, lower_inode);
 out_fput:
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file)))
+                printk(KERN_ERR "Error closing lower_file\n");
 out:
         return rc;
 }
@@ -336,7 +325,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
         struct dentry *lower_dir_dentry;
         struct dentry *lower_dentry;
         struct vfsmount *lower_mnt;
-        struct dentry *tlower_dentry = NULL;
         char *encoded_name;
         unsigned int encoded_namelen;
         struct ecryptfs_crypt_stat *crypt_stat = NULL;
@@ -347,27 +335,32 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
         lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
         dentry->d_op = &ecryptfs_dops;
         if ((dentry->d_name.len == 1 && !strcmp(dentry->d_name.name, "."))
-            || (dentry->d_name.len == 2 && !strcmp(dentry->d_name.name, "..")))
-                goto out_drop;
+            || (dentry->d_name.len == 2
+                && !strcmp(dentry->d_name.name, ".."))) {
+                d_drop(dentry);
+                goto out;
+        }
         encoded_namelen = ecryptfs_encode_filename(crypt_stat,
                                                    dentry->d_name.name,
                                                    dentry->d_name.len,
                                                    &encoded_name);
         if (encoded_namelen < 0) {
                 rc = encoded_namelen;
-                goto out_drop;
+                d_drop(dentry);
+                goto out;
         }
         ecryptfs_printk(KERN_DEBUG, "encoded_name = [%s]; encoded_namelen "
                         "= [%d]\n", encoded_name, encoded_namelen);
         lower_dentry = lookup_one_len(encoded_name, lower_dir_dentry,
                                       encoded_namelen - 1);
         kfree(encoded_name);
-        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
         if (IS_ERR(lower_dentry)) {
                 ecryptfs_printk(KERN_ERR, "ERR from lower_dentry\n");
                 rc = PTR_ERR(lower_dentry);
-                goto out_drop;
+                d_drop(dentry);
+                goto out;
         }
+        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
         ecryptfs_printk(KERN_DEBUG, "lower_dentry = [%p]; lower_dentry->"
                 "d_name.name = [%s]\n", lower_dentry,
                 lower_dentry->d_name.name);
@@ -408,12 +401,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
                                 "as we *think* we are about to unlink\n");
                 goto out;
         }
-        tlower_dentry = dget(lower_dentry);
-        if (!tlower_dentry || IS_ERR(tlower_dentry)) {
-                rc = -ENOMEM;
-                ecryptfs_printk(KERN_ERR, "Cannot dget lower_dentry\n");
-                goto out_dput;
-        }
         /* Released in this function */
         page_virt =
             (char *)kmem_cache_alloc(ecryptfs_header_cache_2,
@@ -425,7 +412,7 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
                 goto out_dput;
         }
         memset(page_virt, 0, PAGE_CACHE_SIZE);
-        rc = ecryptfs_read_header_region(page_virt, tlower_dentry, nd->mnt);
+        rc = ecryptfs_read_header_region(page_virt, lower_dentry, nd->mnt);
         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
         if (!ECRYPTFS_CHECK_FLAG(crypt_stat->flags, ECRYPTFS_POLICY_APPLIED))
                 ecryptfs_set_default_sizes(crypt_stat);
@@ -448,9 +435,6 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
 
 out_dput:
         dput(lower_dentry);
-        if (tlower_dentry)
-                dput(tlower_dentry);
-out_drop:
         d_drop(dentry);
 out:
         return ERR_PTR(rc);
@@ -486,8 +470,9 @@ out_lock:
         unlock_dir(lower_dir_dentry);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
-        if (!new_dentry->d_inode)
-                d_drop(new_dentry);
+        d_drop(lower_old_dentry);
+        d_drop(new_dentry);
+        d_drop(old_dentry);
         return rc;
 }
 
@@ -500,7 +485,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
         lock_parent(lower_dentry);
         rc = vfs_unlink(lower_dir_inode, lower_dentry);
         if (rc) {
-                ecryptfs_printk(KERN_ERR, "Error in vfs_unlink\n");
+                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
                 goto out_unlock;
         }
         ecryptfs_copy_attr_times(dir, lower_dir_inode);
@@ -576,41 +561,24 @@ out:
 
 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
 {
-        int rc = 0;
-        struct dentry *tdentry = NULL;
         struct dentry *lower_dentry;
-        struct dentry *tlower_dentry = NULL;
         struct dentry *lower_dir_dentry;
+        int rc;
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (!(tdentry = dget(dentry))) {
-                rc = -EINVAL;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing dentry [%p]\n",
-                                dentry);
-                goto out;
-        }
+        dget(dentry);
         lower_dir_dentry = lock_parent(lower_dentry);
-        if (!(tlower_dentry = dget(lower_dentry))) {
-                rc = -EINVAL;
-                ecryptfs_printk(KERN_ERR, "Error dget'ing lower_dentry "
-                                "[%p]\n", lower_dentry);
-                goto out;
-        }
+        dget(lower_dentry);
         rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
-        if (!rc) {
-                d_delete(tlower_dentry);
-                tlower_dentry = NULL;
-        }
+        dput(lower_dentry);
+        if (!rc)
+                d_delete(lower_dentry);
         ecryptfs_copy_attr_times(dir, lower_dir_dentry->d_inode);
         dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
         unlock_dir(lower_dir_dentry);
         if (!rc)
                 d_drop(dentry);
-out:
-        if (tdentry)
-                dput(tdentry);
-        if (tlower_dentry)
-                dput(tlower_dentry);
+        dput(dentry);
         return rc;
 }
 
@@ -663,6 +631,8 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 ecryptfs_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 out_lock:
         unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
+        dput(lower_new_dentry->d_parent);
+        dput(lower_old_dentry->d_parent);
         dput(lower_new_dentry);
         dput(lower_old_dentry);
         return rc;
@@ -832,12 +802,11 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
         }
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         /* This dget & mntget is released through fput at out_fput: */
-        dget(lower_dentry);
         lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
-        mntget(lower_mnt);
-        lower_file = dentry_open(lower_dentry, lower_mnt, O_RDWR);
-        if (unlikely(IS_ERR(lower_file))) {
-                rc = PTR_ERR(lower_file);
+        if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
+                                           O_RDWR))) {
+                ecryptfs_printk(KERN_ERR,
+                                "Error opening dentry; rc = [%i]\n", rc);
                 goto out_free;
         }
         ecryptfs_set_file_lower(&fake_ecryptfs_file, lower_file);
@@ -879,7 +848,8 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
                 = CURRENT_TIME;
         mark_inode_dirty_sync(inode);
 out_fput:
-        fput(lower_file);
+        if ((rc = ecryptfs_close_lower_file(lower_file)))
+                printk(KERN_ERR "Error closing lower_file\n");
 out_free:
         if (ecryptfs_file_to_private(&fake_ecryptfs_file))
                 kmem_cache_free(ecryptfs_file_info_cache,
diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index ba454785a0c5..c3746f56d162 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -458,14 +458,16 @@ out:
 static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
                                struct ecryptfs_crypt_stat *crypt_stat)
 {
-        int rc = 0;
         struct ecryptfs_password *password_s_ptr;
-        struct crypto_tfm *tfm = NULL;
         struct scatterlist src_sg[2], dst_sg[2];
         struct mutex *tfm_mutex = NULL;
         /* TODO: Use virt_to_scatterlist for these */
         char *encrypted_session_key;
         char *session_key;
+        struct blkcipher_desc desc = {
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
         password_s_ptr = &auth_tok->token.password;
         if (ECRYPTFS_CHECK_FLAG(password_s_ptr->flags,
@@ -482,30 +484,37 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         if (!strcmp(crypt_stat->cipher,
                     crypt_stat->mount_crypt_stat->global_default_cipher_name)
             && crypt_stat->mount_crypt_stat->global_key_tfm) {
-                tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
+                desc.tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
                 tfm_mutex = &crypt_stat->mount_crypt_stat->global_key_tfm_mutex;
         } else {
-                tfm = crypto_alloc_tfm(crypt_stat->cipher,
-                                       CRYPTO_TFM_REQ_WEAK_KEY);
-                if (!tfm) {
-                        printk(KERN_ERR "Error allocating crypto context\n");
-                        rc = -ENOMEM;
+                char *full_alg_name;
+
+                rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                            crypt_stat->cipher,
+                                                            "ecb");
+                if (rc)
+                        goto out;
+                desc.tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                  CRYPTO_ALG_ASYNC);
+                kfree(full_alg_name);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
+                        printk(KERN_ERR "Error allocating crypto context; "
+                               "rc = [%d]\n", rc);
                         goto out;
                 }
-        }
-        if (password_s_ptr->session_key_encryption_key_bytes
-            < crypto_tfm_alg_min_keysize(tfm)) {
-                printk(KERN_WARNING "Session key encryption key is [%d] bytes; "
-                       "minimum keysize for selected cipher is [%d] bytes.\n",
-                       password_s_ptr->session_key_encryption_key_bytes,
-                       crypto_tfm_alg_min_keysize(tfm));
-                rc = -EINVAL;
-                goto out;
+                crypto_blkcipher_set_flags(desc.tfm, CRYPTO_TFM_REQ_WEAK_KEY);
         }
         if (tfm_mutex)
                 mutex_lock(tfm_mutex);
-        crypto_cipher_setkey(tfm, password_s_ptr->session_key_encryption_key,
-                             crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(desc.tfm,
+                                     password_s_ptr->session_key_encryption_key,
+                                     crypt_stat->key_size);
+        if (rc < 0) {
+                printk(KERN_ERR "Error setting key for crypto context\n");
+                rc = -EINVAL;
+                goto out_free_tfm;
+        }
         /* TODO: virt_to_scatterlist */
         encrypted_session_key = (char *)__get_free_page(GFP_KERNEL);
         if (!encrypted_session_key) {
@@ -531,9 +540,12 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         auth_tok->session_key.decrypted_key_size =
             auth_tok->session_key.encrypted_key_size;
         dst_sg[0].length = auth_tok->session_key.encrypted_key_size;
-        /* TODO: Handle error condition */
-        crypto_cipher_decrypt(tfm, dst_sg, src_sg,
-                              auth_tok->session_key.encrypted_key_size);
+        rc = crypto_blkcipher_decrypt(&desc, dst_sg, src_sg,
+                                      auth_tok->session_key.encrypted_key_size);
+        if (rc) {
+                printk(KERN_ERR "Error decrypting; rc = [%d]\n", rc);
+                goto out_free_memory;
+        }
         auth_tok->session_key.decrypted_key_size =
             auth_tok->session_key.encrypted_key_size;
         memcpy(auth_tok->session_key.decrypted_key, session_key,
@@ -546,6 +558,7 @@ static int decrypt_session_key(struct ecryptfs_auth_tok *auth_tok,
         if (ecryptfs_verbosity > 0)
                 ecryptfs_dump_hex(crypt_stat->key,
                                   crypt_stat->key_size);
+out_free_memory:
         memset(encrypted_session_key, 0, PAGE_CACHE_SIZE);
         free_page((unsigned long)encrypted_session_key);
         memset(session_key, 0, PAGE_CACHE_SIZE);
@@ -554,7 +567,7 @@ out_free_tfm:
         if (tfm_mutex)
                 mutex_unlock(tfm_mutex);
         else
-                crypto_free_tfm(tfm);
+                crypto_free_blkcipher(desc.tfm);
 out:
         return rc;
 }
@@ -803,19 +816,21 @@ write_tag_3_packet(char *dest, size_t max, struct ecryptfs_auth_tok *auth_tok,
                    struct ecryptfs_crypt_stat *crypt_stat,
                    struct ecryptfs_key_record *key_rec, size_t *packet_size)
 {
-        int rc = 0;
-
         size_t i;
         size_t signature_is_valid = 0;
         size_t encrypted_session_key_valid = 0;
         char session_key_encryption_key[ECRYPTFS_MAX_KEY_BYTES];
         struct scatterlist dest_sg[2];
         struct scatterlist src_sg[2];
-        struct crypto_tfm *tfm = NULL;
         struct mutex *tfm_mutex = NULL;
         size_t key_rec_size;
         size_t packet_size_length;
         size_t cipher_code;
+        struct blkcipher_desc desc = {
+                .tfm = NULL,
+                .flags = CRYPTO_TFM_REQ_MAY_SLEEP
+        };
+        int rc = 0;
 
         (*packet_size) = 0;
         /* Check for a valid signature on the auth_tok */
@@ -882,33 +897,48 @@ write_tag_3_packet(char *dest, size_t max, struct ecryptfs_auth_tok *auth_tok,
         if (!strcmp(crypt_stat->cipher,
                     crypt_stat->mount_crypt_stat->global_default_cipher_name)
             && crypt_stat->mount_crypt_stat->global_key_tfm) {
-                tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
+                desc.tfm = crypt_stat->mount_crypt_stat->global_key_tfm;
                 tfm_mutex = &crypt_stat->mount_crypt_stat->global_key_tfm_mutex;
-        } else
-                tfm = crypto_alloc_tfm(crypt_stat->cipher, 0);
-        if (!tfm) {
-                ecryptfs_printk(KERN_ERR, "Could not initialize crypto "
-                                "context for cipher [%s]\n",
-                                crypt_stat->cipher);
-                rc = -EINVAL;
-                goto out;
+        } else {
+                char *full_alg_name;
+
+                rc = ecryptfs_crypto_api_algify_cipher_name(&full_alg_name,
+                                                            crypt_stat->cipher,
+                                                            "ecb");
+                if (rc)
+                        goto out;
+                desc.tfm = crypto_alloc_blkcipher(full_alg_name, 0,
+                                                  CRYPTO_ALG_ASYNC);
+                kfree(full_alg_name);
+                if (IS_ERR(desc.tfm)) {
+                        rc = PTR_ERR(desc.tfm);
+                        ecryptfs_printk(KERN_ERR, "Could not initialize crypto "
+                                        "context for cipher [%s]; rc = [%d]\n",
+                                        crypt_stat->cipher, rc);
+                        goto out;
+                }
+                crypto_blkcipher_set_flags(desc.tfm, CRYPTO_TFM_REQ_WEAK_KEY);
         }
         if (tfm_mutex)
                 mutex_lock(tfm_mutex);
-        rc = crypto_cipher_setkey(tfm, session_key_encryption_key,
-                                  crypt_stat->key_size);
+        rc = crypto_blkcipher_setkey(desc.tfm, session_key_encryption_key,
+                                     crypt_stat->key_size);
         if (rc < 0) {
                 if (tfm_mutex)
                         mutex_unlock(tfm_mutex);
                 ecryptfs_printk(KERN_ERR, "Error setting key for crypto "
-                                "context\n");
+                                "context; rc = [%d]\n", rc);
                 goto out;
         }
         rc = 0;
         ecryptfs_printk(KERN_DEBUG, "Encrypting [%d] bytes of the key\n",
                         crypt_stat->key_size);
-        crypto_cipher_encrypt(tfm, dest_sg, src_sg,
-                              (*key_rec).enc_key_size);
+        rc = crypto_blkcipher_encrypt(&desc, dest_sg, src_sg,
+                                      (*key_rec).enc_key_size);
+        if (rc) {
+                printk(KERN_ERR "Error encrypting; rc = [%d]\n", rc);
+                goto out;
+        }
         if (tfm_mutex)
                 mutex_unlock(tfm_mutex);
         ecryptfs_printk(KERN_DEBUG, "This should be the encrypted key:\n");
@@ -971,8 +1001,8 @@ encrypted_session_key_set:
                (*key_rec).enc_key_size);
         (*packet_size) += (*key_rec).enc_key_size;
 out:
-        if (tfm && !tfm_mutex)
-                crypto_free_tfm(tfm);
+        if (desc.tfm && !tfm_mutex)
+                crypto_free_blkcipher(desc.tfm);
         if (rc)
                 (*packet_size) = 0;
         return rc;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index 7a11b8ae6644..a78d87d14baf 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -104,10 +104,7 @@ int ecryptfs_interpose(struct dentry *lower_dentry, struct dentry *dentry,
                 inode->i_op = &ecryptfs_dir_iops;
         if (S_ISDIR(lower_inode->i_mode))
                 inode->i_fop = &ecryptfs_dir_fops;
-        /* TODO: Is there a better way to identify if the inode is
-         * special? */
-        if (S_ISBLK(lower_inode->i_mode) || S_ISCHR(lower_inode->i_mode) ||
-            S_ISFIFO(lower_inode->i_mode) || S_ISSOCK(lower_inode->i_mode))
+        if (special_file(lower_inode->i_mode))
                 init_special_inode(inode, lower_inode->i_mode,
                                    lower_inode->i_rdev);
         dentry->d_op = &ecryptfs_dops;
@@ -211,7 +208,6 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
         char *cipher_name_dst;
         char *cipher_name_src;
         char *cipher_key_bytes_src;
-        struct crypto_tfm *tmp_tfm;
         int cipher_name_len;
 
         if (!options) {
@@ -308,25 +304,19 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
                     = '\0';
         }
         if (!cipher_key_bytes_set) {
-                mount_crypt_stat->global_default_cipher_key_size =
-                        ECRYPTFS_DEFAULT_KEY_BYTES;
-                ecryptfs_printk(KERN_DEBUG, "Cipher key size was not "
-                                "specified.  Defaulting to [%d]\n",
-                                mount_crypt_stat->
-                                global_default_cipher_key_size);
+                mount_crypt_stat->global_default_cipher_key_size = 0;
         }
         rc = ecryptfs_process_cipher(
-                &tmp_tfm,
                 &mount_crypt_stat->global_key_tfm,
                 mount_crypt_stat->global_default_cipher_name,
-                mount_crypt_stat->global_default_cipher_key_size);
-        if (tmp_tfm)
-                crypto_free_tfm(tmp_tfm);
+                &mount_crypt_stat->global_default_cipher_key_size);
         if (rc) {
                 printk(KERN_ERR "Error attempting to initialize cipher [%s] "
                        "with key size [%Zd] bytes; rc = [%d]\n",
                        mount_crypt_stat->global_default_cipher_name,
                        mount_crypt_stat->global_default_cipher_key_size, rc);
+                mount_crypt_stat->global_key_tfm = NULL;
+                mount_crypt_stat->global_auth_tok_key = NULL;
                 rc = -EINVAL;
                 goto out;
         }
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index c337c0410fb1..825757ae4867 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -138,23 +138,6 @@ static void ecryptfs_clear_inode(struct inode *inode)
 }
 
 /**
- * ecryptfs_umount_begin
- *
- * Called in do_umount().
- */
-static void ecryptfs_umount_begin(struct vfsmount *vfsmnt, int flags)
-{
-        struct vfsmount *lower_mnt =
-                ecryptfs_dentry_to_lower_mnt(vfsmnt->mnt_sb->s_root);
-        struct super_block *lower_sb;
-
-        mntput(lower_mnt);
-        lower_sb = lower_mnt->mnt_sb;
-        if (lower_sb->s_op->umount_begin)
-                lower_sb->s_op->umount_begin(lower_mnt, flags);
-}
-
-/**
  * ecryptfs_show_options
  *
  * Prints the directory we are currently mounted over.
@@ -193,6 +176,5 @@ struct super_operations ecryptfs_sops = {
         .statfs = ecryptfs_statfs,
         .remount_fs = NULL,
         .clear_inode = ecryptfs_clear_inode,
-        .umount_begin = ecryptfs_umount_begin,
         .show_options = ecryptfs_show_options
 };
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 557d5b614fae..ae228ec54e94 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -105,6 +105,8 @@
 /* Maximum msec timeout value storeable in a long int */
 #define EP_MAX_MSTIMEO min(1000ULL * MAX_SCHEDULE_TIMEOUT / HZ, (LONG_MAX - 999ULL) / HZ)
 
+#define EP_MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
+
 
 struct epoll_filefd {
         struct file *file;
@@ -497,7 +499,7 @@ void eventpoll_release_file(struct file *file)
  */
 asmlinkage long sys_epoll_create(int size)
 {
-        int error, fd;
+        int error, fd = -1;
         struct eventpoll *ep;
         struct inode *inode;
         struct file *file;
@@ -640,7 +642,6 @@ eexit_1:
         return error;
 }
 
-#define MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
 
 /*
  * Implement the event wait interface for the eventpoll file. It is the kernel
@@ -657,7 +658,7 @@ asmlinkage long sys_epoll_wait(int epfd, struct epoll_event __user *events,
                      current, epfd, events, maxevents, timeout));
 
         /* The maximum number of event must be greater than zero */
-        if (maxevents <= 0 || maxevents > MAX_EVENTS)
+        if (maxevents <= 0 || maxevents > EP_MAX_EVENTS)
                 return -EINVAL;
 
         /* Verify that the area passed by the user is writeable */
@@ -699,6 +700,55 @@ eexit_1:
 }
 
 
+#ifdef TIF_RESTORE_SIGMASK
+
+/*
+ * Implement the event wait interface for the eventpoll file. It is the kernel
+ * part of the user space epoll_pwait(2).
+ */
+asmlinkage long sys_epoll_pwait(int epfd, struct epoll_event __user *events,
+                int maxevents, int timeout, const sigset_t __user *sigmask,
+                size_t sigsetsize)
+{
+        int error;
+        sigset_t ksigmask, sigsaved;
+
+        /*
+         * If the caller wants a certain signal mask to be set during the wait,
+         * we apply it here.
+         */
+        if (sigmask) {
+                if (sigsetsize != sizeof(sigset_t))
+                        return -EINVAL;
+                if (copy_from_user(&ksigmask, sigmask, sizeof(ksigmask)))
+                        return -EFAULT;
+                sigdelsetmask(&ksigmask, sigmask(SIGKILL) | sigmask(SIGSTOP));
+                sigprocmask(SIG_SETMASK, &ksigmask, &sigsaved);
+        }
+
+        error = sys_epoll_wait(epfd, events, maxevents, timeout);
+
+        /*
+         * If we changed the signal mask, we need to restore the original one.
+         * In case we've got a signal while waiting, we do not restore the
+         * signal mask yet, and we allow do_signal() to deliver the signal on
+         * the way back to userspace, before the signal mask is restored.
+         */
+        if (sigmask) {
+                if (error == -EINTR) {
+                        memcpy(&current->saved_sigmask, &sigsaved,
+                                sizeof(sigsaved));
+                        set_thread_flag(TIF_RESTORE_SIGMASK);
+                } else
+                        sigprocmask(SIG_SETMASK, &sigsaved, NULL);
+        }
+
+        return error;
+}
+
+#endif /* #ifdef TIF_RESTORE_SIGMASK */
+
+
 /*
  * Creates the file descriptor to be used by the epoll interface.
  */
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 513cd421ac0b..d8b9abd95d07 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -364,7 +364,6 @@ static int parse_options (char * options,
 {
         char * p;
         substring_t args[MAX_OPT_ARGS];
-        unsigned long kind = EXT2_MOUNT_ERRORS_CONT;
         int option;
 
         if (!options)
@@ -404,13 +403,19 @@ static int parse_options (char * options,
                         /* *sb_block = match_int(&args[0]); */
                         break;
                 case Opt_err_panic:
-                        kind = EXT2_MOUNT_ERRORS_PANIC;
+                        clear_opt (sbi->s_mount_opt, ERRORS_CONT);
+                        clear_opt (sbi->s_mount_opt, ERRORS_RO);
+                        set_opt (sbi->s_mount_opt, ERRORS_PANIC);
                         break;
                 case Opt_err_ro:
-                        kind = EXT2_MOUNT_ERRORS_RO;
+                        clear_opt (sbi->s_mount_opt, ERRORS_CONT);
+                        clear_opt (sbi->s_mount_opt, ERRORS_PANIC);
+                        set_opt (sbi->s_mount_opt, ERRORS_RO);
                         break;
                 case Opt_err_cont:
-                        kind = EXT2_MOUNT_ERRORS_CONT;
+                        clear_opt (sbi->s_mount_opt, ERRORS_RO);
+                        clear_opt (sbi->s_mount_opt, ERRORS_PANIC);
+                        set_opt (sbi->s_mount_opt, ERRORS_CONT);
                         break;
                 case Opt_nouid32:
                         set_opt (sbi->s_mount_opt, NO_UID32);
@@ -489,7 +494,6 @@ static int parse_options (char * options,
                         return 0;
                 }
         }
-        sbi->s_mount_opt |= kind;
         return 1;
 }
 
@@ -715,6 +719,8 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent)
                 set_opt(sbi->s_mount_opt, ERRORS_PANIC);
         else if (le16_to_cpu(sbi->s_es->s_errors) == EXT2_ERRORS_RO)
                 set_opt(sbi->s_mount_opt, ERRORS_RO);
+        else
+                set_opt(sbi->s_mount_opt, ERRORS_CONT);
 
         sbi->s_resuid = le16_to_cpu(es->s_def_resuid);
         sbi->s_resgid = le16_to_cpu(es->s_def_resgid);
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index 8bfd56ef18ca..afc2d4f42d77 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -1470,6 +1470,8 @@ static int ext3_fill_super (struct super_block *sb, void *data, int silent)
                 set_opt(sbi->s_mount_opt, ERRORS_PANIC);
         else if (le16_to_cpu(sbi->s_es->s_errors) == EXT3_ERRORS_RO)
                 set_opt(sbi->s_mount_opt, ERRORS_RO);
+        else
+                set_opt(sbi->s_mount_opt, ERRORS_CONT);
 
         sbi->s_resuid = le16_to_cpu(es->s_def_resuid);
         sbi->s_resgid = le16_to_cpu(es->s_def_resgid);
diff --git a/fs/ext4/Makefile b/fs/ext4/Makefile
new file mode 100644
index 000000000000..a6acb96ebeb9
--- /dev/null
+++ b/fs/ext4/Makefile
@@ -0,0 +1,12 @@
+#
+# Makefile for the linux ext4-filesystem routines.
+#
+
+obj-$(CONFIG_EXT4DEV_FS) += ext4dev.o
+
+ext4dev-y       := balloc.o bitmap.o dir.o file.o fsync.o ialloc.o inode.o \
+           ioctl.o namei.o super.o symlink.o hash.o resize.o extents.o
+
+ext4dev-$(CONFIG_EXT4DEV_FS_XATTR)      += xattr.o xattr_user.o xattr_trusted.o
+ext4dev-$(CONFIG_EXT4DEV_FS_POSIX_ACL)  += acl.o
+ext4dev-$(CONFIG_EXT4DEV_FS_SECURITY)   += xattr_security.o
diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c
new file mode 100644
index 000000000000..9e882546d91a
--- /dev/null
+++ b/fs/ext4/acl.c
@@ -0,0 +1,551 @@
+/*
+ * linux/fs/ext4/acl.c
+ *
+ * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
+ */
+
+#include <linux/init.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/capability.h>
+#include <linux/fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/ext4_fs.h>
+#include "xattr.h"
+#include "acl.h"
+
+/*
+ * Convert from filesystem to in-memory representation.
+ */
+static struct posix_acl *
+ext4_acl_from_disk(const void *value, size_t size)
+{
+        const char *end = (char *)value + size;
+        int n, count;
+        struct posix_acl *acl;
+
+        if (!value)
+                return NULL;
+        if (size < sizeof(ext4_acl_header))
+                 return ERR_PTR(-EINVAL);
+        if (((ext4_acl_header *)value)->a_version !=
+            cpu_to_le32(EXT4_ACL_VERSION))
+                return ERR_PTR(-EINVAL);
+        value = (char *)value + sizeof(ext4_acl_header);
+        count = ext4_acl_count(size);
+        if (count < 0)
+                return ERR_PTR(-EINVAL);
+        if (count == 0)
+                return NULL;
+        acl = posix_acl_alloc(count, GFP_KERNEL);
+        if (!acl)
+                return ERR_PTR(-ENOMEM);
+        for (n=0; n < count; n++) {
+                ext4_acl_entry *entry =
+                        (ext4_acl_entry *)value;
+                if ((char *)value + sizeof(ext4_acl_entry_short) > end)
+                        goto fail;
+                acl->a_entries[n].e_tag  = le16_to_cpu(entry->e_tag);
+                acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm);
+                switch(acl->a_entries[n].e_tag) {
+                        case ACL_USER_OBJ:
+                        case ACL_GROUP_OBJ:
+                        case ACL_MASK:
+                        case ACL_OTHER:
+                                value = (char *)value +
+                                        sizeof(ext4_acl_entry_short);
+                                acl->a_entries[n].e_id = ACL_UNDEFINED_ID;
+                                break;
+
+                        case ACL_USER:
+                        case ACL_GROUP:
+                                value = (char *)value + sizeof(ext4_acl_entry);
+                                if ((char *)value > end)
+                                        goto fail;
+                                acl->a_entries[n].e_id =
+                                        le32_to_cpu(entry->e_id);
+                                break;
+
+                        default:
+                                goto fail;
+                }
+        }
+        if (value != end)
+                goto fail;
+        return acl;
+
+fail:
+        posix_acl_release(acl);
+        return ERR_PTR(-EINVAL);
+}
+
+/*
+ * Convert from in-memory to filesystem representation.
+ */
+static void *
+ext4_acl_to_disk(const struct posix_acl *acl, size_t *size)
+{
+        ext4_acl_header *ext_acl;
+        char *e;
+        size_t n;
+
+        *size = ext4_acl_size(acl->a_count);
+        ext_acl = kmalloc(sizeof(ext4_acl_header) + acl->a_count *
+                        sizeof(ext4_acl_entry), GFP_KERNEL);
+        if (!ext_acl)
+                return ERR_PTR(-ENOMEM);
+        ext_acl->a_version = cpu_to_le32(EXT4_ACL_VERSION);
+        e = (char *)ext_acl + sizeof(ext4_acl_header);
+        for (n=0; n < acl->a_count; n++) {
+                ext4_acl_entry *entry = (ext4_acl_entry *)e;
+                entry->e_tag  = cpu_to_le16(acl->a_entries[n].e_tag);
+                entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm);
+                switch(acl->a_entries[n].e_tag) {
+                        case ACL_USER:
+                        case ACL_GROUP:
+                                entry->e_id =
+                                        cpu_to_le32(acl->a_entries[n].e_id);
+                                e += sizeof(ext4_acl_entry);
+                                break;
+
+                        case ACL_USER_OBJ:
+                        case ACL_GROUP_OBJ:
+                        case ACL_MASK:
+                        case ACL_OTHER:
+                                e += sizeof(ext4_acl_entry_short);
+                                break;
+
+                        default:
+                                goto fail;
+                }
+        }
+        return (char *)ext_acl;
+
+fail:
+        kfree(ext_acl);
+        return ERR_PTR(-EINVAL);
+}
+
+static inline struct posix_acl *
+ext4_iget_acl(struct inode *inode, struct posix_acl **i_acl)
+{
+        struct posix_acl *acl = EXT4_ACL_NOT_CACHED;
+
+        spin_lock(&inode->i_lock);
+        if (*i_acl != EXT4_ACL_NOT_CACHED)
+                acl = posix_acl_dup(*i_acl);
+        spin_unlock(&inode->i_lock);
+
+        return acl;
+}
+
+static inline void
+ext4_iset_acl(struct inode *inode, struct posix_acl **i_acl,
+                struct posix_acl *acl)
+{
+        spin_lock(&inode->i_lock);
+        if (*i_acl != EXT4_ACL_NOT_CACHED)
+                posix_acl_release(*i_acl);
+        *i_acl = posix_acl_dup(acl);
+        spin_unlock(&inode->i_lock);
+}
+
+/*
+ * Inode operation get_posix_acl().
+ *
+ * inode->i_mutex: don't care
+ */
+static struct posix_acl *
+ext4_get_acl(struct inode *inode, int type)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int name_index;
+        char *value = NULL;
+        struct posix_acl *acl;
+        int retval;
+
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return NULL;
+
+        switch(type) {
+                case ACL_TYPE_ACCESS:
+                        acl = ext4_iget_acl(inode, &ei->i_acl);
+                        if (acl != EXT4_ACL_NOT_CACHED)
+                                return acl;
+                        name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
+                        break;
+
+                case ACL_TYPE_DEFAULT:
+                        acl = ext4_iget_acl(inode, &ei->i_default_acl);
+                        if (acl != EXT4_ACL_NOT_CACHED)
+                                return acl;
+                        name_index = EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT;
+                        break;
+
+                default:
+                        return ERR_PTR(-EINVAL);
+        }
+        retval = ext4_xattr_get(inode, name_index, "", NULL, 0);
+        if (retval > 0) {
+                value = kmalloc(retval, GFP_KERNEL);
+                if (!value)
+                        return ERR_PTR(-ENOMEM);
+                retval = ext4_xattr_get(inode, name_index, "", value, retval);
+        }
+        if (retval > 0)
+                acl = ext4_acl_from_disk(value, retval);
+        else if (retval == -ENODATA || retval == -ENOSYS)
+                acl = NULL;
+        else
+                acl = ERR_PTR(retval);
+        kfree(value);
+
+        if (!IS_ERR(acl)) {
+                switch(type) {
+                        case ACL_TYPE_ACCESS:
+                                ext4_iset_acl(inode, &ei->i_acl, acl);
+                                break;
+
+                        case ACL_TYPE_DEFAULT:
+                                ext4_iset_acl(inode, &ei->i_default_acl, acl);
+                                break;
+                }
+        }
+        return acl;
+}
+
+/*
+ * Set the access or default ACL of an inode.
+ *
+ * inode->i_mutex: down unless called from ext4_new_inode
+ */
+static int
+ext4_set_acl(handle_t *handle, struct inode *inode, int type,
+             struct posix_acl *acl)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int name_index;
+        void *value = NULL;
+        size_t size = 0;
+        int error;
+
+        if (S_ISLNK(inode->i_mode))
+                return -EOPNOTSUPP;
+
+        switch(type) {
+                case ACL_TYPE_ACCESS:
+                        name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS;
+                        if (acl) {
+                                mode_t mode = inode->i_mode;
+                                error = posix_acl_equiv_mode(acl, &mode);
+                                if (error < 0)
+                                        return error;
+                                else {
+                                        inode->i_mode = mode;
+                                        ext4_mark_inode_dirty(handle, inode);
+                                        if (error == 0)
+                                                acl = NULL;
+                                }
+                        }
+                        break;
+
+                case ACL_TYPE_DEFAULT:
+                        name_index = EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT;
+                        if (!S_ISDIR(inode->i_mode))
+                                return acl ? -EACCES : 0;
+                        break;
+
+                default:
+                        return -EINVAL;
+        }
+        if (acl) {
+                value = ext4_acl_to_disk(acl, &size);
+                if (IS_ERR(value))
+                        return (int)PTR_ERR(value);
+        }
+
+        error = ext4_xattr_set_handle(handle, inode, name_index, "",
+                                      value, size, 0);
+
+        kfree(value);
+        if (!error) {
+                switch(type) {
+                        case ACL_TYPE_ACCESS:
+                                ext4_iset_acl(inode, &ei->i_acl, acl);
+                                break;
+
+                        case ACL_TYPE_DEFAULT:
+                                ext4_iset_acl(inode, &ei->i_default_acl, acl);
+                                break;
+                }
+        }
+        return error;
+}
+
+static int
+ext4_check_acl(struct inode *inode, int mask)
+{
+        struct posix_acl *acl = ext4_get_acl(inode, ACL_TYPE_ACCESS);
+
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+        if (acl) {
+                int error = posix_acl_permission(inode, acl, mask);
+                posix_acl_release(acl);
+                return error;
+        }
+
+        return -EAGAIN;
+}
+
+int
+ext4_permission(struct inode *inode, int mask, struct nameidata *nd)
+{
+        return generic_permission(inode, mask, ext4_check_acl);
+}
+
+/*
+ * Initialize the ACLs of a new inode. Called from ext4_new_inode.
+ *
+ * dir->i_mutex: down
+ * inode->i_mutex: up (access to inode is still exclusive)
+ */
+int
+ext4_init_acl(handle_t *handle, struct inode *inode, struct inode *dir)
+{
+        struct posix_acl *acl = NULL;
+        int error = 0;
+
+        if (!S_ISLNK(inode->i_mode)) {
+                if (test_opt(dir->i_sb, POSIX_ACL)) {
+                        acl = ext4_get_acl(dir, ACL_TYPE_DEFAULT);
+                        if (IS_ERR(acl))
+                                return PTR_ERR(acl);
+                }
+                if (!acl)
+                        inode->i_mode &= ~current->fs->umask;
+        }
+        if (test_opt(inode->i_sb, POSIX_ACL) && acl) {
+                struct posix_acl *clone;
+                mode_t mode;
+
+                if (S_ISDIR(inode->i_mode)) {
+                        error = ext4_set_acl(handle, inode,
+                                             ACL_TYPE_DEFAULT, acl);
+                        if (error)
+                                goto cleanup;
+                }
+                clone = posix_acl_clone(acl, GFP_KERNEL);
+                error = -ENOMEM;
+                if (!clone)
+                        goto cleanup;
+
+                mode = inode->i_mode;
+                error = posix_acl_create_masq(clone, &mode);
+                if (error >= 0) {
+                        inode->i_mode = mode;
+                        if (error > 0) {
+                                /* This is an extended ACL */
+                                error = ext4_set_acl(handle, inode,
+                                                     ACL_TYPE_ACCESS, clone);
+                        }
+                }
+                posix_acl_release(clone);
+        }
+cleanup:
+        posix_acl_release(acl);
+        return error;
+}
+
+/*
+ * Does chmod for an inode that may have an Access Control List. The
+ * inode->i_mode field must be updated to the desired value by the caller
+ * before calling this function.
+ * Returns 0 on success, or a negative error number.
+ *
+ * We change the ACL rather than storing some ACL entries in the file
+ * mode permission bits (which would be more efficient), because that
+ * would break once additional permissions (like  ACL_APPEND, ACL_DELETE
+ * for directories) are added. There are no more bits available in the
+ * file mode.
+ *
+ * inode->i_mutex: down
+ */
+int
+ext4_acl_chmod(struct inode *inode)
+{
+        struct posix_acl *acl, *clone;
+        int error;
+
+        if (S_ISLNK(inode->i_mode))
+                return -EOPNOTSUPP;
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return 0;
+        acl = ext4_get_acl(inode, ACL_TYPE_ACCESS);
+        if (IS_ERR(acl) || !acl)
+                return PTR_ERR(acl);
+        clone = posix_acl_clone(acl, GFP_KERNEL);
+        posix_acl_release(acl);
+        if (!clone)
+                return -ENOMEM;
+        error = posix_acl_chmod_masq(clone, inode->i_mode);
+        if (!error) {
+                handle_t *handle;
+                int retries = 0;
+
+        retry:
+                handle = ext4_journal_start(inode,
+                                EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
+                if (IS_ERR(handle)) {
+                        error = PTR_ERR(handle);
+                        ext4_std_error(inode->i_sb, error);
+                        goto out;
+                }
+                error = ext4_set_acl(handle, inode, ACL_TYPE_ACCESS, clone);
+                ext4_journal_stop(handle);
+                if (error == -ENOSPC &&
+                    ext4_should_retry_alloc(inode->i_sb, &retries))
+                        goto retry;
+        }
+out:
+        posix_acl_release(clone);
+        return error;
+}
+
+/*
+ * Extended attribute handlers
+ */
+static size_t
+ext4_xattr_list_acl_access(struct inode *inode, char *list, size_t list_len,
+                           const char *name, size_t name_len)
+{
+        const size_t size = sizeof(POSIX_ACL_XATTR_ACCESS);
+
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return 0;
+        if (list && size <= list_len)
+                memcpy(list, POSIX_ACL_XATTR_ACCESS, size);
+        return size;
+}
+
+static size_t
+ext4_xattr_list_acl_default(struct inode *inode, char *list, size_t list_len,
+                            const char *name, size_t name_len)
+{
+        const size_t size = sizeof(POSIX_ACL_XATTR_DEFAULT);
+
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return 0;
+        if (list && size <= list_len)
+                memcpy(list, POSIX_ACL_XATTR_DEFAULT, size);
+        return size;
+}
+
+static int
+ext4_xattr_get_acl(struct inode *inode, int type, void *buffer, size_t size)
+{
+        struct posix_acl *acl;
+        int error;
+
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return -EOPNOTSUPP;
+
+        acl = ext4_get_acl(inode, type);
+        if (IS_ERR(acl))
+                return PTR_ERR(acl);
+        if (acl == NULL)
+                return -ENODATA;
+        error = posix_acl_to_xattr(acl, buffer, size);
+        posix_acl_release(acl);
+
+        return error;
+}
+
+static int
+ext4_xattr_get_acl_access(struct inode *inode, const char *name,
+                          void *buffer, size_t size)
+{
+        if (strcmp(name, "") != 0)
+                return -EINVAL;
+        return ext4_xattr_get_acl(inode, ACL_TYPE_ACCESS, buffer, size);
+}
+
+static int
+ext4_xattr_get_acl_default(struct inode *inode, const char *name,
+                           void *buffer, size_t size)
+{
+        if (strcmp(name, "") != 0)
+                return -EINVAL;
+        return ext4_xattr_get_acl(inode, ACL_TYPE_DEFAULT, buffer, size);
+}
+
+static int
+ext4_xattr_set_acl(struct inode *inode, int type, const void *value,
+                   size_t size)
+{
+        handle_t *handle;
+        struct posix_acl *acl;
+        int error, retries = 0;
+
+        if (!test_opt(inode->i_sb, POSIX_ACL))
+                return -EOPNOTSUPP;
+        if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
+                return -EPERM;
+
+        if (value) {
+                acl = posix_acl_from_xattr(value, size);
+                if (IS_ERR(acl))
+                        return PTR_ERR(acl);
+                else if (acl) {
+                        error = posix_acl_valid(acl);
+                        if (error)
+                                goto release_and_out;
+                }
+        } else
+                acl = NULL;
+
+retry:
+        handle = ext4_journal_start(inode, EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        error = ext4_set_acl(handle, inode, type, acl);
+        ext4_journal_stop(handle);
+        if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
+
+release_and_out:
+        posix_acl_release(acl);
+        return error;
+}
+
+static int
+ext4_xattr_set_acl_access(struct inode *inode, const char *name,
+                          const void *value, size_t size, int flags)
+{
+        if (strcmp(name, "") != 0)
+                return -EINVAL;
+        return ext4_xattr_set_acl(inode, ACL_TYPE_ACCESS, value, size);
+}
+
+static int
+ext4_xattr_set_acl_default(struct inode *inode, const char *name,
+                           const void *value, size_t size, int flags)
+{
+        if (strcmp(name, "") != 0)
+                return -EINVAL;
+        return ext4_xattr_set_acl(inode, ACL_TYPE_DEFAULT, value, size);
+}
+
+struct xattr_handler ext4_xattr_acl_access_handler = {
+        .prefix = POSIX_ACL_XATTR_ACCESS,
+        .list   = ext4_xattr_list_acl_access,
+        .get    = ext4_xattr_get_acl_access,
+        .set    = ext4_xattr_set_acl_access,
+};
+
+struct xattr_handler ext4_xattr_acl_default_handler = {
+        .prefix = POSIX_ACL_XATTR_DEFAULT,
+        .list   = ext4_xattr_list_acl_default,
+        .get    = ext4_xattr_get_acl_default,
+        .set    = ext4_xattr_set_acl_default,
+};
diff --git a/fs/ext4/acl.h b/fs/ext4/acl.h
new file mode 100644
index 000000000000..26a5c1abf147
--- /dev/null
+++ b/fs/ext4/acl.h
@@ -0,0 +1,81 @@
+/*
+  File: fs/ext4/acl.h
+
+  (C) 2001 Andreas Gruenbacher, <a.gruenbacher@computer.org>
+*/
+
+#include <linux/posix_acl_xattr.h>
+
+#define EXT4_ACL_VERSION        0x0001
+
+typedef struct {
+        __le16          e_tag;
+        __le16          e_perm;
+        __le32          e_id;
+} ext4_acl_entry;
+
+typedef struct {
+        __le16          e_tag;
+        __le16          e_perm;
+} ext4_acl_entry_short;
+
+typedef struct {
+        __le32          a_version;
+} ext4_acl_header;
+
+static inline size_t ext4_acl_size(int count)
+{
+        if (count <= 4) {
+                return sizeof(ext4_acl_header) +
+                       count * sizeof(ext4_acl_entry_short);
+        } else {
+                return sizeof(ext4_acl_header) +
+                       4 * sizeof(ext4_acl_entry_short) +
+                       (count - 4) * sizeof(ext4_acl_entry);
+        }
+}
+
+static inline int ext4_acl_count(size_t size)
+{
+        ssize_t s;
+        size -= sizeof(ext4_acl_header);
+        s = size - 4 * sizeof(ext4_acl_entry_short);
+        if (s < 0) {
+                if (size % sizeof(ext4_acl_entry_short))
+                        return -1;
+                return size / sizeof(ext4_acl_entry_short);
+        } else {
+                if (s % sizeof(ext4_acl_entry))
+                        return -1;
+                return s / sizeof(ext4_acl_entry) + 4;
+        }
+}
+
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+
+/* Value for inode->u.ext4_i.i_acl and inode->u.ext4_i.i_default_acl
+   if the ACL has not been cached */
+#define EXT4_ACL_NOT_CACHED ((void *)-1)
+
+/* acl.c */
+extern int ext4_permission (struct inode *, int, struct nameidata *);
+extern int ext4_acl_chmod (struct inode *);
+extern int ext4_init_acl (handle_t *, struct inode *, struct inode *);
+
+#else  /* CONFIG_EXT4DEV_FS_POSIX_ACL */
+#include <linux/sched.h>
+#define ext4_permission NULL
+
+static inline int
+ext4_acl_chmod(struct inode *inode)
+{
+        return 0;
+}
+
+static inline int
+ext4_init_acl(handle_t *handle, struct inode *inode, struct inode *dir)
+{
+        return 0;
+}
+#endif  /* CONFIG_EXT4DEV_FS_POSIX_ACL */
+
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
new file mode 100644
index 000000000000..5d45582f9517
--- /dev/null
+++ b/fs/ext4/balloc.c
@@ -0,0 +1,1833 @@
+/*
+ *  linux/fs/ext4/balloc.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  Enhanced block allocation by Stephen Tweedie (sct@redhat.com), 1993
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ */
+
+#include <linux/time.h>
+#include <linux/capability.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/quotaops.h>
+#include <linux/buffer_head.h>
+
+/*
+ * balloc.c contains the blocks allocation and deallocation routines
+ */
+
+/*
+ * Calculate the block group number and offset, given a block number
+ */
+void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
+                unsigned long *blockgrpp, ext4_grpblk_t *offsetp)
+{
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+        ext4_grpblk_t offset;
+
+        blocknr = blocknr - le32_to_cpu(es->s_first_data_block);
+        offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb));
+        if (offsetp)
+                *offsetp = offset;
+        if (blockgrpp)
+                *blockgrpp = blocknr;
+
+}
+
+/*
+ * The free blocks are managed by bitmaps.  A file system contains several
+ * blocks groups.  Each group contains 1 bitmap block for blocks, 1 bitmap
+ * block for inodes, N blocks for the inode table and data blocks.
+ *
+ * The file system contains group descriptors which are located after the
+ * super block.  Each descriptor contains the number of the bitmap block and
+ * the free blocks count in the block.  The descriptors are loaded in memory
+ * when a file system is mounted (see ext4_read_super).
+ */
+
+
+#define in_range(b, first, len) ((b) >= (first) && (b) <= (first) + (len) - 1)
+
+/**
+ * ext4_get_group_desc() -- load group descriptor from disk
+ * @sb:                 super block
+ * @block_group:        given block group
+ * @bh:                 pointer to the buffer head to store the block
+ *                      group descriptor
+ */
+struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
+                                             unsigned int block_group,
+                                             struct buffer_head ** bh)
+{
+        unsigned long group_desc;
+        unsigned long offset;
+        struct ext4_group_desc * desc;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+
+        if (block_group >= sbi->s_groups_count) {
+                ext4_error (sb, "ext4_get_group_desc",
+                            "block_group >= groups_count - "
+                            "block_group = %d, groups_count = %lu",
+                            block_group, sbi->s_groups_count);
+
+                return NULL;
+        }
+        smp_rmb();
+
+        group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
+        offset = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
+        if (!sbi->s_group_desc[group_desc]) {
+                ext4_error (sb, "ext4_get_group_desc",
+                            "Group descriptor not loaded - "
+                            "block_group = %d, group_desc = %lu, desc = %lu",
+                             block_group, group_desc, offset);
+                return NULL;
+        }
+
+        desc = (struct ext4_group_desc *)(
+                (__u8 *)sbi->s_group_desc[group_desc]->b_data +
+                offset * EXT4_DESC_SIZE(sb));
+        if (bh)
+                *bh = sbi->s_group_desc[group_desc];
+        return desc;
+}
+
+/**
+ * read_block_bitmap()
+ * @sb:                 super block
+ * @block_group:        given block group
+ *
+ * Read the bitmap for a given block_group, reading into the specified
+ * slot in the superblock's bitmap cache.
+ *
+ * Return buffer_head on success or NULL in case of failure.
+ */
+static struct buffer_head *
+read_block_bitmap(struct super_block *sb, unsigned int block_group)
+{
+        struct ext4_group_desc * desc;
+        struct buffer_head * bh = NULL;
+
+        desc = ext4_get_group_desc (sb, block_group, NULL);
+        if (!desc)
+                goto error_out;
+        bh = sb_bread(sb, ext4_block_bitmap(sb, desc));
+        if (!bh)
+                ext4_error (sb, "read_block_bitmap",
+                            "Cannot read block bitmap - "
+                            "block_group = %d, block_bitmap = %llu",
+                            block_group,
+                            ext4_block_bitmap(sb, desc));
+error_out:
+        return bh;
+}
+/*
+ * The reservation window structure operations
+ * --------------------------------------------
+ * Operations include:
+ * dump, find, add, remove, is_empty, find_next_reservable_window, etc.
+ *
+ * We use a red-black tree to represent per-filesystem reservation
+ * windows.
+ *
+ */
+
+/**
+ * __rsv_window_dump() -- Dump the filesystem block allocation reservation map
+ * @rb_root:            root of per-filesystem reservation rb tree
+ * @verbose:            verbose mode
+ * @fn:                 function which wishes to dump the reservation map
+ *
+ * If verbose is turned on, it will print the whole block reservation
+ * windows(start, end). Otherwise, it will only print out the "bad" windows,
+ * those windows that overlap with their immediate neighbors.
+ */
+#if 1
+static void __rsv_window_dump(struct rb_root *root, int verbose,
+                              const char *fn)
+{
+        struct rb_node *n;
+        struct ext4_reserve_window_node *rsv, *prev;
+        int bad;
+
+restart:
+        n = rb_first(root);
+        bad = 0;
+        prev = NULL;
+
+        printk("Block Allocation Reservation Windows Map (%s):\n", fn);
+        while (n) {
+                rsv = list_entry(n, struct ext4_reserve_window_node, rsv_node);
+                if (verbose)
+                        printk("reservation window 0x%p "
+                               "start:  %llu, end:  %llu\n",
+                               rsv, rsv->rsv_start, rsv->rsv_end);
+                if (rsv->rsv_start && rsv->rsv_start >= rsv->rsv_end) {
+                        printk("Bad reservation %p (start >= end)\n",
+                               rsv);
+                        bad = 1;
+                }
+                if (prev && prev->rsv_end >= rsv->rsv_start) {
+                        printk("Bad reservation %p (prev->end >= start)\n",
+                               rsv);
+                        bad = 1;
+                }
+                if (bad) {
+                        if (!verbose) {
+                                printk("Restarting reservation walk in verbose mode\n");
+                                verbose = 1;
+                                goto restart;
+                        }
+                }
+                n = rb_next(n);
+                prev = rsv;
+        }
+        printk("Window map complete.\n");
+        if (bad)
+                BUG();
+}
+#define rsv_window_dump(root, verbose) \
+        __rsv_window_dump((root), (verbose), __FUNCTION__)
+#else
+#define rsv_window_dump(root, verbose) do {} while (0)
+#endif
+
+/**
+ * goal_in_my_reservation()
+ * @rsv:                inode's reservation window
+ * @grp_goal:           given goal block relative to the allocation block group
+ * @group:              the current allocation block group
+ * @sb:                 filesystem super block
+ *
+ * Test if the given goal block (group relative) is within the file's
+ * own block reservation window range.
+ *
+ * If the reservation window is outside the goal allocation group, return 0;
+ * grp_goal (given goal block) could be -1, which means no specific
+ * goal block. In this case, always return 1.
+ * If the goal block is within the reservation window, return 1;
+ * otherwise, return 0;
+ */
+static int
+goal_in_my_reservation(struct ext4_reserve_window *rsv, ext4_grpblk_t grp_goal,
+                        unsigned int group, struct super_block * sb)
+{
+        ext4_fsblk_t group_first_block, group_last_block;
+
+        group_first_block = ext4_group_first_block_no(sb, group);
+        group_last_block = group_first_block + (EXT4_BLOCKS_PER_GROUP(sb) - 1);
+
+        if ((rsv->_rsv_start > group_last_block) ||
+            (rsv->_rsv_end < group_first_block))
+                return 0;
+        if ((grp_goal >= 0) && ((grp_goal + group_first_block < rsv->_rsv_start)
+                || (grp_goal + group_first_block > rsv->_rsv_end)))
+                return 0;
+        return 1;
+}
+
+/**
+ * search_reserve_window()
+ * @rb_root:            root of reservation tree
+ * @goal:               target allocation block
+ *
+ * Find the reserved window which includes the goal, or the previous one
+ * if the goal is not in any window.
+ * Returns NULL if there are no windows or if all windows start after the goal.
+ */
+static struct ext4_reserve_window_node *
+search_reserve_window(struct rb_root *root, ext4_fsblk_t goal)
+{
+        struct rb_node *n = root->rb_node;
+        struct ext4_reserve_window_node *rsv;
+
+        if (!n)
+                return NULL;
+
+        do {
+                rsv = rb_entry(n, struct ext4_reserve_window_node, rsv_node);
+
+                if (goal < rsv->rsv_start)
+                        n = n->rb_left;
+                else if (goal > rsv->rsv_end)
+                        n = n->rb_right;
+                else
+                        return rsv;
+        } while (n);
+        /*
+         * We've fallen off the end of the tree: the goal wasn't inside
+         * any particular node.  OK, the previous node must be to one
+         * side of the interval containing the goal.  If it's the RHS,
+         * we need to back up one.
+         */
+        if (rsv->rsv_start > goal) {
+                n = rb_prev(&rsv->rsv_node);
+                rsv = rb_entry(n, struct ext4_reserve_window_node, rsv_node);
+        }
+        return rsv;
+}
+
+/**
+ * ext4_rsv_window_add() -- Insert a window to the block reservation rb tree.
+ * @sb:                 super block
+ * @rsv:                reservation window to add
+ *
+ * Must be called with rsv_lock hold.
+ */
+void ext4_rsv_window_add(struct super_block *sb,
+                    struct ext4_reserve_window_node *rsv)
+{
+        struct rb_root *root = &EXT4_SB(sb)->s_rsv_window_root;
+        struct rb_node *node = &rsv->rsv_node;
+        ext4_fsblk_t start = rsv->rsv_start;
+
+        struct rb_node ** p = &root->rb_node;
+        struct rb_node * parent = NULL;
+        struct ext4_reserve_window_node *this;
+
+        while (*p)
+        {
+                parent = *p;
+                this = rb_entry(parent, struct ext4_reserve_window_node, rsv_node);
+
+                if (start < this->rsv_start)
+                        p = &(*p)->rb_left;
+                else if (start > this->rsv_end)
+                        p = &(*p)->rb_right;
+                else {
+                        rsv_window_dump(root, 1);
+                        BUG();
+                }
+        }
+
+        rb_link_node(node, parent, p);
+        rb_insert_color(node, root);
+}
+
+/**
+ * ext4_rsv_window_remove() -- unlink a window from the reservation rb tree
+ * @sb:                 super block
+ * @rsv:                reservation window to remove
+ *
+ * Mark the block reservation window as not allocated, and unlink it
+ * from the filesystem reservation window rb tree. Must be called with
+ * rsv_lock hold.
+ */
+static void rsv_window_remove(struct super_block *sb,
+                              struct ext4_reserve_window_node *rsv)
+{
+        rsv->rsv_start = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+        rsv->rsv_end = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+        rsv->rsv_alloc_hit = 0;
+        rb_erase(&rsv->rsv_node, &EXT4_SB(sb)->s_rsv_window_root);
+}
+
+/*
+ * rsv_is_empty() -- Check if the reservation window is allocated.
+ * @rsv:                given reservation window to check
+ *
+ * returns 1 if the end block is EXT4_RESERVE_WINDOW_NOT_ALLOCATED.
+ */
+static inline int rsv_is_empty(struct ext4_reserve_window *rsv)
+{
+        /* a valid reservation end block could not be 0 */
+        return rsv->_rsv_end == EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+}
+
+/**
+ * ext4_init_block_alloc_info()
+ * @inode:              file inode structure
+ *
+ * Allocate and initialize the  reservation window structure, and
+ * link the window to the ext4 inode structure at last
+ *
+ * The reservation window structure is only dynamically allocated
+ * and linked to ext4 inode the first time the open file
+ * needs a new block. So, before every ext4_new_block(s) call, for
+ * regular files, we should check whether the reservation window
+ * structure exists or not. In the latter case, this function is called.
+ * Fail to do so will result in block reservation being turned off for that
+ * open file.
+ *
+ * This function is called from ext4_get_blocks_handle(), also called
+ * when setting the reservation window size through ioctl before the file
+ * is open for write (needs block allocation).
+ *
+ * Needs truncate_mutex protection prior to call this function.
+ */
+void ext4_init_block_alloc_info(struct inode *inode)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct ext4_block_alloc_info *block_i = ei->i_block_alloc_info;
+        struct super_block *sb = inode->i_sb;
+
+        block_i = kmalloc(sizeof(*block_i), GFP_NOFS);
+        if (block_i) {
+                struct ext4_reserve_window_node *rsv = &block_i->rsv_window_node;
+
+                rsv->rsv_start = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+                rsv->rsv_end = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+
+                /*
+                 * if filesystem is mounted with NORESERVATION, the goal
+                 * reservation window size is set to zero to indicate
+                 * block reservation is off
+                 */
+                if (!test_opt(sb, RESERVATION))
+                        rsv->rsv_goal_size = 0;
+                else
+                        rsv->rsv_goal_size = EXT4_DEFAULT_RESERVE_BLOCKS;
+                rsv->rsv_alloc_hit = 0;
+                block_i->last_alloc_logical_block = 0;
+                block_i->last_alloc_physical_block = 0;
+        }
+        ei->i_block_alloc_info = block_i;
+}
+
+/**
+ * ext4_discard_reservation()
+ * @inode:              inode
+ *
+ * Discard(free) block reservation window on last file close, or truncate
+ * or at last iput().
+ *
+ * It is being called in three cases:
+ *      ext4_release_file(): last writer close the file
+ *      ext4_clear_inode(): last iput(), when nobody link to this file.
+ *      ext4_truncate(): when the block indirect map is about to change.
+ *
+ */
+void ext4_discard_reservation(struct inode *inode)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct ext4_block_alloc_info *block_i = ei->i_block_alloc_info;
+        struct ext4_reserve_window_node *rsv;
+        spinlock_t *rsv_lock = &EXT4_SB(inode->i_sb)->s_rsv_window_lock;
+
+        if (!block_i)
+                return;
+
+        rsv = &block_i->rsv_window_node;
+        if (!rsv_is_empty(&rsv->rsv_window)) {
+                spin_lock(rsv_lock);
+                if (!rsv_is_empty(&rsv->rsv_window))
+                        rsv_window_remove(inode->i_sb, rsv);
+                spin_unlock(rsv_lock);
+        }
+}
+
+/**
+ * ext4_free_blocks_sb() -- Free given blocks and update quota
+ * @handle:                     handle to this transaction
+ * @sb:                         super block
+ * @block:                      start physcial block to free
+ * @count:                      number of blocks to free
+ * @pdquot_freed_blocks:        pointer to quota
+ */
+void ext4_free_blocks_sb(handle_t *handle, struct super_block *sb,
+                         ext4_fsblk_t block, unsigned long count,
+                         unsigned long *pdquot_freed_blocks)
+{
+        struct buffer_head *bitmap_bh = NULL;
+        struct buffer_head *gd_bh;
+        unsigned long block_group;
+        ext4_grpblk_t bit;
+        unsigned long i;
+        unsigned long overflow;
+        struct ext4_group_desc * desc;
+        struct ext4_super_block * es;
+        struct ext4_sb_info *sbi;
+        int err = 0, ret;
+        ext4_grpblk_t group_freed;
+
+        *pdquot_freed_blocks = 0;
+        sbi = EXT4_SB(sb);
+        es = sbi->s_es;
+        if (block < le32_to_cpu(es->s_first_data_block) ||
+            block + count < block ||
+            block + count > ext4_blocks_count(es)) {
+                ext4_error (sb, "ext4_free_blocks",
+                            "Freeing blocks not in datazone - "
+                            "block = %llu, count = %lu", block, count);
+                goto error_return;
+        }
+
+        ext4_debug ("freeing block(s) %llu-%llu\n", block, block + count - 1);
+
+do_more:
+        overflow = 0;
+        ext4_get_group_no_and_offset(sb, block, &block_group, &bit);
+        /*
+         * Check to see if we are freeing blocks across a group
+         * boundary.
+         */
+        if (bit + count > EXT4_BLOCKS_PER_GROUP(sb)) {
+                overflow = bit + count - EXT4_BLOCKS_PER_GROUP(sb);
+                count -= overflow;
+        }
+        brelse(bitmap_bh);
+        bitmap_bh = read_block_bitmap(sb, block_group);
+        if (!bitmap_bh)
+                goto error_return;
+        desc = ext4_get_group_desc (sb, block_group, &gd_bh);
+        if (!desc)
+                goto error_return;
+
+        if (in_range(ext4_block_bitmap(sb, desc), block, count) ||
+            in_range(ext4_inode_bitmap(sb, desc), block, count) ||
+            in_range(block, ext4_inode_table(sb, desc), sbi->s_itb_per_group) ||
+            in_range(block + count - 1, ext4_inode_table(sb, desc),
+                     sbi->s_itb_per_group))
+                ext4_error (sb, "ext4_free_blocks",
+                            "Freeing blocks in system zones - "
+                            "Block = %llu, count = %lu",
+                            block, count);
+
+        /*
+         * We are about to start releasing blocks in the bitmap,
+         * so we need undo access.
+         */
+        /* @@@ check errors */
+        BUFFER_TRACE(bitmap_bh, "getting undo access");
+        err = ext4_journal_get_undo_access(handle, bitmap_bh);
+        if (err)
+                goto error_return;
+
+        /*
+         * We are about to modify some metadata.  Call the journal APIs
+         * to unshare ->b_data if a currently-committing transaction is
+         * using it
+         */
+        BUFFER_TRACE(gd_bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, gd_bh);
+        if (err)
+                goto error_return;
+
+        jbd_lock_bh_state(bitmap_bh);
+
+        for (i = 0, group_freed = 0; i < count; i++) {
+                /*
+                 * An HJ special.  This is expensive...
+                 */
+#ifdef CONFIG_JBD_DEBUG
+                jbd_unlock_bh_state(bitmap_bh);
+                {
+                        struct buffer_head *debug_bh;
+                        debug_bh = sb_find_get_block(sb, block + i);
+                        if (debug_bh) {
+                                BUFFER_TRACE(debug_bh, "Deleted!");
+                                if (!bh2jh(bitmap_bh)->b_committed_data)
+                                        BUFFER_TRACE(debug_bh,
+                                                "No commited data in bitmap");
+                                BUFFER_TRACE2(debug_bh, bitmap_bh, "bitmap");
+                                __brelse(debug_bh);
+                        }
+                }
+                jbd_lock_bh_state(bitmap_bh);
+#endif
+                if (need_resched()) {
+                        jbd_unlock_bh_state(bitmap_bh);
+                        cond_resched();
+                        jbd_lock_bh_state(bitmap_bh);
+                }
+                /* @@@ This prevents newly-allocated data from being
+                 * freed and then reallocated within the same
+                 * transaction.
+                 *
+                 * Ideally we would want to allow that to happen, but to
+                 * do so requires making jbd2_journal_forget() capable of
+                 * revoking the queued write of a data block, which
+                 * implies blocking on the journal lock.  *forget()
+                 * cannot block due to truncate races.
+                 *
+                 * Eventually we can fix this by making jbd2_journal_forget()
+                 * return a status indicating whether or not it was able
+                 * to revoke the buffer.  On successful revoke, it is
+                 * safe not to set the allocation bit in the committed
+                 * bitmap, because we know that there is no outstanding
+                 * activity on the buffer any more and so it is safe to
+                 * reallocate it.
+                 */
+                BUFFER_TRACE(bitmap_bh, "set in b_committed_data");
+                J_ASSERT_BH(bitmap_bh,
+                                bh2jh(bitmap_bh)->b_committed_data != NULL);
+                ext4_set_bit_atomic(sb_bgl_lock(sbi, block_group), bit + i,
+                                bh2jh(bitmap_bh)->b_committed_data);
+
+                /*
+                 * We clear the bit in the bitmap after setting the committed
+                 * data bit, because this is the reverse order to that which
+                 * the allocator uses.
+                 */
+                BUFFER_TRACE(bitmap_bh, "clear bit");
+                if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
+                                                bit + i, bitmap_bh->b_data)) {
+                        jbd_unlock_bh_state(bitmap_bh);
+                        ext4_error(sb, __FUNCTION__,
+                                   "bit already cleared for block %llu",
+                                   (ext4_fsblk_t)(block + i));
+                        jbd_lock_bh_state(bitmap_bh);
+                        BUFFER_TRACE(bitmap_bh, "bit already cleared");
+                } else {
+                        group_freed++;
+                }
+        }
+        jbd_unlock_bh_state(bitmap_bh);
+
+        spin_lock(sb_bgl_lock(sbi, block_group));
+        desc->bg_free_blocks_count =
+                cpu_to_le16(le16_to_cpu(desc->bg_free_blocks_count) +
+                        group_freed);
+        spin_unlock(sb_bgl_lock(sbi, block_group));
+        percpu_counter_mod(&sbi->s_freeblocks_counter, count);
+
+        /* We dirtied the bitmap block */
+        BUFFER_TRACE(bitmap_bh, "dirtied bitmap block");
+        err = ext4_journal_dirty_metadata(handle, bitmap_bh);
+
+        /* And the group descriptor block */
+        BUFFER_TRACE(gd_bh, "dirtied group descriptor block");
+        ret = ext4_journal_dirty_metadata(handle, gd_bh);
+        if (!err) err = ret;
+        *pdquot_freed_blocks += group_freed;
+
+        if (overflow && !err) {
+                block += count;
+                count = overflow;
+                goto do_more;
+        }
+        sb->s_dirt = 1;
+error_return:
+        brelse(bitmap_bh);
+        ext4_std_error(sb, err);
+        return;
+}
+
+/**
+ * ext4_free_blocks() -- Free given blocks and update quota
+ * @handle:             handle for this transaction
+ * @inode:              inode
+ * @block:              start physical block to free
+ * @count:              number of blocks to count
+ */
+void ext4_free_blocks(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t block, unsigned long count)
+{
+        struct super_block * sb;
+        unsigned long dquot_freed_blocks;
+
+        sb = inode->i_sb;
+        if (!sb) {
+                printk ("ext4_free_blocks: nonexistent device");
+                return;
+        }
+        ext4_free_blocks_sb(handle, sb, block, count, &dquot_freed_blocks);
+        if (dquot_freed_blocks)
+                DQUOT_FREE_BLOCK(inode, dquot_freed_blocks);
+        return;
+}
+
+/**
+ * ext4_test_allocatable()
+ * @nr:                 given allocation block group
+ * @bh:                 bufferhead contains the bitmap of the given block group
+ *
+ * For ext4 allocations, we must not reuse any blocks which are
+ * allocated in the bitmap buffer's "last committed data" copy.  This
+ * prevents deletes from freeing up the page for reuse until we have
+ * committed the delete transaction.
+ *
+ * If we didn't do this, then deleting something and reallocating it as
+ * data would allow the old block to be overwritten before the
+ * transaction committed (because we force data to disk before commit).
+ * This would lead to corruption if we crashed between overwriting the
+ * data and committing the delete.
+ *
+ * @@@ We may want to make this allocation behaviour conditional on
+ * data-writes at some point, and disable it for metadata allocations or
+ * sync-data inodes.
+ */
+static int ext4_test_allocatable(ext4_grpblk_t nr, struct buffer_head *bh)
+{
+        int ret;
+        struct journal_head *jh = bh2jh(bh);
+
+        if (ext4_test_bit(nr, bh->b_data))
+                return 0;
+
+        jbd_lock_bh_state(bh);
+        if (!jh->b_committed_data)
+                ret = 1;
+        else
+                ret = !ext4_test_bit(nr, jh->b_committed_data);
+        jbd_unlock_bh_state(bh);
+        return ret;
+}
+
+/**
+ * bitmap_search_next_usable_block()
+ * @start:              the starting block (group relative) of the search
+ * @bh:                 bufferhead contains the block group bitmap
+ * @maxblocks:          the ending block (group relative) of the reservation
+ *
+ * The bitmap search --- search forward alternately through the actual
+ * bitmap on disk and the last-committed copy in journal, until we find a
+ * bit free in both bitmaps.
+ */
+static ext4_grpblk_t
+bitmap_search_next_usable_block(ext4_grpblk_t start, struct buffer_head *bh,
+                                        ext4_grpblk_t maxblocks)
+{
+        ext4_grpblk_t next;
+        struct journal_head *jh = bh2jh(bh);
+
+        while (start < maxblocks) {
+                next = ext4_find_next_zero_bit(bh->b_data, maxblocks, start);
+                if (next >= maxblocks)
+                        return -1;
+                if (ext4_test_allocatable(next, bh))
+                        return next;
+                jbd_lock_bh_state(bh);
+                if (jh->b_committed_data)
+                        start = ext4_find_next_zero_bit(jh->b_committed_data,
+                                                        maxblocks, next);
+                jbd_unlock_bh_state(bh);
+        }
+        return -1;
+}
+
+/**
+ * find_next_usable_block()
+ * @start:              the starting block (group relative) to find next
+ *                      allocatable block in bitmap.
+ * @bh:                 bufferhead contains the block group bitmap
+ * @maxblocks:          the ending block (group relative) for the search
+ *
+ * Find an allocatable block in a bitmap.  We honor both the bitmap and
+ * its last-committed copy (if that exists), and perform the "most
+ * appropriate allocation" algorithm of looking for a free block near
+ * the initial goal; then for a free byte somewhere in the bitmap; then
+ * for any free bit in the bitmap.
+ */
+static ext4_grpblk_t
+find_next_usable_block(ext4_grpblk_t start, struct buffer_head *bh,
+                        ext4_grpblk_t maxblocks)
+{
+        ext4_grpblk_t here, next;
+        char *p, *r;
+
+        if (start > 0) {
+                /*
+                 * The goal was occupied; search forward for a free
+                 * block within the next XX blocks.
+                 *
+                 * end_goal is more or less random, but it has to be
+                 * less than EXT4_BLOCKS_PER_GROUP. Aligning up to the
+                 * next 64-bit boundary is simple..
+                 */
+                ext4_grpblk_t end_goal = (start + 63) & ~63;
+                if (end_goal > maxblocks)
+                        end_goal = maxblocks;
+                here = ext4_find_next_zero_bit(bh->b_data, end_goal, start);
+                if (here < end_goal && ext4_test_allocatable(here, bh))
+                        return here;
+                ext4_debug("Bit not found near goal\n");
+        }
+
+        here = start;
+        if (here < 0)
+                here = 0;
+
+        p = ((char *)bh->b_data) + (here >> 3);
+        r = memscan(p, 0, (maxblocks - here + 7) >> 3);
+        next = (r - ((char *)bh->b_data)) << 3;
+
+        if (next < maxblocks && next >= start && ext4_test_allocatable(next, bh))
+                return next;
+
+        /*
+         * The bitmap search --- search forward alternately through the actual
+         * bitmap and the last-committed copy until we find a bit free in
+         * both
+         */
+        here = bitmap_search_next_usable_block(here, bh, maxblocks);
+        return here;
+}
+
+/**
+ * claim_block()
+ * @block:              the free block (group relative) to allocate
+ * @bh:                 the bufferhead containts the block group bitmap
+ *
+ * We think we can allocate this block in this bitmap.  Try to set the bit.
+ * If that succeeds then check that nobody has allocated and then freed the
+ * block since we saw that is was not marked in b_committed_data.  If it _was_
+ * allocated and freed then clear the bit in the bitmap again and return
+ * zero (failure).
+ */
+static inline int
+claim_block(spinlock_t *lock, ext4_grpblk_t block, struct buffer_head *bh)
+{
+        struct journal_head *jh = bh2jh(bh);
+        int ret;
+
+        if (ext4_set_bit_atomic(lock, block, bh->b_data))
+                return 0;
+        jbd_lock_bh_state(bh);
+        if (jh->b_committed_data && ext4_test_bit(block,jh->b_committed_data)) {
+                ext4_clear_bit_atomic(lock, block, bh->b_data);
+                ret = 0;
+        } else {
+                ret = 1;
+        }
+        jbd_unlock_bh_state(bh);
+        return ret;
+}
+
+/**
+ * ext4_try_to_allocate()
+ * @sb:                 superblock
+ * @handle:             handle to this transaction
+ * @group:              given allocation block group
+ * @bitmap_bh:          bufferhead holds the block bitmap
+ * @grp_goal:           given target block within the group
+ * @count:              target number of blocks to allocate
+ * @my_rsv:             reservation window
+ *
+ * Attempt to allocate blocks within a give range. Set the range of allocation
+ * first, then find the first free bit(s) from the bitmap (within the range),
+ * and at last, allocate the blocks by claiming the found free bit as allocated.
+ *
+ * To set the range of this allocation:
+ *      if there is a reservation window, only try to allocate block(s) from the
+ *      file's own reservation window;
+ *      Otherwise, the allocation range starts from the give goal block, ends at
+ *      the block group's last block.
+ *
+ * If we failed to allocate the desired block then we may end up crossing to a
+ * new bitmap.  In that case we must release write access to the old one via
+ * ext4_journal_release_buffer(), else we'll run out of credits.
+ */
+static ext4_grpblk_t
+ext4_try_to_allocate(struct super_block *sb, handle_t *handle, int group,
+                        struct buffer_head *bitmap_bh, ext4_grpblk_t grp_goal,
+                        unsigned long *count, struct ext4_reserve_window *my_rsv)
+{
+        ext4_fsblk_t group_first_block;
+        ext4_grpblk_t start, end;
+        unsigned long num = 0;
+
+        /* we do allocation within the reservation window if we have a window */
+        if (my_rsv) {
+                group_first_block = ext4_group_first_block_no(sb, group);
+                if (my_rsv->_rsv_start >= group_first_block)
+                        start = my_rsv->_rsv_start - group_first_block;
+                else
+                        /* reservation window cross group boundary */
+                        start = 0;
+                end = my_rsv->_rsv_end - group_first_block + 1;
+                if (end > EXT4_BLOCKS_PER_GROUP(sb))
+                        /* reservation window crosses group boundary */
+                        end = EXT4_BLOCKS_PER_GROUP(sb);
+                if ((start <= grp_goal) && (grp_goal < end))
+                        start = grp_goal;
+                else
+                        grp_goal = -1;
+        } else {
+                if (grp_goal > 0)
+                        start = grp_goal;
+                else
+                        start = 0;
+                end = EXT4_BLOCKS_PER_GROUP(sb);
+        }
+
+        BUG_ON(start > EXT4_BLOCKS_PER_GROUP(sb));
+
+repeat:
+        if (grp_goal < 0 || !ext4_test_allocatable(grp_goal, bitmap_bh)) {
+                grp_goal = find_next_usable_block(start, bitmap_bh, end);
+                if (grp_goal < 0)
+                        goto fail_access;
+                if (!my_rsv) {
+                        int i;
+
+                        for (i = 0; i < 7 && grp_goal > start &&
+                                        ext4_test_allocatable(grp_goal - 1,
+                                                                bitmap_bh);
+                                        i++, grp_goal--)
+                                ;
+                }
+        }
+        start = grp_goal;
+
+        if (!claim_block(sb_bgl_lock(EXT4_SB(sb), group),
+                grp_goal, bitmap_bh)) {
+                /*
+                 * The block was allocated by another thread, or it was
+                 * allocated and then freed by another thread
+                 */
+                start++;
+                grp_goal++;
+                if (start >= end)
+                        goto fail_access;
+                goto repeat;
+        }
+        num++;
+        grp_goal++;
+        while (num < *count && grp_goal < end
+                && ext4_test_allocatable(grp_goal, bitmap_bh)
+                && claim_block(sb_bgl_lock(EXT4_SB(sb), group),
+                                grp_goal, bitmap_bh)) {
+                num++;
+                grp_goal++;
+        }
+        *count = num;
+        return grp_goal - num;
+fail_access:
+        *count = num;
+        return -1;
+}
+
+/**
+ *      find_next_reservable_window():
+ *              find a reservable space within the given range.
+ *              It does not allocate the reservation window for now:
+ *              alloc_new_reservation() will do the work later.
+ *
+ *      @search_head: the head of the searching list;
+ *              This is not necessarily the list head of the whole filesystem
+ *
+ *              We have both head and start_block to assist the search
+ *              for the reservable space. The list starts from head,
+ *              but we will shift to the place where start_block is,
+ *              then start from there, when looking for a reservable space.
+ *
+ *      @size: the target new reservation window size
+ *
+ *      @group_first_block: the first block we consider to start
+ *                      the real search from
+ *
+ *      @last_block:
+ *              the maximum block number that our goal reservable space
+ *              could start from. This is normally the last block in this
+ *              group. The search will end when we found the start of next
+ *              possible reservable space is out of this boundary.
+ *              This could handle the cross boundary reservation window
+ *              request.
+ *
+ *      basically we search from the given range, rather than the whole
+ *      reservation double linked list, (start_block, last_block)
+ *      to find a free region that is of my size and has not
+ *      been reserved.
+ *
+ */
+static int find_next_reservable_window(
+                                struct ext4_reserve_window_node *search_head,
+                                struct ext4_reserve_window_node *my_rsv,
+                                struct super_block * sb,
+                                ext4_fsblk_t start_block,
+                                ext4_fsblk_t last_block)
+{
+        struct rb_node *next;
+        struct ext4_reserve_window_node *rsv, *prev;
+        ext4_fsblk_t cur;
+        int size = my_rsv->rsv_goal_size;
+
+        /* TODO: make the start of the reservation window byte-aligned */
+        /* cur = *start_block & ~7;*/
+        cur = start_block;
+        rsv = search_head;
+        if (!rsv)
+                return -1;
+
+        while (1) {
+                if (cur <= rsv->rsv_end)
+                        cur = rsv->rsv_end + 1;
+
+                /* TODO?
+                 * in the case we could not find a reservable space
+                 * that is what is expected, during the re-search, we could
+                 * remember what's the largest reservable space we could have
+                 * and return that one.
+                 *
+                 * For now it will fail if we could not find the reservable
+                 * space with expected-size (or more)...
+                 */
+                if (cur > last_block)
+                        return -1;              /* fail */
+
+                prev = rsv;
+                next = rb_next(&rsv->rsv_node);
+                rsv = list_entry(next,struct ext4_reserve_window_node,rsv_node);
+
+                /*
+                 * Reached the last reservation, we can just append to the
+                 * previous one.
+                 */
+                if (!next)
+                        break;
+
+                if (cur + size <= rsv->rsv_start) {
+                        /*
+                         * Found a reserveable space big enough.  We could
+                         * have a reservation across the group boundary here
+                         */
+                        break;
+                }
+        }
+        /*
+         * we come here either :
+         * when we reach the end of the whole list,
+         * and there is empty reservable space after last entry in the list.
+         * append it to the end of the list.
+         *
+         * or we found one reservable space in the middle of the list,
+         * return the reservation window that we could append to.
+         * succeed.
+         */
+
+        if ((prev != my_rsv) && (!rsv_is_empty(&my_rsv->rsv_window)))
+                rsv_window_remove(sb, my_rsv);
+
+        /*
+         * Let's book the whole avaliable window for now.  We will check the
+         * disk bitmap later and then, if there are free blocks then we adjust
+         * the window size if it's larger than requested.
+         * Otherwise, we will remove this node from the tree next time
+         * call find_next_reservable_window.
+         */
+        my_rsv->rsv_start = cur;
+        my_rsv->rsv_end = cur + size - 1;
+        my_rsv->rsv_alloc_hit = 0;
+
+        if (prev != my_rsv)
+                ext4_rsv_window_add(sb, my_rsv);
+
+        return 0;
+}
+
+/**
+ *      alloc_new_reservation()--allocate a new reservation window
+ *
+ *              To make a new reservation, we search part of the filesystem
+ *              reservation list (the list that inside the group). We try to
+ *              allocate a new reservation window near the allocation goal,
+ *              or the beginning of the group, if there is no goal.
+ *
+ *              We first find a reservable space after the goal, then from
+ *              there, we check the bitmap for the first free block after
+ *              it. If there is no free block until the end of group, then the
+ *              whole group is full, we failed. Otherwise, check if the free
+ *              block is inside the expected reservable space, if so, we
+ *              succeed.
+ *              If the first free block is outside the reservable space, then
+ *              start from the first free block, we search for next available
+ *              space, and go on.
+ *
+ *      on succeed, a new reservation will be found and inserted into the list
+ *      It contains at least one free block, and it does not overlap with other
+ *      reservation windows.
+ *
+ *      failed: we failed to find a reservation window in this group
+ *
+ *      @rsv: the reservation
+ *
+ *      @grp_goal: The goal (group-relative).  It is where the search for a
+ *              free reservable space should start from.
+ *              if we have a grp_goal(grp_goal >0 ), then start from there,
+ *              no grp_goal(grp_goal = -1), we start from the first block
+ *              of the group.
+ *
+ *      @sb: the super block
+ *      @group: the group we are trying to allocate in
+ *      @bitmap_bh: the block group block bitmap
+ *
+ */
+static int alloc_new_reservation(struct ext4_reserve_window_node *my_rsv,
+                ext4_grpblk_t grp_goal, struct super_block *sb,
+                unsigned int group, struct buffer_head *bitmap_bh)
+{
+        struct ext4_reserve_window_node *search_head;
+        ext4_fsblk_t group_first_block, group_end_block, start_block;
+        ext4_grpblk_t first_free_block;
+        struct rb_root *fs_rsv_root = &EXT4_SB(sb)->s_rsv_window_root;
+        unsigned long size;
+        int ret;
+        spinlock_t *rsv_lock = &EXT4_SB(sb)->s_rsv_window_lock;
+
+        group_first_block = ext4_group_first_block_no(sb, group);
+        group_end_block = group_first_block + (EXT4_BLOCKS_PER_GROUP(sb) - 1);
+
+        if (grp_goal < 0)
+                start_block = group_first_block;
+        else
+                start_block = grp_goal + group_first_block;
+
+        size = my_rsv->rsv_goal_size;
+
+        if (!rsv_is_empty(&my_rsv->rsv_window)) {
+                /*
+                 * if the old reservation is cross group boundary
+                 * and if the goal is inside the old reservation window,
+                 * we will come here when we just failed to allocate from
+                 * the first part of the window. We still have another part
+                 * that belongs to the next group. In this case, there is no
+                 * point to discard our window and try to allocate a new one
+                 * in this group(which will fail). we should
+                 * keep the reservation window, just simply move on.
+                 *
+                 * Maybe we could shift the start block of the reservation
+                 * window to the first block of next group.
+                 */
+
+                if ((my_rsv->rsv_start <= group_end_block) &&
+                                (my_rsv->rsv_end > group_end_block) &&
+                                (start_block >= my_rsv->rsv_start))
+                        return -1;
+
+                if ((my_rsv->rsv_alloc_hit >
+                     (my_rsv->rsv_end - my_rsv->rsv_start + 1) / 2)) {
+                        /*
+                         * if the previously allocation hit ratio is
+                         * greater than 1/2, then we double the size of
+                         * the reservation window the next time,
+                         * otherwise we keep the same size window
+                         */
+                        size = size * 2;
+                        if (size > EXT4_MAX_RESERVE_BLOCKS)
+                                size = EXT4_MAX_RESERVE_BLOCKS;
+                        my_rsv->rsv_goal_size= size;
+                }
+        }
+
+        spin_lock(rsv_lock);
+        /*
+         * shift the search start to the window near the goal block
+         */
+        search_head = search_reserve_window(fs_rsv_root, start_block);
+
+        /*
+         * find_next_reservable_window() simply finds a reservable window
+         * inside the given range(start_block, group_end_block).
+         *
+         * To make sure the reservation window has a free bit inside it, we
+         * need to check the bitmap after we found a reservable window.
+         */
+retry:
+        ret = find_next_reservable_window(search_head, my_rsv, sb,
+                                                start_block, group_end_block);
+
+        if (ret == -1) {
+                if (!rsv_is_empty(&my_rsv->rsv_window))
+                        rsv_window_remove(sb, my_rsv);
+                spin_unlock(rsv_lock);
+                return -1;
+        }
+
+        /*
+         * On success, find_next_reservable_window() returns the
+         * reservation window where there is a reservable space after it.
+         * Before we reserve this reservable space, we need
+         * to make sure there is at least a free block inside this region.
+         *
+         * searching the first free bit on the block bitmap and copy of
+         * last committed bitmap alternatively, until we found a allocatable
+         * block. Search start from the start block of the reservable space
+         * we just found.
+         */
+        spin_unlock(rsv_lock);
+        first_free_block = bitmap_search_next_usable_block(
+                        my_rsv->rsv_start - group_first_block,
+                        bitmap_bh, group_end_block - group_first_block + 1);
+
+        if (first_free_block < 0) {
+                /*
+                 * no free block left on the bitmap, no point
+                 * to reserve the space. return failed.
+                 */
+                spin_lock(rsv_lock);
+                if (!rsv_is_empty(&my_rsv->rsv_window))
+                        rsv_window_remove(sb, my_rsv);
+                spin_unlock(rsv_lock);
+                return -1;              /* failed */
+        }
+
+        start_block = first_free_block + group_first_block;
+        /*
+         * check if the first free block is within the
+         * free space we just reserved
+         */
+        if (start_block >= my_rsv->rsv_start && start_block < my_rsv->rsv_end)
+                return 0;               /* success */
+        /*
+         * if the first free bit we found is out of the reservable space
+         * continue search for next reservable space,
+         * start from where the free block is,
+         * we also shift the list head to where we stopped last time
+         */
+        search_head = my_rsv;
+        spin_lock(rsv_lock);
+        goto retry;
+}
+
+/**
+ * try_to_extend_reservation()
+ * @my_rsv:             given reservation window
+ * @sb:                 super block
+ * @size:               the delta to extend
+ *
+ * Attempt to expand the reservation window large enough to have
+ * required number of free blocks
+ *
+ * Since ext4_try_to_allocate() will always allocate blocks within
+ * the reservation window range, if the window size is too small,
+ * multiple blocks allocation has to stop at the end of the reservation
+ * window. To make this more efficient, given the total number of
+ * blocks needed and the current size of the window, we try to
+ * expand the reservation window size if necessary on a best-effort
+ * basis before ext4_new_blocks() tries to allocate blocks,
+ */
+static void try_to_extend_reservation(struct ext4_reserve_window_node *my_rsv,
+                        struct super_block *sb, int size)
+{
+        struct ext4_reserve_window_node *next_rsv;
+        struct rb_node *next;
+        spinlock_t *rsv_lock = &EXT4_SB(sb)->s_rsv_window_lock;
+
+        if (!spin_trylock(rsv_lock))
+                return;
+
+        next = rb_next(&my_rsv->rsv_node);
+
+        if (!next)
+                my_rsv->rsv_end += size;
+        else {
+                next_rsv = list_entry(next, struct ext4_reserve_window_node, rsv_node);
+
+                if ((next_rsv->rsv_start - my_rsv->rsv_end - 1) >= size)
+                        my_rsv->rsv_end += size;
+                else
+                        my_rsv->rsv_end = next_rsv->rsv_start - 1;
+        }
+        spin_unlock(rsv_lock);
+}
+
+/**
+ * ext4_try_to_allocate_with_rsv()
+ * @sb:                 superblock
+ * @handle:             handle to this transaction
+ * @group:              given allocation block group
+ * @bitmap_bh:          bufferhead holds the block bitmap
+ * @grp_goal:           given target block within the group
+ * @count:              target number of blocks to allocate
+ * @my_rsv:             reservation window
+ * @errp:               pointer to store the error code
+ *
+ * This is the main function used to allocate a new block and its reservation
+ * window.
+ *
+ * Each time when a new block allocation is need, first try to allocate from
+ * its own reservation.  If it does not have a reservation window, instead of
+ * looking for a free bit on bitmap first, then look up the reservation list to
+ * see if it is inside somebody else's reservation window, we try to allocate a
+ * reservation window for it starting from the goal first. Then do the block
+ * allocation within the reservation window.
+ *
+ * This will avoid keeping on searching the reservation list again and
+ * again when somebody is looking for a free block (without
+ * reservation), and there are lots of free blocks, but they are all
+ * being reserved.
+ *
+ * We use a red-black tree for the per-filesystem reservation list.
+ *
+ */
+static ext4_grpblk_t
+ext4_try_to_allocate_with_rsv(struct super_block *sb, handle_t *handle,
+                        unsigned int group, struct buffer_head *bitmap_bh,
+                        ext4_grpblk_t grp_goal,
+                        struct ext4_reserve_window_node * my_rsv,
+                        unsigned long *count, int *errp)
+{
+        ext4_fsblk_t group_first_block, group_last_block;
+        ext4_grpblk_t ret = 0;
+        int fatal;
+        unsigned long num = *count;
+
+        *errp = 0;
+
+        /*
+         * Make sure we use undo access for the bitmap, because it is critical
+         * that we do the frozen_data COW on bitmap buffers in all cases even
+         * if the buffer is in BJ_Forget state in the committing transaction.
+         */
+        BUFFER_TRACE(bitmap_bh, "get undo access for new block");
+        fatal = ext4_journal_get_undo_access(handle, bitmap_bh);
+        if (fatal) {
+                *errp = fatal;
+                return -1;
+        }
+
+        /*
+         * we don't deal with reservation when
+         * filesystem is mounted without reservation
+         * or the file is not a regular file
+         * or last attempt to allocate a block with reservation turned on failed
+         */
+        if (my_rsv == NULL ) {
+                ret = ext4_try_to_allocate(sb, handle, group, bitmap_bh,
+                                                grp_goal, count, NULL);
+                goto out;
+        }
+        /*
+         * grp_goal is a group relative block number (if there is a goal)
+         * 0 < grp_goal < EXT4_BLOCKS_PER_GROUP(sb)
+         * first block is a filesystem wide block number
+         * first block is the block number of the first block in this group
+         */
+        group_first_block = ext4_group_first_block_no(sb, group);
+        group_last_block = group_first_block + (EXT4_BLOCKS_PER_GROUP(sb) - 1);
+
+        /*
+         * Basically we will allocate a new block from inode's reservation
+         * window.
+         *
+         * We need to allocate a new reservation window, if:
+         * a) inode does not have a reservation window; or
+         * b) last attempt to allocate a block from existing reservation
+         *    failed; or
+         * c) we come here with a goal and with a reservation window
+         *
+         * We do not need to allocate a new reservation window if we come here
+         * at the beginning with a goal and the goal is inside the window, or
+         * we don't have a goal but already have a reservation window.
+         * then we could go to allocate from the reservation window directly.
+         */
+        while (1) {
+                if (rsv_is_empty(&my_rsv->rsv_window) || (ret < 0) ||
+                        !goal_in_my_reservation(&my_rsv->rsv_window,
+                                                grp_goal, group, sb)) {
+                        if (my_rsv->rsv_goal_size < *count)
+                                my_rsv->rsv_goal_size = *count;
+                        ret = alloc_new_reservation(my_rsv, grp_goal, sb,
+                                                        group, bitmap_bh);
+                        if (ret < 0)
+                                break;                  /* failed */
+
+                        if (!goal_in_my_reservation(&my_rsv->rsv_window,
+                                                        grp_goal, group, sb))
+                                grp_goal = -1;
+                } else if (grp_goal > 0 &&
+                          (my_rsv->rsv_end-grp_goal+1) < *count)
+                        try_to_extend_reservation(my_rsv, sb,
+                                        *count-my_rsv->rsv_end + grp_goal - 1);
+
+                if ((my_rsv->rsv_start > group_last_block) ||
+                                (my_rsv->rsv_end < group_first_block)) {
+                        rsv_window_dump(&EXT4_SB(sb)->s_rsv_window_root, 1);
+                        BUG();
+                }
+                ret = ext4_try_to_allocate(sb, handle, group, bitmap_bh,
+                                           grp_goal, &num, &my_rsv->rsv_window);
+                if (ret >= 0) {
+                        my_rsv->rsv_alloc_hit += num;
+                        *count = num;
+                        break;                          /* succeed */
+                }
+                num = *count;
+        }
+out:
+        if (ret >= 0) {
+                BUFFER_TRACE(bitmap_bh, "journal_dirty_metadata for "
+                                        "bitmap block");
+                fatal = ext4_journal_dirty_metadata(handle, bitmap_bh);
+                if (fatal) {
+                        *errp = fatal;
+                        return -1;
+                }
+                return ret;
+        }
+
+        BUFFER_TRACE(bitmap_bh, "journal_release_buffer");
+        ext4_journal_release_buffer(handle, bitmap_bh);
+        return ret;
+}
+
+/**
+ * ext4_has_free_blocks()
+ * @sbi:                in-core super block structure.
+ *
+ * Check if filesystem has at least 1 free block available for allocation.
+ */
+static int ext4_has_free_blocks(struct ext4_sb_info *sbi)
+{
+        ext4_fsblk_t free_blocks, root_blocks;
+
+        free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+        root_blocks = ext4_r_blocks_count(sbi->s_es);
+        if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
+                sbi->s_resuid != current->fsuid &&
+                (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
+                return 0;
+        }
+        return 1;
+}
+
+/**
+ * ext4_should_retry_alloc()
+ * @sb:                 super block
+ * @retries             number of attemps has been made
+ *
+ * ext4_should_retry_alloc() is called when ENOSPC is returned, and if
+ * it is profitable to retry the operation, this function will wait
+ * for the current or commiting transaction to complete, and then
+ * return TRUE.
+ *
+ * if the total number of retries exceed three times, return FALSE.
+ */
+int ext4_should_retry_alloc(struct super_block *sb, int *retries)
+{
+        if (!ext4_has_free_blocks(EXT4_SB(sb)) || (*retries)++ > 3)
+                return 0;
+
+        jbd_debug(1, "%s: retrying operation after ENOSPC\n", sb->s_id);
+
+        return jbd2_journal_force_commit_nested(EXT4_SB(sb)->s_journal);
+}
+
+/**
+ * ext4_new_blocks() -- core block(s) allocation function
+ * @handle:             handle to this transaction
+ * @inode:              file inode
+ * @goal:               given target block(filesystem wide)
+ * @count:              target number of blocks to allocate
+ * @errp:               error code
+ *
+ * ext4_new_blocks uses a goal block to assist allocation.  It tries to
+ * allocate block(s) from the block group contains the goal block first. If that
+ * fails, it will try to allocate block(s) from other block groups without
+ * any specific goal block.
+ *
+ */
+ext4_fsblk_t ext4_new_blocks(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t goal, unsigned long *count, int *errp)
+{
+        struct buffer_head *bitmap_bh = NULL;
+        struct buffer_head *gdp_bh;
+        unsigned long group_no;
+        int goal_group;
+        ext4_grpblk_t grp_target_blk;   /* blockgroup relative goal block */
+        ext4_grpblk_t grp_alloc_blk;    /* blockgroup-relative allocated block*/
+        ext4_fsblk_t ret_block;         /* filesyetem-wide allocated block */
+        int bgi;                        /* blockgroup iteration index */
+        int fatal = 0, err;
+        int performed_allocation = 0;
+        ext4_grpblk_t free_blocks;      /* number of free blocks in a group */
+        struct super_block *sb;
+        struct ext4_group_desc *gdp;
+        struct ext4_super_block *es;
+        struct ext4_sb_info *sbi;
+        struct ext4_reserve_window_node *my_rsv = NULL;
+        struct ext4_block_alloc_info *block_i;
+        unsigned short windowsz = 0;
+#ifdef EXT4FS_DEBUG
+        static int goal_hits, goal_attempts;
+#endif
+        unsigned long ngroups;
+        unsigned long num = *count;
+
+        *errp = -ENOSPC;
+        sb = inode->i_sb;
+        if (!sb) {
+                printk("ext4_new_block: nonexistent device");
+                return 0;
+        }
+
+        /*
+         * Check quota for allocation of this block.
+         */
+        if (DQUOT_ALLOC_BLOCK(inode, num)) {
+                *errp = -EDQUOT;
+                return 0;
+        }
+
+        sbi = EXT4_SB(sb);
+        es = EXT4_SB(sb)->s_es;
+        ext4_debug("goal=%lu.\n", goal);
+        /*
+         * Allocate a block from reservation only when
+         * filesystem is mounted with reservation(default,-o reservation), and
+         * it's a regular file, and
+         * the desired window size is greater than 0 (One could use ioctl
+         * command EXT4_IOC_SETRSVSZ to set the window size to 0 to turn off
+         * reservation on that particular file)
+         */
+        block_i = EXT4_I(inode)->i_block_alloc_info;
+        if (block_i && ((windowsz = block_i->rsv_window_node.rsv_goal_size) > 0))
+                my_rsv = &block_i->rsv_window_node;
+
+        if (!ext4_has_free_blocks(sbi)) {
+                *errp = -ENOSPC;
+                goto out;
+        }
+
+        /*
+         * First, test whether the goal block is free.
+         */
+        if (goal < le32_to_cpu(es->s_first_data_block) ||
+            goal >= ext4_blocks_count(es))
+                goal = le32_to_cpu(es->s_first_data_block);
+        ext4_get_group_no_and_offset(sb, goal, &group_no, &grp_target_blk);
+        goal_group = group_no;
+retry_alloc:
+        gdp = ext4_get_group_desc(sb, group_no, &gdp_bh);
+        if (!gdp)
+                goto io_error;
+
+        free_blocks = le16_to_cpu(gdp->bg_free_blocks_count);
+        /*
+         * if there is not enough free blocks to make a new resevation
+         * turn off reservation for this allocation
+         */
+        if (my_rsv && (free_blocks < windowsz)
+                && (rsv_is_empty(&my_rsv->rsv_window)))
+                my_rsv = NULL;
+
+        if (free_blocks > 0) {
+                bitmap_bh = read_block_bitmap(sb, group_no);
+                if (!bitmap_bh)
+                        goto io_error;
+                grp_alloc_blk = ext4_try_to_allocate_with_rsv(sb, handle,
+                                        group_no, bitmap_bh, grp_target_blk,
+                                        my_rsv, &num, &fatal);
+                if (fatal)
+                        goto out;
+                if (grp_alloc_blk >= 0)
+                        goto allocated;
+        }
+
+        ngroups = EXT4_SB(sb)->s_groups_count;
+        smp_rmb();
+
+        /*
+         * Now search the rest of the groups.  We assume that
+         * i and gdp correctly point to the last group visited.
+         */
+        for (bgi = 0; bgi < ngroups; bgi++) {
+                group_no++;
+                if (group_no >= ngroups)
+                        group_no = 0;
+                gdp = ext4_get_group_desc(sb, group_no, &gdp_bh);
+                if (!gdp) {
+                        *errp = -EIO;
+                        goto out;
+                }
+                free_blocks = le16_to_cpu(gdp->bg_free_blocks_count);
+                /*
+                 * skip this group if the number of
+                 * free blocks is less than half of the reservation
+                 * window size.
+                 */
+                if (free_blocks <= (windowsz/2))
+                        continue;
+
+                brelse(bitmap_bh);
+                bitmap_bh = read_block_bitmap(sb, group_no);
+                if (!bitmap_bh)
+                        goto io_error;
+                /*
+                 * try to allocate block(s) from this group, without a goal(-1).
+                 */
+                grp_alloc_blk = ext4_try_to_allocate_with_rsv(sb, handle,
+                                        group_no, bitmap_bh, -1, my_rsv,
+                                        &num, &fatal);
+                if (fatal)
+                        goto out;
+                if (grp_alloc_blk >= 0)
+                        goto allocated;
+        }
+        /*
+         * We may end up a bogus ealier ENOSPC error due to
+         * filesystem is "full" of reservations, but
+         * there maybe indeed free blocks avaliable on disk
+         * In this case, we just forget about the reservations
+         * just do block allocation as without reservations.
+         */
+        if (my_rsv) {
+                my_rsv = NULL;
+                group_no = goal_group;
+                goto retry_alloc;
+        }
+        /* No space left on the device */
+        *errp = -ENOSPC;
+        goto out;
+
+allocated:
+
+        ext4_debug("using block group %d(%d)\n",
+                        group_no, gdp->bg_free_blocks_count);
+
+        BUFFER_TRACE(gdp_bh, "get_write_access");
+        fatal = ext4_journal_get_write_access(handle, gdp_bh);
+        if (fatal)
+                goto out;
+
+        ret_block = grp_alloc_blk + ext4_group_first_block_no(sb, group_no);
+
+        if (in_range(ext4_block_bitmap(sb, gdp), ret_block, num) ||
+            in_range(ext4_block_bitmap(sb, gdp), ret_block, num) ||
+            in_range(ret_block, ext4_inode_table(sb, gdp),
+                     EXT4_SB(sb)->s_itb_per_group) ||
+            in_range(ret_block + num - 1, ext4_inode_table(sb, gdp),
+                     EXT4_SB(sb)->s_itb_per_group))
+                ext4_error(sb, "ext4_new_block",
+                            "Allocating block in system zone - "
+                            "blocks from %llu, length %lu",
+                             ret_block, num);
+
+        performed_allocation = 1;
+
+#ifdef CONFIG_JBD_DEBUG
+        {
+                struct buffer_head *debug_bh;
+
+                /* Record bitmap buffer state in the newly allocated block */
+                debug_bh = sb_find_get_block(sb, ret_block);
+                if (debug_bh) {
+                        BUFFER_TRACE(debug_bh, "state when allocated");
+                        BUFFER_TRACE2(debug_bh, bitmap_bh, "bitmap state");
+                        brelse(debug_bh);
+                }
+        }
+        jbd_lock_bh_state(bitmap_bh);
+        spin_lock(sb_bgl_lock(sbi, group_no));
+        if (buffer_jbd(bitmap_bh) && bh2jh(bitmap_bh)->b_committed_data) {
+                int i;
+
+                for (i = 0; i < num; i++) {
+                        if (ext4_test_bit(grp_alloc_blk+i,
+                                        bh2jh(bitmap_bh)->b_committed_data)) {
+                                printk("%s: block was unexpectedly set in "
+                                        "b_committed_data\n", __FUNCTION__);
+                        }
+                }
+        }
+        ext4_debug("found bit %d\n", grp_alloc_blk);
+        spin_unlock(sb_bgl_lock(sbi, group_no));
+        jbd_unlock_bh_state(bitmap_bh);
+#endif
+
+        if (ret_block + num - 1 >= ext4_blocks_count(es)) {
+                ext4_error(sb, "ext4_new_block",
+                            "block(%llu) >= blocks count(%llu) - "
+                            "block_group = %lu, es == %p ", ret_block,
+                        ext4_blocks_count(es), group_no, es);
+                goto out;
+        }
+
+        /*
+         * It is up to the caller to add the new buffer to a journal
+         * list of some description.  We don't know in advance whether
+         * the caller wants to use it as metadata or data.
+         */
+        ext4_debug("allocating block %lu. Goal hits %d of %d.\n",
+                        ret_block, goal_hits, goal_attempts);
+
+        spin_lock(sb_bgl_lock(sbi, group_no));
+        gdp->bg_free_blocks_count =
+                        cpu_to_le16(le16_to_cpu(gdp->bg_free_blocks_count)-num);
+        spin_unlock(sb_bgl_lock(sbi, group_no));
+        percpu_counter_mod(&sbi->s_freeblocks_counter, -num);
+
+        BUFFER_TRACE(gdp_bh, "journal_dirty_metadata for group descriptor");
+        err = ext4_journal_dirty_metadata(handle, gdp_bh);
+        if (!fatal)
+                fatal = err;
+
+        sb->s_dirt = 1;
+        if (fatal)
+                goto out;
+
+        *errp = 0;
+        brelse(bitmap_bh);
+        DQUOT_FREE_BLOCK(inode, *count-num);
+        *count = num;
+        return ret_block;
+
+io_error:
+        *errp = -EIO;
+out:
+        if (fatal) {
+                *errp = fatal;
+                ext4_std_error(sb, fatal);
+        }
+        /*
+         * Undo the block allocation
+         */
+        if (!performed_allocation)
+                DQUOT_FREE_BLOCK(inode, *count);
+        brelse(bitmap_bh);
+        return 0;
+}
+
+ext4_fsblk_t ext4_new_block(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t goal, int *errp)
+{
+        unsigned long count = 1;
+
+        return ext4_new_blocks(handle, inode, goal, &count, errp);
+}
+
+/**
+ * ext4_count_free_blocks() -- count filesystem free blocks
+ * @sb:         superblock
+ *
+ * Adds up the number of free blocks from each block group.
+ */
+ext4_fsblk_t ext4_count_free_blocks(struct super_block *sb)
+{
+        ext4_fsblk_t desc_count;
+        struct ext4_group_desc *gdp;
+        int i;
+        unsigned long ngroups = EXT4_SB(sb)->s_groups_count;
+#ifdef EXT4FS_DEBUG
+        struct ext4_super_block *es;
+        ext4_fsblk_t bitmap_count;
+        unsigned long x;
+        struct buffer_head *bitmap_bh = NULL;
+
+        es = EXT4_SB(sb)->s_es;
+        desc_count = 0;
+        bitmap_count = 0;
+        gdp = NULL;
+
+        smp_rmb();
+        for (i = 0; i < ngroups; i++) {
+                gdp = ext4_get_group_desc(sb, i, NULL);
+                if (!gdp)
+                        continue;
+                desc_count += le16_to_cpu(gdp->bg_free_blocks_count);
+                brelse(bitmap_bh);
+                bitmap_bh = read_block_bitmap(sb, i);
+                if (bitmap_bh == NULL)
+                        continue;
+
+                x = ext4_count_free(bitmap_bh, sb->s_blocksize);
+                printk("group %d: stored = %d, counted = %lu\n",
+                        i, le16_to_cpu(gdp->bg_free_blocks_count), x);
+                bitmap_count += x;
+        }
+        brelse(bitmap_bh);
+        printk("ext4_count_free_blocks: stored = %llu"
+                ", computed = %llu, %llu\n",
+               EXT4_FREE_BLOCKS_COUNT(es),
+                desc_count, bitmap_count);
+        return bitmap_count;
+#else
+        desc_count = 0;
+        smp_rmb();
+        for (i = 0; i < ngroups; i++) {
+                gdp = ext4_get_group_desc(sb, i, NULL);
+                if (!gdp)
+                        continue;
+                desc_count += le16_to_cpu(gdp->bg_free_blocks_count);
+        }
+
+        return desc_count;
+#endif
+}
+
+static inline int
+block_in_use(ext4_fsblk_t block, struct super_block *sb, unsigned char *map)
+{
+        ext4_grpblk_t offset;
+
+        ext4_get_group_no_and_offset(sb, block, NULL, &offset);
+        return ext4_test_bit (offset, map);
+}
+
+static inline int test_root(int a, int b)
+{
+        int num = b;
+
+        while (a > num)
+                num *= b;
+        return num == a;
+}
+
+static int ext4_group_sparse(int group)
+{
+        if (group <= 1)
+                return 1;
+        if (!(group & 1))
+                return 0;
+        return (test_root(group, 7) || test_root(group, 5) ||
+                test_root(group, 3));
+}
+
+/**
+ *      ext4_bg_has_super - number of blocks used by the superblock in group
+ *      @sb: superblock for filesystem
+ *      @group: group number to check
+ *
+ *      Return the number of blocks used by the superblock (primary or backup)
+ *      in this group.  Currently this will be only 0 or 1.
+ */
+int ext4_bg_has_super(struct super_block *sb, int group)
+{
+        if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER) &&
+                        !ext4_group_sparse(group))
+                return 0;
+        return 1;
+}
+
+static unsigned long ext4_bg_num_gdb_meta(struct super_block *sb, int group)
+{
+        unsigned long metagroup = group / EXT4_DESC_PER_BLOCK(sb);
+        unsigned long first = metagroup * EXT4_DESC_PER_BLOCK(sb);
+        unsigned long last = first + EXT4_DESC_PER_BLOCK(sb) - 1;
+
+        if (group == first || group == first + 1 || group == last)
+                return 1;
+        return 0;
+}
+
+static unsigned long ext4_bg_num_gdb_nometa(struct super_block *sb, int group)
+{
+        if (EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER) &&
+                        !ext4_group_sparse(group))
+                return 0;
+        return EXT4_SB(sb)->s_gdb_count;
+}
+
+/**
+ *      ext4_bg_num_gdb - number of blocks used by the group table in group
+ *      @sb: superblock for filesystem
+ *      @group: group number to check
+ *
+ *      Return the number of blocks used by the group descriptor table
+ *      (primary or backup) in this group.  In the future there may be a
+ *      different number of descriptor blocks in each group.
+ */
+unsigned long ext4_bg_num_gdb(struct super_block *sb, int group)
+{
+        unsigned long first_meta_bg =
+                        le32_to_cpu(EXT4_SB(sb)->s_es->s_first_meta_bg);
+        unsigned long metagroup = group / EXT4_DESC_PER_BLOCK(sb);
+
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb,EXT4_FEATURE_INCOMPAT_META_BG) ||
+                        metagroup < first_meta_bg)
+                return ext4_bg_num_gdb_nometa(sb,group);
+
+        return ext4_bg_num_gdb_meta(sb,group);
+
+}
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
new file mode 100644
index 000000000000..11e93c169bcf
--- /dev/null
+++ b/fs/ext4/bitmap.c
@@ -0,0 +1,32 @@
+/*
+ *  linux/fs/ext4/bitmap.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ */
+
+#include <linux/buffer_head.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+
+#ifdef EXT4FS_DEBUG
+
+static int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0};
+
+unsigned long ext4_count_free (struct buffer_head * map, unsigned int numchars)
+{
+        unsigned int i;
+        unsigned long sum = 0;
+
+        if (!map)
+                return (0);
+        for (i = 0; i < numchars; i++)
+                sum += nibblemap[map->b_data[i] & 0xf] +
+                        nibblemap[(map->b_data[i] >> 4) & 0xf];
+        return (sum);
+}
+
+#endif  /*  EXT4FS_DEBUG  */
+
diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
new file mode 100644
index 000000000000..f8595787a70e
--- /dev/null
+++ b/fs/ext4/dir.c
@@ -0,0 +1,518 @@
+/*
+ *  linux/fs/ext4/dir.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/dir.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  ext4 directory handling functions
+ *
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ *
+ * Hash Tree Directory indexing (c) 2001  Daniel Phillips
+ *
+ */
+
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/buffer_head.h>
+#include <linux/smp_lock.h>
+#include <linux/slab.h>
+#include <linux/rbtree.h>
+
+static unsigned char ext4_filetype_table[] = {
+        DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
+};
+
+static int ext4_readdir(struct file *, void *, filldir_t);
+static int ext4_dx_readdir(struct file * filp,
+                           void * dirent, filldir_t filldir);
+static int ext4_release_dir (struct inode * inode,
+                                struct file * filp);
+
+const struct file_operations ext4_dir_operations = {
+        .llseek         = generic_file_llseek,
+        .read           = generic_read_dir,
+        .readdir        = ext4_readdir,         /* we take BKL. needed?*/
+        .ioctl          = ext4_ioctl,           /* BKL held */
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = ext4_compat_ioctl,
+#endif
+        .fsync          = ext4_sync_file,       /* BKL held */
+#ifdef CONFIG_EXT4_INDEX
+        .release        = ext4_release_dir,
+#endif
+};
+
+
+static unsigned char get_dtype(struct super_block *sb, int filetype)
+{
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FILETYPE) ||
+            (filetype >= EXT4_FT_MAX))
+                return DT_UNKNOWN;
+
+        return (ext4_filetype_table[filetype]);
+}
+
+
+int ext4_check_dir_entry (const char * function, struct inode * dir,
+                          struct ext4_dir_entry_2 * de,
+                          struct buffer_head * bh,
+                          unsigned long offset)
+{
+        const char * error_msg = NULL;
+        const int rlen = le16_to_cpu(de->rec_len);
+
+        if (rlen < EXT4_DIR_REC_LEN(1))
+                error_msg = "rec_len is smaller than minimal";
+        else if (rlen % 4 != 0)
+                error_msg = "rec_len % 4 != 0";
+        else if (rlen < EXT4_DIR_REC_LEN(de->name_len))
+                error_msg = "rec_len is too small for name_len";
+        else if (((char *) de - bh->b_data) + rlen > dir->i_sb->s_blocksize)
+                error_msg = "directory entry across blocks";
+        else if (le32_to_cpu(de->inode) >
+                        le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))
+                error_msg = "inode out of bounds";
+
+        if (error_msg != NULL)
+                ext4_error (dir->i_sb, function,
+                        "bad entry in directory #%lu: %s - "
+                        "offset=%lu, inode=%lu, rec_len=%d, name_len=%d",
+                        dir->i_ino, error_msg, offset,
+                        (unsigned long) le32_to_cpu(de->inode),
+                        rlen, de->name_len);
+        return error_msg == NULL ? 1 : 0;
+}
+
+static int ext4_readdir(struct file * filp,
+                         void * dirent, filldir_t filldir)
+{
+        int error = 0;
+        unsigned long offset;
+        int i, stored;
+        struct ext4_dir_entry_2 *de;
+        struct super_block *sb;
+        int err;
+        struct inode *inode = filp->f_dentry->d_inode;
+        int ret = 0;
+
+        sb = inode->i_sb;
+
+#ifdef CONFIG_EXT4_INDEX
+        if (EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
+                                    EXT4_FEATURE_COMPAT_DIR_INDEX) &&
+            ((EXT4_I(inode)->i_flags & EXT4_INDEX_FL) ||
+             ((inode->i_size >> sb->s_blocksize_bits) == 1))) {
+                err = ext4_dx_readdir(filp, dirent, filldir);
+                if (err != ERR_BAD_DX_DIR) {
+                        ret = err;
+                        goto out;
+                }
+                /*
+                 * We don't set the inode dirty flag since it's not
+                 * critical that it get flushed back to the disk.
+                 */
+                EXT4_I(filp->f_dentry->d_inode)->i_flags &= ~EXT4_INDEX_FL;
+        }
+#endif
+        stored = 0;
+        offset = filp->f_pos & (sb->s_blocksize - 1);
+
+        while (!error && !stored && filp->f_pos < inode->i_size) {
+                unsigned long blk = filp->f_pos >> EXT4_BLOCK_SIZE_BITS(sb);
+                struct buffer_head map_bh;
+                struct buffer_head *bh = NULL;
+
+                map_bh.b_state = 0;
+                err = ext4_get_blocks_wrap(NULL, inode, blk, 1, &map_bh, 0, 0);
+                if (err > 0) {
+                        page_cache_readahead(sb->s_bdev->bd_inode->i_mapping,
+                                &filp->f_ra,
+                                filp,
+                                map_bh.b_blocknr >>
+                                        (PAGE_CACHE_SHIFT - inode->i_blkbits),
+                                1);
+                        bh = ext4_bread(NULL, inode, blk, 0, &err);
+                }
+
+                /*
+                 * We ignore I/O errors on directories so users have a chance
+                 * of recovering data when there's a bad sector
+                 */
+                if (!bh) {
+                        ext4_error (sb, "ext4_readdir",
+                                "directory #%lu contains a hole at offset %lu",
+                                inode->i_ino, (unsigned long)filp->f_pos);
+                        filp->f_pos += sb->s_blocksize - offset;
+                        continue;
+                }
+
+revalidate:
+                /* If the dir block has changed since the last call to
+                 * readdir(2), then we might be pointing to an invalid
+                 * dirent right now.  Scan from the start of the block
+                 * to make sure. */
+                if (filp->f_version != inode->i_version) {
+                        for (i = 0; i < sb->s_blocksize && i < offset; ) {
+                                de = (struct ext4_dir_entry_2 *)
+                                        (bh->b_data + i);
+                                /* It's too expensive to do a full
+                                 * dirent test each time round this
+                                 * loop, but we do have to test at
+                                 * least that it is non-zero.  A
+                                 * failure will be detected in the
+                                 * dirent test below. */
+                                if (le16_to_cpu(de->rec_len) <
+                                                EXT4_DIR_REC_LEN(1))
+                                        break;
+                                i += le16_to_cpu(de->rec_len);
+                        }
+                        offset = i;
+                        filp->f_pos = (filp->f_pos & ~(sb->s_blocksize - 1))
+                                | offset;
+                        filp->f_version = inode->i_version;
+                }
+
+                while (!error && filp->f_pos < inode->i_size
+                       && offset < sb->s_blocksize) {
+                        de = (struct ext4_dir_entry_2 *) (bh->b_data + offset);
+                        if (!ext4_check_dir_entry ("ext4_readdir", inode, de,
+                                                   bh, offset)) {
+                                /*
+                                 * On error, skip the f_pos to the next block
+                                 */
+                                filp->f_pos = (filp->f_pos |
+                                                (sb->s_blocksize - 1)) + 1;
+                                brelse (bh);
+                                ret = stored;
+                                goto out;
+                        }
+                        offset += le16_to_cpu(de->rec_len);
+                        if (le32_to_cpu(de->inode)) {
+                                /* We might block in the next section
+                                 * if the data destination is
+                                 * currently swapped out.  So, use a
+                                 * version stamp to detect whether or
+                                 * not the directory has been modified
+                                 * during the copy operation.
+                                 */
+                                unsigned long version = filp->f_version;
+
+                                error = filldir(dirent, de->name,
+                                                de->name_len,
+                                                filp->f_pos,
+                                                le32_to_cpu(de->inode),
+                                                get_dtype(sb, de->file_type));
+                                if (error)
+                                        break;
+                                if (version != filp->f_version)
+                                        goto revalidate;
+                                stored ++;
+                        }
+                        filp->f_pos += le16_to_cpu(de->rec_len);
+                }
+                offset = 0;
+                brelse (bh);
+        }
+out:
+        return ret;
+}
+
+#ifdef CONFIG_EXT4_INDEX
+/*
+ * These functions convert from the major/minor hash to an f_pos
+ * value.
+ *
+ * Currently we only use major hash numer.  This is unfortunate, but
+ * on 32-bit machines, the same VFS interface is used for lseek and
+ * llseek, so if we use the 64 bit offset, then the 32-bit versions of
+ * lseek/telldir/seekdir will blow out spectacularly, and from within
+ * the ext2 low-level routine, we don't know if we're being called by
+ * a 64-bit version of the system call or the 32-bit version of the
+ * system call.  Worse yet, NFSv2 only allows for a 32-bit readdir
+ * cookie.  Sigh.
+ */
+#define hash2pos(major, minor)  (major >> 1)
+#define pos2maj_hash(pos)       ((pos << 1) & 0xffffffff)
+#define pos2min_hash(pos)       (0)
+
+/*
+ * This structure holds the nodes of the red-black tree used to store
+ * the directory entry in hash order.
+ */
+struct fname {
+        __u32           hash;
+        __u32           minor_hash;
+        struct rb_node  rb_hash;
+        struct fname    *next;
+        __u32           inode;
+        __u8            name_len;
+        __u8            file_type;
+        char            name[0];
+};
+
+/*
+ * This functoin implements a non-recursive way of freeing all of the
+ * nodes in the red-black tree.
+ */
+static void free_rb_tree_fname(struct rb_root *root)
+{
+        struct rb_node  *n = root->rb_node;
+        struct rb_node  *parent;
+        struct fname    *fname;
+
+        while (n) {
+                /* Do the node's children first */
+                if ((n)->rb_left) {
+                        n = n->rb_left;
+                        continue;
+                }
+                if (n->rb_right) {
+                        n = n->rb_right;
+                        continue;
+                }
+                /*
+                 * The node has no children; free it, and then zero
+                 * out parent's link to it.  Finally go to the
+                 * beginning of the loop and try to free the parent
+                 * node.
+                 */
+                parent = rb_parent(n);
+                fname = rb_entry(n, struct fname, rb_hash);
+                while (fname) {
+                        struct fname * old = fname;
+                        fname = fname->next;
+                        kfree (old);
+                }
+                if (!parent)
+                        root->rb_node = NULL;
+                else if (parent->rb_left == n)
+                        parent->rb_left = NULL;
+                else if (parent->rb_right == n)
+                        parent->rb_right = NULL;
+                n = parent;
+        }
+        root->rb_node = NULL;
+}
+
+
+static struct dir_private_info *create_dir_info(loff_t pos)
+{
+        struct dir_private_info *p;
+
+        p = kmalloc(sizeof(struct dir_private_info), GFP_KERNEL);
+        if (!p)
+                return NULL;
+        p->root.rb_node = NULL;
+        p->curr_node = NULL;
+        p->extra_fname = NULL;
+        p->last_pos = 0;
+        p->curr_hash = pos2maj_hash(pos);
+        p->curr_minor_hash = pos2min_hash(pos);
+        p->next_hash = 0;
+        return p;
+}
+
+void ext4_htree_free_dir_info(struct dir_private_info *p)
+{
+        free_rb_tree_fname(&p->root);
+        kfree(p);
+}
+
+/*
+ * Given a directory entry, enter it into the fname rb tree.
+ */
+int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
+                             __u32 minor_hash,
+                             struct ext4_dir_entry_2 *dirent)
+{
+        struct rb_node **p, *parent = NULL;
+        struct fname * fname, *new_fn;
+        struct dir_private_info *info;
+        int len;
+
+        info = (struct dir_private_info *) dir_file->private_data;
+        p = &info->root.rb_node;
+
+        /* Create and allocate the fname structure */
+        len = sizeof(struct fname) + dirent->name_len + 1;
+        new_fn = kzalloc(len, GFP_KERNEL);
+        if (!new_fn)
+                return -ENOMEM;
+        new_fn->hash = hash;
+        new_fn->minor_hash = minor_hash;
+        new_fn->inode = le32_to_cpu(dirent->inode);
+        new_fn->name_len = dirent->name_len;
+        new_fn->file_type = dirent->file_type;
+        memcpy(new_fn->name, dirent->name, dirent->name_len);
+        new_fn->name[dirent->name_len] = 0;
+
+        while (*p) {
+                parent = *p;
+                fname = rb_entry(parent, struct fname, rb_hash);
+
+                /*
+                 * If the hash and minor hash match up, then we put
+                 * them on a linked list.  This rarely happens...
+                 */
+                if ((new_fn->hash == fname->hash) &&
+                    (new_fn->minor_hash == fname->minor_hash)) {
+                        new_fn->next = fname->next;
+                        fname->next = new_fn;
+                        return 0;
+                }
+
+                if (new_fn->hash < fname->hash)
+                        p = &(*p)->rb_left;
+                else if (new_fn->hash > fname->hash)
+                        p = &(*p)->rb_right;
+                else if (new_fn->minor_hash < fname->minor_hash)
+                        p = &(*p)->rb_left;
+                else /* if (new_fn->minor_hash > fname->minor_hash) */
+                        p = &(*p)->rb_right;
+        }
+
+        rb_link_node(&new_fn->rb_hash, parent, p);
+        rb_insert_color(&new_fn->rb_hash, &info->root);
+        return 0;
+}
+
+
+
+/*
+ * This is a helper function for ext4_dx_readdir.  It calls filldir
+ * for all entres on the fname linked list.  (Normally there is only
+ * one entry on the linked list, unless there are 62 bit hash collisions.)
+ */
+static int call_filldir(struct file * filp, void * dirent,
+                        filldir_t filldir, struct fname *fname)
+{
+        struct dir_private_info *info = filp->private_data;
+        loff_t  curr_pos;
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct super_block * sb;
+        int error;
+
+        sb = inode->i_sb;
+
+        if (!fname) {
+                printk("call_filldir: called with null fname?!?\n");
+                return 0;
+        }
+        curr_pos = hash2pos(fname->hash, fname->minor_hash);
+        while (fname) {
+                error = filldir(dirent, fname->name,
+                                fname->name_len, curr_pos,
+                                fname->inode,
+                                get_dtype(sb, fname->file_type));
+                if (error) {
+                        filp->f_pos = curr_pos;
+                        info->extra_fname = fname->next;
+                        return error;
+                }
+                fname = fname->next;
+        }
+        return 0;
+}
+
+static int ext4_dx_readdir(struct file * filp,
+                         void * dirent, filldir_t filldir)
+{
+        struct dir_private_info *info = filp->private_data;
+        struct inode *inode = filp->f_dentry->d_inode;
+        struct fname *fname;
+        int     ret;
+
+        if (!info) {
+                info = create_dir_info(filp->f_pos);
+                if (!info)
+                        return -ENOMEM;
+                filp->private_data = info;
+        }
+
+        if (filp->f_pos == EXT4_HTREE_EOF)
+                return 0;       /* EOF */
+
+        /* Some one has messed with f_pos; reset the world */
+        if (info->last_pos != filp->f_pos) {
+                free_rb_tree_fname(&info->root);
+                info->curr_node = NULL;
+                info->extra_fname = NULL;
+                info->curr_hash = pos2maj_hash(filp->f_pos);
+                info->curr_minor_hash = pos2min_hash(filp->f_pos);
+        }
+
+        /*
+         * If there are any leftover names on the hash collision
+         * chain, return them first.
+         */
+        if (info->extra_fname &&
+            call_filldir(filp, dirent, filldir, info->extra_fname))
+                goto finished;
+
+        if (!info->curr_node)
+                info->curr_node = rb_first(&info->root);
+
+        while (1) {
+                /*
+                 * Fill the rbtree if we have no more entries,
+                 * or the inode has changed since we last read in the
+                 * cached entries.
+                 */
+                if ((!info->curr_node) ||
+                    (filp->f_version != inode->i_version)) {
+                        info->curr_node = NULL;
+                        free_rb_tree_fname(&info->root);
+                        filp->f_version = inode->i_version;
+                        ret = ext4_htree_fill_tree(filp, info->curr_hash,
+                                                   info->curr_minor_hash,
+                                                   &info->next_hash);
+                        if (ret < 0)
+                                return ret;
+                        if (ret == 0) {
+                                filp->f_pos = EXT4_HTREE_EOF;
+                                break;
+                        }
+                        info->curr_node = rb_first(&info->root);
+                }
+
+                fname = rb_entry(info->curr_node, struct fname, rb_hash);
+                info->curr_hash = fname->hash;
+                info->curr_minor_hash = fname->minor_hash;
+                if (call_filldir(filp, dirent, filldir, fname))
+                        break;
+
+                info->curr_node = rb_next(info->curr_node);
+                if (!info->curr_node) {
+                        if (info->next_hash == ~0) {
+                                filp->f_pos = EXT4_HTREE_EOF;
+                                break;
+                        }
+                        info->curr_hash = info->next_hash;
+                        info->curr_minor_hash = 0;
+                }
+        }
+finished:
+        info->last_pos = filp->f_pos;
+        return 0;
+}
+
+static int ext4_release_dir (struct inode * inode, struct file * filp)
+{
+        if (filp->private_data)
+                ext4_htree_free_dir_info(filp->private_data);
+
+        return 0;
+}
+
+#endif
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
new file mode 100644
index 000000000000..2608dce18f3e
--- /dev/null
+++ b/fs/ext4/extents.c
@@ -0,0 +1,2152 @@
+/*
+ * Copyright (c) 2003-2006, Cluster File Systems, Inc, info@clusterfs.com
+ * Written by Alex Tomas <alex@clusterfs.com>
+ *
+ * Architecture independence:
+ *   Copyright (c) 2005, Bull S.A.
+ *   Written by Pierre Peiffer <pierre.peiffer@bull.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public Licens
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-
+ */
+
+/*
+ * Extents support for EXT4
+ *
+ * TODO:
+ *   - ext4*_error() should be used in some situations
+ *   - analyze all BUG()/BUG_ON(), use -EIO where appropriate
+ *   - smart tree reduction
+ */
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/jbd.h>
+#include <linux/smp_lock.h>
+#include <linux/highuid.h>
+#include <linux/pagemap.h>
+#include <linux/quotaops.h>
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/ext4_fs_extents.h>
+#include <asm/uaccess.h>
+
+
+/*
+ * ext_pblock:
+ * combine low and high parts of physical block number into ext4_fsblk_t
+ */
+static inline ext4_fsblk_t ext_pblock(struct ext4_extent *ex)
+{
+        ext4_fsblk_t block;
+
+        block = le32_to_cpu(ex->ee_start);
+        block |= ((ext4_fsblk_t) le16_to_cpu(ex->ee_start_hi) << 31) << 1;
+        return block;
+}
+
+/*
+ * idx_pblock:
+ * combine low and high parts of a leaf physical block number into ext4_fsblk_t
+ */
+static inline ext4_fsblk_t idx_pblock(struct ext4_extent_idx *ix)
+{
+        ext4_fsblk_t block;
+
+        block = le32_to_cpu(ix->ei_leaf);
+        block |= ((ext4_fsblk_t) le16_to_cpu(ix->ei_leaf_hi) << 31) << 1;
+        return block;
+}
+
+/*
+ * ext4_ext_store_pblock:
+ * stores a large physical block number into an extent struct,
+ * breaking it into parts
+ */
+static inline void ext4_ext_store_pblock(struct ext4_extent *ex, ext4_fsblk_t pb)
+{
+        ex->ee_start = cpu_to_le32((unsigned long) (pb & 0xffffffff));
+        ex->ee_start_hi = cpu_to_le16((unsigned long) ((pb >> 31) >> 1) & 0xffff);
+}
+
+/*
+ * ext4_idx_store_pblock:
+ * stores a large physical block number into an index struct,
+ * breaking it into parts
+ */
+static inline void ext4_idx_store_pblock(struct ext4_extent_idx *ix, ext4_fsblk_t pb)
+{
+        ix->ei_leaf = cpu_to_le32((unsigned long) (pb & 0xffffffff));
+        ix->ei_leaf_hi = cpu_to_le16((unsigned long) ((pb >> 31) >> 1) & 0xffff);
+}
+
+static int ext4_ext_check_header(const char *function, struct inode *inode,
+                                struct ext4_extent_header *eh)
+{
+        const char *error_msg = NULL;
+
+        if (unlikely(eh->eh_magic != EXT4_EXT_MAGIC)) {
+                error_msg = "invalid magic";
+                goto corrupted;
+        }
+        if (unlikely(eh->eh_max == 0)) {
+                error_msg = "invalid eh_max";
+                goto corrupted;
+        }
+        if (unlikely(le16_to_cpu(eh->eh_entries) > le16_to_cpu(eh->eh_max))) {
+                error_msg = "invalid eh_entries";
+                goto corrupted;
+        }
+        return 0;
+
+corrupted:
+        ext4_error(inode->i_sb, function,
+                        "bad header in inode #%lu: %s - magic %x, "
+                        "entries %u, max %u, depth %u",
+                        inode->i_ino, error_msg, le16_to_cpu(eh->eh_magic),
+                        le16_to_cpu(eh->eh_entries), le16_to_cpu(eh->eh_max),
+                        le16_to_cpu(eh->eh_depth));
+
+        return -EIO;
+}
+
+static handle_t *ext4_ext_journal_restart(handle_t *handle, int needed)
+{
+        int err;
+
+        if (handle->h_buffer_credits > needed)
+                return handle;
+        if (!ext4_journal_extend(handle, needed))
+                return handle;
+        err = ext4_journal_restart(handle, needed);
+
+        return handle;
+}
+
+/*
+ * could return:
+ *  - EROFS
+ *  - ENOMEM
+ */
+static int ext4_ext_get_access(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *path)
+{
+        if (path->p_bh) {
+                /* path points to block */
+                return ext4_journal_get_write_access(handle, path->p_bh);
+        }
+        /* path points to leaf/index in inode body */
+        /* we use in-core data, no need to protect them */
+        return 0;
+}
+
+/*
+ * could return:
+ *  - EROFS
+ *  - ENOMEM
+ *  - EIO
+ */
+static int ext4_ext_dirty(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *path)
+{
+        int err;
+        if (path->p_bh) {
+                /* path points to block */
+                err = ext4_journal_dirty_metadata(handle, path->p_bh);
+        } else {
+                /* path points to leaf/index in inode body */
+                err = ext4_mark_inode_dirty(handle, inode);
+        }
+        return err;
+}
+
+static ext4_fsblk_t ext4_ext_find_goal(struct inode *inode,
+                              struct ext4_ext_path *path,
+                              ext4_fsblk_t block)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        ext4_fsblk_t bg_start;
+        ext4_grpblk_t colour;
+        int depth;
+
+        if (path) {
+                struct ext4_extent *ex;
+                depth = path->p_depth;
+
+                /* try to predict block placement */
+                if ((ex = path[depth].p_ext))
+                        return ext_pblock(ex)+(block-le32_to_cpu(ex->ee_block));
+
+                /* it looks like index is empty;
+                 * try to find starting block from index itself */
+                if (path[depth].p_bh)
+                        return path[depth].p_bh->b_blocknr;
+        }
+
+        /* OK. use inode's group */
+        bg_start = (ei->i_block_group * EXT4_BLOCKS_PER_GROUP(inode->i_sb)) +
+                le32_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_first_data_block);
+        colour = (current->pid % 16) *
+                        (EXT4_BLOCKS_PER_GROUP(inode->i_sb) / 16);
+        return bg_start + colour + block;
+}
+
+static ext4_fsblk_t
+ext4_ext_new_block(handle_t *handle, struct inode *inode,
+                        struct ext4_ext_path *path,
+                        struct ext4_extent *ex, int *err)
+{
+        ext4_fsblk_t goal, newblock;
+
+        goal = ext4_ext_find_goal(inode, path, le32_to_cpu(ex->ee_block));
+        newblock = ext4_new_block(handle, inode, goal, err);
+        return newblock;
+}
+
+static inline int ext4_ext_space_block(struct inode *inode)
+{
+        int size;
+
+        size = (inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
+                        / sizeof(struct ext4_extent);
+#ifdef AGRESSIVE_TEST
+        if (size > 6)
+                size = 6;
+#endif
+        return size;
+}
+
+static inline int ext4_ext_space_block_idx(struct inode *inode)
+{
+        int size;
+
+        size = (inode->i_sb->s_blocksize - sizeof(struct ext4_extent_header))
+                        / sizeof(struct ext4_extent_idx);
+#ifdef AGRESSIVE_TEST
+        if (size > 5)
+                size = 5;
+#endif
+        return size;
+}
+
+static inline int ext4_ext_space_root(struct inode *inode)
+{
+        int size;
+
+        size = sizeof(EXT4_I(inode)->i_data);
+        size -= sizeof(struct ext4_extent_header);
+        size /= sizeof(struct ext4_extent);
+#ifdef AGRESSIVE_TEST
+        if (size > 3)
+                size = 3;
+#endif
+        return size;
+}
+
+static inline int ext4_ext_space_root_idx(struct inode *inode)
+{
+        int size;
+
+        size = sizeof(EXT4_I(inode)->i_data);
+        size -= sizeof(struct ext4_extent_header);
+        size /= sizeof(struct ext4_extent_idx);
+#ifdef AGRESSIVE_TEST
+        if (size > 4)
+                size = 4;
+#endif
+        return size;
+}
+
+#ifdef EXT_DEBUG
+static void ext4_ext_show_path(struct inode *inode, struct ext4_ext_path *path)
+{
+        int k, l = path->p_depth;
+
+        ext_debug("path:");
+        for (k = 0; k <= l; k++, path++) {
+                if (path->p_idx) {
+                  ext_debug("  %d->%llu", le32_to_cpu(path->p_idx->ei_block),
+                            idx_pblock(path->p_idx));
+                } else if (path->p_ext) {
+                        ext_debug("  %d:%d:%llu ",
+                                  le32_to_cpu(path->p_ext->ee_block),
+                                  le16_to_cpu(path->p_ext->ee_len),
+                                  ext_pblock(path->p_ext));
+                } else
+                        ext_debug("  []");
+        }
+        ext_debug("\n");
+}
+
+static void ext4_ext_show_leaf(struct inode *inode, struct ext4_ext_path *path)
+{
+        int depth = ext_depth(inode);
+        struct ext4_extent_header *eh;
+        struct ext4_extent *ex;
+        int i;
+
+        if (!path)
+                return;
+
+        eh = path[depth].p_hdr;
+        ex = EXT_FIRST_EXTENT(eh);
+
+        for (i = 0; i < le16_to_cpu(eh->eh_entries); i++, ex++) {
+                ext_debug("%d:%d:%llu ", le32_to_cpu(ex->ee_block),
+                          le16_to_cpu(ex->ee_len), ext_pblock(ex));
+        }
+        ext_debug("\n");
+}
+#else
+#define ext4_ext_show_path(inode,path)
+#define ext4_ext_show_leaf(inode,path)
+#endif
+
+static void ext4_ext_drop_refs(struct ext4_ext_path *path)
+{
+        int depth = path->p_depth;
+        int i;
+
+        for (i = 0; i <= depth; i++, path++)
+                if (path->p_bh) {
+                        brelse(path->p_bh);
+                        path->p_bh = NULL;
+                }
+}
+
+/*
+ * ext4_ext_binsearch_idx:
+ * binary search for the closest index of the given block
+ */
+static void
+ext4_ext_binsearch_idx(struct inode *inode, struct ext4_ext_path *path, int block)
+{
+        struct ext4_extent_header *eh = path->p_hdr;
+        struct ext4_extent_idx *r, *l, *m;
+
+        BUG_ON(eh->eh_magic != EXT4_EXT_MAGIC);
+        BUG_ON(le16_to_cpu(eh->eh_entries) > le16_to_cpu(eh->eh_max));
+        BUG_ON(le16_to_cpu(eh->eh_entries) <= 0);
+
+        ext_debug("binsearch for %d(idx):  ", block);
+
+        l = EXT_FIRST_INDEX(eh) + 1;
+        r = EXT_FIRST_INDEX(eh) + le16_to_cpu(eh->eh_entries) - 1;
+        while (l <= r) {
+                m = l + (r - l) / 2;
+                if (block < le32_to_cpu(m->ei_block))
+                        r = m - 1;
+                else
+                        l = m + 1;
+                ext_debug("%p(%u):%p(%u):%p(%u) ", l, l->ei_block,
+                                m, m->ei_block, r, r->ei_block);
+        }
+
+        path->p_idx = l - 1;
+        ext_debug("  -> %d->%lld ", le32_to_cpu(path->p_idx->ei_block),
+                  idx_block(path->p_idx));
+
+#ifdef CHECK_BINSEARCH
+        {
+                struct ext4_extent_idx *chix, *ix;
+                int k;
+
+                chix = ix = EXT_FIRST_INDEX(eh);
+                for (k = 0; k < le16_to_cpu(eh->eh_entries); k++, ix++) {
+                  if (k != 0 &&
+                      le32_to_cpu(ix->ei_block) <= le32_to_cpu(ix[-1].ei_block)) {
+                                printk("k=%d, ix=0x%p, first=0x%p\n", k,
+                                        ix, EXT_FIRST_INDEX(eh));
+                                printk("%u <= %u\n",
+                                       le32_to_cpu(ix->ei_block),
+                                       le32_to_cpu(ix[-1].ei_block));
+                        }
+                        BUG_ON(k && le32_to_cpu(ix->ei_block)
+                                           <= le32_to_cpu(ix[-1].ei_block));
+                        if (block < le32_to_cpu(ix->ei_block))
+                                break;
+                        chix = ix;
+                }
+                BUG_ON(chix != path->p_idx);
+        }
+#endif
+
+}
+
+/*
+ * ext4_ext_binsearch:
+ * binary search for closest extent of the given block
+ */
+static void
+ext4_ext_binsearch(struct inode *inode, struct ext4_ext_path *path, int block)
+{
+        struct ext4_extent_header *eh = path->p_hdr;
+        struct ext4_extent *r, *l, *m;
+
+        BUG_ON(eh->eh_magic != EXT4_EXT_MAGIC);
+        BUG_ON(le16_to_cpu(eh->eh_entries) > le16_to_cpu(eh->eh_max));
+
+        if (eh->eh_entries == 0) {
+                /*
+                 * this leaf is empty:
+                 * we get such a leaf in split/add case
+                 */
+                return;
+        }
+
+        ext_debug("binsearch for %d:  ", block);
+
+        l = EXT_FIRST_EXTENT(eh) + 1;
+        r = EXT_FIRST_EXTENT(eh) + le16_to_cpu(eh->eh_entries) - 1;
+
+        while (l <= r) {
+                m = l + (r - l) / 2;
+                if (block < le32_to_cpu(m->ee_block))
+                        r = m - 1;
+                else
+                        l = m + 1;
+                ext_debug("%p(%u):%p(%u):%p(%u) ", l, l->ee_block,
+                                m, m->ee_block, r, r->ee_block);
+        }
+
+        path->p_ext = l - 1;
+        ext_debug("  -> %d:%llu:%d ",
+                        le32_to_cpu(path->p_ext->ee_block),
+                        ext_pblock(path->p_ext),
+                        le16_to_cpu(path->p_ext->ee_len));
+
+#ifdef CHECK_BINSEARCH
+        {
+                struct ext4_extent *chex, *ex;
+                int k;
+
+                chex = ex = EXT_FIRST_EXTENT(eh);
+                for (k = 0; k < le16_to_cpu(eh->eh_entries); k++, ex++) {
+                        BUG_ON(k && le32_to_cpu(ex->ee_block)
+                                          <= le32_to_cpu(ex[-1].ee_block));
+                        if (block < le32_to_cpu(ex->ee_block))
+                                break;
+                        chex = ex;
+                }
+                BUG_ON(chex != path->p_ext);
+        }
+#endif
+
+}
+
+int ext4_ext_tree_init(handle_t *handle, struct inode *inode)
+{
+        struct ext4_extent_header *eh;
+
+        eh = ext_inode_hdr(inode);
+        eh->eh_depth = 0;
+        eh->eh_entries = 0;
+        eh->eh_magic = EXT4_EXT_MAGIC;
+        eh->eh_max = cpu_to_le16(ext4_ext_space_root(inode));
+        ext4_mark_inode_dirty(handle, inode);
+        ext4_ext_invalidate_cache(inode);
+        return 0;
+}
+
+struct ext4_ext_path *
+ext4_ext_find_extent(struct inode *inode, int block, struct ext4_ext_path *path)
+{
+        struct ext4_extent_header *eh;
+        struct buffer_head *bh;
+        short int depth, i, ppos = 0, alloc = 0;
+
+        eh = ext_inode_hdr(inode);
+        BUG_ON(eh == NULL);
+        if (ext4_ext_check_header(__FUNCTION__, inode, eh))
+                return ERR_PTR(-EIO);
+
+        i = depth = ext_depth(inode);
+
+        /* account possible depth increase */
+        if (!path) {
+                path = kmalloc(sizeof(struct ext4_ext_path) * (depth + 2),
+                                GFP_NOFS);
+                if (!path)
+                        return ERR_PTR(-ENOMEM);
+                alloc = 1;
+        }
+        memset(path, 0, sizeof(struct ext4_ext_path) * (depth + 1));
+        path[0].p_hdr = eh;
+
+        /* walk through the tree */
+        while (i) {
+                ext_debug("depth %d: num %d, max %d\n",
+                          ppos, le16_to_cpu(eh->eh_entries), le16_to_cpu(eh->eh_max));
+                ext4_ext_binsearch_idx(inode, path + ppos, block);
+                path[ppos].p_block = idx_pblock(path[ppos].p_idx);
+                path[ppos].p_depth = i;
+                path[ppos].p_ext = NULL;
+
+                bh = sb_bread(inode->i_sb, path[ppos].p_block);
+                if (!bh)
+                        goto err;
+
+                eh = ext_block_hdr(bh);
+                ppos++;
+                BUG_ON(ppos > depth);
+                path[ppos].p_bh = bh;
+                path[ppos].p_hdr = eh;
+                i--;
+
+                if (ext4_ext_check_header(__FUNCTION__, inode, eh))
+                        goto err;
+        }
+
+        path[ppos].p_depth = i;
+        path[ppos].p_hdr = eh;
+        path[ppos].p_ext = NULL;
+        path[ppos].p_idx = NULL;
+
+        if (ext4_ext_check_header(__FUNCTION__, inode, eh))
+                goto err;
+
+        /* find extent */
+        ext4_ext_binsearch(inode, path + ppos, block);
+
+        ext4_ext_show_path(inode, path);
+
+        return path;
+
+err:
+        ext4_ext_drop_refs(path);
+        if (alloc)
+                kfree(path);
+        return ERR_PTR(-EIO);
+}
+
+/*
+ * ext4_ext_insert_index:
+ * insert new index [@logical;@ptr] into the block at @curp;
+ * check where to insert: before @curp or after @curp
+ */
+static int ext4_ext_insert_index(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *curp,
+                                int logical, ext4_fsblk_t ptr)
+{
+        struct ext4_extent_idx *ix;
+        int len, err;
+
+        if ((err = ext4_ext_get_access(handle, inode, curp)))
+                return err;
+
+        BUG_ON(logical == le32_to_cpu(curp->p_idx->ei_block));
+        len = EXT_MAX_INDEX(curp->p_hdr) - curp->p_idx;
+        if (logical > le32_to_cpu(curp->p_idx->ei_block)) {
+                /* insert after */
+                if (curp->p_idx != EXT_LAST_INDEX(curp->p_hdr)) {
+                        len = (len - 1) * sizeof(struct ext4_extent_idx);
+                        len = len < 0 ? 0 : len;
+                        ext_debug("insert new index %d after: %d. "
+                                        "move %d from 0x%p to 0x%p\n",
+                                        logical, ptr, len,
+                                        (curp->p_idx + 1), (curp->p_idx + 2));
+                        memmove(curp->p_idx + 2, curp->p_idx + 1, len);
+                }
+                ix = curp->p_idx + 1;
+        } else {
+                /* insert before */
+                len = len * sizeof(struct ext4_extent_idx);
+                len = len < 0 ? 0 : len;
+                ext_debug("insert new index %d before: %d. "
+                                "move %d from 0x%p to 0x%p\n",
+                                logical, ptr, len,
+                                curp->p_idx, (curp->p_idx + 1));
+                memmove(curp->p_idx + 1, curp->p_idx, len);
+                ix = curp->p_idx;
+        }
+
+        ix->ei_block = cpu_to_le32(logical);
+        ext4_idx_store_pblock(ix, ptr);
+        curp->p_hdr->eh_entries = cpu_to_le16(le16_to_cpu(curp->p_hdr->eh_entries)+1);
+
+        BUG_ON(le16_to_cpu(curp->p_hdr->eh_entries)
+                             > le16_to_cpu(curp->p_hdr->eh_max));
+        BUG_ON(ix > EXT_LAST_INDEX(curp->p_hdr));
+
+        err = ext4_ext_dirty(handle, inode, curp);
+        ext4_std_error(inode->i_sb, err);
+
+        return err;
+}
+
+/*
+ * ext4_ext_split:
+ * inserts new subtree into the path, using free index entry
+ * at depth @at:
+ * - allocates all needed blocks (new leaf and all intermediate index blocks)
+ * - makes decision where to split
+ * - moves remaining extents and index entries (right to the split point)
+ *   into the newly allocated blocks
+ * - initializes subtree
+ */
+static int ext4_ext_split(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *path,
+                                struct ext4_extent *newext, int at)
+{
+        struct buffer_head *bh = NULL;
+        int depth = ext_depth(inode);
+        struct ext4_extent_header *neh;
+        struct ext4_extent_idx *fidx;
+        struct ext4_extent *ex;
+        int i = at, k, m, a;
+        ext4_fsblk_t newblock, oldblock;
+        __le32 border;
+        ext4_fsblk_t *ablocks = NULL; /* array of allocated blocks */
+        int err = 0;
+
+        /* make decision: where to split? */
+        /* FIXME: now decision is simplest: at current extent */
+
+        /* if current leaf will be split, then we should use
+         * border from split point */
+        BUG_ON(path[depth].p_ext > EXT_MAX_EXTENT(path[depth].p_hdr));
+        if (path[depth].p_ext != EXT_MAX_EXTENT(path[depth].p_hdr)) {
+                border = path[depth].p_ext[1].ee_block;
+                ext_debug("leaf will be split."
+                                " next leaf starts at %d\n",
+                                  le32_to_cpu(border));
+        } else {
+                border = newext->ee_block;
+                ext_debug("leaf will be added."
+                                " next leaf starts at %d\n",
+                                le32_to_cpu(border));
+        }
+
+        /*
+         * If error occurs, then we break processing
+         * and mark filesystem read-only. index won't
+         * be inserted and tree will be in consistent
+         * state. Next mount will repair buffers too.
+         */
+
+        /*
+         * Get array to track all allocated blocks.
+         * We need this to handle errors and free blocks
+         * upon them.
+         */
+        ablocks = kmalloc(sizeof(ext4_fsblk_t) * depth, GFP_NOFS);
+        if (!ablocks)
+                return -ENOMEM;
+        memset(ablocks, 0, sizeof(ext4_fsblk_t) * depth);
+
+        /* allocate all needed blocks */
+        ext_debug("allocate %d blocks for indexes/leaf\n", depth - at);
+        for (a = 0; a < depth - at; a++) {
+                newblock = ext4_ext_new_block(handle, inode, path, newext, &err);
+                if (newblock == 0)
+                        goto cleanup;
+                ablocks[a] = newblock;
+        }
+
+        /* initialize new leaf */
+        newblock = ablocks[--a];
+        BUG_ON(newblock == 0);
+        bh = sb_getblk(inode->i_sb, newblock);
+        if (!bh) {
+                err = -EIO;
+                goto cleanup;
+        }
+        lock_buffer(bh);
+
+        if ((err = ext4_journal_get_create_access(handle, bh)))
+                goto cleanup;
+
+        neh = ext_block_hdr(bh);
+        neh->eh_entries = 0;
+        neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode));
+        neh->eh_magic = EXT4_EXT_MAGIC;
+        neh->eh_depth = 0;
+        ex = EXT_FIRST_EXTENT(neh);
+
+        /* move remainder of path[depth] to the new leaf */
+        BUG_ON(path[depth].p_hdr->eh_entries != path[depth].p_hdr->eh_max);
+        /* start copy from next extent */
+        /* TODO: we could do it by single memmove */
+        m = 0;
+        path[depth].p_ext++;
+        while (path[depth].p_ext <=
+                        EXT_MAX_EXTENT(path[depth].p_hdr)) {
+                ext_debug("move %d:%llu:%d in new leaf %llu\n",
+                                le32_to_cpu(path[depth].p_ext->ee_block),
+                                ext_pblock(path[depth].p_ext),
+                                le16_to_cpu(path[depth].p_ext->ee_len),
+                                newblock);
+                /*memmove(ex++, path[depth].p_ext++,
+                                sizeof(struct ext4_extent));
+                neh->eh_entries++;*/
+                path[depth].p_ext++;
+                m++;
+        }
+        if (m) {
+                memmove(ex, path[depth].p_ext-m, sizeof(struct ext4_extent)*m);
+                neh->eh_entries = cpu_to_le16(le16_to_cpu(neh->eh_entries)+m);
+        }
+
+        set_buffer_uptodate(bh);
+        unlock_buffer(bh);
+
+        if ((err = ext4_journal_dirty_metadata(handle, bh)))
+                goto cleanup;
+        brelse(bh);
+        bh = NULL;
+
+        /* correct old leaf */
+        if (m) {
+                if ((err = ext4_ext_get_access(handle, inode, path + depth)))
+                        goto cleanup;
+                path[depth].p_hdr->eh_entries =
+                     cpu_to_le16(le16_to_cpu(path[depth].p_hdr->eh_entries)-m);
+                if ((err = ext4_ext_dirty(handle, inode, path + depth)))
+                        goto cleanup;
+
+        }
+
+        /* create intermediate indexes */
+        k = depth - at - 1;
+        BUG_ON(k < 0);
+        if (k)
+                ext_debug("create %d intermediate indices\n", k);
+        /* insert new index into current index block */
+        /* current depth stored in i var */
+        i = depth - 1;
+        while (k--) {
+                oldblock = newblock;
+                newblock = ablocks[--a];
+                bh = sb_getblk(inode->i_sb, (ext4_fsblk_t)newblock);
+                if (!bh) {
+                        err = -EIO;
+                        goto cleanup;
+                }
+                lock_buffer(bh);
+
+                if ((err = ext4_journal_get_create_access(handle, bh)))
+                        goto cleanup;
+
+                neh = ext_block_hdr(bh);
+                neh->eh_entries = cpu_to_le16(1);
+                neh->eh_magic = EXT4_EXT_MAGIC;
+                neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode));
+                neh->eh_depth = cpu_to_le16(depth - i);
+                fidx = EXT_FIRST_INDEX(neh);
+                fidx->ei_block = border;
+                ext4_idx_store_pblock(fidx, oldblock);
+
+                ext_debug("int.index at %d (block %llu): %lu -> %llu\n", i,
+                                newblock, (unsigned long) le32_to_cpu(border),
+                                oldblock);
+                /* copy indexes */
+                m = 0;
+                path[i].p_idx++;
+
+                ext_debug("cur 0x%p, last 0x%p\n", path[i].p_idx,
+                                EXT_MAX_INDEX(path[i].p_hdr));
+                BUG_ON(EXT_MAX_INDEX(path[i].p_hdr) !=
+                                EXT_LAST_INDEX(path[i].p_hdr));
+                while (path[i].p_idx <= EXT_MAX_INDEX(path[i].p_hdr)) {
+                        ext_debug("%d: move %d:%d in new index %llu\n", i,
+                                        le32_to_cpu(path[i].p_idx->ei_block),
+                                        idx_pblock(path[i].p_idx),
+                                        newblock);
+                        /*memmove(++fidx, path[i].p_idx++,
+                                        sizeof(struct ext4_extent_idx));
+                        neh->eh_entries++;
+                        BUG_ON(neh->eh_entries > neh->eh_max);*/
+                        path[i].p_idx++;
+                        m++;
+                }
+                if (m) {
+                        memmove(++fidx, path[i].p_idx - m,
+                                sizeof(struct ext4_extent_idx) * m);
+                        neh->eh_entries =
+                                cpu_to_le16(le16_to_cpu(neh->eh_entries) + m);
+                }
+                set_buffer_uptodate(bh);
+                unlock_buffer(bh);
+
+                if ((err = ext4_journal_dirty_metadata(handle, bh)))
+                        goto cleanup;
+                brelse(bh);
+                bh = NULL;
+
+                /* correct old index */
+                if (m) {
+                        err = ext4_ext_get_access(handle, inode, path + i);
+                        if (err)
+                                goto cleanup;
+                        path[i].p_hdr->eh_entries = cpu_to_le16(le16_to_cpu(path[i].p_hdr->eh_entries)-m);
+                        err = ext4_ext_dirty(handle, inode, path + i);
+                        if (err)
+                                goto cleanup;
+                }
+
+                i--;
+        }
+
+        /* insert new index */
+        if (err)
+                goto cleanup;
+
+        err = ext4_ext_insert_index(handle, inode, path + at,
+                                    le32_to_cpu(border), newblock);
+
+cleanup:
+        if (bh) {
+                if (buffer_locked(bh))
+                        unlock_buffer(bh);
+                brelse(bh);
+        }
+
+        if (err) {
+                /* free all allocated blocks in error case */
+                for (i = 0; i < depth; i++) {
+                        if (!ablocks[i])
+                                continue;
+                        ext4_free_blocks(handle, inode, ablocks[i], 1);
+                }
+        }
+        kfree(ablocks);
+
+        return err;
+}
+
+/*
+ * ext4_ext_grow_indepth:
+ * implements tree growing procedure:
+ * - allocates new block
+ * - moves top-level data (index block or leaf) into the new block
+ * - initializes new top-level, creating index that points to the
+ *   just created block
+ */
+static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
+                                        struct ext4_ext_path *path,
+                                        struct ext4_extent *newext)
+{
+        struct ext4_ext_path *curp = path;
+        struct ext4_extent_header *neh;
+        struct ext4_extent_idx *fidx;
+        struct buffer_head *bh;
+        ext4_fsblk_t newblock;
+        int err = 0;
+
+        newblock = ext4_ext_new_block(handle, inode, path, newext, &err);
+        if (newblock == 0)
+                return err;
+
+        bh = sb_getblk(inode->i_sb, newblock);
+        if (!bh) {
+                err = -EIO;
+                ext4_std_error(inode->i_sb, err);
+                return err;
+        }
+        lock_buffer(bh);
+
+        if ((err = ext4_journal_get_create_access(handle, bh))) {
+                unlock_buffer(bh);
+                goto out;
+        }
+
+        /* move top-level index/leaf into new block */
+        memmove(bh->b_data, curp->p_hdr, sizeof(EXT4_I(inode)->i_data));
+
+        /* set size of new block */
+        neh = ext_block_hdr(bh);
+        /* old root could have indexes or leaves
+         * so calculate e_max right way */
+        if (ext_depth(inode))
+          neh->eh_max = cpu_to_le16(ext4_ext_space_block_idx(inode));
+        else
+          neh->eh_max = cpu_to_le16(ext4_ext_space_block(inode));
+        neh->eh_magic = EXT4_EXT_MAGIC;
+        set_buffer_uptodate(bh);
+        unlock_buffer(bh);
+
+        if ((err = ext4_journal_dirty_metadata(handle, bh)))
+                goto out;
+
+        /* create index in new top-level index: num,max,pointer */
+        if ((err = ext4_ext_get_access(handle, inode, curp)))
+                goto out;
+
+        curp->p_hdr->eh_magic = EXT4_EXT_MAGIC;
+        curp->p_hdr->eh_max = cpu_to_le16(ext4_ext_space_root_idx(inode));
+        curp->p_hdr->eh_entries = cpu_to_le16(1);
+        curp->p_idx = EXT_FIRST_INDEX(curp->p_hdr);
+        /* FIXME: it works, but actually path[0] can be index */
+        curp->p_idx->ei_block = EXT_FIRST_EXTENT(path[0].p_hdr)->ee_block;
+        ext4_idx_store_pblock(curp->p_idx, newblock);
+
+        neh = ext_inode_hdr(inode);
+        fidx = EXT_FIRST_INDEX(neh);
+        ext_debug("new root: num %d(%d), lblock %d, ptr %llu\n",
+                  le16_to_cpu(neh->eh_entries), le16_to_cpu(neh->eh_max),
+                  le32_to_cpu(fidx->ei_block), idx_pblock(fidx));
+
+        neh->eh_depth = cpu_to_le16(path->p_depth + 1);
+        err = ext4_ext_dirty(handle, inode, curp);
+out:
+        brelse(bh);
+
+        return err;
+}
+
+/*
+ * ext4_ext_create_new_leaf:
+ * finds empty index and adds new leaf.
+ * if no free index is found, then it requests in-depth growing.
+ */
+static int ext4_ext_create_new_leaf(handle_t *handle, struct inode *inode,
+                                        struct ext4_ext_path *path,
+                                        struct ext4_extent *newext)
+{
+        struct ext4_ext_path *curp;
+        int depth, i, err = 0;
+
+repeat:
+        i = depth = ext_depth(inode);
+
+        /* walk up to the tree and look for free index entry */
+        curp = path + depth;
+        while (i > 0 && !EXT_HAS_FREE_INDEX(curp)) {
+                i--;
+                curp--;
+        }
+
+        /* we use already allocated block for index block,
+         * so subsequent data blocks should be contiguous */
+        if (EXT_HAS_FREE_INDEX(curp)) {
+                /* if we found index with free entry, then use that
+                 * entry: create all needed subtree and add new leaf */
+                err = ext4_ext_split(handle, inode, path, newext, i);
+
+                /* refill path */
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode,
+                                            le32_to_cpu(newext->ee_block),
+                                            path);
+                if (IS_ERR(path))
+                        err = PTR_ERR(path);
+        } else {
+                /* tree is full, time to grow in depth */
+                err = ext4_ext_grow_indepth(handle, inode, path, newext);
+                if (err)
+                        goto out;
+
+                /* refill path */
+                ext4_ext_drop_refs(path);
+                path = ext4_ext_find_extent(inode,
+                                            le32_to_cpu(newext->ee_block),
+                                            path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        goto out;
+                }
+
+                /*
+                 * only first (depth 0 -> 1) produces free space;
+                 * in all other cases we have to split the grown tree
+                 */
+                depth = ext_depth(inode);
+                if (path[depth].p_hdr->eh_entries == path[depth].p_hdr->eh_max) {
+                        /* now we need to split */
+                        goto repeat;
+                }
+        }
+
+out:
+        return err;
+}
+
+/*
+ * ext4_ext_next_allocated_block:
+ * returns allocated block in subsequent extent or EXT_MAX_BLOCK.
+ * NOTE: it considers block number from index entry as
+ * allocated block. Thus, index entries have to be consistent
+ * with leaves.
+ */
+static unsigned long
+ext4_ext_next_allocated_block(struct ext4_ext_path *path)
+{
+        int depth;
+
+        BUG_ON(path == NULL);
+        depth = path->p_depth;
+
+        if (depth == 0 && path->p_ext == NULL)
+                return EXT_MAX_BLOCK;
+
+        while (depth >= 0) {
+                if (depth == path->p_depth) {
+                        /* leaf */
+                        if (path[depth].p_ext !=
+                                        EXT_LAST_EXTENT(path[depth].p_hdr))
+                          return le32_to_cpu(path[depth].p_ext[1].ee_block);
+                } else {
+                        /* index */
+                        if (path[depth].p_idx !=
+                                        EXT_LAST_INDEX(path[depth].p_hdr))
+                          return le32_to_cpu(path[depth].p_idx[1].ei_block);
+                }
+                depth--;
+        }
+
+        return EXT_MAX_BLOCK;
+}
+
+/*
+ * ext4_ext_next_leaf_block:
+ * returns first allocated block from next leaf or EXT_MAX_BLOCK
+ */
+static unsigned ext4_ext_next_leaf_block(struct inode *inode,
+                                        struct ext4_ext_path *path)
+{
+        int depth;
+
+        BUG_ON(path == NULL);
+        depth = path->p_depth;
+
+        /* zero-tree has no leaf blocks at all */
+        if (depth == 0)
+                return EXT_MAX_BLOCK;
+
+        /* go to index block */
+        depth--;
+
+        while (depth >= 0) {
+                if (path[depth].p_idx !=
+                                EXT_LAST_INDEX(path[depth].p_hdr))
+                  return le32_to_cpu(path[depth].p_idx[1].ei_block);
+                depth--;
+        }
+
+        return EXT_MAX_BLOCK;
+}
+
+/*
+ * ext4_ext_correct_indexes:
+ * if leaf gets modified and modified extent is first in the leaf,
+ * then we have to correct all indexes above.
+ * TODO: do we need to correct tree in all cases?
+ */
+int ext4_ext_correct_indexes(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *path)
+{
+        struct ext4_extent_header *eh;
+        int depth = ext_depth(inode);
+        struct ext4_extent *ex;
+        __le32 border;
+        int k, err = 0;
+
+        eh = path[depth].p_hdr;
+        ex = path[depth].p_ext;
+        BUG_ON(ex == NULL);
+        BUG_ON(eh == NULL);
+
+        if (depth == 0) {
+                /* there is no tree at all */
+                return 0;
+        }
+
+        if (ex != EXT_FIRST_EXTENT(eh)) {
+                /* we correct tree if first leaf got modified only */
+                return 0;
+        }
+
+        /*
+         * TODO: we need correction if border is smaller than current one
+         */
+        k = depth - 1;
+        border = path[depth].p_ext->ee_block;
+        if ((err = ext4_ext_get_access(handle, inode, path + k)))
+                return err;
+        path[k].p_idx->ei_block = border;
+        if ((err = ext4_ext_dirty(handle, inode, path + k)))
+                return err;
+
+        while (k--) {
+                /* change all left-side indexes */
+                if (path[k+1].p_idx != EXT_FIRST_INDEX(path[k+1].p_hdr))
+                        break;
+                if ((err = ext4_ext_get_access(handle, inode, path + k)))
+                        break;
+                path[k].p_idx->ei_block = border;
+                if ((err = ext4_ext_dirty(handle, inode, path + k)))
+                        break;
+        }
+
+        return err;
+}
+
+static int inline
+ext4_can_extents_be_merged(struct inode *inode, struct ext4_extent *ex1,
+                                struct ext4_extent *ex2)
+{
+        if (le32_to_cpu(ex1->ee_block) + le16_to_cpu(ex1->ee_len) !=
+                        le32_to_cpu(ex2->ee_block))
+                return 0;
+
+        /*
+         * To allow future support for preallocated extents to be added
+         * as an RO_COMPAT feature, refuse to merge to extents if
+         * this can result in the top bit of ee_len being set.
+         */
+        if (le16_to_cpu(ex1->ee_len) + le16_to_cpu(ex2->ee_len) > EXT_MAX_LEN)
+                return 0;
+#ifdef AGRESSIVE_TEST
+        if (le16_to_cpu(ex1->ee_len) >= 4)
+                return 0;
+#endif
+
+        if (ext_pblock(ex1) + le16_to_cpu(ex1->ee_len) == ext_pblock(ex2))
+                return 1;
+        return 0;
+}
+
+/*
+ * ext4_ext_insert_extent:
+ * tries to merge requsted extent into the existing extent or
+ * inserts requested extent as new one into the tree,
+ * creating new leaf in the no-space case.
+ */
+int ext4_ext_insert_extent(handle_t *handle, struct inode *inode,
+                                struct ext4_ext_path *path,
+                                struct ext4_extent *newext)
+{
+        struct ext4_extent_header * eh;
+        struct ext4_extent *ex, *fex;
+        struct ext4_extent *nearex; /* nearest extent */
+        struct ext4_ext_path *npath = NULL;
+        int depth, len, err, next;
+
+        BUG_ON(newext->ee_len == 0);
+        depth = ext_depth(inode);
+        ex = path[depth].p_ext;
+        BUG_ON(path[depth].p_hdr == NULL);
+
+        /* try to insert block into found extent and return */
+        if (ex && ext4_can_extents_be_merged(inode, ex, newext)) {
+                ext_debug("append %d block to %d:%d (from %llu)\n",
+                                le16_to_cpu(newext->ee_len),
+                                le32_to_cpu(ex->ee_block),
+                                le16_to_cpu(ex->ee_len), ext_pblock(ex));
+                if ((err = ext4_ext_get_access(handle, inode, path + depth)))
+                        return err;
+                ex->ee_len = cpu_to_le16(le16_to_cpu(ex->ee_len)
+                                         + le16_to_cpu(newext->ee_len));
+                eh = path[depth].p_hdr;
+                nearex = ex;
+                goto merge;
+        }
+
+repeat:
+        depth = ext_depth(inode);
+        eh = path[depth].p_hdr;
+        if (le16_to_cpu(eh->eh_entries) < le16_to_cpu(eh->eh_max))
+                goto has_space;
+
+        /* probably next leaf has space for us? */
+        fex = EXT_LAST_EXTENT(eh);
+        next = ext4_ext_next_leaf_block(inode, path);
+        if (le32_to_cpu(newext->ee_block) > le32_to_cpu(fex->ee_block)
+            && next != EXT_MAX_BLOCK) {
+                ext_debug("next leaf block - %d\n", next);
+                BUG_ON(npath != NULL);
+                npath = ext4_ext_find_extent(inode, next, NULL);
+                if (IS_ERR(npath))
+                        return PTR_ERR(npath);
+                BUG_ON(npath->p_depth != path->p_depth);
+                eh = npath[depth].p_hdr;
+                if (le16_to_cpu(eh->eh_entries) < le16_to_cpu(eh->eh_max)) {
+                        ext_debug("next leaf isnt full(%d)\n",
+                                  le16_to_cpu(eh->eh_entries));
+                        path = npath;
+                        goto repeat;
+                }
+                ext_debug("next leaf has no free space(%d,%d)\n",
+                          le16_to_cpu(eh->eh_entries), le16_to_cpu(eh->eh_max));
+        }
+
+        /*
+         * There is no free space in the found leaf.
+         * We're gonna add a new leaf in the tree.
+         */
+        err = ext4_ext_create_new_leaf(handle, inode, path, newext);
+        if (err)
+                goto cleanup;
+        depth = ext_depth(inode);
+        eh = path[depth].p_hdr;
+
+has_space:
+        nearex = path[depth].p_ext;
+
+        if ((err = ext4_ext_get_access(handle, inode, path + depth)))
+                goto cleanup;
+
+        if (!nearex) {
+                /* there is no extent in this leaf, create first one */
+                ext_debug("first extent in the leaf: %d:%llu:%d\n",
+                                le32_to_cpu(newext->ee_block),
+                                ext_pblock(newext),
+                                le16_to_cpu(newext->ee_len));
+                path[depth].p_ext = EXT_FIRST_EXTENT(eh);
+        } else if (le32_to_cpu(newext->ee_block)
+                           > le32_to_cpu(nearex->ee_block)) {
+/*              BUG_ON(newext->ee_block == nearex->ee_block); */
+                if (nearex != EXT_LAST_EXTENT(eh)) {
+                        len = EXT_MAX_EXTENT(eh) - nearex;
+                        len = (len - 1) * sizeof(struct ext4_extent);
+                        len = len < 0 ? 0 : len;
+                        ext_debug("insert %d:%llu:%d after: nearest 0x%p, "
+                                        "move %d from 0x%p to 0x%p\n",
+                                        le32_to_cpu(newext->ee_block),
+                                        ext_pblock(newext),
+                                        le16_to_cpu(newext->ee_len),
+                                        nearex, len, nearex + 1, nearex + 2);
+                        memmove(nearex + 2, nearex + 1, len);
+                }
+                path[depth].p_ext = nearex + 1;
+        } else {
+                BUG_ON(newext->ee_block == nearex->ee_block);
+                len = (EXT_MAX_EXTENT(eh) - nearex) * sizeof(struct ext4_extent);
+                len = len < 0 ? 0 : len;
+                ext_debug("insert %d:%llu:%d before: nearest 0x%p, "
+                                "move %d from 0x%p to 0x%p\n",
+                                le32_to_cpu(newext->ee_block),
+                                ext_pblock(newext),
+                                le16_to_cpu(newext->ee_len),
+                                nearex, len, nearex + 1, nearex + 2);
+                memmove(nearex + 1, nearex, len);
+                path[depth].p_ext = nearex;
+        }
+
+        eh->eh_entries = cpu_to_le16(le16_to_cpu(eh->eh_entries)+1);
+        nearex = path[depth].p_ext;
+        nearex->ee_block = newext->ee_block;
+        nearex->ee_start = newext->ee_start;
+        nearex->ee_start_hi = newext->ee_start_hi;
+        nearex->ee_len = newext->ee_len;
+
+merge:
+        /* try to merge extents to the right */
+        while (nearex < EXT_LAST_EXTENT(eh)) {
+                if (!ext4_can_extents_be_merged(inode, nearex, nearex + 1))
+                        break;
+                /* merge with next extent! */
+                nearex->ee_len = cpu_to_le16(le16_to_cpu(nearex->ee_len)
+                                             + le16_to_cpu(nearex[1].ee_len));
+                if (nearex + 1 < EXT_LAST_EXTENT(eh)) {
+                        len = (EXT_LAST_EXTENT(eh) - nearex - 1)
+                                        * sizeof(struct ext4_extent);
+                        memmove(nearex + 1, nearex + 2, len);
+                }
+                eh->eh_entries = cpu_to_le16(le16_to_cpu(eh->eh_entries)-1);
+                BUG_ON(eh->eh_entries == 0);
+        }
+
+        /* try to merge extents to the left */
+
+        /* time to correct all indexes above */
+        err = ext4_ext_correct_indexes(handle, inode, path);
+        if (err)
+                goto cleanup;
+
+        err = ext4_ext_dirty(handle, inode, path + depth);
+
+cleanup:
+        if (npath) {
+                ext4_ext_drop_refs(npath);
+                kfree(npath);
+        }
+        ext4_ext_tree_changed(inode);
+        ext4_ext_invalidate_cache(inode);
+        return err;
+}
+
+int ext4_ext_walk_space(struct inode *inode, unsigned long block,
+                        unsigned long num, ext_prepare_callback func,
+                        void *cbdata)
+{
+        struct ext4_ext_path *path = NULL;
+        struct ext4_ext_cache cbex;
+        struct ext4_extent *ex;
+        unsigned long next, start = 0, end = 0;
+        unsigned long last = block + num;
+        int depth, exists, err = 0;
+
+        BUG_ON(func == NULL);
+        BUG_ON(inode == NULL);
+
+        while (block < last && block != EXT_MAX_BLOCK) {
+                num = last - block;
+                /* find extent for this block */
+                path = ext4_ext_find_extent(inode, block, path);
+                if (IS_ERR(path)) {
+                        err = PTR_ERR(path);
+                        path = NULL;
+                        break;
+                }
+
+                depth = ext_depth(inode);
+                BUG_ON(path[depth].p_hdr == NULL);
+                ex = path[depth].p_ext;
+                next = ext4_ext_next_allocated_block(path);
+
+                exists = 0;
+                if (!ex) {
+                        /* there is no extent yet, so try to allocate
+                         * all requested space */
+                        start = block;
+                        end = block + num;
+                } else if (le32_to_cpu(ex->ee_block) > block) {
+                        /* need to allocate space before found extent */
+                        start = block;
+                        end = le32_to_cpu(ex->ee_block);
+                        if (block + num < end)
+                                end = block + num;
+                } else if (block >=
+                             le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len)) {
+                        /* need to allocate space after found extent */
+                        start = block;
+                        end = block + num;
+                        if (end >= next)
+                                end = next;
+                } else if (block >= le32_to_cpu(ex->ee_block)) {
+                        /*
+                         * some part of requested space is covered
+                         * by found extent
+                         */
+                        start = block;
+                        end = le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len);
+                        if (block + num < end)
+                                end = block + num;
+                        exists = 1;
+                } else {
+                        BUG();
+                }
+                BUG_ON(end <= start);
+
+                if (!exists) {
+                        cbex.ec_block = start;
+                        cbex.ec_len = end - start;
+                        cbex.ec_start = 0;
+                        cbex.ec_type = EXT4_EXT_CACHE_GAP;
+                } else {
+                        cbex.ec_block = le32_to_cpu(ex->ee_block);
+                        cbex.ec_len = le16_to_cpu(ex->ee_len);
+                        cbex.ec_start = ext_pblock(ex);
+                        cbex.ec_type = EXT4_EXT_CACHE_EXTENT;
+                }
+
+                BUG_ON(cbex.ec_len == 0);
+                err = func(inode, path, &cbex, cbdata);
+                ext4_ext_drop_refs(path);
+
+                if (err < 0)
+                        break;
+                if (err == EXT_REPEAT)
+                        continue;
+                else if (err == EXT_BREAK) {
+                        err = 0;
+                        break;
+                }
+
+                if (ext_depth(inode) != depth) {
+                        /* depth was changed. we have to realloc path */
+                        kfree(path);
+                        path = NULL;
+                }
+
+                block = cbex.ec_block + cbex.ec_len;
+        }
+
+        if (path) {
+                ext4_ext_drop_refs(path);
+                kfree(path);
+        }
+
+        return err;
+}
+
+static inline void
+ext4_ext_put_in_cache(struct inode *inode, __u32 block,
+                        __u32 len, __u32 start, int type)
+{
+        struct ext4_ext_cache *cex;
+        BUG_ON(len == 0);
+        cex = &EXT4_I(inode)->i_cached_extent;
+        cex->ec_type = type;
+        cex->ec_block = block;
+        cex->ec_len = len;
+        cex->ec_start = start;
+}
+
+/*
+ * ext4_ext_put_gap_in_cache:
+ * calculate boundaries of the gap that the requested block fits into
+ * and cache this gap
+ */
+static inline void
+ext4_ext_put_gap_in_cache(struct inode *inode, struct ext4_ext_path *path,
+                                unsigned long block)
+{
+        int depth = ext_depth(inode);
+        unsigned long lblock, len;
+        struct ext4_extent *ex;
+
+        ex = path[depth].p_ext;
+        if (ex == NULL) {
+                /* there is no extent yet, so gap is [0;-] */
+                lblock = 0;
+                len = EXT_MAX_BLOCK;
+                ext_debug("cache gap(whole file):");
+        } else if (block < le32_to_cpu(ex->ee_block)) {
+                lblock = block;
+                len = le32_to_cpu(ex->ee_block) - block;
+                ext_debug("cache gap(before): %lu [%lu:%lu]",
+                                (unsigned long) block,
+                                (unsigned long) le32_to_cpu(ex->ee_block),
+                                (unsigned long) le16_to_cpu(ex->ee_len));
+        } else if (block >= le32_to_cpu(ex->ee_block)
+                            + le16_to_cpu(ex->ee_len)) {
+                lblock = le32_to_cpu(ex->ee_block)
+                         + le16_to_cpu(ex->ee_len);
+                len = ext4_ext_next_allocated_block(path);
+                ext_debug("cache gap(after): [%lu:%lu] %lu",
+                                (unsigned long) le32_to_cpu(ex->ee_block),
+                                (unsigned long) le16_to_cpu(ex->ee_len),
+                                (unsigned long) block);
+                BUG_ON(len == lblock);
+                len = len - lblock;
+        } else {
+                lblock = len = 0;
+                BUG();
+        }
+
+        ext_debug(" -> %lu:%lu\n", (unsigned long) lblock, len);
+        ext4_ext_put_in_cache(inode, lblock, len, 0, EXT4_EXT_CACHE_GAP);
+}
+
+static inline int
+ext4_ext_in_cache(struct inode *inode, unsigned long block,
+                        struct ext4_extent *ex)
+{
+        struct ext4_ext_cache *cex;
+
+        cex = &EXT4_I(inode)->i_cached_extent;
+
+        /* has cache valid data? */
+        if (cex->ec_type == EXT4_EXT_CACHE_NO)
+                return EXT4_EXT_CACHE_NO;
+
+        BUG_ON(cex->ec_type != EXT4_EXT_CACHE_GAP &&
+                        cex->ec_type != EXT4_EXT_CACHE_EXTENT);
+        if (block >= cex->ec_block && block < cex->ec_block + cex->ec_len) {
+                ex->ee_block = cpu_to_le32(cex->ec_block);
+                ext4_ext_store_pblock(ex, cex->ec_start);
+                ex->ee_len = cpu_to_le16(cex->ec_len);
+                ext_debug("%lu cached by %lu:%lu:%llu\n",
+                                (unsigned long) block,
+                                (unsigned long) cex->ec_block,
+                                (unsigned long) cex->ec_len,
+                                cex->ec_start);
+                return cex->ec_type;
+        }
+
+        /* not in cache */
+        return EXT4_EXT_CACHE_NO;
+}
+
+/*
+ * ext4_ext_rm_idx:
+ * removes index from the index block.
+ * It's used in truncate case only, thus all requests are for
+ * last index in the block only.
+ */
+int ext4_ext_rm_idx(handle_t *handle, struct inode *inode,
+                        struct ext4_ext_path *path)
+{
+        struct buffer_head *bh;
+        int err;
+        ext4_fsblk_t leaf;
+
+        /* free index block */
+        path--;
+        leaf = idx_pblock(path->p_idx);
+        BUG_ON(path->p_hdr->eh_entries == 0);
+        if ((err = ext4_ext_get_access(handle, inode, path)))
+                return err;
+        path->p_hdr->eh_entries = cpu_to_le16(le16_to_cpu(path->p_hdr->eh_entries)-1);
+        if ((err = ext4_ext_dirty(handle, inode, path)))
+                return err;
+        ext_debug("index is empty, remove it, free block %llu\n", leaf);
+        bh = sb_find_get_block(inode->i_sb, leaf);
+        ext4_forget(handle, 1, inode, bh, leaf);
+        ext4_free_blocks(handle, inode, leaf, 1);
+        return err;
+}
+
+/*
+ * ext4_ext_calc_credits_for_insert:
+ * This routine returns max. credits that the extent tree can consume.
+ * It should be OK for low-performance paths like ->writepage()
+ * To allow many writing processes to fit into a single transaction,
+ * the caller should calculate credits under truncate_mutex and
+ * pass the actual path.
+ */
+int inline ext4_ext_calc_credits_for_insert(struct inode *inode,
+                                                struct ext4_ext_path *path)
+{
+        int depth, needed;
+
+        if (path) {
+                /* probably there is space in leaf? */
+                depth = ext_depth(inode);
+                if (le16_to_cpu(path[depth].p_hdr->eh_entries)
+                                < le16_to_cpu(path[depth].p_hdr->eh_max))
+                        return 1;
+        }
+
+        /*
+         * given 32-bit logical block (4294967296 blocks), max. tree
+         * can be 4 levels in depth -- 4 * 340^4 == 53453440000.
+         * Let's also add one more level for imbalance.
+         */
+        depth = 5;
+
+        /* allocation of new data block(s) */
+        needed = 2;
+
+        /*
+         * tree can be full, so it would need to grow in depth:
+         * allocation + old root + new root
+         */
+        needed += 2 + 1 + 1;
+
+        /*
+         * Index split can happen, we would need:
+         *    allocate intermediate indexes (bitmap + group)
+         *  + change two blocks at each level, but root (already included)
+         */
+        needed = (depth * 2) + (depth * 2);
+
+        /* any allocation modifies superblock */
+        needed += 1;
+
+        return needed;
+}
+
+static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
+                                struct ext4_extent *ex,
+                                unsigned long from, unsigned long to)
+{
+        struct buffer_head *bh;
+        int i;
+
+#ifdef EXTENTS_STATS
+        {
+                struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+                unsigned short ee_len =  le16_to_cpu(ex->ee_len);
+                spin_lock(&sbi->s_ext_stats_lock);
+                sbi->s_ext_blocks += ee_len;
+                sbi->s_ext_extents++;
+                if (ee_len < sbi->s_ext_min)
+                        sbi->s_ext_min = ee_len;
+                if (ee_len > sbi->s_ext_max)
+                        sbi->s_ext_max = ee_len;
+                if (ext_depth(inode) > sbi->s_depth_max)
+                        sbi->s_depth_max = ext_depth(inode);
+                spin_unlock(&sbi->s_ext_stats_lock);
+        }
+#endif
+        if (from >= le32_to_cpu(ex->ee_block)
+            && to == le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len) - 1) {
+                /* tail removal */
+                unsigned long num;
+                ext4_fsblk_t start;
+                num = le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len) - from;
+                start = ext_pblock(ex) + le16_to_cpu(ex->ee_len) - num;
+                ext_debug("free last %lu blocks starting %llu\n", num, start);
+                for (i = 0; i < num; i++) {
+                        bh = sb_find_get_block(inode->i_sb, start + i);
+                        ext4_forget(handle, 0, inode, bh, start + i);
+                }
+                ext4_free_blocks(handle, inode, start, num);
+        } else if (from == le32_to_cpu(ex->ee_block)
+                   && to <= le32_to_cpu(ex->ee_block) + le16_to_cpu(ex->ee_len) - 1) {
+                printk("strange request: removal %lu-%lu from %u:%u\n",
+                       from, to, le32_to_cpu(ex->ee_block), le16_to_cpu(ex->ee_len));
+        } else {
+                printk("strange request: removal(2) %lu-%lu from %u:%u\n",
+                       from, to, le32_to_cpu(ex->ee_block), le16_to_cpu(ex->ee_len));
+        }
+        return 0;
+}
+
+static int
+ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
+                struct ext4_ext_path *path, unsigned long start)
+{
+        int err = 0, correct_index = 0;
+        int depth = ext_depth(inode), credits;
+        struct ext4_extent_header *eh;
+        unsigned a, b, block, num;
+        unsigned long ex_ee_block;
+        unsigned short ex_ee_len;
+        struct ext4_extent *ex;
+
+        ext_debug("truncate since %lu in leaf\n", start);
+        if (!path[depth].p_hdr)
+                path[depth].p_hdr = ext_block_hdr(path[depth].p_bh);
+        eh = path[depth].p_hdr;
+        BUG_ON(eh == NULL);
+        BUG_ON(le16_to_cpu(eh->eh_entries) > le16_to_cpu(eh->eh_max));
+        BUG_ON(eh->eh_magic != EXT4_EXT_MAGIC);
+
+        /* find where to start removing */
+        ex = EXT_LAST_EXTENT(eh);
+
+        ex_ee_block = le32_to_cpu(ex->ee_block);
+        ex_ee_len = le16_to_cpu(ex->ee_len);
+
+        while (ex >= EXT_FIRST_EXTENT(eh) &&
+                        ex_ee_block + ex_ee_len > start) {
+                ext_debug("remove ext %lu:%u\n", ex_ee_block, ex_ee_len);
+                path[depth].p_ext = ex;
+
+                a = ex_ee_block > start ? ex_ee_block : start;
+                b = ex_ee_block + ex_ee_len - 1 < EXT_MAX_BLOCK ?
+                        ex_ee_block + ex_ee_len - 1 : EXT_MAX_BLOCK;
+
+                ext_debug("  border %u:%u\n", a, b);
+
+                if (a != ex_ee_block && b != ex_ee_block + ex_ee_len - 1) {
+                        block = 0;
+                        num = 0;
+                        BUG();
+                } else if (a != ex_ee_block) {
+                        /* remove tail of the extent */
+                        block = ex_ee_block;
+                        num = a - block;
+                } else if (b != ex_ee_block + ex_ee_len - 1) {
+                        /* remove head of the extent */
+                        block = a;
+                        num = b - a;
+                        /* there is no "make a hole" API yet */
+                        BUG();
+                } else {
+                        /* remove whole extent: excellent! */
+                        block = ex_ee_block;
+                        num = 0;
+                        BUG_ON(a != ex_ee_block);
+                        BUG_ON(b != ex_ee_block + ex_ee_len - 1);
+                }
+
+                /* at present, extent can't cross block group: */
+                /* leaf + bitmap + group desc + sb + inode */
+                credits = 5;
+                if (ex == EXT_FIRST_EXTENT(eh)) {
+                        correct_index = 1;
+                        credits += (ext_depth(inode)) + 1;
+                }
+#ifdef CONFIG_QUOTA
+                credits += 2 * EXT4_QUOTA_TRANS_BLOCKS(inode->i_sb);
+#endif
+
+                handle = ext4_ext_journal_restart(handle, credits);
+                if (IS_ERR(handle)) {
+                        err = PTR_ERR(handle);
+                        goto out;
+                }
+
+                err = ext4_ext_get_access(handle, inode, path + depth);
+                if (err)
+                        goto out;
+
+                err = ext4_remove_blocks(handle, inode, ex, a, b);
+                if (err)
+                        goto out;
+
+                if (num == 0) {
+                        /* this extent is removed; mark slot entirely unused */
+                        ext4_ext_store_pblock(ex, 0);
+                        eh->eh_entries = cpu_to_le16(le16_to_cpu(eh->eh_entries)-1);
+                }
+
+                ex->ee_block = cpu_to_le32(block);
+                ex->ee_len = cpu_to_le16(num);
+
+                err = ext4_ext_dirty(handle, inode, path + depth);
+                if (err)
+                        goto out;
+
+                ext_debug("new extent: %u:%u:%llu\n", block, num,
+                                ext_pblock(ex));
+                ex--;
+                ex_ee_block = le32_to_cpu(ex->ee_block);
+                ex_ee_len = le16_to_cpu(ex->ee_len);
+        }
+
+        if (correct_index && eh->eh_entries)
+                err = ext4_ext_correct_indexes(handle, inode, path);
+
+        /* if this leaf is free, then we should
+         * remove it from index block above */
+        if (err == 0 && eh->eh_entries == 0 && path[depth].p_bh != NULL)
+                err = ext4_ext_rm_idx(handle, inode, path + depth);
+
+out:
+        return err;
+}
+
+/*
+ * ext4_ext_more_to_rm:
+ * returns 1 if current index has to be freed (even partial)
+ */
+static int inline
+ext4_ext_more_to_rm(struct ext4_ext_path *path)
+{
+        BUG_ON(path->p_idx == NULL);
+
+        if (path->p_idx < EXT_FIRST_INDEX(path->p_hdr))
+                return 0;
+
+        /*
+         * if truncate on deeper level happened, it wasn't partial,
+         * so we have to consider current index for truncation
+         */
+        if (le16_to_cpu(path->p_hdr->eh_entries) == path->p_block)
+                return 0;
+        return 1;
+}
+
+int ext4_ext_remove_space(struct inode *inode, unsigned long start)
+{
+        struct super_block *sb = inode->i_sb;
+        int depth = ext_depth(inode);
+        struct ext4_ext_path *path;
+        handle_t *handle;
+        int i = 0, err = 0;
+
+        ext_debug("truncate since %lu\n", start);
+
+        /* probably first extent we're gonna free will be last in block */
+        handle = ext4_journal_start(inode, depth + 1);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        ext4_ext_invalidate_cache(inode);
+
+        /*
+         * We start scanning from right side, freeing all the blocks
+         * after i_size and walking into the tree depth-wise.
+         */
+        path = kmalloc(sizeof(struct ext4_ext_path) * (depth + 1), GFP_KERNEL);
+        if (path == NULL) {
+                ext4_journal_stop(handle);
+                return -ENOMEM;
+        }
+        memset(path, 0, sizeof(struct ext4_ext_path) * (depth + 1));
+        path[0].p_hdr = ext_inode_hdr(inode);
+        if (ext4_ext_check_header(__FUNCTION__, inode, path[0].p_hdr)) {
+                err = -EIO;
+                goto out;
+        }
+        path[0].p_depth = depth;
+
+        while (i >= 0 && err == 0) {
+                if (i == depth) {
+                        /* this is leaf block */
+                        err = ext4_ext_rm_leaf(handle, inode, path, start);
+                        /* root level has p_bh == NULL, brelse() eats this */
+                        brelse(path[i].p_bh);
+                        path[i].p_bh = NULL;
+                        i--;
+                        continue;
+                }
+
+                /* this is index block */
+                if (!path[i].p_hdr) {
+                        ext_debug("initialize header\n");
+                        path[i].p_hdr = ext_block_hdr(path[i].p_bh);
+                        if (ext4_ext_check_header(__FUNCTION__, inode,
+                                                        path[i].p_hdr)) {
+                                err = -EIO;
+                                goto out;
+                        }
+                }
+
+                BUG_ON(le16_to_cpu(path[i].p_hdr->eh_entries)
+                           > le16_to_cpu(path[i].p_hdr->eh_max));
+                BUG_ON(path[i].p_hdr->eh_magic != EXT4_EXT_MAGIC);
+
+                if (!path[i].p_idx) {
+                        /* this level hasn't been touched yet */
+                        path[i].p_idx = EXT_LAST_INDEX(path[i].p_hdr);
+                        path[i].p_block = le16_to_cpu(path[i].p_hdr->eh_entries)+1;
+                        ext_debug("init index ptr: hdr 0x%p, num %d\n",
+                                  path[i].p_hdr,
+                                  le16_to_cpu(path[i].p_hdr->eh_entries));
+                } else {
+                        /* we were already here, see at next index */
+                        path[i].p_idx--;
+                }
+
+                ext_debug("level %d - index, first 0x%p, cur 0x%p\n",
+                                i, EXT_FIRST_INDEX(path[i].p_hdr),
+                                path[i].p_idx);
+                if (ext4_ext_more_to_rm(path + i)) {
+                        /* go to the next level */
+                        ext_debug("move to level %d (block %llu)\n",
+                                  i + 1, idx_pblock(path[i].p_idx));
+                        memset(path + i + 1, 0, sizeof(*path));
+                        path[i+1].p_bh =
+                                sb_bread(sb, idx_pblock(path[i].p_idx));
+                        if (!path[i+1].p_bh) {
+                                /* should we reset i_size? */
+                                err = -EIO;
+                                break;
+                        }
+
+                        /* save actual number of indexes since this
+                         * number is changed at the next iteration */
+                        path[i].p_block = le16_to_cpu(path[i].p_hdr->eh_entries);
+                        i++;
+                } else {
+                        /* we finished processing this index, go up */
+                        if (path[i].p_hdr->eh_entries == 0 && i > 0) {
+                                /* index is empty, remove it;
+                                 * handle must be already prepared by the
+                                 * truncatei_leaf() */
+                                err = ext4_ext_rm_idx(handle, inode, path + i);
+                        }
+                        /* root level has p_bh == NULL, brelse() eats this */
+                        brelse(path[i].p_bh);
+                        path[i].p_bh = NULL;
+                        i--;
+                        ext_debug("return to level %d\n", i);
+                }
+        }
+
+        /* TODO: flexible tree reduction should be here */
+        if (path->p_hdr->eh_entries == 0) {
+                /*
+                 * truncate to zero freed all the tree,
+                 * so we need to correct eh_depth
+                 */
+                err = ext4_ext_get_access(handle, inode, path);
+                if (err == 0) {
+                        ext_inode_hdr(inode)->eh_depth = 0;
+                        ext_inode_hdr(inode)->eh_max =
+                                cpu_to_le16(ext4_ext_space_root(inode));
+                        err = ext4_ext_dirty(handle, inode, path);
+                }
+        }
+out:
+        ext4_ext_tree_changed(inode);
+        ext4_ext_drop_refs(path);
+        kfree(path);
+        ext4_journal_stop(handle);
+
+        return err;
+}
+
+/*
+ * called at mount time
+ */
+void ext4_ext_init(struct super_block *sb)
+{
+        /*
+         * possible initialization would be here
+         */
+
+        if (test_opt(sb, EXTENTS)) {
+                printk("EXT4-fs: file extents enabled");
+#ifdef AGRESSIVE_TEST
+                printk(", agressive tests");
+#endif
+#ifdef CHECK_BINSEARCH
+                printk(", check binsearch");
+#endif
+#ifdef EXTENTS_STATS
+                printk(", stats");
+#endif
+                printk("\n");
+#ifdef EXTENTS_STATS
+                spin_lock_init(&EXT4_SB(sb)->s_ext_stats_lock);
+                EXT4_SB(sb)->s_ext_min = 1 << 30;
+                EXT4_SB(sb)->s_ext_max = 0;
+#endif
+        }
+}
+
+/*
+ * called at umount time
+ */
+void ext4_ext_release(struct super_block *sb)
+{
+        if (!test_opt(sb, EXTENTS))
+                return;
+
+#ifdef EXTENTS_STATS
+        if (EXT4_SB(sb)->s_ext_blocks && EXT4_SB(sb)->s_ext_extents) {
+                struct ext4_sb_info *sbi = EXT4_SB(sb);
+                printk(KERN_ERR "EXT4-fs: %lu blocks in %lu extents (%lu ave)\n",
+                        sbi->s_ext_blocks, sbi->s_ext_extents,
+                        sbi->s_ext_blocks / sbi->s_ext_extents);
+                printk(KERN_ERR "EXT4-fs: extents: %lu min, %lu max, max depth %lu\n",
+                        sbi->s_ext_min, sbi->s_ext_max, sbi->s_depth_max);
+        }
+#endif
+}
+
+int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t iblock,
+                        unsigned long max_blocks, struct buffer_head *bh_result,
+                        int create, int extend_disksize)
+{
+        struct ext4_ext_path *path = NULL;
+        struct ext4_extent newex, *ex;
+        ext4_fsblk_t goal, newblock;
+        int err = 0, depth;
+        unsigned long allocated = 0;
+
+        __clear_bit(BH_New, &bh_result->b_state);
+        ext_debug("blocks %d/%lu requested for inode %u\n", (int) iblock,
+                        max_blocks, (unsigned) inode->i_ino);
+        mutex_lock(&EXT4_I(inode)->truncate_mutex);
+
+        /* check in cache */
+        if ((goal = ext4_ext_in_cache(inode, iblock, &newex))) {
+                if (goal == EXT4_EXT_CACHE_GAP) {
+                        if (!create) {
+                                /* block isn't allocated yet and
+                                 * user doesn't want to allocate it */
+                                goto out2;
+                        }
+                        /* we should allocate requested block */
+                } else if (goal == EXT4_EXT_CACHE_EXTENT) {
+                        /* block is already allocated */
+                        newblock = iblock
+                                   - le32_to_cpu(newex.ee_block)
+                                   + ext_pblock(&newex);
+                        /* number of remaining blocks in the extent */
+                        allocated = le16_to_cpu(newex.ee_len) -
+                                        (iblock - le32_to_cpu(newex.ee_block));
+                        goto out;
+                } else {
+                        BUG();
+                }
+        }
+
+        /* find extent for this block */
+        path = ext4_ext_find_extent(inode, iblock, NULL);
+        if (IS_ERR(path)) {
+                err = PTR_ERR(path);
+                path = NULL;
+                goto out2;
+        }
+
+        depth = ext_depth(inode);
+
+        /*
+         * consistent leaf must not be empty;
+         * this situation is possible, though, _during_ tree modification;
+         * this is why assert can't be put in ext4_ext_find_extent()
+         */
+        BUG_ON(path[depth].p_ext == NULL && depth != 0);
+
+        if ((ex = path[depth].p_ext)) {
+                unsigned long ee_block = le32_to_cpu(ex->ee_block);
+                ext4_fsblk_t ee_start = ext_pblock(ex);
+                unsigned short ee_len  = le16_to_cpu(ex->ee_len);
+
+                /*
+                 * Allow future support for preallocated extents to be added
+                 * as an RO_COMPAT feature:
+                 * Uninitialized extents are treated as holes, except that
+                 * we avoid (fail) allocating new blocks during a write.
+                 */
+                if (ee_len > EXT_MAX_LEN)
+                        goto out2;
+                /* if found extent covers block, simply return it */
+                if (iblock >= ee_block && iblock < ee_block + ee_len) {
+                        newblock = iblock - ee_block + ee_start;
+                        /* number of remaining blocks in the extent */
+                        allocated = ee_len - (iblock - ee_block);
+                        ext_debug("%d fit into %lu:%d -> %llu\n", (int) iblock,
+                                        ee_block, ee_len, newblock);
+                        ext4_ext_put_in_cache(inode, ee_block, ee_len,
+                                                ee_start, EXT4_EXT_CACHE_EXTENT);
+                        goto out;
+                }
+        }
+
+        /*
+         * requested block isn't allocated yet;
+         * we couldn't try to create block if create flag is zero
+         */
+        if (!create) {
+                /* put just found gap into cache to speed up
+                 * subsequent requests */
+                ext4_ext_put_gap_in_cache(inode, path, iblock);
+                goto out2;
+        }
+        /*
+         * Okay, we need to do block allocation.  Lazily initialize the block
+         * allocation info here if necessary.
+         */
+        if (S_ISREG(inode->i_mode) && (!EXT4_I(inode)->i_block_alloc_info))
+                ext4_init_block_alloc_info(inode);
+
+        /* allocate new block */
+        goal = ext4_ext_find_goal(inode, path, iblock);
+        allocated = max_blocks;
+        newblock = ext4_new_blocks(handle, inode, goal, &allocated, &err);
+        if (!newblock)
+                goto out2;
+        ext_debug("allocate new block: goal %llu, found %llu/%lu\n",
+                        goal, newblock, allocated);
+
+        /* try to insert new extent into found leaf and return */
+        newex.ee_block = cpu_to_le32(iblock);
+        ext4_ext_store_pblock(&newex, newblock);
+        newex.ee_len = cpu_to_le16(allocated);
+        err = ext4_ext_insert_extent(handle, inode, path, &newex);
+        if (err)
+                goto out2;
+
+        if (extend_disksize && inode->i_size > EXT4_I(inode)->i_disksize)
+                EXT4_I(inode)->i_disksize = inode->i_size;
+
+        /* previous routine could use block we allocated */
+        newblock = ext_pblock(&newex);
+        __set_bit(BH_New, &bh_result->b_state);
+
+        ext4_ext_put_in_cache(inode, iblock, allocated, newblock,
+                                EXT4_EXT_CACHE_EXTENT);
+out:
+        if (allocated > max_blocks)
+                allocated = max_blocks;
+        ext4_ext_show_leaf(inode, path);
+        __set_bit(BH_Mapped, &bh_result->b_state);
+        bh_result->b_bdev = inode->i_sb->s_bdev;
+        bh_result->b_blocknr = newblock;
+out2:
+        if (path) {
+                ext4_ext_drop_refs(path);
+                kfree(path);
+        }
+        mutex_unlock(&EXT4_I(inode)->truncate_mutex);
+
+        return err ? err : allocated;
+}
+
+void ext4_ext_truncate(struct inode * inode, struct page *page)
+{
+        struct address_space *mapping = inode->i_mapping;
+        struct super_block *sb = inode->i_sb;
+        unsigned long last_block;
+        handle_t *handle;
+        int err = 0;
+
+        /*
+         * probably first extent we're gonna free will be last in block
+         */
+        err = ext4_writepage_trans_blocks(inode) + 3;
+        handle = ext4_journal_start(inode, err);
+        if (IS_ERR(handle)) {
+                if (page) {
+                        clear_highpage(page);
+                        flush_dcache_page(page);
+                        unlock_page(page);
+                        page_cache_release(page);
+                }
+                return;
+        }
+
+        if (page)
+                ext4_block_truncate_page(handle, page, mapping, inode->i_size);
+
+        mutex_lock(&EXT4_I(inode)->truncate_mutex);
+        ext4_ext_invalidate_cache(inode);
+
+        /*
+         * TODO: optimization is possible here.
+         * Probably we need not scan at all,
+         * because page truncation is enough.
+         */
+        if (ext4_orphan_add(handle, inode))
+                goto out_stop;
+
+        /* we have to know where to truncate from in crash case */
+        EXT4_I(inode)->i_disksize = inode->i_size;
+        ext4_mark_inode_dirty(handle, inode);
+
+        last_block = (inode->i_size + sb->s_blocksize - 1)
+                        >> EXT4_BLOCK_SIZE_BITS(sb);
+        err = ext4_ext_remove_space(inode, last_block);
+
+        /* In a multi-transaction truncate, we only make the final
+         * transaction synchronous. */
+        if (IS_SYNC(inode))
+                handle->h_sync = 1;
+
+out_stop:
+        /*
+         * If this was a simple ftruncate() and the file will remain alive,
+         * then we need to clear up the orphan record which we created above.
+         * However, if this was a real unlink then we were called by
+         * ext4_delete_inode(), and we allow that function to clean up the
+         * orphan info for us.
+         */
+        if (inode->i_nlink)
+                ext4_orphan_del(handle, inode);
+
+        mutex_unlock(&EXT4_I(inode)->truncate_mutex);
+        ext4_journal_stop(handle);
+}
+
+/*
+ * ext4_ext_writepage_trans_blocks:
+ * calculate max number of blocks we could modify
+ * in order to allocate new block for an inode
+ */
+int ext4_ext_writepage_trans_blocks(struct inode *inode, int num)
+{
+        int needed;
+
+        needed = ext4_ext_calc_credits_for_insert(inode, NULL);
+
+        /* caller wants to allocate num blocks, but note it includes sb */
+        needed = needed * num - (num - 1);
+
+#ifdef CONFIG_QUOTA
+        needed += 2 * EXT4_QUOTA_TRANS_BLOCKS(inode->i_sb);
+#endif
+
+        return needed;
+}
+
+EXPORT_SYMBOL(ext4_mark_inode_dirty);
+EXPORT_SYMBOL(ext4_ext_invalidate_cache);
+EXPORT_SYMBOL(ext4_ext_insert_extent);
+EXPORT_SYMBOL(ext4_ext_walk_space);
+EXPORT_SYMBOL(ext4_ext_find_goal);
+EXPORT_SYMBOL(ext4_ext_calc_credits_for_insert);
+
diff --git a/fs/ext4/file.c b/fs/ext4/file.c
new file mode 100644
index 000000000000..0b622c0624b7
--- /dev/null
+++ b/fs/ext4/file.c
@@ -0,0 +1,139 @@
+/*
+ *  linux/fs/ext4/file.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/file.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  ext4 fs regular file handling primitives
+ *
+ *  64-bit file support on 64-bit platforms by Jakub Jelinek
+ *      (jj@sunsite.ms.mff.cuni.cz)
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include "xattr.h"
+#include "acl.h"
+
+/*
+ * Called when an inode is released. Note that this is different
+ * from ext4_file_open: open gets called at every open, but release
+ * gets called only when /all/ the files are closed.
+ */
+static int ext4_release_file (struct inode * inode, struct file * filp)
+{
+        /* if we are the last writer on the inode, drop the block reservation */
+        if ((filp->f_mode & FMODE_WRITE) &&
+                        (atomic_read(&inode->i_writecount) == 1))
+        {
+                mutex_lock(&EXT4_I(inode)->truncate_mutex);
+                ext4_discard_reservation(inode);
+                mutex_unlock(&EXT4_I(inode)->truncate_mutex);
+        }
+        if (is_dx(inode) && filp->private_data)
+                ext4_htree_free_dir_info(filp->private_data);
+
+        return 0;
+}
+
+static ssize_t
+ext4_file_write(struct kiocb *iocb, const struct iovec *iov,
+                unsigned long nr_segs, loff_t pos)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_dentry->d_inode;
+        ssize_t ret;
+        int err;
+
+        ret = generic_file_aio_write(iocb, iov, nr_segs, pos);
+
+        /*
+         * Skip flushing if there was an error, or if nothing was written.
+         */
+        if (ret <= 0)
+                return ret;
+
+        /*
+         * If the inode is IS_SYNC, or is O_SYNC and we are doing data
+         * journalling then we need to make sure that we force the transaction
+         * to disk to keep all metadata uptodate synchronously.
+         */
+        if (file->f_flags & O_SYNC) {
+                /*
+                 * If we are non-data-journaled, then the dirty data has
+                 * already been flushed to backing store by generic_osync_inode,
+                 * and the inode has been flushed too if there have been any
+                 * modifications other than mere timestamp updates.
+                 *
+                 * Open question --- do we care about flushing timestamps too
+                 * if the inode is IS_SYNC?
+                 */
+                if (!ext4_should_journal_data(inode))
+                        return ret;
+
+                goto force_commit;
+        }
+
+        /*
+         * So we know that there has been no forced data flush.  If the inode
+         * is marked IS_SYNC, we need to force one ourselves.
+         */
+        if (!IS_SYNC(inode))
+                return ret;
+
+        /*
+         * Open question #2 --- should we force data to disk here too?  If we
+         * don't, the only impact is that data=writeback filesystems won't
+         * flush data to disk automatically on IS_SYNC, only metadata (but
+         * historically, that is what ext2 has done.)
+         */
+
+force_commit:
+        err = ext4_force_commit(inode->i_sb);
+        if (err)
+                return err;
+        return ret;
+}
+
+const struct file_operations ext4_file_operations = {
+        .llseek         = generic_file_llseek,
+        .read           = do_sync_read,
+        .write          = do_sync_write,
+        .aio_read       = generic_file_aio_read,
+        .aio_write      = ext4_file_write,
+        .ioctl          = ext4_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = ext4_compat_ioctl,
+#endif
+        .mmap           = generic_file_mmap,
+        .open           = generic_file_open,
+        .release        = ext4_release_file,
+        .fsync          = ext4_sync_file,
+        .sendfile       = generic_file_sendfile,
+        .splice_read    = generic_file_splice_read,
+        .splice_write   = generic_file_splice_write,
+};
+
+struct inode_operations ext4_file_inode_operations = {
+        .truncate       = ext4_truncate,
+        .setattr        = ext4_setattr,
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
+        .listxattr      = ext4_listxattr,
+        .removexattr    = generic_removexattr,
+#endif
+        .permission     = ext4_permission,
+};
+
diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
new file mode 100644
index 000000000000..2a167d7131fa
--- /dev/null
+++ b/fs/ext4/fsync.c
@@ -0,0 +1,88 @@
+/*
+ *  linux/fs/ext4/fsync.c
+ *
+ *  Copyright (C) 1993  Stephen Tweedie (sct@redhat.com)
+ *  from
+ *  Copyright (C) 1992  Remy Card (card@masi.ibp.fr)
+ *                      Laboratoire MASI - Institut Blaise Pascal
+ *                      Universite Pierre et Marie Curie (Paris VI)
+ *  from
+ *  linux/fs/minix/truncate.c   Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  ext4fs fsync primitive
+ *
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ *
+ *  Removed unnecessary code duplication for little endian machines
+ *  and excessive __inline__s.
+ *        Andi Kleen, 1997
+ *
+ * Major simplications and cleanup - we only need to do the metadata, because
+ * we can depend on generic_block_fdatasync() to sync the data blocks.
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/writeback.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+
+/*
+ * akpm: A new design for ext4_sync_file().
+ *
+ * This is only called from sys_fsync(), sys_fdatasync() and sys_msync().
+ * There cannot be a transaction open by this task.
+ * Another task could have dirtied this inode.  Its data can be in any
+ * state in the journalling system.
+ *
+ * What we do is just kick off a commit and wait on it.  This will snapshot the
+ * inode to disk.
+ */
+
+int ext4_sync_file(struct file * file, struct dentry *dentry, int datasync)
+{
+        struct inode *inode = dentry->d_inode;
+        int ret = 0;
+
+        J_ASSERT(ext4_journal_current_handle() == 0);
+
+        /*
+         * data=writeback:
+         *  The caller's filemap_fdatawrite()/wait will sync the data.
+         *  sync_inode() will sync the metadata
+         *
+         * data=ordered:
+         *  The caller's filemap_fdatawrite() will write the data and
+         *  sync_inode() will write the inode if it is dirty.  Then the caller's
+         *  filemap_fdatawait() will wait on the pages.
+         *
+         * data=journal:
+         *  filemap_fdatawrite won't do anything (the buffers are clean).
+         *  ext4_force_commit will write the file data into the journal and
+         *  will wait on that.
+         *  filemap_fdatawait() will encounter a ton of newly-dirtied pages
+         *  (they were dirtied by commit).  But that's OK - the blocks are
+         *  safe in-journal, which is all fsync() needs to ensure.
+         */
+        if (ext4_should_journal_data(inode)) {
+                ret = ext4_force_commit(inode->i_sb);
+                goto out;
+        }
+
+        /*
+         * The VFS has written the file data.  If the inode is unaltered
+         * then we need not start a commit.
+         */
+        if (inode->i_state & (I_DIRTY_SYNC|I_DIRTY_DATASYNC)) {
+                struct writeback_control wbc = {
+                        .sync_mode = WB_SYNC_ALL,
+                        .nr_to_write = 0, /* sys_fsync did this */
+                };
+                ret = sync_inode(inode, &wbc);
+        }
+out:
+        return ret;
+}
diff --git a/fs/ext4/hash.c b/fs/ext4/hash.c
new file mode 100644
index 000000000000..a67966385e06
--- /dev/null
+++ b/fs/ext4/hash.c
@@ -0,0 +1,152 @@
+/*
+ *  linux/fs/ext4/hash.c
+ *
+ * Copyright (C) 2002 by Theodore Ts'o
+ *
+ * This file is released under the GPL v2.
+ *
+ * This file may be redistributed under the terms of the GNU Public
+ * License.
+ */
+
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/sched.h>
+#include <linux/ext4_fs.h>
+#include <linux/cryptohash.h>
+
+#define DELTA 0x9E3779B9
+
+static void TEA_transform(__u32 buf[4], __u32 const in[])
+{
+        __u32   sum = 0;
+        __u32   b0 = buf[0], b1 = buf[1];
+        __u32   a = in[0], b = in[1], c = in[2], d = in[3];
+        int     n = 16;
+
+        do {
+                sum += DELTA;
+                b0 += ((b1 << 4)+a) ^ (b1+sum) ^ ((b1 >> 5)+b);
+                b1 += ((b0 << 4)+c) ^ (b0+sum) ^ ((b0 >> 5)+d);
+        } while(--n);
+
+        buf[0] += b0;
+        buf[1] += b1;
+}
+
+
+/* The old legacy hash */
+static __u32 dx_hack_hash (const char *name, int len)
+{
+        __u32 hash0 = 0x12a3fe2d, hash1 = 0x37abe8f9;
+        while (len--) {
+                __u32 hash = hash1 + (hash0 ^ (*name++ * 7152373));
+
+                if (hash & 0x80000000) hash -= 0x7fffffff;
+                hash1 = hash0;
+                hash0 = hash;
+        }
+        return (hash0 << 1);
+}
+
+static void str2hashbuf(const char *msg, int len, __u32 *buf, int num)
+{
+        __u32   pad, val;
+        int     i;
+
+        pad = (__u32)len | ((__u32)len << 8);
+        pad |= pad << 16;
+
+        val = pad;
+        if (len > num*4)
+                len = num * 4;
+        for (i=0; i < len; i++) {
+                if ((i % 4) == 0)
+                        val = pad;
+                val = msg[i] + (val << 8);
+                if ((i % 4) == 3) {
+                        *buf++ = val;
+                        val = pad;
+                        num--;
+                }
+        }
+        if (--num >= 0)
+                *buf++ = val;
+        while (--num >= 0)
+                *buf++ = pad;
+}
+
+/*
+ * Returns the hash of a filename.  If len is 0 and name is NULL, then
+ * this function can be used to test whether or not a hash version is
+ * supported.
+ *
+ * The seed is an 4 longword (32 bits) "secret" which can be used to
+ * uniquify a hash.  If the seed is all zero's, then some default seed
+ * may be used.
+ *
+ * A particular hash version specifies whether or not the seed is
+ * represented, and whether or not the returned hash is 32 bits or 64
+ * bits.  32 bit hashes will return 0 for the minor hash.
+ */
+int ext4fs_dirhash(const char *name, int len, struct dx_hash_info *hinfo)
+{
+        __u32   hash;
+        __u32   minor_hash = 0;
+        const char      *p;
+        int             i;
+        __u32           in[8], buf[4];
+
+        /* Initialize the default seed for the hash checksum functions */
+        buf[0] = 0x67452301;
+        buf[1] = 0xefcdab89;
+        buf[2] = 0x98badcfe;
+        buf[3] = 0x10325476;
+
+        /* Check to see if the seed is all zero's */
+        if (hinfo->seed) {
+                for (i=0; i < 4; i++) {
+                        if (hinfo->seed[i])
+                                break;
+                }
+                if (i < 4)
+                        memcpy(buf, hinfo->seed, sizeof(buf));
+        }
+
+        switch (hinfo->hash_version) {
+        case DX_HASH_LEGACY:
+                hash = dx_hack_hash(name, len);
+                break;
+        case DX_HASH_HALF_MD4:
+                p = name;
+                while (len > 0) {
+                        str2hashbuf(p, len, in, 8);
+                        half_md4_transform(buf, in);
+                        len -= 32;
+                        p += 32;
+                }
+                minor_hash = buf[2];
+                hash = buf[1];
+                break;
+        case DX_HASH_TEA:
+                p = name;
+                while (len > 0) {
+                        str2hashbuf(p, len, in, 4);
+                        TEA_transform(buf, in);
+                        len -= 16;
+                        p += 16;
+                }
+                hash = buf[0];
+                minor_hash = buf[1];
+                break;
+        default:
+                hinfo->hash = 0;
+                return -1;
+        }
+        hash = hash & ~1;
+        if (hash == (EXT4_HTREE_EOF << 1))
+                hash = (EXT4_HTREE_EOF-1) << 1;
+        hinfo->hash = hash;
+        hinfo->minor_hash = minor_hash;
+        return 0;
+}
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
new file mode 100644
index 000000000000..c88b439ba5cd
--- /dev/null
+++ b/fs/ext4/ialloc.c
@@ -0,0 +1,772 @@
+/*
+ *  linux/fs/ext4/ialloc.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  BSD ufs-inspired inode and directory allocation by
+ *  Stephen Tweedie (sct@redhat.com), 1993
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/stat.h>
+#include <linux/string.h>
+#include <linux/quotaops.h>
+#include <linux/buffer_head.h>
+#include <linux/random.h>
+#include <linux/bitops.h>
+#include <linux/blkdev.h>
+#include <asm/byteorder.h>
+
+#include "xattr.h"
+#include "acl.h"
+
+/*
+ * ialloc.c contains the inodes allocation and deallocation routines
+ */
+
+/*
+ * The free inodes are managed by bitmaps.  A file system contains several
+ * blocks groups.  Each group contains 1 bitmap block for blocks, 1 bitmap
+ * block for inodes, N blocks for the inode table and data blocks.
+ *
+ * The file system contains group descriptors which are located after the
+ * super block.  Each descriptor contains the number of the bitmap block and
+ * the free blocks count in the block.
+ */
+
+
+/*
+ * Read the inode allocation bitmap for a given block_group, reading
+ * into the specified slot in the superblock's bitmap cache.
+ *
+ * Return buffer_head of bitmap on success or NULL.
+ */
+static struct buffer_head *
+read_inode_bitmap(struct super_block * sb, unsigned long block_group)
+{
+        struct ext4_group_desc *desc;
+        struct buffer_head *bh = NULL;
+
+        desc = ext4_get_group_desc(sb, block_group, NULL);
+        if (!desc)
+                goto error_out;
+
+        bh = sb_bread(sb, ext4_inode_bitmap(sb, desc));
+        if (!bh)
+                ext4_error(sb, "read_inode_bitmap",
+                            "Cannot read inode bitmap - "
+                            "block_group = %lu, inode_bitmap = %llu",
+                            block_group, ext4_inode_bitmap(sb, desc));
+error_out:
+        return bh;
+}
+
+/*
+ * NOTE! When we get the inode, we're the only people
+ * that have access to it, and as such there are no
+ * race conditions we have to worry about. The inode
+ * is not on the hash-lists, and it cannot be reached
+ * through the filesystem because the directory entry
+ * has been deleted earlier.
+ *
+ * HOWEVER: we must make sure that we get no aliases,
+ * which means that we have to call "clear_inode()"
+ * _before_ we mark the inode not in use in the inode
+ * bitmaps. Otherwise a newly created file might use
+ * the same inode number (not actually the same pointer
+ * though), and then we'd have two inodes sharing the
+ * same inode number and space on the harddisk.
+ */
+void ext4_free_inode (handle_t *handle, struct inode * inode)
+{
+        struct super_block * sb = inode->i_sb;
+        int is_directory;
+        unsigned long ino;
+        struct buffer_head *bitmap_bh = NULL;
+        struct buffer_head *bh2;
+        unsigned long block_group;
+        unsigned long bit;
+        struct ext4_group_desc * gdp;
+        struct ext4_super_block * es;
+        struct ext4_sb_info *sbi;
+        int fatal = 0, err;
+
+        if (atomic_read(&inode->i_count) > 1) {
+                printk ("ext4_free_inode: inode has count=%d\n",
+                                        atomic_read(&inode->i_count));
+                return;
+        }
+        if (inode->i_nlink) {
+                printk ("ext4_free_inode: inode has nlink=%d\n",
+                        inode->i_nlink);
+                return;
+        }
+        if (!sb) {
+                printk("ext4_free_inode: inode on nonexistent device\n");
+                return;
+        }
+        sbi = EXT4_SB(sb);
+
+        ino = inode->i_ino;
+        ext4_debug ("freeing inode %lu\n", ino);
+
+        /*
+         * Note: we must free any quota before locking the superblock,
+         * as writing the quota to disk may need the lock as well.
+         */
+        DQUOT_INIT(inode);
+        ext4_xattr_delete_inode(handle, inode);
+        DQUOT_FREE_INODE(inode);
+        DQUOT_DROP(inode);
+
+        is_directory = S_ISDIR(inode->i_mode);
+
+        /* Do this BEFORE marking the inode not in use or returning an error */
+        clear_inode (inode);
+
+        es = EXT4_SB(sb)->s_es;
+        if (ino < EXT4_FIRST_INO(sb) || ino > le32_to_cpu(es->s_inodes_count)) {
+                ext4_error (sb, "ext4_free_inode",
+                            "reserved or nonexistent inode %lu", ino);
+                goto error_return;
+        }
+        block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
+        bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
+        bitmap_bh = read_inode_bitmap(sb, block_group);
+        if (!bitmap_bh)
+                goto error_return;
+
+        BUFFER_TRACE(bitmap_bh, "get_write_access");
+        fatal = ext4_journal_get_write_access(handle, bitmap_bh);
+        if (fatal)
+                goto error_return;
+
+        /* Ok, now we can actually update the inode bitmaps.. */
+        if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
+                                        bit, bitmap_bh->b_data))
+                ext4_error (sb, "ext4_free_inode",
+                              "bit already cleared for inode %lu", ino);
+        else {
+                gdp = ext4_get_group_desc (sb, block_group, &bh2);
+
+                BUFFER_TRACE(bh2, "get_write_access");
+                fatal = ext4_journal_get_write_access(handle, bh2);
+                if (fatal) goto error_return;
+
+                if (gdp) {
+                        spin_lock(sb_bgl_lock(sbi, block_group));
+                        gdp->bg_free_inodes_count = cpu_to_le16(
+                                le16_to_cpu(gdp->bg_free_inodes_count) + 1);
+                        if (is_directory)
+                                gdp->bg_used_dirs_count = cpu_to_le16(
+                                  le16_to_cpu(gdp->bg_used_dirs_count) - 1);
+                        spin_unlock(sb_bgl_lock(sbi, block_group));
+                        percpu_counter_inc(&sbi->s_freeinodes_counter);
+                        if (is_directory)
+                                percpu_counter_dec(&sbi->s_dirs_counter);
+
+                }
+                BUFFER_TRACE(bh2, "call ext4_journal_dirty_metadata");
+                err = ext4_journal_dirty_metadata(handle, bh2);
+                if (!fatal) fatal = err;
+        }
+        BUFFER_TRACE(bitmap_bh, "call ext4_journal_dirty_metadata");
+        err = ext4_journal_dirty_metadata(handle, bitmap_bh);
+        if (!fatal)
+                fatal = err;
+        sb->s_dirt = 1;
+error_return:
+        brelse(bitmap_bh);
+        ext4_std_error(sb, fatal);
+}
+
+/*
+ * There are two policies for allocating an inode.  If the new inode is
+ * a directory, then a forward search is made for a block group with both
+ * free space and a low directory-to-inode ratio; if that fails, then of
+ * the groups with above-average free space, that group with the fewest
+ * directories already is chosen.
+ *
+ * For other inodes, search forward from the parent directory\'s block
+ * group to find a free inode.
+ */
+static int find_group_dir(struct super_block *sb, struct inode *parent)
+{
+        int ngroups = EXT4_SB(sb)->s_groups_count;
+        unsigned int freei, avefreei;
+        struct ext4_group_desc *desc, *best_desc = NULL;
+        struct buffer_head *bh;
+        int group, best_group = -1;
+
+        freei = percpu_counter_read_positive(&EXT4_SB(sb)->s_freeinodes_counter);
+        avefreei = freei / ngroups;
+
+        for (group = 0; group < ngroups; group++) {
+                desc = ext4_get_group_desc (sb, group, &bh);
+                if (!desc || !desc->bg_free_inodes_count)
+                        continue;
+                if (le16_to_cpu(desc->bg_free_inodes_count) < avefreei)
+                        continue;
+                if (!best_desc ||
+                    (le16_to_cpu(desc->bg_free_blocks_count) >
+                     le16_to_cpu(best_desc->bg_free_blocks_count))) {
+                        best_group = group;
+                        best_desc = desc;
+                }
+        }
+        return best_group;
+}
+
+/*
+ * Orlov's allocator for directories.
+ *
+ * We always try to spread first-level directories.
+ *
+ * If there are blockgroups with both free inodes and free blocks counts
+ * not worse than average we return one with smallest directory count.
+ * Otherwise we simply return a random group.
+ *
+ * For the rest rules look so:
+ *
+ * It's OK to put directory into a group unless
+ * it has too many directories already (max_dirs) or
+ * it has too few free inodes left (min_inodes) or
+ * it has too few free blocks left (min_blocks) or
+ * it's already running too large debt (max_debt).
+ * Parent's group is prefered, if it doesn't satisfy these
+ * conditions we search cyclically through the rest. If none
+ * of the groups look good we just look for a group with more
+ * free inodes than average (starting at parent's group).
+ *
+ * Debt is incremented each time we allocate a directory and decremented
+ * when we allocate an inode, within 0--255.
+ */
+
+#define INODE_COST 64
+#define BLOCK_COST 256
+
+static int find_group_orlov(struct super_block *sb, struct inode *parent)
+{
+        int parent_group = EXT4_I(parent)->i_block_group;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        struct ext4_super_block *es = sbi->s_es;
+        int ngroups = sbi->s_groups_count;
+        int inodes_per_group = EXT4_INODES_PER_GROUP(sb);
+        unsigned int freei, avefreei;
+        ext4_fsblk_t freeb, avefreeb;
+        ext4_fsblk_t blocks_per_dir;
+        unsigned int ndirs;
+        int max_debt, max_dirs, min_inodes;
+        ext4_grpblk_t min_blocks;
+        int group = -1, i;
+        struct ext4_group_desc *desc;
+        struct buffer_head *bh;
+
+        freei = percpu_counter_read_positive(&sbi->s_freeinodes_counter);
+        avefreei = freei / ngroups;
+        freeb = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
+        avefreeb = freeb;
+        do_div(avefreeb, ngroups);
+        ndirs = percpu_counter_read_positive(&sbi->s_dirs_counter);
+
+        if ((parent == sb->s_root->d_inode) ||
+            (EXT4_I(parent)->i_flags & EXT4_TOPDIR_FL)) {
+                int best_ndir = inodes_per_group;
+                int best_group = -1;
+
+                get_random_bytes(&group, sizeof(group));
+                parent_group = (unsigned)group % ngroups;
+                for (i = 0; i < ngroups; i++) {
+                        group = (parent_group + i) % ngroups;
+                        desc = ext4_get_group_desc (sb, group, &bh);
+                        if (!desc || !desc->bg_free_inodes_count)
+                                continue;
+                        if (le16_to_cpu(desc->bg_used_dirs_count) >= best_ndir)
+                                continue;
+                        if (le16_to_cpu(desc->bg_free_inodes_count) < avefreei)
+                                continue;
+                        if (le16_to_cpu(desc->bg_free_blocks_count) < avefreeb)
+                                continue;
+                        best_group = group;
+                        best_ndir = le16_to_cpu(desc->bg_used_dirs_count);
+                }
+                if (best_group >= 0)
+                        return best_group;
+                goto fallback;
+        }
+
+        blocks_per_dir = ext4_blocks_count(es) - freeb;
+        do_div(blocks_per_dir, ndirs);
+
+        max_dirs = ndirs / ngroups + inodes_per_group / 16;
+        min_inodes = avefreei - inodes_per_group / 4;
+        min_blocks = avefreeb - EXT4_BLOCKS_PER_GROUP(sb) / 4;
+
+        max_debt = EXT4_BLOCKS_PER_GROUP(sb);
+        max_debt /= max_t(int, blocks_per_dir, BLOCK_COST);
+        if (max_debt * INODE_COST > inodes_per_group)
+                max_debt = inodes_per_group / INODE_COST;
+        if (max_debt > 255)
+                max_debt = 255;
+        if (max_debt == 0)
+                max_debt = 1;
+
+        for (i = 0; i < ngroups; i++) {
+                group = (parent_group + i) % ngroups;
+                desc = ext4_get_group_desc (sb, group, &bh);
+                if (!desc || !desc->bg_free_inodes_count)
+                        continue;
+                if (le16_to_cpu(desc->bg_used_dirs_count) >= max_dirs)
+                        continue;
+                if (le16_to_cpu(desc->bg_free_inodes_count) < min_inodes)
+                        continue;
+                if (le16_to_cpu(desc->bg_free_blocks_count) < min_blocks)
+                        continue;
+                return group;
+        }
+
+fallback:
+        for (i = 0; i < ngroups; i++) {
+                group = (parent_group + i) % ngroups;
+                desc = ext4_get_group_desc (sb, group, &bh);
+                if (!desc || !desc->bg_free_inodes_count)
+                        continue;
+                if (le16_to_cpu(desc->bg_free_inodes_count) >= avefreei)
+                        return group;
+        }
+
+        if (avefreei) {
+                /*
+                 * The free-inodes counter is approximate, and for really small
+                 * filesystems the above test can fail to find any blockgroups
+                 */
+                avefreei = 0;
+                goto fallback;
+        }
+
+        return -1;
+}
+
+static int find_group_other(struct super_block *sb, struct inode *parent)
+{
+        int parent_group = EXT4_I(parent)->i_block_group;
+        int ngroups = EXT4_SB(sb)->s_groups_count;
+        struct ext4_group_desc *desc;
+        struct buffer_head *bh;
+        int group, i;
+
+        /*
+         * Try to place the inode in its parent directory
+         */
+        group = parent_group;
+        desc = ext4_get_group_desc (sb, group, &bh);
+        if (desc && le16_to_cpu(desc->bg_free_inodes_count) &&
+                        le16_to_cpu(desc->bg_free_blocks_count))
+                return group;
+
+        /*
+         * We're going to place this inode in a different blockgroup from its
+         * parent.  We want to cause files in a common directory to all land in
+         * the same blockgroup.  But we want files which are in a different
+         * directory which shares a blockgroup with our parent to land in a
+         * different blockgroup.
+         *
+         * So add our directory's i_ino into the starting point for the hash.
+         */
+        group = (group + parent->i_ino) % ngroups;
+
+        /*
+         * Use a quadratic hash to find a group with a free inode and some free
+         * blocks.
+         */
+        for (i = 1; i < ngroups; i <<= 1) {
+                group += i;
+                if (group >= ngroups)
+                        group -= ngroups;
+                desc = ext4_get_group_desc (sb, group, &bh);
+                if (desc && le16_to_cpu(desc->bg_free_inodes_count) &&
+                                le16_to_cpu(desc->bg_free_blocks_count))
+                        return group;
+        }
+
+        /*
+         * That failed: try linear search for a free inode, even if that group
+         * has no free blocks.
+         */
+        group = parent_group;
+        for (i = 0; i < ngroups; i++) {
+                if (++group >= ngroups)
+                        group = 0;
+                desc = ext4_get_group_desc (sb, group, &bh);
+                if (desc && le16_to_cpu(desc->bg_free_inodes_count))
+                        return group;
+        }
+
+        return -1;
+}
+
+/*
+ * There are two policies for allocating an inode.  If the new inode is
+ * a directory, then a forward search is made for a block group with both
+ * free space and a low directory-to-inode ratio; if that fails, then of
+ * the groups with above-average free space, that group with the fewest
+ * directories already is chosen.
+ *
+ * For other inodes, search forward from the parent directory's block
+ * group to find a free inode.
+ */
+struct inode *ext4_new_inode(handle_t *handle, struct inode * dir, int mode)
+{
+        struct super_block *sb;
+        struct buffer_head *bitmap_bh = NULL;
+        struct buffer_head *bh2;
+        int group;
+        unsigned long ino = 0;
+        struct inode * inode;
+        struct ext4_group_desc * gdp = NULL;
+        struct ext4_super_block * es;
+        struct ext4_inode_info *ei;
+        struct ext4_sb_info *sbi;
+        int err = 0;
+        struct inode *ret;
+        int i;
+
+        /* Cannot create files in a deleted directory */
+        if (!dir || !dir->i_nlink)
+                return ERR_PTR(-EPERM);
+
+        sb = dir->i_sb;
+        inode = new_inode(sb);
+        if (!inode)
+                return ERR_PTR(-ENOMEM);
+        ei = EXT4_I(inode);
+
+        sbi = EXT4_SB(sb);
+        es = sbi->s_es;
+        if (S_ISDIR(mode)) {
+                if (test_opt (sb, OLDALLOC))
+                        group = find_group_dir(sb, dir);
+                else
+                        group = find_group_orlov(sb, dir);
+        } else
+                group = find_group_other(sb, dir);
+
+        err = -ENOSPC;
+        if (group == -1)
+                goto out;
+
+        for (i = 0; i < sbi->s_groups_count; i++) {
+                err = -EIO;
+
+                gdp = ext4_get_group_desc(sb, group, &bh2);
+                if (!gdp)
+                        goto fail;
+
+                brelse(bitmap_bh);
+                bitmap_bh = read_inode_bitmap(sb, group);
+                if (!bitmap_bh)
+                        goto fail;
+
+                ino = 0;
+
+repeat_in_this_group:
+                ino = ext4_find_next_zero_bit((unsigned long *)
+                                bitmap_bh->b_data, EXT4_INODES_PER_GROUP(sb), ino);
+                if (ino < EXT4_INODES_PER_GROUP(sb)) {
+
+                        BUFFER_TRACE(bitmap_bh, "get_write_access");
+                        err = ext4_journal_get_write_access(handle, bitmap_bh);
+                        if (err)
+                                goto fail;
+
+                        if (!ext4_set_bit_atomic(sb_bgl_lock(sbi, group),
+                                                ino, bitmap_bh->b_data)) {
+                                /* we won it */
+                                BUFFER_TRACE(bitmap_bh,
+                                        "call ext4_journal_dirty_metadata");
+                                err = ext4_journal_dirty_metadata(handle,
+                                                                bitmap_bh);
+                                if (err)
+                                        goto fail;
+                                goto got;
+                        }
+                        /* we lost it */
+                        jbd2_journal_release_buffer(handle, bitmap_bh);
+
+                        if (++ino < EXT4_INODES_PER_GROUP(sb))
+                                goto repeat_in_this_group;
+                }
+
+                /*
+                 * This case is possible in concurrent environment.  It is very
+                 * rare.  We cannot repeat the find_group_xxx() call because
+                 * that will simply return the same blockgroup, because the
+                 * group descriptor metadata has not yet been updated.
+                 * So we just go onto the next blockgroup.
+                 */
+                if (++group == sbi->s_groups_count)
+                        group = 0;
+        }
+        err = -ENOSPC;
+        goto out;
+
+got:
+        ino += group * EXT4_INODES_PER_GROUP(sb) + 1;
+        if (ino < EXT4_FIRST_INO(sb) || ino > le32_to_cpu(es->s_inodes_count)) {
+                ext4_error (sb, "ext4_new_inode",
+                            "reserved inode or inode > inodes count - "
+                            "block_group = %d, inode=%lu", group, ino);
+                err = -EIO;
+                goto fail;
+        }
+
+        BUFFER_TRACE(bh2, "get_write_access");
+        err = ext4_journal_get_write_access(handle, bh2);
+        if (err) goto fail;
+        spin_lock(sb_bgl_lock(sbi, group));
+        gdp->bg_free_inodes_count =
+                cpu_to_le16(le16_to_cpu(gdp->bg_free_inodes_count) - 1);
+        if (S_ISDIR(mode)) {
+                gdp->bg_used_dirs_count =
+                        cpu_to_le16(le16_to_cpu(gdp->bg_used_dirs_count) + 1);
+        }
+        spin_unlock(sb_bgl_lock(sbi, group));
+        BUFFER_TRACE(bh2, "call ext4_journal_dirty_metadata");
+        err = ext4_journal_dirty_metadata(handle, bh2);
+        if (err) goto fail;
+
+        percpu_counter_dec(&sbi->s_freeinodes_counter);
+        if (S_ISDIR(mode))
+                percpu_counter_inc(&sbi->s_dirs_counter);
+        sb->s_dirt = 1;
+
+        inode->i_uid = current->fsuid;
+        if (test_opt (sb, GRPID))
+                inode->i_gid = dir->i_gid;
+        else if (dir->i_mode & S_ISGID) {
+                inode->i_gid = dir->i_gid;
+                if (S_ISDIR(mode))
+                        mode |= S_ISGID;
+        } else
+                inode->i_gid = current->fsgid;
+        inode->i_mode = mode;
+
+        inode->i_ino = ino;
+        /* This is the optimal IO size (for stat), not the fs block size */
+        inode->i_blocks = 0;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME_SEC;
+
+        memset(ei->i_data, 0, sizeof(ei->i_data));
+        ei->i_dir_start_lookup = 0;
+        ei->i_disksize = 0;
+
+        ei->i_flags = EXT4_I(dir)->i_flags & ~EXT4_INDEX_FL;
+        if (S_ISLNK(mode))
+                ei->i_flags &= ~(EXT4_IMMUTABLE_FL|EXT4_APPEND_FL);
+        /* dirsync only applies to directories */
+        if (!S_ISDIR(mode))
+                ei->i_flags &= ~EXT4_DIRSYNC_FL;
+#ifdef EXT4_FRAGMENTS
+        ei->i_faddr = 0;
+        ei->i_frag_no = 0;
+        ei->i_frag_size = 0;
+#endif
+        ei->i_file_acl = 0;
+        ei->i_dir_acl = 0;
+        ei->i_dtime = 0;
+        ei->i_block_alloc_info = NULL;
+        ei->i_block_group = group;
+
+        ext4_set_inode_flags(inode);
+        if (IS_DIRSYNC(inode))
+                handle->h_sync = 1;
+        insert_inode_hash(inode);
+        spin_lock(&sbi->s_next_gen_lock);
+        inode->i_generation = sbi->s_next_generation++;
+        spin_unlock(&sbi->s_next_gen_lock);
+
+        ei->i_state = EXT4_STATE_NEW;
+        ei->i_extra_isize =
+                (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) ?
+                sizeof(struct ext4_inode) - EXT4_GOOD_OLD_INODE_SIZE : 0;
+
+        ret = inode;
+        if(DQUOT_ALLOC_INODE(inode)) {
+                err = -EDQUOT;
+                goto fail_drop;
+        }
+
+        err = ext4_init_acl(handle, inode, dir);
+        if (err)
+                goto fail_free_drop;
+
+        err = ext4_init_security(handle,inode, dir);
+        if (err)
+                goto fail_free_drop;
+
+        err = ext4_mark_inode_dirty(handle, inode);
+        if (err) {
+                ext4_std_error(sb, err);
+                goto fail_free_drop;
+        }
+        if (test_opt(sb, EXTENTS)) {
+                EXT4_I(inode)->i_flags |= EXT4_EXTENTS_FL;
+                ext4_ext_tree_init(handle, inode);
+                if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS)) {
+                        err = ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh);
+                        if (err) goto fail;
+                        EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS);
+                        BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "call ext4_journal_dirty_metadata");
+                        err = ext4_journal_dirty_metadata(handle, EXT4_SB(sb)->s_sbh);
+                }
+        }
+
+        ext4_debug("allocating inode %lu\n", inode->i_ino);
+        goto really_out;
+fail:
+        ext4_std_error(sb, err);
+out:
+        iput(inode);
+        ret = ERR_PTR(err);
+really_out:
+        brelse(bitmap_bh);
+        return ret;
+
+fail_free_drop:
+        DQUOT_FREE_INODE(inode);
+
+fail_drop:
+        DQUOT_DROP(inode);
+        inode->i_flags |= S_NOQUOTA;
+        inode->i_nlink = 0;
+        iput(inode);
+        brelse(bitmap_bh);
+        return ERR_PTR(err);
+}
+
+/* Verify that we are loading a valid orphan from disk */
+struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino)
+{
+        unsigned long max_ino = le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count);
+        unsigned long block_group;
+        int bit;
+        struct buffer_head *bitmap_bh = NULL;
+        struct inode *inode = NULL;
+
+        /* Error cases - e2fsck has already cleaned up for us */
+        if (ino > max_ino) {
+                ext4_warning(sb, __FUNCTION__,
+                             "bad orphan ino %lu!  e2fsck was run?", ino);
+                goto out;
+        }
+
+        block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
+        bit = (ino - 1) % EXT4_INODES_PER_GROUP(sb);
+        bitmap_bh = read_inode_bitmap(sb, block_group);
+        if (!bitmap_bh) {
+                ext4_warning(sb, __FUNCTION__,
+                             "inode bitmap error for orphan %lu", ino);
+                goto out;
+        }
+
+        /* Having the inode bit set should be a 100% indicator that this
+         * is a valid orphan (no e2fsck run on fs).  Orphans also include
+         * inodes that were being truncated, so we can't check i_nlink==0.
+         */
+        if (!ext4_test_bit(bit, bitmap_bh->b_data) ||
+                        !(inode = iget(sb, ino)) || is_bad_inode(inode) ||
+                        NEXT_ORPHAN(inode) > max_ino) {
+                ext4_warning(sb, __FUNCTION__,
+                             "bad orphan inode %lu!  e2fsck was run?", ino);
+                printk(KERN_NOTICE "ext4_test_bit(bit=%d, block=%llu) = %d\n",
+                       bit, (unsigned long long)bitmap_bh->b_blocknr,
+                       ext4_test_bit(bit, bitmap_bh->b_data));
+                printk(KERN_NOTICE "inode=%p\n", inode);
+                if (inode) {
+                        printk(KERN_NOTICE "is_bad_inode(inode)=%d\n",
+                               is_bad_inode(inode));
+                        printk(KERN_NOTICE "NEXT_ORPHAN(inode)=%u\n",
+                               NEXT_ORPHAN(inode));
+                        printk(KERN_NOTICE "max_ino=%lu\n", max_ino);
+                }
+                /* Avoid freeing blocks if we got a bad deleted inode */
+                if (inode && inode->i_nlink == 0)
+                        inode->i_blocks = 0;
+                iput(inode);
+                inode = NULL;
+        }
+out:
+        brelse(bitmap_bh);
+        return inode;
+}
+
+unsigned long ext4_count_free_inodes (struct super_block * sb)
+{
+        unsigned long desc_count;
+        struct ext4_group_desc *gdp;
+        int i;
+#ifdef EXT4FS_DEBUG
+        struct ext4_super_block *es;
+        unsigned long bitmap_count, x;
+        struct buffer_head *bitmap_bh = NULL;
+
+        es = EXT4_SB(sb)->s_es;
+        desc_count = 0;
+        bitmap_count = 0;
+        gdp = NULL;
+        for (i = 0; i < EXT4_SB(sb)->s_groups_count; i++) {
+                gdp = ext4_get_group_desc (sb, i, NULL);
+                if (!gdp)
+                        continue;
+                desc_count += le16_to_cpu(gdp->bg_free_inodes_count);
+                brelse(bitmap_bh);
+                bitmap_bh = read_inode_bitmap(sb, i);
+                if (!bitmap_bh)
+                        continue;
+
+                x = ext4_count_free(bitmap_bh, EXT4_INODES_PER_GROUP(sb) / 8);
+                printk("group %d: stored = %d, counted = %lu\n",
+                        i, le16_to_cpu(gdp->bg_free_inodes_count), x);
+                bitmap_count += x;
+        }
+        brelse(bitmap_bh);
+        printk("ext4_count_free_inodes: stored = %u, computed = %lu, %lu\n",
+                le32_to_cpu(es->s_free_inodes_count), desc_count, bitmap_count);
+        return desc_count;
+#else
+        desc_count = 0;
+        for (i = 0; i < EXT4_SB(sb)->s_groups_count; i++) {
+                gdp = ext4_get_group_desc (sb, i, NULL);
+                if (!gdp)
+                        continue;
+                desc_count += le16_to_cpu(gdp->bg_free_inodes_count);
+                cond_resched();
+        }
+        return desc_count;
+#endif
+}
+
+/* Called at mount-time, super-block is locked */
+unsigned long ext4_count_dirs (struct super_block * sb)
+{
+        unsigned long count = 0;
+        int i;
+
+        for (i = 0; i < EXT4_SB(sb)->s_groups_count; i++) {
+                struct ext4_group_desc *gdp = ext4_get_group_desc (sb, i, NULL);
+                if (!gdp)
+                        continue;
+                count += le16_to_cpu(gdp->bg_used_dirs_count);
+        }
+        return count;
+}
+
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
new file mode 100644
index 000000000000..0a60ec5a16db
--- /dev/null
+++ b/fs/ext4/inode.c
@@ -0,0 +1,3233 @@
+/*
+ *  linux/fs/ext4/inode.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/inode.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  Goal-directed block allocation by Stephen Tweedie
+ *      (sct@redhat.com), 1993, 1998
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ *  64-bit file support on 64-bit platforms by Jakub Jelinek
+ *      (jj@sunsite.ms.mff.cuni.cz)
+ *
+ *  Assorted race fixes, rewrite of ext4_get_block() by Al Viro, 2000
+ */
+
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/jbd2.h>
+#include <linux/smp_lock.h>
+#include <linux/highuid.h>
+#include <linux/pagemap.h>
+#include <linux/quotaops.h>
+#include <linux/string.h>
+#include <linux/buffer_head.h>
+#include <linux/writeback.h>
+#include <linux/mpage.h>
+#include <linux/uio.h>
+#include <linux/bio.h>
+#include "xattr.h"
+#include "acl.h"
+
+/*
+ * Test whether an inode is a fast symlink.
+ */
+static int ext4_inode_is_fast_symlink(struct inode *inode)
+{
+        int ea_blocks = EXT4_I(inode)->i_file_acl ?
+                (inode->i_sb->s_blocksize >> 9) : 0;
+
+        return (S_ISLNK(inode->i_mode) && inode->i_blocks - ea_blocks == 0);
+}
+
+/*
+ * The ext4 forget function must perform a revoke if we are freeing data
+ * which has been journaled.  Metadata (eg. indirect blocks) must be
+ * revoked in all cases.
+ *
+ * "bh" may be NULL: a metadata block may have been freed from memory
+ * but there may still be a record of it in the journal, and that record
+ * still needs to be revoked.
+ */
+int ext4_forget(handle_t *handle, int is_metadata, struct inode *inode,
+                        struct buffer_head *bh, ext4_fsblk_t blocknr)
+{
+        int err;
+
+        might_sleep();
+
+        BUFFER_TRACE(bh, "enter");
+
+        jbd_debug(4, "forgetting bh %p: is_metadata = %d, mode %o, "
+                  "data mode %lx\n",
+                  bh, is_metadata, inode->i_mode,
+                  test_opt(inode->i_sb, DATA_FLAGS));
+
+        /* Never use the revoke function if we are doing full data
+         * journaling: there is no need to, and a V1 superblock won't
+         * support it.  Otherwise, only skip the revoke on un-journaled
+         * data blocks. */
+
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA ||
+            (!is_metadata && !ext4_should_journal_data(inode))) {
+                if (bh) {
+                        BUFFER_TRACE(bh, "call jbd2_journal_forget");
+                        return ext4_journal_forget(handle, bh);
+                }
+                return 0;
+        }
+
+        /*
+         * data!=journal && (is_metadata || should_journal_data(inode))
+         */
+        BUFFER_TRACE(bh, "call ext4_journal_revoke");
+        err = ext4_journal_revoke(handle, blocknr, bh);
+        if (err)
+                ext4_abort(inode->i_sb, __FUNCTION__,
+                           "error %d when attempting revoke", err);
+        BUFFER_TRACE(bh, "exit");
+        return err;
+}
+
+/*
+ * Work out how many blocks we need to proceed with the next chunk of a
+ * truncate transaction.
+ */
+static unsigned long blocks_for_truncate(struct inode *inode)
+{
+        unsigned long needed;
+
+        needed = inode->i_blocks >> (inode->i_sb->s_blocksize_bits - 9);
+
+        /* Give ourselves just enough room to cope with inodes in which
+         * i_blocks is corrupt: we've seen disk corruptions in the past
+         * which resulted in random data in an inode which looked enough
+         * like a regular file for ext4 to try to delete it.  Things
+         * will go a bit crazy if that happens, but at least we should
+         * try not to panic the whole kernel. */
+        if (needed < 2)
+                needed = 2;
+
+        /* But we need to bound the transaction so we don't overflow the
+         * journal. */
+        if (needed > EXT4_MAX_TRANS_DATA)
+                needed = EXT4_MAX_TRANS_DATA;
+
+        return EXT4_DATA_TRANS_BLOCKS(inode->i_sb) + needed;
+}
+
+/*
+ * Truncate transactions can be complex and absolutely huge.  So we need to
+ * be able to restart the transaction at a conventient checkpoint to make
+ * sure we don't overflow the journal.
+ *
+ * start_transaction gets us a new handle for a truncate transaction,
+ * and extend_transaction tries to extend the existing one a bit.  If
+ * extend fails, we need to propagate the failure up and restart the
+ * transaction in the top-level truncate loop. --sct
+ */
+static handle_t *start_transaction(struct inode *inode)
+{
+        handle_t *result;
+
+        result = ext4_journal_start(inode, blocks_for_truncate(inode));
+        if (!IS_ERR(result))
+                return result;
+
+        ext4_std_error(inode->i_sb, PTR_ERR(result));
+        return result;
+}
+
+/*
+ * Try to extend this transaction for the purposes of truncation.
+ *
+ * Returns 0 if we managed to create more room.  If we can't create more
+ * room, and the transaction must be restarted we return 1.
+ */
+static int try_to_extend_transaction(handle_t *handle, struct inode *inode)
+{
+        if (handle->h_buffer_credits > EXT4_RESERVE_TRANS_BLOCKS)
+                return 0;
+        if (!ext4_journal_extend(handle, blocks_for_truncate(inode)))
+                return 0;
+        return 1;
+}
+
+/*
+ * Restart the transaction associated with *handle.  This does a commit,
+ * so before we call here everything must be consistently dirtied against
+ * this transaction.
+ */
+static int ext4_journal_test_restart(handle_t *handle, struct inode *inode)
+{
+        jbd_debug(2, "restarting handle %p\n", handle);
+        return ext4_journal_restart(handle, blocks_for_truncate(inode));
+}
+
+/*
+ * Called at the last iput() if i_nlink is zero.
+ */
+void ext4_delete_inode (struct inode * inode)
+{
+        handle_t *handle;
+
+        truncate_inode_pages(&inode->i_data, 0);
+
+        if (is_bad_inode(inode))
+                goto no_delete;
+
+        handle = start_transaction(inode);
+        if (IS_ERR(handle)) {
+                /*
+                 * If we're going to skip the normal cleanup, we still need to
+                 * make sure that the in-core orphan linked list is properly
+                 * cleaned up.
+                 */
+                ext4_orphan_del(NULL, inode);
+                goto no_delete;
+        }
+
+        if (IS_SYNC(inode))
+                handle->h_sync = 1;
+        inode->i_size = 0;
+        if (inode->i_blocks)
+                ext4_truncate(inode);
+        /*
+         * Kill off the orphan record which ext4_truncate created.
+         * AKPM: I think this can be inside the above `if'.
+         * Note that ext4_orphan_del() has to be able to cope with the
+         * deletion of a non-existent orphan - this is because we don't
+         * know if ext4_truncate() actually created an orphan record.
+         * (Well, we could do this if we need to, but heck - it works)
+         */
+        ext4_orphan_del(handle, inode);
+        EXT4_I(inode)->i_dtime  = get_seconds();
+
+        /*
+         * One subtle ordering requirement: if anything has gone wrong
+         * (transaction abort, IO errors, whatever), then we can still
+         * do these next steps (the fs will already have been marked as
+         * having errors), but we can't free the inode if the mark_dirty
+         * fails.
+         */
+        if (ext4_mark_inode_dirty(handle, inode))
+                /* If that failed, just do the required in-core inode clear. */
+                clear_inode(inode);
+        else
+                ext4_free_inode(handle, inode);
+        ext4_journal_stop(handle);
+        return;
+no_delete:
+        clear_inode(inode);     /* We must guarantee clearing of inode... */
+}
+
+typedef struct {
+        __le32  *p;
+        __le32  key;
+        struct buffer_head *bh;
+} Indirect;
+
+static inline void add_chain(Indirect *p, struct buffer_head *bh, __le32 *v)
+{
+        p->key = *(p->p = v);
+        p->bh = bh;
+}
+
+static int verify_chain(Indirect *from, Indirect *to)
+{
+        while (from <= to && from->key == *from->p)
+                from++;
+        return (from > to);
+}
+
+/**
+ *      ext4_block_to_path - parse the block number into array of offsets
+ *      @inode: inode in question (we are only interested in its superblock)
+ *      @i_block: block number to be parsed
+ *      @offsets: array to store the offsets in
+ *      @boundary: set this non-zero if the referred-to block is likely to be
+ *             followed (on disk) by an indirect block.
+ *
+ *      To store the locations of file's data ext4 uses a data structure common
+ *      for UNIX filesystems - tree of pointers anchored in the inode, with
+ *      data blocks at leaves and indirect blocks in intermediate nodes.
+ *      This function translates the block number into path in that tree -
+ *      return value is the path length and @offsets[n] is the offset of
+ *      pointer to (n+1)th node in the nth one. If @block is out of range
+ *      (negative or too large) warning is printed and zero returned.
+ *
+ *      Note: function doesn't find node addresses, so no IO is needed. All
+ *      we need to know is the capacity of indirect blocks (taken from the
+ *      inode->i_sb).
+ */
+
+/*
+ * Portability note: the last comparison (check that we fit into triple
+ * indirect block) is spelled differently, because otherwise on an
+ * architecture with 32-bit longs and 8Kb pages we might get into trouble
+ * if our filesystem had 8Kb blocks. We might use long long, but that would
+ * kill us on x86. Oh, well, at least the sign propagation does not matter -
+ * i_block would have to be negative in the very beginning, so we would not
+ * get there at all.
+ */
+
+static int ext4_block_to_path(struct inode *inode,
+                        long i_block, int offsets[4], int *boundary)
+{
+        int ptrs = EXT4_ADDR_PER_BLOCK(inode->i_sb);
+        int ptrs_bits = EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb);
+        const long direct_blocks = EXT4_NDIR_BLOCKS,
+                indirect_blocks = ptrs,
+                double_blocks = (1 << (ptrs_bits * 2));
+        int n = 0;
+        int final = 0;
+
+        if (i_block < 0) {
+                ext4_warning (inode->i_sb, "ext4_block_to_path", "block < 0");
+        } else if (i_block < direct_blocks) {
+                offsets[n++] = i_block;
+                final = direct_blocks;
+        } else if ( (i_block -= direct_blocks) < indirect_blocks) {
+                offsets[n++] = EXT4_IND_BLOCK;
+                offsets[n++] = i_block;
+                final = ptrs;
+        } else if ((i_block -= indirect_blocks) < double_blocks) {
+                offsets[n++] = EXT4_DIND_BLOCK;
+                offsets[n++] = i_block >> ptrs_bits;
+                offsets[n++] = i_block & (ptrs - 1);
+                final = ptrs;
+        } else if (((i_block -= double_blocks) >> (ptrs_bits * 2)) < ptrs) {
+                offsets[n++] = EXT4_TIND_BLOCK;
+                offsets[n++] = i_block >> (ptrs_bits * 2);
+                offsets[n++] = (i_block >> ptrs_bits) & (ptrs - 1);
+                offsets[n++] = i_block & (ptrs - 1);
+                final = ptrs;
+        } else {
+                ext4_warning(inode->i_sb, "ext4_block_to_path", "block > big");
+        }
+        if (boundary)
+                *boundary = final - 1 - (i_block & (ptrs - 1));
+        return n;
+}
+
+/**
+ *      ext4_get_branch - read the chain of indirect blocks leading to data
+ *      @inode: inode in question
+ *      @depth: depth of the chain (1 - direct pointer, etc.)
+ *      @offsets: offsets of pointers in inode/indirect blocks
+ *      @chain: place to store the result
+ *      @err: here we store the error value
+ *
+ *      Function fills the array of triples <key, p, bh> and returns %NULL
+ *      if everything went OK or the pointer to the last filled triple
+ *      (incomplete one) otherwise. Upon the return chain[i].key contains
+ *      the number of (i+1)-th block in the chain (as it is stored in memory,
+ *      i.e. little-endian 32-bit), chain[i].p contains the address of that
+ *      number (it points into struct inode for i==0 and into the bh->b_data
+ *      for i>0) and chain[i].bh points to the buffer_head of i-th indirect
+ *      block for i>0 and NULL for i==0. In other words, it holds the block
+ *      numbers of the chain, addresses they were taken from (and where we can
+ *      verify that chain did not change) and buffer_heads hosting these
+ *      numbers.
+ *
+ *      Function stops when it stumbles upon zero pointer (absent block)
+ *              (pointer to last triple returned, *@err == 0)
+ *      or when it gets an IO error reading an indirect block
+ *              (ditto, *@err == -EIO)
+ *      or when it notices that chain had been changed while it was reading
+ *              (ditto, *@err == -EAGAIN)
+ *      or when it reads all @depth-1 indirect blocks successfully and finds
+ *      the whole chain, all way to the data (returns %NULL, *err == 0).
+ */
+static Indirect *ext4_get_branch(struct inode *inode, int depth, int *offsets,
+                                 Indirect chain[4], int *err)
+{
+        struct super_block *sb = inode->i_sb;
+        Indirect *p = chain;
+        struct buffer_head *bh;
+
+        *err = 0;
+        /* i_data is not going away, no lock needed */
+        add_chain (chain, NULL, EXT4_I(inode)->i_data + *offsets);
+        if (!p->key)
+                goto no_block;
+        while (--depth) {
+                bh = sb_bread(sb, le32_to_cpu(p->key));
+                if (!bh)
+                        goto failure;
+                /* Reader: pointers */
+                if (!verify_chain(chain, p))
+                        goto changed;
+                add_chain(++p, bh, (__le32*)bh->b_data + *++offsets);
+                /* Reader: end */
+                if (!p->key)
+                        goto no_block;
+        }
+        return NULL;
+
+changed:
+        brelse(bh);
+        *err = -EAGAIN;
+        goto no_block;
+failure:
+        *err = -EIO;
+no_block:
+        return p;
+}
+
+/**
+ *      ext4_find_near - find a place for allocation with sufficient locality
+ *      @inode: owner
+ *      @ind: descriptor of indirect block.
+ *
+ *      This function returns the prefered place for block allocation.
+ *      It is used when heuristic for sequential allocation fails.
+ *      Rules are:
+ *        + if there is a block to the left of our position - allocate near it.
+ *        + if pointer will live in indirect block - allocate near that block.
+ *        + if pointer will live in inode - allocate in the same
+ *          cylinder group.
+ *
+ * In the latter case we colour the starting block by the callers PID to
+ * prevent it from clashing with concurrent allocations for a different inode
+ * in the same block group.   The PID is used here so that functionally related
+ * files will be close-by on-disk.
+ *
+ *      Caller must make sure that @ind is valid and will stay that way.
+ */
+static ext4_fsblk_t ext4_find_near(struct inode *inode, Indirect *ind)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        __le32 *start = ind->bh ? (__le32*) ind->bh->b_data : ei->i_data;
+        __le32 *p;
+        ext4_fsblk_t bg_start;
+        ext4_grpblk_t colour;
+
+        /* Try to find previous block */
+        for (p = ind->p - 1; p >= start; p--) {
+                if (*p)
+                        return le32_to_cpu(*p);
+        }
+
+        /* No such thing, so let's try location of indirect block */
+        if (ind->bh)
+                return ind->bh->b_blocknr;
+
+        /*
+         * It is going to be referred to from the inode itself? OK, just put it
+         * into the same cylinder group then.
+         */
+        bg_start = ext4_group_first_block_no(inode->i_sb, ei->i_block_group);
+        colour = (current->pid % 16) *
+                        (EXT4_BLOCKS_PER_GROUP(inode->i_sb) / 16);
+        return bg_start + colour;
+}
+
+/**
+ *      ext4_find_goal - find a prefered place for allocation.
+ *      @inode: owner
+ *      @block:  block we want
+ *      @chain:  chain of indirect blocks
+ *      @partial: pointer to the last triple within a chain
+ *      @goal:  place to store the result.
+ *
+ *      Normally this function find the prefered place for block allocation,
+ *      stores it in *@goal and returns zero.
+ */
+
+static ext4_fsblk_t ext4_find_goal(struct inode *inode, long block,
+                Indirect chain[4], Indirect *partial)
+{
+        struct ext4_block_alloc_info *block_i;
+
+        block_i =  EXT4_I(inode)->i_block_alloc_info;
+
+        /*
+         * try the heuristic for sequential allocation,
+         * failing that at least try to get decent locality.
+         */
+        if (block_i && (block == block_i->last_alloc_logical_block + 1)
+                && (block_i->last_alloc_physical_block != 0)) {
+                return block_i->last_alloc_physical_block + 1;
+        }
+
+        return ext4_find_near(inode, partial);
+}
+
+/**
+ *      ext4_blks_to_allocate: Look up the block map and count the number
+ *      of direct blocks need to be allocated for the given branch.
+ *
+ *      @branch: chain of indirect blocks
+ *      @k: number of blocks need for indirect blocks
+ *      @blks: number of data blocks to be mapped.
+ *      @blocks_to_boundary:  the offset in the indirect block
+ *
+ *      return the total number of blocks to be allocate, including the
+ *      direct and indirect blocks.
+ */
+static int ext4_blks_to_allocate(Indirect *branch, int k, unsigned long blks,
+                int blocks_to_boundary)
+{
+        unsigned long count = 0;
+
+        /*
+         * Simple case, [t,d]Indirect block(s) has not allocated yet
+         * then it's clear blocks on that path have not allocated
+         */
+        if (k > 0) {
+                /* right now we don't handle cross boundary allocation */
+                if (blks < blocks_to_boundary + 1)
+                        count += blks;
+                else
+                        count += blocks_to_boundary + 1;
+                return count;
+        }
+
+        count++;
+        while (count < blks && count <= blocks_to_boundary &&
+                le32_to_cpu(*(branch[0].p + count)) == 0) {
+                count++;
+        }
+        return count;
+}
+
+/**
+ *      ext4_alloc_blocks: multiple allocate blocks needed for a branch
+ *      @indirect_blks: the number of blocks need to allocate for indirect
+ *                      blocks
+ *
+ *      @new_blocks: on return it will store the new block numbers for
+ *      the indirect blocks(if needed) and the first direct block,
+ *      @blks:  on return it will store the total number of allocated
+ *              direct blocks
+ */
+static int ext4_alloc_blocks(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t goal, int indirect_blks, int blks,
+                        ext4_fsblk_t new_blocks[4], int *err)
+{
+        int target, i;
+        unsigned long count = 0;
+        int index = 0;
+        ext4_fsblk_t current_block = 0;
+        int ret = 0;
+
+        /*
+         * Here we try to allocate the requested multiple blocks at once,
+         * on a best-effort basis.
+         * To build a branch, we should allocate blocks for
+         * the indirect blocks(if not allocated yet), and at least
+         * the first direct block of this branch.  That's the
+         * minimum number of blocks need to allocate(required)
+         */
+        target = blks + indirect_blks;
+
+        while (1) {
+                count = target;
+                /* allocating blocks for indirect blocks and direct blocks */
+                current_block = ext4_new_blocks(handle,inode,goal,&count,err);
+                if (*err)
+                        goto failed_out;
+
+                target -= count;
+                /* allocate blocks for indirect blocks */
+                while (index < indirect_blks && count) {
+                        new_blocks[index++] = current_block++;
+                        count--;
+                }
+
+                if (count > 0)
+                        break;
+        }
+
+        /* save the new block number for the first direct block */
+        new_blocks[index] = current_block;
+
+        /* total number of blocks allocated for direct blocks */
+        ret = count;
+        *err = 0;
+        return ret;
+failed_out:
+        for (i = 0; i <index; i++)
+                ext4_free_blocks(handle, inode, new_blocks[i], 1);
+        return ret;
+}
+
+/**
+ *      ext4_alloc_branch - allocate and set up a chain of blocks.
+ *      @inode: owner
+ *      @indirect_blks: number of allocated indirect blocks
+ *      @blks: number of allocated direct blocks
+ *      @offsets: offsets (in the blocks) to store the pointers to next.
+ *      @branch: place to store the chain in.
+ *
+ *      This function allocates blocks, zeroes out all but the last one,
+ *      links them into chain and (if we are synchronous) writes them to disk.
+ *      In other words, it prepares a branch that can be spliced onto the
+ *      inode. It stores the information about that chain in the branch[], in
+ *      the same format as ext4_get_branch() would do. We are calling it after
+ *      we had read the existing part of chain and partial points to the last
+ *      triple of that (one with zero ->key). Upon the exit we have the same
+ *      picture as after the successful ext4_get_block(), except that in one
+ *      place chain is disconnected - *branch->p is still zero (we did not
+ *      set the last link), but branch->key contains the number that should
+ *      be placed into *branch->p to fill that gap.
+ *
+ *      If allocation fails we free all blocks we've allocated (and forget
+ *      their buffer_heads) and return the error value the from failed
+ *      ext4_alloc_block() (normally -ENOSPC). Otherwise we set the chain
+ *      as described above and return 0.
+ */
+static int ext4_alloc_branch(handle_t *handle, struct inode *inode,
+                        int indirect_blks, int *blks, ext4_fsblk_t goal,
+                        int *offsets, Indirect *branch)
+{
+        int blocksize = inode->i_sb->s_blocksize;
+        int i, n = 0;
+        int err = 0;
+        struct buffer_head *bh;
+        int num;
+        ext4_fsblk_t new_blocks[4];
+        ext4_fsblk_t current_block;
+
+        num = ext4_alloc_blocks(handle, inode, goal, indirect_blks,
+                                *blks, new_blocks, &err);
+        if (err)
+                return err;
+
+        branch[0].key = cpu_to_le32(new_blocks[0]);
+        /*
+         * metadata blocks and data blocks are allocated.
+         */
+        for (n = 1; n <= indirect_blks;  n++) {
+                /*
+                 * Get buffer_head for parent block, zero it out
+                 * and set the pointer to new one, then send
+                 * parent to disk.
+                 */
+                bh = sb_getblk(inode->i_sb, new_blocks[n-1]);
+                branch[n].bh = bh;
+                lock_buffer(bh);
+                BUFFER_TRACE(bh, "call get_create_access");
+                err = ext4_journal_get_create_access(handle, bh);
+                if (err) {
+                        unlock_buffer(bh);
+                        brelse(bh);
+                        goto failed;
+                }
+
+                memset(bh->b_data, 0, blocksize);
+                branch[n].p = (__le32 *) bh->b_data + offsets[n];
+                branch[n].key = cpu_to_le32(new_blocks[n]);
+                *branch[n].p = branch[n].key;
+                if ( n == indirect_blks) {
+                        current_block = new_blocks[n];
+                        /*
+                         * End of chain, update the last new metablock of
+                         * the chain to point to the new allocated
+                         * data blocks numbers
+                         */
+                        for (i=1; i < num; i++)
+                                *(branch[n].p + i) = cpu_to_le32(++current_block);
+                }
+                BUFFER_TRACE(bh, "marking uptodate");
+                set_buffer_uptodate(bh);
+                unlock_buffer(bh);
+
+                BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+                err = ext4_journal_dirty_metadata(handle, bh);
+                if (err)
+                        goto failed;
+        }
+        *blks = num;
+        return err;
+failed:
+        /* Allocation failed, free what we already allocated */
+        for (i = 1; i <= n ; i++) {
+                BUFFER_TRACE(branch[i].bh, "call jbd2_journal_forget");
+                ext4_journal_forget(handle, branch[i].bh);
+        }
+        for (i = 0; i <indirect_blks; i++)
+                ext4_free_blocks(handle, inode, new_blocks[i], 1);
+
+        ext4_free_blocks(handle, inode, new_blocks[i], num);
+
+        return err;
+}
+
+/**
+ * ext4_splice_branch - splice the allocated branch onto inode.
+ * @inode: owner
+ * @block: (logical) number of block we are adding
+ * @chain: chain of indirect blocks (with a missing link - see
+ *      ext4_alloc_branch)
+ * @where: location of missing link
+ * @num:   number of indirect blocks we are adding
+ * @blks:  number of direct blocks we are adding
+ *
+ * This function fills the missing link and does all housekeeping needed in
+ * inode (->i_blocks, etc.). In case of success we end up with the full
+ * chain to new block and return 0.
+ */
+static int ext4_splice_branch(handle_t *handle, struct inode *inode,
+                        long block, Indirect *where, int num, int blks)
+{
+        int i;
+        int err = 0;
+        struct ext4_block_alloc_info *block_i;
+        ext4_fsblk_t current_block;
+
+        block_i = EXT4_I(inode)->i_block_alloc_info;
+        /*
+         * If we're splicing into a [td]indirect block (as opposed to the
+         * inode) then we need to get write access to the [td]indirect block
+         * before the splice.
+         */
+        if (where->bh) {
+                BUFFER_TRACE(where->bh, "get_write_access");
+                err = ext4_journal_get_write_access(handle, where->bh);
+                if (err)
+                        goto err_out;
+        }
+        /* That's it */
+
+        *where->p = where->key;
+
+        /*
+         * Update the host buffer_head or inode to point to more just allocated
+         * direct blocks blocks
+         */
+        if (num == 0 && blks > 1) {
+                current_block = le32_to_cpu(where->key) + 1;
+                for (i = 1; i < blks; i++)
+                        *(where->p + i ) = cpu_to_le32(current_block++);
+        }
+
+        /*
+         * update the most recently allocated logical & physical block
+         * in i_block_alloc_info, to assist find the proper goal block for next
+         * allocation
+         */
+        if (block_i) {
+                block_i->last_alloc_logical_block = block + blks - 1;
+                block_i->last_alloc_physical_block =
+                                le32_to_cpu(where[num].key) + blks - 1;
+        }
+
+        /* We are done with atomic stuff, now do the rest of housekeeping */
+
+        inode->i_ctime = CURRENT_TIME_SEC;
+        ext4_mark_inode_dirty(handle, inode);
+
+        /* had we spliced it onto indirect block? */
+        if (where->bh) {
+                /*
+                 * If we spliced it onto an indirect block, we haven't
+                 * altered the inode.  Note however that if it is being spliced
+                 * onto an indirect block at the very end of the file (the
+                 * file is growing) then we *will* alter the inode to reflect
+                 * the new i_size.  But that is not done here - it is done in
+                 * generic_commit_write->__mark_inode_dirty->ext4_dirty_inode.
+                 */
+                jbd_debug(5, "splicing indirect only\n");
+                BUFFER_TRACE(where->bh, "call ext4_journal_dirty_metadata");
+                err = ext4_journal_dirty_metadata(handle, where->bh);
+                if (err)
+                        goto err_out;
+        } else {
+                /*
+                 * OK, we spliced it into the inode itself on a direct block.
+                 * Inode was dirtied above.
+                 */
+                jbd_debug(5, "splicing direct\n");
+        }
+        return err;
+
+err_out:
+        for (i = 1; i <= num; i++) {
+                BUFFER_TRACE(where[i].bh, "call jbd2_journal_forget");
+                ext4_journal_forget(handle, where[i].bh);
+                ext4_free_blocks(handle,inode,le32_to_cpu(where[i-1].key),1);
+        }
+        ext4_free_blocks(handle, inode, le32_to_cpu(where[num].key), blks);
+
+        return err;
+}
+
+/*
+ * Allocation strategy is simple: if we have to allocate something, we will
+ * have to go the whole way to leaf. So let's do it before attaching anything
+ * to tree, set linkage between the newborn blocks, write them if sync is
+ * required, recheck the path, free and repeat if check fails, otherwise
+ * set the last missing link (that will protect us from any truncate-generated
+ * removals - all blocks on the path are immune now) and possibly force the
+ * write on the parent block.
+ * That has a nice additional property: no special recovery from the failed
+ * allocations is needed - we simply release blocks and do not touch anything
+ * reachable from inode.
+ *
+ * `handle' can be NULL if create == 0.
+ *
+ * The BKL may not be held on entry here.  Be sure to take it early.
+ * return > 0, # of blocks mapped or allocated.
+ * return = 0, if plain lookup failed.
+ * return < 0, error case.
+ */
+int ext4_get_blocks_handle(handle_t *handle, struct inode *inode,
+                sector_t iblock, unsigned long maxblocks,
+                struct buffer_head *bh_result,
+                int create, int extend_disksize)
+{
+        int err = -EIO;
+        int offsets[4];
+        Indirect chain[4];
+        Indirect *partial;
+        ext4_fsblk_t goal;
+        int indirect_blks;
+        int blocks_to_boundary = 0;
+        int depth;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        int count = 0;
+        ext4_fsblk_t first_block = 0;
+
+
+        J_ASSERT(!(EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL));
+        J_ASSERT(handle != NULL || create == 0);
+        depth = ext4_block_to_path(inode,iblock,offsets,&blocks_to_boundary);
+
+        if (depth == 0)
+                goto out;
+
+        partial = ext4_get_branch(inode, depth, offsets, chain, &err);
+
+        /* Simplest case - block found, no allocation needed */
+        if (!partial) {
+                first_block = le32_to_cpu(chain[depth - 1].key);
+                clear_buffer_new(bh_result);
+                count++;
+                /*map more blocks*/
+                while (count < maxblocks && count <= blocks_to_boundary) {
+                        ext4_fsblk_t blk;
+
+                        if (!verify_chain(chain, partial)) {
+                                /*
+                                 * Indirect block might be removed by
+                                 * truncate while we were reading it.
+                                 * Handling of that case: forget what we've
+                                 * got now. Flag the err as EAGAIN, so it
+                                 * will reread.
+                                 */
+                                err = -EAGAIN;
+                                count = 0;
+                                break;
+                        }
+                        blk = le32_to_cpu(*(chain[depth-1].p + count));
+
+                        if (blk == first_block + count)
+                                count++;
+                        else
+                                break;
+                }
+                if (err != -EAGAIN)
+                        goto got_it;
+        }
+
+        /* Next simple case - plain lookup or failed read of indirect block */
+        if (!create || err == -EIO)
+                goto cleanup;
+
+        mutex_lock(&ei->truncate_mutex);
+
+        /*
+         * If the indirect block is missing while we are reading
+         * the chain(ext4_get_branch() returns -EAGAIN err), or
+         * if the chain has been changed after we grab the semaphore,
+         * (either because another process truncated this branch, or
+         * another get_block allocated this branch) re-grab the chain to see if
+         * the request block has been allocated or not.
+         *
+         * Since we already block the truncate/other get_block
+         * at this point, we will have the current copy of the chain when we
+         * splice the branch into the tree.
+         */
+        if (err == -EAGAIN || !verify_chain(chain, partial)) {
+                while (partial > chain) {
+                        brelse(partial->bh);
+                        partial--;
+                }
+                partial = ext4_get_branch(inode, depth, offsets, chain, &err);
+                if (!partial) {
+                        count++;
+                        mutex_unlock(&ei->truncate_mutex);
+                        if (err)
+                                goto cleanup;
+                        clear_buffer_new(bh_result);
+                        goto got_it;
+                }
+        }
+
+        /*
+         * Okay, we need to do block allocation.  Lazily initialize the block
+         * allocation info here if necessary
+        */
+        if (S_ISREG(inode->i_mode) && (!ei->i_block_alloc_info))
+                ext4_init_block_alloc_info(inode);
+
+        goal = ext4_find_goal(inode, iblock, chain, partial);
+
+        /* the number of blocks need to allocate for [d,t]indirect blocks */
+        indirect_blks = (chain + depth) - partial - 1;
+
+        /*
+         * Next look up the indirect map to count the totoal number of
+         * direct blocks to allocate for this branch.
+         */
+        count = ext4_blks_to_allocate(partial, indirect_blks,
+                                        maxblocks, blocks_to_boundary);
+        /*
+         * Block out ext4_truncate while we alter the tree
+         */
+        err = ext4_alloc_branch(handle, inode, indirect_blks, &count, goal,
+                                offsets + (partial - chain), partial);
+
+        /*
+         * The ext4_splice_branch call will free and forget any buffers
+         * on the new chain if there is a failure, but that risks using
+         * up transaction credits, especially for bitmaps where the
+         * credits cannot be returned.  Can we handle this somehow?  We
+         * may need to return -EAGAIN upwards in the worst case.  --sct
+         */
+        if (!err)
+                err = ext4_splice_branch(handle, inode, iblock,
+                                        partial, indirect_blks, count);
+        /*
+         * i_disksize growing is protected by truncate_mutex.  Don't forget to
+         * protect it if you're about to implement concurrent
+         * ext4_get_block() -bzzz
+        */
+        if (!err && extend_disksize && inode->i_size > ei->i_disksize)
+                ei->i_disksize = inode->i_size;
+        mutex_unlock(&ei->truncate_mutex);
+        if (err)
+                goto cleanup;
+
+        set_buffer_new(bh_result);
+got_it:
+        map_bh(bh_result, inode->i_sb, le32_to_cpu(chain[depth-1].key));
+        if (count > blocks_to_boundary)
+                set_buffer_boundary(bh_result);
+        err = count;
+        /* Clean up and exit */
+        partial = chain + depth - 1;    /* the whole chain */
+cleanup:
+        while (partial > chain) {
+                BUFFER_TRACE(partial->bh, "call brelse");
+                brelse(partial->bh);
+                partial--;
+        }
+        BUFFER_TRACE(bh_result, "returned");
+out:
+        return err;
+}
+
+#define DIO_CREDITS (EXT4_RESERVE_TRANS_BLOCKS + 32)
+
+static int ext4_get_block(struct inode *inode, sector_t iblock,
+                        struct buffer_head *bh_result, int create)
+{
+        handle_t *handle = journal_current_handle();
+        int ret = 0;
+        unsigned max_blocks = bh_result->b_size >> inode->i_blkbits;
+
+        if (!create)
+                goto get_block;         /* A read */
+
+        if (max_blocks == 1)
+                goto get_block;         /* A single block get */
+
+        if (handle->h_transaction->t_state == T_LOCKED) {
+                /*
+                 * Huge direct-io writes can hold off commits for long
+                 * periods of time.  Let this commit run.
+                 */
+                ext4_journal_stop(handle);
+                handle = ext4_journal_start(inode, DIO_CREDITS);
+                if (IS_ERR(handle))
+                        ret = PTR_ERR(handle);
+                goto get_block;
+        }
+
+        if (handle->h_buffer_credits <= EXT4_RESERVE_TRANS_BLOCKS) {
+                /*
+                 * Getting low on buffer credits...
+                 */
+                ret = ext4_journal_extend(handle, DIO_CREDITS);
+                if (ret > 0) {
+                        /*
+                         * Couldn't extend the transaction.  Start a new one.
+                         */
+                        ret = ext4_journal_restart(handle, DIO_CREDITS);
+                }
+        }
+
+get_block:
+        if (ret == 0) {
+                ret = ext4_get_blocks_wrap(handle, inode, iblock,
+                                        max_blocks, bh_result, create, 0);
+                if (ret > 0) {
+                        bh_result->b_size = (ret << inode->i_blkbits);
+                        ret = 0;
+                }
+        }
+        return ret;
+}
+
+/*
+ * `handle' can be NULL if create is zero
+ */
+struct buffer_head *ext4_getblk(handle_t *handle, struct inode *inode,
+                                long block, int create, int *errp)
+{
+        struct buffer_head dummy;
+        int fatal = 0, err;
+
+        J_ASSERT(handle != NULL || create == 0);
+
+        dummy.b_state = 0;
+        dummy.b_blocknr = -1000;
+        buffer_trace_init(&dummy.b_history);
+        err = ext4_get_blocks_wrap(handle, inode, block, 1,
+                                        &dummy, create, 1);
+        /*
+         * ext4_get_blocks_handle() returns number of blocks
+         * mapped. 0 in case of a HOLE.
+         */
+        if (err > 0) {
+                if (err > 1)
+                        WARN_ON(1);
+                err = 0;
+        }
+        *errp = err;
+        if (!err && buffer_mapped(&dummy)) {
+                struct buffer_head *bh;
+                bh = sb_getblk(inode->i_sb, dummy.b_blocknr);
+                if (!bh) {
+                        *errp = -EIO;
+                        goto err;
+                }
+                if (buffer_new(&dummy)) {
+                        J_ASSERT(create != 0);
+                        J_ASSERT(handle != 0);
+
+                        /*
+                         * Now that we do not always journal data, we should
+                         * keep in mind whether this should always journal the
+                         * new buffer as metadata.  For now, regular file
+                         * writes use ext4_get_block instead, so it's not a
+                         * problem.
+                         */
+                        lock_buffer(bh);
+                        BUFFER_TRACE(bh, "call get_create_access");
+                        fatal = ext4_journal_get_create_access(handle, bh);
+                        if (!fatal && !buffer_uptodate(bh)) {
+                                memset(bh->b_data,0,inode->i_sb->s_blocksize);
+                                set_buffer_uptodate(bh);
+                        }
+                        unlock_buffer(bh);
+                        BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+                        err = ext4_journal_dirty_metadata(handle, bh);
+                        if (!fatal)
+                                fatal = err;
+                } else {
+                        BUFFER_TRACE(bh, "not a new buffer");
+                }
+                if (fatal) {
+                        *errp = fatal;
+                        brelse(bh);
+                        bh = NULL;
+                }
+                return bh;
+        }
+err:
+        return NULL;
+}
+
+struct buffer_head *ext4_bread(handle_t *handle, struct inode *inode,
+                               int block, int create, int *err)
+{
+        struct buffer_head * bh;
+
+        bh = ext4_getblk(handle, inode, block, create, err);
+        if (!bh)
+                return bh;
+        if (buffer_uptodate(bh))
+                return bh;
+        ll_rw_block(READ_META, 1, &bh);
+        wait_on_buffer(bh);
+        if (buffer_uptodate(bh))
+                return bh;
+        put_bh(bh);
+        *err = -EIO;
+        return NULL;
+}
+
+static int walk_page_buffers(   handle_t *handle,
+                                struct buffer_head *head,
+                                unsigned from,
+                                unsigned to,
+                                int *partial,
+                                int (*fn)(      handle_t *handle,
+                                                struct buffer_head *bh))
+{
+        struct buffer_head *bh;
+        unsigned block_start, block_end;
+        unsigned blocksize = head->b_size;
+        int err, ret = 0;
+        struct buffer_head *next;
+
+        for (   bh = head, block_start = 0;
+                ret == 0 && (bh != head || !block_start);
+                block_start = block_end, bh = next)
+        {
+                next = bh->b_this_page;
+                block_end = block_start + blocksize;
+                if (block_end <= from || block_start >= to) {
+                        if (partial && !buffer_uptodate(bh))
+                                *partial = 1;
+                        continue;
+                }
+                err = (*fn)(handle, bh);
+                if (!ret)
+                        ret = err;
+        }
+        return ret;
+}
+
+/*
+ * To preserve ordering, it is essential that the hole instantiation and
+ * the data write be encapsulated in a single transaction.  We cannot
+ * close off a transaction and start a new one between the ext4_get_block()
+ * and the commit_write().  So doing the jbd2_journal_start at the start of
+ * prepare_write() is the right place.
+ *
+ * Also, this function can nest inside ext4_writepage() ->
+ * block_write_full_page(). In that case, we *know* that ext4_writepage()
+ * has generated enough buffer credits to do the whole page.  So we won't
+ * block on the journal in that case, which is good, because the caller may
+ * be PF_MEMALLOC.
+ *
+ * By accident, ext4 can be reentered when a transaction is open via
+ * quota file writes.  If we were to commit the transaction while thus
+ * reentered, there can be a deadlock - we would be holding a quota
+ * lock, and the commit would never complete if another thread had a
+ * transaction open and was blocking on the quota lock - a ranking
+ * violation.
+ *
+ * So what we do is to rely on the fact that jbd2_journal_stop/journal_start
+ * will _not_ run commit under these circumstances because handle->h_ref
+ * is elevated.  We'll still have enough credits for the tiny quotafile
+ * write.
+ */
+static int do_journal_get_write_access(handle_t *handle,
+                                        struct buffer_head *bh)
+{
+        if (!buffer_mapped(bh) || buffer_freed(bh))
+                return 0;
+        return ext4_journal_get_write_access(handle, bh);
+}
+
+static int ext4_prepare_write(struct file *file, struct page *page,
+                              unsigned from, unsigned to)
+{
+        struct inode *inode = page->mapping->host;
+        int ret, needed_blocks = ext4_writepage_trans_blocks(inode);
+        handle_t *handle;
+        int retries = 0;
+
+retry:
+        handle = ext4_journal_start(inode, needed_blocks);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out;
+        }
+        if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
+                ret = nobh_prepare_write(page, from, to, ext4_get_block);
+        else
+                ret = block_prepare_write(page, from, to, ext4_get_block);
+        if (ret)
+                goto prepare_write_failed;
+
+        if (ext4_should_journal_data(inode)) {
+                ret = walk_page_buffers(handle, page_buffers(page),
+                                from, to, NULL, do_journal_get_write_access);
+        }
+prepare_write_failed:
+        if (ret)
+                ext4_journal_stop(handle);
+        if (ret == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries))
+                goto retry;
+out:
+        return ret;
+}
+
+int ext4_journal_dirty_data(handle_t *handle, struct buffer_head *bh)
+{
+        int err = jbd2_journal_dirty_data(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(__FUNCTION__, __FUNCTION__,
+                                                bh, handle,err);
+        return err;
+}
+
+/* For commit_write() in data=journal mode */
+static int commit_write_fn(handle_t *handle, struct buffer_head *bh)
+{
+        if (!buffer_mapped(bh) || buffer_freed(bh))
+                return 0;
+        set_buffer_uptodate(bh);
+        return ext4_journal_dirty_metadata(handle, bh);
+}
+
+/*
+ * We need to pick up the new inode size which generic_commit_write gave us
+ * `file' can be NULL - eg, when called from page_symlink().
+ *
+ * ext4 never places buffers on inode->i_mapping->private_list.  metadata
+ * buffers are managed internally.
+ */
+static int ext4_ordered_commit_write(struct file *file, struct page *page,
+                             unsigned from, unsigned to)
+{
+        handle_t *handle = ext4_journal_current_handle();
+        struct inode *inode = page->mapping->host;
+        int ret = 0, ret2;
+
+        ret = walk_page_buffers(handle, page_buffers(page),
+                from, to, NULL, ext4_journal_dirty_data);
+
+        if (ret == 0) {
+                /*
+                 * generic_commit_write() will run mark_inode_dirty() if i_size
+                 * changes.  So let's piggyback the i_disksize mark_inode_dirty
+                 * into that.
+                 */
+                loff_t new_i_size;
+
+                new_i_size = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
+                if (new_i_size > EXT4_I(inode)->i_disksize)
+                        EXT4_I(inode)->i_disksize = new_i_size;
+                ret = generic_commit_write(file, page, from, to);
+        }
+        ret2 = ext4_journal_stop(handle);
+        if (!ret)
+                ret = ret2;
+        return ret;
+}
+
+static int ext4_writeback_commit_write(struct file *file, struct page *page,
+                             unsigned from, unsigned to)
+{
+        handle_t *handle = ext4_journal_current_handle();
+        struct inode *inode = page->mapping->host;
+        int ret = 0, ret2;
+        loff_t new_i_size;
+
+        new_i_size = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
+        if (new_i_size > EXT4_I(inode)->i_disksize)
+                EXT4_I(inode)->i_disksize = new_i_size;
+
+        if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
+                ret = nobh_commit_write(file, page, from, to);
+        else
+                ret = generic_commit_write(file, page, from, to);
+
+        ret2 = ext4_journal_stop(handle);
+        if (!ret)
+                ret = ret2;
+        return ret;
+}
+
+static int ext4_journalled_commit_write(struct file *file,
+                        struct page *page, unsigned from, unsigned to)
+{
+        handle_t *handle = ext4_journal_current_handle();
+        struct inode *inode = page->mapping->host;
+        int ret = 0, ret2;
+        int partial = 0;
+        loff_t pos;
+
+        /*
+         * Here we duplicate the generic_commit_write() functionality
+         */
+        pos = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
+
+        ret = walk_page_buffers(handle, page_buffers(page), from,
+                                to, &partial, commit_write_fn);
+        if (!partial)
+                SetPageUptodate(page);
+        if (pos > inode->i_size)
+                i_size_write(inode, pos);
+        EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+        if (inode->i_size > EXT4_I(inode)->i_disksize) {
+                EXT4_I(inode)->i_disksize = inode->i_size;
+                ret2 = ext4_mark_inode_dirty(handle, inode);
+                if (!ret)
+                        ret = ret2;
+        }
+        ret2 = ext4_journal_stop(handle);
+        if (!ret)
+                ret = ret2;
+        return ret;
+}
+
+/*
+ * bmap() is special.  It gets used by applications such as lilo and by
+ * the swapper to find the on-disk block of a specific piece of data.
+ *
+ * Naturally, this is dangerous if the block concerned is still in the
+ * journal.  If somebody makes a swapfile on an ext4 data-journaling
+ * filesystem and enables swap, then they may get a nasty shock when the
+ * data getting swapped to that swapfile suddenly gets overwritten by
+ * the original zero's written out previously to the journal and
+ * awaiting writeback in the kernel's buffer cache.
+ *
+ * So, if we see any bmap calls here on a modified, data-journaled file,
+ * take extra steps to flush any blocks which might be in the cache.
+ */
+static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
+{
+        struct inode *inode = mapping->host;
+        journal_t *journal;
+        int err;
+
+        if (EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
+                /*
+                 * This is a REALLY heavyweight approach, but the use of
+                 * bmap on dirty files is expected to be extremely rare:
+                 * only if we run lilo or swapon on a freshly made file
+                 * do we expect this to happen.
+                 *
+                 * (bmap requires CAP_SYS_RAWIO so this does not
+                 * represent an unprivileged user DOS attack --- we'd be
+                 * in trouble if mortal users could trigger this path at
+                 * will.)
+                 *
+                 * NB. EXT4_STATE_JDATA is not set on files other than
+                 * regular files.  If somebody wants to bmap a directory
+                 * or symlink and gets confused because the buffer
+                 * hasn't yet been flushed to disk, they deserve
+                 * everything they get.
+                 */
+
+                EXT4_I(inode)->i_state &= ~EXT4_STATE_JDATA;
+                journal = EXT4_JOURNAL(inode);
+                jbd2_journal_lock_updates(journal);
+                err = jbd2_journal_flush(journal);
+                jbd2_journal_unlock_updates(journal);
+
+                if (err)
+                        return 0;
+        }
+
+        return generic_block_bmap(mapping,block,ext4_get_block);
+}
+
+static int bget_one(handle_t *handle, struct buffer_head *bh)
+{
+        get_bh(bh);
+        return 0;
+}
+
+static int bput_one(handle_t *handle, struct buffer_head *bh)
+{
+        put_bh(bh);
+        return 0;
+}
+
+static int jbd2_journal_dirty_data_fn(handle_t *handle, struct buffer_head *bh)
+{
+        if (buffer_mapped(bh))
+                return ext4_journal_dirty_data(handle, bh);
+        return 0;
+}
+
+/*
+ * Note that we always start a transaction even if we're not journalling
+ * data.  This is to preserve ordering: any hole instantiation within
+ * __block_write_full_page -> ext4_get_block() should be journalled
+ * along with the data so we don't crash and then get metadata which
+ * refers to old data.
+ *
+ * In all journalling modes block_write_full_page() will start the I/O.
+ *
+ * Problem:
+ *
+ *      ext4_writepage() -> kmalloc() -> __alloc_pages() -> page_launder() ->
+ *              ext4_writepage()
+ *
+ * Similar for:
+ *
+ *      ext4_file_write() -> generic_file_write() -> __alloc_pages() -> ...
+ *
+ * Same applies to ext4_get_block().  We will deadlock on various things like
+ * lock_journal and i_truncate_mutex.
+ *
+ * Setting PF_MEMALLOC here doesn't work - too many internal memory
+ * allocations fail.
+ *
+ * 16May01: If we're reentered then journal_current_handle() will be
+ *          non-zero. We simply *return*.
+ *
+ * 1 July 2001: @@@ FIXME:
+ *   In journalled data mode, a data buffer may be metadata against the
+ *   current transaction.  But the same file is part of a shared mapping
+ *   and someone does a writepage() on it.
+ *
+ *   We will move the buffer onto the async_data list, but *after* it has
+ *   been dirtied. So there's a small window where we have dirty data on
+ *   BJ_Metadata.
+ *
+ *   Note that this only applies to the last partial page in the file.  The
+ *   bit which block_write_full_page() uses prepare/commit for.  (That's
+ *   broken code anyway: it's wrong for msync()).
+ *
+ *   It's a rare case: affects the final partial page, for journalled data
+ *   where the file is subject to bith write() and writepage() in the same
+ *   transction.  To fix it we'll need a custom block_write_full_page().
+ *   We'll probably need that anyway for journalling writepage() output.
+ *
+ * We don't honour synchronous mounts for writepage().  That would be
+ * disastrous.  Any write() or metadata operation will sync the fs for
+ * us.
+ *
+ * AKPM2: if all the page's buffers are mapped to disk and !data=journal,
+ * we don't need to open a transaction here.
+ */
+static int ext4_ordered_writepage(struct page *page,
+                                struct writeback_control *wbc)
+{
+        struct inode *inode = page->mapping->host;
+        struct buffer_head *page_bufs;
+        handle_t *handle = NULL;
+        int ret = 0;
+        int err;
+
+        J_ASSERT(PageLocked(page));
+
+        /*
+         * We give up here if we're reentered, because it might be for a
+         * different filesystem.
+         */
+        if (ext4_journal_current_handle())
+                goto out_fail;
+
+        handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
+
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out_fail;
+        }
+
+        if (!page_has_buffers(page)) {
+                create_empty_buffers(page, inode->i_sb->s_blocksize,
+                                (1 << BH_Dirty)|(1 << BH_Uptodate));
+        }
+        page_bufs = page_buffers(page);
+        walk_page_buffers(handle, page_bufs, 0,
+                        PAGE_CACHE_SIZE, NULL, bget_one);
+
+        ret = block_write_full_page(page, ext4_get_block, wbc);
+
+        /*
+         * The page can become unlocked at any point now, and
+         * truncate can then come in and change things.  So we
+         * can't touch *page from now on.  But *page_bufs is
+         * safe due to elevated refcount.
+         */
+
+        /*
+         * And attach them to the current transaction.  But only if
+         * block_write_full_page() succeeded.  Otherwise they are unmapped,
+         * and generally junk.
+         */
+        if (ret == 0) {
+                err = walk_page_buffers(handle, page_bufs, 0, PAGE_CACHE_SIZE,
+                                        NULL, jbd2_journal_dirty_data_fn);
+                if (!ret)
+                        ret = err;
+        }
+        walk_page_buffers(handle, page_bufs, 0,
+                        PAGE_CACHE_SIZE, NULL, bput_one);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+
+out_fail:
+        redirty_page_for_writepage(wbc, page);
+        unlock_page(page);
+        return ret;
+}
+
+static int ext4_writeback_writepage(struct page *page,
+                                struct writeback_control *wbc)
+{
+        struct inode *inode = page->mapping->host;
+        handle_t *handle = NULL;
+        int ret = 0;
+        int err;
+
+        if (ext4_journal_current_handle())
+                goto out_fail;
+
+        handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto out_fail;
+        }
+
+        if (test_opt(inode->i_sb, NOBH) && ext4_should_writeback_data(inode))
+                ret = nobh_writepage(page, ext4_get_block, wbc);
+        else
+                ret = block_write_full_page(page, ext4_get_block, wbc);
+
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+
+out_fail:
+        redirty_page_for_writepage(wbc, page);
+        unlock_page(page);
+        return ret;
+}
+
+static int ext4_journalled_writepage(struct page *page,
+                                struct writeback_control *wbc)
+{
+        struct inode *inode = page->mapping->host;
+        handle_t *handle = NULL;
+        int ret = 0;
+        int err;
+
+        if (ext4_journal_current_handle())
+                goto no_write;
+
+        handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+                goto no_write;
+        }
+
+        if (!page_has_buffers(page) || PageChecked(page)) {
+                /*
+                 * It's mmapped pagecache.  Add buffers and journal it.  There
+                 * doesn't seem much point in redirtying the page here.
+                 */
+                ClearPageChecked(page);
+                ret = block_prepare_write(page, 0, PAGE_CACHE_SIZE,
+                                        ext4_get_block);
+                if (ret != 0) {
+                        ext4_journal_stop(handle);
+                        goto out_unlock;
+                }
+                ret = walk_page_buffers(handle, page_buffers(page), 0,
+                        PAGE_CACHE_SIZE, NULL, do_journal_get_write_access);
+
+                err = walk_page_buffers(handle, page_buffers(page), 0,
+                                PAGE_CACHE_SIZE, NULL, commit_write_fn);
+                if (ret == 0)
+                        ret = err;
+                EXT4_I(inode)->i_state |= EXT4_STATE_JDATA;
+                unlock_page(page);
+        } else {
+                /*
+                 * It may be a page full of checkpoint-mode buffers.  We don't
+                 * really know unless we go poke around in the buffer_heads.
+                 * But block_write_full_page will do the right thing.
+                 */
+                ret = block_write_full_page(page, ext4_get_block, wbc);
+        }
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+out:
+        return ret;
+
+no_write:
+        redirty_page_for_writepage(wbc, page);
+out_unlock:
+        unlock_page(page);
+        goto out;
+}
+
+static int ext4_readpage(struct file *file, struct page *page)
+{
+        return mpage_readpage(page, ext4_get_block);
+}
+
+static int
+ext4_readpages(struct file *file, struct address_space *mapping,
+                struct list_head *pages, unsigned nr_pages)
+{
+        return mpage_readpages(mapping, pages, nr_pages, ext4_get_block);
+}
+
+static void ext4_invalidatepage(struct page *page, unsigned long offset)
+{
+        journal_t *journal = EXT4_JOURNAL(page->mapping->host);
+
+        /*
+         * If it's a full truncate we just forget about the pending dirtying
+         */
+        if (offset == 0)
+                ClearPageChecked(page);
+
+        jbd2_journal_invalidatepage(journal, page, offset);
+}
+
+static int ext4_releasepage(struct page *page, gfp_t wait)
+{
+        journal_t *journal = EXT4_JOURNAL(page->mapping->host);
+
+        WARN_ON(PageChecked(page));
+        if (!page_has_buffers(page))
+                return 0;
+        return jbd2_journal_try_to_free_buffers(journal, page, wait);
+}
+
+/*
+ * If the O_DIRECT write will extend the file then add this inode to the
+ * orphan list.  So recovery will truncate it back to the original size
+ * if the machine crashes during the write.
+ *
+ * If the O_DIRECT write is intantiating holes inside i_size and the machine
+ * crashes then stale disk data _may_ be exposed inside the file.
+ */
+static ssize_t ext4_direct_IO(int rw, struct kiocb *iocb,
+                        const struct iovec *iov, loff_t offset,
+                        unsigned long nr_segs)
+{
+        struct file *file = iocb->ki_filp;
+        struct inode *inode = file->f_mapping->host;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        handle_t *handle = NULL;
+        ssize_t ret;
+        int orphan = 0;
+        size_t count = iov_length(iov, nr_segs);
+
+        if (rw == WRITE) {
+                loff_t final_size = offset + count;
+
+                handle = ext4_journal_start(inode, DIO_CREDITS);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        goto out;
+                }
+                if (final_size > inode->i_size) {
+                        ret = ext4_orphan_add(handle, inode);
+                        if (ret)
+                                goto out_stop;
+                        orphan = 1;
+                        ei->i_disksize = inode->i_size;
+                }
+        }
+
+        ret = blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
+                                 offset, nr_segs,
+                                 ext4_get_block, NULL);
+
+        /*
+         * Reacquire the handle: ext4_get_block() can restart the transaction
+         */
+        handle = journal_current_handle();
+
+out_stop:
+        if (handle) {
+                int err;
+
+                if (orphan && inode->i_nlink)
+                        ext4_orphan_del(handle, inode);
+                if (orphan && ret > 0) {
+                        loff_t end = offset + ret;
+                        if (end > inode->i_size) {
+                                ei->i_disksize = end;
+                                i_size_write(inode, end);
+                                /*
+                                 * We're going to return a positive `ret'
+                                 * here due to non-zero-length I/O, so there's
+                                 * no way of reporting error returns from
+                                 * ext4_mark_inode_dirty() to userspace.  So
+                                 * ignore it.
+                                 */
+                                ext4_mark_inode_dirty(handle, inode);
+                        }
+                }
+                err = ext4_journal_stop(handle);
+                if (ret == 0)
+                        ret = err;
+        }
+out:
+        return ret;
+}
+
+/*
+ * Pages can be marked dirty completely asynchronously from ext4's journalling
+ * activity.  By filemap_sync_pte(), try_to_unmap_one(), etc.  We cannot do
+ * much here because ->set_page_dirty is called under VFS locks.  The page is
+ * not necessarily locked.
+ *
+ * We cannot just dirty the page and leave attached buffers clean, because the
+ * buffers' dirty state is "definitive".  We cannot just set the buffers dirty
+ * or jbddirty because all the journalling code will explode.
+ *
+ * So what we do is to mark the page "pending dirty" and next time writepage
+ * is called, propagate that into the buffers appropriately.
+ */
+static int ext4_journalled_set_page_dirty(struct page *page)
+{
+        SetPageChecked(page);
+        return __set_page_dirty_nobuffers(page);
+}
+
+static const struct address_space_operations ext4_ordered_aops = {
+        .readpage       = ext4_readpage,
+        .readpages      = ext4_readpages,
+        .writepage      = ext4_ordered_writepage,
+        .sync_page      = block_sync_page,
+        .prepare_write  = ext4_prepare_write,
+        .commit_write   = ext4_ordered_commit_write,
+        .bmap           = ext4_bmap,
+        .invalidatepage = ext4_invalidatepage,
+        .releasepage    = ext4_releasepage,
+        .direct_IO      = ext4_direct_IO,
+        .migratepage    = buffer_migrate_page,
+};
+
+static const struct address_space_operations ext4_writeback_aops = {
+        .readpage       = ext4_readpage,
+        .readpages      = ext4_readpages,
+        .writepage      = ext4_writeback_writepage,
+        .sync_page      = block_sync_page,
+        .prepare_write  = ext4_prepare_write,
+        .commit_write   = ext4_writeback_commit_write,
+        .bmap           = ext4_bmap,
+        .invalidatepage = ext4_invalidatepage,
+        .releasepage    = ext4_releasepage,
+        .direct_IO      = ext4_direct_IO,
+        .migratepage    = buffer_migrate_page,
+};
+
+static const struct address_space_operations ext4_journalled_aops = {
+        .readpage       = ext4_readpage,
+        .readpages      = ext4_readpages,
+        .writepage      = ext4_journalled_writepage,
+        .sync_page      = block_sync_page,
+        .prepare_write  = ext4_prepare_write,
+        .commit_write   = ext4_journalled_commit_write,
+        .set_page_dirty = ext4_journalled_set_page_dirty,
+        .bmap           = ext4_bmap,
+        .invalidatepage = ext4_invalidatepage,
+        .releasepage    = ext4_releasepage,
+};
+
+void ext4_set_aops(struct inode *inode)
+{
+        if (ext4_should_order_data(inode))
+                inode->i_mapping->a_ops = &ext4_ordered_aops;
+        else if (ext4_should_writeback_data(inode))
+                inode->i_mapping->a_ops = &ext4_writeback_aops;
+        else
+                inode->i_mapping->a_ops = &ext4_journalled_aops;
+}
+
+/*
+ * ext4_block_truncate_page() zeroes out a mapping from file offset `from'
+ * up to the end of the block which corresponds to `from'.
+ * This required during truncate. We need to physically zero the tail end
+ * of that block so it doesn't yield old data if the file is later grown.
+ */
+int ext4_block_truncate_page(handle_t *handle, struct page *page,
+                struct address_space *mapping, loff_t from)
+{
+        ext4_fsblk_t index = from >> PAGE_CACHE_SHIFT;
+        unsigned offset = from & (PAGE_CACHE_SIZE-1);
+        unsigned blocksize, iblock, length, pos;
+        struct inode *inode = mapping->host;
+        struct buffer_head *bh;
+        int err = 0;
+        void *kaddr;
+
+        blocksize = inode->i_sb->s_blocksize;
+        length = blocksize - (offset & (blocksize - 1));
+        iblock = index << (PAGE_CACHE_SHIFT - inode->i_sb->s_blocksize_bits);
+
+        /*
+         * For "nobh" option,  we can only work if we don't need to
+         * read-in the page - otherwise we create buffers to do the IO.
+         */
+        if (!page_has_buffers(page) && test_opt(inode->i_sb, NOBH) &&
+             ext4_should_writeback_data(inode) && PageUptodate(page)) {
+                kaddr = kmap_atomic(page, KM_USER0);
+                memset(kaddr + offset, 0, length);
+                flush_dcache_page(page);
+                kunmap_atomic(kaddr, KM_USER0);
+                set_page_dirty(page);
+                goto unlock;
+        }
+
+        if (!page_has_buffers(page))
+                create_empty_buffers(page, blocksize, 0);
+
+        /* Find the buffer that contains "offset" */
+        bh = page_buffers(page);
+        pos = blocksize;
+        while (offset >= pos) {
+                bh = bh->b_this_page;
+                iblock++;
+                pos += blocksize;
+        }
+
+        err = 0;
+        if (buffer_freed(bh)) {
+                BUFFER_TRACE(bh, "freed: skip");
+                goto unlock;
+        }
+
+        if (!buffer_mapped(bh)) {
+                BUFFER_TRACE(bh, "unmapped");
+                ext4_get_block(inode, iblock, bh, 0);
+                /* unmapped? It's a hole - nothing to do */
+                if (!buffer_mapped(bh)) {
+                        BUFFER_TRACE(bh, "still unmapped");
+                        goto unlock;
+                }
+        }
+
+        /* Ok, it's mapped. Make sure it's up-to-date */
+        if (PageUptodate(page))
+                set_buffer_uptodate(bh);
+
+        if (!buffer_uptodate(bh)) {
+                err = -EIO;
+                ll_rw_block(READ, 1, &bh);
+                wait_on_buffer(bh);
+                /* Uhhuh. Read error. Complain and punt. */
+                if (!buffer_uptodate(bh))
+                        goto unlock;
+        }
+
+        if (ext4_should_journal_data(inode)) {
+                BUFFER_TRACE(bh, "get write access");
+                err = ext4_journal_get_write_access(handle, bh);
+                if (err)
+                        goto unlock;
+        }
+
+        kaddr = kmap_atomic(page, KM_USER0);
+        memset(kaddr + offset, 0, length);
+        flush_dcache_page(page);
+        kunmap_atomic(kaddr, KM_USER0);
+
+        BUFFER_TRACE(bh, "zeroed end of block");
+
+        err = 0;
+        if (ext4_should_journal_data(inode)) {
+                err = ext4_journal_dirty_metadata(handle, bh);
+        } else {
+                if (ext4_should_order_data(inode))
+                        err = ext4_journal_dirty_data(handle, bh);
+                mark_buffer_dirty(bh);
+        }
+
+unlock:
+        unlock_page(page);
+        page_cache_release(page);
+        return err;
+}
+
+/*
+ * Probably it should be a library function... search for first non-zero word
+ * or memcmp with zero_page, whatever is better for particular architecture.
+ * Linus?
+ */
+static inline int all_zeroes(__le32 *p, __le32 *q)
+{
+        while (p < q)
+                if (*p++)
+                        return 0;
+        return 1;
+}
+
+/**
+ *      ext4_find_shared - find the indirect blocks for partial truncation.
+ *      @inode:   inode in question
+ *      @depth:   depth of the affected branch
+ *      @offsets: offsets of pointers in that branch (see ext4_block_to_path)
+ *      @chain:   place to store the pointers to partial indirect blocks
+ *      @top:     place to the (detached) top of branch
+ *
+ *      This is a helper function used by ext4_truncate().
+ *
+ *      When we do truncate() we may have to clean the ends of several
+ *      indirect blocks but leave the blocks themselves alive. Block is
+ *      partially truncated if some data below the new i_size is refered
+ *      from it (and it is on the path to the first completely truncated
+ *      data block, indeed).  We have to free the top of that path along
+ *      with everything to the right of the path. Since no allocation
+ *      past the truncation point is possible until ext4_truncate()
+ *      finishes, we may safely do the latter, but top of branch may
+ *      require special attention - pageout below the truncation point
+ *      might try to populate it.
+ *
+ *      We atomically detach the top of branch from the tree, store the
+ *      block number of its root in *@top, pointers to buffer_heads of
+ *      partially truncated blocks - in @chain[].bh and pointers to
+ *      their last elements that should not be removed - in
+ *      @chain[].p. Return value is the pointer to last filled element
+ *      of @chain.
+ *
+ *      The work left to caller to do the actual freeing of subtrees:
+ *              a) free the subtree starting from *@top
+ *              b) free the subtrees whose roots are stored in
+ *                      (@chain[i].p+1 .. end of @chain[i].bh->b_data)
+ *              c) free the subtrees growing from the inode past the @chain[0].
+ *                      (no partially truncated stuff there).  */
+
+static Indirect *ext4_find_shared(struct inode *inode, int depth,
+                        int offsets[4], Indirect chain[4], __le32 *top)
+{
+        Indirect *partial, *p;
+        int k, err;
+
+        *top = 0;
+        /* Make k index the deepest non-null offest + 1 */
+        for (k = depth; k > 1 && !offsets[k-1]; k--)
+                ;
+        partial = ext4_get_branch(inode, k, offsets, chain, &err);
+        /* Writer: pointers */
+        if (!partial)
+                partial = chain + k-1;
+        /*
+         * If the branch acquired continuation since we've looked at it -
+         * fine, it should all survive and (new) top doesn't belong to us.
+         */
+        if (!partial->key && *partial->p)
+                /* Writer: end */
+                goto no_top;
+        for (p=partial; p>chain && all_zeroes((__le32*)p->bh->b_data,p->p); p--)
+                ;
+        /*
+         * OK, we've found the last block that must survive. The rest of our
+         * branch should be detached before unlocking. However, if that rest
+         * of branch is all ours and does not grow immediately from the inode
+         * it's easier to cheat and just decrement partial->p.
+         */
+        if (p == chain + k - 1 && p > chain) {
+                p->p--;
+        } else {
+                *top = *p->p;
+                /* Nope, don't do this in ext4.  Must leave the tree intact */
+#if 0
+                *p->p = 0;
+#endif
+        }
+        /* Writer: end */
+
+        while(partial > p) {
+                brelse(partial->bh);
+                partial--;
+        }
+no_top:
+        return partial;
+}
+
+/*
+ * Zero a number of block pointers in either an inode or an indirect block.
+ * If we restart the transaction we must again get write access to the
+ * indirect block for further modification.
+ *
+ * We release `count' blocks on disk, but (last - first) may be greater
+ * than `count' because there can be holes in there.
+ */
+static void ext4_clear_blocks(handle_t *handle, struct inode *inode,
+                struct buffer_head *bh, ext4_fsblk_t block_to_free,
+                unsigned long count, __le32 *first, __le32 *last)
+{
+        __le32 *p;
+        if (try_to_extend_transaction(handle, inode)) {
+                if (bh) {
+                        BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+                        ext4_journal_dirty_metadata(handle, bh);
+                }
+                ext4_mark_inode_dirty(handle, inode);
+                ext4_journal_test_restart(handle, inode);
+                if (bh) {
+                        BUFFER_TRACE(bh, "retaking write access");
+                        ext4_journal_get_write_access(handle, bh);
+                }
+        }
+
+        /*
+         * Any buffers which are on the journal will be in memory. We find
+         * them on the hash table so jbd2_journal_revoke() will run jbd2_journal_forget()
+         * on them.  We've already detached each block from the file, so
+         * bforget() in jbd2_journal_forget() should be safe.
+         *
+         * AKPM: turn on bforget in jbd2_journal_forget()!!!
+         */
+        for (p = first; p < last; p++) {
+                u32 nr = le32_to_cpu(*p);
+                if (nr) {
+                        struct buffer_head *bh;
+
+                        *p = 0;
+                        bh = sb_find_get_block(inode->i_sb, nr);
+                        ext4_forget(handle, 0, inode, bh, nr);
+                }
+        }
+
+        ext4_free_blocks(handle, inode, block_to_free, count);
+}
+
+/**
+ * ext4_free_data - free a list of data blocks
+ * @handle:     handle for this transaction
+ * @inode:      inode we are dealing with
+ * @this_bh:    indirect buffer_head which contains *@first and *@last
+ * @first:      array of block numbers
+ * @last:       points immediately past the end of array
+ *
+ * We are freeing all blocks refered from that array (numbers are stored as
+ * little-endian 32-bit) and updating @inode->i_blocks appropriately.
+ *
+ * We accumulate contiguous runs of blocks to free.  Conveniently, if these
+ * blocks are contiguous then releasing them at one time will only affect one
+ * or two bitmap blocks (+ group descriptor(s) and superblock) and we won't
+ * actually use a lot of journal space.
+ *
+ * @this_bh will be %NULL if @first and @last point into the inode's direct
+ * block pointers.
+ */
+static void ext4_free_data(handle_t *handle, struct inode *inode,
+                           struct buffer_head *this_bh,
+                           __le32 *first, __le32 *last)
+{
+        ext4_fsblk_t block_to_free = 0;    /* Starting block # of a run */
+        unsigned long count = 0;            /* Number of blocks in the run */
+        __le32 *block_to_free_p = NULL;     /* Pointer into inode/ind
+                                               corresponding to
+                                               block_to_free */
+        ext4_fsblk_t nr;                    /* Current block # */
+        __le32 *p;                          /* Pointer into inode/ind
+                                               for current block */
+        int err;
+
+        if (this_bh) {                          /* For indirect block */
+                BUFFER_TRACE(this_bh, "get_write_access");
+                err = ext4_journal_get_write_access(handle, this_bh);
+                /* Important: if we can't update the indirect pointers
+                 * to the blocks, we can't free them. */
+                if (err)
+                        return;
+        }
+
+        for (p = first; p < last; p++) {
+                nr = le32_to_cpu(*p);
+                if (nr) {
+                        /* accumulate blocks to free if they're contiguous */
+                        if (count == 0) {
+                                block_to_free = nr;
+                                block_to_free_p = p;
+                                count = 1;
+                        } else if (nr == block_to_free + count) {
+                                count++;
+                        } else {
+                                ext4_clear_blocks(handle, inode, this_bh,
+                                                  block_to_free,
+                                                  count, block_to_free_p, p);
+                                block_to_free = nr;
+                                block_to_free_p = p;
+                                count = 1;
+                        }
+                }
+        }
+
+        if (count > 0)
+                ext4_clear_blocks(handle, inode, this_bh, block_to_free,
+                                  count, block_to_free_p, p);
+
+        if (this_bh) {
+                BUFFER_TRACE(this_bh, "call ext4_journal_dirty_metadata");
+                ext4_journal_dirty_metadata(handle, this_bh);
+        }
+}
+
+/**
+ *      ext4_free_branches - free an array of branches
+ *      @handle: JBD handle for this transaction
+ *      @inode: inode we are dealing with
+ *      @parent_bh: the buffer_head which contains *@first and *@last
+ *      @first: array of block numbers
+ *      @last:  pointer immediately past the end of array
+ *      @depth: depth of the branches to free
+ *
+ *      We are freeing all blocks refered from these branches (numbers are
+ *      stored as little-endian 32-bit) and updating @inode->i_blocks
+ *      appropriately.
+ */
+static void ext4_free_branches(handle_t *handle, struct inode *inode,
+                               struct buffer_head *parent_bh,
+                               __le32 *first, __le32 *last, int depth)
+{
+        ext4_fsblk_t nr;
+        __le32 *p;
+
+        if (is_handle_aborted(handle))
+                return;
+
+        if (depth--) {
+                struct buffer_head *bh;
+                int addr_per_block = EXT4_ADDR_PER_BLOCK(inode->i_sb);
+                p = last;
+                while (--p >= first) {
+                        nr = le32_to_cpu(*p);
+                        if (!nr)
+                                continue;               /* A hole */
+
+                        /* Go read the buffer for the next level down */
+                        bh = sb_bread(inode->i_sb, nr);
+
+                        /*
+                         * A read failure? Report error and clear slot
+                         * (should be rare).
+                         */
+                        if (!bh) {
+                                ext4_error(inode->i_sb, "ext4_free_branches",
+                                           "Read failure, inode=%lu, block=%llu",
+                                           inode->i_ino, nr);
+                                continue;
+                        }
+
+                        /* This zaps the entire block.  Bottom up. */
+                        BUFFER_TRACE(bh, "free child branches");
+                        ext4_free_branches(handle, inode, bh,
+                                           (__le32*)bh->b_data,
+                                           (__le32*)bh->b_data + addr_per_block,
+                                           depth);
+
+                        /*
+                         * We've probably journalled the indirect block several
+                         * times during the truncate.  But it's no longer
+                         * needed and we now drop it from the transaction via
+                         * jbd2_journal_revoke().
+                         *
+                         * That's easy if it's exclusively part of this
+                         * transaction.  But if it's part of the committing
+                         * transaction then jbd2_journal_forget() will simply
+                         * brelse() it.  That means that if the underlying
+                         * block is reallocated in ext4_get_block(),
+                         * unmap_underlying_metadata() will find this block
+                         * and will try to get rid of it.  damn, damn.
+                         *
+                         * If this block has already been committed to the
+                         * journal, a revoke record will be written.  And
+                         * revoke records must be emitted *before* clearing
+                         * this block's bit in the bitmaps.
+                         */
+                        ext4_forget(handle, 1, inode, bh, bh->b_blocknr);
+
+                        /*
+                         * Everything below this this pointer has been
+                         * released.  Now let this top-of-subtree go.
+                         *
+                         * We want the freeing of this indirect block to be
+                         * atomic in the journal with the updating of the
+                         * bitmap block which owns it.  So make some room in
+                         * the journal.
+                         *
+                         * We zero the parent pointer *after* freeing its
+                         * pointee in the bitmaps, so if extend_transaction()
+                         * for some reason fails to put the bitmap changes and
+                         * the release into the same transaction, recovery
+                         * will merely complain about releasing a free block,
+                         * rather than leaking blocks.
+                         */
+                        if (is_handle_aborted(handle))
+                                return;
+                        if (try_to_extend_transaction(handle, inode)) {
+                                ext4_mark_inode_dirty(handle, inode);
+                                ext4_journal_test_restart(handle, inode);
+                        }
+
+                        ext4_free_blocks(handle, inode, nr, 1);
+
+                        if (parent_bh) {
+                                /*
+                                 * The block which we have just freed is
+                                 * pointed to by an indirect block: journal it
+                                 */
+                                BUFFER_TRACE(parent_bh, "get_write_access");
+                                if (!ext4_journal_get_write_access(handle,
+                                                                   parent_bh)){
+                                        *p = 0;
+                                        BUFFER_TRACE(parent_bh,
+                                        "call ext4_journal_dirty_metadata");
+                                        ext4_journal_dirty_metadata(handle,
+                                                                    parent_bh);
+                                }
+                        }
+                }
+        } else {
+                /* We have reached the bottom of the tree. */
+                BUFFER_TRACE(parent_bh, "free data blocks");
+                ext4_free_data(handle, inode, parent_bh, first, last);
+        }
+}
+
+/*
+ * ext4_truncate()
+ *
+ * We block out ext4_get_block() block instantiations across the entire
+ * transaction, and VFS/VM ensures that ext4_truncate() cannot run
+ * simultaneously on behalf of the same inode.
+ *
+ * As we work through the truncate and commmit bits of it to the journal there
+ * is one core, guiding principle: the file's tree must always be consistent on
+ * disk.  We must be able to restart the truncate after a crash.
+ *
+ * The file's tree may be transiently inconsistent in memory (although it
+ * probably isn't), but whenever we close off and commit a journal transaction,
+ * the contents of (the filesystem + the journal) must be consistent and
+ * restartable.  It's pretty simple, really: bottom up, right to left (although
+ * left-to-right works OK too).
+ *
+ * Note that at recovery time, journal replay occurs *before* the restart of
+ * truncate against the orphan inode list.
+ *
+ * The committed inode has the new, desired i_size (which is the same as
+ * i_disksize in this case).  After a crash, ext4_orphan_cleanup() will see
+ * that this inode's truncate did not complete and it will again call
+ * ext4_truncate() to have another go.  So there will be instantiated blocks
+ * to the right of the truncation point in a crashed ext4 filesystem.  But
+ * that's fine - as long as they are linked from the inode, the post-crash
+ * ext4_truncate() run will find them and release them.
+ */
+void ext4_truncate(struct inode *inode)
+{
+        handle_t *handle;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        __le32 *i_data = ei->i_data;
+        int addr_per_block = EXT4_ADDR_PER_BLOCK(inode->i_sb);
+        struct address_space *mapping = inode->i_mapping;
+        int offsets[4];
+        Indirect chain[4];
+        Indirect *partial;
+        __le32 nr = 0;
+        int n;
+        long last_block;
+        unsigned blocksize = inode->i_sb->s_blocksize;
+        struct page *page;
+
+        if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+            S_ISLNK(inode->i_mode)))
+                return;
+        if (ext4_inode_is_fast_symlink(inode))
+                return;
+        if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
+                return;
+
+        /*
+         * We have to lock the EOF page here, because lock_page() nests
+         * outside jbd2_journal_start().
+         */
+        if ((inode->i_size & (blocksize - 1)) == 0) {
+                /* Block boundary? Nothing to do */
+                page = NULL;
+        } else {
+                page = grab_cache_page(mapping,
+                                inode->i_size >> PAGE_CACHE_SHIFT);
+                if (!page)
+                        return;
+        }
+
+        if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+                return ext4_ext_truncate(inode, page);
+
+        handle = start_transaction(inode);
+        if (IS_ERR(handle)) {
+                if (page) {
+                        clear_highpage(page);
+                        flush_dcache_page(page);
+                        unlock_page(page);
+                        page_cache_release(page);
+                }
+                return;         /* AKPM: return what? */
+        }
+
+        last_block = (inode->i_size + blocksize-1)
+                                        >> EXT4_BLOCK_SIZE_BITS(inode->i_sb);
+
+        if (page)
+                ext4_block_truncate_page(handle, page, mapping, inode->i_size);
+
+        n = ext4_block_to_path(inode, last_block, offsets, NULL);
+        if (n == 0)
+                goto out_stop;  /* error */
+
+        /*
+         * OK.  This truncate is going to happen.  We add the inode to the
+         * orphan list, so that if this truncate spans multiple transactions,
+         * and we crash, we will resume the truncate when the filesystem
+         * recovers.  It also marks the inode dirty, to catch the new size.
+         *
+         * Implication: the file must always be in a sane, consistent
+         * truncatable state while each transaction commits.
+         */
+        if (ext4_orphan_add(handle, inode))
+                goto out_stop;
+
+        /*
+         * The orphan list entry will now protect us from any crash which
+         * occurs before the truncate completes, so it is now safe to propagate
+         * the new, shorter inode size (held for now in i_size) into the
+         * on-disk inode. We do this via i_disksize, which is the value which
+         * ext4 *really* writes onto the disk inode.
+         */
+        ei->i_disksize = inode->i_size;
+
+        /*
+         * From here we block out all ext4_get_block() callers who want to
+         * modify the block allocation tree.
+         */
+        mutex_lock(&ei->truncate_mutex);
+
+        if (n == 1) {           /* direct blocks */
+                ext4_free_data(handle, inode, NULL, i_data+offsets[0],
+                               i_data + EXT4_NDIR_BLOCKS);
+                goto do_indirects;
+        }
+
+        partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+        /* Kill the top of shared branch (not detached) */
+        if (nr) {
+                if (partial == chain) {
+                        /* Shared branch grows from the inode */
+                        ext4_free_branches(handle, inode, NULL,
+                                           &nr, &nr+1, (chain+n-1) - partial);
+                        *partial->p = 0;
+                        /*
+                         * We mark the inode dirty prior to restart,
+                         * and prior to stop.  No need for it here.
+                         */
+                } else {
+                        /* Shared branch grows from an indirect block */
+                        BUFFER_TRACE(partial->bh, "get_write_access");
+                        ext4_free_branches(handle, inode, partial->bh,
+                                        partial->p,
+                                        partial->p+1, (chain+n-1) - partial);
+                }
+        }
+        /* Clear the ends of indirect blocks on the shared branch */
+        while (partial > chain) {
+                ext4_free_branches(handle, inode, partial->bh, partial->p + 1,
+                                   (__le32*)partial->bh->b_data+addr_per_block,
+                                   (chain+n-1) - partial);
+                BUFFER_TRACE(partial->bh, "call brelse");
+                brelse (partial->bh);
+                partial--;
+        }
+do_indirects:
+        /* Kill the remaining (whole) subtrees */
+        switch (offsets[0]) {
+        default:
+                nr = i_data[EXT4_IND_BLOCK];
+                if (nr) {
+                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
+                        i_data[EXT4_IND_BLOCK] = 0;
+                }
+        case EXT4_IND_BLOCK:
+                nr = i_data[EXT4_DIND_BLOCK];
+                if (nr) {
+                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
+                        i_data[EXT4_DIND_BLOCK] = 0;
+                }
+        case EXT4_DIND_BLOCK:
+                nr = i_data[EXT4_TIND_BLOCK];
+                if (nr) {
+                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
+                        i_data[EXT4_TIND_BLOCK] = 0;
+                }
+        case EXT4_TIND_BLOCK:
+                ;
+        }
+
+        ext4_discard_reservation(inode);
+
+        mutex_unlock(&ei->truncate_mutex);
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME_SEC;
+        ext4_mark_inode_dirty(handle, inode);
+
+        /*
+         * In a multi-transaction truncate, we only make the final transaction
+         * synchronous
+         */
+        if (IS_SYNC(inode))
+                handle->h_sync = 1;
+out_stop:
+        /*
+         * If this was a simple ftruncate(), and the file will remain alive
+         * then we need to clear up the orphan record which we created above.
+         * However, if this was a real unlink then we were called by
+         * ext4_delete_inode(), and we allow that function to clean up the
+         * orphan info for us.
+         */
+        if (inode->i_nlink)
+                ext4_orphan_del(handle, inode);
+
+        ext4_journal_stop(handle);
+}
+
+static ext4_fsblk_t ext4_get_inode_block(struct super_block *sb,
+                unsigned long ino, struct ext4_iloc *iloc)
+{
+        unsigned long desc, group_desc, block_group;
+        unsigned long offset;
+        ext4_fsblk_t block;
+        struct buffer_head *bh;
+        struct ext4_group_desc * gdp;
+
+        if (!ext4_valid_inum(sb, ino)) {
+                /*
+                 * This error is already checked for in namei.c unless we are
+                 * looking at an NFS filehandle, in which case no error
+                 * report is needed
+                 */
+                return 0;
+        }
+
+        block_group = (ino - 1) / EXT4_INODES_PER_GROUP(sb);
+        if (block_group >= EXT4_SB(sb)->s_groups_count) {
+                ext4_error(sb,"ext4_get_inode_block","group >= groups count");
+                return 0;
+        }
+        smp_rmb();
+        group_desc = block_group >> EXT4_DESC_PER_BLOCK_BITS(sb);
+        desc = block_group & (EXT4_DESC_PER_BLOCK(sb) - 1);
+        bh = EXT4_SB(sb)->s_group_desc[group_desc];
+        if (!bh) {
+                ext4_error (sb, "ext4_get_inode_block",
+                            "Descriptor not loaded");
+                return 0;
+        }
+
+        gdp = (struct ext4_group_desc *)((__u8 *)bh->b_data +
+                desc * EXT4_DESC_SIZE(sb));
+        /*
+         * Figure out the offset within the block group inode table
+         */
+        offset = ((ino - 1) % EXT4_INODES_PER_GROUP(sb)) *
+                EXT4_INODE_SIZE(sb);
+        block = ext4_inode_table(sb, gdp) +
+                (offset >> EXT4_BLOCK_SIZE_BITS(sb));
+
+        iloc->block_group = block_group;
+        iloc->offset = offset & (EXT4_BLOCK_SIZE(sb) - 1);
+        return block;
+}
+
+/*
+ * ext4_get_inode_loc returns with an extra refcount against the inode's
+ * underlying buffer_head on success. If 'in_mem' is true, we have all
+ * data in memory that is needed to recreate the on-disk version of this
+ * inode.
+ */
+static int __ext4_get_inode_loc(struct inode *inode,
+                                struct ext4_iloc *iloc, int in_mem)
+{
+        ext4_fsblk_t block;
+        struct buffer_head *bh;
+
+        block = ext4_get_inode_block(inode->i_sb, inode->i_ino, iloc);
+        if (!block)
+                return -EIO;
+
+        bh = sb_getblk(inode->i_sb, block);
+        if (!bh) {
+                ext4_error (inode->i_sb, "ext4_get_inode_loc",
+                                "unable to read inode block - "
+                                "inode=%lu, block=%llu",
+                                 inode->i_ino, block);
+                return -EIO;
+        }
+        if (!buffer_uptodate(bh)) {
+                lock_buffer(bh);
+                if (buffer_uptodate(bh)) {
+                        /* someone brought it uptodate while we waited */
+                        unlock_buffer(bh);
+                        goto has_buffer;
+                }
+
+                /*
+                 * If we have all information of the inode in memory and this
+                 * is the only valid inode in the block, we need not read the
+                 * block.
+                 */
+                if (in_mem) {
+                        struct buffer_head *bitmap_bh;
+                        struct ext4_group_desc *desc;
+                        int inodes_per_buffer;
+                        int inode_offset, i;
+                        int block_group;
+                        int start;
+
+                        block_group = (inode->i_ino - 1) /
+                                        EXT4_INODES_PER_GROUP(inode->i_sb);
+                        inodes_per_buffer = bh->b_size /
+                                EXT4_INODE_SIZE(inode->i_sb);
+                        inode_offset = ((inode->i_ino - 1) %
+                                        EXT4_INODES_PER_GROUP(inode->i_sb));
+                        start = inode_offset & ~(inodes_per_buffer - 1);
+
+                        /* Is the inode bitmap in cache? */
+                        desc = ext4_get_group_desc(inode->i_sb,
+                                                block_group, NULL);
+                        if (!desc)
+                                goto make_io;
+
+                        bitmap_bh = sb_getblk(inode->i_sb,
+                                ext4_inode_bitmap(inode->i_sb, desc));
+                        if (!bitmap_bh)
+                                goto make_io;
+
+                        /*
+                         * If the inode bitmap isn't in cache then the
+                         * optimisation may end up performing two reads instead
+                         * of one, so skip it.
+                         */
+                        if (!buffer_uptodate(bitmap_bh)) {
+                                brelse(bitmap_bh);
+                                goto make_io;
+                        }
+                        for (i = start; i < start + inodes_per_buffer; i++) {
+                                if (i == inode_offset)
+                                        continue;
+                                if (ext4_test_bit(i, bitmap_bh->b_data))
+                                        break;
+                        }
+                        brelse(bitmap_bh);
+                        if (i == start + inodes_per_buffer) {
+                                /* all other inodes are free, so skip I/O */
+                                memset(bh->b_data, 0, bh->b_size);
+                                set_buffer_uptodate(bh);
+                                unlock_buffer(bh);
+                                goto has_buffer;
+                        }
+                }
+
+make_io:
+                /*
+                 * There are other valid inodes in the buffer, this inode
+                 * has in-inode xattrs, or we don't have this inode in memory.
+                 * Read the block from disk.
+                 */
+                get_bh(bh);
+                bh->b_end_io = end_buffer_read_sync;
+                submit_bh(READ_META, bh);
+                wait_on_buffer(bh);
+                if (!buffer_uptodate(bh)) {
+                        ext4_error(inode->i_sb, "ext4_get_inode_loc",
+                                        "unable to read inode block - "
+                                        "inode=%lu, block=%llu",
+                                        inode->i_ino, block);
+                        brelse(bh);
+                        return -EIO;
+                }
+        }
+has_buffer:
+        iloc->bh = bh;
+        return 0;
+}
+
+int ext4_get_inode_loc(struct inode *inode, struct ext4_iloc *iloc)
+{
+        /* We have all inode data except xattrs in memory here. */
+        return __ext4_get_inode_loc(inode, iloc,
+                !(EXT4_I(inode)->i_state & EXT4_STATE_XATTR));
+}
+
+void ext4_set_inode_flags(struct inode *inode)
+{
+        unsigned int flags = EXT4_I(inode)->i_flags;
+
+        inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+        if (flags & EXT4_SYNC_FL)
+                inode->i_flags |= S_SYNC;
+        if (flags & EXT4_APPEND_FL)
+                inode->i_flags |= S_APPEND;
+        if (flags & EXT4_IMMUTABLE_FL)
+                inode->i_flags |= S_IMMUTABLE;
+        if (flags & EXT4_NOATIME_FL)
+                inode->i_flags |= S_NOATIME;
+        if (flags & EXT4_DIRSYNC_FL)
+                inode->i_flags |= S_DIRSYNC;
+}
+
+void ext4_read_inode(struct inode * inode)
+{
+        struct ext4_iloc iloc;
+        struct ext4_inode *raw_inode;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct buffer_head *bh;
+        int block;
+
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        ei->i_acl = EXT4_ACL_NOT_CACHED;
+        ei->i_default_acl = EXT4_ACL_NOT_CACHED;
+#endif
+        ei->i_block_alloc_info = NULL;
+
+        if (__ext4_get_inode_loc(inode, &iloc, 0))
+                goto bad_inode;
+        bh = iloc.bh;
+        raw_inode = ext4_raw_inode(&iloc);
+        inode->i_mode = le16_to_cpu(raw_inode->i_mode);
+        inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
+        inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
+        if(!(test_opt (inode->i_sb, NO_UID32))) {
+                inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
+                inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
+        }
+        inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
+        inode->i_size = le32_to_cpu(raw_inode->i_size);
+        inode->i_atime.tv_sec = le32_to_cpu(raw_inode->i_atime);
+        inode->i_ctime.tv_sec = le32_to_cpu(raw_inode->i_ctime);
+        inode->i_mtime.tv_sec = le32_to_cpu(raw_inode->i_mtime);
+        inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec = inode->i_mtime.tv_nsec = 0;
+
+        ei->i_state = 0;
+        ei->i_dir_start_lookup = 0;
+        ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
+        /* We now have enough fields to check if the inode was active or not.
+         * This is needed because nfsd might try to access dead inodes
+         * the test is that same one that e2fsck uses
+         * NeilBrown 1999oct15
+         */
+        if (inode->i_nlink == 0) {
+                if (inode->i_mode == 0 ||
+                    !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) {
+                        /* this inode is deleted */
+                        brelse (bh);
+                        goto bad_inode;
+                }
+                /* The only unlinked inodes we let through here have
+                 * valid i_mode and are being read by the orphan
+                 * recovery code: that's fine, we're about to complete
+                 * the process of deleting those. */
+        }
+        inode->i_blocks = le32_to_cpu(raw_inode->i_blocks);
+        ei->i_flags = le32_to_cpu(raw_inode->i_flags);
+#ifdef EXT4_FRAGMENTS
+        ei->i_faddr = le32_to_cpu(raw_inode->i_faddr);
+        ei->i_frag_no = raw_inode->i_frag;
+        ei->i_frag_size = raw_inode->i_fsize;
+#endif
+        ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl);
+        if (EXT4_SB(inode->i_sb)->s_es->s_creator_os !=
+            cpu_to_le32(EXT4_OS_HURD))
+                ei->i_file_acl |=
+                        ((__u64)le16_to_cpu(raw_inode->i_file_acl_high)) << 32;
+        if (!S_ISREG(inode->i_mode)) {
+                ei->i_dir_acl = le32_to_cpu(raw_inode->i_dir_acl);
+        } else {
+                inode->i_size |=
+                        ((__u64)le32_to_cpu(raw_inode->i_size_high)) << 32;
+        }
+        ei->i_disksize = inode->i_size;
+        inode->i_generation = le32_to_cpu(raw_inode->i_generation);
+        ei->i_block_group = iloc.block_group;
+        /*
+         * NOTE! The in-memory inode i_data array is in little-endian order
+         * even on big-endian machines: we do NOT byteswap the block numbers!
+         */
+        for (block = 0; block < EXT4_N_BLOCKS; block++)
+                ei->i_data[block] = raw_inode->i_block[block];
+        INIT_LIST_HEAD(&ei->i_orphan);
+
+        if (inode->i_ino >= EXT4_FIRST_INO(inode->i_sb) + 1 &&
+            EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) {
+                /*
+                 * When mke2fs creates big inodes it does not zero out
+                 * the unused bytes above EXT4_GOOD_OLD_INODE_SIZE,
+                 * so ignore those first few inodes.
+                 */
+                ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize);
+                if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
+                    EXT4_INODE_SIZE(inode->i_sb))
+                        goto bad_inode;
+                if (ei->i_extra_isize == 0) {
+                        /* The extra space is currently unused. Use it. */
+                        ei->i_extra_isize = sizeof(struct ext4_inode) -
+                                            EXT4_GOOD_OLD_INODE_SIZE;
+                } else {
+                        __le32 *magic = (void *)raw_inode +
+                                        EXT4_GOOD_OLD_INODE_SIZE +
+                                        ei->i_extra_isize;
+                        if (*magic == cpu_to_le32(EXT4_XATTR_MAGIC))
+                                 ei->i_state |= EXT4_STATE_XATTR;
+                }
+        } else
+                ei->i_extra_isize = 0;
+
+        if (S_ISREG(inode->i_mode)) {
+                inode->i_op = &ext4_file_inode_operations;
+                inode->i_fop = &ext4_file_operations;
+                ext4_set_aops(inode);
+        } else if (S_ISDIR(inode->i_mode)) {
+                inode->i_op = &ext4_dir_inode_operations;
+                inode->i_fop = &ext4_dir_operations;
+        } else if (S_ISLNK(inode->i_mode)) {
+                if (ext4_inode_is_fast_symlink(inode))
+                        inode->i_op = &ext4_fast_symlink_inode_operations;
+                else {
+                        inode->i_op = &ext4_symlink_inode_operations;
+                        ext4_set_aops(inode);
+                }
+        } else {
+                inode->i_op = &ext4_special_inode_operations;
+                if (raw_inode->i_block[0])
+                        init_special_inode(inode, inode->i_mode,
+                           old_decode_dev(le32_to_cpu(raw_inode->i_block[0])));
+                else
+                        init_special_inode(inode, inode->i_mode,
+                           new_decode_dev(le32_to_cpu(raw_inode->i_block[1])));
+        }
+        brelse (iloc.bh);
+        ext4_set_inode_flags(inode);
+        return;
+
+bad_inode:
+        make_bad_inode(inode);
+        return;
+}
+
+/*
+ * Post the struct inode info into an on-disk inode location in the
+ * buffer-cache.  This gobbles the caller's reference to the
+ * buffer_head in the inode location struct.
+ *
+ * The caller must have write access to iloc->bh.
+ */
+static int ext4_do_update_inode(handle_t *handle,
+                                struct inode *inode,
+                                struct ext4_iloc *iloc)
+{
+        struct ext4_inode *raw_inode = ext4_raw_inode(iloc);
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct buffer_head *bh = iloc->bh;
+        int err = 0, rc, block;
+
+        /* For fields not not tracking in the in-memory inode,
+         * initialise them to zero for new inodes. */
+        if (ei->i_state & EXT4_STATE_NEW)
+                memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
+
+        raw_inode->i_mode = cpu_to_le16(inode->i_mode);
+        if(!(test_opt(inode->i_sb, NO_UID32))) {
+                raw_inode->i_uid_low = cpu_to_le16(low_16_bits(inode->i_uid));
+                raw_inode->i_gid_low = cpu_to_le16(low_16_bits(inode->i_gid));
+/*
+ * Fix up interoperability with old kernels. Otherwise, old inodes get
+ * re-used with the upper 16 bits of the uid/gid intact
+ */
+                if(!ei->i_dtime) {
+                        raw_inode->i_uid_high =
+                                cpu_to_le16(high_16_bits(inode->i_uid));
+                        raw_inode->i_gid_high =
+                                cpu_to_le16(high_16_bits(inode->i_gid));
+                } else {
+                        raw_inode->i_uid_high = 0;
+                        raw_inode->i_gid_high = 0;
+                }
+        } else {
+                raw_inode->i_uid_low =
+                        cpu_to_le16(fs_high2lowuid(inode->i_uid));
+                raw_inode->i_gid_low =
+                        cpu_to_le16(fs_high2lowgid(inode->i_gid));
+                raw_inode->i_uid_high = 0;
+                raw_inode->i_gid_high = 0;
+        }
+        raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
+        raw_inode->i_size = cpu_to_le32(ei->i_disksize);
+        raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
+        raw_inode->i_ctime = cpu_to_le32(inode->i_ctime.tv_sec);
+        raw_inode->i_mtime = cpu_to_le32(inode->i_mtime.tv_sec);
+        raw_inode->i_blocks = cpu_to_le32(inode->i_blocks);
+        raw_inode->i_dtime = cpu_to_le32(ei->i_dtime);
+        raw_inode->i_flags = cpu_to_le32(ei->i_flags);
+#ifdef EXT4_FRAGMENTS
+        raw_inode->i_faddr = cpu_to_le32(ei->i_faddr);
+        raw_inode->i_frag = ei->i_frag_no;
+        raw_inode->i_fsize = ei->i_frag_size;
+#endif
+        if (EXT4_SB(inode->i_sb)->s_es->s_creator_os !=
+            cpu_to_le32(EXT4_OS_HURD))
+                raw_inode->i_file_acl_high =
+                        cpu_to_le16(ei->i_file_acl >> 32);
+        raw_inode->i_file_acl = cpu_to_le32(ei->i_file_acl);
+        if (!S_ISREG(inode->i_mode)) {
+                raw_inode->i_dir_acl = cpu_to_le32(ei->i_dir_acl);
+        } else {
+                raw_inode->i_size_high =
+                        cpu_to_le32(ei->i_disksize >> 32);
+                if (ei->i_disksize > 0x7fffffffULL) {
+                        struct super_block *sb = inode->i_sb;
+                        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                        EXT4_FEATURE_RO_COMPAT_LARGE_FILE) ||
+                            EXT4_SB(sb)->s_es->s_rev_level ==
+                                        cpu_to_le32(EXT4_GOOD_OLD_REV)) {
+                               /* If this is the first large file
+                                * created, add a flag to the superblock.
+                                */
+                                err = ext4_journal_get_write_access(handle,
+                                                EXT4_SB(sb)->s_sbh);
+                                if (err)
+                                        goto out_brelse;
+                                ext4_update_dynamic_rev(sb);
+                                EXT4_SET_RO_COMPAT_FEATURE(sb,
+                                        EXT4_FEATURE_RO_COMPAT_LARGE_FILE);
+                                sb->s_dirt = 1;
+                                handle->h_sync = 1;
+                                err = ext4_journal_dirty_metadata(handle,
+                                                EXT4_SB(sb)->s_sbh);
+                        }
+                }
+        }
+        raw_inode->i_generation = cpu_to_le32(inode->i_generation);
+        if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode)) {
+                if (old_valid_dev(inode->i_rdev)) {
+                        raw_inode->i_block[0] =
+                                cpu_to_le32(old_encode_dev(inode->i_rdev));
+                        raw_inode->i_block[1] = 0;
+                } else {
+                        raw_inode->i_block[0] = 0;
+                        raw_inode->i_block[1] =
+                                cpu_to_le32(new_encode_dev(inode->i_rdev));
+                        raw_inode->i_block[2] = 0;
+                }
+        } else for (block = 0; block < EXT4_N_BLOCKS; block++)
+                raw_inode->i_block[block] = ei->i_data[block];
+
+        if (ei->i_extra_isize)
+                raw_inode->i_extra_isize = cpu_to_le16(ei->i_extra_isize);
+
+        BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+        rc = ext4_journal_dirty_metadata(handle, bh);
+        if (!err)
+                err = rc;
+        ei->i_state &= ~EXT4_STATE_NEW;
+
+out_brelse:
+        brelse (bh);
+        ext4_std_error(inode->i_sb, err);
+        return err;
+}
+
+/*
+ * ext4_write_inode()
+ *
+ * We are called from a few places:
+ *
+ * - Within generic_file_write() for O_SYNC files.
+ *   Here, there will be no transaction running. We wait for any running
+ *   trasnaction to commit.
+ *
+ * - Within sys_sync(), kupdate and such.
+ *   We wait on commit, if tol to.
+ *
+ * - Within prune_icache() (PF_MEMALLOC == true)
+ *   Here we simply return.  We can't afford to block kswapd on the
+ *   journal commit.
+ *
+ * In all cases it is actually safe for us to return without doing anything,
+ * because the inode has been copied into a raw inode buffer in
+ * ext4_mark_inode_dirty().  This is a correctness thing for O_SYNC and for
+ * knfsd.
+ *
+ * Note that we are absolutely dependent upon all inode dirtiers doing the
+ * right thing: they *must* call mark_inode_dirty() after dirtying info in
+ * which we are interested.
+ *
+ * It would be a bug for them to not do this.  The code:
+ *
+ *      mark_inode_dirty(inode)
+ *      stuff();
+ *      inode->i_size = expr;
+ *
+ * is in error because a kswapd-driven write_inode() could occur while
+ * `stuff()' is running, and the new i_size will be lost.  Plus the inode
+ * will no longer be on the superblock's dirty inode list.
+ */
+int ext4_write_inode(struct inode *inode, int wait)
+{
+        if (current->flags & PF_MEMALLOC)
+                return 0;
+
+        if (ext4_journal_current_handle()) {
+                jbd_debug(0, "called recursively, non-PF_MEMALLOC!\n");
+                dump_stack();
+                return -EIO;
+        }
+
+        if (!wait)
+                return 0;
+
+        return ext4_force_commit(inode->i_sb);
+}
+
+/*
+ * ext4_setattr()
+ *
+ * Called from notify_change.
+ *
+ * We want to trap VFS attempts to truncate the file as soon as
+ * possible.  In particular, we want to make sure that when the VFS
+ * shrinks i_size, we put the inode on the orphan list and modify
+ * i_disksize immediately, so that during the subsequent flushing of
+ * dirty pages and freeing of disk blocks, we can guarantee that any
+ * commit will leave the blocks being flushed in an unused state on
+ * disk.  (On recovery, the inode will get truncated and the blocks will
+ * be freed, so we have a strong guarantee that no future commit will
+ * leave these blocks visible to the user.)
+ *
+ * Called with inode->sem down.
+ */
+int ext4_setattr(struct dentry *dentry, struct iattr *attr)
+{
+        struct inode *inode = dentry->d_inode;
+        int error, rc = 0;
+        const unsigned int ia_valid = attr->ia_valid;
+
+        error = inode_change_ok(inode, attr);
+        if (error)
+                return error;
+
+        if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
+                (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
+                handle_t *handle;
+
+                /* (user+group)*(old+new) structure, inode write (sb,
+                 * inode block, ? - but truncate inode update has it) */
+                handle = ext4_journal_start(inode, 2*(EXT4_QUOTA_INIT_BLOCKS(inode->i_sb)+
+                                        EXT4_QUOTA_DEL_BLOCKS(inode->i_sb))+3);
+                if (IS_ERR(handle)) {
+                        error = PTR_ERR(handle);
+                        goto err_out;
+                }
+                error = DQUOT_TRANSFER(inode, attr) ? -EDQUOT : 0;
+                if (error) {
+                        ext4_journal_stop(handle);
+                        return error;
+                }
+                /* Update corresponding info in inode so that everything is in
+                 * one transaction */
+                if (attr->ia_valid & ATTR_UID)
+                        inode->i_uid = attr->ia_uid;
+                if (attr->ia_valid & ATTR_GID)
+                        inode->i_gid = attr->ia_gid;
+                error = ext4_mark_inode_dirty(handle, inode);
+                ext4_journal_stop(handle);
+        }
+
+        if (S_ISREG(inode->i_mode) &&
+            attr->ia_valid & ATTR_SIZE && attr->ia_size < inode->i_size) {
+                handle_t *handle;
+
+                handle = ext4_journal_start(inode, 3);
+                if (IS_ERR(handle)) {
+                        error = PTR_ERR(handle);
+                        goto err_out;
+                }
+
+                error = ext4_orphan_add(handle, inode);
+                EXT4_I(inode)->i_disksize = attr->ia_size;
+                rc = ext4_mark_inode_dirty(handle, inode);
+                if (!error)
+                        error = rc;
+                ext4_journal_stop(handle);
+        }
+
+        rc = inode_setattr(inode, attr);
+
+        /* If inode_setattr's call to ext4_truncate failed to get a
+         * transaction handle at all, we need to clean up the in-core
+         * orphan list manually. */
+        if (inode->i_nlink)
+                ext4_orphan_del(NULL, inode);
+
+        if (!rc && (ia_valid & ATTR_MODE))
+                rc = ext4_acl_chmod(inode);
+
+err_out:
+        ext4_std_error(inode->i_sb, error);
+        if (!error)
+                error = rc;
+        return error;
+}
+
+
+/*
+ * How many blocks doth make a writepage()?
+ *
+ * With N blocks per page, it may be:
+ * N data blocks
+ * 2 indirect block
+ * 2 dindirect
+ * 1 tindirect
+ * N+5 bitmap blocks (from the above)
+ * N+5 group descriptor summary blocks
+ * 1 inode block
+ * 1 superblock.
+ * 2 * EXT4_SINGLEDATA_TRANS_BLOCKS for the quote files
+ *
+ * 3 * (N + 5) + 2 + 2 * EXT4_SINGLEDATA_TRANS_BLOCKS
+ *
+ * With ordered or writeback data it's the same, less the N data blocks.
+ *
+ * If the inode's direct blocks can hold an integral number of pages then a
+ * page cannot straddle two indirect blocks, and we can only touch one indirect
+ * and dindirect block, and the "5" above becomes "3".
+ *
+ * This still overestimates under most circumstances.  If we were to pass the
+ * start and end offsets in here as well we could do block_to_path() on each
+ * block and work out the exact number of indirects which are touched.  Pah.
+ */
+
+int ext4_writepage_trans_blocks(struct inode *inode)
+{
+        int bpp = ext4_journal_blocks_per_page(inode);
+        int indirects = (EXT4_NDIR_BLOCKS % bpp) ? 5 : 3;
+        int ret;
+
+        if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+                return ext4_ext_writepage_trans_blocks(inode, bpp);
+
+        if (ext4_should_journal_data(inode))
+                ret = 3 * (bpp + indirects) + 2;
+        else
+                ret = 2 * (bpp + indirects) + 2;
+
+#ifdef CONFIG_QUOTA
+        /* We know that structure was already allocated during DQUOT_INIT so
+         * we will be updating only the data blocks + inodes */
+        ret += 2*EXT4_QUOTA_TRANS_BLOCKS(inode->i_sb);
+#endif
+
+        return ret;
+}
+
+/*
+ * The caller must have previously called ext4_reserve_inode_write().
+ * Give this, we know that the caller already has write access to iloc->bh.
+ */
+int ext4_mark_iloc_dirty(handle_t *handle,
+                struct inode *inode, struct ext4_iloc *iloc)
+{
+        int err = 0;
+
+        /* the do_update_inode consumes one bh->b_count */
+        get_bh(iloc->bh);
+
+        /* ext4_do_update_inode() does jbd2_journal_dirty_metadata */
+        err = ext4_do_update_inode(handle, inode, iloc);
+        put_bh(iloc->bh);
+        return err;
+}
+
+/*
+ * On success, We end up with an outstanding reference count against
+ * iloc->bh.  This _must_ be cleaned up later.
+ */
+
+int
+ext4_reserve_inode_write(handle_t *handle, struct inode *inode,
+                         struct ext4_iloc *iloc)
+{
+        int err = 0;
+        if (handle) {
+                err = ext4_get_inode_loc(inode, iloc);
+                if (!err) {
+                        BUFFER_TRACE(iloc->bh, "get_write_access");
+                        err = ext4_journal_get_write_access(handle, iloc->bh);
+                        if (err) {
+                                brelse(iloc->bh);
+                                iloc->bh = NULL;
+                        }
+                }
+        }
+        ext4_std_error(inode->i_sb, err);
+        return err;
+}
+
+/*
+ * What we do here is to mark the in-core inode as clean with respect to inode
+ * dirtiness (it may still be data-dirty).
+ * This means that the in-core inode may be reaped by prune_icache
+ * without having to perform any I/O.  This is a very good thing,
+ * because *any* task may call prune_icache - even ones which
+ * have a transaction open against a different journal.
+ *
+ * Is this cheating?  Not really.  Sure, we haven't written the
+ * inode out, but prune_icache isn't a user-visible syncing function.
+ * Whenever the user wants stuff synced (sys_sync, sys_msync, sys_fsync)
+ * we start and wait on commits.
+ *
+ * Is this efficient/effective?  Well, we're being nice to the system
+ * by cleaning up our inodes proactively so they can be reaped
+ * without I/O.  But we are potentially leaving up to five seconds'
+ * worth of inodes floating about which prune_icache wants us to
+ * write out.  One way to fix that would be to get prune_icache()
+ * to do a write_super() to free up some memory.  It has the desired
+ * effect.
+ */
+int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
+{
+        struct ext4_iloc iloc;
+        int err;
+
+        might_sleep();
+        err = ext4_reserve_inode_write(handle, inode, &iloc);
+        if (!err)
+                err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+        return err;
+}
+
+/*
+ * ext4_dirty_inode() is called from __mark_inode_dirty()
+ *
+ * We're really interested in the case where a file is being extended.
+ * i_size has been changed by generic_commit_write() and we thus need
+ * to include the updated inode in the current transaction.
+ *
+ * Also, DQUOT_ALLOC_SPACE() will always dirty the inode when blocks
+ * are allocated to the file.
+ *
+ * If the inode is marked synchronous, we don't honour that here - doing
+ * so would cause a commit on atime updates, which we don't bother doing.
+ * We handle synchronous inodes at the highest possible level.
+ */
+void ext4_dirty_inode(struct inode *inode)
+{
+        handle_t *current_handle = ext4_journal_current_handle();
+        handle_t *handle;
+
+        handle = ext4_journal_start(inode, 2);
+        if (IS_ERR(handle))
+                goto out;
+        if (current_handle &&
+                current_handle->h_transaction != handle->h_transaction) {
+                /* This task has a transaction open against a different fs */
+                printk(KERN_EMERG "%s: transactions do not match!\n",
+                       __FUNCTION__);
+        } else {
+                jbd_debug(5, "marking dirty.  outer handle=%p\n",
+                                current_handle);
+                ext4_mark_inode_dirty(handle, inode);
+        }
+        ext4_journal_stop(handle);
+out:
+        return;
+}
+
+#if 0
+/*
+ * Bind an inode's backing buffer_head into this transaction, to prevent
+ * it from being flushed to disk early.  Unlike
+ * ext4_reserve_inode_write, this leaves behind no bh reference and
+ * returns no iloc structure, so the caller needs to repeat the iloc
+ * lookup to mark the inode dirty later.
+ */
+static int ext4_pin_inode(handle_t *handle, struct inode *inode)
+{
+        struct ext4_iloc iloc;
+
+        int err = 0;
+        if (handle) {
+                err = ext4_get_inode_loc(inode, &iloc);
+                if (!err) {
+                        BUFFER_TRACE(iloc.bh, "get_write_access");
+                        err = jbd2_journal_get_write_access(handle, iloc.bh);
+                        if (!err)
+                                err = ext4_journal_dirty_metadata(handle,
+                                                                  iloc.bh);
+                        brelse(iloc.bh);
+                }
+        }
+        ext4_std_error(inode->i_sb, err);
+        return err;
+}
+#endif
+
+int ext4_change_inode_journal_flag(struct inode *inode, int val)
+{
+        journal_t *journal;
+        handle_t *handle;
+        int err;
+
+        /*
+         * We have to be very careful here: changing a data block's
+         * journaling status dynamically is dangerous.  If we write a
+         * data block to the journal, change the status and then delete
+         * that block, we risk forgetting to revoke the old log record
+         * from the journal and so a subsequent replay can corrupt data.
+         * So, first we make sure that the journal is empty and that
+         * nobody is changing anything.
+         */
+
+        journal = EXT4_JOURNAL(inode);
+        if (is_journal_aborted(journal) || IS_RDONLY(inode))
+                return -EROFS;
+
+        jbd2_journal_lock_updates(journal);
+        jbd2_journal_flush(journal);
+
+        /*
+         * OK, there are no updates running now, and all cached data is
+         * synced to disk.  We are now in a completely consistent state
+         * which doesn't have anything in the journal, and we know that
+         * no filesystem updates are running, so it is safe to modify
+         * the inode's in-core data-journaling state flag now.
+         */
+
+        if (val)
+                EXT4_I(inode)->i_flags |= EXT4_JOURNAL_DATA_FL;
+        else
+                EXT4_I(inode)->i_flags &= ~EXT4_JOURNAL_DATA_FL;
+        ext4_set_aops(inode);
+
+        jbd2_journal_unlock_updates(journal);
+
+        /* Finally we can mark the inode as dirty. */
+
+        handle = ext4_journal_start(inode, 1);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        err = ext4_mark_inode_dirty(handle, inode);
+        handle->h_sync = 1;
+        ext4_journal_stop(handle);
+        ext4_std_error(inode->i_sb, err);
+
+        return err;
+}
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
new file mode 100644
index 000000000000..22a737c306c7
--- /dev/null
+++ b/fs/ext4/ioctl.c
@@ -0,0 +1,306 @@
+/*
+ * linux/fs/ext4/ioctl.c
+ *
+ * Copyright (C) 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ */
+
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/capability.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/time.h>
+#include <linux/compat.h>
+#include <linux/smp_lock.h>
+#include <asm/uaccess.h>
+
+int ext4_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
+                unsigned long arg)
+{
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        unsigned int flags;
+        unsigned short rsv_window_size;
+
+        ext4_debug ("cmd = %u, arg = %lu\n", cmd, arg);
+
+        switch (cmd) {
+        case EXT4_IOC_GETFLAGS:
+                flags = ei->i_flags & EXT4_FL_USER_VISIBLE;
+                return put_user(flags, (int __user *) arg);
+        case EXT4_IOC_SETFLAGS: {
+                handle_t *handle = NULL;
+                int err;
+                struct ext4_iloc iloc;
+                unsigned int oldflags;
+                unsigned int jflag;
+
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+
+                if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
+                        return -EACCES;
+
+                if (get_user(flags, (int __user *) arg))
+                        return -EFAULT;
+
+                if (!S_ISDIR(inode->i_mode))
+                        flags &= ~EXT4_DIRSYNC_FL;
+
+                mutex_lock(&inode->i_mutex);
+                oldflags = ei->i_flags;
+
+                /* The JOURNAL_DATA flag is modifiable only by root */
+                jflag = flags & EXT4_JOURNAL_DATA_FL;
+
+                /*
+                 * The IMMUTABLE and APPEND_ONLY flags can only be changed by
+                 * the relevant capability.
+                 *
+                 * This test looks nicer. Thanks to Pauline Middelink
+                 */
+                if ((flags ^ oldflags) & (EXT4_APPEND_FL | EXT4_IMMUTABLE_FL)) {
+                        if (!capable(CAP_LINUX_IMMUTABLE)) {
+                                mutex_unlock(&inode->i_mutex);
+                                return -EPERM;
+                        }
+                }
+
+                /*
+                 * The JOURNAL_DATA flag can only be changed by
+                 * the relevant capability.
+                 */
+                if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL)) {
+                        if (!capable(CAP_SYS_RESOURCE)) {
+                                mutex_unlock(&inode->i_mutex);
+                                return -EPERM;
+                        }
+                }
+
+
+                handle = ext4_journal_start(inode, 1);
+                if (IS_ERR(handle)) {
+                        mutex_unlock(&inode->i_mutex);
+                        return PTR_ERR(handle);
+                }
+                if (IS_SYNC(inode))
+                        handle->h_sync = 1;
+                err = ext4_reserve_inode_write(handle, inode, &iloc);
+                if (err)
+                        goto flags_err;
+
+                flags = flags & EXT4_FL_USER_MODIFIABLE;
+                flags |= oldflags & ~EXT4_FL_USER_MODIFIABLE;
+                ei->i_flags = flags;
+
+                ext4_set_inode_flags(inode);
+                inode->i_ctime = CURRENT_TIME_SEC;
+
+                err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+flags_err:
+                ext4_journal_stop(handle);
+                if (err) {
+                        mutex_unlock(&inode->i_mutex);
+                        return err;
+                }
+
+                if ((jflag ^ oldflags) & (EXT4_JOURNAL_DATA_FL))
+                        err = ext4_change_inode_journal_flag(inode, jflag);
+                mutex_unlock(&inode->i_mutex);
+                return err;
+        }
+        case EXT4_IOC_GETVERSION:
+        case EXT4_IOC_GETVERSION_OLD:
+                return put_user(inode->i_generation, (int __user *) arg);
+        case EXT4_IOC_SETVERSION:
+        case EXT4_IOC_SETVERSION_OLD: {
+                handle_t *handle;
+                struct ext4_iloc iloc;
+                __u32 generation;
+                int err;
+
+                if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
+                        return -EPERM;
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+                if (get_user(generation, (int __user *) arg))
+                        return -EFAULT;
+
+                handle = ext4_journal_start(inode, 1);
+                if (IS_ERR(handle))
+                        return PTR_ERR(handle);
+                err = ext4_reserve_inode_write(handle, inode, &iloc);
+                if (err == 0) {
+                        inode->i_ctime = CURRENT_TIME_SEC;
+                        inode->i_generation = generation;
+                        err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+                }
+                ext4_journal_stop(handle);
+                return err;
+        }
+#ifdef CONFIG_JBD_DEBUG
+        case EXT4_IOC_WAIT_FOR_READONLY:
+                /*
+                 * This is racy - by the time we're woken up and running,
+                 * the superblock could be released.  And the module could
+                 * have been unloaded.  So sue me.
+                 *
+                 * Returns 1 if it slept, else zero.
+                 */
+                {
+                        struct super_block *sb = inode->i_sb;
+                        DECLARE_WAITQUEUE(wait, current);
+                        int ret = 0;
+
+                        set_current_state(TASK_INTERRUPTIBLE);
+                        add_wait_queue(&EXT4_SB(sb)->ro_wait_queue, &wait);
+                        if (timer_pending(&EXT4_SB(sb)->turn_ro_timer)) {
+                                schedule();
+                                ret = 1;
+                        }
+                        remove_wait_queue(&EXT4_SB(sb)->ro_wait_queue, &wait);
+                        return ret;
+                }
+#endif
+        case EXT4_IOC_GETRSVSZ:
+                if (test_opt(inode->i_sb, RESERVATION)
+                        && S_ISREG(inode->i_mode)
+                        && ei->i_block_alloc_info) {
+                        rsv_window_size = ei->i_block_alloc_info->rsv_window_node.rsv_goal_size;
+                        return put_user(rsv_window_size, (int __user *)arg);
+                }
+                return -ENOTTY;
+        case EXT4_IOC_SETRSVSZ: {
+
+                if (!test_opt(inode->i_sb, RESERVATION) ||!S_ISREG(inode->i_mode))
+                        return -ENOTTY;
+
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+
+                if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
+                        return -EACCES;
+
+                if (get_user(rsv_window_size, (int __user *)arg))
+                        return -EFAULT;
+
+                if (rsv_window_size > EXT4_MAX_RESERVE_BLOCKS)
+                        rsv_window_size = EXT4_MAX_RESERVE_BLOCKS;
+
+                /*
+                 * need to allocate reservation structure for this inode
+                 * before set the window size
+                 */
+                mutex_lock(&ei->truncate_mutex);
+                if (!ei->i_block_alloc_info)
+                        ext4_init_block_alloc_info(inode);
+
+                if (ei->i_block_alloc_info){
+                        struct ext4_reserve_window_node *rsv = &ei->i_block_alloc_info->rsv_window_node;
+                        rsv->rsv_goal_size = rsv_window_size;
+                }
+                mutex_unlock(&ei->truncate_mutex);
+                return 0;
+        }
+        case EXT4_IOC_GROUP_EXTEND: {
+                ext4_fsblk_t n_blocks_count;
+                struct super_block *sb = inode->i_sb;
+                int err;
+
+                if (!capable(CAP_SYS_RESOURCE))
+                        return -EPERM;
+
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+
+                if (get_user(n_blocks_count, (__u32 __user *)arg))
+                        return -EFAULT;
+
+                err = ext4_group_extend(sb, EXT4_SB(sb)->s_es, n_blocks_count);
+                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+
+                return err;
+        }
+        case EXT4_IOC_GROUP_ADD: {
+                struct ext4_new_group_data input;
+                struct super_block *sb = inode->i_sb;
+                int err;
+
+                if (!capable(CAP_SYS_RESOURCE))
+                        return -EPERM;
+
+                if (IS_RDONLY(inode))
+                        return -EROFS;
+
+                if (copy_from_user(&input, (struct ext4_new_group_input __user *)arg,
+                                sizeof(input)))
+                        return -EFAULT;
+
+                err = ext4_group_add(sb, &input);
+                jbd2_journal_lock_updates(EXT4_SB(sb)->s_journal);
+                jbd2_journal_flush(EXT4_SB(sb)->s_journal);
+                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+
+                return err;
+        }
+
+        default:
+                return -ENOTTY;
+        }
+}
+
+#ifdef CONFIG_COMPAT
+long ext4_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct inode *inode = file->f_dentry->d_inode;
+        int ret;
+
+        /* These are just misnamed, they actually get/put from/to user an int */
+        switch (cmd) {
+        case EXT4_IOC32_GETFLAGS:
+                cmd = EXT4_IOC_GETFLAGS;
+                break;
+        case EXT4_IOC32_SETFLAGS:
+                cmd = EXT4_IOC_SETFLAGS;
+                break;
+        case EXT4_IOC32_GETVERSION:
+                cmd = EXT4_IOC_GETVERSION;
+                break;
+        case EXT4_IOC32_SETVERSION:
+                cmd = EXT4_IOC_SETVERSION;
+                break;
+        case EXT4_IOC32_GROUP_EXTEND:
+                cmd = EXT4_IOC_GROUP_EXTEND;
+                break;
+        case EXT4_IOC32_GETVERSION_OLD:
+                cmd = EXT4_IOC_GETVERSION_OLD;
+                break;
+        case EXT4_IOC32_SETVERSION_OLD:
+                cmd = EXT4_IOC_SETVERSION_OLD;
+                break;
+#ifdef CONFIG_JBD_DEBUG
+        case EXT4_IOC32_WAIT_FOR_READONLY:
+                cmd = EXT4_IOC_WAIT_FOR_READONLY;
+                break;
+#endif
+        case EXT4_IOC32_GETRSVSZ:
+                cmd = EXT4_IOC_GETRSVSZ;
+                break;
+        case EXT4_IOC32_SETRSVSZ:
+                cmd = EXT4_IOC_SETRSVSZ;
+                break;
+        case EXT4_IOC_GROUP_ADD:
+                break;
+        default:
+                return -ENOIOCTLCMD;
+        }
+        lock_kernel();
+        ret = ext4_ioctl(inode, file, cmd, (unsigned long) compat_ptr(arg));
+        unlock_kernel();
+        return ret;
+}
+#endif
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
new file mode 100644
index 000000000000..8b1bd03d20f5
--- /dev/null
+++ b/fs/ext4/namei.c
@@ -0,0 +1,2395 @@
+/*
+ *  linux/fs/ext4/namei.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/namei.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ *  Directory entry file type support and forward compatibility hooks
+ *      for B-tree directories by Theodore Ts'o (tytso@mit.edu), 1998
+ *  Hash Tree Directory indexing (c)
+ *      Daniel Phillips, 2001
+ *  Hash Tree Directory indexing porting
+ *      Christopher Li, 2002
+ *  Hash Tree Directory indexing cleanup
+ *      Theodore Ts'o, 2002
+ */
+
+#include <linux/fs.h>
+#include <linux/pagemap.h>
+#include <linux/jbd2.h>
+#include <linux/time.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/fcntl.h>
+#include <linux/stat.h>
+#include <linux/string.h>
+#include <linux/quotaops.h>
+#include <linux/buffer_head.h>
+#include <linux/bio.h>
+#include <linux/smp_lock.h>
+
+#include "namei.h"
+#include "xattr.h"
+#include "acl.h"
+
+/*
+ * define how far ahead to read directories while searching them.
+ */
+#define NAMEI_RA_CHUNKS  2
+#define NAMEI_RA_BLOCKS  4
+#define NAMEI_RA_SIZE        (NAMEI_RA_CHUNKS * NAMEI_RA_BLOCKS)
+#define NAMEI_RA_INDEX(c,b)  (((c) * NAMEI_RA_BLOCKS) + (b))
+
+static struct buffer_head *ext4_append(handle_t *handle,
+                                        struct inode *inode,
+                                        u32 *block, int *err)
+{
+        struct buffer_head *bh;
+
+        *block = inode->i_size >> inode->i_sb->s_blocksize_bits;
+
+        if ((bh = ext4_bread(handle, inode, *block, 1, err))) {
+                inode->i_size += inode->i_sb->s_blocksize;
+                EXT4_I(inode)->i_disksize = inode->i_size;
+                ext4_journal_get_write_access(handle,bh);
+        }
+        return bh;
+}
+
+#ifndef assert
+#define assert(test) J_ASSERT(test)
+#endif
+
+#ifndef swap
+#define swap(x, y) do { typeof(x) z = x; x = y; y = z; } while (0)
+#endif
+
+#ifdef DX_DEBUG
+#define dxtrace(command) command
+#else
+#define dxtrace(command)
+#endif
+
+struct fake_dirent
+{
+        __le32 inode;
+        __le16 rec_len;
+        u8 name_len;
+        u8 file_type;
+};
+
+struct dx_countlimit
+{
+        __le16 limit;
+        __le16 count;
+};
+
+struct dx_entry
+{
+        __le32 hash;
+        __le32 block;
+};
+
+/*
+ * dx_root_info is laid out so that if it should somehow get overlaid by a
+ * dirent the two low bits of the hash version will be zero.  Therefore, the
+ * hash version mod 4 should never be 0.  Sincerely, the paranoia department.
+ */
+
+struct dx_root
+{
+        struct fake_dirent dot;
+        char dot_name[4];
+        struct fake_dirent dotdot;
+        char dotdot_name[4];
+        struct dx_root_info
+        {
+                __le32 reserved_zero;
+                u8 hash_version;
+                u8 info_length; /* 8 */
+                u8 indirect_levels;
+                u8 unused_flags;
+        }
+        info;
+        struct dx_entry entries[0];
+};
+
+struct dx_node
+{
+        struct fake_dirent fake;
+        struct dx_entry entries[0];
+};
+
+
+struct dx_frame
+{
+        struct buffer_head *bh;
+        struct dx_entry *entries;
+        struct dx_entry *at;
+};
+
+struct dx_map_entry
+{
+        u32 hash;
+        u32 offs;
+};
+
+#ifdef CONFIG_EXT4_INDEX
+static inline unsigned dx_get_block (struct dx_entry *entry);
+static void dx_set_block (struct dx_entry *entry, unsigned value);
+static inline unsigned dx_get_hash (struct dx_entry *entry);
+static void dx_set_hash (struct dx_entry *entry, unsigned value);
+static unsigned dx_get_count (struct dx_entry *entries);
+static unsigned dx_get_limit (struct dx_entry *entries);
+static void dx_set_count (struct dx_entry *entries, unsigned value);
+static void dx_set_limit (struct dx_entry *entries, unsigned value);
+static unsigned dx_root_limit (struct inode *dir, unsigned infosize);
+static unsigned dx_node_limit (struct inode *dir);
+static struct dx_frame *dx_probe(struct dentry *dentry,
+                                 struct inode *dir,
+                                 struct dx_hash_info *hinfo,
+                                 struct dx_frame *frame,
+                                 int *err);
+static void dx_release (struct dx_frame *frames);
+static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
+                        struct dx_hash_info *hinfo, struct dx_map_entry map[]);
+static void dx_sort_map(struct dx_map_entry *map, unsigned count);
+static struct ext4_dir_entry_2 *dx_move_dirents (char *from, char *to,
+                struct dx_map_entry *offsets, int count);
+static struct ext4_dir_entry_2* dx_pack_dirents (char *base, int size);
+static void dx_insert_block (struct dx_frame *frame, u32 hash, u32 block);
+static int ext4_htree_next_block(struct inode *dir, __u32 hash,
+                                 struct dx_frame *frame,
+                                 struct dx_frame *frames,
+                                 __u32 *start_hash);
+static struct buffer_head * ext4_dx_find_entry(struct dentry *dentry,
+                       struct ext4_dir_entry_2 **res_dir, int *err);
+static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
+                             struct inode *inode);
+
+/*
+ * Future: use high four bits of block for coalesce-on-delete flags
+ * Mask them off for now.
+ */
+
+static inline unsigned dx_get_block (struct dx_entry *entry)
+{
+        return le32_to_cpu(entry->block) & 0x00ffffff;
+}
+
+static inline void dx_set_block (struct dx_entry *entry, unsigned value)
+{
+        entry->block = cpu_to_le32(value);
+}
+
+static inline unsigned dx_get_hash (struct dx_entry *entry)
+{
+        return le32_to_cpu(entry->hash);
+}
+
+static inline void dx_set_hash (struct dx_entry *entry, unsigned value)
+{
+        entry->hash = cpu_to_le32(value);
+}
+
+static inline unsigned dx_get_count (struct dx_entry *entries)
+{
+        return le16_to_cpu(((struct dx_countlimit *) entries)->count);
+}
+
+static inline unsigned dx_get_limit (struct dx_entry *entries)
+{
+        return le16_to_cpu(((struct dx_countlimit *) entries)->limit);
+}
+
+static inline void dx_set_count (struct dx_entry *entries, unsigned value)
+{
+        ((struct dx_countlimit *) entries)->count = cpu_to_le16(value);
+}
+
+static inline void dx_set_limit (struct dx_entry *entries, unsigned value)
+{
+        ((struct dx_countlimit *) entries)->limit = cpu_to_le16(value);
+}
+
+static inline unsigned dx_root_limit (struct inode *dir, unsigned infosize)
+{
+        unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(1) -
+                EXT4_DIR_REC_LEN(2) - infosize;
+        return 0? 20: entry_space / sizeof(struct dx_entry);
+}
+
+static inline unsigned dx_node_limit (struct inode *dir)
+{
+        unsigned entry_space = dir->i_sb->s_blocksize - EXT4_DIR_REC_LEN(0);
+        return 0? 22: entry_space / sizeof(struct dx_entry);
+}
+
+/*
+ * Debug
+ */
+#ifdef DX_DEBUG
+static void dx_show_index (char * label, struct dx_entry *entries)
+{
+        int i, n = dx_get_count (entries);
+        printk("%s index ", label);
+        for (i = 0; i < n; i++) {
+                printk("%x->%u ", i? dx_get_hash(entries + i) :
+                                0, dx_get_block(entries + i));
+        }
+        printk("\n");
+}
+
+struct stats
+{
+        unsigned names;
+        unsigned space;
+        unsigned bcount;
+};
+
+static struct stats dx_show_leaf(struct dx_hash_info *hinfo, struct ext4_dir_entry_2 *de,
+                                 int size, int show_names)
+{
+        unsigned names = 0, space = 0;
+        char *base = (char *) de;
+        struct dx_hash_info h = *hinfo;
+
+        printk("names: ");
+        while ((char *) de < base + size)
+        {
+                if (de->inode)
+                {
+                        if (show_names)
+                        {
+                                int len = de->name_len;
+                                char *name = de->name;
+                                while (len--) printk("%c", *name++);
+                                ext4fs_dirhash(de->name, de->name_len, &h);
+                                printk(":%x.%u ", h.hash,
+                                       ((char *) de - base));
+                        }
+                        space += EXT4_DIR_REC_LEN(de->name_len);
+                        names++;
+                }
+                de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
+        }
+        printk("(%i)\n", names);
+        return (struct stats) { names, space, 1 };
+}
+
+struct stats dx_show_entries(struct dx_hash_info *hinfo, struct inode *dir,
+                             struct dx_entry *entries, int levels)
+{
+        unsigned blocksize = dir->i_sb->s_blocksize;
+        unsigned count = dx_get_count (entries), names = 0, space = 0, i;
+        unsigned bcount = 0;
+        struct buffer_head *bh;
+        int err;
+        printk("%i indexed blocks...\n", count);
+        for (i = 0; i < count; i++, entries++)
+        {
+                u32 block = dx_get_block(entries), hash = i? dx_get_hash(entries): 0;
+                u32 range = i < count - 1? (dx_get_hash(entries + 1) - hash): ~hash;
+                struct stats stats;
+                printk("%s%3u:%03u hash %8x/%8x ",levels?"":"   ", i, block, hash, range);
+                if (!(bh = ext4_bread (NULL,dir, block, 0,&err))) continue;
+                stats = levels?
+                   dx_show_entries(hinfo, dir, ((struct dx_node *) bh->b_data)->entries, levels - 1):
+                   dx_show_leaf(hinfo, (struct ext4_dir_entry_2 *) bh->b_data, blocksize, 0);
+                names += stats.names;
+                space += stats.space;
+                bcount += stats.bcount;
+                brelse (bh);
+        }
+        if (bcount)
+                printk("%snames %u, fullness %u (%u%%)\n", levels?"":"   ",
+                        names, space/bcount,(space/bcount)*100/blocksize);
+        return (struct stats) { names, space, bcount};
+}
+#endif /* DX_DEBUG */
+
+/*
+ * Probe for a directory leaf block to search.
+ *
+ * dx_probe can return ERR_BAD_DX_DIR, which means there was a format
+ * error in the directory index, and the caller should fall back to
+ * searching the directory normally.  The callers of dx_probe **MUST**
+ * check for this error code, and make sure it never gets reflected
+ * back to userspace.
+ */
+static struct dx_frame *
+dx_probe(struct dentry *dentry, struct inode *dir,
+         struct dx_hash_info *hinfo, struct dx_frame *frame_in, int *err)
+{
+        unsigned count, indirect;
+        struct dx_entry *at, *entries, *p, *q, *m;
+        struct dx_root *root;
+        struct buffer_head *bh;
+        struct dx_frame *frame = frame_in;
+        u32 hash;
+
+        frame->bh = NULL;
+        if (dentry)
+                dir = dentry->d_parent->d_inode;
+        if (!(bh = ext4_bread (NULL,dir, 0, 0, err)))
+                goto fail;
+        root = (struct dx_root *) bh->b_data;
+        if (root->info.hash_version != DX_HASH_TEA &&
+            root->info.hash_version != DX_HASH_HALF_MD4 &&
+            root->info.hash_version != DX_HASH_LEGACY) {
+                ext4_warning(dir->i_sb, __FUNCTION__,
+                             "Unrecognised inode hash code %d",
+                             root->info.hash_version);
+                brelse(bh);
+                *err = ERR_BAD_DX_DIR;
+                goto fail;
+        }
+        hinfo->hash_version = root->info.hash_version;
+        hinfo->seed = EXT4_SB(dir->i_sb)->s_hash_seed;
+        if (dentry)
+                ext4fs_dirhash(dentry->d_name.name, dentry->d_name.len, hinfo);
+        hash = hinfo->hash;
+
+        if (root->info.unused_flags & 1) {
+                ext4_warning(dir->i_sb, __FUNCTION__,
+                             "Unimplemented inode hash flags: %#06x",
+                             root->info.unused_flags);
+                brelse(bh);
+                *err = ERR_BAD_DX_DIR;
+                goto fail;
+        }
+
+        if ((indirect = root->info.indirect_levels) > 1) {
+                ext4_warning(dir->i_sb, __FUNCTION__,
+                             "Unimplemented inode hash depth: %#06x",
+                             root->info.indirect_levels);
+                brelse(bh);
+                *err = ERR_BAD_DX_DIR;
+                goto fail;
+        }
+
+        entries = (struct dx_entry *) (((char *)&root->info) +
+                                       root->info.info_length);
+        assert(dx_get_limit(entries) == dx_root_limit(dir,
+                                                      root->info.info_length));
+        dxtrace (printk("Look up %x", hash));
+        while (1)
+        {
+                count = dx_get_count(entries);
+                assert (count && count <= dx_get_limit(entries));
+                p = entries + 1;
+                q = entries + count - 1;
+                while (p <= q)
+                {
+                        m = p + (q - p)/2;
+                        dxtrace(printk("."));
+                        if (dx_get_hash(m) > hash)
+                                q = m - 1;
+                        else
+                                p = m + 1;
+                }
+
+                if (0) // linear search cross check
+                {
+                        unsigned n = count - 1;
+                        at = entries;
+                        while (n--)
+                        {
+                                dxtrace(printk(","));
+                                if (dx_get_hash(++at) > hash)
+                                {
+                                        at--;
+                                        break;
+                                }
+                        }
+                        assert (at == p - 1);
+                }
+
+                at = p - 1;
+                dxtrace(printk(" %x->%u\n", at == entries? 0: dx_get_hash(at), dx_get_block(at)));
+                frame->bh = bh;
+                frame->entries = entries;
+                frame->at = at;
+                if (!indirect--) return frame;
+                if (!(bh = ext4_bread (NULL,dir, dx_get_block(at), 0, err)))
+                        goto fail2;
+                at = entries = ((struct dx_node *) bh->b_data)->entries;
+                assert (dx_get_limit(entries) == dx_node_limit (dir));
+                frame++;
+        }
+fail2:
+        while (frame >= frame_in) {
+                brelse(frame->bh);
+                frame--;
+        }
+fail:
+        return NULL;
+}
+
+static void dx_release (struct dx_frame *frames)
+{
+        if (frames[0].bh == NULL)
+                return;
+
+        if (((struct dx_root *) frames[0].bh->b_data)->info.indirect_levels)
+                brelse(frames[1].bh);
+        brelse(frames[0].bh);
+}
+
+/*
+ * This function increments the frame pointer to search the next leaf
+ * block, and reads in the necessary intervening nodes if the search
+ * should be necessary.  Whether or not the search is necessary is
+ * controlled by the hash parameter.  If the hash value is even, then
+ * the search is only continued if the next block starts with that
+ * hash value.  This is used if we are searching for a specific file.
+ *
+ * If the hash value is HASH_NB_ALWAYS, then always go to the next block.
+ *
+ * This function returns 1 if the caller should continue to search,
+ * or 0 if it should not.  If there is an error reading one of the
+ * index blocks, it will a negative error code.
+ *
+ * If start_hash is non-null, it will be filled in with the starting
+ * hash of the next page.
+ */
+static int ext4_htree_next_block(struct inode *dir, __u32 hash,
+                                 struct dx_frame *frame,
+                                 struct dx_frame *frames,
+                                 __u32 *start_hash)
+{
+        struct dx_frame *p;
+        struct buffer_head *bh;
+        int err, num_frames = 0;
+        __u32 bhash;
+
+        p = frame;
+        /*
+         * Find the next leaf page by incrementing the frame pointer.
+         * If we run out of entries in the interior node, loop around and
+         * increment pointer in the parent node.  When we break out of
+         * this loop, num_frames indicates the number of interior
+         * nodes need to be read.
+         */
+        while (1) {
+                if (++(p->at) < p->entries + dx_get_count(p->entries))
+                        break;
+                if (p == frames)
+                        return 0;
+                num_frames++;
+                p--;
+        }
+
+        /*
+         * If the hash is 1, then continue only if the next page has a
+         * continuation hash of any value.  This is used for readdir
+         * handling.  Otherwise, check to see if the hash matches the
+         * desired contiuation hash.  If it doesn't, return since
+         * there's no point to read in the successive index pages.
+         */
+        bhash = dx_get_hash(p->at);
+        if (start_hash)
+                *start_hash = bhash;
+        if ((hash & 1) == 0) {
+                if ((bhash & ~1) != hash)
+                        return 0;
+        }
+        /*
+         * If the hash is HASH_NB_ALWAYS, we always go to the next
+         * block so no check is necessary
+         */
+        while (num_frames--) {
+                if (!(bh = ext4_bread(NULL, dir, dx_get_block(p->at),
+                                      0, &err)))
+                        return err; /* Failure */
+                p++;
+                brelse (p->bh);
+                p->bh = bh;
+                p->at = p->entries = ((struct dx_node *) bh->b_data)->entries;
+        }
+        return 1;
+}
+
+
+/*
+ * p is at least 6 bytes before the end of page
+ */
+static inline struct ext4_dir_entry_2 *ext4_next_entry(struct ext4_dir_entry_2 *p)
+{
+        return (struct ext4_dir_entry_2 *)((char*)p + le16_to_cpu(p->rec_len));
+}
+
+/*
+ * This function fills a red-black tree with information from a
+ * directory block.  It returns the number directory entries loaded
+ * into the tree.  If there is an error it is returned in err.
+ */
+static int htree_dirblock_to_tree(struct file *dir_file,
+                                  struct inode *dir, int block,
+                                  struct dx_hash_info *hinfo,
+                                  __u32 start_hash, __u32 start_minor_hash)
+{
+        struct buffer_head *bh;
+        struct ext4_dir_entry_2 *de, *top;
+        int err, count = 0;
+
+        dxtrace(printk("In htree dirblock_to_tree: block %d\n", block));
+        if (!(bh = ext4_bread (NULL, dir, block, 0, &err)))
+                return err;
+
+        de = (struct ext4_dir_entry_2 *) bh->b_data;
+        top = (struct ext4_dir_entry_2 *) ((char *) de +
+                                           dir->i_sb->s_blocksize -
+                                           EXT4_DIR_REC_LEN(0));
+        for (; de < top; de = ext4_next_entry(de)) {
+                ext4fs_dirhash(de->name, de->name_len, hinfo);
+                if ((hinfo->hash < start_hash) ||
+                    ((hinfo->hash == start_hash) &&
+                     (hinfo->minor_hash < start_minor_hash)))
+                        continue;
+                if (de->inode == 0)
+                        continue;
+                if ((err = ext4_htree_store_dirent(dir_file,
+                                   hinfo->hash, hinfo->minor_hash, de)) != 0) {
+                        brelse(bh);
+                        return err;
+                }
+                count++;
+        }
+        brelse(bh);
+        return count;
+}
+
+
+/*
+ * This function fills a red-black tree with information from a
+ * directory.  We start scanning the directory in hash order, starting
+ * at start_hash and start_minor_hash.
+ *
+ * This function returns the number of entries inserted into the tree,
+ * or a negative error code.
+ */
+int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
+                         __u32 start_minor_hash, __u32 *next_hash)
+{
+        struct dx_hash_info hinfo;
+        struct ext4_dir_entry_2 *de;
+        struct dx_frame frames[2], *frame;
+        struct inode *dir;
+        int block, err;
+        int count = 0;
+        int ret;
+        __u32 hashval;
+
+        dxtrace(printk("In htree_fill_tree, start hash: %x:%x\n", start_hash,
+                       start_minor_hash));
+        dir = dir_file->f_dentry->d_inode;
+        if (!(EXT4_I(dir)->i_flags & EXT4_INDEX_FL)) {
+                hinfo.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
+                hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
+                count = htree_dirblock_to_tree(dir_file, dir, 0, &hinfo,
+                                               start_hash, start_minor_hash);
+                *next_hash = ~0;
+                return count;
+        }
+        hinfo.hash = start_hash;
+        hinfo.minor_hash = 0;
+        frame = dx_probe(NULL, dir_file->f_dentry->d_inode, &hinfo, frames, &err);
+        if (!frame)
+                return err;
+
+        /* Add '.' and '..' from the htree header */
+        if (!start_hash && !start_minor_hash) {
+                de = (struct ext4_dir_entry_2 *) frames[0].bh->b_data;
+                if ((err = ext4_htree_store_dirent(dir_file, 0, 0, de)) != 0)
+                        goto errout;
+                count++;
+        }
+        if (start_hash < 2 || (start_hash ==2 && start_minor_hash==0)) {
+                de = (struct ext4_dir_entry_2 *) frames[0].bh->b_data;
+                de = ext4_next_entry(de);
+                if ((err = ext4_htree_store_dirent(dir_file, 2, 0, de)) != 0)
+                        goto errout;
+                count++;
+        }
+
+        while (1) {
+                block = dx_get_block(frame->at);
+                ret = htree_dirblock_to_tree(dir_file, dir, block, &hinfo,
+                                             start_hash, start_minor_hash);
+                if (ret < 0) {
+                        err = ret;
+                        goto errout;
+                }
+                count += ret;
+                hashval = ~0;
+                ret = ext4_htree_next_block(dir, HASH_NB_ALWAYS,
+                                            frame, frames, &hashval);
+                *next_hash = hashval;
+                if (ret < 0) {
+                        err = ret;
+                        goto errout;
+                }
+                /*
+                 * Stop if:  (a) there are no more entries, or
+                 * (b) we have inserted at least one entry and the
+                 * next hash value is not a continuation
+                 */
+                if ((ret == 0) ||
+                    (count && ((hashval & 1) == 0)))
+                        break;
+        }
+        dx_release(frames);
+        dxtrace(printk("Fill tree: returned %d entries, next hash: %x\n",
+                       count, *next_hash));
+        return count;
+errout:
+        dx_release(frames);
+        return (err);
+}
+
+
+/*
+ * Directory block splitting, compacting
+ */
+
+static int dx_make_map (struct ext4_dir_entry_2 *de, int size,
+                        struct dx_hash_info *hinfo, struct dx_map_entry *map_tail)
+{
+        int count = 0;
+        char *base = (char *) de;
+        struct dx_hash_info h = *hinfo;
+
+        while ((char *) de < base + size)
+        {
+                if (de->name_len && de->inode) {
+                        ext4fs_dirhash(de->name, de->name_len, &h);
+                        map_tail--;
+                        map_tail->hash = h.hash;
+                        map_tail->offs = (u32) ((char *) de - base);
+                        count++;
+                        cond_resched();
+                }
+                /* XXX: do we need to check rec_len == 0 case? -Chris */
+                de = (struct ext4_dir_entry_2 *) ((char *) de + le16_to_cpu(de->rec_len));
+        }
+        return count;
+}
+
+static void dx_sort_map (struct dx_map_entry *map, unsigned count)
+{
+        struct dx_map_entry *p, *q, *top = map + count - 1;
+        int more;
+        /* Combsort until bubble sort doesn't suck */
+        while (count > 2) {
+                count = count*10/13;
+                if (count - 9 < 2) /* 9, 10 -> 11 */
+                        count = 11;
+                for (p = top, q = p - count; q >= map; p--, q--)
+                        if (p->hash < q->hash)
+                                swap(*p, *q);
+        }
+        /* Garden variety bubble sort */
+        do {
+                more = 0;
+                q = top;
+                while (q-- > map) {
+                        if (q[1].hash >= q[0].hash)
+                                continue;
+                        swap(*(q+1), *q);
+                        more = 1;
+                }
+        } while(more);
+}
+
+static void dx_insert_block(struct dx_frame *frame, u32 hash, u32 block)
+{
+        struct dx_entry *entries = frame->entries;
+        struct dx_entry *old = frame->at, *new = old + 1;
+        int count = dx_get_count(entries);
+
+        assert(count < dx_get_limit(entries));
+        assert(old < entries + count);
+        memmove(new + 1, new, (char *)(entries + count) - (char *)(new));
+        dx_set_hash(new, hash);
+        dx_set_block(new, block);
+        dx_set_count(entries, count + 1);
+}
+#endif
+
+
+static void ext4_update_dx_flag(struct inode *inode)
+{
+        if (!EXT4_HAS_COMPAT_FEATURE(inode->i_sb,
+                                     EXT4_FEATURE_COMPAT_DIR_INDEX))
+                EXT4_I(inode)->i_flags &= ~EXT4_INDEX_FL;
+}
+
+/*
+ * NOTE! unlike strncmp, ext4_match returns 1 for success, 0 for failure.
+ *
+ * `len <= EXT4_NAME_LEN' is guaranteed by caller.
+ * `de != NULL' is guaranteed by caller.
+ */
+static inline int ext4_match (int len, const char * const name,
+                              struct ext4_dir_entry_2 * de)
+{
+        if (len != de->name_len)
+                return 0;
+        if (!de->inode)
+                return 0;
+        return !memcmp(name, de->name, len);
+}
+
+/*
+ * Returns 0 if not found, -1 on failure, and 1 on success
+ */
+static inline int search_dirblock(struct buffer_head * bh,
+                                  struct inode *dir,
+                                  struct dentry *dentry,
+                                  unsigned long offset,
+                                  struct ext4_dir_entry_2 ** res_dir)
+{
+        struct ext4_dir_entry_2 * de;
+        char * dlimit;
+        int de_len;
+        const char *name = dentry->d_name.name;
+        int namelen = dentry->d_name.len;
+
+        de = (struct ext4_dir_entry_2 *) bh->b_data;
+        dlimit = bh->b_data + dir->i_sb->s_blocksize;
+        while ((char *) de < dlimit) {
+                /* this code is executed quadratically often */
+                /* do minimal checking `by hand' */
+
+                if ((char *) de + namelen <= dlimit &&
+                    ext4_match (namelen, name, de)) {
+                        /* found a match - just to be sure, do a full check */
+                        if (!ext4_check_dir_entry("ext4_find_entry",
+                                                  dir, de, bh, offset))
+                                return -1;
+                        *res_dir = de;
+                        return 1;
+                }
+                /* prevent looping on a bad block */
+                de_len = le16_to_cpu(de->rec_len);
+                if (de_len <= 0)
+                        return -1;
+                offset += de_len;
+                de = (struct ext4_dir_entry_2 *) ((char *) de + de_len);
+        }
+        return 0;
+}
+
+
+/*
+ *      ext4_find_entry()
+ *
+ * finds an entry in the specified directory with the wanted name. It
+ * returns the cache buffer in which the entry was found, and the entry
+ * itself (as a parameter - res_dir). It does NOT read the inode of the
+ * entry - you'll have to do that yourself if you want to.
+ *
+ * The returned buffer_head has ->b_count elevated.  The caller is expected
+ * to brelse() it when appropriate.
+ */
+static struct buffer_head * ext4_find_entry (struct dentry *dentry,
+                                        struct ext4_dir_entry_2 ** res_dir)
+{
+        struct super_block * sb;
+        struct buffer_head * bh_use[NAMEI_RA_SIZE];
+        struct buffer_head * bh, *ret = NULL;
+        unsigned long start, block, b;
+        int ra_max = 0;         /* Number of bh's in the readahead
+                                   buffer, bh_use[] */
+        int ra_ptr = 0;         /* Current index into readahead
+                                   buffer */
+        int num = 0;
+        int nblocks, i, err;
+        struct inode *dir = dentry->d_parent->d_inode;
+        int namelen;
+        const u8 *name;
+        unsigned blocksize;
+
+        *res_dir = NULL;
+        sb = dir->i_sb;
+        blocksize = sb->s_blocksize;
+        namelen = dentry->d_name.len;
+        name = dentry->d_name.name;
+        if (namelen > EXT4_NAME_LEN)
+                return NULL;
+#ifdef CONFIG_EXT4_INDEX
+        if (is_dx(dir)) {
+                bh = ext4_dx_find_entry(dentry, res_dir, &err);
+                /*
+                 * On success, or if the error was file not found,
+                 * return.  Otherwise, fall back to doing a search the
+                 * old fashioned way.
+                 */
+                if (bh || (err != ERR_BAD_DX_DIR))
+                        return bh;
+                dxtrace(printk("ext4_find_entry: dx failed, falling back\n"));
+        }
+#endif
+        nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
+        start = EXT4_I(dir)->i_dir_start_lookup;
+        if (start >= nblocks)
+                start = 0;
+        block = start;
+restart:
+        do {
+                /*
+                 * We deal with the read-ahead logic here.
+                 */
+                if (ra_ptr >= ra_max) {
+                        /* Refill the readahead buffer */
+                        ra_ptr = 0;
+                        b = block;
+                        for (ra_max = 0; ra_max < NAMEI_RA_SIZE; ra_max++) {
+                                /*
+                                 * Terminate if we reach the end of the
+                                 * directory and must wrap, or if our
+                                 * search has finished at this block.
+                                 */
+                                if (b >= nblocks || (num && block == start)) {
+                                        bh_use[ra_max] = NULL;
+                                        break;
+                                }
+                                num++;
+                                bh = ext4_getblk(NULL, dir, b++, 0, &err);
+                                bh_use[ra_max] = bh;
+                                if (bh)
+                                        ll_rw_block(READ_META, 1, &bh);
+                        }
+                }
+                if ((bh = bh_use[ra_ptr++]) == NULL)
+                        goto next;
+                wait_on_buffer(bh);
+                if (!buffer_uptodate(bh)) {
+                        /* read error, skip block & hope for the best */
+                        ext4_error(sb, __FUNCTION__, "reading directory #%lu "
+                                   "offset %lu", dir->i_ino, block);
+                        brelse(bh);
+                        goto next;
+                }
+                i = search_dirblock(bh, dir, dentry,
+                            block << EXT4_BLOCK_SIZE_BITS(sb), res_dir);
+                if (i == 1) {
+                        EXT4_I(dir)->i_dir_start_lookup = block;
+                        ret = bh;
+                        goto cleanup_and_exit;
+                } else {
+                        brelse(bh);
+                        if (i < 0)
+                                goto cleanup_and_exit;
+                }
+        next:
+                if (++block >= nblocks)
+                        block = 0;
+        } while (block != start);
+
+        /*
+         * If the directory has grown while we were searching, then
+         * search the last part of the directory before giving up.
+         */
+        block = nblocks;
+        nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb);
+        if (block < nblocks) {
+                start = 0;
+                goto restart;
+        }
+
+cleanup_and_exit:
+        /* Clean up the read-ahead blocks */
+        for (; ra_ptr < ra_max; ra_ptr++)
+                brelse (bh_use[ra_ptr]);
+        return ret;
+}
+
+#ifdef CONFIG_EXT4_INDEX
+static struct buffer_head * ext4_dx_find_entry(struct dentry *dentry,
+                       struct ext4_dir_entry_2 **res_dir, int *err)
+{
+        struct super_block * sb;
+        struct dx_hash_info     hinfo;
+        u32 hash;
+        struct dx_frame frames[2], *frame;
+        struct ext4_dir_entry_2 *de, *top;
+        struct buffer_head *bh;
+        unsigned long block;
+        int retval;
+        int namelen = dentry->d_name.len;
+        const u8 *name = dentry->d_name.name;
+        struct inode *dir = dentry->d_parent->d_inode;
+
+        sb = dir->i_sb;
+        /* NFS may look up ".." - look at dx_root directory block */
+        if (namelen > 2 || name[0] != '.'||(name[1] != '.' && name[1] != '\0')){
+                if (!(frame = dx_probe(dentry, NULL, &hinfo, frames, err)))
+                        return NULL;
+        } else {
+                frame = frames;
+                frame->bh = NULL;                       /* for dx_release() */
+                frame->at = (struct dx_entry *)frames;  /* hack for zero entry*/
+                dx_set_block(frame->at, 0);             /* dx_root block is 0 */
+        }
+        hash = hinfo.hash;
+        do {
+                block = dx_get_block(frame->at);
+                if (!(bh = ext4_bread (NULL,dir, block, 0, err)))
+                        goto errout;
+                de = (struct ext4_dir_entry_2 *) bh->b_data;
+                top = (struct ext4_dir_entry_2 *) ((char *) de + sb->s_blocksize -
+                                       EXT4_DIR_REC_LEN(0));
+                for (; de < top; de = ext4_next_entry(de))
+                if (ext4_match (namelen, name, de)) {
+                        if (!ext4_check_dir_entry("ext4_find_entry",
+                                                  dir, de, bh,
+                                  (block<<EXT4_BLOCK_SIZE_BITS(sb))
+                                          +((char *)de - bh->b_data))) {
+                                brelse (bh);
+                                goto errout;
+                        }
+                        *res_dir = de;
+                        dx_release (frames);
+                        return bh;
+                }
+                brelse (bh);
+                /* Check to see if we should continue to search */
+                retval = ext4_htree_next_block(dir, hash, frame,
+                                               frames, NULL);
+                if (retval < 0) {
+                        ext4_warning(sb, __FUNCTION__,
+                             "error reading index page in directory #%lu",
+                             dir->i_ino);
+                        *err = retval;
+                        goto errout;
+                }
+        } while (retval == 1);
+
+        *err = -ENOENT;
+errout:
+        dxtrace(printk("%s not found\n", name));
+        dx_release (frames);
+        return NULL;
+}
+#endif
+
+static struct dentry *ext4_lookup(struct inode * dir, struct dentry *dentry, struct nameidata *nd)
+{
+        struct inode * inode;
+        struct ext4_dir_entry_2 * de;
+        struct buffer_head * bh;
+
+        if (dentry->d_name.len > EXT4_NAME_LEN)
+                return ERR_PTR(-ENAMETOOLONG);
+
+        bh = ext4_find_entry(dentry, &de);
+        inode = NULL;
+        if (bh) {
+                unsigned long ino = le32_to_cpu(de->inode);
+                brelse (bh);
+                if (!ext4_valid_inum(dir->i_sb, ino)) {
+                        ext4_error(dir->i_sb, "ext4_lookup",
+                                   "bad inode number: %lu", ino);
+                        inode = NULL;
+                } else
+                        inode = iget(dir->i_sb, ino);
+
+                if (!inode)
+                        return ERR_PTR(-EACCES);
+        }
+        return d_splice_alias(inode, dentry);
+}
+
+
+struct dentry *ext4_get_parent(struct dentry *child)
+{
+        unsigned long ino;
+        struct dentry *parent;
+        struct inode *inode;
+        struct dentry dotdot;
+        struct ext4_dir_entry_2 * de;
+        struct buffer_head *bh;
+
+        dotdot.d_name.name = "..";
+        dotdot.d_name.len = 2;
+        dotdot.d_parent = child; /* confusing, isn't it! */
+
+        bh = ext4_find_entry(&dotdot, &de);
+        inode = NULL;
+        if (!bh)
+                return ERR_PTR(-ENOENT);
+        ino = le32_to_cpu(de->inode);
+        brelse(bh);
+
+        if (!ext4_valid_inum(child->d_inode->i_sb, ino)) {
+                ext4_error(child->d_inode->i_sb, "ext4_get_parent",
+                           "bad inode number: %lu", ino);
+                inode = NULL;
+        } else
+                inode = iget(child->d_inode->i_sb, ino);
+
+        if (!inode)
+                return ERR_PTR(-EACCES);
+
+        parent = d_alloc_anon(inode);
+        if (!parent) {
+                iput(inode);
+                parent = ERR_PTR(-ENOMEM);
+        }
+        return parent;
+}
+
+#define S_SHIFT 12
+static unsigned char ext4_type_by_mode[S_IFMT >> S_SHIFT] = {
+        [S_IFREG >> S_SHIFT]    = EXT4_FT_REG_FILE,
+        [S_IFDIR >> S_SHIFT]    = EXT4_FT_DIR,
+        [S_IFCHR >> S_SHIFT]    = EXT4_FT_CHRDEV,
+        [S_IFBLK >> S_SHIFT]    = EXT4_FT_BLKDEV,
+        [S_IFIFO >> S_SHIFT]    = EXT4_FT_FIFO,
+        [S_IFSOCK >> S_SHIFT]   = EXT4_FT_SOCK,
+        [S_IFLNK >> S_SHIFT]    = EXT4_FT_SYMLINK,
+};
+
+static inline void ext4_set_de_type(struct super_block *sb,
+                                struct ext4_dir_entry_2 *de,
+                                umode_t mode) {
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_FILETYPE))
+                de->file_type = ext4_type_by_mode[(mode & S_IFMT)>>S_SHIFT];
+}
+
+#ifdef CONFIG_EXT4_INDEX
+static struct ext4_dir_entry_2 *
+dx_move_dirents(char *from, char *to, struct dx_map_entry *map, int count)
+{
+        unsigned rec_len = 0;
+
+        while (count--) {
+                struct ext4_dir_entry_2 *de = (struct ext4_dir_entry_2 *) (from + map->offs);
+                rec_len = EXT4_DIR_REC_LEN(de->name_len);
+                memcpy (to, de, rec_len);
+                ((struct ext4_dir_entry_2 *) to)->rec_len =
+                                cpu_to_le16(rec_len);
+                de->inode = 0;
+                map++;
+                to += rec_len;
+        }
+        return (struct ext4_dir_entry_2 *) (to - rec_len);
+}
+
+static struct ext4_dir_entry_2* dx_pack_dirents(char *base, int size)
+{
+        struct ext4_dir_entry_2 *next, *to, *prev, *de = (struct ext4_dir_entry_2 *) base;
+        unsigned rec_len = 0;
+
+        prev = to = de;
+        while ((char*)de < base + size) {
+                next = (struct ext4_dir_entry_2 *) ((char *) de +
+                                                    le16_to_cpu(de->rec_len));
+                if (de->inode && de->name_len) {
+                        rec_len = EXT4_DIR_REC_LEN(de->name_len);
+                        if (de > to)
+                                memmove(to, de, rec_len);
+                        to->rec_len = cpu_to_le16(rec_len);
+                        prev = to;
+                        to = (struct ext4_dir_entry_2 *) (((char *) to) + rec_len);
+                }
+                de = next;
+        }
+        return prev;
+}
+
+static struct ext4_dir_entry_2 *do_split(handle_t *handle, struct inode *dir,
+                        struct buffer_head **bh,struct dx_frame *frame,
+                        struct dx_hash_info *hinfo, int *error)
+{
+        unsigned blocksize = dir->i_sb->s_blocksize;
+        unsigned count, continued;
+        struct buffer_head *bh2;
+        u32 newblock;
+        u32 hash2;
+        struct dx_map_entry *map;
+        char *data1 = (*bh)->b_data, *data2;
+        unsigned split;
+        struct ext4_dir_entry_2 *de = NULL, *de2;
+        int     err;
+
+        bh2 = ext4_append (handle, dir, &newblock, error);
+        if (!(bh2)) {
+                brelse(*bh);
+                *bh = NULL;
+                goto errout;
+        }
+
+        BUFFER_TRACE(*bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, *bh);
+        if (err) {
+        journal_error:
+                brelse(*bh);
+                brelse(bh2);
+                *bh = NULL;
+                ext4_std_error(dir->i_sb, err);
+                goto errout;
+        }
+        BUFFER_TRACE(frame->bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, frame->bh);
+        if (err)
+                goto journal_error;
+
+        data2 = bh2->b_data;
+
+        /* create map in the end of data2 block */
+        map = (struct dx_map_entry *) (data2 + blocksize);
+        count = dx_make_map ((struct ext4_dir_entry_2 *) data1,
+                             blocksize, hinfo, map);
+        map -= count;
+        split = count/2; // need to adjust to actual middle
+        dx_sort_map (map, count);
+        hash2 = map[split].hash;
+        continued = hash2 == map[split - 1].hash;
+        dxtrace(printk("Split block %i at %x, %i/%i\n",
+                dx_get_block(frame->at), hash2, split, count-split));
+
+        /* Fancy dance to stay within two buffers */
+        de2 = dx_move_dirents(data1, data2, map + split, count - split);
+        de = dx_pack_dirents(data1,blocksize);
+        de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
+        de2->rec_len = cpu_to_le16(data2 + blocksize - (char *) de2);
+        dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data1, blocksize, 1));
+        dxtrace(dx_show_leaf (hinfo, (struct ext4_dir_entry_2 *) data2, blocksize, 1));
+
+        /* Which block gets the new entry? */
+        if (hinfo->hash >= hash2)
+        {
+                swap(*bh, bh2);
+                de = de2;
+        }
+        dx_insert_block (frame, hash2 + continued, newblock);
+        err = ext4_journal_dirty_metadata (handle, bh2);
+        if (err)
+                goto journal_error;
+        err = ext4_journal_dirty_metadata (handle, frame->bh);
+        if (err)
+                goto journal_error;
+        brelse (bh2);
+        dxtrace(dx_show_index ("frame", frame->entries));
+errout:
+        return de;
+}
+#endif
+
+
+/*
+ * Add a new entry into a directory (leaf) block.  If de is non-NULL,
+ * it points to a directory entry which is guaranteed to be large
+ * enough for new directory entry.  If de is NULL, then
+ * add_dirent_to_buf will attempt search the directory block for
+ * space.  It will return -ENOSPC if no space is available, and -EIO
+ * and -EEXIST if directory entry already exists.
+ *
+ * NOTE!  bh is NOT released in the case where ENOSPC is returned.  In
+ * all other cases bh is released.
+ */
+static int add_dirent_to_buf(handle_t *handle, struct dentry *dentry,
+                             struct inode *inode, struct ext4_dir_entry_2 *de,
+                             struct buffer_head * bh)
+{
+        struct inode    *dir = dentry->d_parent->d_inode;
+        const char      *name = dentry->d_name.name;
+        int             namelen = dentry->d_name.len;
+        unsigned long   offset = 0;
+        unsigned short  reclen;
+        int             nlen, rlen, err;
+        char            *top;
+
+        reclen = EXT4_DIR_REC_LEN(namelen);
+        if (!de) {
+                de = (struct ext4_dir_entry_2 *)bh->b_data;
+                top = bh->b_data + dir->i_sb->s_blocksize - reclen;
+                while ((char *) de <= top) {
+                        if (!ext4_check_dir_entry("ext4_add_entry", dir, de,
+                                                  bh, offset)) {
+                                brelse (bh);
+                                return -EIO;
+                        }
+                        if (ext4_match (namelen, name, de)) {
+                                brelse (bh);
+                                return -EEXIST;
+                        }
+                        nlen = EXT4_DIR_REC_LEN(de->name_len);
+                        rlen = le16_to_cpu(de->rec_len);
+                        if ((de->inode? rlen - nlen: rlen) >= reclen)
+                                break;
+                        de = (struct ext4_dir_entry_2 *)((char *)de + rlen);
+                        offset += rlen;
+                }
+                if ((char *) de > top)
+                        return -ENOSPC;
+        }
+        BUFFER_TRACE(bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, bh);
+        if (err) {
+                ext4_std_error(dir->i_sb, err);
+                brelse(bh);
+                return err;
+        }
+
+        /* By now the buffer is marked for journaling */
+        nlen = EXT4_DIR_REC_LEN(de->name_len);
+        rlen = le16_to_cpu(de->rec_len);
+        if (de->inode) {
+                struct ext4_dir_entry_2 *de1 = (struct ext4_dir_entry_2 *)((char *)de + nlen);
+                de1->rec_len = cpu_to_le16(rlen - nlen);
+                de->rec_len = cpu_to_le16(nlen);
+                de = de1;
+        }
+        de->file_type = EXT4_FT_UNKNOWN;
+        if (inode) {
+                de->inode = cpu_to_le32(inode->i_ino);
+                ext4_set_de_type(dir->i_sb, de, inode->i_mode);
+        } else
+                de->inode = 0;
+        de->name_len = namelen;
+        memcpy (de->name, name, namelen);
+        /*
+         * XXX shouldn't update any times until successful
+         * completion of syscall, but too many callers depend
+         * on this.
+         *
+         * XXX similarly, too many callers depend on
+         * ext4_new_inode() setting the times, but error
+         * recovery deletes the inode, so the worst that can
+         * happen is that the times are slightly out of date
+         * and/or different from the directory change time.
+         */
+        dir->i_mtime = dir->i_ctime = CURRENT_TIME_SEC;
+        ext4_update_dx_flag(dir);
+        dir->i_version++;
+        ext4_mark_inode_dirty(handle, dir);
+        BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+        err = ext4_journal_dirty_metadata(handle, bh);
+        if (err)
+                ext4_std_error(dir->i_sb, err);
+        brelse(bh);
+        return 0;
+}
+
+#ifdef CONFIG_EXT4_INDEX
+/*
+ * This converts a one block unindexed directory to a 3 block indexed
+ * directory, and adds the dentry to the indexed directory.
+ */
+static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
+                            struct inode *inode, struct buffer_head *bh)
+{
+        struct inode    *dir = dentry->d_parent->d_inode;
+        const char      *name = dentry->d_name.name;
+        int             namelen = dentry->d_name.len;
+        struct buffer_head *bh2;
+        struct dx_root  *root;
+        struct dx_frame frames[2], *frame;
+        struct dx_entry *entries;
+        struct ext4_dir_entry_2 *de, *de2;
+        char            *data1, *top;
+        unsigned        len;
+        int             retval;
+        unsigned        blocksize;
+        struct dx_hash_info hinfo;
+        u32             block;
+        struct fake_dirent *fde;
+
+        blocksize =  dir->i_sb->s_blocksize;
+        dxtrace(printk("Creating index\n"));
+        retval = ext4_journal_get_write_access(handle, bh);
+        if (retval) {
+                ext4_std_error(dir->i_sb, retval);
+                brelse(bh);
+                return retval;
+        }
+        root = (struct dx_root *) bh->b_data;
+
+        bh2 = ext4_append (handle, dir, &block, &retval);
+        if (!(bh2)) {
+                brelse(bh);
+                return retval;
+        }
+        EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
+        data1 = bh2->b_data;
+
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext4_dir_entry_2 *)((char *)fde + le16_to_cpu(fde->rec_len));
+        len = ((char *) root) + blocksize - (char *) de;
+        memcpy (data1, de, len);
+        de = (struct ext4_dir_entry_2 *) data1;
+        top = data1 + len;
+        while ((char *)(de2=(void*)de+le16_to_cpu(de->rec_len)) < top)
+                de = de2;
+        de->rec_len = cpu_to_le16(data1 + blocksize - (char *) de);
+        /* Initialize the root; the dot dirents already exist */
+        de = (struct ext4_dir_entry_2 *) (&root->dotdot);
+        de->rec_len = cpu_to_le16(blocksize - EXT4_DIR_REC_LEN(2));
+        memset (&root->info, 0, sizeof(root->info));
+        root->info.info_length = sizeof(root->info);
+        root->info.hash_version = EXT4_SB(dir->i_sb)->s_def_hash_version;
+        entries = root->entries;
+        dx_set_block (entries, 1);
+        dx_set_count (entries, 1);
+        dx_set_limit (entries, dx_root_limit(dir, sizeof(root->info)));
+
+        /* Initialize as for dx_probe */
+        hinfo.hash_version = root->info.hash_version;
+        hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
+        ext4fs_dirhash(name, namelen, &hinfo);
+        frame = frames;
+        frame->entries = entries;
+        frame->at = entries;
+        frame->bh = bh;
+        bh = bh2;
+        de = do_split(handle,dir, &bh, frame, &hinfo, &retval);
+        dx_release (frames);
+        if (!(de))
+                return retval;
+
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
+}
+#endif
+
+/*
+ *      ext4_add_entry()
+ *
+ * adds a file entry to the specified directory, using the same
+ * semantics as ext4_find_entry(). It returns NULL if it failed.
+ *
+ * NOTE!! The inode part of 'de' is left at 0 - which means you
+ * may not sleep between calling this and putting something into
+ * the entry, as someone else might have used it while you slept.
+ */
+static int ext4_add_entry (handle_t *handle, struct dentry *dentry,
+        struct inode *inode)
+{
+        struct inode *dir = dentry->d_parent->d_inode;
+        unsigned long offset;
+        struct buffer_head * bh;
+        struct ext4_dir_entry_2 *de;
+        struct super_block * sb;
+        int     retval;
+#ifdef CONFIG_EXT4_INDEX
+        int     dx_fallback=0;
+#endif
+        unsigned blocksize;
+        u32 block, blocks;
+
+        sb = dir->i_sb;
+        blocksize = sb->s_blocksize;
+        if (!dentry->d_name.len)
+                return -EINVAL;
+#ifdef CONFIG_EXT4_INDEX
+        if (is_dx(dir)) {
+                retval = ext4_dx_add_entry(handle, dentry, inode);
+                if (!retval || (retval != ERR_BAD_DX_DIR))
+                        return retval;
+                EXT4_I(dir)->i_flags &= ~EXT4_INDEX_FL;
+                dx_fallback++;
+                ext4_mark_inode_dirty(handle, dir);
+        }
+#endif
+        blocks = dir->i_size >> sb->s_blocksize_bits;
+        for (block = 0, offset = 0; block < blocks; block++) {
+                bh = ext4_bread(handle, dir, block, 0, &retval);
+                if(!bh)
+                        return retval;
+                retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+                if (retval != -ENOSPC)
+                        return retval;
+
+#ifdef CONFIG_EXT4_INDEX
+                if (blocks == 1 && !dx_fallback &&
+                    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+                        return make_indexed_dir(handle, dentry, inode, bh);
+#endif
+                brelse(bh);
+        }
+        bh = ext4_append(handle, dir, &block, &retval);
+        if (!bh)
+                return retval;
+        de = (struct ext4_dir_entry_2 *) bh->b_data;
+        de->inode = 0;
+        de->rec_len = cpu_to_le16(blocksize);
+        return add_dirent_to_buf(handle, dentry, inode, de, bh);
+}
+
+#ifdef CONFIG_EXT4_INDEX
+/*
+ * Returns 0 for success, or a negative error value
+ */
+static int ext4_dx_add_entry(handle_t *handle, struct dentry *dentry,
+                             struct inode *inode)
+{
+        struct dx_frame frames[2], *frame;
+        struct dx_entry *entries, *at;
+        struct dx_hash_info hinfo;
+        struct buffer_head * bh;
+        struct inode *dir = dentry->d_parent->d_inode;
+        struct super_block * sb = dir->i_sb;
+        struct ext4_dir_entry_2 *de;
+        int err;
+
+        frame = dx_probe(dentry, NULL, &hinfo, frames, &err);
+        if (!frame)
+                return err;
+        entries = frame->entries;
+        at = frame->at;
+
+        if (!(bh = ext4_bread(handle,dir, dx_get_block(frame->at), 0, &err)))
+                goto cleanup;
+
+        BUFFER_TRACE(bh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, bh);
+        if (err)
+                goto journal_error;
+
+        err = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+        if (err != -ENOSPC) {
+                bh = NULL;
+                goto cleanup;
+        }
+
+        /* Block full, should compress but for now just split */
+        dxtrace(printk("using %u of %u node entries\n",
+                       dx_get_count(entries), dx_get_limit(entries)));
+        /* Need to split index? */
+        if (dx_get_count(entries) == dx_get_limit(entries)) {
+                u32 newblock;
+                unsigned icount = dx_get_count(entries);
+                int levels = frame - frames;
+                struct dx_entry *entries2;
+                struct dx_node *node2;
+                struct buffer_head *bh2;
+
+                if (levels && (dx_get_count(frames->entries) ==
+                               dx_get_limit(frames->entries))) {
+                        ext4_warning(sb, __FUNCTION__,
+                                     "Directory index full!");
+                        err = -ENOSPC;
+                        goto cleanup;
+                }
+                bh2 = ext4_append (handle, dir, &newblock, &err);
+                if (!(bh2))
+                        goto cleanup;
+                node2 = (struct dx_node *)(bh2->b_data);
+                entries2 = node2->entries;
+                node2->fake.rec_len = cpu_to_le16(sb->s_blocksize);
+                node2->fake.inode = 0;
+                BUFFER_TRACE(frame->bh, "get_write_access");
+                err = ext4_journal_get_write_access(handle, frame->bh);
+                if (err)
+                        goto journal_error;
+                if (levels) {
+                        unsigned icount1 = icount/2, icount2 = icount - icount1;
+                        unsigned hash2 = dx_get_hash(entries + icount1);
+                        dxtrace(printk("Split index %i/%i\n", icount1, icount2));
+
+                        BUFFER_TRACE(frame->bh, "get_write_access"); /* index root */
+                        err = ext4_journal_get_write_access(handle,
+                                                             frames[0].bh);
+                        if (err)
+                                goto journal_error;
+
+                        memcpy ((char *) entries2, (char *) (entries + icount1),
+                                icount2 * sizeof(struct dx_entry));
+                        dx_set_count (entries, icount1);
+                        dx_set_count (entries2, icount2);
+                        dx_set_limit (entries2, dx_node_limit(dir));
+
+                        /* Which index block gets the new entry? */
+                        if (at - entries >= icount1) {
+                                frame->at = at = at - entries - icount1 + entries2;
+                                frame->entries = entries = entries2;
+                                swap(frame->bh, bh2);
+                        }
+                        dx_insert_block (frames + 0, hash2, newblock);
+                        dxtrace(dx_show_index ("node", frames[1].entries));
+                        dxtrace(dx_show_index ("node",
+                               ((struct dx_node *) bh2->b_data)->entries));
+                        err = ext4_journal_dirty_metadata(handle, bh2);
+                        if (err)
+                                goto journal_error;
+                        brelse (bh2);
+                } else {
+                        dxtrace(printk("Creating second level index...\n"));
+                        memcpy((char *) entries2, (char *) entries,
+                               icount * sizeof(struct dx_entry));
+                        dx_set_limit(entries2, dx_node_limit(dir));
+
+                        /* Set up root */
+                        dx_set_count(entries, 1);
+                        dx_set_block(entries + 0, newblock);
+                        ((struct dx_root *) frames[0].bh->b_data)->info.indirect_levels = 1;
+
+                        /* Add new access path frame */
+                        frame = frames + 1;
+                        frame->at = at = at - entries + entries2;
+                        frame->entries = entries = entries2;
+                        frame->bh = bh2;
+                        err = ext4_journal_get_write_access(handle,
+                                                             frame->bh);
+                        if (err)
+                                goto journal_error;
+                }
+                ext4_journal_dirty_metadata(handle, frames[0].bh);
+        }
+        de = do_split(handle, dir, &bh, frame, &hinfo, &err);
+        if (!de)
+                goto cleanup;
+        err = add_dirent_to_buf(handle, dentry, inode, de, bh);
+        bh = NULL;
+        goto cleanup;
+
+journal_error:
+        ext4_std_error(dir->i_sb, err);
+cleanup:
+        if (bh)
+                brelse(bh);
+        dx_release(frames);
+        return err;
+}
+#endif
+
+/*
+ * ext4_delete_entry deletes a directory entry by merging it with the
+ * previous entry
+ */
+static int ext4_delete_entry (handle_t *handle,
+                              struct inode * dir,
+                              struct ext4_dir_entry_2 * de_del,
+                              struct buffer_head * bh)
+{
+        struct ext4_dir_entry_2 * de, * pde;
+        int i;
+
+        i = 0;
+        pde = NULL;
+        de = (struct ext4_dir_entry_2 *) bh->b_data;
+        while (i < bh->b_size) {
+                if (!ext4_check_dir_entry("ext4_delete_entry", dir, de, bh, i))
+                        return -EIO;
+                if (de == de_del)  {
+                        BUFFER_TRACE(bh, "get_write_access");
+                        ext4_journal_get_write_access(handle, bh);
+                        if (pde)
+                                pde->rec_len =
+                                        cpu_to_le16(le16_to_cpu(pde->rec_len) +
+                                                    le16_to_cpu(de->rec_len));
+                        else
+                                de->inode = 0;
+                        dir->i_version++;
+                        BUFFER_TRACE(bh, "call ext4_journal_dirty_metadata");
+                        ext4_journal_dirty_metadata(handle, bh);
+                        return 0;
+                }
+                i += le16_to_cpu(de->rec_len);
+                pde = de;
+                de = (struct ext4_dir_entry_2 *)
+                        ((char *) de + le16_to_cpu(de->rec_len));
+        }
+        return -ENOENT;
+}
+
+/*
+ * ext4_mark_inode_dirty is somewhat expensive, so unlike ext2 we
+ * do not perform it in these functions.  We perform it at the call site,
+ * if it is needed.
+ */
+static inline void ext4_inc_count(handle_t *handle, struct inode *inode)
+{
+        inc_nlink(inode);
+}
+
+static inline void ext4_dec_count(handle_t *handle, struct inode *inode)
+{
+        drop_nlink(inode);
+}
+
+static int ext4_add_nondir(handle_t *handle,
+                struct dentry *dentry, struct inode *inode)
+{
+        int err = ext4_add_entry(handle, dentry, inode);
+        if (!err) {
+                ext4_mark_inode_dirty(handle, inode);
+                d_instantiate(dentry, inode);
+                return 0;
+        }
+        ext4_dec_count(handle, inode);
+        iput(inode);
+        return err;
+}
+
+/*
+ * By the time this is called, we already have created
+ * the directory cache entry for the new file, but it
+ * is so far negative - it has no inode.
+ *
+ * If the create succeeds, we fill in the inode information
+ * with d_instantiate().
+ */
+static int ext4_create (struct inode * dir, struct dentry * dentry, int mode,
+                struct nameidata *nd)
+{
+        handle_t *handle;
+        struct inode * inode;
+        int err, retries = 0;
+
+retry:
+        handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
+                                        2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode = ext4_new_inode (handle, dir, mode);
+        err = PTR_ERR(inode);
+        if (!IS_ERR(inode)) {
+                inode->i_op = &ext4_file_inode_operations;
+                inode->i_fop = &ext4_file_operations;
+                ext4_set_aops(inode);
+                err = ext4_add_nondir(handle, dentry, inode);
+        }
+        ext4_journal_stop(handle);
+        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
+                goto retry;
+        return err;
+}
+
+static int ext4_mknod (struct inode * dir, struct dentry *dentry,
+                        int mode, dev_t rdev)
+{
+        handle_t *handle;
+        struct inode *inode;
+        int err, retries = 0;
+
+        if (!new_valid_dev(rdev))
+                return -EINVAL;
+
+retry:
+        handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
+                                        2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode = ext4_new_inode (handle, dir, mode);
+        err = PTR_ERR(inode);
+        if (!IS_ERR(inode)) {
+                init_special_inode(inode, inode->i_mode, rdev);
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+                inode->i_op = &ext4_special_inode_operations;
+#endif
+                err = ext4_add_nondir(handle, dentry, inode);
+        }
+        ext4_journal_stop(handle);
+        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
+                goto retry;
+        return err;
+}
+
+static int ext4_mkdir(struct inode * dir, struct dentry * dentry, int mode)
+{
+        handle_t *handle;
+        struct inode * inode;
+        struct buffer_head * dir_block;
+        struct ext4_dir_entry_2 * de;
+        int err, retries = 0;
+
+        if (dir->i_nlink >= EXT4_LINK_MAX)
+                return -EMLINK;
+
+retry:
+        handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS + 3 +
+                                        2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode = ext4_new_inode (handle, dir, S_IFDIR | mode);
+        err = PTR_ERR(inode);
+        if (IS_ERR(inode))
+                goto out_stop;
+
+        inode->i_op = &ext4_dir_inode_operations;
+        inode->i_fop = &ext4_dir_operations;
+        inode->i_size = EXT4_I(inode)->i_disksize = inode->i_sb->s_blocksize;
+        dir_block = ext4_bread (handle, inode, 0, 1, &err);
+        if (!dir_block) {
+                drop_nlink(inode); /* is this nlink == 0? */
+                ext4_mark_inode_dirty(handle, inode);
+                iput (inode);
+                goto out_stop;
+        }
+        BUFFER_TRACE(dir_block, "get_write_access");
+        ext4_journal_get_write_access(handle, dir_block);
+        de = (struct ext4_dir_entry_2 *) dir_block->b_data;
+        de->inode = cpu_to_le32(inode->i_ino);
+        de->name_len = 1;
+        de->rec_len = cpu_to_le16(EXT4_DIR_REC_LEN(de->name_len));
+        strcpy (de->name, ".");
+        ext4_set_de_type(dir->i_sb, de, S_IFDIR);
+        de = (struct ext4_dir_entry_2 *)
+                        ((char *) de + le16_to_cpu(de->rec_len));
+        de->inode = cpu_to_le32(dir->i_ino);
+        de->rec_len = cpu_to_le16(inode->i_sb->s_blocksize-EXT4_DIR_REC_LEN(1));
+        de->name_len = 2;
+        strcpy (de->name, "..");
+        ext4_set_de_type(dir->i_sb, de, S_IFDIR);
+        inode->i_nlink = 2;
+        BUFFER_TRACE(dir_block, "call ext4_journal_dirty_metadata");
+        ext4_journal_dirty_metadata(handle, dir_block);
+        brelse (dir_block);
+        ext4_mark_inode_dirty(handle, inode);
+        err = ext4_add_entry (handle, dentry, inode);
+        if (err) {
+                inode->i_nlink = 0;
+                ext4_mark_inode_dirty(handle, inode);
+                iput (inode);
+                goto out_stop;
+        }
+        inc_nlink(dir);
+        ext4_update_dx_flag(dir);
+        ext4_mark_inode_dirty(handle, dir);
+        d_instantiate(dentry, inode);
+out_stop:
+        ext4_journal_stop(handle);
+        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
+                goto retry;
+        return err;
+}
+
+/*
+ * routine to check that the specified directory is empty (for rmdir)
+ */
+static int empty_dir (struct inode * inode)
+{
+        unsigned long offset;
+        struct buffer_head * bh;
+        struct ext4_dir_entry_2 * de, * de1;
+        struct super_block * sb;
+        int err = 0;
+
+        sb = inode->i_sb;
+        if (inode->i_size < EXT4_DIR_REC_LEN(1) + EXT4_DIR_REC_LEN(2) ||
+            !(bh = ext4_bread (NULL, inode, 0, 0, &err))) {
+                if (err)
+                        ext4_error(inode->i_sb, __FUNCTION__,
+                                   "error %d reading directory #%lu offset 0",
+                                   err, inode->i_ino);
+                else
+                        ext4_warning(inode->i_sb, __FUNCTION__,
+                                     "bad directory (dir #%lu) - no data block",
+                                     inode->i_ino);
+                return 1;
+        }
+        de = (struct ext4_dir_entry_2 *) bh->b_data;
+        de1 = (struct ext4_dir_entry_2 *)
+                        ((char *) de + le16_to_cpu(de->rec_len));
+        if (le32_to_cpu(de->inode) != inode->i_ino ||
+                        !le32_to_cpu(de1->inode) ||
+                        strcmp (".", de->name) ||
+                        strcmp ("..", de1->name)) {
+                ext4_warning (inode->i_sb, "empty_dir",
+                              "bad directory (dir #%lu) - no `.' or `..'",
+                              inode->i_ino);
+                brelse (bh);
+                return 1;
+        }
+        offset = le16_to_cpu(de->rec_len) + le16_to_cpu(de1->rec_len);
+        de = (struct ext4_dir_entry_2 *)
+                        ((char *) de1 + le16_to_cpu(de1->rec_len));
+        while (offset < inode->i_size ) {
+                if (!bh ||
+                        (void *) de >= (void *) (bh->b_data+sb->s_blocksize)) {
+                        err = 0;
+                        brelse (bh);
+                        bh = ext4_bread (NULL, inode,
+                                offset >> EXT4_BLOCK_SIZE_BITS(sb), 0, &err);
+                        if (!bh) {
+                                if (err)
+                                        ext4_error(sb, __FUNCTION__,
+                                                   "error %d reading directory"
+                                                   " #%lu offset %lu",
+                                                   err, inode->i_ino, offset);
+                                offset += sb->s_blocksize;
+                                continue;
+                        }
+                        de = (struct ext4_dir_entry_2 *) bh->b_data;
+                }
+                if (!ext4_check_dir_entry("empty_dir", inode, de, bh, offset)) {
+                        de = (struct ext4_dir_entry_2 *)(bh->b_data +
+                                                         sb->s_blocksize);
+                        offset = (offset | (sb->s_blocksize - 1)) + 1;
+                        continue;
+                }
+                if (le32_to_cpu(de->inode)) {
+                        brelse (bh);
+                        return 0;
+                }
+                offset += le16_to_cpu(de->rec_len);
+                de = (struct ext4_dir_entry_2 *)
+                                ((char *) de + le16_to_cpu(de->rec_len));
+        }
+        brelse (bh);
+        return 1;
+}
+
+/* ext4_orphan_add() links an unlinked or truncated inode into a list of
+ * such inodes, starting at the superblock, in case we crash before the
+ * file is closed/deleted, or in case the inode truncate spans multiple
+ * transactions and the last transaction is not recovered after a crash.
+ *
+ * At filesystem recovery time, we walk this list deleting unlinked
+ * inodes and truncating linked inodes in ext4_orphan_cleanup().
+ */
+int ext4_orphan_add(handle_t *handle, struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct ext4_iloc iloc;
+        int err = 0, rc;
+
+        lock_super(sb);
+        if (!list_empty(&EXT4_I(inode)->i_orphan))
+                goto out_unlock;
+
+        /* Orphan handling is only valid for files with data blocks
+         * being truncated, or files being unlinked. */
+
+        /* @@@ FIXME: Observation from aviro:
+         * I think I can trigger J_ASSERT in ext4_orphan_add().  We block
+         * here (on lock_super()), so race with ext4_link() which might bump
+         * ->i_nlink. For, say it, character device. Not a regular file,
+         * not a directory, not a symlink and ->i_nlink > 0.
+         */
+        J_ASSERT ((S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+                S_ISLNK(inode->i_mode)) || inode->i_nlink == 0);
+
+        BUFFER_TRACE(EXT4_SB(sb)->s_sbh, "get_write_access");
+        err = ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh);
+        if (err)
+                goto out_unlock;
+
+        err = ext4_reserve_inode_write(handle, inode, &iloc);
+        if (err)
+                goto out_unlock;
+
+        /* Insert this inode at the head of the on-disk orphan list... */
+        NEXT_ORPHAN(inode) = le32_to_cpu(EXT4_SB(sb)->s_es->s_last_orphan);
+        EXT4_SB(sb)->s_es->s_last_orphan = cpu_to_le32(inode->i_ino);
+        err = ext4_journal_dirty_metadata(handle, EXT4_SB(sb)->s_sbh);
+        rc = ext4_mark_iloc_dirty(handle, inode, &iloc);
+        if (!err)
+                err = rc;
+
+        /* Only add to the head of the in-memory list if all the
+         * previous operations succeeded.  If the orphan_add is going to
+         * fail (possibly taking the journal offline), we can't risk
+         * leaving the inode on the orphan list: stray orphan-list
+         * entries can cause panics at unmount time.
+         *
+         * This is safe: on error we're going to ignore the orphan list
+         * anyway on the next recovery. */
+        if (!err)
+                list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
+
+        jbd_debug(4, "superblock will point to %lu\n", inode->i_ino);
+        jbd_debug(4, "orphan inode %lu will point to %d\n",
+                        inode->i_ino, NEXT_ORPHAN(inode));
+out_unlock:
+        unlock_super(sb);
+        ext4_std_error(inode->i_sb, err);
+        return err;
+}
+
+/*
+ * ext4_orphan_del() removes an unlinked or truncated inode from the list
+ * of such inodes stored on disk, because it is finally being cleaned up.
+ */
+int ext4_orphan_del(handle_t *handle, struct inode *inode)
+{
+        struct list_head *prev;
+        struct ext4_inode_info *ei = EXT4_I(inode);
+        struct ext4_sb_info *sbi;
+        unsigned long ino_next;
+        struct ext4_iloc iloc;
+        int err = 0;
+
+        lock_super(inode->i_sb);
+        if (list_empty(&ei->i_orphan)) {
+                unlock_super(inode->i_sb);
+                return 0;
+        }
+
+        ino_next = NEXT_ORPHAN(inode);
+        prev = ei->i_orphan.prev;
+        sbi = EXT4_SB(inode->i_sb);
+
+        jbd_debug(4, "remove inode %lu from orphan list\n", inode->i_ino);
+
+        list_del_init(&ei->i_orphan);
+
+        /* If we're on an error path, we may not have a valid
+         * transaction handle with which to update the orphan list on
+         * disk, but we still need to remove the inode from the linked
+         * list in memory. */
+        if (!handle)
+                goto out;
+
+        err = ext4_reserve_inode_write(handle, inode, &iloc);
+        if (err)
+                goto out_err;
+
+        if (prev == &sbi->s_orphan) {
+                jbd_debug(4, "superblock will point to %lu\n", ino_next);
+                BUFFER_TRACE(sbi->s_sbh, "get_write_access");
+                err = ext4_journal_get_write_access(handle, sbi->s_sbh);
+                if (err)
+                        goto out_brelse;
+                sbi->s_es->s_last_orphan = cpu_to_le32(ino_next);
+                err = ext4_journal_dirty_metadata(handle, sbi->s_sbh);
+        } else {
+                struct ext4_iloc iloc2;
+                struct inode *i_prev =
+                        &list_entry(prev, struct ext4_inode_info, i_orphan)->vfs_inode;
+
+                jbd_debug(4, "orphan inode %lu will point to %lu\n",
+                          i_prev->i_ino, ino_next);
+                err = ext4_reserve_inode_write(handle, i_prev, &iloc2);
+                if (err)
+                        goto out_brelse;
+                NEXT_ORPHAN(i_prev) = ino_next;
+                err = ext4_mark_iloc_dirty(handle, i_prev, &iloc2);
+        }
+        if (err)
+                goto out_brelse;
+        NEXT_ORPHAN(inode) = 0;
+        err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+
+out_err:
+        ext4_std_error(inode->i_sb, err);
+out:
+        unlock_super(inode->i_sb);
+        return err;
+
+out_brelse:
+        brelse(iloc.bh);
+        goto out_err;
+}
+
+static int ext4_rmdir (struct inode * dir, struct dentry *dentry)
+{
+        int retval;
+        struct inode * inode;
+        struct buffer_head * bh;
+        struct ext4_dir_entry_2 * de;
+        handle_t *handle;
+
+        /* Initialize quotas before so that eventual writes go in
+         * separate transaction */
+        DQUOT_INIT(dentry->d_inode);
+        handle = ext4_journal_start(dir, EXT4_DELETE_TRANS_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        retval = -ENOENT;
+        bh = ext4_find_entry (dentry, &de);
+        if (!bh)
+                goto end_rmdir;
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode = dentry->d_inode;
+
+        retval = -EIO;
+        if (le32_to_cpu(de->inode) != inode->i_ino)
+                goto end_rmdir;
+
+        retval = -ENOTEMPTY;
+        if (!empty_dir (inode))
+                goto end_rmdir;
+
+        retval = ext4_delete_entry(handle, dir, de, bh);
+        if (retval)
+                goto end_rmdir;
+        if (inode->i_nlink != 2)
+                ext4_warning (inode->i_sb, "ext4_rmdir",
+                              "empty directory has nlink!=2 (%d)",
+                              inode->i_nlink);
+        inode->i_version++;
+        clear_nlink(inode);
+        /* There's no need to set i_disksize: the fact that i_nlink is
+         * zero will ensure that the right thing happens during any
+         * recovery. */
+        inode->i_size = 0;
+        ext4_orphan_add(handle, inode);
+        inode->i_ctime = dir->i_ctime = dir->i_mtime = CURRENT_TIME_SEC;
+        ext4_mark_inode_dirty(handle, inode);
+        drop_nlink(dir);
+        ext4_update_dx_flag(dir);
+        ext4_mark_inode_dirty(handle, dir);
+
+end_rmdir:
+        ext4_journal_stop(handle);
+        brelse (bh);
+        return retval;
+}
+
+static int ext4_unlink(struct inode * dir, struct dentry *dentry)
+{
+        int retval;
+        struct inode * inode;
+        struct buffer_head * bh;
+        struct ext4_dir_entry_2 * de;
+        handle_t *handle;
+
+        /* Initialize quotas before so that eventual writes go
+         * in separate transaction */
+        DQUOT_INIT(dentry->d_inode);
+        handle = ext4_journal_start(dir, EXT4_DELETE_TRANS_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        retval = -ENOENT;
+        bh = ext4_find_entry (dentry, &de);
+        if (!bh)
+                goto end_unlink;
+
+        inode = dentry->d_inode;
+
+        retval = -EIO;
+        if (le32_to_cpu(de->inode) != inode->i_ino)
+                goto end_unlink;
+
+        if (!inode->i_nlink) {
+                ext4_warning (inode->i_sb, "ext4_unlink",
+                              "Deleting nonexistent file (%lu), %d",
+                              inode->i_ino, inode->i_nlink);
+                inode->i_nlink = 1;
+        }
+        retval = ext4_delete_entry(handle, dir, de, bh);
+        if (retval)
+                goto end_unlink;
+        dir->i_ctime = dir->i_mtime = CURRENT_TIME_SEC;
+        ext4_update_dx_flag(dir);
+        ext4_mark_inode_dirty(handle, dir);
+        drop_nlink(inode);
+        if (!inode->i_nlink)
+                ext4_orphan_add(handle, inode);
+        inode->i_ctime = dir->i_ctime;
+        ext4_mark_inode_dirty(handle, inode);
+        retval = 0;
+
+end_unlink:
+        ext4_journal_stop(handle);
+        brelse (bh);
+        return retval;
+}
+
+static int ext4_symlink (struct inode * dir,
+                struct dentry *dentry, const char * symname)
+{
+        handle_t *handle;
+        struct inode * inode;
+        int l, err, retries = 0;
+
+        l = strlen(symname)+1;
+        if (l > dir->i_sb->s_blocksize)
+                return -ENAMETOOLONG;
+
+retry:
+        handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS + 5 +
+                                        2*EXT4_QUOTA_INIT_BLOCKS(dir->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode = ext4_new_inode (handle, dir, S_IFLNK|S_IRWXUGO);
+        err = PTR_ERR(inode);
+        if (IS_ERR(inode))
+                goto out_stop;
+
+        if (l > sizeof (EXT4_I(inode)->i_data)) {
+                inode->i_op = &ext4_symlink_inode_operations;
+                ext4_set_aops(inode);
+                /*
+                 * page_symlink() calls into ext4_prepare/commit_write.
+                 * We have a transaction open.  All is sweetness.  It also sets
+                 * i_size in generic_commit_write().
+                 */
+                err = __page_symlink(inode, symname, l,
+                                mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS);
+                if (err) {
+                        ext4_dec_count(handle, inode);
+                        ext4_mark_inode_dirty(handle, inode);
+                        iput (inode);
+                        goto out_stop;
+                }
+        } else {
+                inode->i_op = &ext4_fast_symlink_inode_operations;
+                memcpy((char*)&EXT4_I(inode)->i_data,symname,l);
+                inode->i_size = l-1;
+        }
+        EXT4_I(inode)->i_disksize = inode->i_size;
+        err = ext4_add_nondir(handle, dentry, inode);
+out_stop:
+        ext4_journal_stop(handle);
+        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
+                goto retry;
+        return err;
+}
+
+static int ext4_link (struct dentry * old_dentry,
+                struct inode * dir, struct dentry *dentry)
+{
+        handle_t *handle;
+        struct inode *inode = old_dentry->d_inode;
+        int err, retries = 0;
+
+        if (inode->i_nlink >= EXT4_LINK_MAX)
+                return -EMLINK;
+
+retry:
+        handle = ext4_journal_start(dir, EXT4_DATA_TRANS_BLOCKS(dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(dir))
+                handle->h_sync = 1;
+
+        inode->i_ctime = CURRENT_TIME_SEC;
+        ext4_inc_count(handle, inode);
+        atomic_inc(&inode->i_count);
+
+        err = ext4_add_nondir(handle, dentry, inode);
+        ext4_journal_stop(handle);
+        if (err == -ENOSPC && ext4_should_retry_alloc(dir->i_sb, &retries))
+                goto retry;
+        return err;
+}
+
+#define PARENT_INO(buffer) \
+        ((struct ext4_dir_entry_2 *) ((char *) buffer + \
+        le16_to_cpu(((struct ext4_dir_entry_2 *) buffer)->rec_len)))->inode
+
+/*
+ * Anybody can rename anything with this: the permission checks are left to the
+ * higher-level routines.
+ */
+static int ext4_rename (struct inode * old_dir, struct dentry *old_dentry,
+                           struct inode * new_dir,struct dentry *new_dentry)
+{
+        handle_t *handle;
+        struct inode * old_inode, * new_inode;
+        struct buffer_head * old_bh, * new_bh, * dir_bh;
+        struct ext4_dir_entry_2 * old_de, * new_de;
+        int retval;
+
+        old_bh = new_bh = dir_bh = NULL;
+
+        /* Initialize quotas before so that eventual writes go
+         * in separate transaction */
+        if (new_dentry->d_inode)
+                DQUOT_INIT(new_dentry->d_inode);
+        handle = ext4_journal_start(old_dir, 2 *
+                                        EXT4_DATA_TRANS_BLOCKS(old_dir->i_sb) +
+                                        EXT4_INDEX_EXTRA_TRANS_BLOCKS + 2);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        if (IS_DIRSYNC(old_dir) || IS_DIRSYNC(new_dir))
+                handle->h_sync = 1;
+
+        old_bh = ext4_find_entry (old_dentry, &old_de);
+        /*
+         *  Check for inode number is _not_ due to possible IO errors.
+         *  We might rmdir the source, keep it as pwd of some process
+         *  and merrily kill the link to whatever was created under the
+         *  same name. Goodbye sticky bit ;-<
+         */
+        old_inode = old_dentry->d_inode;
+        retval = -ENOENT;
+        if (!old_bh || le32_to_cpu(old_de->inode) != old_inode->i_ino)
+                goto end_rename;
+
+        new_inode = new_dentry->d_inode;
+        new_bh = ext4_find_entry (new_dentry, &new_de);
+        if (new_bh) {
+                if (!new_inode) {
+                        brelse (new_bh);
+                        new_bh = NULL;
+                }
+        }
+        if (S_ISDIR(old_inode->i_mode)) {
+                if (new_inode) {
+                        retval = -ENOTEMPTY;
+                        if (!empty_dir (new_inode))
+                                goto end_rename;
+                }
+                retval = -EIO;
+                dir_bh = ext4_bread (handle, old_inode, 0, 0, &retval);
+                if (!dir_bh)
+                        goto end_rename;
+                if (le32_to_cpu(PARENT_INO(dir_bh->b_data)) != old_dir->i_ino)
+                        goto end_rename;
+                retval = -EMLINK;
+                if (!new_inode && new_dir!=old_dir &&
+                                new_dir->i_nlink >= EXT4_LINK_MAX)
+                        goto end_rename;
+        }
+        if (!new_bh) {
+                retval = ext4_add_entry (handle, new_dentry, old_inode);
+                if (retval)
+                        goto end_rename;
+        } else {
+                BUFFER_TRACE(new_bh, "get write access");
+                ext4_journal_get_write_access(handle, new_bh);
+                new_de->inode = cpu_to_le32(old_inode->i_ino);
+                if (EXT4_HAS_INCOMPAT_FEATURE(new_dir->i_sb,
+                                              EXT4_FEATURE_INCOMPAT_FILETYPE))
+                        new_de->file_type = old_de->file_type;
+                new_dir->i_version++;
+                BUFFER_TRACE(new_bh, "call ext4_journal_dirty_metadata");
+                ext4_journal_dirty_metadata(handle, new_bh);
+                brelse(new_bh);
+                new_bh = NULL;
+        }
+
+        /*
+         * Like most other Unix systems, set the ctime for inodes on a
+         * rename.
+         */
+        old_inode->i_ctime = CURRENT_TIME_SEC;
+        ext4_mark_inode_dirty(handle, old_inode);
+
+        /*
+         * ok, that's it
+         */
+        if (le32_to_cpu(old_de->inode) != old_inode->i_ino ||
+            old_de->name_len != old_dentry->d_name.len ||
+            strncmp(old_de->name, old_dentry->d_name.name, old_de->name_len) ||
+            (retval = ext4_delete_entry(handle, old_dir,
+                                        old_de, old_bh)) == -ENOENT) {
+                /* old_de could have moved from under us during htree split, so
+                 * make sure that we are deleting the right entry.  We might
+                 * also be pointing to a stale entry in the unused part of
+                 * old_bh so just checking inum and the name isn't enough. */
+                struct buffer_head *old_bh2;
+                struct ext4_dir_entry_2 *old_de2;
+
+                old_bh2 = ext4_find_entry(old_dentry, &old_de2);
+                if (old_bh2) {
+                        retval = ext4_delete_entry(handle, old_dir,
+                                                   old_de2, old_bh2);
+                        brelse(old_bh2);
+                }
+        }
+        if (retval) {
+                ext4_warning(old_dir->i_sb, "ext4_rename",
+                                "Deleting old file (%lu), %d, error=%d",
+                                old_dir->i_ino, old_dir->i_nlink, retval);
+        }
+
+        if (new_inode) {
+                drop_nlink(new_inode);
+                new_inode->i_ctime = CURRENT_TIME_SEC;
+        }
+        old_dir->i_ctime = old_dir->i_mtime = CURRENT_TIME_SEC;
+        ext4_update_dx_flag(old_dir);
+        if (dir_bh) {
+                BUFFER_TRACE(dir_bh, "get_write_access");
+                ext4_journal_get_write_access(handle, dir_bh);
+                PARENT_INO(dir_bh->b_data) = cpu_to_le32(new_dir->i_ino);
+                BUFFER_TRACE(dir_bh, "call ext4_journal_dirty_metadata");
+                ext4_journal_dirty_metadata(handle, dir_bh);
+                drop_nlink(old_dir);
+                if (new_inode) {
+                        drop_nlink(new_inode);
+                } else {
+                        inc_nlink(new_dir);
+                        ext4_update_dx_flag(new_dir);
+                        ext4_mark_inode_dirty(handle, new_dir);
+                }
+        }
+        ext4_mark_inode_dirty(handle, old_dir);
+        if (new_inode) {
+                ext4_mark_inode_dirty(handle, new_inode);
+                if (!new_inode->i_nlink)
+                        ext4_orphan_add(handle, new_inode);
+        }
+        retval = 0;
+
+end_rename:
+        brelse (dir_bh);
+        brelse (old_bh);
+        brelse (new_bh);
+        ext4_journal_stop(handle);
+        return retval;
+}
+
+/*
+ * directories can handle most operations...
+ */
+struct inode_operations ext4_dir_inode_operations = {
+        .create         = ext4_create,
+        .lookup         = ext4_lookup,
+        .link           = ext4_link,
+        .unlink         = ext4_unlink,
+        .symlink        = ext4_symlink,
+        .mkdir          = ext4_mkdir,
+        .rmdir          = ext4_rmdir,
+        .mknod          = ext4_mknod,
+        .rename         = ext4_rename,
+        .setattr        = ext4_setattr,
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
+        .listxattr      = ext4_listxattr,
+        .removexattr    = generic_removexattr,
+#endif
+        .permission     = ext4_permission,
+};
+
+struct inode_operations ext4_special_inode_operations = {
+        .setattr        = ext4_setattr,
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
+        .listxattr      = ext4_listxattr,
+        .removexattr    = generic_removexattr,
+#endif
+        .permission     = ext4_permission,
+};
diff --git a/fs/ext4/namei.h b/fs/ext4/namei.h
new file mode 100644
index 000000000000..5e4dfff36a00
--- /dev/null
+++ b/fs/ext4/namei.h
@@ -0,0 +1,8 @@
+/*  linux/fs/ext4/namei.h
+ *
+ * Copyright (C) 2005 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+*/
+
+extern struct dentry *ext4_get_parent(struct dentry *child);
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
new file mode 100644
index 000000000000..4fe49c3661b2
--- /dev/null
+++ b/fs/ext4/resize.c
@@ -0,0 +1,1050 @@
+/*
+ *  linux/fs/ext4/resize.c
+ *
+ * Support for resizing an ext4 filesystem while it is mounted.
+ *
+ * Copyright (C) 2001, 2002 Andreas Dilger <adilger@clusterfs.com>
+ *
+ * This could probably be made into a module, because it is not often in use.
+ */
+
+
+#define EXT4FS_DEBUG
+
+#include <linux/sched.h>
+#include <linux/smp_lock.h>
+#include <linux/ext4_jbd2.h>
+
+#include <linux/errno.h>
+#include <linux/slab.h>
+
+
+#define outside(b, first, last) ((b) < (first) || (b) >= (last))
+#define inside(b, first, last)  ((b) >= (first) && (b) < (last))
+
+static int verify_group_input(struct super_block *sb,
+                              struct ext4_new_group_data *input)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        struct ext4_super_block *es = sbi->s_es;
+        ext4_fsblk_t start = ext4_blocks_count(es);
+        ext4_fsblk_t end = start + input->blocks_count;
+        unsigned group = input->group;
+        ext4_fsblk_t itend = input->inode_table + sbi->s_itb_per_group;
+        unsigned overhead = ext4_bg_has_super(sb, group) ?
+                (1 + ext4_bg_num_gdb(sb, group) +
+                 le16_to_cpu(es->s_reserved_gdt_blocks)) : 0;
+        ext4_fsblk_t metaend = start + overhead;
+        struct buffer_head *bh = NULL;
+        ext4_grpblk_t free_blocks_count, offset;
+        int err = -EINVAL;
+
+        input->free_blocks_count = free_blocks_count =
+                input->blocks_count - 2 - overhead - sbi->s_itb_per_group;
+
+        if (test_opt(sb, DEBUG))
+                printk(KERN_DEBUG "EXT4-fs: adding %s group %u: %u blocks "
+                       "(%d free, %u reserved)\n",
+                       ext4_bg_has_super(sb, input->group) ? "normal" :
+                       "no-super", input->group, input->blocks_count,
+                       free_blocks_count, input->reserved_blocks);
+
+        ext4_get_group_no_and_offset(sb, start, NULL, &offset);
+        if (group != sbi->s_groups_count)
+                ext4_warning(sb, __FUNCTION__,
+                             "Cannot add at group %u (only %lu groups)",
+                             input->group, sbi->s_groups_count);
+        else if (offset != 0)
+                        ext4_warning(sb, __FUNCTION__, "Last group not full");
+        else if (input->reserved_blocks > input->blocks_count / 5)
+                ext4_warning(sb, __FUNCTION__, "Reserved blocks too high (%u)",
+                             input->reserved_blocks);
+        else if (free_blocks_count < 0)
+                ext4_warning(sb, __FUNCTION__, "Bad blocks count %u",
+                             input->blocks_count);
+        else if (!(bh = sb_bread(sb, end - 1)))
+                ext4_warning(sb, __FUNCTION__,
+                             "Cannot read last block (%llu)",
+                             end - 1);
+        else if (outside(input->block_bitmap, start, end))
+                ext4_warning(sb, __FUNCTION__,
+                             "Block bitmap not in group (block %llu)",
+                             (unsigned long long)input->block_bitmap);
+        else if (outside(input->inode_bitmap, start, end))
+                ext4_warning(sb, __FUNCTION__,
+                             "Inode bitmap not in group (block %llu)",
+                             (unsigned long long)input->inode_bitmap);
+        else if (outside(input->inode_table, start, end) ||
+                 outside(itend - 1, start, end))
+                ext4_warning(sb, __FUNCTION__,
+                             "Inode table not in group (blocks %llu-%llu)",
+                             (unsigned long long)input->inode_table, itend - 1);
+        else if (input->inode_bitmap == input->block_bitmap)
+                ext4_warning(sb, __FUNCTION__,
+                             "Block bitmap same as inode bitmap (%llu)",
+                             (unsigned long long)input->block_bitmap);
+        else if (inside(input->block_bitmap, input->inode_table, itend))
+                ext4_warning(sb, __FUNCTION__,
+                             "Block bitmap (%llu) in inode table (%llu-%llu)",
+                             (unsigned long long)input->block_bitmap,
+                             (unsigned long long)input->inode_table, itend - 1);
+        else if (inside(input->inode_bitmap, input->inode_table, itend))
+                ext4_warning(sb, __FUNCTION__,
+                             "Inode bitmap (%llu) in inode table (%llu-%llu)",
+                             (unsigned long long)input->inode_bitmap,
+                             (unsigned long long)input->inode_table, itend - 1);
+        else if (inside(input->block_bitmap, start, metaend))
+                ext4_warning(sb, __FUNCTION__,
+                             "Block bitmap (%llu) in GDT table"
+                             " (%llu-%llu)",
+                             (unsigned long long)input->block_bitmap,
+                             start, metaend - 1);
+        else if (inside(input->inode_bitmap, start, metaend))
+                ext4_warning(sb, __FUNCTION__,
+                             "Inode bitmap (%llu) in GDT table"
+                             " (%llu-%llu)",
+                             (unsigned long long)input->inode_bitmap,
+                             start, metaend - 1);
+        else if (inside(input->inode_table, start, metaend) ||
+                 inside(itend - 1, start, metaend))
+                ext4_warning(sb, __FUNCTION__,
+                             "Inode table (%llu-%llu) overlaps"
+                             "GDT table (%llu-%llu)",
+                             (unsigned long long)input->inode_table,
+                             itend - 1, start, metaend - 1);
+        else
+                err = 0;
+        brelse(bh);
+
+        return err;
+}
+
+static struct buffer_head *bclean(handle_t *handle, struct super_block *sb,
+                                  ext4_fsblk_t blk)
+{
+        struct buffer_head *bh;
+        int err;
+
+        bh = sb_getblk(sb, blk);
+        if (!bh)
+                return ERR_PTR(-EIO);
+        if ((err = ext4_journal_get_write_access(handle, bh))) {
+                brelse(bh);
+                bh = ERR_PTR(err);
+        } else {
+                lock_buffer(bh);
+                memset(bh->b_data, 0, sb->s_blocksize);
+                set_buffer_uptodate(bh);
+                unlock_buffer(bh);
+        }
+
+        return bh;
+}
+
+/*
+ * To avoid calling the atomic setbit hundreds or thousands of times, we only
+ * need to use it within a single byte (to ensure we get endianness right).
+ * We can use memset for the rest of the bitmap as there are no other users.
+ */
+static void mark_bitmap_end(int start_bit, int end_bit, char *bitmap)
+{
+        int i;
+
+        if (start_bit >= end_bit)
+                return;
+
+        ext4_debug("mark end bits +%d through +%d used\n", start_bit, end_bit);
+        for (i = start_bit; i < ((start_bit + 7) & ~7UL); i++)
+                ext4_set_bit(i, bitmap);
+        if (i < end_bit)
+                memset(bitmap + (i >> 3), 0xff, (end_bit - i) >> 3);
+}
+
+/*
+ * Set up the block and inode bitmaps, and the inode table for the new group.
+ * This doesn't need to be part of the main transaction, since we are only
+ * changing blocks outside the actual filesystem.  We still do journaling to
+ * ensure the recovery is correct in case of a failure just after resize.
+ * If any part of this fails, we simply abort the resize.
+ */
+static int setup_new_group_blocks(struct super_block *sb,
+                                  struct ext4_new_group_data *input)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        ext4_fsblk_t start = ext4_group_first_block_no(sb, input->group);
+        int reserved_gdb = ext4_bg_has_super(sb, input->group) ?
+                le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) : 0;
+        unsigned long gdblocks = ext4_bg_num_gdb(sb, input->group);
+        struct buffer_head *bh;
+        handle_t *handle;
+        ext4_fsblk_t block;
+        ext4_grpblk_t bit;
+        int i;
+        int err = 0, err2;
+
+        handle = ext4_journal_start_sb(sb, reserved_gdb + gdblocks +
+                                       2 + sbi->s_itb_per_group);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+
+        lock_super(sb);
+        if (input->group != sbi->s_groups_count) {
+                err = -EBUSY;
+                goto exit_journal;
+        }
+
+        if (IS_ERR(bh = bclean(handle, sb, input->block_bitmap))) {
+                err = PTR_ERR(bh);
+                goto exit_journal;
+        }
+
+        if (ext4_bg_has_super(sb, input->group)) {
+                ext4_debug("mark backup superblock %#04lx (+0)\n", start);
+                ext4_set_bit(0, bh->b_data);
+        }
+
+        /* Copy all of the GDT blocks into the backup in this group */
+        for (i = 0, bit = 1, block = start + 1;
+             i < gdblocks; i++, block++, bit++) {
+                struct buffer_head *gdb;
+
+                ext4_debug("update backup group %#04lx (+%d)\n", block, bit);
+
+                gdb = sb_getblk(sb, block);
+                if (!gdb) {
+                        err = -EIO;
+                        goto exit_bh;
+                }
+                if ((err = ext4_journal_get_write_access(handle, gdb))) {
+                        brelse(gdb);
+                        goto exit_bh;
+                }
+                lock_buffer(bh);
+                memcpy(gdb->b_data, sbi->s_group_desc[i]->b_data, bh->b_size);
+                set_buffer_uptodate(gdb);
+                unlock_buffer(bh);
+                ext4_journal_dirty_metadata(handle, gdb);
+                ext4_set_bit(bit, bh->b_data);
+                brelse(gdb);
+        }
+
+        /* Zero out all of the reserved backup group descriptor table blocks */
+        for (i = 0, bit = gdblocks + 1, block = start + bit;
+             i < reserved_gdb; i++, block++, bit++) {
+                struct buffer_head *gdb;
+
+                ext4_debug("clear reserved block %#04lx (+%d)\n", block, bit);
+
+                if (IS_ERR(gdb = bclean(handle, sb, block))) {
+                        err = PTR_ERR(bh);
+                        goto exit_bh;
+                }
+                ext4_journal_dirty_metadata(handle, gdb);
+                ext4_set_bit(bit, bh->b_data);
+                brelse(gdb);
+        }
+        ext4_debug("mark block bitmap %#04x (+%ld)\n", input->block_bitmap,
+                   input->block_bitmap - start);
+        ext4_set_bit(input->block_bitmap - start, bh->b_data);
+        ext4_debug("mark inode bitmap %#04x (+%ld)\n", input->inode_bitmap,
+                   input->inode_bitmap - start);
+        ext4_set_bit(input->inode_bitmap - start, bh->b_data);
+
+        /* Zero out all of the inode table blocks */
+        for (i = 0, block = input->inode_table, bit = block - start;
+             i < sbi->s_itb_per_group; i++, bit++, block++) {
+                struct buffer_head *it;
+
+                ext4_debug("clear inode block %#04lx (+%d)\n", block, bit);
+                if (IS_ERR(it = bclean(handle, sb, block))) {
+                        err = PTR_ERR(it);
+                        goto exit_bh;
+                }
+                ext4_journal_dirty_metadata(handle, it);
+                brelse(it);
+                ext4_set_bit(bit, bh->b_data);
+        }
+        mark_bitmap_end(input->blocks_count, EXT4_BLOCKS_PER_GROUP(sb),
+                        bh->b_data);
+        ext4_journal_dirty_metadata(handle, bh);
+        brelse(bh);
+
+        /* Mark unused entries in inode bitmap used */
+        ext4_debug("clear inode bitmap %#04x (+%ld)\n",
+                   input->inode_bitmap, input->inode_bitmap - start);
+        if (IS_ERR(bh = bclean(handle, sb, input->inode_bitmap))) {
+                err = PTR_ERR(bh);
+                goto exit_journal;
+        }
+
+        mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), EXT4_BLOCKS_PER_GROUP(sb),
+                        bh->b_data);
+        ext4_journal_dirty_metadata(handle, bh);
+exit_bh:
+        brelse(bh);
+
+exit_journal:
+        unlock_super(sb);
+        if ((err2 = ext4_journal_stop(handle)) && !err)
+                err = err2;
+
+        return err;
+}
+
+
+/*
+ * Iterate through the groups which hold BACKUP superblock/GDT copies in an
+ * ext4 filesystem.  The counters should be initialized to 1, 5, and 7 before
+ * calling this for the first time.  In a sparse filesystem it will be the
+ * sequence of powers of 3, 5, and 7: 1, 3, 5, 7, 9, 25, 27, 49, 81, ...
+ * For a non-sparse filesystem it will be every group: 1, 2, 3, 4, ...
+ */
+static unsigned ext4_list_backups(struct super_block *sb, unsigned *three,
+                                  unsigned *five, unsigned *seven)
+{
+        unsigned *min = three;
+        int mult = 3;
+        unsigned ret;
+
+        if (!EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                        EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER)) {
+                ret = *min;
+                *min += 1;
+                return ret;
+        }
+
+        if (*five < *min) {
+                min = five;
+                mult = 5;
+        }
+        if (*seven < *min) {
+                min = seven;
+                mult = 7;
+        }
+
+        ret = *min;
+        *min *= mult;
+
+        return ret;
+}
+
+/*
+ * Check that all of the backup GDT blocks are held in the primary GDT block.
+ * It is assumed that they are stored in group order.  Returns the number of
+ * groups in current filesystem that have BACKUPS, or -ve error code.
+ */
+static int verify_reserved_gdb(struct super_block *sb,
+                               struct buffer_head *primary)
+{
+        const ext4_fsblk_t blk = primary->b_blocknr;
+        const unsigned long end = EXT4_SB(sb)->s_groups_count;
+        unsigned three = 1;
+        unsigned five = 5;
+        unsigned seven = 7;
+        unsigned grp;
+        __le32 *p = (__le32 *)primary->b_data;
+        int gdbackups = 0;
+
+        while ((grp = ext4_list_backups(sb, &three, &five, &seven)) < end) {
+                if (le32_to_cpu(*p++) !=
+                    grp * EXT4_BLOCKS_PER_GROUP(sb) + blk){
+                        ext4_warning(sb, __FUNCTION__,
+                                     "reserved GDT %llu"
+                                     " missing grp %d (%llu)",
+                                     blk, grp,
+                                     grp *
+                                     (ext4_fsblk_t)EXT4_BLOCKS_PER_GROUP(sb) +
+                                     blk);
+                        return -EINVAL;
+                }
+                if (++gdbackups > EXT4_ADDR_PER_BLOCK(sb))
+                        return -EFBIG;
+        }
+
+        return gdbackups;
+}
+
+/*
+ * Called when we need to bring a reserved group descriptor table block into
+ * use from the resize inode.  The primary copy of the new GDT block currently
+ * is an indirect block (under the double indirect block in the resize inode).
+ * The new backup GDT blocks will be stored as leaf blocks in this indirect
+ * block, in group order.  Even though we know all the block numbers we need,
+ * we check to ensure that the resize inode has actually reserved these blocks.
+ *
+ * Don't need to update the block bitmaps because the blocks are still in use.
+ *
+ * We get all of the error cases out of the way, so that we are sure to not
+ * fail once we start modifying the data on disk, because JBD has no rollback.
+ */
+static int add_new_gdb(handle_t *handle, struct inode *inode,
+                       struct ext4_new_group_data *input,
+                       struct buffer_head **primary)
+{
+        struct super_block *sb = inode->i_sb;
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+        unsigned long gdb_num = input->group / EXT4_DESC_PER_BLOCK(sb);
+        ext4_fsblk_t gdblock = EXT4_SB(sb)->s_sbh->b_blocknr + 1 + gdb_num;
+        struct buffer_head **o_group_desc, **n_group_desc;
+        struct buffer_head *dind;
+        int gdbackups;
+        struct ext4_iloc iloc;
+        __le32 *data;
+        int err;
+
+        if (test_opt(sb, DEBUG))
+                printk(KERN_DEBUG
+                       "EXT4-fs: ext4_add_new_gdb: adding group block %lu\n",
+                       gdb_num);
+
+        /*
+         * If we are not using the primary superblock/GDT copy don't resize,
+         * because the user tools have no way of handling this.  Probably a
+         * bad time to do it anyways.
+         */
+        if (EXT4_SB(sb)->s_sbh->b_blocknr !=
+            le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+                ext4_warning(sb, __FUNCTION__,
+                        "won't resize using backup superblock at %llu",
+                        (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
+                return -EPERM;
+        }
+
+        *primary = sb_bread(sb, gdblock);
+        if (!*primary)
+                return -EIO;
+
+        if ((gdbackups = verify_reserved_gdb(sb, *primary)) < 0) {
+                err = gdbackups;
+                goto exit_bh;
+        }
+
+        data = EXT4_I(inode)->i_data + EXT4_DIND_BLOCK;
+        dind = sb_bread(sb, le32_to_cpu(*data));
+        if (!dind) {
+                err = -EIO;
+                goto exit_bh;
+        }
+
+        data = (__le32 *)dind->b_data;
+        if (le32_to_cpu(data[gdb_num % EXT4_ADDR_PER_BLOCK(sb)]) != gdblock) {
+                ext4_warning(sb, __FUNCTION__,
+                             "new group %u GDT block %llu not reserved",
+                             input->group, gdblock);
+                err = -EINVAL;
+                goto exit_dind;
+        }
+
+        if ((err = ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh)))
+                goto exit_dind;
+
+        if ((err = ext4_journal_get_write_access(handle, *primary)))
+                goto exit_sbh;
+
+        if ((err = ext4_journal_get_write_access(handle, dind)))
+                goto exit_primary;
+
+        /* ext4_reserve_inode_write() gets a reference on the iloc */
+        if ((err = ext4_reserve_inode_write(handle, inode, &iloc)))
+                goto exit_dindj;
+
+        n_group_desc = kmalloc((gdb_num + 1) * sizeof(struct buffer_head *),
+                        GFP_KERNEL);
+        if (!n_group_desc) {
+                err = -ENOMEM;
+                ext4_warning (sb, __FUNCTION__,
+                              "not enough memory for %lu groups", gdb_num + 1);
+                goto exit_inode;
+        }
+
+        /*
+         * Finally, we have all of the possible failures behind us...
+         *
+         * Remove new GDT block from inode double-indirect block and clear out
+         * the new GDT block for use (which also "frees" the backup GDT blocks
+         * from the reserved inode).  We don't need to change the bitmaps for
+         * these blocks, because they are marked as in-use from being in the
+         * reserved inode, and will become GDT blocks (primary and backup).
+         */
+        data[gdb_num % EXT4_ADDR_PER_BLOCK(sb)] = 0;
+        ext4_journal_dirty_metadata(handle, dind);
+        brelse(dind);
+        inode->i_blocks -= (gdbackups + 1) * sb->s_blocksize >> 9;
+        ext4_mark_iloc_dirty(handle, inode, &iloc);
+        memset((*primary)->b_data, 0, sb->s_blocksize);
+        ext4_journal_dirty_metadata(handle, *primary);
+
+        o_group_desc = EXT4_SB(sb)->s_group_desc;
+        memcpy(n_group_desc, o_group_desc,
+               EXT4_SB(sb)->s_gdb_count * sizeof(struct buffer_head *));
+        n_group_desc[gdb_num] = *primary;
+        EXT4_SB(sb)->s_group_desc = n_group_desc;
+        EXT4_SB(sb)->s_gdb_count++;
+        kfree(o_group_desc);
+
+        es->s_reserved_gdt_blocks =
+                cpu_to_le16(le16_to_cpu(es->s_reserved_gdt_blocks) - 1);
+        ext4_journal_dirty_metadata(handle, EXT4_SB(sb)->s_sbh);
+
+        return 0;
+
+exit_inode:
+        //ext4_journal_release_buffer(handle, iloc.bh);
+        brelse(iloc.bh);
+exit_dindj:
+        //ext4_journal_release_buffer(handle, dind);
+exit_primary:
+        //ext4_journal_release_buffer(handle, *primary);
+exit_sbh:
+        //ext4_journal_release_buffer(handle, *primary);
+exit_dind:
+        brelse(dind);
+exit_bh:
+        brelse(*primary);
+
+        ext4_debug("leaving with error %d\n", err);
+        return err;
+}
+
+/*
+ * Called when we are adding a new group which has a backup copy of each of
+ * the GDT blocks (i.e. sparse group) and there are reserved GDT blocks.
+ * We need to add these reserved backup GDT blocks to the resize inode, so
+ * that they are kept for future resizing and not allocated to files.
+ *
+ * Each reserved backup GDT block will go into a different indirect block.
+ * The indirect blocks are actually the primary reserved GDT blocks,
+ * so we know in advance what their block numbers are.  We only get the
+ * double-indirect block to verify it is pointing to the primary reserved
+ * GDT blocks so we don't overwrite a data block by accident.  The reserved
+ * backup GDT blocks are stored in their reserved primary GDT block.
+ */
+static int reserve_backup_gdb(handle_t *handle, struct inode *inode,
+                              struct ext4_new_group_data *input)
+{
+        struct super_block *sb = inode->i_sb;
+        int reserved_gdb =le16_to_cpu(EXT4_SB(sb)->s_es->s_reserved_gdt_blocks);
+        struct buffer_head **primary;
+        struct buffer_head *dind;
+        struct ext4_iloc iloc;
+        ext4_fsblk_t blk;
+        __le32 *data, *end;
+        int gdbackups = 0;
+        int res, i;
+        int err;
+
+        primary = kmalloc(reserved_gdb * sizeof(*primary), GFP_KERNEL);
+        if (!primary)
+                return -ENOMEM;
+
+        data = EXT4_I(inode)->i_data + EXT4_DIND_BLOCK;
+        dind = sb_bread(sb, le32_to_cpu(*data));
+        if (!dind) {
+                err = -EIO;
+                goto exit_free;
+        }
+
+        blk = EXT4_SB(sb)->s_sbh->b_blocknr + 1 + EXT4_SB(sb)->s_gdb_count;
+        data = (__le32 *)dind->b_data + EXT4_SB(sb)->s_gdb_count;
+        end = (__le32 *)dind->b_data + EXT4_ADDR_PER_BLOCK(sb);
+
+        /* Get each reserved primary GDT block and verify it holds backups */
+        for (res = 0; res < reserved_gdb; res++, blk++) {
+                if (le32_to_cpu(*data) != blk) {
+                        ext4_warning(sb, __FUNCTION__,
+                                     "reserved block %llu"
+                                     " not at offset %ld",
+                                     blk,
+                                     (long)(data - (__le32 *)dind->b_data));
+                        err = -EINVAL;
+                        goto exit_bh;
+                }
+                primary[res] = sb_bread(sb, blk);
+                if (!primary[res]) {
+                        err = -EIO;
+                        goto exit_bh;
+                }
+                if ((gdbackups = verify_reserved_gdb(sb, primary[res])) < 0) {
+                        brelse(primary[res]);
+                        err = gdbackups;
+                        goto exit_bh;
+                }
+                if (++data >= end)
+                        data = (__le32 *)dind->b_data;
+        }
+
+        for (i = 0; i < reserved_gdb; i++) {
+                if ((err = ext4_journal_get_write_access(handle, primary[i]))) {
+                        /*
+                        int j;
+                        for (j = 0; j < i; j++)
+                                ext4_journal_release_buffer(handle, primary[j]);
+                         */
+                        goto exit_bh;
+                }
+        }
+
+        if ((err = ext4_reserve_inode_write(handle, inode, &iloc)))
+                goto exit_bh;
+
+        /*
+         * Finally we can add each of the reserved backup GDT blocks from
+         * the new group to its reserved primary GDT block.
+         */
+        blk = input->group * EXT4_BLOCKS_PER_GROUP(sb);
+        for (i = 0; i < reserved_gdb; i++) {
+                int err2;
+                data = (__le32 *)primary[i]->b_data;
+                /* printk("reserving backup %lu[%u] = %lu\n",
+                       primary[i]->b_blocknr, gdbackups,
+                       blk + primary[i]->b_blocknr); */
+                data[gdbackups] = cpu_to_le32(blk + primary[i]->b_blocknr);
+                err2 = ext4_journal_dirty_metadata(handle, primary[i]);
+                if (!err)
+                        err = err2;
+        }
+        inode->i_blocks += reserved_gdb * sb->s_blocksize >> 9;
+        ext4_mark_iloc_dirty(handle, inode, &iloc);
+
+exit_bh:
+        while (--res >= 0)
+                brelse(primary[res]);
+        brelse(dind);
+
+exit_free:
+        kfree(primary);
+
+        return err;
+}
+
+/*
+ * Update the backup copies of the ext4 metadata.  These don't need to be part
+ * of the main resize transaction, because e2fsck will re-write them if there
+ * is a problem (basically only OOM will cause a problem).  However, we
+ * _should_ update the backups if possible, in case the primary gets trashed
+ * for some reason and we need to run e2fsck from a backup superblock.  The
+ * important part is that the new block and inode counts are in the backup
+ * superblocks, and the location of the new group metadata in the GDT backups.
+ *
+ * We do not need lock_super() for this, because these blocks are not
+ * otherwise touched by the filesystem code when it is mounted.  We don't
+ * need to worry about last changing from sbi->s_groups_count, because the
+ * worst that can happen is that we do not copy the full number of backups
+ * at this time.  The resize which changed s_groups_count will backup again.
+ */
+static void update_backups(struct super_block *sb,
+                           int blk_off, char *data, int size)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        const unsigned long last = sbi->s_groups_count;
+        const int bpg = EXT4_BLOCKS_PER_GROUP(sb);
+        unsigned three = 1;
+        unsigned five = 5;
+        unsigned seven = 7;
+        unsigned group;
+        int rest = sb->s_blocksize - size;
+        handle_t *handle;
+        int err = 0, err2;
+
+        handle = ext4_journal_start_sb(sb, EXT4_MAX_TRANS_DATA);
+        if (IS_ERR(handle)) {
+                group = 1;
+                err = PTR_ERR(handle);
+                goto exit_err;
+        }
+
+        while ((group = ext4_list_backups(sb, &three, &five, &seven)) < last) {
+                struct buffer_head *bh;
+
+                /* Out of journal space, and can't get more - abort - so sad */
+                if (handle->h_buffer_credits == 0 &&
+                    ext4_journal_extend(handle, EXT4_MAX_TRANS_DATA) &&
+                    (err = ext4_journal_restart(handle, EXT4_MAX_TRANS_DATA)))
+                        break;
+
+                bh = sb_getblk(sb, group * bpg + blk_off);
+                if (!bh) {
+                        err = -EIO;
+                        break;
+                }
+                ext4_debug("update metadata backup %#04lx\n",
+                          (unsigned long)bh->b_blocknr);
+                if ((err = ext4_journal_get_write_access(handle, bh)))
+                        break;
+                lock_buffer(bh);
+                memcpy(bh->b_data, data, size);
+                if (rest)
+                        memset(bh->b_data + size, 0, rest);
+                set_buffer_uptodate(bh);
+                unlock_buffer(bh);
+                ext4_journal_dirty_metadata(handle, bh);
+                brelse(bh);
+        }
+        if ((err2 = ext4_journal_stop(handle)) && !err)
+                err = err2;
+
+        /*
+         * Ugh! Need to have e2fsck write the backup copies.  It is too
+         * late to revert the resize, we shouldn't fail just because of
+         * the backup copies (they are only needed in case of corruption).
+         *
+         * However, if we got here we have a journal problem too, so we
+         * can't really start a transaction to mark the superblock.
+         * Chicken out and just set the flag on the hope it will be written
+         * to disk, and if not - we will simply wait until next fsck.
+         */
+exit_err:
+        if (err) {
+                ext4_warning(sb, __FUNCTION__,
+                             "can't update backup for group %d (err %d), "
+                             "forcing fsck on next reboot", group, err);
+                sbi->s_mount_state &= ~EXT4_VALID_FS;
+                sbi->s_es->s_state &= cpu_to_le16(~EXT4_VALID_FS);
+                mark_buffer_dirty(sbi->s_sbh);
+        }
+}
+
+/* Add group descriptor data to an existing or new group descriptor block.
+ * Ensure we handle all possible error conditions _before_ we start modifying
+ * the filesystem, because we cannot abort the transaction and not have it
+ * write the data to disk.
+ *
+ * If we are on a GDT block boundary, we need to get the reserved GDT block.
+ * Otherwise, we may need to add backup GDT blocks for a sparse group.
+ *
+ * We only need to hold the superblock lock while we are actually adding
+ * in the new group's counts to the superblock.  Prior to that we have
+ * not really "added" the group at all.  We re-check that we are still
+ * adding in the last group in case things have changed since verifying.
+ */
+int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        struct ext4_super_block *es = sbi->s_es;
+        int reserved_gdb = ext4_bg_has_super(sb, input->group) ?
+                le16_to_cpu(es->s_reserved_gdt_blocks) : 0;
+        struct buffer_head *primary = NULL;
+        struct ext4_group_desc *gdp;
+        struct inode *inode = NULL;
+        handle_t *handle;
+        int gdb_off, gdb_num;
+        int err, err2;
+
+        gdb_num = input->group / EXT4_DESC_PER_BLOCK(sb);
+        gdb_off = input->group % EXT4_DESC_PER_BLOCK(sb);
+
+        if (gdb_off == 0 && !EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                        EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER)) {
+                ext4_warning(sb, __FUNCTION__,
+                             "Can't resize non-sparse filesystem further");
+                return -EPERM;
+        }
+
+        if (ext4_blocks_count(es) + input->blocks_count <
+            ext4_blocks_count(es)) {
+                ext4_warning(sb, __FUNCTION__, "blocks_count overflow\n");
+                return -EINVAL;
+        }
+
+        if (le32_to_cpu(es->s_inodes_count) + EXT4_INODES_PER_GROUP(sb) <
+            le32_to_cpu(es->s_inodes_count)) {
+                ext4_warning(sb, __FUNCTION__, "inodes_count overflow\n");
+                return -EINVAL;
+        }
+
+        if (reserved_gdb || gdb_off == 0) {
+                if (!EXT4_HAS_COMPAT_FEATURE(sb,
+                                             EXT4_FEATURE_COMPAT_RESIZE_INODE)){
+                        ext4_warning(sb, __FUNCTION__,
+                                     "No reserved GDT blocks, can't resize");
+                        return -EPERM;
+                }
+                inode = iget(sb, EXT4_RESIZE_INO);
+                if (!inode || is_bad_inode(inode)) {
+                        ext4_warning(sb, __FUNCTION__,
+                                     "Error opening resize inode");
+                        iput(inode);
+                        return -ENOENT;
+                }
+        }
+
+        if ((err = verify_group_input(sb, input)))
+                goto exit_put;
+
+        if ((err = setup_new_group_blocks(sb, input)))
+                goto exit_put;
+
+        /*
+         * We will always be modifying at least the superblock and a GDT
+         * block.  If we are adding a group past the last current GDT block,
+         * we will also modify the inode and the dindirect block.  If we
+         * are adding a group with superblock/GDT backups  we will also
+         * modify each of the reserved GDT dindirect blocks.
+         */
+        handle = ext4_journal_start_sb(sb,
+                                       ext4_bg_has_super(sb, input->group) ?
+                                       3 + reserved_gdb : 4);
+        if (IS_ERR(handle)) {
+                err = PTR_ERR(handle);
+                goto exit_put;
+        }
+
+        lock_super(sb);
+        if (input->group != sbi->s_groups_count) {
+                ext4_warning(sb, __FUNCTION__,
+                             "multiple resizers run on filesystem!");
+                err = -EBUSY;
+                goto exit_journal;
+        }
+
+        if ((err = ext4_journal_get_write_access(handle, sbi->s_sbh)))
+                goto exit_journal;
+
+        /*
+         * We will only either add reserved group blocks to a backup group
+         * or remove reserved blocks for the first group in a new group block.
+         * Doing both would be mean more complex code, and sane people don't
+         * use non-sparse filesystems anymore.  This is already checked above.
+         */
+        if (gdb_off) {
+                primary = sbi->s_group_desc[gdb_num];
+                if ((err = ext4_journal_get_write_access(handle, primary)))
+                        goto exit_journal;
+
+                if (reserved_gdb && ext4_bg_num_gdb(sb, input->group) &&
+                    (err = reserve_backup_gdb(handle, inode, input)))
+                        goto exit_journal;
+        } else if ((err = add_new_gdb(handle, inode, input, &primary)))
+                goto exit_journal;
+
+        /*
+         * OK, now we've set up the new group.  Time to make it active.
+         *
+         * Current kernels don't lock all allocations via lock_super(),
+         * so we have to be safe wrt. concurrent accesses the group
+         * data.  So we need to be careful to set all of the relevant
+         * group descriptor data etc. *before* we enable the group.
+         *
+         * The key field here is sbi->s_groups_count: as long as
+         * that retains its old value, nobody is going to access the new
+         * group.
+         *
+         * So first we update all the descriptor metadata for the new
+         * group; then we update the total disk blocks count; then we
+         * update the groups count to enable the group; then finally we
+         * update the free space counts so that the system can start
+         * using the new disk blocks.
+         */
+
+        /* Update group descriptor block for new group */
+        gdp = (struct ext4_group_desc *)primary->b_data + gdb_off;
+
+        ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
+        ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
+        ext4_inode_table_set(sb, gdp, input->inode_table); /* LV FIXME */
+        gdp->bg_free_blocks_count = cpu_to_le16(input->free_blocks_count);
+        gdp->bg_free_inodes_count = cpu_to_le16(EXT4_INODES_PER_GROUP(sb));
+
+        /*
+         * Make the new blocks and inodes valid next.  We do this before
+         * increasing the group count so that once the group is enabled,
+         * all of its blocks and inodes are already valid.
+         *
+         * We always allocate group-by-group, then block-by-block or
+         * inode-by-inode within a group, so enabling these
+         * blocks/inodes before the group is live won't actually let us
+         * allocate the new space yet.
+         */
+        ext4_blocks_count_set(es, ext4_blocks_count(es) +
+                input->blocks_count);
+        es->s_inodes_count = cpu_to_le32(le32_to_cpu(es->s_inodes_count) +
+                EXT4_INODES_PER_GROUP(sb));
+
+        /*
+         * We need to protect s_groups_count against other CPUs seeing
+         * inconsistent state in the superblock.
+         *
+         * The precise rules we use are:
+         *
+         * * Writers of s_groups_count *must* hold lock_super
+         * AND
+         * * Writers must perform a smp_wmb() after updating all dependent
+         *   data and before modifying the groups count
+         *
+         * * Readers must hold lock_super() over the access
+         * OR
+         * * Readers must perform an smp_rmb() after reading the groups count
+         *   and before reading any dependent data.
+         *
+         * NB. These rules can be relaxed when checking the group count
+         * while freeing data, as we can only allocate from a block
+         * group after serialising against the group count, and we can
+         * only then free after serialising in turn against that
+         * allocation.
+         */
+        smp_wmb();
+
+        /* Update the global fs size fields */
+        sbi->s_groups_count++;
+
+        ext4_journal_dirty_metadata(handle, primary);
+
+        /* Update the reserved block counts only once the new group is
+         * active. */
+        ext4_r_blocks_count_set(es, ext4_r_blocks_count(es) +
+                input->reserved_blocks);
+
+        /* Update the free space counts */
+        percpu_counter_mod(&sbi->s_freeblocks_counter,
+                           input->free_blocks_count);
+        percpu_counter_mod(&sbi->s_freeinodes_counter,
+                           EXT4_INODES_PER_GROUP(sb));
+
+        ext4_journal_dirty_metadata(handle, sbi->s_sbh);
+        sb->s_dirt = 1;
+
+exit_journal:
+        unlock_super(sb);
+        if ((err2 = ext4_journal_stop(handle)) && !err)
+                err = err2;
+        if (!err) {
+                update_backups(sb, sbi->s_sbh->b_blocknr, (char *)es,
+                               sizeof(struct ext4_super_block));
+                update_backups(sb, primary->b_blocknr, primary->b_data,
+                               primary->b_size);
+        }
+exit_put:
+        iput(inode);
+        return err;
+} /* ext4_group_add */
+
+/* Extend the filesystem to the new number of blocks specified.  This entry
+ * point is only used to extend the current filesystem to the end of the last
+ * existing group.  It can be accessed via ioctl, or by "remount,resize=<size>"
+ * for emergencies (because it has no dependencies on reserved blocks).
+ *
+ * If we _really_ wanted, we could use default values to call ext4_group_add()
+ * allow the "remount" trick to work for arbitrary resizing, assuming enough
+ * GDT blocks are reserved to grow to the desired size.
+ */
+int ext4_group_extend(struct super_block *sb, struct ext4_super_block *es,
+                      ext4_fsblk_t n_blocks_count)
+{
+        ext4_fsblk_t o_blocks_count;
+        unsigned long o_groups_count;
+        ext4_grpblk_t last;
+        ext4_grpblk_t add;
+        struct buffer_head * bh;
+        handle_t *handle;
+        int err;
+        unsigned long freed_blocks;
+
+        /* We don't need to worry about locking wrt other resizers just
+         * yet: we're going to revalidate es->s_blocks_count after
+         * taking lock_super() below. */
+        o_blocks_count = ext4_blocks_count(es);
+        o_groups_count = EXT4_SB(sb)->s_groups_count;
+
+        if (test_opt(sb, DEBUG))
+                printk(KERN_DEBUG "EXT4-fs: extending last group from %llu uto %llu blocks\n",
+                       o_blocks_count, n_blocks_count);
+
+        if (n_blocks_count == 0 || n_blocks_count == o_blocks_count)
+                return 0;
+
+        if (n_blocks_count > (sector_t)(~0ULL) >> (sb->s_blocksize_bits - 9)) {
+                printk(KERN_ERR "EXT4-fs: filesystem on %s:"
+                        " too large to resize to %llu blocks safely\n",
+                        sb->s_id, n_blocks_count);
+                if (sizeof(sector_t) < 8)
+                        ext4_warning(sb, __FUNCTION__,
+                        "CONFIG_LBD not enabled\n");
+                return -EINVAL;
+        }
+
+        if (n_blocks_count < o_blocks_count) {
+                ext4_warning(sb, __FUNCTION__,
+                             "can't shrink FS - resize aborted");
+                return -EBUSY;
+        }
+
+        /* Handle the remaining blocks in the last group only. */
+        ext4_get_group_no_and_offset(sb, o_blocks_count, NULL, &last);
+
+        if (last == 0) {
+                ext4_warning(sb, __FUNCTION__,
+                             "need to use ext2online to resize further");
+                return -EPERM;
+        }
+
+        add = EXT4_BLOCKS_PER_GROUP(sb) - last;
+
+        if (o_blocks_count + add < o_blocks_count) {
+                ext4_warning(sb, __FUNCTION__, "blocks_count overflow");
+                return -EINVAL;
+        }
+
+        if (o_blocks_count + add > n_blocks_count)
+                add = n_blocks_count - o_blocks_count;
+
+        if (o_blocks_count + add < n_blocks_count)
+                ext4_warning(sb, __FUNCTION__,
+                             "will only finish group (%llu"
+                             " blocks, %u new)",
+                             o_blocks_count + add, add);
+
+        /* See if the device is actually as big as what was requested */
+        bh = sb_bread(sb, o_blocks_count + add -1);
+        if (!bh) {
+                ext4_warning(sb, __FUNCTION__,
+                             "can't read last block, resize aborted");
+                return -ENOSPC;
+        }
+        brelse(bh);
+
+        /* We will update the superblock, one block bitmap, and
+         * one group descriptor via ext4_free_blocks().
+         */
+        handle = ext4_journal_start_sb(sb, 3);
+        if (IS_ERR(handle)) {
+                err = PTR_ERR(handle);
+                ext4_warning(sb, __FUNCTION__, "error %d on journal start",err);
+                goto exit_put;
+        }
+
+        lock_super(sb);
+        if (o_blocks_count != ext4_blocks_count(es)) {
+                ext4_warning(sb, __FUNCTION__,
+                             "multiple resizers run on filesystem!");
+                unlock_super(sb);
+                err = -EBUSY;
+                goto exit_put;
+        }
+
+        if ((err = ext4_journal_get_write_access(handle,
+                                                 EXT4_SB(sb)->s_sbh))) {
+                ext4_warning(sb, __FUNCTION__,
+                             "error %d on journal write access", err);
+                unlock_super(sb);
+                ext4_journal_stop(handle);
+                goto exit_put;
+        }
+        ext4_blocks_count_set(es, o_blocks_count + add);
+        ext4_journal_dirty_metadata(handle, EXT4_SB(sb)->s_sbh);
+        sb->s_dirt = 1;
+        unlock_super(sb);
+        ext4_debug("freeing blocks %lu through %llu\n", o_blocks_count,
+                   o_blocks_count + add);
+        ext4_free_blocks_sb(handle, sb, o_blocks_count, add, &freed_blocks);
+        ext4_debug("freed blocks %llu through %llu\n", o_blocks_count,
+                   o_blocks_count + add);
+        if ((err = ext4_journal_stop(handle)))
+                goto exit_put;
+        if (test_opt(sb, DEBUG))
+                printk(KERN_DEBUG "EXT4-fs: extended group to %llu blocks\n",
+                       ext4_blocks_count(es));
+        update_backups(sb, EXT4_SB(sb)->s_sbh->b_blocknr, (char *)es,
+                       sizeof(struct ext4_super_block));
+exit_put:
+        return err;
+} /* ext4_group_extend */
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
new file mode 100644
index 000000000000..b4b022aa2bc2
--- /dev/null
+++ b/fs/ext4/super.c
@@ -0,0 +1,2829 @@
+/*
+ *  linux/fs/ext4/super.c
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/inode.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  Big-endian to little-endian byte-swapping/bitmaps by
+ *        David S. Miller (davem@caip.rutgers.edu), 1995
+ */
+
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <linux/time.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/slab.h>
+#include <linux/init.h>
+#include <linux/blkdev.h>
+#include <linux/parser.h>
+#include <linux/smp_lock.h>
+#include <linux/buffer_head.h>
+#include <linux/vfs.h>
+#include <linux/random.h>
+#include <linux/mount.h>
+#include <linux/namei.h>
+#include <linux/quotaops.h>
+#include <linux/seq_file.h>
+
+#include <asm/uaccess.h>
+
+#include "xattr.h"
+#include "acl.h"
+#include "namei.h"
+
+static int ext4_load_journal(struct super_block *, struct ext4_super_block *,
+                             unsigned long journal_devnum);
+static int ext4_create_journal(struct super_block *, struct ext4_super_block *,
+                               unsigned int);
+static void ext4_commit_super (struct super_block * sb,
+                               struct ext4_super_block * es,
+                               int sync);
+static void ext4_mark_recovery_complete(struct super_block * sb,
+                                        struct ext4_super_block * es);
+static void ext4_clear_journal_err(struct super_block * sb,
+                                   struct ext4_super_block * es);
+static int ext4_sync_fs(struct super_block *sb, int wait);
+static const char *ext4_decode_error(struct super_block * sb, int errno,
+                                     char nbuf[16]);
+static int ext4_remount (struct super_block * sb, int * flags, char * data);
+static int ext4_statfs (struct dentry * dentry, struct kstatfs * buf);
+static void ext4_unlockfs(struct super_block *sb);
+static void ext4_write_super (struct super_block * sb);
+static void ext4_write_super_lockfs(struct super_block *sb);
+
+
+ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
+                               struct ext4_group_desc *bg)
+{
+        return le32_to_cpu(bg->bg_block_bitmap) |
+                (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT ?
+                 (ext4_fsblk_t)le32_to_cpu(bg->bg_block_bitmap_hi) << 32 : 0);
+}
+
+ext4_fsblk_t ext4_inode_bitmap(struct super_block *sb,
+                               struct ext4_group_desc *bg)
+{
+        return le32_to_cpu(bg->bg_inode_bitmap) |
+                (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT ?
+                 (ext4_fsblk_t)le32_to_cpu(bg->bg_inode_bitmap_hi) << 32 : 0);
+}
+
+ext4_fsblk_t ext4_inode_table(struct super_block *sb,
+                              struct ext4_group_desc *bg)
+{
+        return le32_to_cpu(bg->bg_inode_table) |
+                (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT ?
+                 (ext4_fsblk_t)le32_to_cpu(bg->bg_inode_table_hi) << 32 : 0);
+}
+
+void ext4_block_bitmap_set(struct super_block *sb,
+                           struct ext4_group_desc *bg, ext4_fsblk_t blk)
+{
+        bg->bg_block_bitmap = cpu_to_le32((u32)blk);
+        if (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT)
+                bg->bg_block_bitmap_hi = cpu_to_le32(blk >> 32);
+}
+
+void ext4_inode_bitmap_set(struct super_block *sb,
+                           struct ext4_group_desc *bg, ext4_fsblk_t blk)
+{
+        bg->bg_inode_bitmap  = cpu_to_le32((u32)blk);
+        if (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT)
+                bg->bg_inode_bitmap_hi = cpu_to_le32(blk >> 32);
+}
+
+void ext4_inode_table_set(struct super_block *sb,
+                          struct ext4_group_desc *bg, ext4_fsblk_t blk)
+{
+        bg->bg_inode_table = cpu_to_le32((u32)blk);
+        if (EXT4_DESC_SIZE(sb) >= EXT4_MIN_DESC_SIZE_64BIT)
+                bg->bg_inode_table_hi = cpu_to_le32(blk >> 32);
+}
+
+/*
+ * Wrappers for jbd2_journal_start/end.
+ *
+ * The only special thing we need to do here is to make sure that all
+ * journal_end calls result in the superblock being marked dirty, so
+ * that sync() will call the filesystem's write_super callback if
+ * appropriate.
+ */
+handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
+{
+        journal_t *journal;
+
+        if (sb->s_flags & MS_RDONLY)
+                return ERR_PTR(-EROFS);
+
+        /* Special case here: if the journal has aborted behind our
+         * backs (eg. EIO in the commit thread), then we still need to
+         * take the FS itself readonly cleanly. */
+        journal = EXT4_SB(sb)->s_journal;
+        if (is_journal_aborted(journal)) {
+                ext4_abort(sb, __FUNCTION__,
+                           "Detected aborted journal");
+                return ERR_PTR(-EROFS);
+        }
+
+        return jbd2_journal_start(journal, nblocks);
+}
+
+/*
+ * The only special thing we need to do here is to make sure that all
+ * jbd2_journal_stop calls result in the superblock being marked dirty, so
+ * that sync() will call the filesystem's write_super callback if
+ * appropriate.
+ */
+int __ext4_journal_stop(const char *where, handle_t *handle)
+{
+        struct super_block *sb;
+        int err;
+        int rc;
+
+        sb = handle->h_transaction->t_journal->j_private;
+        err = handle->h_err;
+        rc = jbd2_journal_stop(handle);
+
+        if (!err)
+                err = rc;
+        if (err)
+                __ext4_std_error(sb, where, err);
+        return err;
+}
+
+void ext4_journal_abort_handle(const char *caller, const char *err_fn,
+                struct buffer_head *bh, handle_t *handle, int err)
+{
+        char nbuf[16];
+        const char *errstr = ext4_decode_error(NULL, err, nbuf);
+
+        if (bh)
+                BUFFER_TRACE(bh, "abort");
+
+        if (!handle->h_err)
+                handle->h_err = err;
+
+        if (is_handle_aborted(handle))
+                return;
+
+        printk(KERN_ERR "%s: aborting transaction: %s in %s\n",
+               caller, errstr, err_fn);
+
+        jbd2_journal_abort_handle(handle);
+}
+
+/* Deal with the reporting of failure conditions on a filesystem such as
+ * inconsistencies detected or read IO failures.
+ *
+ * On ext2, we can store the error state of the filesystem in the
+ * superblock.  That is not possible on ext4, because we may have other
+ * write ordering constraints on the superblock which prevent us from
+ * writing it out straight away; and given that the journal is about to
+ * be aborted, we can't rely on the current, or future, transactions to
+ * write out the superblock safely.
+ *
+ * We'll just use the jbd2_journal_abort() error code to record an error in
+ * the journal instead.  On recovery, the journal will compain about
+ * that error until we've noted it down and cleared it.
+ */
+
+static void ext4_handle_error(struct super_block *sb)
+{
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
+        EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+        es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+
+        if (sb->s_flags & MS_RDONLY)
+                return;
+
+        if (!test_opt (sb, ERRORS_CONT)) {
+                journal_t *journal = EXT4_SB(sb)->s_journal;
+
+                EXT4_SB(sb)->s_mount_opt |= EXT4_MOUNT_ABORT;
+                if (journal)
+                        jbd2_journal_abort(journal, -EIO);
+        }
+        if (test_opt (sb, ERRORS_RO)) {
+                printk (KERN_CRIT "Remounting filesystem read-only\n");
+                sb->s_flags |= MS_RDONLY;
+        }
+        ext4_commit_super(sb, es, 1);
+        if (test_opt(sb, ERRORS_PANIC))
+                panic("EXT4-fs (device %s): panic forced after error\n",
+                        sb->s_id);
+}
+
+void ext4_error (struct super_block * sb, const char * function,
+                 const char * fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        printk(KERN_CRIT "EXT4-fs error (device %s): %s: ",sb->s_id, function);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        ext4_handle_error(sb);
+}
+
+static const char *ext4_decode_error(struct super_block * sb, int errno,
+                                     char nbuf[16])
+{
+        char *errstr = NULL;
+
+        switch (errno) {
+        case -EIO:
+                errstr = "IO failure";
+                break;
+        case -ENOMEM:
+                errstr = "Out of memory";
+                break;
+        case -EROFS:
+                if (!sb || EXT4_SB(sb)->s_journal->j_flags & JBD2_ABORT)
+                        errstr = "Journal has aborted";
+                else
+                        errstr = "Readonly filesystem";
+                break;
+        default:
+                /* If the caller passed in an extra buffer for unknown
+                 * errors, textualise them now.  Else we just return
+                 * NULL. */
+                if (nbuf) {
+                        /* Check for truncated error codes... */
+                        if (snprintf(nbuf, 16, "error %d", -errno) >= 0)
+                                errstr = nbuf;
+                }
+                break;
+        }
+
+        return errstr;
+}
+
+/* __ext4_std_error decodes expected errors from journaling functions
+ * automatically and invokes the appropriate error response.  */
+
+void __ext4_std_error (struct super_block * sb, const char * function,
+                       int errno)
+{
+        char nbuf[16];
+        const char *errstr;
+
+        /* Special case: if the error is EROFS, and we're not already
+         * inside a transaction, then there's really no point in logging
+         * an error. */
+        if (errno == -EROFS && journal_current_handle() == NULL &&
+            (sb->s_flags & MS_RDONLY))
+                return;
+
+        errstr = ext4_decode_error(sb, errno, nbuf);
+        printk (KERN_CRIT "EXT4-fs error (device %s) in %s: %s\n",
+                sb->s_id, function, errstr);
+
+        ext4_handle_error(sb);
+}
+
+/*
+ * ext4_abort is a much stronger failure handler than ext4_error.  The
+ * abort function may be used to deal with unrecoverable failures such
+ * as journal IO errors or ENOMEM at a critical moment in log management.
+ *
+ * We unconditionally force the filesystem into an ABORT|READONLY state,
+ * unless the error response on the fs has been set to panic in which
+ * case we take the easy way out and panic immediately.
+ */
+
+void ext4_abort (struct super_block * sb, const char * function,
+                 const char * fmt, ...)
+{
+        va_list args;
+
+        printk (KERN_CRIT "ext4_abort called.\n");
+
+        va_start(args, fmt);
+        printk(KERN_CRIT "EXT4-fs error (device %s): %s: ",sb->s_id, function);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+
+        if (test_opt(sb, ERRORS_PANIC))
+                panic("EXT4-fs panic from previous error\n");
+
+        if (sb->s_flags & MS_RDONLY)
+                return;
+
+        printk(KERN_CRIT "Remounting filesystem read-only\n");
+        EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+        sb->s_flags |= MS_RDONLY;
+        EXT4_SB(sb)->s_mount_opt |= EXT4_MOUNT_ABORT;
+        jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
+}
+
+void ext4_warning (struct super_block * sb, const char * function,
+                   const char * fmt, ...)
+{
+        va_list args;
+
+        va_start(args, fmt);
+        printk(KERN_WARNING "EXT4-fs warning (device %s): %s: ",
+               sb->s_id, function);
+        vprintk(fmt, args);
+        printk("\n");
+        va_end(args);
+}
+
+void ext4_update_dynamic_rev(struct super_block *sb)
+{
+        struct ext4_super_block *es = EXT4_SB(sb)->s_es;
+
+        if (le32_to_cpu(es->s_rev_level) > EXT4_GOOD_OLD_REV)
+                return;
+
+        ext4_warning(sb, __FUNCTION__,
+                     "updating to rev %d because of new feature flag, "
+                     "running e2fsck is recommended",
+                     EXT4_DYNAMIC_REV);
+
+        es->s_first_ino = cpu_to_le32(EXT4_GOOD_OLD_FIRST_INO);
+        es->s_inode_size = cpu_to_le16(EXT4_GOOD_OLD_INODE_SIZE);
+        es->s_rev_level = cpu_to_le32(EXT4_DYNAMIC_REV);
+        /* leave es->s_feature_*compat flags alone */
+        /* es->s_uuid will be set by e2fsck if empty */
+
+        /*
+         * The rest of the superblock fields should be zero, and if not it
+         * means they are likely already in use, so leave them alone.  We
+         * can leave it up to e2fsck to clean up any inconsistencies there.
+         */
+}
+
+/*
+ * Open the external journal device
+ */
+static struct block_device *ext4_blkdev_get(dev_t dev)
+{
+        struct block_device *bdev;
+        char b[BDEVNAME_SIZE];
+
+        bdev = open_by_devnum(dev, FMODE_READ|FMODE_WRITE);
+        if (IS_ERR(bdev))
+                goto fail;
+        return bdev;
+
+fail:
+        printk(KERN_ERR "EXT4: failed to open journal device %s: %ld\n",
+                        __bdevname(dev, b), PTR_ERR(bdev));
+        return NULL;
+}
+
+/*
+ * Release the journal device
+ */
+static int ext4_blkdev_put(struct block_device *bdev)
+{
+        bd_release(bdev);
+        return blkdev_put(bdev);
+}
+
+static int ext4_blkdev_remove(struct ext4_sb_info *sbi)
+{
+        struct block_device *bdev;
+        int ret = -ENODEV;
+
+        bdev = sbi->journal_bdev;
+        if (bdev) {
+                ret = ext4_blkdev_put(bdev);
+                sbi->journal_bdev = NULL;
+        }
+        return ret;
+}
+
+static inline struct inode *orphan_list_entry(struct list_head *l)
+{
+        return &list_entry(l, struct ext4_inode_info, i_orphan)->vfs_inode;
+}
+
+static void dump_orphan_list(struct super_block *sb, struct ext4_sb_info *sbi)
+{
+        struct list_head *l;
+
+        printk(KERN_ERR "sb orphan head is %d\n",
+               le32_to_cpu(sbi->s_es->s_last_orphan));
+
+        printk(KERN_ERR "sb_info orphan list:\n");
+        list_for_each(l, &sbi->s_orphan) {
+                struct inode *inode = orphan_list_entry(l);
+                printk(KERN_ERR "  "
+                       "inode %s:%lu at %p: mode %o, nlink %d, next %d\n",
+                       inode->i_sb->s_id, inode->i_ino, inode,
+                       inode->i_mode, inode->i_nlink,
+                       NEXT_ORPHAN(inode));
+        }
+}
+
+static void ext4_put_super (struct super_block * sb)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        struct ext4_super_block *es = sbi->s_es;
+        int i;
+
+        ext4_ext_release(sb);
+        ext4_xattr_put_super(sb);
+        jbd2_journal_destroy(sbi->s_journal);
+        if (!(sb->s_flags & MS_RDONLY)) {
+                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+                es->s_state = cpu_to_le16(sbi->s_mount_state);
+                BUFFER_TRACE(sbi->s_sbh, "marking dirty");
+                mark_buffer_dirty(sbi->s_sbh);
+                ext4_commit_super(sb, es, 1);
+        }
+
+        for (i = 0; i < sbi->s_gdb_count; i++)
+                brelse(sbi->s_group_desc[i]);
+        kfree(sbi->s_group_desc);
+        percpu_counter_destroy(&sbi->s_freeblocks_counter);
+        percpu_counter_destroy(&sbi->s_freeinodes_counter);
+        percpu_counter_destroy(&sbi->s_dirs_counter);
+        brelse(sbi->s_sbh);
+#ifdef CONFIG_QUOTA
+        for (i = 0; i < MAXQUOTAS; i++)
+                kfree(sbi->s_qf_names[i]);
+#endif
+
+        /* Debugging code just in case the in-memory inode orphan list
+         * isn't empty.  The on-disk one can be non-empty if we've
+         * detected an error and taken the fs readonly, but the
+         * in-memory list had better be clean by this point. */
+        if (!list_empty(&sbi->s_orphan))
+                dump_orphan_list(sb, sbi);
+        J_ASSERT(list_empty(&sbi->s_orphan));
+
+        invalidate_bdev(sb->s_bdev, 0);
+        if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
+                /*
+                 * Invalidate the journal device's buffers.  We don't want them
+                 * floating about in memory - the physical journal device may
+                 * hotswapped, and it breaks the `ro-after' testing code.
+                 */
+                sync_blockdev(sbi->journal_bdev);
+                invalidate_bdev(sbi->journal_bdev, 0);
+                ext4_blkdev_remove(sbi);
+        }
+        sb->s_fs_info = NULL;
+        kfree(sbi);
+        return;
+}
+
+static kmem_cache_t *ext4_inode_cachep;
+
+/*
+ * Called inside transaction, so use GFP_NOFS
+ */
+static struct inode *ext4_alloc_inode(struct super_block *sb)
+{
+        struct ext4_inode_info *ei;
+
+        ei = kmem_cache_alloc(ext4_inode_cachep, SLAB_NOFS);
+        if (!ei)
+                return NULL;
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        ei->i_acl = EXT4_ACL_NOT_CACHED;
+        ei->i_default_acl = EXT4_ACL_NOT_CACHED;
+#endif
+        ei->i_block_alloc_info = NULL;
+        ei->vfs_inode.i_version = 1;
+        memset(&ei->i_cached_extent, 0, sizeof(struct ext4_ext_cache));
+        return &ei->vfs_inode;
+}
+
+static void ext4_destroy_inode(struct inode *inode)
+{
+        kmem_cache_free(ext4_inode_cachep, EXT4_I(inode));
+}
+
+static void init_once(void * foo, kmem_cache_t * cachep, unsigned long flags)
+{
+        struct ext4_inode_info *ei = (struct ext4_inode_info *) foo;
+
+        if ((flags & (SLAB_CTOR_VERIFY|SLAB_CTOR_CONSTRUCTOR)) ==
+            SLAB_CTOR_CONSTRUCTOR) {
+                INIT_LIST_HEAD(&ei->i_orphan);
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+                init_rwsem(&ei->xattr_sem);
+#endif
+                mutex_init(&ei->truncate_mutex);
+                inode_init_once(&ei->vfs_inode);
+        }
+}
+
+static int init_inodecache(void)
+{
+        ext4_inode_cachep = kmem_cache_create("ext4_inode_cache",
+                                             sizeof(struct ext4_inode_info),
+                                             0, (SLAB_RECLAIM_ACCOUNT|
+                                                SLAB_MEM_SPREAD),
+                                             init_once, NULL);
+        if (ext4_inode_cachep == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+static void destroy_inodecache(void)
+{
+        kmem_cache_destroy(ext4_inode_cachep);
+}
+
+static void ext4_clear_inode(struct inode *inode)
+{
+        struct ext4_block_alloc_info *rsv = EXT4_I(inode)->i_block_alloc_info;
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        if (EXT4_I(inode)->i_acl &&
+                        EXT4_I(inode)->i_acl != EXT4_ACL_NOT_CACHED) {
+                posix_acl_release(EXT4_I(inode)->i_acl);
+                EXT4_I(inode)->i_acl = EXT4_ACL_NOT_CACHED;
+        }
+        if (EXT4_I(inode)->i_default_acl &&
+                        EXT4_I(inode)->i_default_acl != EXT4_ACL_NOT_CACHED) {
+                posix_acl_release(EXT4_I(inode)->i_default_acl);
+                EXT4_I(inode)->i_default_acl = EXT4_ACL_NOT_CACHED;
+        }
+#endif
+        ext4_discard_reservation(inode);
+        EXT4_I(inode)->i_block_alloc_info = NULL;
+        if (unlikely(rsv))
+                kfree(rsv);
+}
+
+static inline void ext4_show_quota_options(struct seq_file *seq, struct super_block *sb)
+{
+#if defined(CONFIG_QUOTA)
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+
+        if (sbi->s_jquota_fmt)
+                seq_printf(seq, ",jqfmt=%s",
+                (sbi->s_jquota_fmt == QFMT_VFS_OLD) ? "vfsold": "vfsv0");
+
+        if (sbi->s_qf_names[USRQUOTA])
+                seq_printf(seq, ",usrjquota=%s", sbi->s_qf_names[USRQUOTA]);
+
+        if (sbi->s_qf_names[GRPQUOTA])
+                seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
+
+        if (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA)
+                seq_puts(seq, ",usrquota");
+
+        if (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)
+                seq_puts(seq, ",grpquota");
+#endif
+}
+
+static int ext4_show_options(struct seq_file *seq, struct vfsmount *vfs)
+{
+        struct super_block *sb = vfs->mnt_sb;
+
+        if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+                seq_puts(seq, ",data=journal");
+        else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
+                seq_puts(seq, ",data=ordered");
+        else if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
+                seq_puts(seq, ",data=writeback");
+
+        ext4_show_quota_options(seq, sb);
+
+        return 0;
+}
+
+
+static struct dentry *ext4_get_dentry(struct super_block *sb, void *vobjp)
+{
+        __u32 *objp = vobjp;
+        unsigned long ino = objp[0];
+        __u32 generation = objp[1];
+        struct inode *inode;
+        struct dentry *result;
+
+        if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
+                return ERR_PTR(-ESTALE);
+        if (ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count))
+                return ERR_PTR(-ESTALE);
+
+        /* iget isn't really right if the inode is currently unallocated!!
+         *
+         * ext4_read_inode will return a bad_inode if the inode had been
+         * deleted, so we should be safe.
+         *
+         * Currently we don't know the generation for parent directory, so
+         * a generation of 0 means "accept any"
+         */
+        inode = iget(sb, ino);
+        if (inode == NULL)
+                return ERR_PTR(-ENOMEM);
+        if (is_bad_inode(inode) ||
+            (generation && inode->i_generation != generation)) {
+                iput(inode);
+                return ERR_PTR(-ESTALE);
+        }
+        /* now to find a dentry.
+         * If possible, get a well-connected one
+         */
+        result = d_alloc_anon(inode);
+        if (!result) {
+                iput(inode);
+                return ERR_PTR(-ENOMEM);
+        }
+        return result;
+}
+
+#ifdef CONFIG_QUOTA
+#define QTYPE2NAME(t) ((t)==USRQUOTA?"user":"group")
+#define QTYPE2MOPT(on, t) ((t)==USRQUOTA?((on)##USRJQUOTA):((on)##GRPJQUOTA))
+
+static int ext4_dquot_initialize(struct inode *inode, int type);
+static int ext4_dquot_drop(struct inode *inode);
+static int ext4_write_dquot(struct dquot *dquot);
+static int ext4_acquire_dquot(struct dquot *dquot);
+static int ext4_release_dquot(struct dquot *dquot);
+static int ext4_mark_dquot_dirty(struct dquot *dquot);
+static int ext4_write_info(struct super_block *sb, int type);
+static int ext4_quota_on(struct super_block *sb, int type, int format_id, char *path);
+static int ext4_quota_on_mount(struct super_block *sb, int type);
+static ssize_t ext4_quota_read(struct super_block *sb, int type, char *data,
+                               size_t len, loff_t off);
+static ssize_t ext4_quota_write(struct super_block *sb, int type,
+                                const char *data, size_t len, loff_t off);
+
+static struct dquot_operations ext4_quota_operations = {
+        .initialize     = ext4_dquot_initialize,
+        .drop           = ext4_dquot_drop,
+        .alloc_space    = dquot_alloc_space,
+        .alloc_inode    = dquot_alloc_inode,
+        .free_space     = dquot_free_space,
+        .free_inode     = dquot_free_inode,
+        .transfer       = dquot_transfer,
+        .write_dquot    = ext4_write_dquot,
+        .acquire_dquot  = ext4_acquire_dquot,
+        .release_dquot  = ext4_release_dquot,
+        .mark_dirty     = ext4_mark_dquot_dirty,
+        .write_info     = ext4_write_info
+};
+
+static struct quotactl_ops ext4_qctl_operations = {
+        .quota_on       = ext4_quota_on,
+        .quota_off      = vfs_quota_off,
+        .quota_sync     = vfs_quota_sync,
+        .get_info       = vfs_get_dqinfo,
+        .set_info       = vfs_set_dqinfo,
+        .get_dqblk      = vfs_get_dqblk,
+        .set_dqblk      = vfs_set_dqblk
+};
+#endif
+
+static struct super_operations ext4_sops = {
+        .alloc_inode    = ext4_alloc_inode,
+        .destroy_inode  = ext4_destroy_inode,
+        .read_inode     = ext4_read_inode,
+        .write_inode    = ext4_write_inode,
+        .dirty_inode    = ext4_dirty_inode,
+        .delete_inode   = ext4_delete_inode,
+        .put_super      = ext4_put_super,
+        .write_super    = ext4_write_super,
+        .sync_fs        = ext4_sync_fs,
+        .write_super_lockfs = ext4_write_super_lockfs,
+        .unlockfs       = ext4_unlockfs,
+        .statfs         = ext4_statfs,
+        .remount_fs     = ext4_remount,
+        .clear_inode    = ext4_clear_inode,
+        .show_options   = ext4_show_options,
+#ifdef CONFIG_QUOTA
+        .quota_read     = ext4_quota_read,
+        .quota_write    = ext4_quota_write,
+#endif
+};
+
+static struct export_operations ext4_export_ops = {
+        .get_parent = ext4_get_parent,
+        .get_dentry = ext4_get_dentry,
+};
+
+enum {
+        Opt_bsd_df, Opt_minix_df, Opt_grpid, Opt_nogrpid,
+        Opt_resgid, Opt_resuid, Opt_sb, Opt_err_cont, Opt_err_panic, Opt_err_ro,
+        Opt_nouid32, Opt_nocheck, Opt_debug, Opt_oldalloc, Opt_orlov,
+        Opt_user_xattr, Opt_nouser_xattr, Opt_acl, Opt_noacl,
+        Opt_reservation, Opt_noreservation, Opt_noload, Opt_nobh, Opt_bh,
+        Opt_commit, Opt_journal_update, Opt_journal_inum, Opt_journal_dev,
+        Opt_abort, Opt_data_journal, Opt_data_ordered, Opt_data_writeback,
+        Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
+        Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
+        Opt_ignore, Opt_barrier, Opt_err, Opt_resize, Opt_usrquota,
+        Opt_grpquota, Opt_extents,
+};
+
+static match_table_t tokens = {
+        {Opt_bsd_df, "bsddf"},
+        {Opt_minix_df, "minixdf"},
+        {Opt_grpid, "grpid"},
+        {Opt_grpid, "bsdgroups"},
+        {Opt_nogrpid, "nogrpid"},
+        {Opt_nogrpid, "sysvgroups"},
+        {Opt_resgid, "resgid=%u"},
+        {Opt_resuid, "resuid=%u"},
+        {Opt_sb, "sb=%u"},
+        {Opt_err_cont, "errors=continue"},
+        {Opt_err_panic, "errors=panic"},
+        {Opt_err_ro, "errors=remount-ro"},
+        {Opt_nouid32, "nouid32"},
+        {Opt_nocheck, "nocheck"},
+        {Opt_nocheck, "check=none"},
+        {Opt_debug, "debug"},
+        {Opt_oldalloc, "oldalloc"},
+        {Opt_orlov, "orlov"},
+        {Opt_user_xattr, "user_xattr"},
+        {Opt_nouser_xattr, "nouser_xattr"},
+        {Opt_acl, "acl"},
+        {Opt_noacl, "noacl"},
+        {Opt_reservation, "reservation"},
+        {Opt_noreservation, "noreservation"},
+        {Opt_noload, "noload"},
+        {Opt_nobh, "nobh"},
+        {Opt_bh, "bh"},
+        {Opt_commit, "commit=%u"},
+        {Opt_journal_update, "journal=update"},
+        {Opt_journal_inum, "journal=%u"},
+        {Opt_journal_dev, "journal_dev=%u"},
+        {Opt_abort, "abort"},
+        {Opt_data_journal, "data=journal"},
+        {Opt_data_ordered, "data=ordered"},
+        {Opt_data_writeback, "data=writeback"},
+        {Opt_offusrjquota, "usrjquota="},
+        {Opt_usrjquota, "usrjquota=%s"},
+        {Opt_offgrpjquota, "grpjquota="},
+        {Opt_grpjquota, "grpjquota=%s"},
+        {Opt_jqfmt_vfsold, "jqfmt=vfsold"},
+        {Opt_jqfmt_vfsv0, "jqfmt=vfsv0"},
+        {Opt_grpquota, "grpquota"},
+        {Opt_noquota, "noquota"},
+        {Opt_quota, "quota"},
+        {Opt_usrquota, "usrquota"},
+        {Opt_barrier, "barrier=%u"},
+        {Opt_extents, "extents"},
+        {Opt_err, NULL},
+        {Opt_resize, "resize"},
+};
+
+static ext4_fsblk_t get_sb_block(void **data)
+{
+        ext4_fsblk_t    sb_block;
+        char            *options = (char *) *data;
+
+        if (!options || strncmp(options, "sb=", 3) != 0)
+                return 1;       /* Default location */
+        options += 3;
+        /*todo: use simple_strtoll with >32bit ext4 */
+        sb_block = simple_strtoul(options, &options, 0);
+        if (*options && *options != ',') {
+                printk("EXT4-fs: Invalid sb specification: %s\n",
+                       (char *) *data);
+                return 1;
+        }
+        if (*options == ',')
+                options++;
+        *data = (void *) options;
+        return sb_block;
+}
+
+static int parse_options (char *options, struct super_block *sb,
+                          unsigned int *inum, unsigned long *journal_devnum,
+                          ext4_fsblk_t *n_blocks_count, int is_remount)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        char * p;
+        substring_t args[MAX_OPT_ARGS];
+        int data_opt = 0;
+        int option;
+#ifdef CONFIG_QUOTA
+        int qtype;
+        char *qname;
+#endif
+
+        if (!options)
+                return 1;
+
+        while ((p = strsep (&options, ",")) != NULL) {
+                int token;
+                if (!*p)
+                        continue;
+
+                token = match_token(p, tokens, args);
+                switch (token) {
+                case Opt_bsd_df:
+                        clear_opt (sbi->s_mount_opt, MINIX_DF);
+                        break;
+                case Opt_minix_df:
+                        set_opt (sbi->s_mount_opt, MINIX_DF);
+                        break;
+                case Opt_grpid:
+                        set_opt (sbi->s_mount_opt, GRPID);
+                        break;
+                case Opt_nogrpid:
+                        clear_opt (sbi->s_mount_opt, GRPID);
+                        break;
+                case Opt_resuid:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        sbi->s_resuid = option;
+                        break;
+                case Opt_resgid:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        sbi->s_resgid = option;
+                        break;
+                case Opt_sb:
+                        /* handled by get_sb_block() instead of here */
+                        /* *sb_block = match_int(&args[0]); */
+                        break;
+                case Opt_err_panic:
+                        clear_opt (sbi->s_mount_opt, ERRORS_CONT);
+                        clear_opt (sbi->s_mount_opt, ERRORS_RO);
+                        set_opt (sbi->s_mount_opt, ERRORS_PANIC);
+                        break;
+                case Opt_err_ro:
+                        clear_opt (sbi->s_mount_opt, ERRORS_CONT);
+                        clear_opt (sbi->s_mount_opt, ERRORS_PANIC);
+                        set_opt (sbi->s_mount_opt, ERRORS_RO);
+                        break;
+                case Opt_err_cont:
+                        clear_opt (sbi->s_mount_opt, ERRORS_RO);
+                        clear_opt (sbi->s_mount_opt, ERRORS_PANIC);
+                        set_opt (sbi->s_mount_opt, ERRORS_CONT);
+                        break;
+                case Opt_nouid32:
+                        set_opt (sbi->s_mount_opt, NO_UID32);
+                        break;
+                case Opt_nocheck:
+                        clear_opt (sbi->s_mount_opt, CHECK);
+                        break;
+                case Opt_debug:
+                        set_opt (sbi->s_mount_opt, DEBUG);
+                        break;
+                case Opt_oldalloc:
+                        set_opt (sbi->s_mount_opt, OLDALLOC);
+                        break;
+                case Opt_orlov:
+                        clear_opt (sbi->s_mount_opt, OLDALLOC);
+                        break;
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+                case Opt_user_xattr:
+                        set_opt (sbi->s_mount_opt, XATTR_USER);
+                        break;
+                case Opt_nouser_xattr:
+                        clear_opt (sbi->s_mount_opt, XATTR_USER);
+                        break;
+#else
+                case Opt_user_xattr:
+                case Opt_nouser_xattr:
+                        printk("EXT4 (no)user_xattr options not supported\n");
+                        break;
+#endif
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+                case Opt_acl:
+                        set_opt(sbi->s_mount_opt, POSIX_ACL);
+                        break;
+                case Opt_noacl:
+                        clear_opt(sbi->s_mount_opt, POSIX_ACL);
+                        break;
+#else
+                case Opt_acl:
+                case Opt_noacl:
+                        printk("EXT4 (no)acl options not supported\n");
+                        break;
+#endif
+                case Opt_reservation:
+                        set_opt(sbi->s_mount_opt, RESERVATION);
+                        break;
+                case Opt_noreservation:
+                        clear_opt(sbi->s_mount_opt, RESERVATION);
+                        break;
+                case Opt_journal_update:
+                        /* @@@ FIXME */
+                        /* Eventually we will want to be able to create
+                           a journal file here.  For now, only allow the
+                           user to specify an existing inode to be the
+                           journal file. */
+                        if (is_remount) {
+                                printk(KERN_ERR "EXT4-fs: cannot specify "
+                                       "journal on remount\n");
+                                return 0;
+                        }
+                        set_opt (sbi->s_mount_opt, UPDATE_JOURNAL);
+                        break;
+                case Opt_journal_inum:
+                        if (is_remount) {
+                                printk(KERN_ERR "EXT4-fs: cannot specify "
+                                       "journal on remount\n");
+                                return 0;
+                        }
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        *inum = option;
+                        break;
+                case Opt_journal_dev:
+                        if (is_remount) {
+                                printk(KERN_ERR "EXT4-fs: cannot specify "
+                                       "journal on remount\n");
+                                return 0;
+                        }
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        *journal_devnum = option;
+                        break;
+                case Opt_noload:
+                        set_opt (sbi->s_mount_opt, NOLOAD);
+                        break;
+                case Opt_commit:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        if (option < 0)
+                                return 0;
+                        if (option == 0)
+                                option = JBD_DEFAULT_MAX_COMMIT_AGE;
+                        sbi->s_commit_interval = HZ * option;
+                        break;
+                case Opt_data_journal:
+                        data_opt = EXT4_MOUNT_JOURNAL_DATA;
+                        goto datacheck;
+                case Opt_data_ordered:
+                        data_opt = EXT4_MOUNT_ORDERED_DATA;
+                        goto datacheck;
+                case Opt_data_writeback:
+                        data_opt = EXT4_MOUNT_WRITEBACK_DATA;
+                datacheck:
+                        if (is_remount) {
+                                if ((sbi->s_mount_opt & EXT4_MOUNT_DATA_FLAGS)
+                                                != data_opt) {
+                                        printk(KERN_ERR
+                                                "EXT4-fs: cannot change data "
+                                                "mode on remount\n");
+                                        return 0;
+                                }
+                        } else {
+                                sbi->s_mount_opt &= ~EXT4_MOUNT_DATA_FLAGS;
+                                sbi->s_mount_opt |= data_opt;
+                        }
+                        break;
+#ifdef CONFIG_QUOTA
+                case Opt_usrjquota:
+                        qtype = USRQUOTA;
+                        goto set_qf_name;
+                case Opt_grpjquota:
+                        qtype = GRPQUOTA;
+set_qf_name:
+                        if (sb_any_quota_enabled(sb)) {
+                                printk(KERN_ERR
+                                        "EXT4-fs: Cannot change journalled "
+                                        "quota options when quota turned on.\n");
+                                return 0;
+                        }
+                        qname = match_strdup(&args[0]);
+                        if (!qname) {
+                                printk(KERN_ERR
+                                        "EXT4-fs: not enough memory for "
+                                        "storing quotafile name.\n");
+                                return 0;
+                        }
+                        if (sbi->s_qf_names[qtype] &&
+                            strcmp(sbi->s_qf_names[qtype], qname)) {
+                                printk(KERN_ERR
+                                        "EXT4-fs: %s quota file already "
+                                        "specified.\n", QTYPE2NAME(qtype));
+                                kfree(qname);
+                                return 0;
+                        }
+                        sbi->s_qf_names[qtype] = qname;
+                        if (strchr(sbi->s_qf_names[qtype], '/')) {
+                                printk(KERN_ERR
+                                        "EXT4-fs: quotafile must be on "
+                                        "filesystem root.\n");
+                                kfree(sbi->s_qf_names[qtype]);
+                                sbi->s_qf_names[qtype] = NULL;
+                                return 0;
+                        }
+                        set_opt(sbi->s_mount_opt, QUOTA);
+                        break;
+                case Opt_offusrjquota:
+                        qtype = USRQUOTA;
+                        goto clear_qf_name;
+                case Opt_offgrpjquota:
+                        qtype = GRPQUOTA;
+clear_qf_name:
+                        if (sb_any_quota_enabled(sb)) {
+                                printk(KERN_ERR "EXT4-fs: Cannot change "
+                                        "journalled quota options when "
+                                        "quota turned on.\n");
+                                return 0;
+                        }
+                        /*
+                         * The space will be released later when all options
+                         * are confirmed to be correct
+                         */
+                        sbi->s_qf_names[qtype] = NULL;
+                        break;
+                case Opt_jqfmt_vfsold:
+                        sbi->s_jquota_fmt = QFMT_VFS_OLD;
+                        break;
+                case Opt_jqfmt_vfsv0:
+                        sbi->s_jquota_fmt = QFMT_VFS_V0;
+                        break;
+                case Opt_quota:
+                case Opt_usrquota:
+                        set_opt(sbi->s_mount_opt, QUOTA);
+                        set_opt(sbi->s_mount_opt, USRQUOTA);
+                        break;
+                case Opt_grpquota:
+                        set_opt(sbi->s_mount_opt, QUOTA);
+                        set_opt(sbi->s_mount_opt, GRPQUOTA);
+                        break;
+                case Opt_noquota:
+                        if (sb_any_quota_enabled(sb)) {
+                                printk(KERN_ERR "EXT4-fs: Cannot change quota "
+                                        "options when quota turned on.\n");
+                                return 0;
+                        }
+                        clear_opt(sbi->s_mount_opt, QUOTA);
+                        clear_opt(sbi->s_mount_opt, USRQUOTA);
+                        clear_opt(sbi->s_mount_opt, GRPQUOTA);
+                        break;
+#else
+                case Opt_quota:
+                case Opt_usrquota:
+                case Opt_grpquota:
+                case Opt_usrjquota:
+                case Opt_grpjquota:
+                case Opt_offusrjquota:
+                case Opt_offgrpjquota:
+                case Opt_jqfmt_vfsold:
+                case Opt_jqfmt_vfsv0:
+                        printk(KERN_ERR
+                                "EXT4-fs: journalled quota options not "
+                                "supported.\n");
+                        break;
+                case Opt_noquota:
+                        break;
+#endif
+                case Opt_abort:
+                        set_opt(sbi->s_mount_opt, ABORT);
+                        break;
+                case Opt_barrier:
+                        if (match_int(&args[0], &option))
+                                return 0;
+                        if (option)
+                                set_opt(sbi->s_mount_opt, BARRIER);
+                        else
+                                clear_opt(sbi->s_mount_opt, BARRIER);
+                        break;
+                case Opt_ignore:
+                        break;
+                case Opt_resize:
+                        if (!is_remount) {
+                                printk("EXT4-fs: resize option only available "
+                                        "for remount\n");
+                                return 0;
+                        }
+                        if (match_int(&args[0], &option) != 0)
+                                return 0;
+                        *n_blocks_count = option;
+                        break;
+                case Opt_nobh:
+                        set_opt(sbi->s_mount_opt, NOBH);
+                        break;
+                case Opt_bh:
+                        clear_opt(sbi->s_mount_opt, NOBH);
+                        break;
+                case Opt_extents:
+                        set_opt (sbi->s_mount_opt, EXTENTS);
+                        break;
+                default:
+                        printk (KERN_ERR
+                                "EXT4-fs: Unrecognized mount option \"%s\" "
+                                "or missing value\n", p);
+                        return 0;
+                }
+        }
+#ifdef CONFIG_QUOTA
+        if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+                if ((sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA) &&
+                     sbi->s_qf_names[USRQUOTA])
+                        clear_opt(sbi->s_mount_opt, USRQUOTA);
+
+                if ((sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA) &&
+                     sbi->s_qf_names[GRPQUOTA])
+                        clear_opt(sbi->s_mount_opt, GRPQUOTA);
+
+                if ((sbi->s_qf_names[USRQUOTA] &&
+                                (sbi->s_mount_opt & EXT4_MOUNT_GRPQUOTA)) ||
+                    (sbi->s_qf_names[GRPQUOTA] &&
+                                (sbi->s_mount_opt & EXT4_MOUNT_USRQUOTA))) {
+                        printk(KERN_ERR "EXT4-fs: old and new quota "
+                                        "format mixing.\n");
+                        return 0;
+                }
+
+                if (!sbi->s_jquota_fmt) {
+                        printk(KERN_ERR "EXT4-fs: journalled quota format "
+                                        "not specified.\n");
+                        return 0;
+                }
+        } else {
+                if (sbi->s_jquota_fmt) {
+                        printk(KERN_ERR "EXT4-fs: journalled quota format "
+                                        "specified with no journalling "
+                                        "enabled.\n");
+                        return 0;
+                }
+        }
+#endif
+        return 1;
+}
+
+static int ext4_setup_super(struct super_block *sb, struct ext4_super_block *es,
+                            int read_only)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        int res = 0;
+
+        if (le32_to_cpu(es->s_rev_level) > EXT4_MAX_SUPP_REV) {
+                printk (KERN_ERR "EXT4-fs warning: revision level too high, "
+                        "forcing read-only mode\n");
+                res = MS_RDONLY;
+        }
+        if (read_only)
+                return res;
+        if (!(sbi->s_mount_state & EXT4_VALID_FS))
+                printk (KERN_WARNING "EXT4-fs warning: mounting unchecked fs, "
+                        "running e2fsck is recommended\n");
+        else if ((sbi->s_mount_state & EXT4_ERROR_FS))
+                printk (KERN_WARNING
+                        "EXT4-fs warning: mounting fs with errors, "
+                        "running e2fsck is recommended\n");
+        else if ((__s16) le16_to_cpu(es->s_max_mnt_count) >= 0 &&
+                 le16_to_cpu(es->s_mnt_count) >=
+                 (unsigned short) (__s16) le16_to_cpu(es->s_max_mnt_count))
+                printk (KERN_WARNING
+                        "EXT4-fs warning: maximal mount count reached, "
+                        "running e2fsck is recommended\n");
+        else if (le32_to_cpu(es->s_checkinterval) &&
+                (le32_to_cpu(es->s_lastcheck) +
+                        le32_to_cpu(es->s_checkinterval) <= get_seconds()))
+                printk (KERN_WARNING
+                        "EXT4-fs warning: checktime reached, "
+                        "running e2fsck is recommended\n");
+#if 0
+                /* @@@ We _will_ want to clear the valid bit if we find
+                 * inconsistencies, to force a fsck at reboot.  But for
+                 * a plain journaled filesystem we can keep it set as
+                 * valid forever! :)
+                 */
+        es->s_state = cpu_to_le16(le16_to_cpu(es->s_state) & ~EXT4_VALID_FS);
+#endif
+        if (!(__s16) le16_to_cpu(es->s_max_mnt_count))
+                es->s_max_mnt_count = cpu_to_le16(EXT4_DFL_MAX_MNT_COUNT);
+        es->s_mnt_count=cpu_to_le16(le16_to_cpu(es->s_mnt_count) + 1);
+        es->s_mtime = cpu_to_le32(get_seconds());
+        ext4_update_dynamic_rev(sb);
+        EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+
+        ext4_commit_super(sb, es, 1);
+        if (test_opt(sb, DEBUG))
+                printk(KERN_INFO "[EXT4 FS bs=%lu, gc=%lu, "
+                                "bpg=%lu, ipg=%lu, mo=%04lx]\n",
+                        sb->s_blocksize,
+                        sbi->s_groups_count,
+                        EXT4_BLOCKS_PER_GROUP(sb),
+                        EXT4_INODES_PER_GROUP(sb),
+                        sbi->s_mount_opt);
+
+        printk(KERN_INFO "EXT4 FS on %s, ", sb->s_id);
+        if (EXT4_SB(sb)->s_journal->j_inode == NULL) {
+                char b[BDEVNAME_SIZE];
+
+                printk("external journal on %s\n",
+                        bdevname(EXT4_SB(sb)->s_journal->j_dev, b));
+        } else {
+                printk("internal journal\n");
+        }
+        return res;
+}
+
+/* Called at mount-time, super-block is locked */
+static int ext4_check_descriptors (struct super_block * sb)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block);
+        ext4_fsblk_t last_block;
+        ext4_fsblk_t block_bitmap;
+        ext4_fsblk_t inode_bitmap;
+        ext4_fsblk_t inode_table;
+        struct ext4_group_desc * gdp = NULL;
+        int desc_block = 0;
+        int i;
+
+        ext4_debug ("Checking group descriptors");
+
+        for (i = 0; i < sbi->s_groups_count; i++)
+        {
+                if (i == sbi->s_groups_count - 1)
+                        last_block = ext4_blocks_count(sbi->s_es) - 1;
+                else
+                        last_block = first_block +
+                                (EXT4_BLOCKS_PER_GROUP(sb) - 1);
+
+                if ((i % EXT4_DESC_PER_BLOCK(sb)) == 0)
+                        gdp = (struct ext4_group_desc *)
+                                        sbi->s_group_desc[desc_block++]->b_data;
+                block_bitmap = ext4_block_bitmap(sb, gdp);
+                if (block_bitmap < first_block || block_bitmap > last_block)
+                {
+                        ext4_error (sb, "ext4_check_descriptors",
+                                    "Block bitmap for group %d"
+                                    " not in group (block %llu)!",
+                                    i, block_bitmap);
+                        return 0;
+                }
+                inode_bitmap = ext4_inode_bitmap(sb, gdp);
+                if (inode_bitmap < first_block || inode_bitmap > last_block)
+                {
+                        ext4_error (sb, "ext4_check_descriptors",
+                                    "Inode bitmap for group %d"
+                                    " not in group (block %llu)!",
+                                    i, inode_bitmap);
+                        return 0;
+                }
+                inode_table = ext4_inode_table(sb, gdp);
+                if (inode_table < first_block ||
+                    inode_table + sbi->s_itb_per_group > last_block)
+                {
+                        ext4_error (sb, "ext4_check_descriptors",
+                                    "Inode table for group %d"
+                                    " not in group (block %llu)!",
+                                    i, inode_table);
+                        return 0;
+                }
+                first_block += EXT4_BLOCKS_PER_GROUP(sb);
+                gdp = (struct ext4_group_desc *)
+                        ((__u8 *)gdp + EXT4_DESC_SIZE(sb));
+        }
+
+        ext4_free_blocks_count_set(sbi->s_es, ext4_count_free_blocks(sb));
+        sbi->s_es->s_free_inodes_count=cpu_to_le32(ext4_count_free_inodes(sb));
+        return 1;
+}
+
+
+/* ext4_orphan_cleanup() walks a singly-linked list of inodes (starting at
+ * the superblock) which were deleted from all directories, but held open by
+ * a process at the time of a crash.  We walk the list and try to delete these
+ * inodes at recovery time (only with a read-write filesystem).
+ *
+ * In order to keep the orphan inode chain consistent during traversal (in
+ * case of crash during recovery), we link each inode into the superblock
+ * orphan list_head and handle it the same way as an inode deletion during
+ * normal operation (which journals the operations for us).
+ *
+ * We only do an iget() and an iput() on each inode, which is very safe if we
+ * accidentally point at an in-use or already deleted inode.  The worst that
+ * can happen in this case is that we get a "bit already cleared" message from
+ * ext4_free_inode().  The only reason we would point at a wrong inode is if
+ * e2fsck was run on this filesystem, and it must have already done the orphan
+ * inode cleanup for us, so we can safely abort without any further action.
+ */
+static void ext4_orphan_cleanup (struct super_block * sb,
+                                 struct ext4_super_block * es)
+{
+        unsigned int s_flags = sb->s_flags;
+        int nr_orphans = 0, nr_truncates = 0;
+#ifdef CONFIG_QUOTA
+        int i;
+#endif
+        if (!es->s_last_orphan) {
+                jbd_debug(4, "no orphan inodes to clean up\n");
+                return;
+        }
+
+        if (EXT4_SB(sb)->s_mount_state & EXT4_ERROR_FS) {
+                if (es->s_last_orphan)
+                        jbd_debug(1, "Errors on filesystem, "
+                                  "clearing orphan list.\n");
+                es->s_last_orphan = 0;
+                jbd_debug(1, "Skipping orphan recovery on fs with errors.\n");
+                return;
+        }
+
+        if (s_flags & MS_RDONLY) {
+                printk(KERN_INFO "EXT4-fs: %s: orphan cleanup on readonly fs\n",
+                       sb->s_id);
+                sb->s_flags &= ~MS_RDONLY;
+        }
+#ifdef CONFIG_QUOTA
+        /* Needed for iput() to work correctly and not trash data */
+        sb->s_flags |= MS_ACTIVE;
+        /* Turn on quotas so that they are updated correctly */
+        for (i = 0; i < MAXQUOTAS; i++) {
+                if (EXT4_SB(sb)->s_qf_names[i]) {
+                        int ret = ext4_quota_on_mount(sb, i);
+                        if (ret < 0)
+                                printk(KERN_ERR
+                                        "EXT4-fs: Cannot turn on journalled "
+                                        "quota: error %d\n", ret);
+                }
+        }
+#endif
+
+        while (es->s_last_orphan) {
+                struct inode *inode;
+
+                if (!(inode =
+                      ext4_orphan_get(sb, le32_to_cpu(es->s_last_orphan)))) {
+                        es->s_last_orphan = 0;
+                        break;
+                }
+
+                list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan);
+                DQUOT_INIT(inode);
+                if (inode->i_nlink) {
+                        printk(KERN_DEBUG
+                                "%s: truncating inode %lu to %Ld bytes\n",
+                                __FUNCTION__, inode->i_ino, inode->i_size);
+                        jbd_debug(2, "truncating inode %lu to %Ld bytes\n",
+                                  inode->i_ino, inode->i_size);
+                        ext4_truncate(inode);
+                        nr_truncates++;
+                } else {
+                        printk(KERN_DEBUG
+                                "%s: deleting unreferenced inode %lu\n",
+                                __FUNCTION__, inode->i_ino);
+                        jbd_debug(2, "deleting unreferenced inode %lu\n",
+                                  inode->i_ino);
+                        nr_orphans++;
+                }
+                iput(inode);  /* The delete magic happens here! */
+        }
+
+#define PLURAL(x) (x), ((x)==1) ? "" : "s"
+
+        if (nr_orphans)
+                printk(KERN_INFO "EXT4-fs: %s: %d orphan inode%s deleted\n",
+                       sb->s_id, PLURAL(nr_orphans));
+        if (nr_truncates)
+                printk(KERN_INFO "EXT4-fs: %s: %d truncate%s cleaned up\n",
+                       sb->s_id, PLURAL(nr_truncates));
+#ifdef CONFIG_QUOTA
+        /* Turn quotas off */
+        for (i = 0; i < MAXQUOTAS; i++) {
+                if (sb_dqopt(sb)->files[i])
+                        vfs_quota_off(sb, i);
+        }
+#endif
+        sb->s_flags = s_flags; /* Restore MS_RDONLY status */
+}
+
+#define log2(n) ffz(~(n))
+
+/*
+ * Maximal file size.  There is a direct, and {,double-,triple-}indirect
+ * block limit, and also a limit of (2^32 - 1) 512-byte sectors in i_blocks.
+ * We need to be 1 filesystem block less than the 2^32 sector limit.
+ */
+static loff_t ext4_max_size(int bits)
+{
+        loff_t res = EXT4_NDIR_BLOCKS;
+        /* This constant is calculated to be the largest file size for a
+         * dense, 4k-blocksize file such that the total number of
+         * sectors in the file, including data and all indirect blocks,
+         * does not exceed 2^32. */
+        const loff_t upper_limit = 0x1ff7fffd000LL;
+
+        res += 1LL << (bits-2);
+        res += 1LL << (2*(bits-2));
+        res += 1LL << (3*(bits-2));
+        res <<= bits;
+        if (res > upper_limit)
+                res = upper_limit;
+        return res;
+}
+
+static ext4_fsblk_t descriptor_loc(struct super_block *sb,
+                                ext4_fsblk_t logical_sb_block, int nr)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        unsigned long bg, first_meta_bg;
+        int has_super = 0;
+
+        first_meta_bg = le32_to_cpu(sbi->s_es->s_first_meta_bg);
+
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG) ||
+            nr < first_meta_bg)
+                return logical_sb_block + nr + 1;
+        bg = sbi->s_desc_per_block * nr;
+        if (ext4_bg_has_super(sb, bg))
+                has_super = 1;
+        return (has_super + ext4_group_first_block_no(sb, bg));
+}
+
+
+static int ext4_fill_super (struct super_block *sb, void *data, int silent)
+{
+        struct buffer_head * bh;
+        struct ext4_super_block *es = NULL;
+        struct ext4_sb_info *sbi;
+        ext4_fsblk_t block;
+        ext4_fsblk_t sb_block = get_sb_block(&data);
+        ext4_fsblk_t logical_sb_block;
+        unsigned long offset = 0;
+        unsigned int journal_inum = 0;
+        unsigned long journal_devnum = 0;
+        unsigned long def_mount_opts;
+        struct inode *root;
+        int blocksize;
+        int hblock;
+        int db_count;
+        int i;
+        int needs_recovery;
+        __le32 features;
+        __u64 blocks_count;
+
+        sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+        if (!sbi)
+                return -ENOMEM;
+        sb->s_fs_info = sbi;
+        sbi->s_mount_opt = 0;
+        sbi->s_resuid = EXT4_DEF_RESUID;
+        sbi->s_resgid = EXT4_DEF_RESGID;
+
+        unlock_kernel();
+
+        blocksize = sb_min_blocksize(sb, EXT4_MIN_BLOCK_SIZE);
+        if (!blocksize) {
+                printk(KERN_ERR "EXT4-fs: unable to set blocksize\n");
+                goto out_fail;
+        }
+
+        /*
+         * The ext4 superblock will not be buffer aligned for other than 1kB
+         * block sizes.  We need to calculate the offset from buffer start.
+         */
+        if (blocksize != EXT4_MIN_BLOCK_SIZE) {
+                logical_sb_block = sb_block * EXT4_MIN_BLOCK_SIZE;
+                offset = do_div(logical_sb_block, blocksize);
+        } else {
+                logical_sb_block = sb_block;
+        }
+
+        if (!(bh = sb_bread(sb, logical_sb_block))) {
+                printk (KERN_ERR "EXT4-fs: unable to read superblock\n");
+                goto out_fail;
+        }
+        /*
+         * Note: s_es must be initialized as soon as possible because
+         *       some ext4 macro-instructions depend on its value
+         */
+        es = (struct ext4_super_block *) (((char *)bh->b_data) + offset);
+        sbi->s_es = es;
+        sb->s_magic = le16_to_cpu(es->s_magic);
+        if (sb->s_magic != EXT4_SUPER_MAGIC)
+                goto cantfind_ext4;
+
+        /* Set defaults before we parse the mount options */
+        def_mount_opts = le32_to_cpu(es->s_default_mount_opts);
+        if (def_mount_opts & EXT4_DEFM_DEBUG)
+                set_opt(sbi->s_mount_opt, DEBUG);
+        if (def_mount_opts & EXT4_DEFM_BSDGROUPS)
+                set_opt(sbi->s_mount_opt, GRPID);
+        if (def_mount_opts & EXT4_DEFM_UID16)
+                set_opt(sbi->s_mount_opt, NO_UID32);
+        if (def_mount_opts & EXT4_DEFM_XATTR_USER)
+                set_opt(sbi->s_mount_opt, XATTR_USER);
+        if (def_mount_opts & EXT4_DEFM_ACL)
+                set_opt(sbi->s_mount_opt, POSIX_ACL);
+        if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_DATA)
+                sbi->s_mount_opt |= EXT4_MOUNT_JOURNAL_DATA;
+        else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_ORDERED)
+                sbi->s_mount_opt |= EXT4_MOUNT_ORDERED_DATA;
+        else if ((def_mount_opts & EXT4_DEFM_JMODE) == EXT4_DEFM_JMODE_WBACK)
+                sbi->s_mount_opt |= EXT4_MOUNT_WRITEBACK_DATA;
+
+        if (le16_to_cpu(sbi->s_es->s_errors) == EXT4_ERRORS_PANIC)
+                set_opt(sbi->s_mount_opt, ERRORS_PANIC);
+        else if (le16_to_cpu(sbi->s_es->s_errors) == EXT4_ERRORS_RO)
+                set_opt(sbi->s_mount_opt, ERRORS_RO);
+        else
+                set_opt(sbi->s_mount_opt, ERRORS_CONT);
+
+        sbi->s_resuid = le16_to_cpu(es->s_def_resuid);
+        sbi->s_resgid = le16_to_cpu(es->s_def_resgid);
+
+        set_opt(sbi->s_mount_opt, RESERVATION);
+
+        if (!parse_options ((char *) data, sb, &journal_inum, &journal_devnum,
+                            NULL, 0))
+                goto failed_mount;
+
+        sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
+                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+
+        if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV &&
+            (EXT4_HAS_COMPAT_FEATURE(sb, ~0U) ||
+             EXT4_HAS_RO_COMPAT_FEATURE(sb, ~0U) ||
+             EXT4_HAS_INCOMPAT_FEATURE(sb, ~0U)))
+                printk(KERN_WARNING
+                       "EXT4-fs warning: feature flags set on rev 0 fs, "
+                       "running e2fsck is recommended\n");
+        /*
+         * Check feature flags regardless of the revision level, since we
+         * previously didn't change the revision level when setting the flags,
+         * so there is a chance incompat flags are set on a rev 0 filesystem.
+         */
+        features = EXT4_HAS_INCOMPAT_FEATURE(sb, ~EXT4_FEATURE_INCOMPAT_SUPP);
+        if (features) {
+                printk(KERN_ERR "EXT4-fs: %s: couldn't mount because of "
+                       "unsupported optional features (%x).\n",
+                       sb->s_id, le32_to_cpu(features));
+                goto failed_mount;
+        }
+        features = EXT4_HAS_RO_COMPAT_FEATURE(sb, ~EXT4_FEATURE_RO_COMPAT_SUPP);
+        if (!(sb->s_flags & MS_RDONLY) && features) {
+                printk(KERN_ERR "EXT4-fs: %s: couldn't mount RDWR because of "
+                       "unsupported optional features (%x).\n",
+                       sb->s_id, le32_to_cpu(features));
+                goto failed_mount;
+        }
+        blocksize = BLOCK_SIZE << le32_to_cpu(es->s_log_block_size);
+
+        if (blocksize < EXT4_MIN_BLOCK_SIZE ||
+            blocksize > EXT4_MAX_BLOCK_SIZE) {
+                printk(KERN_ERR
+                       "EXT4-fs: Unsupported filesystem blocksize %d on %s.\n",
+                       blocksize, sb->s_id);
+                goto failed_mount;
+        }
+
+        hblock = bdev_hardsect_size(sb->s_bdev);
+        if (sb->s_blocksize != blocksize) {
+                /*
+                 * Make sure the blocksize for the filesystem is larger
+                 * than the hardware sectorsize for the machine.
+                 */
+                if (blocksize < hblock) {
+                        printk(KERN_ERR "EXT4-fs: blocksize %d too small for "
+                               "device blocksize %d.\n", blocksize, hblock);
+                        goto failed_mount;
+                }
+
+                brelse (bh);
+                sb_set_blocksize(sb, blocksize);
+                logical_sb_block = sb_block * EXT4_MIN_BLOCK_SIZE;
+                offset = do_div(logical_sb_block, blocksize);
+                bh = sb_bread(sb, logical_sb_block);
+                if (!bh) {
+                        printk(KERN_ERR
+                               "EXT4-fs: Can't read superblock on 2nd try.\n");
+                        goto failed_mount;
+                }
+                es = (struct ext4_super_block *)(((char *)bh->b_data) + offset);
+                sbi->s_es = es;
+                if (es->s_magic != cpu_to_le16(EXT4_SUPER_MAGIC)) {
+                        printk (KERN_ERR
+                                "EXT4-fs: Magic mismatch, very weird !\n");
+                        goto failed_mount;
+                }
+        }
+
+        sb->s_maxbytes = ext4_max_size(sb->s_blocksize_bits);
+
+        if (le32_to_cpu(es->s_rev_level) == EXT4_GOOD_OLD_REV) {
+                sbi->s_inode_size = EXT4_GOOD_OLD_INODE_SIZE;
+                sbi->s_first_ino = EXT4_GOOD_OLD_FIRST_INO;
+        } else {
+                sbi->s_inode_size = le16_to_cpu(es->s_inode_size);
+                sbi->s_first_ino = le32_to_cpu(es->s_first_ino);
+                if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) ||
+                    (sbi->s_inode_size & (sbi->s_inode_size - 1)) ||
+                    (sbi->s_inode_size > blocksize)) {
+                        printk (KERN_ERR
+                                "EXT4-fs: unsupported inode size: %d\n",
+                                sbi->s_inode_size);
+                        goto failed_mount;
+                }
+        }
+        sbi->s_frag_size = EXT4_MIN_FRAG_SIZE <<
+                                   le32_to_cpu(es->s_log_frag_size);
+        if (blocksize != sbi->s_frag_size) {
+                printk(KERN_ERR
+                       "EXT4-fs: fragsize %lu != blocksize %u (unsupported)\n",
+                       sbi->s_frag_size, blocksize);
+                goto failed_mount;
+        }
+        sbi->s_desc_size = le16_to_cpu(es->s_desc_size);
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_64BIT)) {
+                if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT ||
+                    sbi->s_desc_size > EXT4_MAX_DESC_SIZE ||
+                    sbi->s_desc_size & (sbi->s_desc_size - 1)) {
+                        printk(KERN_ERR
+                               "EXT4-fs: unsupported descriptor size %lu\n",
+                               sbi->s_desc_size);
+                        goto failed_mount;
+                }
+        } else
+                sbi->s_desc_size = EXT4_MIN_DESC_SIZE;
+        sbi->s_blocks_per_group = le32_to_cpu(es->s_blocks_per_group);
+        sbi->s_frags_per_group = le32_to_cpu(es->s_frags_per_group);
+        sbi->s_inodes_per_group = le32_to_cpu(es->s_inodes_per_group);
+        if (EXT4_INODE_SIZE(sb) == 0)
+                goto cantfind_ext4;
+        sbi->s_inodes_per_block = blocksize / EXT4_INODE_SIZE(sb);
+        if (sbi->s_inodes_per_block == 0)
+                goto cantfind_ext4;
+        sbi->s_itb_per_group = sbi->s_inodes_per_group /
+                                        sbi->s_inodes_per_block;
+        sbi->s_desc_per_block = blocksize / EXT4_DESC_SIZE(sb);
+        sbi->s_sbh = bh;
+        sbi->s_mount_state = le16_to_cpu(es->s_state);
+        sbi->s_addr_per_block_bits = log2(EXT4_ADDR_PER_BLOCK(sb));
+        sbi->s_desc_per_block_bits = log2(EXT4_DESC_PER_BLOCK(sb));
+        for (i=0; i < 4; i++)
+                sbi->s_hash_seed[i] = le32_to_cpu(es->s_hash_seed[i]);
+        sbi->s_def_hash_version = es->s_def_hash_version;
+
+        if (sbi->s_blocks_per_group > blocksize * 8) {
+                printk (KERN_ERR
+                        "EXT4-fs: #blocks per group too big: %lu\n",
+                        sbi->s_blocks_per_group);
+                goto failed_mount;
+        }
+        if (sbi->s_frags_per_group > blocksize * 8) {
+                printk (KERN_ERR
+                        "EXT4-fs: #fragments per group too big: %lu\n",
+                        sbi->s_frags_per_group);
+                goto failed_mount;
+        }
+        if (sbi->s_inodes_per_group > blocksize * 8) {
+                printk (KERN_ERR
+                        "EXT4-fs: #inodes per group too big: %lu\n",
+                        sbi->s_inodes_per_group);
+                goto failed_mount;
+        }
+
+        if (ext4_blocks_count(es) >
+                    (sector_t)(~0ULL) >> (sb->s_blocksize_bits - 9)) {
+                printk(KERN_ERR "EXT4-fs: filesystem on %s:"
+                        " too large to mount safely\n", sb->s_id);
+                if (sizeof(sector_t) < 8)
+                        printk(KERN_WARNING "EXT4-fs: CONFIG_LBD not "
+                                        "enabled\n");
+                goto failed_mount;
+        }
+
+        if (EXT4_BLOCKS_PER_GROUP(sb) == 0)
+                goto cantfind_ext4;
+        blocks_count = (ext4_blocks_count(es) -
+                        le32_to_cpu(es->s_first_data_block) +
+                        EXT4_BLOCKS_PER_GROUP(sb) - 1);
+        do_div(blocks_count, EXT4_BLOCKS_PER_GROUP(sb));
+        sbi->s_groups_count = blocks_count;
+        db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) /
+                   EXT4_DESC_PER_BLOCK(sb);
+        sbi->s_group_desc = kmalloc(db_count * sizeof (struct buffer_head *),
+                                    GFP_KERNEL);
+        if (sbi->s_group_desc == NULL) {
+                printk (KERN_ERR "EXT4-fs: not enough memory\n");
+                goto failed_mount;
+        }
+
+        bgl_lock_init(&sbi->s_blockgroup_lock);
+
+        for (i = 0; i < db_count; i++) {
+                block = descriptor_loc(sb, logical_sb_block, i);
+                sbi->s_group_desc[i] = sb_bread(sb, block);
+                if (!sbi->s_group_desc[i]) {
+                        printk (KERN_ERR "EXT4-fs: "
+                                "can't read group descriptor %d\n", i);
+                        db_count = i;
+                        goto failed_mount2;
+                }
+        }
+        if (!ext4_check_descriptors (sb)) {
+                printk(KERN_ERR "EXT4-fs: group descriptors corrupted!\n");
+                goto failed_mount2;
+        }
+        sbi->s_gdb_count = db_count;
+        get_random_bytes(&sbi->s_next_generation, sizeof(u32));
+        spin_lock_init(&sbi->s_next_gen_lock);
+
+        percpu_counter_init(&sbi->s_freeblocks_counter,
+                ext4_count_free_blocks(sb));
+        percpu_counter_init(&sbi->s_freeinodes_counter,
+                ext4_count_free_inodes(sb));
+        percpu_counter_init(&sbi->s_dirs_counter,
+                ext4_count_dirs(sb));
+
+        /* per fileystem reservation list head & lock */
+        spin_lock_init(&sbi->s_rsv_window_lock);
+        sbi->s_rsv_window_root = RB_ROOT;
+        /* Add a single, static dummy reservation to the start of the
+         * reservation window list --- it gives us a placeholder for
+         * append-at-start-of-list which makes the allocation logic
+         * _much_ simpler. */
+        sbi->s_rsv_window_head.rsv_start = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+        sbi->s_rsv_window_head.rsv_end = EXT4_RESERVE_WINDOW_NOT_ALLOCATED;
+        sbi->s_rsv_window_head.rsv_alloc_hit = 0;
+        sbi->s_rsv_window_head.rsv_goal_size = 0;
+        ext4_rsv_window_add(sb, &sbi->s_rsv_window_head);
+
+        /*
+         * set up enough so that it can read an inode
+         */
+        sb->s_op = &ext4_sops;
+        sb->s_export_op = &ext4_export_ops;
+        sb->s_xattr = ext4_xattr_handlers;
+#ifdef CONFIG_QUOTA
+        sb->s_qcop = &ext4_qctl_operations;
+        sb->dq_op = &ext4_quota_operations;
+#endif
+        INIT_LIST_HEAD(&sbi->s_orphan); /* unlinked but open files */
+
+        sb->s_root = NULL;
+
+        needs_recovery = (es->s_last_orphan != 0 ||
+                          EXT4_HAS_INCOMPAT_FEATURE(sb,
+                                    EXT4_FEATURE_INCOMPAT_RECOVER));
+
+        /*
+         * The first inode we look at is the journal inode.  Don't try
+         * root first: it may be modified in the journal!
+         */
+        if (!test_opt(sb, NOLOAD) &&
+            EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL)) {
+                if (ext4_load_journal(sb, es, journal_devnum))
+                        goto failed_mount3;
+        } else if (journal_inum) {
+                if (ext4_create_journal(sb, es, journal_inum))
+                        goto failed_mount3;
+        } else {
+                if (!silent)
+                        printk (KERN_ERR
+                                "ext4: No journal on filesystem on %s\n",
+                                sb->s_id);
+                goto failed_mount3;
+        }
+
+        /* We have now updated the journal if required, so we can
+         * validate the data journaling mode. */
+        switch (test_opt(sb, DATA_FLAGS)) {
+        case 0:
+                /* No mode set, assume a default based on the journal
+                 * capabilities: ORDERED_DATA if the journal can
+                 * cope, else JOURNAL_DATA
+                 */
+                if (jbd2_journal_check_available_features
+                    (sbi->s_journal, 0, 0, JBD2_FEATURE_INCOMPAT_REVOKE))
+                        set_opt(sbi->s_mount_opt, ORDERED_DATA);
+                else
+                        set_opt(sbi->s_mount_opt, JOURNAL_DATA);
+                break;
+
+        case EXT4_MOUNT_ORDERED_DATA:
+        case EXT4_MOUNT_WRITEBACK_DATA:
+                if (!jbd2_journal_check_available_features
+                    (sbi->s_journal, 0, 0, JBD2_FEATURE_INCOMPAT_REVOKE)) {
+                        printk(KERN_ERR "EXT4-fs: Journal does not support "
+                               "requested data journaling mode\n");
+                        goto failed_mount4;
+                }
+        default:
+                break;
+        }
+
+        if (test_opt(sb, NOBH)) {
+                if (!(test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)) {
+                        printk(KERN_WARNING "EXT4-fs: Ignoring nobh option - "
+                                "its supported only with writeback mode\n");
+                        clear_opt(sbi->s_mount_opt, NOBH);
+                }
+        }
+        /*
+         * The jbd2_journal_load will have done any necessary log recovery,
+         * so we can safely mount the rest of the filesystem now.
+         */
+
+        root = iget(sb, EXT4_ROOT_INO);
+        sb->s_root = d_alloc_root(root);
+        if (!sb->s_root) {
+                printk(KERN_ERR "EXT4-fs: get root inode failed\n");
+                iput(root);
+                goto failed_mount4;
+        }
+        if (!S_ISDIR(root->i_mode) || !root->i_blocks || !root->i_size) {
+                dput(sb->s_root);
+                sb->s_root = NULL;
+                printk(KERN_ERR "EXT4-fs: corrupt root inode, run e2fsck\n");
+                goto failed_mount4;
+        }
+
+        ext4_setup_super (sb, es, sb->s_flags & MS_RDONLY);
+        /*
+         * akpm: core read_super() calls in here with the superblock locked.
+         * That deadlocks, because orphan cleanup needs to lock the superblock
+         * in numerous places.  Here we just pop the lock - it's relatively
+         * harmless, because we are now ready to accept write_super() requests,
+         * and aviro says that's the only reason for hanging onto the
+         * superblock lock.
+         */
+        EXT4_SB(sb)->s_mount_state |= EXT4_ORPHAN_FS;
+        ext4_orphan_cleanup(sb, es);
+        EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS;
+        if (needs_recovery)
+                printk (KERN_INFO "EXT4-fs: recovery complete.\n");
+        ext4_mark_recovery_complete(sb, es);
+        printk (KERN_INFO "EXT4-fs: mounted filesystem with %s data mode.\n",
+                test_opt(sb,DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA ? "journal":
+                test_opt(sb,DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA ? "ordered":
+                "writeback");
+
+        ext4_ext_init(sb);
+
+        lock_kernel();
+        return 0;
+
+cantfind_ext4:
+        if (!silent)
+                printk(KERN_ERR "VFS: Can't find ext4 filesystem on dev %s.\n",
+                       sb->s_id);
+        goto failed_mount;
+
+failed_mount4:
+        jbd2_journal_destroy(sbi->s_journal);
+failed_mount3:
+        percpu_counter_destroy(&sbi->s_freeblocks_counter);
+        percpu_counter_destroy(&sbi->s_freeinodes_counter);
+        percpu_counter_destroy(&sbi->s_dirs_counter);
+failed_mount2:
+        for (i = 0; i < db_count; i++)
+                brelse(sbi->s_group_desc[i]);
+        kfree(sbi->s_group_desc);
+failed_mount:
+#ifdef CONFIG_QUOTA
+        for (i = 0; i < MAXQUOTAS; i++)
+                kfree(sbi->s_qf_names[i]);
+#endif
+        ext4_blkdev_remove(sbi);
+        brelse(bh);
+out_fail:
+        sb->s_fs_info = NULL;
+        kfree(sbi);
+        lock_kernel();
+        return -EINVAL;
+}
+
+/*
+ * Setup any per-fs journal parameters now.  We'll do this both on
+ * initial mount, once the journal has been initialised but before we've
+ * done any recovery; and again on any subsequent remount.
+ */
+static void ext4_init_journal_params(struct super_block *sb, journal_t *journal)
+{
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+
+        if (sbi->s_commit_interval)
+                journal->j_commit_interval = sbi->s_commit_interval;
+        /* We could also set up an ext4-specific default for the commit
+         * interval here, but for now we'll just fall back to the jbd
+         * default. */
+
+        spin_lock(&journal->j_state_lock);
+        if (test_opt(sb, BARRIER))
+                journal->j_flags |= JBD2_BARRIER;
+        else
+                journal->j_flags &= ~JBD2_BARRIER;
+        spin_unlock(&journal->j_state_lock);
+}
+
+static journal_t *ext4_get_journal(struct super_block *sb,
+                                   unsigned int journal_inum)
+{
+        struct inode *journal_inode;
+        journal_t *journal;
+
+        /* First, test for the existence of a valid inode on disk.  Bad
+         * things happen if we iget() an unused inode, as the subsequent
+         * iput() will try to delete it. */
+
+        journal_inode = iget(sb, journal_inum);
+        if (!journal_inode) {
+                printk(KERN_ERR "EXT4-fs: no journal found.\n");
+                return NULL;
+        }
+        if (!journal_inode->i_nlink) {
+                make_bad_inode(journal_inode);
+                iput(journal_inode);
+                printk(KERN_ERR "EXT4-fs: journal inode is deleted.\n");
+                return NULL;
+        }
+
+        jbd_debug(2, "Journal inode found at %p: %Ld bytes\n",
+                  journal_inode, journal_inode->i_size);
+        if (is_bad_inode(journal_inode) || !S_ISREG(journal_inode->i_mode)) {
+                printk(KERN_ERR "EXT4-fs: invalid journal inode.\n");
+                iput(journal_inode);
+                return NULL;
+        }
+
+        journal = jbd2_journal_init_inode(journal_inode);
+        if (!journal) {
+                printk(KERN_ERR "EXT4-fs: Could not load journal inode\n");
+                iput(journal_inode);
+                return NULL;
+        }
+        journal->j_private = sb;
+        ext4_init_journal_params(sb, journal);
+        return journal;
+}
+
+static journal_t *ext4_get_dev_journal(struct super_block *sb,
+                                       dev_t j_dev)
+{
+        struct buffer_head * bh;
+        journal_t *journal;
+        ext4_fsblk_t start;
+        ext4_fsblk_t len;
+        int hblock, blocksize;
+        ext4_fsblk_t sb_block;
+        unsigned long offset;
+        struct ext4_super_block * es;
+        struct block_device *bdev;
+
+        bdev = ext4_blkdev_get(j_dev);
+        if (bdev == NULL)
+                return NULL;
+
+        if (bd_claim(bdev, sb)) {
+                printk(KERN_ERR
+                        "EXT4: failed to claim external journal device.\n");
+                blkdev_put(bdev);
+                return NULL;
+        }
+
+        blocksize = sb->s_blocksize;
+        hblock = bdev_hardsect_size(bdev);
+        if (blocksize < hblock) {
+                printk(KERN_ERR
+                        "EXT4-fs: blocksize too small for journal device.\n");
+                goto out_bdev;
+        }
+
+        sb_block = EXT4_MIN_BLOCK_SIZE / blocksize;
+        offset = EXT4_MIN_BLOCK_SIZE % blocksize;
+        set_blocksize(bdev, blocksize);
+        if (!(bh = __bread(bdev, sb_block, blocksize))) {
+                printk(KERN_ERR "EXT4-fs: couldn't read superblock of "
+                       "external journal\n");
+                goto out_bdev;
+        }
+
+        es = (struct ext4_super_block *) (((char *)bh->b_data) + offset);
+        if ((le16_to_cpu(es->s_magic) != EXT4_SUPER_MAGIC) ||
+            !(le32_to_cpu(es->s_feature_incompat) &
+              EXT4_FEATURE_INCOMPAT_JOURNAL_DEV)) {
+                printk(KERN_ERR "EXT4-fs: external journal has "
+                                        "bad superblock\n");
+                brelse(bh);
+                goto out_bdev;
+        }
+
+        if (memcmp(EXT4_SB(sb)->s_es->s_journal_uuid, es->s_uuid, 16)) {
+                printk(KERN_ERR "EXT4-fs: journal UUID does not match\n");
+                brelse(bh);
+                goto out_bdev;
+        }
+
+        len = ext4_blocks_count(es);
+        start = sb_block + 1;
+        brelse(bh);     /* we're done with the superblock */
+
+        journal = jbd2_journal_init_dev(bdev, sb->s_bdev,
+                                        start, len, blocksize);
+        if (!journal) {
+                printk(KERN_ERR "EXT4-fs: failed to create device journal\n");
+                goto out_bdev;
+        }
+        journal->j_private = sb;
+        ll_rw_block(READ, 1, &journal->j_sb_buffer);
+        wait_on_buffer(journal->j_sb_buffer);
+        if (!buffer_uptodate(journal->j_sb_buffer)) {
+                printk(KERN_ERR "EXT4-fs: I/O error on journal device\n");
+                goto out_journal;
+        }
+        if (be32_to_cpu(journal->j_superblock->s_nr_users) != 1) {
+                printk(KERN_ERR "EXT4-fs: External journal has more than one "
+                                        "user (unsupported) - %d\n",
+                        be32_to_cpu(journal->j_superblock->s_nr_users));
+                goto out_journal;
+        }
+        EXT4_SB(sb)->journal_bdev = bdev;
+        ext4_init_journal_params(sb, journal);
+        return journal;
+out_journal:
+        jbd2_journal_destroy(journal);
+out_bdev:
+        ext4_blkdev_put(bdev);
+        return NULL;
+}
+
+static int ext4_load_journal(struct super_block *sb,
+                             struct ext4_super_block *es,
+                             unsigned long journal_devnum)
+{
+        journal_t *journal;
+        unsigned int journal_inum = le32_to_cpu(es->s_journal_inum);
+        dev_t journal_dev;
+        int err = 0;
+        int really_read_only;
+
+        if (journal_devnum &&
+            journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+                printk(KERN_INFO "EXT4-fs: external journal device major/minor "
+                        "numbers have changed\n");
+                journal_dev = new_decode_dev(journal_devnum);
+        } else
+                journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev));
+
+        really_read_only = bdev_read_only(sb->s_bdev);
+
+        /*
+         * Are we loading a blank journal or performing recovery after a
+         * crash?  For recovery, we need to check in advance whether we
+         * can get read-write access to the device.
+         */
+
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER)) {
+                if (sb->s_flags & MS_RDONLY) {
+                        printk(KERN_INFO "EXT4-fs: INFO: recovery "
+                                        "required on readonly filesystem.\n");
+                        if (really_read_only) {
+                                printk(KERN_ERR "EXT4-fs: write access "
+                                        "unavailable, cannot proceed.\n");
+                                return -EROFS;
+                        }
+                        printk (KERN_INFO "EXT4-fs: write access will "
+                                        "be enabled during recovery.\n");
+                }
+        }
+
+        if (journal_inum && journal_dev) {
+                printk(KERN_ERR "EXT4-fs: filesystem has both journal "
+                       "and inode journals!\n");
+                return -EINVAL;
+        }
+
+        if (journal_inum) {
+                if (!(journal = ext4_get_journal(sb, journal_inum)))
+                        return -EINVAL;
+        } else {
+                if (!(journal = ext4_get_dev_journal(sb, journal_dev)))
+                        return -EINVAL;
+        }
+
+        if (!really_read_only && test_opt(sb, UPDATE_JOURNAL)) {
+                err = jbd2_journal_update_format(journal);
+                if (err)  {
+                        printk(KERN_ERR "EXT4-fs: error updating journal.\n");
+                        jbd2_journal_destroy(journal);
+                        return err;
+                }
+        }
+
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER))
+                err = jbd2_journal_wipe(journal, !really_read_only);
+        if (!err)
+                err = jbd2_journal_load(journal);
+
+        if (err) {
+                printk(KERN_ERR "EXT4-fs: error loading journal.\n");
+                jbd2_journal_destroy(journal);
+                return err;
+        }
+
+        EXT4_SB(sb)->s_journal = journal;
+        ext4_clear_journal_err(sb, es);
+
+        if (journal_devnum &&
+            journal_devnum != le32_to_cpu(es->s_journal_dev)) {
+                es->s_journal_dev = cpu_to_le32(journal_devnum);
+                sb->s_dirt = 1;
+
+                /* Make sure we flush the recovery flag to disk. */
+                ext4_commit_super(sb, es, 1);
+        }
+
+        return 0;
+}
+
+static int ext4_create_journal(struct super_block * sb,
+                               struct ext4_super_block * es,
+                               unsigned int journal_inum)
+{
+        journal_t *journal;
+
+        if (sb->s_flags & MS_RDONLY) {
+                printk(KERN_ERR "EXT4-fs: readonly filesystem when trying to "
+                                "create journal.\n");
+                return -EROFS;
+        }
+
+        if (!(journal = ext4_get_journal(sb, journal_inum)))
+                return -EINVAL;
+
+        printk(KERN_INFO "EXT4-fs: creating new journal on inode %u\n",
+               journal_inum);
+
+        if (jbd2_journal_create(journal)) {
+                printk(KERN_ERR "EXT4-fs: error creating journal.\n");
+                jbd2_journal_destroy(journal);
+                return -EIO;
+        }
+
+        EXT4_SB(sb)->s_journal = journal;
+
+        ext4_update_dynamic_rev(sb);
+        EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+        EXT4_SET_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_HAS_JOURNAL);
+
+        es->s_journal_inum = cpu_to_le32(journal_inum);
+        sb->s_dirt = 1;
+
+        /* Make sure we flush the recovery flag to disk. */
+        ext4_commit_super(sb, es, 1);
+
+        return 0;
+}
+
+static void ext4_commit_super (struct super_block * sb,
+                               struct ext4_super_block * es,
+                               int sync)
+{
+        struct buffer_head *sbh = EXT4_SB(sb)->s_sbh;
+
+        if (!sbh)
+                return;
+        es->s_wtime = cpu_to_le32(get_seconds());
+        ext4_free_blocks_count_set(es, ext4_count_free_blocks(sb));
+        es->s_free_inodes_count = cpu_to_le32(ext4_count_free_inodes(sb));
+        BUFFER_TRACE(sbh, "marking dirty");
+        mark_buffer_dirty(sbh);
+        if (sync)
+                sync_dirty_buffer(sbh);
+}
+
+
+/*
+ * Have we just finished recovery?  If so, and if we are mounting (or
+ * remounting) the filesystem readonly, then we will end up with a
+ * consistent fs on disk.  Record that fact.
+ */
+static void ext4_mark_recovery_complete(struct super_block * sb,
+                                        struct ext4_super_block * es)
+{
+        journal_t *journal = EXT4_SB(sb)->s_journal;
+
+        jbd2_journal_lock_updates(journal);
+        jbd2_journal_flush(journal);
+        if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER) &&
+            sb->s_flags & MS_RDONLY) {
+                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+                sb->s_dirt = 0;
+                ext4_commit_super(sb, es, 1);
+        }
+        jbd2_journal_unlock_updates(journal);
+}
+
+/*
+ * If we are mounting (or read-write remounting) a filesystem whose journal
+ * has recorded an error from a previous lifetime, move that error to the
+ * main filesystem now.
+ */
+static void ext4_clear_journal_err(struct super_block * sb,
+                                   struct ext4_super_block * es)
+{
+        journal_t *journal;
+        int j_errno;
+        const char *errstr;
+
+        journal = EXT4_SB(sb)->s_journal;
+
+        /*
+         * Now check for any error status which may have been recorded in the
+         * journal by a prior ext4_error() or ext4_abort()
+         */
+
+        j_errno = jbd2_journal_errno(journal);
+        if (j_errno) {
+                char nbuf[16];
+
+                errstr = ext4_decode_error(sb, j_errno, nbuf);
+                ext4_warning(sb, __FUNCTION__, "Filesystem error recorded "
+                             "from previous mount: %s", errstr);
+                ext4_warning(sb, __FUNCTION__, "Marking fs in need of "
+                             "filesystem check.");
+
+                EXT4_SB(sb)->s_mount_state |= EXT4_ERROR_FS;
+                es->s_state |= cpu_to_le16(EXT4_ERROR_FS);
+                ext4_commit_super (sb, es, 1);
+
+                jbd2_journal_clear_err(journal);
+        }
+}
+
+/*
+ * Force the running and committing transactions to commit,
+ * and wait on the commit.
+ */
+int ext4_force_commit(struct super_block *sb)
+{
+        journal_t *journal;
+        int ret;
+
+        if (sb->s_flags & MS_RDONLY)
+                return 0;
+
+        journal = EXT4_SB(sb)->s_journal;
+        sb->s_dirt = 0;
+        ret = ext4_journal_force_commit(journal);
+        return ret;
+}
+
+/*
+ * Ext4 always journals updates to the superblock itself, so we don't
+ * have to propagate any other updates to the superblock on disk at this
+ * point.  Just start an async writeback to get the buffers on their way
+ * to the disk.
+ *
+ * This implicitly triggers the writebehind on sync().
+ */
+
+static void ext4_write_super (struct super_block * sb)
+{
+        if (mutex_trylock(&sb->s_lock) != 0)
+                BUG();
+        sb->s_dirt = 0;
+}
+
+static int ext4_sync_fs(struct super_block *sb, int wait)
+{
+        tid_t target;
+
+        sb->s_dirt = 0;
+        if (jbd2_journal_start_commit(EXT4_SB(sb)->s_journal, &target)) {
+                if (wait)
+                        jbd2_log_wait_commit(EXT4_SB(sb)->s_journal, target);
+        }
+        return 0;
+}
+
+/*
+ * LVM calls this function before a (read-only) snapshot is created.  This
+ * gives us a chance to flush the journal completely and mark the fs clean.
+ */
+static void ext4_write_super_lockfs(struct super_block *sb)
+{
+        sb->s_dirt = 0;
+
+        if (!(sb->s_flags & MS_RDONLY)) {
+                journal_t *journal = EXT4_SB(sb)->s_journal;
+
+                /* Now we set up the journal barrier. */
+                jbd2_journal_lock_updates(journal);
+                jbd2_journal_flush(journal);
+
+                /* Journal blocked and flushed, clear needs_recovery flag. */
+                EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+                ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
+        }
+}
+
+/*
+ * Called by LVM after the snapshot is done.  We need to reset the RECOVER
+ * flag here, even though the filesystem is not technically dirty yet.
+ */
+static void ext4_unlockfs(struct super_block *sb)
+{
+        if (!(sb->s_flags & MS_RDONLY)) {
+                lock_super(sb);
+                /* Reser the needs_recovery flag before the fs is unlocked. */
+                EXT4_SET_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
+                ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
+                unlock_super(sb);
+                jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
+        }
+}
+
+static int ext4_remount (struct super_block * sb, int * flags, char * data)
+{
+        struct ext4_super_block * es;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        ext4_fsblk_t n_blocks_count = 0;
+        unsigned long old_sb_flags;
+        struct ext4_mount_options old_opts;
+        int err;
+#ifdef CONFIG_QUOTA
+        int i;
+#endif
+
+        /* Store the original options */
+        old_sb_flags = sb->s_flags;
+        old_opts.s_mount_opt = sbi->s_mount_opt;
+        old_opts.s_resuid = sbi->s_resuid;
+        old_opts.s_resgid = sbi->s_resgid;
+        old_opts.s_commit_interval = sbi->s_commit_interval;
+#ifdef CONFIG_QUOTA
+        old_opts.s_jquota_fmt = sbi->s_jquota_fmt;
+        for (i = 0; i < MAXQUOTAS; i++)
+                old_opts.s_qf_names[i] = sbi->s_qf_names[i];
+#endif
+
+        /*
+         * Allow the "check" option to be passed as a remount option.
+         */
+        if (!parse_options(data, sb, NULL, NULL, &n_blocks_count, 1)) {
+                err = -EINVAL;
+                goto restore_opts;
+        }
+
+        if (sbi->s_mount_opt & EXT4_MOUNT_ABORT)
+                ext4_abort(sb, __FUNCTION__, "Abort forced by user");
+
+        sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
+                ((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
+
+        es = sbi->s_es;
+
+        ext4_init_journal_params(sb, sbi->s_journal);
+
+        if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY) ||
+                n_blocks_count > ext4_blocks_count(es)) {
+                if (sbi->s_mount_opt & EXT4_MOUNT_ABORT) {
+                        err = -EROFS;
+                        goto restore_opts;
+                }
+
+                if (*flags & MS_RDONLY) {
+                        /*
+                         * First of all, the unconditional stuff we have to do
+                         * to disable replay of the journal when we next remount
+                         */
+                        sb->s_flags |= MS_RDONLY;
+
+                        /*
+                         * OK, test if we are remounting a valid rw partition
+                         * readonly, and if so set the rdonly flag and then
+                         * mark the partition as valid again.
+                         */
+                        if (!(es->s_state & cpu_to_le16(EXT4_VALID_FS)) &&
+                            (sbi->s_mount_state & EXT4_VALID_FS))
+                                es->s_state = cpu_to_le16(sbi->s_mount_state);
+
+                        ext4_mark_recovery_complete(sb, es);
+                } else {
+                        __le32 ret;
+                        if ((ret = EXT4_HAS_RO_COMPAT_FEATURE(sb,
+                                        ~EXT4_FEATURE_RO_COMPAT_SUPP))) {
+                                printk(KERN_WARNING "EXT4-fs: %s: couldn't "
+                                       "remount RDWR because of unsupported "
+                                       "optional features (%x).\n",
+                                       sb->s_id, le32_to_cpu(ret));
+                                err = -EROFS;
+                                goto restore_opts;
+                        }
+                        /*
+                         * Mounting a RDONLY partition read-write, so reread
+                         * and store the current valid flag.  (It may have
+                         * been changed by e2fsck since we originally mounted
+                         * the partition.)
+                         */
+                        ext4_clear_journal_err(sb, es);
+                        sbi->s_mount_state = le16_to_cpu(es->s_state);
+                        if ((err = ext4_group_extend(sb, es, n_blocks_count)))
+                                goto restore_opts;
+                        if (!ext4_setup_super (sb, es, 0))
+                                sb->s_flags &= ~MS_RDONLY;
+                }
+        }
+#ifdef CONFIG_QUOTA
+        /* Release old quota file names */
+        for (i = 0; i < MAXQUOTAS; i++)
+                if (old_opts.s_qf_names[i] &&
+                    old_opts.s_qf_names[i] != sbi->s_qf_names[i])
+                        kfree(old_opts.s_qf_names[i]);
+#endif
+        return 0;
+restore_opts:
+        sb->s_flags = old_sb_flags;
+        sbi->s_mount_opt = old_opts.s_mount_opt;
+        sbi->s_resuid = old_opts.s_resuid;
+        sbi->s_resgid = old_opts.s_resgid;
+        sbi->s_commit_interval = old_opts.s_commit_interval;
+#ifdef CONFIG_QUOTA
+        sbi->s_jquota_fmt = old_opts.s_jquota_fmt;
+        for (i = 0; i < MAXQUOTAS; i++) {
+                if (sbi->s_qf_names[i] &&
+                    old_opts.s_qf_names[i] != sbi->s_qf_names[i])
+                        kfree(sbi->s_qf_names[i]);
+                sbi->s_qf_names[i] = old_opts.s_qf_names[i];
+        }
+#endif
+        return err;
+}
+
+static int ext4_statfs (struct dentry * dentry, struct kstatfs * buf)
+{
+        struct super_block *sb = dentry->d_sb;
+        struct ext4_sb_info *sbi = EXT4_SB(sb);
+        struct ext4_super_block *es = sbi->s_es;
+        ext4_fsblk_t overhead;
+        int i;
+
+        if (test_opt (sb, MINIX_DF))
+                overhead = 0;
+        else {
+                unsigned long ngroups;
+                ngroups = EXT4_SB(sb)->s_groups_count;
+                smp_rmb();
+
+                /*
+                 * Compute the overhead (FS structures)
+                 */
+
+                /*
+                 * All of the blocks before first_data_block are
+                 * overhead
+                 */
+                overhead = le32_to_cpu(es->s_first_data_block);
+
+                /*
+                 * Add the overhead attributed to the superblock and
+                 * block group descriptors.  If the sparse superblocks
+                 * feature is turned on, then not all groups have this.
+                 */
+                for (i = 0; i < ngroups; i++) {
+                        overhead += ext4_bg_has_super(sb, i) +
+                                ext4_bg_num_gdb(sb, i);
+                        cond_resched();
+                }
+
+                /*
+                 * Every block group has an inode bitmap, a block
+                 * bitmap, and an inode table.
+                 */
+                overhead += (ngroups * (2 + EXT4_SB(sb)->s_itb_per_group));
+        }
+
+        buf->f_type = EXT4_SUPER_MAGIC;
+        buf->f_bsize = sb->s_blocksize;
+        buf->f_blocks = ext4_blocks_count(es) - overhead;
+        buf->f_bfree = percpu_counter_sum(&sbi->s_freeblocks_counter);
+        buf->f_bavail = buf->f_bfree - ext4_r_blocks_count(es);
+        if (buf->f_bfree < ext4_r_blocks_count(es))
+                buf->f_bavail = 0;
+        buf->f_files = le32_to_cpu(es->s_inodes_count);
+        buf->f_ffree = percpu_counter_sum(&sbi->s_freeinodes_counter);
+        buf->f_namelen = EXT4_NAME_LEN;
+        return 0;
+}
+
+/* Helper function for writing quotas on sync - we need to start transaction before quota file
+ * is locked for write. Otherwise the are possible deadlocks:
+ * Process 1                         Process 2
+ * ext4_create()                     quota_sync()
+ *   jbd2_journal_start()                   write_dquot()
+ *   DQUOT_INIT()                        down(dqio_mutex)
+ *     down(dqio_mutex)                    jbd2_journal_start()
+ *
+ */
+
+#ifdef CONFIG_QUOTA
+
+static inline struct inode *dquot_to_inode(struct dquot *dquot)
+{
+        return sb_dqopt(dquot->dq_sb)->files[dquot->dq_type];
+}
+
+static int ext4_dquot_initialize(struct inode *inode, int type)
+{
+        handle_t *handle;
+        int ret, err;
+
+        /* We may create quota structure so we need to reserve enough blocks */
+        handle = ext4_journal_start(inode, 2*EXT4_QUOTA_INIT_BLOCKS(inode->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_initialize(inode, type);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+static int ext4_dquot_drop(struct inode *inode)
+{
+        handle_t *handle;
+        int ret, err;
+
+        /* We may delete quota structure so we need to reserve enough blocks */
+        handle = ext4_journal_start(inode, 2*EXT4_QUOTA_DEL_BLOCKS(inode->i_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_drop(inode);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+static int ext4_write_dquot(struct dquot *dquot)
+{
+        int ret, err;
+        handle_t *handle;
+        struct inode *inode;
+
+        inode = dquot_to_inode(dquot);
+        handle = ext4_journal_start(inode,
+                                        EXT4_QUOTA_TRANS_BLOCKS(dquot->dq_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_commit(dquot);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+static int ext4_acquire_dquot(struct dquot *dquot)
+{
+        int ret, err;
+        handle_t *handle;
+
+        handle = ext4_journal_start(dquot_to_inode(dquot),
+                                        EXT4_QUOTA_INIT_BLOCKS(dquot->dq_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_acquire(dquot);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+static int ext4_release_dquot(struct dquot *dquot)
+{
+        int ret, err;
+        handle_t *handle;
+
+        handle = ext4_journal_start(dquot_to_inode(dquot),
+                                        EXT4_QUOTA_DEL_BLOCKS(dquot->dq_sb));
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_release(dquot);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+static int ext4_mark_dquot_dirty(struct dquot *dquot)
+{
+        /* Are we journalling quotas? */
+        if (EXT4_SB(dquot->dq_sb)->s_qf_names[USRQUOTA] ||
+            EXT4_SB(dquot->dq_sb)->s_qf_names[GRPQUOTA]) {
+                dquot_mark_dquot_dirty(dquot);
+                return ext4_write_dquot(dquot);
+        } else {
+                return dquot_mark_dquot_dirty(dquot);
+        }
+}
+
+static int ext4_write_info(struct super_block *sb, int type)
+{
+        int ret, err;
+        handle_t *handle;
+
+        /* Data block + inode block */
+        handle = ext4_journal_start(sb->s_root->d_inode, 2);
+        if (IS_ERR(handle))
+                return PTR_ERR(handle);
+        ret = dquot_commit_info(sb, type);
+        err = ext4_journal_stop(handle);
+        if (!ret)
+                ret = err;
+        return ret;
+}
+
+/*
+ * Turn on quotas during mount time - we need to find
+ * the quota file and such...
+ */
+static int ext4_quota_on_mount(struct super_block *sb, int type)
+{
+        return vfs_quota_on_mount(sb, EXT4_SB(sb)->s_qf_names[type],
+                        EXT4_SB(sb)->s_jquota_fmt, type);
+}
+
+/*
+ * Standard function to be called on quota_on
+ */
+static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+                         char *path)
+{
+        int err;
+        struct nameidata nd;
+
+        if (!test_opt(sb, QUOTA))
+                return -EINVAL;
+        /* Not journalling quota? */
+        if (!EXT4_SB(sb)->s_qf_names[USRQUOTA] &&
+            !EXT4_SB(sb)->s_qf_names[GRPQUOTA])
+                return vfs_quota_on(sb, type, format_id, path);
+        err = path_lookup(path, LOOKUP_FOLLOW, &nd);
+        if (err)
+                return err;
+        /* Quotafile not on the same filesystem? */
+        if (nd.mnt->mnt_sb != sb) {
+                path_release(&nd);
+                return -EXDEV;
+        }
+        /* Quotafile not of fs root? */
+        if (nd.dentry->d_parent->d_inode != sb->s_root->d_inode)
+                printk(KERN_WARNING
+                        "EXT4-fs: Quota file not on filesystem root. "
+                        "Journalled quota will not work.\n");
+        path_release(&nd);
+        return vfs_quota_on(sb, type, format_id, path);
+}
+
+/* Read data from quotafile - avoid pagecache and such because we cannot afford
+ * acquiring the locks... As quota files are never truncated and quota code
+ * itself serializes the operations (and noone else should touch the files)
+ * we don't have to be afraid of races */
+static ssize_t ext4_quota_read(struct super_block *sb, int type, char *data,
+                               size_t len, loff_t off)
+{
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        sector_t blk = off >> EXT4_BLOCK_SIZE_BITS(sb);
+        int err = 0;
+        int offset = off & (sb->s_blocksize - 1);
+        int tocopy;
+        size_t toread;
+        struct buffer_head *bh;
+        loff_t i_size = i_size_read(inode);
+
+        if (off > i_size)
+                return 0;
+        if (off+len > i_size)
+                len = i_size-off;
+        toread = len;
+        while (toread > 0) {
+                tocopy = sb->s_blocksize - offset < toread ?
+                                sb->s_blocksize - offset : toread;
+                bh = ext4_bread(NULL, inode, blk, 0, &err);
+                if (err)
+                        return err;
+                if (!bh)        /* A hole? */
+                        memset(data, 0, tocopy);
+                else
+                        memcpy(data, bh->b_data+offset, tocopy);
+                brelse(bh);
+                offset = 0;
+                toread -= tocopy;
+                data += tocopy;
+                blk++;
+        }
+        return len;
+}
+
+/* Write to quotafile (we know the transaction is already started and has
+ * enough credits) */
+static ssize_t ext4_quota_write(struct super_block *sb, int type,
+                                const char *data, size_t len, loff_t off)
+{
+        struct inode *inode = sb_dqopt(sb)->files[type];
+        sector_t blk = off >> EXT4_BLOCK_SIZE_BITS(sb);
+        int err = 0;
+        int offset = off & (sb->s_blocksize - 1);
+        int tocopy;
+        int journal_quota = EXT4_SB(sb)->s_qf_names[type] != NULL;
+        size_t towrite = len;
+        struct buffer_head *bh;
+        handle_t *handle = journal_current_handle();
+
+        mutex_lock_nested(&inode->i_mutex, I_MUTEX_QUOTA);
+        while (towrite > 0) {
+                tocopy = sb->s_blocksize - offset < towrite ?
+                                sb->s_blocksize - offset : towrite;
+                bh = ext4_bread(handle, inode, blk, 1, &err);
+                if (!bh)
+                        goto out;
+                if (journal_quota) {
+                        err = ext4_journal_get_write_access(handle, bh);
+                        if (err) {
+                                brelse(bh);
+                                goto out;
+                        }
+                }
+                lock_buffer(bh);
+                memcpy(bh->b_data+offset, data, tocopy);
+                flush_dcache_page(bh->b_page);
+                unlock_buffer(bh);
+                if (journal_quota)
+                        err = ext4_journal_dirty_metadata(handle, bh);
+                else {
+                        /* Always do at least ordered writes for quotas */
+                        err = ext4_journal_dirty_data(handle, bh);
+                        mark_buffer_dirty(bh);
+                }
+                brelse(bh);
+                if (err)
+                        goto out;
+                offset = 0;
+                towrite -= tocopy;
+                data += tocopy;
+                blk++;
+        }
+out:
+        if (len == towrite)
+                return err;
+        if (inode->i_size < off+len-towrite) {
+                i_size_write(inode, off+len-towrite);
+                EXT4_I(inode)->i_disksize = inode->i_size;
+        }
+        inode->i_version++;
+        inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        ext4_mark_inode_dirty(handle, inode);
+        mutex_unlock(&inode->i_mutex);
+        return len - towrite;
+}
+
+#endif
+
+static int ext4_get_sb(struct file_system_type *fs_type,
+        int flags, const char *dev_name, void *data, struct vfsmount *mnt)
+{
+        return get_sb_bdev(fs_type, flags, dev_name, data, ext4_fill_super, mnt);
+}
+
+static struct file_system_type ext4dev_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "ext4dev",
+        .get_sb         = ext4_get_sb,
+        .kill_sb        = kill_block_super,
+        .fs_flags       = FS_REQUIRES_DEV,
+};
+
+static int __init init_ext4_fs(void)
+{
+        int err = init_ext4_xattr();
+        if (err)
+                return err;
+        err = init_inodecache();
+        if (err)
+                goto out1;
+        err = register_filesystem(&ext4dev_fs_type);
+        if (err)
+                goto out;
+        return 0;
+out:
+        destroy_inodecache();
+out1:
+        exit_ext4_xattr();
+        return err;
+}
+
+static void __exit exit_ext4_fs(void)
+{
+        unregister_filesystem(&ext4dev_fs_type);
+        destroy_inodecache();
+        exit_ext4_xattr();
+}
+
+MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others");
+MODULE_DESCRIPTION("Fourth Extended Filesystem with extents");
+MODULE_LICENSE("GPL");
+module_init(init_ext4_fs)
+module_exit(exit_ext4_fs)
diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c
new file mode 100644
index 000000000000..fcf527286d75
--- /dev/null
+++ b/fs/ext4/symlink.c
@@ -0,0 +1,54 @@
+/*
+ *  linux/fs/ext4/symlink.c
+ *
+ * Only fast symlinks left here - the rest is done by generic code. AV, 1999
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/fs/minix/symlink.c
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ *
+ *  ext4 symlink handling code
+ */
+
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/namei.h>
+#include "xattr.h"
+
+static void * ext4_follow_link(struct dentry *dentry, struct nameidata *nd)
+{
+        struct ext4_inode_info *ei = EXT4_I(dentry->d_inode);
+        nd_set_link(nd, (char*)ei->i_data);
+        return NULL;
+}
+
+struct inode_operations ext4_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+        .put_link       = page_put_link,
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
+        .listxattr      = ext4_listxattr,
+        .removexattr    = generic_removexattr,
+#endif
+};
+
+struct inode_operations ext4_fast_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = ext4_follow_link,
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        .setxattr       = generic_setxattr,
+        .getxattr       = generic_getxattr,
+        .listxattr      = ext4_listxattr,
+        .removexattr    = generic_removexattr,
+#endif
+};
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
new file mode 100644
index 000000000000..63233cd946a7
--- /dev/null
+++ b/fs/ext4/xattr.c
@@ -0,0 +1,1317 @@
+/*
+ * linux/fs/ext4/xattr.c
+ *
+ * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
+ *
+ * Fix by Harrison Xing <harrison@mountainviewdata.com>.
+ * Ext4 code with a lot of help from Eric Jarman <ejarman@acm.org>.
+ * Extended attributes for symlinks and special files added per
+ *  suggestion of Luka Renko <luka.renko@hermes.si>.
+ * xattr consolidation Copyright (c) 2004 James Morris <jmorris@redhat.com>,
+ *  Red Hat Inc.
+ * ea-in-inode support by Alex Tomas <alex@clusterfs.com> aka bzzz
+ *  and Andreas Gruenbacher <agruen@suse.de>.
+ */
+
+/*
+ * Extended attributes are stored directly in inodes (on file systems with
+ * inodes bigger than 128 bytes) and on additional disk blocks. The i_file_acl
+ * field contains the block number if an inode uses an additional block. All
+ * attributes must fit in the inode and one additional block. Blocks that
+ * contain the identical set of attributes may be shared among several inodes.
+ * Identical blocks are detected by keeping a cache of blocks that have
+ * recently been accessed.
+ *
+ * The attributes in inodes and on blocks have a different header; the entries
+ * are stored in the same format:
+ *
+ *   +------------------+
+ *   | header           |
+ *   | entry 1          | |
+ *   | entry 2          | | growing downwards
+ *   | entry 3          | v
+ *   | four null bytes  |
+ *   | . . .            |
+ *   | value 1          | ^
+ *   | value 3          | | growing upwards
+ *   | value 2          | |
+ *   +------------------+
+ *
+ * The header is followed by multiple entry descriptors. In disk blocks, the
+ * entry descriptors are kept sorted. In inodes, they are unsorted. The
+ * attribute values are aligned to the end of the block in no specific order.
+ *
+ * Locking strategy
+ * ----------------
+ * EXT4_I(inode)->i_file_acl is protected by EXT4_I(inode)->xattr_sem.
+ * EA blocks are only changed if they are exclusive to an inode, so
+ * holding xattr_sem also means that nothing but the EA block's reference
+ * count can change. Multiple writers to the same block are synchronized
+ * by the buffer lock.
+ */
+
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/mbcache.h>
+#include <linux/quotaops.h>
+#include <linux/rwsem.h>
+#include "xattr.h"
+#include "acl.h"
+
+#define BHDR(bh) ((struct ext4_xattr_header *)((bh)->b_data))
+#define ENTRY(ptr) ((struct ext4_xattr_entry *)(ptr))
+#define BFIRST(bh) ENTRY(BHDR(bh)+1)
+#define IS_LAST_ENTRY(entry) (*(__u32 *)(entry) == 0)
+
+#define IHDR(inode, raw_inode) \
+        ((struct ext4_xattr_ibody_header *) \
+                ((void *)raw_inode + \
+                 EXT4_GOOD_OLD_INODE_SIZE + \
+                 EXT4_I(inode)->i_extra_isize))
+#define IFIRST(hdr) ((struct ext4_xattr_entry *)((hdr)+1))
+
+#ifdef EXT4_XATTR_DEBUG
+# define ea_idebug(inode, f...) do { \
+                printk(KERN_DEBUG "inode %s:%lu: ", \
+                        inode->i_sb->s_id, inode->i_ino); \
+                printk(f); \
+                printk("\n"); \
+        } while (0)
+# define ea_bdebug(bh, f...) do { \
+                char b[BDEVNAME_SIZE]; \
+                printk(KERN_DEBUG "block %s:%lu: ", \
+                        bdevname(bh->b_bdev, b), \
+                        (unsigned long) bh->b_blocknr); \
+                printk(f); \
+                printk("\n"); \
+        } while (0)
+#else
+# define ea_idebug(f...)
+# define ea_bdebug(f...)
+#endif
+
+static void ext4_xattr_cache_insert(struct buffer_head *);
+static struct buffer_head *ext4_xattr_cache_find(struct inode *,
+                                                 struct ext4_xattr_header *,
+                                                 struct mb_cache_entry **);
+static void ext4_xattr_rehash(struct ext4_xattr_header *,
+                              struct ext4_xattr_entry *);
+
+static struct mb_cache *ext4_xattr_cache;
+
+static struct xattr_handler *ext4_xattr_handler_map[] = {
+        [EXT4_XATTR_INDEX_USER]              = &ext4_xattr_user_handler,
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        [EXT4_XATTR_INDEX_POSIX_ACL_ACCESS]  = &ext4_xattr_acl_access_handler,
+        [EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT] = &ext4_xattr_acl_default_handler,
+#endif
+        [EXT4_XATTR_INDEX_TRUSTED]           = &ext4_xattr_trusted_handler,
+#ifdef CONFIG_EXT4DEV_FS_SECURITY
+        [EXT4_XATTR_INDEX_SECURITY]          = &ext4_xattr_security_handler,
+#endif
+};
+
+struct xattr_handler *ext4_xattr_handlers[] = {
+        &ext4_xattr_user_handler,
+        &ext4_xattr_trusted_handler,
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        &ext4_xattr_acl_access_handler,
+        &ext4_xattr_acl_default_handler,
+#endif
+#ifdef CONFIG_EXT4DEV_FS_SECURITY
+        &ext4_xattr_security_handler,
+#endif
+        NULL
+};
+
+static inline struct xattr_handler *
+ext4_xattr_handler(int name_index)
+{
+        struct xattr_handler *handler = NULL;
+
+        if (name_index > 0 && name_index < ARRAY_SIZE(ext4_xattr_handler_map))
+                handler = ext4_xattr_handler_map[name_index];
+        return handler;
+}
+
+/*
+ * Inode operation listxattr()
+ *
+ * dentry->d_inode->i_mutex: don't care
+ */
+ssize_t
+ext4_listxattr(struct dentry *dentry, char *buffer, size_t size)
+{
+        return ext4_xattr_list(dentry->d_inode, buffer, size);
+}
+
+static int
+ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end)
+{
+        while (!IS_LAST_ENTRY(entry)) {
+                struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry);
+                if ((void *)next >= end)
+                        return -EIO;
+                entry = next;
+        }
+        return 0;
+}
+
+static inline int
+ext4_xattr_check_block(struct buffer_head *bh)
+{
+        int error;
+
+        if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
+            BHDR(bh)->h_blocks != cpu_to_le32(1))
+                return -EIO;
+        error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size);
+        return error;
+}
+
+static inline int
+ext4_xattr_check_entry(struct ext4_xattr_entry *entry, size_t size)
+{
+        size_t value_size = le32_to_cpu(entry->e_value_size);
+
+        if (entry->e_value_block != 0 || value_size > size ||
+            le16_to_cpu(entry->e_value_offs) + value_size > size)
+                return -EIO;
+        return 0;
+}
+
+static int
+ext4_xattr_find_entry(struct ext4_xattr_entry **pentry, int name_index,
+                      const char *name, size_t size, int sorted)
+{
+        struct ext4_xattr_entry *entry;
+        size_t name_len;
+        int cmp = 1;
+
+        if (name == NULL)
+                return -EINVAL;
+        name_len = strlen(name);
+        entry = *pentry;
+        for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
+                cmp = name_index - entry->e_name_index;
+                if (!cmp)
+                        cmp = name_len - entry->e_name_len;
+                if (!cmp)
+                        cmp = memcmp(name, entry->e_name, name_len);
+                if (cmp <= 0 && (sorted || cmp == 0))
+                        break;
+        }
+        *pentry = entry;
+        if (!cmp && ext4_xattr_check_entry(entry, size))
+                        return -EIO;
+        return cmp ? -ENODATA : 0;
+}
+
+static int
+ext4_xattr_block_get(struct inode *inode, int name_index, const char *name,
+                     void *buffer, size_t buffer_size)
+{
+        struct buffer_head *bh = NULL;
+        struct ext4_xattr_entry *entry;
+        size_t size;
+        int error;
+
+        ea_idebug(inode, "name=%d.%s, buffer=%p, buffer_size=%ld",
+                  name_index, name, buffer, (long)buffer_size);
+
+        error = -ENODATA;
+        if (!EXT4_I(inode)->i_file_acl)
+                goto cleanup;
+        ea_idebug(inode, "reading block %u", EXT4_I(inode)->i_file_acl);
+        bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+        if (!bh)
+                goto cleanup;
+        ea_bdebug(bh, "b_count=%d, refcount=%d",
+                atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
+        if (ext4_xattr_check_block(bh)) {
+bad_block:      ext4_error(inode->i_sb, __FUNCTION__,
+                           "inode %lu: bad block %llu", inode->i_ino,
+                           EXT4_I(inode)->i_file_acl);
+                error = -EIO;
+                goto cleanup;
+        }
+        ext4_xattr_cache_insert(bh);
+        entry = BFIRST(bh);
+        error = ext4_xattr_find_entry(&entry, name_index, name, bh->b_size, 1);
+        if (error == -EIO)
+                goto bad_block;
+        if (error)
+                goto cleanup;
+        size = le32_to_cpu(entry->e_value_size);
+        if (buffer) {
+                error = -ERANGE;
+                if (size > buffer_size)
+                        goto cleanup;
+                memcpy(buffer, bh->b_data + le16_to_cpu(entry->e_value_offs),
+                       size);
+        }
+        error = size;
+
+cleanup:
+        brelse(bh);
+        return error;
+}
+
+static int
+ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
+                     void *buffer, size_t buffer_size)
+{
+        struct ext4_xattr_ibody_header *header;
+        struct ext4_xattr_entry *entry;
+        struct ext4_inode *raw_inode;
+        struct ext4_iloc iloc;
+        size_t size;
+        void *end;
+        int error;
+
+        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+                return -ENODATA;
+        error = ext4_get_inode_loc(inode, &iloc);
+        if (error)
+                return error;
+        raw_inode = ext4_raw_inode(&iloc);
+        header = IHDR(inode, raw_inode);
+        entry = IFIRST(header);
+        end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+        error = ext4_xattr_check_names(entry, end);
+        if (error)
+                goto cleanup;
+        error = ext4_xattr_find_entry(&entry, name_index, name,
+                                      end - (void *)entry, 0);
+        if (error)
+                goto cleanup;
+        size = le32_to_cpu(entry->e_value_size);
+        if (buffer) {
+                error = -ERANGE;
+                if (size > buffer_size)
+                        goto cleanup;
+                memcpy(buffer, (void *)IFIRST(header) +
+                       le16_to_cpu(entry->e_value_offs), size);
+        }
+        error = size;
+
+cleanup:
+        brelse(iloc.bh);
+        return error;
+}
+
+/*
+ * ext4_xattr_get()
+ *
+ * Copy an extended attribute into the buffer
+ * provided, or compute the buffer size required.
+ * Buffer is NULL to compute the size of the buffer required.
+ *
+ * Returns a negative error number on failure, or the number of bytes
+ * used / required on success.
+ */
+int
+ext4_xattr_get(struct inode *inode, int name_index, const char *name,
+               void *buffer, size_t buffer_size)
+{
+        int error;
+
+        down_read(&EXT4_I(inode)->xattr_sem);
+        error = ext4_xattr_ibody_get(inode, name_index, name, buffer,
+                                     buffer_size);
+        if (error == -ENODATA)
+                error = ext4_xattr_block_get(inode, name_index, name, buffer,
+                                             buffer_size);
+        up_read(&EXT4_I(inode)->xattr_sem);
+        return error;
+}
+
+static int
+ext4_xattr_list_entries(struct inode *inode, struct ext4_xattr_entry *entry,
+                        char *buffer, size_t buffer_size)
+{
+        size_t rest = buffer_size;
+
+        for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) {
+                struct xattr_handler *handler =
+                        ext4_xattr_handler(entry->e_name_index);
+
+                if (handler) {
+                        size_t size = handler->list(inode, buffer, rest,
+                                                    entry->e_name,
+                                                    entry->e_name_len);
+                        if (buffer) {
+                                if (size > rest)
+                                        return -ERANGE;
+                                buffer += size;
+                        }
+                        rest -= size;
+                }
+        }
+        return buffer_size - rest;
+}
+
+static int
+ext4_xattr_block_list(struct inode *inode, char *buffer, size_t buffer_size)
+{
+        struct buffer_head *bh = NULL;
+        int error;
+
+        ea_idebug(inode, "buffer=%p, buffer_size=%ld",
+                  buffer, (long)buffer_size);
+
+        error = 0;
+        if (!EXT4_I(inode)->i_file_acl)
+                goto cleanup;
+        ea_idebug(inode, "reading block %u", EXT4_I(inode)->i_file_acl);
+        bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+        error = -EIO;
+        if (!bh)
+                goto cleanup;
+        ea_bdebug(bh, "b_count=%d, refcount=%d",
+                atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount));
+        if (ext4_xattr_check_block(bh)) {
+                ext4_error(inode->i_sb, __FUNCTION__,
+                           "inode %lu: bad block %llu", inode->i_ino,
+                           EXT4_I(inode)->i_file_acl);
+                error = -EIO;
+                goto cleanup;
+        }
+        ext4_xattr_cache_insert(bh);
+        error = ext4_xattr_list_entries(inode, BFIRST(bh), buffer, buffer_size);
+
+cleanup:
+        brelse(bh);
+
+        return error;
+}
+
+static int
+ext4_xattr_ibody_list(struct inode *inode, char *buffer, size_t buffer_size)
+{
+        struct ext4_xattr_ibody_header *header;
+        struct ext4_inode *raw_inode;
+        struct ext4_iloc iloc;
+        void *end;
+        int error;
+
+        if (!(EXT4_I(inode)->i_state & EXT4_STATE_XATTR))
+                return 0;
+        error = ext4_get_inode_loc(inode, &iloc);
+        if (error)
+                return error;
+        raw_inode = ext4_raw_inode(&iloc);
+        header = IHDR(inode, raw_inode);
+        end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+        error = ext4_xattr_check_names(IFIRST(header), end);
+        if (error)
+                goto cleanup;
+        error = ext4_xattr_list_entries(inode, IFIRST(header),
+                                        buffer, buffer_size);
+
+cleanup:
+        brelse(iloc.bh);
+        return error;
+}
+
+/*
+ * ext4_xattr_list()
+ *
+ * Copy a list of attribute names into the buffer
+ * provided, or compute the buffer size required.
+ * Buffer is NULL to compute the size of the buffer required.
+ *
+ * Returns a negative error number on failure, or the number of bytes
+ * used / required on success.
+ */
+int
+ext4_xattr_list(struct inode *inode, char *buffer, size_t buffer_size)
+{
+        int i_error, b_error;
+
+        down_read(&EXT4_I(inode)->xattr_sem);
+        i_error = ext4_xattr_ibody_list(inode, buffer, buffer_size);
+        if (i_error < 0) {
+                b_error = 0;
+        } else {
+                if (buffer) {
+                        buffer += i_error;
+                        buffer_size -= i_error;
+                }
+                b_error = ext4_xattr_block_list(inode, buffer, buffer_size);
+                if (b_error < 0)
+                        i_error = 0;
+        }
+        up_read(&EXT4_I(inode)->xattr_sem);
+        return i_error + b_error;
+}
+
+/*
+ * If the EXT4_FEATURE_COMPAT_EXT_ATTR feature of this file system is
+ * not set, set it.
+ */
+static void ext4_xattr_update_super_block(handle_t *handle,
+                                          struct super_block *sb)
+{
+        if (EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_EXT_ATTR))
+                return;
+
+        lock_super(sb);
+        if (ext4_journal_get_write_access(handle, EXT4_SB(sb)->s_sbh) == 0) {
+                EXT4_SB(sb)->s_es->s_feature_compat |=
+                        cpu_to_le32(EXT4_FEATURE_COMPAT_EXT_ATTR);
+                sb->s_dirt = 1;
+                ext4_journal_dirty_metadata(handle, EXT4_SB(sb)->s_sbh);
+        }
+        unlock_super(sb);
+}
+
+/*
+ * Release the xattr block BH: If the reference count is > 1, decrement
+ * it; otherwise free the block.
+ */
+static void
+ext4_xattr_release_block(handle_t *handle, struct inode *inode,
+                         struct buffer_head *bh)
+{
+        struct mb_cache_entry *ce = NULL;
+
+        ce = mb_cache_entry_get(ext4_xattr_cache, bh->b_bdev, bh->b_blocknr);
+        if (BHDR(bh)->h_refcount == cpu_to_le32(1)) {
+                ea_bdebug(bh, "refcount now=0; freeing");
+                if (ce)
+                        mb_cache_entry_free(ce);
+                ext4_free_blocks(handle, inode, bh->b_blocknr, 1);
+                get_bh(bh);
+                ext4_forget(handle, 1, inode, bh, bh->b_blocknr);
+        } else {
+                if (ext4_journal_get_write_access(handle, bh) == 0) {
+                        lock_buffer(bh);
+                        BHDR(bh)->h_refcount = cpu_to_le32(
+                                le32_to_cpu(BHDR(bh)->h_refcount) - 1);
+                        ext4_journal_dirty_metadata(handle, bh);
+                        if (IS_SYNC(inode))
+                                handle->h_sync = 1;
+                        DQUOT_FREE_BLOCK(inode, 1);
+                        unlock_buffer(bh);
+                        ea_bdebug(bh, "refcount now=%d; releasing",
+                                  le32_to_cpu(BHDR(bh)->h_refcount));
+                }
+                if (ce)
+                        mb_cache_entry_release(ce);
+        }
+}
+
+struct ext4_xattr_info {
+        int name_index;
+        const char *name;
+        const void *value;
+        size_t value_len;
+};
+
+struct ext4_xattr_search {
+        struct ext4_xattr_entry *first;
+        void *base;
+        void *end;
+        struct ext4_xattr_entry *here;
+        int not_found;
+};
+
+static int
+ext4_xattr_set_entry(struct ext4_xattr_info *i, struct ext4_xattr_search *s)
+{
+        struct ext4_xattr_entry *last;
+        size_t free, min_offs = s->end - s->base, name_len = strlen(i->name);
+
+        /* Compute min_offs and last. */
+        last = s->first;
+        for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
+                if (!last->e_value_block && last->e_value_size) {
+                        size_t offs = le16_to_cpu(last->e_value_offs);
+                        if (offs < min_offs)
+                                min_offs = offs;
+                }
+        }
+        free = min_offs - ((void *)last - s->base) - sizeof(__u32);
+        if (!s->not_found) {
+                if (!s->here->e_value_block && s->here->e_value_size) {
+                        size_t size = le32_to_cpu(s->here->e_value_size);
+                        free += EXT4_XATTR_SIZE(size);
+                }
+                free += EXT4_XATTR_LEN(name_len);
+        }
+        if (i->value) {
+                if (free < EXT4_XATTR_SIZE(i->value_len) ||
+                    free < EXT4_XATTR_LEN(name_len) +
+                           EXT4_XATTR_SIZE(i->value_len))
+                        return -ENOSPC;
+        }
+
+        if (i->value && s->not_found) {
+                /* Insert the new name. */
+                size_t size = EXT4_XATTR_LEN(name_len);
+                size_t rest = (void *)last - (void *)s->here + sizeof(__u32);
+                memmove((void *)s->here + size, s->here, rest);
+                memset(s->here, 0, size);
+                s->here->e_name_index = i->name_index;
+                s->here->e_name_len = name_len;
+                memcpy(s->here->e_name, i->name, name_len);
+        } else {
+                if (!s->here->e_value_block && s->here->e_value_size) {
+                        void *first_val = s->base + min_offs;
+                        size_t offs = le16_to_cpu(s->here->e_value_offs);
+                        void *val = s->base + offs;
+                        size_t size = EXT4_XATTR_SIZE(
+                                le32_to_cpu(s->here->e_value_size));
+
+                        if (i->value && size == EXT4_XATTR_SIZE(i->value_len)) {
+                                /* The old and the new value have the same
+                                   size. Just replace. */
+                                s->here->e_value_size =
+                                        cpu_to_le32(i->value_len);
+                                memset(val + size - EXT4_XATTR_PAD, 0,
+                                       EXT4_XATTR_PAD); /* Clear pad bytes. */
+                                memcpy(val, i->value, i->value_len);
+                                return 0;
+                        }
+
+                        /* Remove the old value. */
+                        memmove(first_val + size, first_val, val - first_val);
+                        memset(first_val, 0, size);
+                        s->here->e_value_size = 0;
+                        s->here->e_value_offs = 0;
+                        min_offs += size;
+
+                        /* Adjust all value offsets. */
+                        last = s->first;
+                        while (!IS_LAST_ENTRY(last)) {
+                                size_t o = le16_to_cpu(last->e_value_offs);
+                                if (!last->e_value_block &&
+                                    last->e_value_size && o < offs)
+                                        last->e_value_offs =
+                                                cpu_to_le16(o + size);
+                                last = EXT4_XATTR_NEXT(last);
+                        }
+                }
+                if (!i->value) {
+                        /* Remove the old name. */
+                        size_t size = EXT4_XATTR_LEN(name_len);
+                        last = ENTRY((void *)last - size);
+                        memmove(s->here, (void *)s->here + size,
+                                (void *)last - (void *)s->here + sizeof(__u32));
+                        memset(last, 0, size);
+                }
+        }
+
+        if (i->value) {
+                /* Insert the new value. */
+                s->here->e_value_size = cpu_to_le32(i->value_len);
+                if (i->value_len) {
+                        size_t size = EXT4_XATTR_SIZE(i->value_len);
+                        void *val = s->base + min_offs - size;
+                        s->here->e_value_offs = cpu_to_le16(min_offs - size);
+                        memset(val + size - EXT4_XATTR_PAD, 0,
+                               EXT4_XATTR_PAD); /* Clear the pad bytes. */
+                        memcpy(val, i->value, i->value_len);
+                }
+        }
+        return 0;
+}
+
+struct ext4_xattr_block_find {
+        struct ext4_xattr_search s;
+        struct buffer_head *bh;
+};
+
+static int
+ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i,
+                      struct ext4_xattr_block_find *bs)
+{
+        struct super_block *sb = inode->i_sb;
+        int error;
+
+        ea_idebug(inode, "name=%d.%s, value=%p, value_len=%ld",
+                  i->name_index, i->name, i->value, (long)i->value_len);
+
+        if (EXT4_I(inode)->i_file_acl) {
+                /* The inode already has an extended attribute block. */
+                bs->bh = sb_bread(sb, EXT4_I(inode)->i_file_acl);
+                error = -EIO;
+                if (!bs->bh)
+                        goto cleanup;
+                ea_bdebug(bs->bh, "b_count=%d, refcount=%d",
+                        atomic_read(&(bs->bh->b_count)),
+                        le32_to_cpu(BHDR(bs->bh)->h_refcount));
+                if (ext4_xattr_check_block(bs->bh)) {
+                        ext4_error(sb, __FUNCTION__,
+                                "inode %lu: bad block %llu", inode->i_ino,
+                                EXT4_I(inode)->i_file_acl);
+                        error = -EIO;
+                        goto cleanup;
+                }
+                /* Find the named attribute. */
+                bs->s.base = BHDR(bs->bh);
+                bs->s.first = BFIRST(bs->bh);
+                bs->s.end = bs->bh->b_data + bs->bh->b_size;
+                bs->s.here = bs->s.first;
+                error = ext4_xattr_find_entry(&bs->s.here, i->name_index,
+                                              i->name, bs->bh->b_size, 1);
+                if (error && error != -ENODATA)
+                        goto cleanup;
+                bs->s.not_found = error;
+        }
+        error = 0;
+
+cleanup:
+        return error;
+}
+
+static int
+ext4_xattr_block_set(handle_t *handle, struct inode *inode,
+                     struct ext4_xattr_info *i,
+                     struct ext4_xattr_block_find *bs)
+{
+        struct super_block *sb = inode->i_sb;
+        struct buffer_head *new_bh = NULL;
+        struct ext4_xattr_search *s = &bs->s;
+        struct mb_cache_entry *ce = NULL;
+        int error;
+
+#define header(x) ((struct ext4_xattr_header *)(x))
+
+        if (i->value && i->value_len > sb->s_blocksize)
+                return -ENOSPC;
+        if (s->base) {
+                ce = mb_cache_entry_get(ext4_xattr_cache, bs->bh->b_bdev,
+                                        bs->bh->b_blocknr);
+                if (header(s->base)->h_refcount == cpu_to_le32(1)) {
+                        if (ce) {
+                                mb_cache_entry_free(ce);
+                                ce = NULL;
+                        }
+                        ea_bdebug(bs->bh, "modifying in-place");
+                        error = ext4_journal_get_write_access(handle, bs->bh);
+                        if (error)
+                                goto cleanup;
+                        lock_buffer(bs->bh);
+                        error = ext4_xattr_set_entry(i, s);
+                        if (!error) {
+                                if (!IS_LAST_ENTRY(s->first))
+                                        ext4_xattr_rehash(header(s->base),
+                                                          s->here);
+                                ext4_xattr_cache_insert(bs->bh);
+                        }
+                        unlock_buffer(bs->bh);
+                        if (error == -EIO)
+                                goto bad_block;
+                        if (!error)
+                                error = ext4_journal_dirty_metadata(handle,
+                                                                    bs->bh);
+                        if (error)
+                                goto cleanup;
+                        goto inserted;
+                } else {
+                        int offset = (char *)s->here - bs->bh->b_data;
+
+                        if (ce) {
+                                mb_cache_entry_release(ce);
+                                ce = NULL;
+                        }
+                        ea_bdebug(bs->bh, "cloning");
+                        s->base = kmalloc(bs->bh->b_size, GFP_KERNEL);
+                        error = -ENOMEM;
+                        if (s->base == NULL)
+                                goto cleanup;
+                        memcpy(s->base, BHDR(bs->bh), bs->bh->b_size);
+                        s->first = ENTRY(header(s->base)+1);
+                        header(s->base)->h_refcount = cpu_to_le32(1);
+                        s->here = ENTRY(s->base + offset);
+                        s->end = s->base + bs->bh->b_size;
+                }
+        } else {
+                /* Allocate a buffer where we construct the new block. */
+                s->base = kmalloc(sb->s_blocksize, GFP_KERNEL);
+                /* assert(header == s->base) */
+                error = -ENOMEM;
+                if (s->base == NULL)
+                        goto cleanup;
+                memset(s->base, 0, sb->s_blocksize);
+                header(s->base)->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
+                header(s->base)->h_blocks = cpu_to_le32(1);
+                header(s->base)->h_refcount = cpu_to_le32(1);
+                s->first = ENTRY(header(s->base)+1);
+                s->here = ENTRY(header(s->base)+1);
+                s->end = s->base + sb->s_blocksize;
+        }
+
+        error = ext4_xattr_set_entry(i, s);
+        if (error == -EIO)
+                goto bad_block;
+        if (error)
+                goto cleanup;
+        if (!IS_LAST_ENTRY(s->first))
+                ext4_xattr_rehash(header(s->base), s->here);
+
+inserted:
+        if (!IS_LAST_ENTRY(s->first)) {
+                new_bh = ext4_xattr_cache_find(inode, header(s->base), &ce);
+                if (new_bh) {
+                        /* We found an identical block in the cache. */
+                        if (new_bh == bs->bh)
+                                ea_bdebug(new_bh, "keeping");
+                        else {
+                                /* The old block is released after updating
+                                   the inode. */
+                                error = -EDQUOT;
+                                if (DQUOT_ALLOC_BLOCK(inode, 1))
+                                        goto cleanup;
+                                error = ext4_journal_get_write_access(handle,
+                                                                      new_bh);
+                                if (error)
+                                        goto cleanup_dquot;
+                                lock_buffer(new_bh);
+                                BHDR(new_bh)->h_refcount = cpu_to_le32(1 +
+                                        le32_to_cpu(BHDR(new_bh)->h_refcount));
+                                ea_bdebug(new_bh, "reusing; refcount now=%d",
+                                        le32_to_cpu(BHDR(new_bh)->h_refcount));
+                                unlock_buffer(new_bh);
+                                error = ext4_journal_dirty_metadata(handle,
+                                                                    new_bh);
+                                if (error)
+                                        goto cleanup_dquot;
+                        }
+                        mb_cache_entry_release(ce);
+                        ce = NULL;
+                } else if (bs->bh && s->base == bs->bh->b_data) {
+                        /* We were modifying this block in-place. */
+                        ea_bdebug(bs->bh, "keeping this block");
+                        new_bh = bs->bh;
+                        get_bh(new_bh);
+                } else {
+                        /* We need to allocate a new block */
+                        ext4_fsblk_t goal = le32_to_cpu(
+                                        EXT4_SB(sb)->s_es->s_first_data_block) +
+                                (ext4_fsblk_t)EXT4_I(inode)->i_block_group *
+                                EXT4_BLOCKS_PER_GROUP(sb);
+                        ext4_fsblk_t block = ext4_new_block(handle, inode,
+                                                        goal, &error);
+                        if (error)
+                                goto cleanup;
+                        ea_idebug(inode, "creating block %d", block);
+
+                        new_bh = sb_getblk(sb, block);
+                        if (!new_bh) {
+getblk_failed:
+                                ext4_free_blocks(handle, inode, block, 1);
+                                error = -EIO;
+                                goto cleanup;
+                        }
+                        lock_buffer(new_bh);
+                        error = ext4_journal_get_create_access(handle, new_bh);
+                        if (error) {
+                                unlock_buffer(new_bh);
+                                goto getblk_failed;
+                        }
+                        memcpy(new_bh->b_data, s->base, new_bh->b_size);
+                        set_buffer_uptodate(new_bh);
+                        unlock_buffer(new_bh);
+                        ext4_xattr_cache_insert(new_bh);
+                        error = ext4_journal_dirty_metadata(handle, new_bh);
+                        if (error)
+                                goto cleanup;
+                }
+        }
+
+        /* Update the inode. */
+        EXT4_I(inode)->i_file_acl = new_bh ? new_bh->b_blocknr : 0;
+
+        /* Drop the previous xattr block. */
+        if (bs->bh && bs->bh != new_bh)
+                ext4_xattr_release_block(handle, inode, bs->bh);
+        error = 0;
+
+cleanup:
+        if (ce)
+                mb_cache_entry_release(ce);
+        brelse(new_bh);
+        if (!(bs->bh && s->base == bs->bh->b_data))
+                kfree(s->base);
+
+        return error;
+
+cleanup_dquot:
+        DQUOT_FREE_BLOCK(inode, 1);
+        goto cleanup;
+
+bad_block:
+        ext4_error(inode->i_sb, __FUNCTION__,
+                   "inode %lu: bad block %llu", inode->i_ino,
+                   EXT4_I(inode)->i_file_acl);
+        goto cleanup;
+
+#undef header
+}
+
+struct ext4_xattr_ibody_find {
+        struct ext4_xattr_search s;
+        struct ext4_iloc iloc;
+};
+
+static int
+ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+                      struct ext4_xattr_ibody_find *is)
+{
+        struct ext4_xattr_ibody_header *header;
+        struct ext4_inode *raw_inode;
+        int error;
+
+        if (EXT4_I(inode)->i_extra_isize == 0)
+                return 0;
+        raw_inode = ext4_raw_inode(&is->iloc);
+        header = IHDR(inode, raw_inode);
+        is->s.base = is->s.first = IFIRST(header);
+        is->s.here = is->s.first;
+        is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+        if (EXT4_I(inode)->i_state & EXT4_STATE_XATTR) {
+                error = ext4_xattr_check_names(IFIRST(header), is->s.end);
+                if (error)
+                        return error;
+                /* Find the named attribute. */
+                error = ext4_xattr_find_entry(&is->s.here, i->name_index,
+                                              i->name, is->s.end -
+                                              (void *)is->s.base, 0);
+                if (error && error != -ENODATA)
+                        return error;
+                is->s.not_found = error;
+        }
+        return 0;
+}
+
+static int
+ext4_xattr_ibody_set(handle_t *handle, struct inode *inode,
+                     struct ext4_xattr_info *i,
+                     struct ext4_xattr_ibody_find *is)
+{
+        struct ext4_xattr_ibody_header *header;
+        struct ext4_xattr_search *s = &is->s;
+        int error;
+
+        if (EXT4_I(inode)->i_extra_isize == 0)
+                return -ENOSPC;
+        error = ext4_xattr_set_entry(i, s);
+        if (error)
+                return error;
+        header = IHDR(inode, ext4_raw_inode(&is->iloc));
+        if (!IS_LAST_ENTRY(s->first)) {
+                header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC);
+                EXT4_I(inode)->i_state |= EXT4_STATE_XATTR;
+        } else {
+                header->h_magic = cpu_to_le32(0);
+                EXT4_I(inode)->i_state &= ~EXT4_STATE_XATTR;
+        }
+        return 0;
+}
+
+/*
+ * ext4_xattr_set_handle()
+ *
+ * Create, replace or remove an extended attribute for this inode. Buffer
+ * is NULL to remove an existing extended attribute, and non-NULL to
+ * either replace an existing extended attribute, or create a new extended
+ * attribute. The flags XATTR_REPLACE and XATTR_CREATE
+ * specify that an extended attribute must exist and must not exist
+ * previous to the call, respectively.
+ *
+ * Returns 0, or a negative error number on failure.
+ */
+int
+ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+                      const char *name, const void *value, size_t value_len,
+                      int flags)
+{
+        struct ext4_xattr_info i = {
+                .name_index = name_index,
+                .name = name,
+                .value = value,
+                .value_len = value_len,
+
+        };
+        struct ext4_xattr_ibody_find is = {
+                .s = { .not_found = -ENODATA, },
+        };
+        struct ext4_xattr_block_find bs = {
+                .s = { .not_found = -ENODATA, },
+        };
+        int error;
+
+        if (!name)
+                return -EINVAL;
+        if (strlen(name) > 255)
+                return -ERANGE;
+        down_write(&EXT4_I(inode)->xattr_sem);
+        error = ext4_get_inode_loc(inode, &is.iloc);
+        if (error)
+                goto cleanup;
+
+        if (EXT4_I(inode)->i_state & EXT4_STATE_NEW) {
+                struct ext4_inode *raw_inode = ext4_raw_inode(&is.iloc);
+                memset(raw_inode, 0, EXT4_SB(inode->i_sb)->s_inode_size);
+                EXT4_I(inode)->i_state &= ~EXT4_STATE_NEW;
+        }
+
+        error = ext4_xattr_ibody_find(inode, &i, &is);
+        if (error)
+                goto cleanup;
+        if (is.s.not_found)
+                error = ext4_xattr_block_find(inode, &i, &bs);
+        if (error)
+                goto cleanup;
+        if (is.s.not_found && bs.s.not_found) {
+                error = -ENODATA;
+                if (flags & XATTR_REPLACE)
+                        goto cleanup;
+                error = 0;
+                if (!value)
+                        goto cleanup;
+        } else {
+                error = -EEXIST;
+                if (flags & XATTR_CREATE)
+                        goto cleanup;
+        }
+        error = ext4_journal_get_write_access(handle, is.iloc.bh);
+        if (error)
+                goto cleanup;
+        if (!value) {
+                if (!is.s.not_found)
+                        error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+                else if (!bs.s.not_found)
+                        error = ext4_xattr_block_set(handle, inode, &i, &bs);
+        } else {
+                error = ext4_xattr_ibody_set(handle, inode, &i, &is);
+                if (!error && !bs.s.not_found) {
+                        i.value = NULL;
+                        error = ext4_xattr_block_set(handle, inode, &i, &bs);
+                } else if (error == -ENOSPC) {
+                        error = ext4_xattr_block_set(handle, inode, &i, &bs);
+                        if (error)
+                                goto cleanup;
+                        if (!is.s.not_found) {
+                                i.value = NULL;
+                                error = ext4_xattr_ibody_set(handle, inode, &i,
+                                                             &is);
+                        }
+                }
+        }
+        if (!error) {
+                ext4_xattr_update_super_block(handle, inode->i_sb);
+                inode->i_ctime = CURRENT_TIME_SEC;
+                error = ext4_mark_iloc_dirty(handle, inode, &is.iloc);
+                /*
+                 * The bh is consumed by ext4_mark_iloc_dirty, even with
+                 * error != 0.
+                 */
+                is.iloc.bh = NULL;
+                if (IS_SYNC(inode))
+                        handle->h_sync = 1;
+        }
+
+cleanup:
+        brelse(is.iloc.bh);
+        brelse(bs.bh);
+        up_write(&EXT4_I(inode)->xattr_sem);
+        return error;
+}
+
+/*
+ * ext4_xattr_set()
+ *
+ * Like ext4_xattr_set_handle, but start from an inode. This extended
+ * attribute modification is a filesystem transaction by itself.
+ *
+ * Returns 0, or a negative error number on failure.
+ */
+int
+ext4_xattr_set(struct inode *inode, int name_index, const char *name,
+               const void *value, size_t value_len, int flags)
+{
+        handle_t *handle;
+        int error, retries = 0;
+
+retry:
+        handle = ext4_journal_start(inode, EXT4_DATA_TRANS_BLOCKS(inode->i_sb));
+        if (IS_ERR(handle)) {
+                error = PTR_ERR(handle);
+        } else {
+                int error2;
+
+                error = ext4_xattr_set_handle(handle, inode, name_index, name,
+                                              value, value_len, flags);
+                error2 = ext4_journal_stop(handle);
+                if (error == -ENOSPC &&
+                    ext4_should_retry_alloc(inode->i_sb, &retries))
+                        goto retry;
+                if (error == 0)
+                        error = error2;
+        }
+
+        return error;
+}
+
+/*
+ * ext4_xattr_delete_inode()
+ *
+ * Free extended attribute resources associated with this inode. This
+ * is called immediately before an inode is freed. We have exclusive
+ * access to the inode.
+ */
+void
+ext4_xattr_delete_inode(handle_t *handle, struct inode *inode)
+{
+        struct buffer_head *bh = NULL;
+
+        if (!EXT4_I(inode)->i_file_acl)
+                goto cleanup;
+        bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl);
+        if (!bh) {
+                ext4_error(inode->i_sb, __FUNCTION__,
+                        "inode %lu: block %llu read error", inode->i_ino,
+                        EXT4_I(inode)->i_file_acl);
+                goto cleanup;
+        }
+        if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
+            BHDR(bh)->h_blocks != cpu_to_le32(1)) {
+                ext4_error(inode->i_sb, __FUNCTION__,
+                        "inode %lu: bad block %llu", inode->i_ino,
+                        EXT4_I(inode)->i_file_acl);
+                goto cleanup;
+        }
+        ext4_xattr_release_block(handle, inode, bh);
+        EXT4_I(inode)->i_file_acl = 0;
+
+cleanup:
+        brelse(bh);
+}
+
+/*
+ * ext4_xattr_put_super()
+ *
+ * This is called when a file system is unmounted.
+ */
+void
+ext4_xattr_put_super(struct super_block *sb)
+{
+        mb_cache_shrink(sb->s_bdev);
+}
+
+/*
+ * ext4_xattr_cache_insert()
+ *
+ * Create a new entry in the extended attribute cache, and insert
+ * it unless such an entry is already in the cache.
+ *
+ * Returns 0, or a negative error number on failure.
+ */
+static void
+ext4_xattr_cache_insert(struct buffer_head *bh)
+{
+        __u32 hash = le32_to_cpu(BHDR(bh)->h_hash);
+        struct mb_cache_entry *ce;
+        int error;
+
+        ce = mb_cache_entry_alloc(ext4_xattr_cache);
+        if (!ce) {
+                ea_bdebug(bh, "out of memory");
+                return;
+        }
+        error = mb_cache_entry_insert(ce, bh->b_bdev, bh->b_blocknr, &hash);
+        if (error) {
+                mb_cache_entry_free(ce);
+                if (error == -EBUSY) {
+                        ea_bdebug(bh, "already in cache");
+                        error = 0;
+                }
+        } else {
+                ea_bdebug(bh, "inserting [%x]", (int)hash);
+                mb_cache_entry_release(ce);
+        }
+}
+
+/*
+ * ext4_xattr_cmp()
+ *
+ * Compare two extended attribute blocks for equality.
+ *
+ * Returns 0 if the blocks are equal, 1 if they differ, and
+ * a negative error number on errors.
+ */
+static int
+ext4_xattr_cmp(struct ext4_xattr_header *header1,
+               struct ext4_xattr_header *header2)
+{
+        struct ext4_xattr_entry *entry1, *entry2;
+
+        entry1 = ENTRY(header1+1);
+        entry2 = ENTRY(header2+1);
+        while (!IS_LAST_ENTRY(entry1)) {
+                if (IS_LAST_ENTRY(entry2))
+                        return 1;
+                if (entry1->e_hash != entry2->e_hash ||
+                    entry1->e_name_index != entry2->e_name_index ||
+                    entry1->e_name_len != entry2->e_name_len ||
+                    entry1->e_value_size != entry2->e_value_size ||
+                    memcmp(entry1->e_name, entry2->e_name, entry1->e_name_len))
+                        return 1;
+                if (entry1->e_value_block != 0 || entry2->e_value_block != 0)
+                        return -EIO;
+                if (memcmp((char *)header1 + le16_to_cpu(entry1->e_value_offs),
+                           (char *)header2 + le16_to_cpu(entry2->e_value_offs),
+                           le32_to_cpu(entry1->e_value_size)))
+                        return 1;
+
+                entry1 = EXT4_XATTR_NEXT(entry1);
+                entry2 = EXT4_XATTR_NEXT(entry2);
+        }
+        if (!IS_LAST_ENTRY(entry2))
+                return 1;
+        return 0;
+}
+
+/*
+ * ext4_xattr_cache_find()
+ *
+ * Find an identical extended attribute block.
+ *
+ * Returns a pointer to the block found, or NULL if such a block was
+ * not found or an error occurred.
+ */
+static struct buffer_head *
+ext4_xattr_cache_find(struct inode *inode, struct ext4_xattr_header *header,
+                      struct mb_cache_entry **pce)
+{
+        __u32 hash = le32_to_cpu(header->h_hash);
+        struct mb_cache_entry *ce;
+
+        if (!header->h_hash)
+                return NULL;  /* never share */
+        ea_idebug(inode, "looking for cached blocks [%x]", (int)hash);
+again:
+        ce = mb_cache_entry_find_first(ext4_xattr_cache, 0,
+                                       inode->i_sb->s_bdev, hash);
+        while (ce) {
+                struct buffer_head *bh;
+
+                if (IS_ERR(ce)) {
+                        if (PTR_ERR(ce) == -EAGAIN)
+                                goto again;
+                        break;
+                }
+                bh = sb_bread(inode->i_sb, ce->e_block);
+                if (!bh) {
+                        ext4_error(inode->i_sb, __FUNCTION__,
+                                "inode %lu: block %lu read error",
+                                inode->i_ino, (unsigned long) ce->e_block);
+                } else if (le32_to_cpu(BHDR(bh)->h_refcount) >=
+                                EXT4_XATTR_REFCOUNT_MAX) {
+                        ea_idebug(inode, "block %lu refcount %d>=%d",
+                                  (unsigned long) ce->e_block,
+                                  le32_to_cpu(BHDR(bh)->h_refcount),
+                                          EXT4_XATTR_REFCOUNT_MAX);
+                } else if (ext4_xattr_cmp(header, BHDR(bh)) == 0) {
+                        *pce = ce;
+                        return bh;
+                }
+                brelse(bh);
+                ce = mb_cache_entry_find_next(ce, 0, inode->i_sb->s_bdev, hash);
+        }
+        return NULL;
+}
+
+#define NAME_HASH_SHIFT 5
+#define VALUE_HASH_SHIFT 16
+
+/*
+ * ext4_xattr_hash_entry()
+ *
+ * Compute the hash of an extended attribute.
+ */
+static inline void ext4_xattr_hash_entry(struct ext4_xattr_header *header,
+                                         struct ext4_xattr_entry *entry)
+{
+        __u32 hash = 0;
+        char *name = entry->e_name;
+        int n;
+
+        for (n=0; n < entry->e_name_len; n++) {
+                hash = (hash << NAME_HASH_SHIFT) ^
+                       (hash >> (8*sizeof(hash) - NAME_HASH_SHIFT)) ^
+                       *name++;
+        }
+
+        if (entry->e_value_block == 0 && entry->e_value_size != 0) {
+                __le32 *value = (__le32 *)((char *)header +
+                        le16_to_cpu(entry->e_value_offs));
+                for (n = (le32_to_cpu(entry->e_value_size) +
+                     EXT4_XATTR_ROUND) >> EXT4_XATTR_PAD_BITS; n; n--) {
+                        hash = (hash << VALUE_HASH_SHIFT) ^
+                               (hash >> (8*sizeof(hash) - VALUE_HASH_SHIFT)) ^
+                               le32_to_cpu(*value++);
+                }
+        }
+        entry->e_hash = cpu_to_le32(hash);
+}
+
+#undef NAME_HASH_SHIFT
+#undef VALUE_HASH_SHIFT
+
+#define BLOCK_HASH_SHIFT 16
+
+/*
+ * ext4_xattr_rehash()
+ *
+ * Re-compute the extended attribute hash value after an entry has changed.
+ */
+static void ext4_xattr_rehash(struct ext4_xattr_header *header,
+                              struct ext4_xattr_entry *entry)
+{
+        struct ext4_xattr_entry *here;
+        __u32 hash = 0;
+
+        ext4_xattr_hash_entry(header, entry);
+        here = ENTRY(header+1);
+        while (!IS_LAST_ENTRY(here)) {
+                if (!here->e_hash) {
+                        /* Block is not shared if an entry's hash value == 0 */
+                        hash = 0;
+                        break;
+                }
+                hash = (hash << BLOCK_HASH_SHIFT) ^
+                       (hash >> (8*sizeof(hash) - BLOCK_HASH_SHIFT)) ^
+                       le32_to_cpu(here->e_hash);
+                here = EXT4_XATTR_NEXT(here);
+        }
+        header->h_hash = cpu_to_le32(hash);
+}
+
+#undef BLOCK_HASH_SHIFT
+
+int __init
+init_ext4_xattr(void)
+{
+        ext4_xattr_cache = mb_cache_create("ext4_xattr", NULL,
+                sizeof(struct mb_cache_entry) +
+                sizeof(((struct mb_cache_entry *) 0)->e_indexes[0]), 1, 6);
+        if (!ext4_xattr_cache)
+                return -ENOMEM;
+        return 0;
+}
+
+void
+exit_ext4_xattr(void)
+{
+        if (ext4_xattr_cache)
+                mb_cache_destroy(ext4_xattr_cache);
+        ext4_xattr_cache = NULL;
+}
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
new file mode 100644
index 000000000000..79432b35398f
--- /dev/null
+++ b/fs/ext4/xattr.h
@@ -0,0 +1,145 @@
+/*
+  File: fs/ext4/xattr.h
+
+  On-disk format of extended attributes for the ext4 filesystem.
+
+  (C) 2001 Andreas Gruenbacher, <a.gruenbacher@computer.org>
+*/
+
+#include <linux/xattr.h>
+
+/* Magic value in attribute blocks */
+#define EXT4_XATTR_MAGIC                0xEA020000
+
+/* Maximum number of references to one attribute block */
+#define EXT4_XATTR_REFCOUNT_MAX         1024
+
+/* Name indexes */
+#define EXT4_XATTR_INDEX_USER                   1
+#define EXT4_XATTR_INDEX_POSIX_ACL_ACCESS       2
+#define EXT4_XATTR_INDEX_POSIX_ACL_DEFAULT      3
+#define EXT4_XATTR_INDEX_TRUSTED                4
+#define EXT4_XATTR_INDEX_LUSTRE                 5
+#define EXT4_XATTR_INDEX_SECURITY               6
+
+struct ext4_xattr_header {
+        __le32  h_magic;        /* magic number for identification */
+        __le32  h_refcount;     /* reference count */
+        __le32  h_blocks;       /* number of disk blocks used */
+        __le32  h_hash;         /* hash value of all attributes */
+        __u32   h_reserved[4];  /* zero right now */
+};
+
+struct ext4_xattr_ibody_header {
+        __le32  h_magic;        /* magic number for identification */
+};
+
+struct ext4_xattr_entry {
+        __u8    e_name_len;     /* length of name */
+        __u8    e_name_index;   /* attribute name index */
+        __le16  e_value_offs;   /* offset in disk block of value */
+        __le32  e_value_block;  /* disk block attribute is stored on (n/i) */
+        __le32  e_value_size;   /* size of attribute value */
+        __le32  e_hash;         /* hash value of name and value */
+        char    e_name[0];      /* attribute name */
+};
+
+#define EXT4_XATTR_PAD_BITS             2
+#define EXT4_XATTR_PAD          (1<<EXT4_XATTR_PAD_BITS)
+#define EXT4_XATTR_ROUND                (EXT4_XATTR_PAD-1)
+#define EXT4_XATTR_LEN(name_len) \
+        (((name_len) + EXT4_XATTR_ROUND + \
+        sizeof(struct ext4_xattr_entry)) & ~EXT4_XATTR_ROUND)
+#define EXT4_XATTR_NEXT(entry) \
+        ( (struct ext4_xattr_entry *)( \
+          (char *)(entry) + EXT4_XATTR_LEN((entry)->e_name_len)) )
+#define EXT4_XATTR_SIZE(size) \
+        (((size) + EXT4_XATTR_ROUND) & ~EXT4_XATTR_ROUND)
+
+# ifdef CONFIG_EXT4DEV_FS_XATTR
+
+extern struct xattr_handler ext4_xattr_user_handler;
+extern struct xattr_handler ext4_xattr_trusted_handler;
+extern struct xattr_handler ext4_xattr_acl_access_handler;
+extern struct xattr_handler ext4_xattr_acl_default_handler;
+extern struct xattr_handler ext4_xattr_security_handler;
+
+extern ssize_t ext4_listxattr(struct dentry *, char *, size_t);
+
+extern int ext4_xattr_get(struct inode *, int, const char *, void *, size_t);
+extern int ext4_xattr_list(struct inode *, char *, size_t);
+extern int ext4_xattr_set(struct inode *, int, const char *, const void *, size_t, int);
+extern int ext4_xattr_set_handle(handle_t *, struct inode *, int, const char *, const void *, size_t, int);
+
+extern void ext4_xattr_delete_inode(handle_t *, struct inode *);
+extern void ext4_xattr_put_super(struct super_block *);
+
+extern int init_ext4_xattr(void);
+extern void exit_ext4_xattr(void);
+
+extern struct xattr_handler *ext4_xattr_handlers[];
+
+# else  /* CONFIG_EXT4DEV_FS_XATTR */
+
+static inline int
+ext4_xattr_get(struct inode *inode, int name_index, const char *name,
+               void *buffer, size_t size, int flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int
+ext4_xattr_list(struct inode *inode, void *buffer, size_t size)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int
+ext4_xattr_set(struct inode *inode, int name_index, const char *name,
+               const void *value, size_t size, int flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int
+ext4_xattr_set_handle(handle_t *handle, struct inode *inode, int name_index,
+               const char *name, const void *value, size_t size, int flags)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline void
+ext4_xattr_delete_inode(handle_t *handle, struct inode *inode)
+{
+}
+
+static inline void
+ext4_xattr_put_super(struct super_block *sb)
+{
+}
+
+static inline int
+init_ext4_xattr(void)
+{
+        return 0;
+}
+
+static inline void
+exit_ext4_xattr(void)
+{
+}
+
+#define ext4_xattr_handlers     NULL
+
+# endif  /* CONFIG_EXT4DEV_FS_XATTR */
+
+#ifdef CONFIG_EXT4DEV_FS_SECURITY
+extern int ext4_init_security(handle_t *handle, struct inode *inode,
+                                struct inode *dir);
+#else
+static inline int ext4_init_security(handle_t *handle, struct inode *inode,
+                                struct inode *dir)
+{
+        return 0;
+}
+#endif
diff --git a/fs/ext4/xattr_security.c b/fs/ext4/xattr_security.c
new file mode 100644
index 000000000000..b6a6861951f9
--- /dev/null
+++ b/fs/ext4/xattr_security.c
@@ -0,0 +1,77 @@
+/*
+ * linux/fs/ext4/xattr_security.c
+ * Handler for storing security labels as extended attributes.
+ */
+
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <linux/smp_lock.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/ext4_fs.h>
+#include <linux/security.h>
+#include "xattr.h"
+
+static size_t
+ext4_xattr_security_list(struct inode *inode, char *list, size_t list_size,
+                         const char *name, size_t name_len)
+{
+        const size_t prefix_len = sizeof(XATTR_SECURITY_PREFIX)-1;
+        const size_t total_len = prefix_len + name_len + 1;
+
+
+        if (list && total_len <= list_size) {
+                memcpy(list, XATTR_SECURITY_PREFIX, prefix_len);
+                memcpy(list+prefix_len, name, name_len);
+                list[prefix_len + name_len] = '\0';
+        }
+        return total_len;
+}
+
+static int
+ext4_xattr_security_get(struct inode *inode, const char *name,
+                       void *buffer, size_t size)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        return ext4_xattr_get(inode, EXT4_XATTR_INDEX_SECURITY, name,
+                              buffer, size);
+}
+
+static int
+ext4_xattr_security_set(struct inode *inode, const char *name,
+                       const void *value, size_t size, int flags)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        return ext4_xattr_set(inode, EXT4_XATTR_INDEX_SECURITY, name,
+                              value, size, flags);
+}
+
+int
+ext4_init_security(handle_t *handle, struct inode *inode, struct inode *dir)
+{
+        int err;
+        size_t len;
+        void *value;
+        char *name;
+
+        err = security_inode_init_security(inode, dir, &name, &value, &len);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        return 0;
+                return err;
+        }
+        err = ext4_xattr_set_handle(handle, inode, EXT4_XATTR_INDEX_SECURITY,
+                                    name, value, len, 0);
+        kfree(name);
+        kfree(value);
+        return err;
+}
+
+struct xattr_handler ext4_xattr_security_handler = {
+        .prefix = XATTR_SECURITY_PREFIX,
+        .list   = ext4_xattr_security_list,
+        .get    = ext4_xattr_security_get,
+        .set    = ext4_xattr_security_set,
+};
diff --git a/fs/ext4/xattr_trusted.c b/fs/ext4/xattr_trusted.c
new file mode 100644
index 000000000000..b76f2dbc82da
--- /dev/null
+++ b/fs/ext4/xattr_trusted.c
@@ -0,0 +1,62 @@
+/*
+ * linux/fs/ext4/xattr_trusted.c
+ * Handler for trusted extended attributes.
+ *
+ * Copyright (C) 2003 by Andreas Gruenbacher, <a.gruenbacher@computer.org>
+ */
+
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/capability.h>
+#include <linux/fs.h>
+#include <linux/smp_lock.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/ext4_fs.h>
+#include "xattr.h"
+
+#define XATTR_TRUSTED_PREFIX "trusted."
+
+static size_t
+ext4_xattr_trusted_list(struct inode *inode, char *list, size_t list_size,
+                        const char *name, size_t name_len)
+{
+        const size_t prefix_len = sizeof(XATTR_TRUSTED_PREFIX)-1;
+        const size_t total_len = prefix_len + name_len + 1;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return 0;
+
+        if (list && total_len <= list_size) {
+                memcpy(list, XATTR_TRUSTED_PREFIX, prefix_len);
+                memcpy(list+prefix_len, name, name_len);
+                list[prefix_len + name_len] = '\0';
+        }
+        return total_len;
+}
+
+static int
+ext4_xattr_trusted_get(struct inode *inode, const char *name,
+                       void *buffer, size_t size)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        return ext4_xattr_get(inode, EXT4_XATTR_INDEX_TRUSTED, name,
+                              buffer, size);
+}
+
+static int
+ext4_xattr_trusted_set(struct inode *inode, const char *name,
+                       const void *value, size_t size, int flags)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        return ext4_xattr_set(inode, EXT4_XATTR_INDEX_TRUSTED, name,
+                              value, size, flags);
+}
+
+struct xattr_handler ext4_xattr_trusted_handler = {
+        .prefix = XATTR_TRUSTED_PREFIX,
+        .list   = ext4_xattr_trusted_list,
+        .get    = ext4_xattr_trusted_get,
+        .set    = ext4_xattr_trusted_set,
+};
diff --git a/fs/ext4/xattr_user.c b/fs/ext4/xattr_user.c
new file mode 100644
index 000000000000..c53cded0761a
--- /dev/null
+++ b/fs/ext4/xattr_user.c
@@ -0,0 +1,64 @@
+/*
+ * linux/fs/ext4/xattr_user.c
+ * Handler for extended user attributes.
+ *
+ * Copyright (C) 2001 by Andreas Gruenbacher, <a.gruenbacher@computer.org>
+ */
+
+#include <linux/module.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <linux/smp_lock.h>
+#include <linux/ext4_jbd2.h>
+#include <linux/ext4_fs.h>
+#include "xattr.h"
+
+#define XATTR_USER_PREFIX "user."
+
+static size_t
+ext4_xattr_user_list(struct inode *inode, char *list, size_t list_size,
+                     const char *name, size_t name_len)
+{
+        const size_t prefix_len = sizeof(XATTR_USER_PREFIX)-1;
+        const size_t total_len = prefix_len + name_len + 1;
+
+        if (!test_opt(inode->i_sb, XATTR_USER))
+                return 0;
+
+        if (list && total_len <= list_size) {
+                memcpy(list, XATTR_USER_PREFIX, prefix_len);
+                memcpy(list+prefix_len, name, name_len);
+                list[prefix_len + name_len] = '\0';
+        }
+        return total_len;
+}
+
+static int
+ext4_xattr_user_get(struct inode *inode, const char *name,
+                    void *buffer, size_t size)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        if (!test_opt(inode->i_sb, XATTR_USER))
+                return -EOPNOTSUPP;
+        return ext4_xattr_get(inode, EXT4_XATTR_INDEX_USER, name, buffer, size);
+}
+
+static int
+ext4_xattr_user_set(struct inode *inode, const char *name,
+                    const void *value, size_t size, int flags)
+{
+        if (strcmp(name, "") == 0)
+                return -EINVAL;
+        if (!test_opt(inode->i_sb, XATTR_USER))
+                return -EOPNOTSUPP;
+        return ext4_xattr_set(inode, EXT4_XATTR_INDEX_USER, name,
+                              value, size, flags);
+}
+
+struct xattr_handler ext4_xattr_user_handler = {
+        .prefix = XATTR_USER_PREFIX,
+        .list   = ext4_xattr_user_list,
+        .get    = ext4_xattr_user_get,
+        .set    = ext4_xattr_user_set,
+};
diff --git a/fs/fat/file.c b/fs/fat/file.c
index f4b8f8b3fbdd..0aa813d944a6 100644
--- a/fs/fat/file.c
+++ b/fs/fat/file.c
@@ -13,6 +13,7 @@
 #include <linux/smp_lock.h>
 #include <linux/buffer_head.h>
 #include <linux/writeback.h>
+#include <linux/backing-dev.h>
 #include <linux/blkdev.h>
 
 int fat_generic_ioctl(struct inode *inode, struct file *filp,
@@ -118,7 +119,7 @@ static int fat_file_release(struct inode *inode, struct file *filp)
         if ((filp->f_mode & FMODE_WRITE) &&
              MSDOS_SB(inode->i_sb)->options.flush) {
                 fat_flush_inodes(inode->i_sb, inode, NULL);
-                blk_congestion_wait(WRITE, HZ/10);
+                congestion_wait(WRITE, HZ/10);
         }
         return 0;
 }
@@ -302,7 +303,17 @@ void fat_truncate(struct inode *inode)
         fat_flush_inodes(inode->i_sb, inode, NULL);
 }
 
+int fat_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        generic_fillattr(inode, stat);
+        stat->blksize = MSDOS_SB(inode->i_sb)->cluster_size;
+        return 0;
+}
+EXPORT_SYMBOL_GPL(fat_getattr);
+
 struct inode_operations fat_file_inode_operations = {
         .truncate       = fat_truncate,
         .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 4613cb202170..78945b53b0f8 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1472,7 +1472,7 @@ int fat_flush_inodes(struct super_block *sb, struct inode *i1, struct inode *i2)
                 ret = writeback_inode(i1);
         if (!ret && i2)
                 ret = writeback_inode(i2);
-        if (!ret && sb) {
+        if (!ret) {
                 struct address_space *mapping = sb->s_bdev->bd_inode->i_mapping;
                 ret = filemap_flush(mapping);
         }
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 8605155db171..cfc8f81e60d0 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -138,6 +138,7 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 struct fuse_entry_out outarg;
                 struct fuse_conn *fc;
                 struct fuse_req *req;
+                struct dentry *parent;
 
                 /* Doesn't hurt to "reset" the validity timeout */
                 fuse_invalidate_entry_cache(entry);
@@ -151,8 +152,10 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                 if (IS_ERR(req))
                         return 0;
 
-                fuse_lookup_init(req, entry->d_parent->d_inode, entry, &outarg);
+                parent = dget_parent(entry);
+                fuse_lookup_init(req, parent->d_inode, entry, &outarg);
                 request_send(fc, req);
+                dput(parent);
                 err = req->out.h.error;
                 /* Zero nodeid is same as -ENOENT */
                 if (!err && !outarg.nodeid)
@@ -163,7 +166,9 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                                 fuse_send_forget(fc, req, outarg.nodeid, 1);
                                 return 0;
                         }
+                        spin_lock(&fc->lock);
                         fi->nlookup ++;
+                        spin_unlock(&fc->lock);
                 }
                 fuse_put_request(fc, req);
                 if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT)
@@ -175,22 +180,6 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
         return 1;
 }
 
-/*
- * Check if there's already a hashed alias of this directory inode.
- * If yes, then lookup and mkdir must not create a new alias.
- */
-static int dir_alias(struct inode *inode)
-{
-        if (S_ISDIR(inode->i_mode)) {
-                struct dentry *alias = d_find_alias(inode);
-                if (alias) {
-                        dput(alias);
-                        return 1;
-                }
-        }
-        return 0;
-}
-
 static int invalid_nodeid(u64 nodeid)
 {
         return !nodeid || nodeid == FUSE_ROOT_ID;
@@ -206,6 +195,24 @@ static int valid_mode(int m)
                 S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
 }
 
+/*
+ * Add a directory inode to a dentry, ensuring that no other dentry
+ * refers to this inode.  Called with fc->inst_mutex.
+ */
+static int fuse_d_add_directory(struct dentry *entry, struct inode *inode)
+{
+        struct dentry *alias = d_find_alias(inode);
+        if (alias) {
+                /* This tries to shrink the subtree below alias */
+                fuse_invalidate_entry(alias);
+                dput(alias);
+                if (!list_empty(&inode->i_dentry))
+                        return -EBUSY;
+        }
+        d_add(entry, inode);
+        return 0;
+}
+
 static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
                                   struct nameidata *nd)
 {
@@ -241,11 +248,17 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         if (err && err != -ENOENT)
                 return ERR_PTR(err);
 
-        if (inode && dir_alias(inode)) {
-                iput(inode);
-                return ERR_PTR(-EIO);
-        }
-        d_add(entry, inode);
+        if (inode && S_ISDIR(inode->i_mode)) {
+                mutex_lock(&fc->inst_mutex);
+                err = fuse_d_add_directory(entry, inode);
+                mutex_unlock(&fc->inst_mutex);
+                if (err) {
+                        iput(inode);
+                        return ERR_PTR(err);
+                }
+        } else
+                d_add(entry, inode);
+
         entry->d_op = &fuse_dentry_operations;
         if (!err)
                 fuse_change_timeout(entry, &outarg);
@@ -401,12 +414,22 @@ static int create_new_entry(struct fuse_conn *fc, struct fuse_req *req,
         }
         fuse_put_request(fc, req);
 
-        if (dir_alias(inode)) {
-                iput(inode);
-                return -EIO;
-        }
+        if (S_ISDIR(inode->i_mode)) {
+                struct dentry *alias;
+                mutex_lock(&fc->inst_mutex);
+                alias = d_find_alias(inode);
+                if (alias) {
+                        /* New directory must have moved since mkdir */
+                        mutex_unlock(&fc->inst_mutex);
+                        dput(alias);
+                        iput(inode);
+                        return -EBUSY;
+                }
+                d_instantiate(entry, inode);
+                mutex_unlock(&fc->inst_mutex);
+        } else
+                d_instantiate(entry, inode);
 
-        d_instantiate(entry, inode);
         fuse_change_timeout(entry, &outarg);
         fuse_invalidate_attr(dir);
         return 0;
@@ -935,14 +958,30 @@ static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg)
         }
 }
 
+static void fuse_vmtruncate(struct inode *inode, loff_t offset)
+{
+        struct fuse_conn *fc = get_fuse_conn(inode);
+        int need_trunc;
+
+        spin_lock(&fc->lock);
+        need_trunc = inode->i_size > offset;
+        i_size_write(inode, offset);
+        spin_unlock(&fc->lock);
+
+        if (need_trunc) {
+                struct address_space *mapping = inode->i_mapping;
+                unmap_mapping_range(mapping, offset + PAGE_SIZE - 1, 0, 1);
+                truncate_inode_pages(mapping, offset);
+        }
+}
+
 /*
  * Set attributes, and at the same time refresh them.
  *
  * Truncation is slightly complicated, because the 'truncate' request
  * may fail, in which case we don't want to touch the mapping.
- * vmtruncate() doesn't allow for this case.  So do the rlimit
- * checking by hand and call vmtruncate() only after the file has
- * actually been truncated.
+ * vmtruncate() doesn't allow for this case, so do the rlimit checking
+ * and the actual truncation by hand.
  */
 static int fuse_setattr(struct dentry *entry, struct iattr *attr)
 {
@@ -993,12 +1032,8 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                         make_bad_inode(inode);
                         err = -EIO;
                 } else {
-                        if (is_truncate) {
-                                loff_t origsize = i_size_read(inode);
-                                i_size_write(inode, outarg.attr.size);
-                                if (origsize > outarg.attr.size)
-                                        vmtruncate(inode, outarg.attr.size);
-                        }
+                        if (is_truncate)
+                                fuse_vmtruncate(inode, outarg.attr.size);
                         fuse_change_attributes(inode, &outarg.attr);
                         fi->i_time = time_to_jiffies(outarg.attr_valid,
                                                      outarg.attr_valid_nsec);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 183626868eea..763a50daf1c0 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -397,14 +397,14 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         err = -EIO;
         if (is_bad_inode(inode))
-                goto clean_pages_up;
+                goto out;
 
         data.file = file;
         data.inode = inode;
         data.req = fuse_get_req(fc);
         err = PTR_ERR(data.req);
         if (IS_ERR(data.req))
-                goto clean_pages_up;
+                goto out;
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
         if (!err) {
@@ -413,10 +413,7 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
                 else
                         fuse_put_request(fc, data.req);
         }
-        return err;
-
-clean_pages_up:
-        put_pages_list(pages);
+out:
         return err;
 }
 
@@ -481,8 +478,10 @@ static int fuse_commit_write(struct file *file, struct page *page,
                 err = -EIO;
         if (!err) {
                 pos += count;
-                if (pos > i_size_read(inode))
+                spin_lock(&fc->lock);
+                if (pos > inode->i_size)
                         i_size_write(inode, pos);
+                spin_unlock(&fc->lock);
 
                 if (offset == 0 && to == PAGE_CACHE_SIZE) {
                         clear_page_dirty(page);
@@ -586,8 +585,12 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
         }
         fuse_put_request(fc, req);
         if (res > 0) {
-                if (write && pos > i_size_read(inode))
-                        i_size_write(inode, pos);
+                if (write) {
+                        spin_lock(&fc->lock);
+                        if (pos > inode->i_size)
+                                i_size_write(inode, pos);
+                        spin_unlock(&fc->lock);
+                }
                 *ppos = pos;
         }
         fuse_invalidate_attr(inode);
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index 69c7750d55b8..91edb8932d90 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -239,6 +239,9 @@ struct fuse_conn {
         /** Lock protecting accessess to  members of this structure */
         spinlock_t lock;
 
+        /** Mutex protecting against directory alias creation */
+        struct mutex inst_mutex;
+
         /** Refcount */
         atomic_t count;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 7d0a9aee01f2..fc4203570370 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -109,6 +109,7 @@ static int fuse_remount_fs(struct super_block *sb, int *flags, char *data)
 
 void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
 {
+        struct fuse_conn *fc = get_fuse_conn(inode);
         if (S_ISREG(inode->i_mode) && i_size_read(inode) != attr->size)
                 invalidate_inode_pages(inode->i_mapping);
 
@@ -117,7 +118,9 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
         inode->i_nlink   = attr->nlink;
         inode->i_uid     = attr->uid;
         inode->i_gid     = attr->gid;
+        spin_lock(&fc->lock);
         i_size_write(inode, attr->size);
+        spin_unlock(&fc->lock);
         inode->i_blocks  = attr->blocks;
         inode->i_atime.tv_sec   = attr->atime;
         inode->i_atime.tv_nsec  = attr->atimensec;
@@ -130,7 +133,7 @@ void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr)
 static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
 {
         inode->i_mode = attr->mode & S_IFMT;
-        i_size_write(inode, attr->size);
+        inode->i_size = attr->size;
         if (S_ISREG(inode->i_mode)) {
                 fuse_init_common(inode);
                 fuse_init_file_inode(inode);
@@ -169,7 +172,6 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
         struct inode *inode;
         struct fuse_inode *fi;
         struct fuse_conn *fc = get_fuse_conn_super(sb);
-        int retried = 0;
 
  retry:
         inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set, &nodeid);
@@ -183,16 +185,16 @@ struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
                 fuse_init_inode(inode, attr);
                 unlock_new_inode(inode);
         } else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
-                BUG_ON(retried);
                 /* Inode has changed type, any I/O on the old should fail */
                 make_bad_inode(inode);
                 iput(inode);
-                retried = 1;
                 goto retry;
         }
 
         fi = get_fuse_inode(inode);
+        spin_lock(&fc->lock);
         fi->nlookup ++;
+        spin_unlock(&fc->lock);
         fuse_change_attributes(inode, attr);
         return inode;
 }
@@ -377,6 +379,7 @@ static struct fuse_conn *new_conn(void)
         fc = kzalloc(sizeof(*fc), GFP_KERNEL);
         if (fc) {
                 spin_lock_init(&fc->lock);
+                mutex_init(&fc->inst_mutex);
                 atomic_set(&fc->count, 1);
                 init_waitqueue_head(&fc->waitq);
                 init_waitqueue_head(&fc->blocked_waitq);
@@ -396,8 +399,10 @@ static struct fuse_conn *new_conn(void)
 
 void fuse_conn_put(struct fuse_conn *fc)
 {
-        if (atomic_dec_and_test(&fc->count))
+        if (atomic_dec_and_test(&fc->count)) {
+                mutex_destroy(&fc->inst_mutex);
                 kfree(fc);
+        }
 }
 
 struct fuse_conn *fuse_conn_get(struct fuse_conn *fc)
diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
index cc57f2ecd219..06e9a8cb45e9 100644
--- a/fs/gfs2/bmap.c
+++ b/fs/gfs2/bmap.c
@@ -434,8 +434,7 @@ static int lookup_block(struct gfs2_inode *ip, struct buffer_head *bh,
  */
 
 static int gfs2_block_pointers(struct inode *inode, u64 lblock, int create,
-                               struct buffer_head *bh_map, struct metapath *mp,
-                               unsigned int maxlen)
+                               struct buffer_head *bh_map, struct metapath *mp)
 {
         struct gfs2_inode *ip = GFS2_I(inode);
         struct gfs2_sbd *sdp = GFS2_SB(inode);
@@ -448,6 +447,7 @@ static int gfs2_block_pointers(struct inode *inode, u64 lblock, int create,
         int new = 0;
         u64 dblock = 0;
         int boundary;
+        unsigned int maxlen = bh_map->b_size >> inode->i_blkbits;
 
         BUG_ON(maxlen == 0);
 
@@ -541,13 +541,13 @@ static inline void bmap_unlock(struct inode *inode, int create)
 }
 
 int gfs2_block_map(struct inode *inode, u64 lblock, int create,
-                   struct buffer_head *bh, unsigned int maxlen)
+                   struct buffer_head *bh)
 {
         struct metapath mp;
         int ret;
 
         bmap_lock(inode, create);
-        ret = gfs2_block_pointers(inode, lblock, create, bh, &mp, maxlen);
+        ret = gfs2_block_pointers(inode, lblock, create, bh, &mp);
         bmap_unlock(inode, create);
         return ret;
 }
@@ -555,7 +555,7 @@ int gfs2_block_map(struct inode *inode, u64 lblock, int create,
 int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsigned *extlen)
 {
         struct metapath mp;
-        struct buffer_head bh = { .b_state = 0, .b_blocknr = 0, .b_size = 0 };
+        struct buffer_head bh = { .b_state = 0, .b_blocknr = 0 };
         int ret;
         int create = *new;
 
@@ -563,8 +563,9 @@ int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsi
         BUG_ON(!dblock);
         BUG_ON(!new);
 
+        bh.b_size = 1 << (inode->i_blkbits + 5);
         bmap_lock(inode, create);
-        ret = gfs2_block_pointers(inode, lblock, create, &bh, &mp, 32);
+        ret = gfs2_block_pointers(inode, lblock, create, &bh, &mp);
         bmap_unlock(inode, create);
         *extlen = bh.b_size >> inode->i_blkbits;
         *dblock = bh.b_blocknr;
diff --git a/fs/gfs2/bmap.h b/fs/gfs2/bmap.h
index 0fd379b4cd9e..ac2fd04370dc 100644
--- a/fs/gfs2/bmap.h
+++ b/fs/gfs2/bmap.h
@@ -15,7 +15,7 @@ struct gfs2_inode;
 struct page;
 
 int gfs2_unstuff_dinode(struct gfs2_inode *ip, struct page *page);
-int gfs2_block_map(struct inode *inode, u64 lblock, int create, struct buffer_head *bh, unsigned int maxlen);
+int gfs2_block_map(struct inode *inode, u64 lblock, int create, struct buffer_head *bh);
 int gfs2_extent_map(struct inode *inode, u64 lblock, int *new, u64 *dblock, unsigned *extlen);
 
 int gfs2_truncatei(struct gfs2_inode *ip, u64 size);
diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c
index 459498cac93b..e24af28b1a12 100644
--- a/fs/gfs2/dir.c
+++ b/fs/gfs2/dir.c
@@ -184,7 +184,7 @@ static int gfs2_dir_write_data(struct gfs2_inode *ip, const char *buf,
         while (copied < size) {
                 unsigned int amount;
                 struct buffer_head *bh;
-                int new;
+                int new = 0;
 
                 amount = size - copied;
                 if (amount > sdp->sd_sb.sb_bsize - o)
@@ -212,8 +212,6 @@ static int gfs2_dir_write_data(struct gfs2_inode *ip, const char *buf,
                 gfs2_trans_add_bh(ip->i_gl, bh, 1);
                 memcpy(bh->b_data + o, buf, amount);
                 brelse(bh);
-                if (error)
-                        goto fail;
 
                 buf += amount;
                 copied += amount;
@@ -317,8 +315,7 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, char *buf, u64 offset,
                         if (!ra)
                                 extlen = 1;
                         bh = gfs2_meta_ra(ip->i_gl, dblock, extlen);
-                }
-                if (!bh) {
+                } else {
                         error = gfs2_meta_read(ip->i_gl, dblock, DIO_WAIT, &bh);
                         if (error)
                                 goto fail;
@@ -332,7 +329,6 @@ static int gfs2_dir_read_data(struct gfs2_inode *ip, char *buf, u64 offset,
                 extlen--;
                 memcpy(buf, bh->b_data + o, amount);
                 brelse(bh);
-                bh = NULL;
                 buf += amount;
                 copied += amount;
                 lblock++;
@@ -815,7 +811,7 @@ static struct gfs2_leaf *new_leaf(struct inode *inode, struct buffer_head **pbh,
         leaf = (struct gfs2_leaf *)bh->b_data;
         leaf->lf_depth = cpu_to_be16(depth);
         leaf->lf_entries = 0;
-        leaf->lf_dirent_format = cpu_to_be16(GFS2_FORMAT_DE);
+        leaf->lf_dirent_format = cpu_to_be32(GFS2_FORMAT_DE);
         leaf->lf_next = 0;
         memset(leaf->lf_reserved, 0, sizeof(leaf->lf_reserved));
         dent = (struct gfs2_dirent *)(leaf+1);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index 57c43ac47925..d470e5286ecd 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -157,6 +157,9 @@ struct inode *gfs2_inode_lookup(struct super_block *sb, struct gfs2_inum *inum,
         struct gfs2_glock *io_gl;
         int error;
 
+        if (!inode)
+                return ERR_PTR(-ENOBUFS);
+
         if (inode->i_state & I_NEW) {
                 struct gfs2_sbd *sdp = GFS2_SB(inode);
                 umode_t mode = DT2IF(type);
diff --git a/fs/gfs2/locking/dlm/mount.c b/fs/gfs2/locking/dlm/mount.c
index 1f94dd35a943..cdd1694e889b 100644
--- a/fs/gfs2/locking/dlm/mount.c
+++ b/fs/gfs2/locking/dlm/mount.c
@@ -45,7 +45,7 @@ static struct gdlm_ls *init_gdlm(lm_callback_t cb, struct gfs2_sbd *sdp,
         strncpy(buf, table_name, 256);
         buf[255] = '\0';
 
-        p = strstr(buf, ":");
+        p = strchr(buf, ':');
         if (!p) {
                 log_info("invalid table_name \"%s\"", table_name);
                 kfree(ls);
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 554fe5bd1b72..0cace3da9dbb 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -312,10 +312,12 @@ void gfs2_log_release(struct gfs2_sbd *sdp, unsigned int blks)
 
 static u64 log_bmap(struct gfs2_sbd *sdp, unsigned int lbn)
 {
+        struct inode *inode = sdp->sd_jdesc->jd_inode;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
-        error = gfs2_block_map(sdp->sd_jdesc->jd_inode, lbn, 0, &bh_map, 1);
+        bh_map.b_size = 1 << inode->i_blkbits;
+        error = gfs2_block_map(inode, lbn, 0, &bh_map);
         if (error || !bh_map.b_blocknr)
                 printk(KERN_INFO "error=%d, dbn=%llu lbn=%u", error, bh_map.b_blocknr, lbn);
         gfs2_assert_withdraw(sdp, !error && bh_map.b_blocknr);
@@ -569,16 +571,15 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl)
         else if (sdp->sd_log_tail != current_tail(sdp) && !sdp->sd_log_idle)
                 log_write_header(sdp, 0, PULL);
         lops_after_commit(sdp, ai);
-        sdp->sd_log_head = sdp->sd_log_flush_head;
 
+        gfs2_log_lock(sdp);
+        sdp->sd_log_head = sdp->sd_log_flush_head;
         sdp->sd_log_blks_free -= sdp->sd_log_num_hdrs;
-
         sdp->sd_log_blks_reserved = 0;
         sdp->sd_log_commited_buf = 0;
         sdp->sd_log_num_hdrs = 0;
         sdp->sd_log_commited_revoke = 0;
 
-        gfs2_log_lock(sdp);
         if (!list_empty(&ai->ai_ail1_list)) {
                 list_add(&ai->ai_list, &sdp->sd_ail1_list);
                 ai = NULL;
diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
index 881e337b6a70..ab6d1115f95d 100644
--- a/fs/gfs2/lops.c
+++ b/fs/gfs2/lops.c
@@ -492,7 +492,7 @@ static int gfs2_check_magic(struct buffer_head *bh)
         ptr = kaddr + bh_offset(bh);
         if (*ptr == cpu_to_be32(GFS2_MAGIC))
                 rv = 1;
-        kunmap_atomic(page, KM_USER0);
+        kunmap_atomic(kaddr, KM_USER0);
 
         return rv;
 }
@@ -626,7 +626,7 @@ static void databuf_lo_before_commit(struct gfs2_sbd *sdp)
                                 memcpy(bh->b_data,
                                        kaddr + bh_offset(bd2->bd_bh),
                                        sdp->sd_sb.sb_bsize);
-                                kunmap_atomic(page, KM_USER0);
+                                kunmap_atomic(kaddr, KM_USER0);
                                 *(__be32 *)bh->b_data = 0;
                         } else {
                                 bh = gfs2_log_fake_buf(sdp, bd2->bd_bh);
diff --git a/fs/gfs2/main.c b/fs/gfs2/main.c
index 21508a13bb78..9889c1eacec1 100644
--- a/fs/gfs2/main.c
+++ b/fs/gfs2/main.c
@@ -84,8 +84,8 @@ static int __init init_gfs2_fs(void)
 
         gfs2_inode_cachep = kmem_cache_create("gfs2_inode",
                                               sizeof(struct gfs2_inode),
-                                              0, (SLAB_RECLAIM_ACCOUNT|
-                                              SLAB_PANIC|SLAB_MEM_SPREAD),
+                                              0,  SLAB_RECLAIM_ACCOUNT|
+                                                  SLAB_MEM_SPREAD,
                                               gfs2_init_inode_once, NULL);
         if (!gfs2_inode_cachep)
                 goto fail;
diff --git a/fs/gfs2/ops_address.c b/fs/gfs2/ops_address.c
index 4fb743f4e4a4..015640b3f123 100644
--- a/fs/gfs2/ops_address.c
+++ b/fs/gfs2/ops_address.c
@@ -65,7 +65,7 @@ static void gfs2_page_add_databufs(struct gfs2_inode *ip, struct page *page,
 int gfs2_get_block(struct inode *inode, sector_t lblock,
                    struct buffer_head *bh_result, int create)
 {
-        return gfs2_block_map(inode, lblock, create, bh_result, 32);
+        return gfs2_block_map(inode, lblock, create, bh_result);
 }
 
 /**
@@ -83,7 +83,7 @@ static int gfs2_get_block_noalloc(struct inode *inode, sector_t lblock,
 {
         int error;
 
-        error = gfs2_block_map(inode, lblock, 0, bh_result, 1);
+        error = gfs2_block_map(inode, lblock, 0, bh_result);
         if (error)
                 return error;
         if (bh_result->b_blocknr == 0)
@@ -94,7 +94,7 @@ static int gfs2_get_block_noalloc(struct inode *inode, sector_t lblock,
 static int gfs2_get_block_direct(struct inode *inode, sector_t lblock,
                                  struct buffer_head *bh_result, int create)
 {
-        return gfs2_block_map(inode, lblock, 0, bh_result, 32);
+        return gfs2_block_map(inode, lblock, 0, bh_result);
 }
 
 /**
@@ -162,7 +162,7 @@ static int zero_readpage(struct page *page)
 
         kaddr = kmap_atomic(page, KM_USER0);
         memset(kaddr, 0, PAGE_CACHE_SIZE);
-        kunmap_atomic(page, KM_USER0);
+        kunmap_atomic(kaddr, KM_USER0);
 
         SetPageUptodate(page);
 
@@ -195,7 +195,7 @@ static int stuffed_readpage(struct gfs2_inode *ip, struct page *page)
         memcpy(kaddr, dibh->b_data + sizeof(struct gfs2_dinode),
                ip->i_di.di_size);
         memset(kaddr + ip->i_di.di_size, 0, PAGE_CACHE_SIZE - ip->i_di.di_size);
-        kunmap_atomic(page, KM_USER0);
+        kunmap_atomic(kaddr, KM_USER0);
 
         brelse(dibh);
 
@@ -337,13 +337,6 @@ out:
 out_noerror:
         ret = 0;
 out_unlock:
-        /* unlock all pages, we can't do any I/O right now */
-        for (page_idx = 0; page_idx < nr_pages; page_idx++) {
-                struct page *page = list_entry(pages->prev, struct page, lru);
-                list_del(&page->lru);
-                unlock_page(page);
-                page_cache_release(page);
-        }
         if (do_unlock)
                 gfs2_holder_uninit(&gh);
         goto out;
@@ -370,19 +363,22 @@ static int gfs2_prepare_write(struct file *file, struct page *page,
         loff_t pos = ((loff_t)page->index << PAGE_CACHE_SHIFT) + from;
         loff_t end = ((loff_t)page->index << PAGE_CACHE_SHIFT) + to;
         struct gfs2_alloc *al;
+        unsigned int write_len = to - from;
+
 
         gfs2_holder_init(ip->i_gl, LM_ST_EXCLUSIVE, GL_ATIME|GL_AOP, &ip->i_gh);
         error = gfs2_glock_nq_m_atime(1, &ip->i_gh);
         if (error)
                 goto out_uninit;
 
-        gfs2_write_calc_reserv(ip, to - from, &data_blocks, &ind_blocks);
+        gfs2_write_calc_reserv(ip, write_len, &data_blocks, &ind_blocks);
 
-        error = gfs2_write_alloc_required(ip, pos, from - to, &alloc_required);
+        error = gfs2_write_alloc_required(ip, pos, write_len, &alloc_required);
         if (error)
                 goto out_unlock;
 
 
+        ip->i_alloc.al_requested = 0;
         if (alloc_required) {
                 al = gfs2_alloc_get(ip);
 
@@ -482,7 +478,7 @@ static int gfs2_commit_write(struct file *file, struct page *page,
                 kaddr = kmap_atomic(page, KM_USER0);
                 memcpy(dibh->b_data + sizeof(struct gfs2_dinode) + from,
                        kaddr + from, to - from);
-                kunmap_atomic(page, KM_USER0);
+                kunmap_atomic(kaddr, KM_USER0);
 
                 SetPageUptodate(page);
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 178b33911843..882873a6bd69 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -794,8 +794,8 @@ static int fill_super_meta(struct super_block *sb, struct super_block *new,
                 fs_err(sdp, "can't get root dentry\n");
                 error = -ENOMEM;
                 iput(inode);
-        }
-        new->s_root->d_op = &gfs2_dops;
+        } else
+                new->s_root->d_op = &gfs2_dops;
 
         return error;
 }
@@ -854,7 +854,6 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
         int error = 0;
         struct super_block *sb = NULL, *new;
         struct gfs2_sbd *sdp;
-        char *gfs2mnt = NULL;
 
         sb = get_gfs2_sb(dev_name);
         if (!sb) {
@@ -892,8 +891,6 @@ static int gfs2_get_sb_meta(struct file_system_type *fs_type, int flags,
         atomic_inc(&sdp->sd_gfs2mnt->mnt_count);
         return simple_set_mnt(mnt, new);
 error:
-        if (gfs2mnt)
-                kfree(gfs2mnt);
         return error;
 }
 
diff --git a/fs/gfs2/ops_super.c b/fs/gfs2/ops_super.c
index 06f06f7773d0..b47d9598c047 100644
--- a/fs/gfs2/ops_super.c
+++ b/fs/gfs2/ops_super.c
@@ -138,16 +138,27 @@ static void gfs2_put_super(struct super_block *sb)
 }
 
 /**
- * gfs2_write_super - disk commit all incore transactions
- * @sb: the filesystem
+ * gfs2_write_super
+ * @sb: the superblock
  *
- * This function is called every time sync(2) is called.
- * After this exits, all dirty buffers are synced.
  */
 
 static void gfs2_write_super(struct super_block *sb)
 {
+        sb->s_dirt = 0;
+}
+
+/**
+ * gfs2_sync_fs - sync the filesystem
+ * @sb: the superblock
+ *
+ * Flushes the log to disk.
+ */
+static int gfs2_sync_fs(struct super_block *sb, int wait)
+{
+        sb->s_dirt = 0;
         gfs2_log_flush(sb->s_fs_info, NULL);
+        return 0;
 }
 
 /**
@@ -452,17 +463,18 @@ static void gfs2_destroy_inode(struct inode *inode)
 }
 
 struct super_operations gfs2_super_ops = {
-        .alloc_inode = gfs2_alloc_inode,
-        .destroy_inode = gfs2_destroy_inode,
-        .write_inode = gfs2_write_inode,
-        .delete_inode = gfs2_delete_inode,
-        .put_super = gfs2_put_super,
-        .write_super = gfs2_write_super,
-        .write_super_lockfs = gfs2_write_super_lockfs,
-        .unlockfs = gfs2_unlockfs,
-        .statfs = gfs2_statfs,
-        .remount_fs = gfs2_remount_fs,
-        .clear_inode = gfs2_clear_inode,
-        .show_options = gfs2_show_options,
+        .alloc_inode            = gfs2_alloc_inode,
+        .destroy_inode          = gfs2_destroy_inode,
+        .write_inode            = gfs2_write_inode,
+        .delete_inode           = gfs2_delete_inode,
+        .put_super              = gfs2_put_super,
+        .write_super            = gfs2_write_super,
+        .sync_fs                = gfs2_sync_fs,
+        .write_super_lockfs     = gfs2_write_super_lockfs,
+        .unlockfs               = gfs2_unlockfs,
+        .statfs                 = gfs2_statfs,
+        .remount_fs             = gfs2_remount_fs,
+        .clear_inode            = gfs2_clear_inode,
+        .show_options           = gfs2_show_options,
 };
 
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index c69b94a55588..a3deae7416c9 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -251,7 +251,7 @@ static int bh_get(struct gfs2_quota_data *qd)
         unsigned int block, offset;
         struct buffer_head *bh;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
         mutex_lock(&sdp->sd_quota_mutex);
 
@@ -263,7 +263,8 @@ static int bh_get(struct gfs2_quota_data *qd)
         block = qd->qd_slot / sdp->sd_qc_per_block;
         offset = qd->qd_slot % sdp->sd_qc_per_block;;
 
-        error = gfs2_block_map(&ip->i_inode, block, 0, &bh_map, 1);
+        bh_map.b_size = 1 << ip->i_inode.i_blkbits;
+        error = gfs2_block_map(&ip->i_inode, block, 0, &bh_map);
         if (error)
                 goto fail;
         error = gfs2_meta_read(ip->i_gl, bh_map.b_blocknr, DIO_WAIT, &bh);
diff --git a/fs/gfs2/recovery.c b/fs/gfs2/recovery.c
index 0a8a4b87dcc6..62cd223819b7 100644
--- a/fs/gfs2/recovery.c
+++ b/fs/gfs2/recovery.c
@@ -372,11 +372,12 @@ static int clean_journal(struct gfs2_jdesc *jd, struct gfs2_log_header *head)
         u32 hash;
         struct buffer_head *bh;
         int error;
-        struct buffer_head bh_map;
+        struct buffer_head bh_map = { .b_state = 0, .b_blocknr = 0 };
 
         lblock = head->lh_blkno;
         gfs2_replay_incr_blk(sdp, &lblock);
-        error = gfs2_block_map(&ip->i_inode, lblock, 0, &bh_map, 1);
+        bh_map.b_size = 1 << ip->i_inode.i_blkbits;
+        error = gfs2_block_map(&ip->i_inode, lblock, 0, &bh_map);
         if (error)
                 return error;
         if (!bh_map.b_blocknr) {
diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h
index 9eedfd12bfff..b01e0cfc99b5 100644
--- a/fs/gfs2/rgrp.h
+++ b/fs/gfs2/rgrp.h
@@ -32,7 +32,7 @@ void gfs2_rgrp_repolish_clones(struct gfs2_rgrpd *rgd);
 struct gfs2_alloc *gfs2_alloc_get(struct gfs2_inode *ip);
 static inline void gfs2_alloc_put(struct gfs2_inode *ip)
 {
-        return; /* Se we can see where ip->i_alloc is used */
+        return; /* So we can see where ip->i_alloc is used */
 }
 
 int gfs2_inplace_reserve_i(struct gfs2_inode *ip,
diff --git a/fs/hfs/super.c b/fs/hfs/super.c
index d43b4fcc8ad3..85b17b3fa4a0 100644
--- a/fs/hfs/super.c
+++ b/fs/hfs/super.c
@@ -390,11 +390,13 @@ static int hfs_fill_super(struct super_block *sb, void *data, int silent)
                 hfs_find_exit(&fd);
                 goto bail_no_root;
         }
+        res = -EINVAL;
         root_inode = hfs_iget(sb, &fd.search_key->cat, &rec);
         hfs_find_exit(&fd);
         if (!root_inode)
                 goto bail_no_root;
 
+        res = -ENOMEM;
         sb->s_root = d_alloc_root(root_inode);
         if (!sb->s_root)
                 goto bail_iput;
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 5e03b2f67b93..7f4756963d05 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -62,24 +62,19 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
         loff_t len, vma_len;
         int ret;
 
-        if (vma->vm_pgoff & (HPAGE_SIZE / PAGE_SIZE - 1))
-                return -EINVAL;
-
-        if (vma->vm_start & ~HPAGE_MASK)
-                return -EINVAL;
-
-        if (vma->vm_end & ~HPAGE_MASK)
-                return -EINVAL;
-
-        if (vma->vm_end - vma->vm_start < HPAGE_SIZE)
-                return -EINVAL;
+        /*
+         * vma alignment has already been checked by prepare_hugepage_range.
+         * If you add any error returns here, do so after setting VM_HUGETLB,
+         * so is_vm_hugetlb_page tests below unmap_region go the right way
+         * when do_mmap_pgoff unwinds (may be important on powerpc and ia64).
+         */
+        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
+        vma->vm_ops = &hugetlb_vm_ops;
 
         vma_len = (loff_t)(vma->vm_end - vma->vm_start);
 
         mutex_lock(&inode->i_mutex);
         file_accessed(file);
-        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
-        vma->vm_ops = &hugetlb_vm_ops;
 
         ret = -ENOMEM;
         len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
@@ -271,29 +266,27 @@ static void hugetlbfs_drop_inode(struct inode *inode)
                 hugetlbfs_forget_inode(inode);
 }
 
-/*
- * h_pgoff is in HPAGE_SIZE units.
- * vma->vm_pgoff is in PAGE_SIZE units.
- */
 static inline void
-hugetlb_vmtruncate_list(struct prio_tree_root *root, unsigned long h_pgoff)
+hugetlb_vmtruncate_list(struct prio_tree_root *root, pgoff_t pgoff)
 {
         struct vm_area_struct *vma;
         struct prio_tree_iter iter;
 
-        vma_prio_tree_foreach(vma, &iter, root, h_pgoff, ULONG_MAX) {
-                unsigned long h_vm_pgoff;
+        vma_prio_tree_foreach(vma, &iter, root, pgoff, ULONG_MAX) {
                 unsigned long v_offset;
 
-                h_vm_pgoff = vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT);
-                v_offset = (h_pgoff - h_vm_pgoff) << HPAGE_SHIFT;
                 /*
-                 * Is this VMA fully outside the truncation point?
+                 * Can the expression below overflow on 32-bit arches?
+                 * No, because the prio_tree returns us only those vmas
+                 * which overlap the truncated area starting at pgoff,
+                 * and no vma on a 32-bit arch can span beyond the 4GB.
                  */
-                if (h_vm_pgoff >= h_pgoff)
+                if (vma->vm_pgoff < pgoff)
+                        v_offset = (pgoff - vma->vm_pgoff) << PAGE_SHIFT;
+                else
                         v_offset = 0;
 
-                unmap_hugepage_range(vma,
+                __unmap_hugepage_range(vma,
                                 vma->vm_start + v_offset, vma->vm_end);
         }
 }
@@ -303,14 +296,14 @@ hugetlb_vmtruncate_list(struct prio_tree_root *root, unsigned long h_pgoff)
  */
 static int hugetlb_vmtruncate(struct inode *inode, loff_t offset)
 {
-        unsigned long pgoff;
+        pgoff_t pgoff;
         struct address_space *mapping = inode->i_mapping;
 
         if (offset > inode->i_size)
                 return -EINVAL;
 
         BUG_ON(offset & ~HPAGE_MASK);
-        pgoff = offset >> HPAGE_SHIFT;
+        pgoff = offset >> PAGE_SHIFT;
 
         inode->i_size = offset;
         spin_lock(&mapping->i_mmap_lock);
@@ -624,7 +617,6 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
                                 do_div(size, 100);
                                 rest++;
                         }
-                        size &= HPAGE_MASK;
                         pconfig->nr_blocks = (size >> HPAGE_SHIFT);
                         value = rest;
                 } else if (!strcmp(opt,"nr_inodes")) {
diff --git a/fs/inode.c b/fs/inode.c
index d9a21d122926..26cdb115ce67 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1306,6 +1306,42 @@ void wake_up_inode(struct inode *inode)
         wake_up_bit(&inode->i_state, __I_LOCK);
 }
 
+/*
+ * We rarely want to lock two inodes that do not have a parent/child
+ * relationship (such as directory, child inode) simultaneously. The
+ * vast majority of file systems should be able to get along fine
+ * without this. Do not use these functions except as a last resort.
+ */
+void inode_double_lock(struct inode *inode1, struct inode *inode2)
+{
+        if (inode1 == NULL || inode2 == NULL || inode1 == inode2) {
+                if (inode1)
+                        mutex_lock(&inode1->i_mutex);
+                else if (inode2)
+                        mutex_lock(&inode2->i_mutex);
+                return;
+        }
+
+        if (inode1 < inode2) {
+                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_PARENT);
+                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_CHILD);
+        } else {
+                mutex_lock_nested(&inode2->i_mutex, I_MUTEX_PARENT);
+                mutex_lock_nested(&inode1->i_mutex, I_MUTEX_CHILD);
+        }
+}
+EXPORT_SYMBOL(inode_double_lock);
+
+void inode_double_unlock(struct inode *inode1, struct inode *inode2)
+{
+        if (inode1)
+                mutex_unlock(&inode1->i_mutex);
+
+        if (inode2 && inode2 != inode1)
+                mutex_unlock(&inode2->i_mutex);
+}
+EXPORT_SYMBOL(inode_double_unlock);
+
 static __initdata unsigned long ihash_entries;
 static int __init set_ihash_entries(char *str)
 {
diff --git a/fs/ioprio.c b/fs/ioprio.c
index 6dc6721d9e82..89e8da112a75 100644
--- a/fs/ioprio.c
+++ b/fs/ioprio.c
@@ -150,11 +150,6 @@ int ioprio_best(unsigned short aprio, unsigned short bprio)
         unsigned short aclass = IOPRIO_PRIO_CLASS(aprio);
         unsigned short bclass = IOPRIO_PRIO_CLASS(bprio);
 
-        if (!ioprio_valid(aprio))
-                return bprio;
-        if (!ioprio_valid(bprio))
-                return aprio;
-
         if (aclass == IOPRIO_CLASS_NONE)
                 aclass = IOPRIO_CLASS_BE;
         if (bclass == IOPRIO_CLASS_NONE)
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index c518dd8fe60a..b85c686b60db 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -725,6 +725,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
                         __FUNCTION__);
                 kfree(journal);
                 journal = NULL;
+                goto out;
         }
         journal->j_dev = bdev;
         journal->j_fs_dev = fs_dev;
@@ -735,7 +736,7 @@ journal_t * journal_init_dev(struct block_device *bdev,
         J_ASSERT(bh != NULL);
         journal->j_sb_buffer = bh;
         journal->j_superblock = (journal_superblock_t *)bh->b_data;
-
+out:
         return journal;
 }
 
diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c
index e1b3c8af4d17..4f82bcd63e48 100644
--- a/fs/jbd/transaction.c
+++ b/fs/jbd/transaction.c
@@ -967,6 +967,13 @@ int journal_dirty_data(handle_t *handle, struct buffer_head *bh)
          */
         jbd_lock_bh_state(bh);
         spin_lock(&journal->j_list_lock);
+
+        /* Now that we have bh_state locked, are we really still mapped? */
+        if (!buffer_mapped(bh)) {
+                JBUFFER_TRACE(jh, "unmapped buffer, bailing out");
+                goto no_journal;
+        }
+
         if (jh->b_transaction) {
                 JBUFFER_TRACE(jh, "has transaction");
                 if (jh->b_transaction != handle->h_transaction) {
@@ -1028,6 +1035,11 @@ int journal_dirty_data(handle_t *handle, struct buffer_head *bh)
                                 sync_dirty_buffer(bh);
                                 jbd_lock_bh_state(bh);
                                 spin_lock(&journal->j_list_lock);
+                                /* Since we dropped the lock... */
+                                if (!buffer_mapped(bh)) {
+                                        JBUFFER_TRACE(jh, "buffer got unmapped");
+                                        goto no_journal;
+                                }
                                 /* The buffer may become locked again at any
                                    time if it is redirtied */
                         }
@@ -1314,13 +1326,14 @@ int journal_stop(handle_t *handle)
         int old_handle_count, err;
         pid_t pid;
 
-        J_ASSERT(transaction->t_updates > 0);
         J_ASSERT(journal_current_handle() == handle);
 
         if (is_handle_aborted(handle))
                 err = -EIO;
-        else
+        else {
+                J_ASSERT(transaction->t_updates > 0);
                 err = 0;
+        }
 
         if (--handle->h_ref > 0) {
                 jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1,
@@ -1823,6 +1836,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                         }
                 }
         } else if (transaction == journal->j_committing_transaction) {
+                JBUFFER_TRACE(jh, "on committing transaction");
                 if (jh->b_jlist == BJ_Locked) {
                         /*
                          * The buffer is on the committing transaction's locked
@@ -1837,7 +1851,6 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                  * can remove it's next_transaction pointer from the
                  * running transaction if that is set, but nothing
                  * else. */
-                JBUFFER_TRACE(jh, "on committing transaction");
                 set_buffer_freed(bh);
                 if (jh->b_next_transaction) {
                         J_ASSERT(jh->b_next_transaction ==
@@ -1857,6 +1870,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
                  * i_size already for this truncate so recovery will not
                  * expose the disk blocks we are discarding here.) */
                 J_ASSERT_JH(jh, transaction == journal->j_running_transaction);
+                JBUFFER_TRACE(jh, "on running transaction");
                 may_free = __dispose_buffer(jh, transaction);
         }
 
diff --git a/fs/jbd2/Makefile b/fs/jbd2/Makefile
new file mode 100644
index 000000000000..802a3413872a
--- /dev/null
+++ b/fs/jbd2/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for the linux journaling routines.
+#
+
+obj-$(CONFIG_JBD2) += jbd2.o
+
+jbd2-objs := transaction.o commit.o recovery.o checkpoint.o revoke.o journal.o
diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
new file mode 100644
index 000000000000..68039fa9a566
--- /dev/null
+++ b/fs/jbd2/checkpoint.c
@@ -0,0 +1,697 @@
+/*
+ * linux/fs/checkpoint.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1999
+ *
+ * Copyright 1999 Red Hat Software --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Checkpoint routines for the generic filesystem journaling code.
+ * Part of the ext2fs journaling system.
+ *
+ * Checkpointing is the process of ensuring that a section of the log is
+ * committed fully to disk, so that that portion of the log can be
+ * reused.
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+
+/*
+ * Unlink a buffer from a transaction checkpoint list.
+ *
+ * Called with j_list_lock held.
+ */
+static inline void __buffer_unlink_first(struct journal_head *jh)
+{
+        transaction_t *transaction = jh->b_cp_transaction;
+
+        jh->b_cpnext->b_cpprev = jh->b_cpprev;
+        jh->b_cpprev->b_cpnext = jh->b_cpnext;
+        if (transaction->t_checkpoint_list == jh) {
+                transaction->t_checkpoint_list = jh->b_cpnext;
+                if (transaction->t_checkpoint_list == jh)
+                        transaction->t_checkpoint_list = NULL;
+        }
+}
+
+/*
+ * Unlink a buffer from a transaction checkpoint(io) list.
+ *
+ * Called with j_list_lock held.
+ */
+static inline void __buffer_unlink(struct journal_head *jh)
+{
+        transaction_t *transaction = jh->b_cp_transaction;
+
+        __buffer_unlink_first(jh);
+        if (transaction->t_checkpoint_io_list == jh) {
+                transaction->t_checkpoint_io_list = jh->b_cpnext;
+                if (transaction->t_checkpoint_io_list == jh)
+                        transaction->t_checkpoint_io_list = NULL;
+        }
+}
+
+/*
+ * Move a buffer from the checkpoint list to the checkpoint io list
+ *
+ * Called with j_list_lock held
+ */
+static inline void __buffer_relink_io(struct journal_head *jh)
+{
+        transaction_t *transaction = jh->b_cp_transaction;
+
+        __buffer_unlink_first(jh);
+
+        if (!transaction->t_checkpoint_io_list) {
+                jh->b_cpnext = jh->b_cpprev = jh;
+        } else {
+                jh->b_cpnext = transaction->t_checkpoint_io_list;
+                jh->b_cpprev = transaction->t_checkpoint_io_list->b_cpprev;
+                jh->b_cpprev->b_cpnext = jh;
+                jh->b_cpnext->b_cpprev = jh;
+        }
+        transaction->t_checkpoint_io_list = jh;
+}
+
+/*
+ * Try to release a checkpointed buffer from its transaction.
+ * Returns 1 if we released it and 2 if we also released the
+ * whole transaction.
+ *
+ * Requires j_list_lock
+ * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
+ */
+static int __try_to_free_cp_buf(struct journal_head *jh)
+{
+        int ret = 0;
+        struct buffer_head *bh = jh2bh(jh);
+
+        if (jh->b_jlist == BJ_None && !buffer_locked(bh) && !buffer_dirty(bh)) {
+                JBUFFER_TRACE(jh, "remove from checkpoint list");
+                ret = __jbd2_journal_remove_checkpoint(jh) + 1;
+                jbd_unlock_bh_state(bh);
+                jbd2_journal_remove_journal_head(bh);
+                BUFFER_TRACE(bh, "release");
+                __brelse(bh);
+        } else {
+                jbd_unlock_bh_state(bh);
+        }
+        return ret;
+}
+
+/*
+ * __jbd2_log_wait_for_space: wait until there is space in the journal.
+ *
+ * Called under j-state_lock *only*.  It will be unlocked if we have to wait
+ * for a checkpoint to free up some space in the log.
+ */
+void __jbd2_log_wait_for_space(journal_t *journal)
+{
+        int nblocks;
+        assert_spin_locked(&journal->j_state_lock);
+
+        nblocks = jbd_space_needed(journal);
+        while (__jbd2_log_space_left(journal) < nblocks) {
+                if (journal->j_flags & JBD2_ABORT)
+                        return;
+                spin_unlock(&journal->j_state_lock);
+                mutex_lock(&journal->j_checkpoint_mutex);
+
+                /*
+                 * Test again, another process may have checkpointed while we
+                 * were waiting for the checkpoint lock
+                 */
+                spin_lock(&journal->j_state_lock);
+                nblocks = jbd_space_needed(journal);
+                if (__jbd2_log_space_left(journal) < nblocks) {
+                        spin_unlock(&journal->j_state_lock);
+                        jbd2_log_do_checkpoint(journal);
+                        spin_lock(&journal->j_state_lock);
+                }
+                mutex_unlock(&journal->j_checkpoint_mutex);
+        }
+}
+
+/*
+ * We were unable to perform jbd_trylock_bh_state() inside j_list_lock.
+ * The caller must restart a list walk.  Wait for someone else to run
+ * jbd_unlock_bh_state().
+ */
+static void jbd_sync_bh(journal_t *journal, struct buffer_head *bh)
+        __releases(journal->j_list_lock)
+{
+        get_bh(bh);
+        spin_unlock(&journal->j_list_lock);
+        jbd_lock_bh_state(bh);
+        jbd_unlock_bh_state(bh);
+        put_bh(bh);
+}
+
+/*
+ * Clean up transaction's list of buffers submitted for io.
+ * We wait for any pending IO to complete and remove any clean
+ * buffers. Note that we take the buffers in the opposite ordering
+ * from the one in which they were submitted for IO.
+ *
+ * Called with j_list_lock held.
+ */
+static void __wait_cp_io(journal_t *journal, transaction_t *transaction)
+{
+        struct journal_head *jh;
+        struct buffer_head *bh;
+        tid_t this_tid;
+        int released = 0;
+
+        this_tid = transaction->t_tid;
+restart:
+        /* Did somebody clean up the transaction in the meanwhile? */
+        if (journal->j_checkpoint_transactions != transaction ||
+                        transaction->t_tid != this_tid)
+                return;
+        while (!released && transaction->t_checkpoint_io_list) {
+                jh = transaction->t_checkpoint_io_list;
+                bh = jh2bh(jh);
+                if (!jbd_trylock_bh_state(bh)) {
+                        jbd_sync_bh(journal, bh);
+                        spin_lock(&journal->j_list_lock);
+                        goto restart;
+                }
+                if (buffer_locked(bh)) {
+                        atomic_inc(&bh->b_count);
+                        spin_unlock(&journal->j_list_lock);
+                        jbd_unlock_bh_state(bh);
+                        wait_on_buffer(bh);
+                        /* the journal_head may have gone by now */
+                        BUFFER_TRACE(bh, "brelse");
+                        __brelse(bh);
+                        spin_lock(&journal->j_list_lock);
+                        goto restart;
+                }
+                /*
+                 * Now in whatever state the buffer currently is, we know that
+                 * it has been written out and so we can drop it from the list
+                 */
+                released = __jbd2_journal_remove_checkpoint(jh);
+                jbd_unlock_bh_state(bh);
+                jbd2_journal_remove_journal_head(bh);
+                __brelse(bh);
+        }
+}
+
+#define NR_BATCH        64
+
+static void
+__flush_batch(journal_t *journal, struct buffer_head **bhs, int *batch_count)
+{
+        int i;
+
+        ll_rw_block(SWRITE, *batch_count, bhs);
+        for (i = 0; i < *batch_count; i++) {
+                struct buffer_head *bh = bhs[i];
+                clear_buffer_jwrite(bh);
+                BUFFER_TRACE(bh, "brelse");
+                __brelse(bh);
+        }
+        *batch_count = 0;
+}
+
+/*
+ * Try to flush one buffer from the checkpoint list to disk.
+ *
+ * Return 1 if something happened which requires us to abort the current
+ * scan of the checkpoint list.
+ *
+ * Called with j_list_lock held and drops it if 1 is returned
+ * Called under jbd_lock_bh_state(jh2bh(jh)), and drops it
+ */
+static int __process_buffer(journal_t *journal, struct journal_head *jh,
+                        struct buffer_head **bhs, int *batch_count)
+{
+        struct buffer_head *bh = jh2bh(jh);
+        int ret = 0;
+
+        if (buffer_locked(bh)) {
+                atomic_inc(&bh->b_count);
+                spin_unlock(&journal->j_list_lock);
+                jbd_unlock_bh_state(bh);
+                wait_on_buffer(bh);
+                /* the journal_head may have gone by now */
+                BUFFER_TRACE(bh, "brelse");
+                __brelse(bh);
+                ret = 1;
+        } else if (jh->b_transaction != NULL) {
+                transaction_t *t = jh->b_transaction;
+                tid_t tid = t->t_tid;
+
+                spin_unlock(&journal->j_list_lock);
+                jbd_unlock_bh_state(bh);
+                jbd2_log_start_commit(journal, tid);
+                jbd2_log_wait_commit(journal, tid);
+                ret = 1;
+        } else if (!buffer_dirty(bh)) {
+                J_ASSERT_JH(jh, !buffer_jbddirty(bh));
+                BUFFER_TRACE(bh, "remove from checkpoint");
+                __jbd2_journal_remove_checkpoint(jh);
+                spin_unlock(&journal->j_list_lock);
+                jbd_unlock_bh_state(bh);
+                jbd2_journal_remove_journal_head(bh);
+                __brelse(bh);
+                ret = 1;
+        } else {
+                /*
+                 * Important: we are about to write the buffer, and
+                 * possibly block, while still holding the journal lock.
+                 * We cannot afford to let the transaction logic start
+                 * messing around with this buffer before we write it to
+                 * disk, as that would break recoverability.
+                 */
+                BUFFER_TRACE(bh, "queue");
+                get_bh(bh);
+                J_ASSERT_BH(bh, !buffer_jwrite(bh));
+                set_buffer_jwrite(bh);
+                bhs[*batch_count] = bh;
+                __buffer_relink_io(jh);
+                jbd_unlock_bh_state(bh);
+                (*batch_count)++;
+                if (*batch_count == NR_BATCH) {
+                        spin_unlock(&journal->j_list_lock);
+                        __flush_batch(journal, bhs, batch_count);
+                        ret = 1;
+                }
+        }
+        return ret;
+}
+
+/*
+ * Perform an actual checkpoint. We take the first transaction on the
+ * list of transactions to be checkpointed and send all its buffers
+ * to disk. We submit larger chunks of data at once.
+ *
+ * The journal should be locked before calling this function.
+ */
+int jbd2_log_do_checkpoint(journal_t *journal)
+{
+        transaction_t *transaction;
+        tid_t this_tid;
+        int result;
+
+        jbd_debug(1, "Start checkpoint\n");
+
+        /*
+         * First thing: if there are any transactions in the log which
+         * don't need checkpointing, just eliminate them from the
+         * journal straight away.
+         */
+        result = jbd2_cleanup_journal_tail(journal);
+        jbd_debug(1, "cleanup_journal_tail returned %d\n", result);
+        if (result <= 0)
+                return result;
+
+        /*
+         * OK, we need to start writing disk blocks.  Take one transaction
+         * and write it.
+         */
+        spin_lock(&journal->j_list_lock);
+        if (!journal->j_checkpoint_transactions)
+                goto out;
+        transaction = journal->j_checkpoint_transactions;
+        this_tid = transaction->t_tid;
+restart:
+        /*
+         * If someone cleaned up this transaction while we slept, we're
+         * done (maybe it's a new transaction, but it fell at the same
+         * address).
+         */
+        if (journal->j_checkpoint_transactions == transaction &&
+                        transaction->t_tid == this_tid) {
+                int batch_count = 0;
+                struct buffer_head *bhs[NR_BATCH];
+                struct journal_head *jh;
+                int retry = 0;
+
+                while (!retry && transaction->t_checkpoint_list) {
+                        struct buffer_head *bh;
+
+                        jh = transaction->t_checkpoint_list;
+                        bh = jh2bh(jh);
+                        if (!jbd_trylock_bh_state(bh)) {
+                                jbd_sync_bh(journal, bh);
+                                retry = 1;
+                                break;
+                        }
+                        retry = __process_buffer(journal, jh, bhs,&batch_count);
+                        if (!retry && lock_need_resched(&journal->j_list_lock)){
+                                spin_unlock(&journal->j_list_lock);
+                                retry = 1;
+                                break;
+                        }
+                }
+
+                if (batch_count) {
+                        if (!retry) {
+                                spin_unlock(&journal->j_list_lock);
+                                retry = 1;
+                        }
+                        __flush_batch(journal, bhs, &batch_count);
+                }
+
+                if (retry) {
+                        spin_lock(&journal->j_list_lock);
+                        goto restart;
+                }
+                /*
+                 * Now we have cleaned up the first transaction's checkpoint
+                 * list. Let's clean up the second one
+                 */
+                __wait_cp_io(journal, transaction);
+        }
+out:
+        spin_unlock(&journal->j_list_lock);
+        result = jbd2_cleanup_journal_tail(journal);
+        if (result < 0)
+                return result;
+        return 0;
+}
+
+/*
+ * Check the list of checkpoint transactions for the journal to see if
+ * we have already got rid of any since the last update of the log tail
+ * in the journal superblock.  If so, we can instantly roll the
+ * superblock forward to remove those transactions from the log.
+ *
+ * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
+ *
+ * Called with the journal lock held.
+ *
+ * This is the only part of the journaling code which really needs to be
+ * aware of transaction aborts.  Checkpointing involves writing to the
+ * main filesystem area rather than to the journal, so it can proceed
+ * even in abort state, but we must not update the journal superblock if
+ * we have an abort error outstanding.
+ */
+
+int jbd2_cleanup_journal_tail(journal_t *journal)
+{
+        transaction_t * transaction;
+        tid_t           first_tid;
+        unsigned long   blocknr, freed;
+
+        /* OK, work out the oldest transaction remaining in the log, and
+         * the log block it starts at.
+         *
+         * If the log is now empty, we need to work out which is the
+         * next transaction ID we will write, and where it will
+         * start. */
+
+        spin_lock(&journal->j_state_lock);
+        spin_lock(&journal->j_list_lock);
+        transaction = journal->j_checkpoint_transactions;
+        if (transaction) {
+                first_tid = transaction->t_tid;
+                blocknr = transaction->t_log_start;
+        } else if ((transaction = journal->j_committing_transaction) != NULL) {
+                first_tid = transaction->t_tid;
+                blocknr = transaction->t_log_start;
+        } else if ((transaction = journal->j_running_transaction) != NULL) {
+                first_tid = transaction->t_tid;
+                blocknr = journal->j_head;
+        } else {
+                first_tid = journal->j_transaction_sequence;
+                blocknr = journal->j_head;
+        }
+        spin_unlock(&journal->j_list_lock);
+        J_ASSERT(blocknr != 0);
+
+        /* If the oldest pinned transaction is at the tail of the log
+           already then there's not much we can do right now. */
+        if (journal->j_tail_sequence == first_tid) {
+                spin_unlock(&journal->j_state_lock);
+                return 1;
+        }
+
+        /* OK, update the superblock to recover the freed space.
+         * Physical blocks come first: have we wrapped beyond the end of
+         * the log?  */
+        freed = blocknr - journal->j_tail;
+        if (blocknr < journal->j_tail)
+                freed = freed + journal->j_last - journal->j_first;
+
+        jbd_debug(1,
+                  "Cleaning journal tail from %d to %d (offset %lu), "
+                  "freeing %lu\n",
+                  journal->j_tail_sequence, first_tid, blocknr, freed);
+
+        journal->j_free += freed;
+        journal->j_tail_sequence = first_tid;
+        journal->j_tail = blocknr;
+        spin_unlock(&journal->j_state_lock);
+        if (!(journal->j_flags & JBD2_ABORT))
+                jbd2_journal_update_superblock(journal, 1);
+        return 0;
+}
+
+
+/* Checkpoint list management */
+
+/*
+ * journal_clean_one_cp_list
+ *
+ * Find all the written-back checkpoint buffers in the given list and release them.
+ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ * Returns number of bufers reaped (for debug)
+ */
+
+static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
+{
+        struct journal_head *last_jh;
+        struct journal_head *next_jh = jh;
+        int ret, freed = 0;
+
+        *released = 0;
+        if (!jh)
+                return 0;
+
+        last_jh = jh->b_cpprev;
+        do {
+                jh = next_jh;
+                next_jh = jh->b_cpnext;
+                /* Use trylock because of the ranking */
+                if (jbd_trylock_bh_state(jh2bh(jh))) {
+                        ret = __try_to_free_cp_buf(jh);
+                        if (ret) {
+                                freed++;
+                                if (ret == 2) {
+                                        *released = 1;
+                                        return freed;
+                                }
+                        }
+                }
+                /*
+                 * This function only frees up some memory
+                 * if possible so we dont have an obligation
+                 * to finish processing. Bail out if preemption
+                 * requested:
+                 */
+                if (need_resched())
+                        return freed;
+        } while (jh != last_jh);
+
+        return freed;
+}
+
+/*
+ * journal_clean_checkpoint_list
+ *
+ * Find all the written-back checkpoint buffers in the journal and release them.
+ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ * Returns number of buffers reaped (for debug)
+ */
+
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+{
+        transaction_t *transaction, *last_transaction, *next_transaction;
+        int ret = 0;
+        int released;
+
+        transaction = journal->j_checkpoint_transactions;
+        if (!transaction)
+                goto out;
+
+        last_transaction = transaction->t_cpprev;
+        next_transaction = transaction;
+        do {
+                transaction = next_transaction;
+                next_transaction = transaction->t_cpnext;
+                ret += journal_clean_one_cp_list(transaction->
+                                t_checkpoint_list, &released);
+                /*
+                 * This function only frees up some memory if possible so we
+                 * dont have an obligation to finish processing. Bail out if
+                 * preemption requested:
+                 */
+                if (need_resched())
+                        goto out;
+                if (released)
+                        continue;
+                /*
+                 * It is essential that we are as careful as in the case of
+                 * t_checkpoint_list with removing the buffer from the list as
+                 * we can possibly see not yet submitted buffers on io_list
+                 */
+                ret += journal_clean_one_cp_list(transaction->
+                                t_checkpoint_io_list, &released);
+                if (need_resched())
+                        goto out;
+        } while (transaction != last_transaction);
+out:
+        return ret;
+}
+
+/*
+ * journal_remove_checkpoint: called after a buffer has been committed
+ * to disk (either by being write-back flushed to disk, or being
+ * committed to the log).
+ *
+ * We cannot safely clean a transaction out of the log until all of the
+ * buffer updates committed in that transaction have safely been stored
+ * elsewhere on disk.  To achieve this, all of the buffers in a
+ * transaction need to be maintained on the transaction's checkpoint
+ * lists until they have been rewritten, at which point this function is
+ * called to remove the buffer from the existing transaction's
+ * checkpoint lists.
+ *
+ * The function returns 1 if it frees the transaction, 0 otherwise.
+ *
+ * This function is called with the journal locked.
+ * This function is called with j_list_lock held.
+ * This function is called with jbd_lock_bh_state(jh2bh(jh))
+ */
+
+int __jbd2_journal_remove_checkpoint(struct journal_head *jh)
+{
+        transaction_t *transaction;
+        journal_t *journal;
+        int ret = 0;
+
+        JBUFFER_TRACE(jh, "entry");
+
+        if ((transaction = jh->b_cp_transaction) == NULL) {
+                JBUFFER_TRACE(jh, "not on transaction");
+                goto out;
+        }
+        journal = transaction->t_journal;
+
+        __buffer_unlink(jh);
+        jh->b_cp_transaction = NULL;
+
+        if (transaction->t_checkpoint_list != NULL ||
+            transaction->t_checkpoint_io_list != NULL)
+                goto out;
+        JBUFFER_TRACE(jh, "transaction has no more buffers");
+
+        /*
+         * There is one special case to worry about: if we have just pulled the
+         * buffer off a committing transaction's forget list, then even if the
+         * checkpoint list is empty, the transaction obviously cannot be
+         * dropped!
+         *
+         * The locking here around j_committing_transaction is a bit sleazy.
+         * See the comment at the end of jbd2_journal_commit_transaction().
+         */
+        if (transaction == journal->j_committing_transaction) {
+                JBUFFER_TRACE(jh, "belongs to committing transaction");
+                goto out;
+        }
+
+        /* OK, that was the last buffer for the transaction: we can now
+           safely remove this transaction from the log */
+
+        __jbd2_journal_drop_transaction(journal, transaction);
+
+        /* Just in case anybody was waiting for more transactions to be
+           checkpointed... */
+        wake_up(&journal->j_wait_logspace);
+        ret = 1;
+out:
+        JBUFFER_TRACE(jh, "exit");
+        return ret;
+}
+
+/*
+ * journal_insert_checkpoint: put a committed buffer onto a checkpoint
+ * list so that we know when it is safe to clean the transaction out of
+ * the log.
+ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ */
+void __jbd2_journal_insert_checkpoint(struct journal_head *jh,
+                               transaction_t *transaction)
+{
+        JBUFFER_TRACE(jh, "entry");
+        J_ASSERT_JH(jh, buffer_dirty(jh2bh(jh)) || buffer_jbddirty(jh2bh(jh)));
+        J_ASSERT_JH(jh, jh->b_cp_transaction == NULL);
+
+        jh->b_cp_transaction = transaction;
+
+        if (!transaction->t_checkpoint_list) {
+                jh->b_cpnext = jh->b_cpprev = jh;
+        } else {
+                jh->b_cpnext = transaction->t_checkpoint_list;
+                jh->b_cpprev = transaction->t_checkpoint_list->b_cpprev;
+                jh->b_cpprev->b_cpnext = jh;
+                jh->b_cpnext->b_cpprev = jh;
+        }
+        transaction->t_checkpoint_list = jh;
+}
+
+/*
+ * We've finished with this transaction structure: adios...
+ *
+ * The transaction must have no links except for the checkpoint by this
+ * point.
+ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ */
+
+void __jbd2_journal_drop_transaction(journal_t *journal, transaction_t *transaction)
+{
+        assert_spin_locked(&journal->j_list_lock);
+        if (transaction->t_cpnext) {
+                transaction->t_cpnext->t_cpprev = transaction->t_cpprev;
+                transaction->t_cpprev->t_cpnext = transaction->t_cpnext;
+                if (journal->j_checkpoint_transactions == transaction)
+                        journal->j_checkpoint_transactions =
+                                transaction->t_cpnext;
+                if (journal->j_checkpoint_transactions == transaction)
+                        journal->j_checkpoint_transactions = NULL;
+        }
+
+        J_ASSERT(transaction->t_state == T_FINISHED);
+        J_ASSERT(transaction->t_buffers == NULL);
+        J_ASSERT(transaction->t_sync_datalist == NULL);
+        J_ASSERT(transaction->t_forget == NULL);
+        J_ASSERT(transaction->t_iobuf_list == NULL);
+        J_ASSERT(transaction->t_shadow_list == NULL);
+        J_ASSERT(transaction->t_log_list == NULL);
+        J_ASSERT(transaction->t_checkpoint_list == NULL);
+        J_ASSERT(transaction->t_checkpoint_io_list == NULL);
+        J_ASSERT(transaction->t_updates == 0);
+        J_ASSERT(journal->j_committing_transaction != transaction);
+        J_ASSERT(journal->j_running_transaction != transaction);
+
+        jbd_debug(1, "Dropping transaction %d, all done\n", transaction->t_tid);
+        kfree(transaction);
+}
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
new file mode 100644
index 000000000000..70b2ae1ef281
--- /dev/null
+++ b/fs/jbd2/commit.c
@@ -0,0 +1,920 @@
+/*
+ * linux/fs/jbd2/commit.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1998
+ *
+ * Copyright 1998 Red Hat corp --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Journal commit routines for the generic filesystem journaling code;
+ * part of the ext2fs journaling system.
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/smp_lock.h>
+
+/*
+ * Default IO end handler for temporary BJ_IO buffer_heads.
+ */
+static void journal_end_buffer_io_sync(struct buffer_head *bh, int uptodate)
+{
+        BUFFER_TRACE(bh, "");
+        if (uptodate)
+                set_buffer_uptodate(bh);
+        else
+                clear_buffer_uptodate(bh);
+        unlock_buffer(bh);
+}
+
+/*
+ * When an ext3-ordered file is truncated, it is possible that many pages are
+ * not sucessfully freed, because they are attached to a committing transaction.
+ * After the transaction commits, these pages are left on the LRU, with no
+ * ->mapping, and with attached buffers.  These pages are trivially reclaimable
+ * by the VM, but their apparent absence upsets the VM accounting, and it makes
+ * the numbers in /proc/meminfo look odd.
+ *
+ * So here, we have a buffer which has just come off the forget list.  Look to
+ * see if we can strip all buffers from the backing page.
+ *
+ * Called under lock_journal(), and possibly under journal_datalist_lock.  The
+ * caller provided us with a ref against the buffer, and we drop that here.
+ */
+static void release_buffer_page(struct buffer_head *bh)
+{
+        struct page *page;
+
+        if (buffer_dirty(bh))
+                goto nope;
+        if (atomic_read(&bh->b_count) != 1)
+                goto nope;
+        page = bh->b_page;
+        if (!page)
+                goto nope;
+        if (page->mapping)
+                goto nope;
+
+        /* OK, it's a truncated page */
+        if (TestSetPageLocked(page))
+                goto nope;
+
+        page_cache_get(page);
+        __brelse(bh);
+        try_to_free_buffers(page);
+        unlock_page(page);
+        page_cache_release(page);
+        return;
+
+nope:
+        __brelse(bh);
+}
+
+/*
+ * Try to acquire jbd_lock_bh_state() against the buffer, when j_list_lock is
+ * held.  For ranking reasons we must trylock.  If we lose, schedule away and
+ * return 0.  j_list_lock is dropped in this case.
+ */
+static int inverted_lock(journal_t *journal, struct buffer_head *bh)
+{
+        if (!jbd_trylock_bh_state(bh)) {
+                spin_unlock(&journal->j_list_lock);
+                schedule();
+                return 0;
+        }
+        return 1;
+}
+
+/* Done it all: now write the commit record.  We should have
+ * cleaned up our previous buffers by now, so if we are in abort
+ * mode we can now just skip the rest of the journal write
+ * entirely.
+ *
+ * Returns 1 if the journal needs to be aborted or 0 on success
+ */
+static int journal_write_commit_record(journal_t *journal,
+                                        transaction_t *commit_transaction)
+{
+        struct journal_head *descriptor;
+        struct buffer_head *bh;
+        int i, ret;
+        int barrier_done = 0;
+
+        if (is_journal_aborted(journal))
+                return 0;
+
+        descriptor = jbd2_journal_get_descriptor_buffer(journal);
+        if (!descriptor)
+                return 1;
+
+        bh = jh2bh(descriptor);
+
+        /* AKPM: buglet - add `i' to tmp! */
+        for (i = 0; i < bh->b_size; i += 512) {
+                journal_header_t *tmp = (journal_header_t*)bh->b_data;
+                tmp->h_magic = cpu_to_be32(JBD2_MAGIC_NUMBER);
+                tmp->h_blocktype = cpu_to_be32(JBD2_COMMIT_BLOCK);
+                tmp->h_sequence = cpu_to_be32(commit_transaction->t_tid);
+        }
+
+        JBUFFER_TRACE(descriptor, "write commit block");
+        set_buffer_dirty(bh);
+        if (journal->j_flags & JBD2_BARRIER) {
+                set_buffer_ordered(bh);
+                barrier_done = 1;
+        }
+        ret = sync_dirty_buffer(bh);
+        /* is it possible for another commit to fail at roughly
+         * the same time as this one?  If so, we don't want to
+         * trust the barrier flag in the super, but instead want
+         * to remember if we sent a barrier request
+         */
+        if (ret == -EOPNOTSUPP && barrier_done) {
+                char b[BDEVNAME_SIZE];
+
+                printk(KERN_WARNING
+                        "JBD: barrier-based sync failed on %s - "
+                        "disabling barriers\n",
+                        bdevname(journal->j_dev, b));
+                spin_lock(&journal->j_state_lock);
+                journal->j_flags &= ~JBD2_BARRIER;
+                spin_unlock(&journal->j_state_lock);
+
+                /* And try again, without the barrier */
+                clear_buffer_ordered(bh);
+                set_buffer_uptodate(bh);
+                set_buffer_dirty(bh);
+                ret = sync_dirty_buffer(bh);
+        }
+        put_bh(bh);             /* One for getblk() */
+        jbd2_journal_put_journal_head(descriptor);
+
+        return (ret == -EIO);
+}
+
+static void journal_do_submit_data(struct buffer_head **wbuf, int bufs)
+{
+        int i;
+
+        for (i = 0; i < bufs; i++) {
+                wbuf[i]->b_end_io = end_buffer_write_sync;
+                /* We use-up our safety reference in submit_bh() */
+                submit_bh(WRITE, wbuf[i]);
+        }
+}
+
+/*
+ *  Submit all the data buffers to disk
+ */
+static void journal_submit_data_buffers(journal_t *journal,
+                                transaction_t *commit_transaction)
+{
+        struct journal_head *jh;
+        struct buffer_head *bh;
+        int locked;
+        int bufs = 0;
+        struct buffer_head **wbuf = journal->j_wbuf;
+
+        /*
+         * Whenever we unlock the journal and sleep, things can get added
+         * onto ->t_sync_datalist, so we have to keep looping back to
+         * write_out_data until we *know* that the list is empty.
+         *
+         * Cleanup any flushed data buffers from the data list.  Even in
+         * abort mode, we want to flush this out as soon as possible.
+         */
+write_out_data:
+        cond_resched();
+        spin_lock(&journal->j_list_lock);
+
+        while (commit_transaction->t_sync_datalist) {
+                jh = commit_transaction->t_sync_datalist;
+                bh = jh2bh(jh);
+                locked = 0;
+
+                /* Get reference just to make sure buffer does not disappear
+                 * when we are forced to drop various locks */
+                get_bh(bh);
+                /* If the buffer is dirty, we need to submit IO and hence
+                 * we need the buffer lock. We try to lock the buffer without
+                 * blocking. If we fail, we need to drop j_list_lock and do
+                 * blocking lock_buffer().
+                 */
+                if (buffer_dirty(bh)) {
+                        if (test_set_buffer_locked(bh)) {
+                                BUFFER_TRACE(bh, "needs blocking lock");
+                                spin_unlock(&journal->j_list_lock);
+                                /* Write out all data to prevent deadlocks */
+                                journal_do_submit_data(wbuf, bufs);
+                                bufs = 0;
+                                lock_buffer(bh);
+                                spin_lock(&journal->j_list_lock);
+                        }
+                        locked = 1;
+                }
+                /* We have to get bh_state lock. Again out of order, sigh. */
+                if (!inverted_lock(journal, bh)) {
+                        jbd_lock_bh_state(bh);
+                        spin_lock(&journal->j_list_lock);
+                }
+                /* Someone already cleaned up the buffer? */
+                if (!buffer_jbd(bh)
+                        || jh->b_transaction != commit_transaction
+                        || jh->b_jlist != BJ_SyncData) {
+                        jbd_unlock_bh_state(bh);
+                        if (locked)
+                                unlock_buffer(bh);
+                        BUFFER_TRACE(bh, "already cleaned up");
+                        put_bh(bh);
+                        continue;
+                }
+                if (locked && test_clear_buffer_dirty(bh)) {
+                        BUFFER_TRACE(bh, "needs writeout, adding to array");
+                        wbuf[bufs++] = bh;
+                        __jbd2_journal_file_buffer(jh, commit_transaction,
+                                                BJ_Locked);
+                        jbd_unlock_bh_state(bh);
+                        if (bufs == journal->j_wbufsize) {
+                                spin_unlock(&journal->j_list_lock);
+                                journal_do_submit_data(wbuf, bufs);
+                                bufs = 0;
+                                goto write_out_data;
+                        }
+                }
+                else {
+                        BUFFER_TRACE(bh, "writeout complete: unfile");
+                        __jbd2_journal_unfile_buffer(jh);
+                        jbd_unlock_bh_state(bh);
+                        if (locked)
+                                unlock_buffer(bh);
+                        jbd2_journal_remove_journal_head(bh);
+                        /* Once for our safety reference, once for
+                         * jbd2_journal_remove_journal_head() */
+                        put_bh(bh);
+                        put_bh(bh);
+                }
+
+                if (lock_need_resched(&journal->j_list_lock)) {
+                        spin_unlock(&journal->j_list_lock);
+                        goto write_out_data;
+                }
+        }
+        spin_unlock(&journal->j_list_lock);
+        journal_do_submit_data(wbuf, bufs);
+}
+
+static inline void write_tag_block(int tag_bytes, journal_block_tag_t *tag,
+                                   unsigned long long block)
+{
+        tag->t_blocknr = cpu_to_be32(block & (u32)~0);
+        if (tag_bytes > JBD_TAG_SIZE32)
+                tag->t_blocknr_high = cpu_to_be32((block >> 31) >> 1);
+}
+
+/*
+ * jbd2_journal_commit_transaction
+ *
+ * The primary function for committing a transaction to the log.  This
+ * function is called by the journal thread to begin a complete commit.
+ */
+void jbd2_journal_commit_transaction(journal_t *journal)
+{
+        transaction_t *commit_transaction;
+        struct journal_head *jh, *new_jh, *descriptor;
+        struct buffer_head **wbuf = journal->j_wbuf;
+        int bufs;
+        int flags;
+        int err;
+        unsigned long long blocknr;
+        char *tagp = NULL;
+        journal_header_t *header;
+        journal_block_tag_t *tag = NULL;
+        int space_left = 0;
+        int first_tag = 0;
+        int tag_flag;
+        int i;
+        int tag_bytes = journal_tag_bytes(journal);
+
+        /*
+         * First job: lock down the current transaction and wait for
+         * all outstanding updates to complete.
+         */
+
+#ifdef COMMIT_STATS
+        spin_lock(&journal->j_list_lock);
+        summarise_journal_usage(journal);
+        spin_unlock(&journal->j_list_lock);
+#endif
+
+        /* Do we need to erase the effects of a prior jbd2_journal_flush? */
+        if (journal->j_flags & JBD2_FLUSHED) {
+                jbd_debug(3, "super block updated\n");
+                jbd2_journal_update_superblock(journal, 1);
+        } else {
+                jbd_debug(3, "superblock not updated\n");
+        }
+
+        J_ASSERT(journal->j_running_transaction != NULL);
+        J_ASSERT(journal->j_committing_transaction == NULL);
+
+        commit_transaction = journal->j_running_transaction;
+        J_ASSERT(commit_transaction->t_state == T_RUNNING);
+
+        jbd_debug(1, "JBD: starting commit of transaction %d\n",
+                        commit_transaction->t_tid);
+
+        spin_lock(&journal->j_state_lock);
+        commit_transaction->t_state = T_LOCKED;
+
+        spin_lock(&commit_transaction->t_handle_lock);
+        while (commit_transaction->t_updates) {
+                DEFINE_WAIT(wait);
+
+                prepare_to_wait(&journal->j_wait_updates, &wait,
+                                        TASK_UNINTERRUPTIBLE);
+                if (commit_transaction->t_updates) {
+                        spin_unlock(&commit_transaction->t_handle_lock);
+                        spin_unlock(&journal->j_state_lock);
+                        schedule();
+                        spin_lock(&journal->j_state_lock);
+                        spin_lock(&commit_transaction->t_handle_lock);
+                }
+                finish_wait(&journal->j_wait_updates, &wait);
+        }
+        spin_unlock(&commit_transaction->t_handle_lock);
+
+        J_ASSERT (commit_transaction->t_outstanding_credits <=
+                        journal->j_max_transaction_buffers);
+
+        /*
+         * First thing we are allowed to do is to discard any remaining
+         * BJ_Reserved buffers.  Note, it is _not_ permissible to assume
+         * that there are no such buffers: if a large filesystem
+         * operation like a truncate needs to split itself over multiple
+         * transactions, then it may try to do a jbd2_journal_restart() while
+         * there are still BJ_Reserved buffers outstanding.  These must
+         * be released cleanly from the current transaction.
+         *
+         * In this case, the filesystem must still reserve write access
+         * again before modifying the buffer in the new transaction, but
+         * we do not require it to remember exactly which old buffers it
+         * has reserved.  This is consistent with the existing behaviour
+         * that multiple jbd2_journal_get_write_access() calls to the same
+         * buffer are perfectly permissable.
+         */
+        while (commit_transaction->t_reserved_list) {
+                jh = commit_transaction->t_reserved_list;
+                JBUFFER_TRACE(jh, "reserved, unused: refile");
+                /*
+                 * A jbd2_journal_get_undo_access()+jbd2_journal_release_buffer() may
+                 * leave undo-committed data.
+                 */
+                if (jh->b_committed_data) {
+                        struct buffer_head *bh = jh2bh(jh);
+
+                        jbd_lock_bh_state(bh);
+                        jbd2_slab_free(jh->b_committed_data, bh->b_size);
+                        jh->b_committed_data = NULL;
+                        jbd_unlock_bh_state(bh);
+                }
+                jbd2_journal_refile_buffer(journal, jh);
+        }
+
+        /*
+         * Now try to drop any written-back buffers from the journal's
+         * checkpoint lists.  We do this *before* commit because it potentially
+         * frees some memory
+         */
+        spin_lock(&journal->j_list_lock);
+        __jbd2_journal_clean_checkpoint_list(journal);
+        spin_unlock(&journal->j_list_lock);
+
+        jbd_debug (3, "JBD: commit phase 1\n");
+
+        /*
+         * Switch to a new revoke table.
+         */
+        jbd2_journal_switch_revoke_table(journal);
+
+        commit_transaction->t_state = T_FLUSH;
+        journal->j_committing_transaction = commit_transaction;
+        journal->j_running_transaction = NULL;
+        commit_transaction->t_log_start = journal->j_head;
+        wake_up(&journal->j_wait_transaction_locked);
+        spin_unlock(&journal->j_state_lock);
+
+        jbd_debug (3, "JBD: commit phase 2\n");
+
+        /*
+         * First, drop modified flag: all accesses to the buffers
+         * will be tracked for a new trasaction only -bzzz
+         */
+        spin_lock(&journal->j_list_lock);
+        if (commit_transaction->t_buffers) {
+                new_jh = jh = commit_transaction->t_buffers->b_tnext;
+                do {
+                        J_ASSERT_JH(new_jh, new_jh->b_modified == 1 ||
+                                        new_jh->b_modified == 0);
+                        new_jh->b_modified = 0;
+                        new_jh = new_jh->b_tnext;
+                } while (new_jh != jh);
+        }
+        spin_unlock(&journal->j_list_lock);
+
+        /*
+         * Now start flushing things to disk, in the order they appear
+         * on the transaction lists.  Data blocks go first.
+         */
+        err = 0;
+        journal_submit_data_buffers(journal, commit_transaction);
+
+        /*
+         * Wait for all previously submitted IO to complete.
+         */
+        spin_lock(&journal->j_list_lock);
+        while (commit_transaction->t_locked_list) {
+                struct buffer_head *bh;
+
+                jh = commit_transaction->t_locked_list->b_tprev;
+                bh = jh2bh(jh);
+                get_bh(bh);
+                if (buffer_locked(bh)) {
+                        spin_unlock(&journal->j_list_lock);
+                        wait_on_buffer(bh);
+                        if (unlikely(!buffer_uptodate(bh)))
+                                err = -EIO;
+                        spin_lock(&journal->j_list_lock);
+                }
+                if (!inverted_lock(journal, bh)) {
+                        put_bh(bh);
+                        spin_lock(&journal->j_list_lock);
+                        continue;
+                }
+                if (buffer_jbd(bh) && jh->b_jlist == BJ_Locked) {
+                        __jbd2_journal_unfile_buffer(jh);
+                        jbd_unlock_bh_state(bh);
+                        jbd2_journal_remove_journal_head(bh);
+                        put_bh(bh);
+                } else {
+                        jbd_unlock_bh_state(bh);
+                }
+                put_bh(bh);
+                cond_resched_lock(&journal->j_list_lock);
+        }
+        spin_unlock(&journal->j_list_lock);
+
+        if (err)
+                __jbd2_journal_abort_hard(journal);
+
+        jbd2_journal_write_revoke_records(journal, commit_transaction);
+
+        jbd_debug(3, "JBD: commit phase 2\n");
+
+        /*
+         * If we found any dirty or locked buffers, then we should have
+         * looped back up to the write_out_data label.  If there weren't
+         * any then journal_clean_data_list should have wiped the list
+         * clean by now, so check that it is in fact empty.
+         */
+        J_ASSERT (commit_transaction->t_sync_datalist == NULL);
+
+        jbd_debug (3, "JBD: commit phase 3\n");
+
+        /*
+         * Way to go: we have now written out all of the data for a
+         * transaction!  Now comes the tricky part: we need to write out
+         * metadata.  Loop over the transaction's entire buffer list:
+         */
+        commit_transaction->t_state = T_COMMIT;
+
+        descriptor = NULL;
+        bufs = 0;
+        while (commit_transaction->t_buffers) {
+
+                /* Find the next buffer to be journaled... */
+
+                jh = commit_transaction->t_buffers;
+
+                /* If we're in abort mode, we just un-journal the buffer and
+                   release it for background writing. */
+
+                if (is_journal_aborted(journal)) {
+                        JBUFFER_TRACE(jh, "journal is aborting: refile");
+                        jbd2_journal_refile_buffer(journal, jh);
+                        /* If that was the last one, we need to clean up
+                         * any descriptor buffers which may have been
+                         * already allocated, even if we are now
+                         * aborting. */
+                        if (!commit_transaction->t_buffers)
+                                goto start_journal_io;
+                        continue;
+                }
+
+                /* Make sure we have a descriptor block in which to
+                   record the metadata buffer. */
+
+                if (!descriptor) {
+                        struct buffer_head *bh;
+
+                        J_ASSERT (bufs == 0);
+
+                        jbd_debug(4, "JBD: get descriptor\n");
+
+                        descriptor = jbd2_journal_get_descriptor_buffer(journal);
+                        if (!descriptor) {
+                                __jbd2_journal_abort_hard(journal);
+                                continue;
+                        }
+
+                        bh = jh2bh(descriptor);
+                        jbd_debug(4, "JBD: got buffer %llu (%p)\n",
+                                (unsigned long long)bh->b_blocknr, bh->b_data);
+                        header = (journal_header_t *)&bh->b_data[0];
+                        header->h_magic     = cpu_to_be32(JBD2_MAGIC_NUMBER);
+                        header->h_blocktype = cpu_to_be32(JBD2_DESCRIPTOR_BLOCK);
+                        header->h_sequence  = cpu_to_be32(commit_transaction->t_tid);
+
+                        tagp = &bh->b_data[sizeof(journal_header_t)];
+                        space_left = bh->b_size - sizeof(journal_header_t);
+                        first_tag = 1;
+                        set_buffer_jwrite(bh);
+                        set_buffer_dirty(bh);
+                        wbuf[bufs++] = bh;
+
+                        /* Record it so that we can wait for IO
+                           completion later */
+                        BUFFER_TRACE(bh, "ph3: file as descriptor");
+                        jbd2_journal_file_buffer(descriptor, commit_transaction,
+                                        BJ_LogCtl);
+                }
+
+                /* Where is the buffer to be written? */
+
+                err = jbd2_journal_next_log_block(journal, &blocknr);
+                /* If the block mapping failed, just abandon the buffer
+                   and repeat this loop: we'll fall into the
+                   refile-on-abort condition above. */
+                if (err) {
+                        __jbd2_journal_abort_hard(journal);
+                        continue;
+                }
+
+                /*
+                 * start_this_handle() uses t_outstanding_credits to determine
+                 * the free space in the log, but this counter is changed
+                 * by jbd2_journal_next_log_block() also.
+                 */
+                commit_transaction->t_outstanding_credits--;
+
+                /* Bump b_count to prevent truncate from stumbling over
+                   the shadowed buffer!  @@@ This can go if we ever get
+                   rid of the BJ_IO/BJ_Shadow pairing of buffers. */
+                atomic_inc(&jh2bh(jh)->b_count);
+
+                /* Make a temporary IO buffer with which to write it out
+                   (this will requeue both the metadata buffer and the
+                   temporary IO buffer). new_bh goes on BJ_IO*/
+
+                set_bit(BH_JWrite, &jh2bh(jh)->b_state);
+                /*
+                 * akpm: jbd2_journal_write_metadata_buffer() sets
+                 * new_bh->b_transaction to commit_transaction.
+                 * We need to clean this up before we release new_bh
+                 * (which is of type BJ_IO)
+                 */
+                JBUFFER_TRACE(jh, "ph3: write metadata");
+                flags = jbd2_journal_write_metadata_buffer(commit_transaction,
+                                                      jh, &new_jh, blocknr);
+                set_bit(BH_JWrite, &jh2bh(new_jh)->b_state);
+                wbuf[bufs++] = jh2bh(new_jh);
+
+                /* Record the new block's tag in the current descriptor
+                   buffer */
+
+                tag_flag = 0;
+                if (flags & 1)
+                        tag_flag |= JBD2_FLAG_ESCAPE;
+                if (!first_tag)
+                        tag_flag |= JBD2_FLAG_SAME_UUID;
+
+                tag = (journal_block_tag_t *) tagp;
+                write_tag_block(tag_bytes, tag, jh2bh(jh)->b_blocknr);
+                tag->t_flags = cpu_to_be32(tag_flag);
+                tagp += tag_bytes;
+                space_left -= tag_bytes;
+
+                if (first_tag) {
+                        memcpy (tagp, journal->j_uuid, 16);
+                        tagp += 16;
+                        space_left -= 16;
+                        first_tag = 0;
+                }
+
+                /* If there's no more to do, or if the descriptor is full,
+                   let the IO rip! */
+
+                if (bufs == journal->j_wbufsize ||
+                    commit_transaction->t_buffers == NULL ||
+                    space_left < tag_bytes + 16) {
+
+                        jbd_debug(4, "JBD: Submit %d IOs\n", bufs);
+
+                        /* Write an end-of-descriptor marker before
+                           submitting the IOs.  "tag" still points to
+                           the last tag we set up. */
+
+                        tag->t_flags |= cpu_to_be32(JBD2_FLAG_LAST_TAG);
+
+start_journal_io:
+                        for (i = 0; i < bufs; i++) {
+                                struct buffer_head *bh = wbuf[i];
+                                lock_buffer(bh);
+                                clear_buffer_dirty(bh);
+                                set_buffer_uptodate(bh);
+                                bh->b_end_io = journal_end_buffer_io_sync;
+                                submit_bh(WRITE, bh);
+                        }
+                        cond_resched();
+
+                        /* Force a new descriptor to be generated next
+                           time round the loop. */
+                        descriptor = NULL;
+                        bufs = 0;
+                }
+        }
+
+        /* Lo and behold: we have just managed to send a transaction to
+           the log.  Before we can commit it, wait for the IO so far to
+           complete.  Control buffers being written are on the
+           transaction's t_log_list queue, and metadata buffers are on
+           the t_iobuf_list queue.
+
+           Wait for the buffers in reverse order.  That way we are
+           less likely to be woken up until all IOs have completed, and
+           so we incur less scheduling load.
+        */
+
+        jbd_debug(3, "JBD: commit phase 4\n");
+
+        /*
+         * akpm: these are BJ_IO, and j_list_lock is not needed.
+         * See __journal_try_to_free_buffer.
+         */
+wait_for_iobuf:
+        while (commit_transaction->t_iobuf_list != NULL) {
+                struct buffer_head *bh;
+
+                jh = commit_transaction->t_iobuf_list->b_tprev;
+                bh = jh2bh(jh);
+                if (buffer_locked(bh)) {
+                        wait_on_buffer(bh);
+                        goto wait_for_iobuf;
+                }
+                if (cond_resched())
+                        goto wait_for_iobuf;
+
+                if (unlikely(!buffer_uptodate(bh)))
+                        err = -EIO;
+
+                clear_buffer_jwrite(bh);
+
+                JBUFFER_TRACE(jh, "ph4: unfile after journal write");
+                jbd2_journal_unfile_buffer(journal, jh);
+
+                /*
+                 * ->t_iobuf_list should contain only dummy buffer_heads
+                 * which were created by jbd2_journal_write_metadata_buffer().
+                 */
+                BUFFER_TRACE(bh, "dumping temporary bh");
+                jbd2_journal_put_journal_head(jh);
+                __brelse(bh);
+                J_ASSERT_BH(bh, atomic_read(&bh->b_count) == 0);
+                free_buffer_head(bh);
+
+                /* We also have to unlock and free the corresponding
+                   shadowed buffer */
+                jh = commit_transaction->t_shadow_list->b_tprev;
+                bh = jh2bh(jh);
+                clear_bit(BH_JWrite, &bh->b_state);
+                J_ASSERT_BH(bh, buffer_jbddirty(bh));
+
+                /* The metadata is now released for reuse, but we need
+                   to remember it against this transaction so that when
+                   we finally commit, we can do any checkpointing
+                   required. */
+                JBUFFER_TRACE(jh, "file as BJ_Forget");
+                jbd2_journal_file_buffer(jh, commit_transaction, BJ_Forget);
+                /* Wake up any transactions which were waiting for this
+                   IO to complete */
+                wake_up_bit(&bh->b_state, BH_Unshadow);
+                JBUFFER_TRACE(jh, "brelse shadowed buffer");
+                __brelse(bh);
+        }
+
+        J_ASSERT (commit_transaction->t_shadow_list == NULL);
+
+        jbd_debug(3, "JBD: commit phase 5\n");
+
+        /* Here we wait for the revoke record and descriptor record buffers */
+ wait_for_ctlbuf:
+        while (commit_transaction->t_log_list != NULL) {
+                struct buffer_head *bh;
+
+                jh = commit_transaction->t_log_list->b_tprev;
+                bh = jh2bh(jh);
+                if (buffer_locked(bh)) {
+                        wait_on_buffer(bh);
+                        goto wait_for_ctlbuf;
+                }
+                if (cond_resched())
+                        goto wait_for_ctlbuf;
+
+                if (unlikely(!buffer_uptodate(bh)))
+                        err = -EIO;
+
+                BUFFER_TRACE(bh, "ph5: control buffer writeout done: unfile");
+                clear_buffer_jwrite(bh);
+                jbd2_journal_unfile_buffer(journal, jh);
+                jbd2_journal_put_journal_head(jh);
+                __brelse(bh);           /* One for getblk */
+                /* AKPM: bforget here */
+        }
+
+        jbd_debug(3, "JBD: commit phase 6\n");
+
+        if (journal_write_commit_record(journal, commit_transaction))
+                err = -EIO;
+
+        if (err)
+                __jbd2_journal_abort_hard(journal);
+
+        /* End of a transaction!  Finally, we can do checkpoint
+           processing: any buffers committed as a result of this
+           transaction can be removed from any checkpoint list it was on
+           before. */
+
+        jbd_debug(3, "JBD: commit phase 7\n");
+
+        J_ASSERT(commit_transaction->t_sync_datalist == NULL);
+        J_ASSERT(commit_transaction->t_buffers == NULL);
+        J_ASSERT(commit_transaction->t_checkpoint_list == NULL);
+        J_ASSERT(commit_transaction->t_iobuf_list == NULL);
+        J_ASSERT(commit_transaction->t_shadow_list == NULL);
+        J_ASSERT(commit_transaction->t_log_list == NULL);
+
+restart_loop:
+        /*
+         * As there are other places (journal_unmap_buffer()) adding buffers
+         * to this list we have to be careful and hold the j_list_lock.
+         */
+        spin_lock(&journal->j_list_lock);
+        while (commit_transaction->t_forget) {
+                transaction_t *cp_transaction;
+                struct buffer_head *bh;
+
+                jh = commit_transaction->t_forget;
+                spin_unlock(&journal->j_list_lock);
+                bh = jh2bh(jh);
+                jbd_lock_bh_state(bh);
+                J_ASSERT_JH(jh, jh->b_transaction == commit_transaction ||
+                        jh->b_transaction == journal->j_running_transaction);
+
+                /*
+                 * If there is undo-protected committed data against
+                 * this buffer, then we can remove it now.  If it is a
+                 * buffer needing such protection, the old frozen_data
+                 * field now points to a committed version of the
+                 * buffer, so rotate that field to the new committed
+                 * data.
+                 *
+                 * Otherwise, we can just throw away the frozen data now.
+                 */
+                if (jh->b_committed_data) {
+                        jbd2_slab_free(jh->b_committed_data, bh->b_size);
+                        jh->b_committed_data = NULL;
+                        if (jh->b_frozen_data) {
+                                jh->b_committed_data = jh->b_frozen_data;
+                                jh->b_frozen_data = NULL;
+                        }
+                } else if (jh->b_frozen_data) {
+                        jbd2_slab_free(jh->b_frozen_data, bh->b_size);
+                        jh->b_frozen_data = NULL;
+                }
+
+                spin_lock(&journal->j_list_lock);
+                cp_transaction = jh->b_cp_transaction;
+                if (cp_transaction) {
+                        JBUFFER_TRACE(jh, "remove from old cp transaction");
+                        __jbd2_journal_remove_checkpoint(jh);
+                }
+
+                /* Only re-checkpoint the buffer_head if it is marked
+                 * dirty.  If the buffer was added to the BJ_Forget list
+                 * by jbd2_journal_forget, it may no longer be dirty and
+                 * there's no point in keeping a checkpoint record for
+                 * it. */
+
+                /* A buffer which has been freed while still being
+                 * journaled by a previous transaction may end up still
+                 * being dirty here, but we want to avoid writing back
+                 * that buffer in the future now that the last use has
+                 * been committed.  That's not only a performance gain,
+                 * it also stops aliasing problems if the buffer is left
+                 * behind for writeback and gets reallocated for another
+                 * use in a different page. */
+                if (buffer_freed(bh)) {
+                        clear_buffer_freed(bh);
+                        clear_buffer_jbddirty(bh);
+                }
+
+                if (buffer_jbddirty(bh)) {
+                        JBUFFER_TRACE(jh, "add to new checkpointing trans");
+                        __jbd2_journal_insert_checkpoint(jh, commit_transaction);
+                        JBUFFER_TRACE(jh, "refile for checkpoint writeback");
+                        __jbd2_journal_refile_buffer(jh);
+                        jbd_unlock_bh_state(bh);
+                } else {
+                        J_ASSERT_BH(bh, !buffer_dirty(bh));
+                        /* The buffer on BJ_Forget list and not jbddirty means
+                         * it has been freed by this transaction and hence it
+                         * could not have been reallocated until this
+                         * transaction has committed. *BUT* it could be
+                         * reallocated once we have written all the data to
+                         * disk and before we process the buffer on BJ_Forget
+                         * list. */
+                        JBUFFER_TRACE(jh, "refile or unfile freed buffer");
+                        __jbd2_journal_refile_buffer(jh);
+                        if (!jh->b_transaction) {
+                                jbd_unlock_bh_state(bh);
+                                 /* needs a brelse */
+                                jbd2_journal_remove_journal_head(bh);
+                                release_buffer_page(bh);
+                        } else
+                                jbd_unlock_bh_state(bh);
+                }
+                cond_resched_lock(&journal->j_list_lock);
+        }
+        spin_unlock(&journal->j_list_lock);
+        /*
+         * This is a bit sleazy.  We borrow j_list_lock to protect
+         * journal->j_committing_transaction in __jbd2_journal_remove_checkpoint.
+         * Really, __jbd2_journal_remove_checkpoint should be using j_state_lock but
+         * it's a bit hassle to hold that across __jbd2_journal_remove_checkpoint
+         */
+        spin_lock(&journal->j_state_lock);
+        spin_lock(&journal->j_list_lock);
+        /*
+         * Now recheck if some buffers did not get attached to the transaction
+         * while the lock was dropped...
+         */
+        if (commit_transaction->t_forget) {
+                spin_unlock(&journal->j_list_lock);
+                spin_unlock(&journal->j_state_lock);
+                goto restart_loop;
+        }
+
+        /* Done with this transaction! */
+
+        jbd_debug(3, "JBD: commit phase 8\n");
+
+        J_ASSERT(commit_transaction->t_state == T_COMMIT);
+
+        commit_transaction->t_state = T_FINISHED;
+        J_ASSERT(commit_transaction == journal->j_committing_transaction);
+        journal->j_commit_sequence = commit_transaction->t_tid;
+        journal->j_committing_transaction = NULL;
+        spin_unlock(&journal->j_state_lock);
+
+        if (commit_transaction->t_checkpoint_list == NULL) {
+                __jbd2_journal_drop_transaction(journal, commit_transaction);
+        } else {
+                if (journal->j_checkpoint_transactions == NULL) {
+                        journal->j_checkpoint_transactions = commit_transaction;
+                        commit_transaction->t_cpnext = commit_transaction;
+                        commit_transaction->t_cpprev = commit_transaction;
+                } else {
+                        commit_transaction->t_cpnext =
+                                journal->j_checkpoint_transactions;
+                        commit_transaction->t_cpprev =
+                                commit_transaction->t_cpnext->t_cpprev;
+                        commit_transaction->t_cpnext->t_cpprev =
+                                commit_transaction;
+                        commit_transaction->t_cpprev->t_cpnext =
+                                commit_transaction;
+                }
+        }
+        spin_unlock(&journal->j_list_lock);
+
+        jbd_debug(1, "JBD: commit %d complete, head %d\n",
+                  journal->j_commit_sequence, journal->j_tail_sequence);
+
+        wake_up(&journal->j_wait_done_commit);
+}
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
new file mode 100644
index 000000000000..c60f378b0f76
--- /dev/null
+++ b/fs/jbd2/journal.c
@@ -0,0 +1,2084 @@
+/*
+ * linux/fs/jbd2/journal.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1998
+ *
+ * Copyright 1998 Red Hat corp --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Generic filesystem journal-writing code; part of the ext2fs
+ * journaling system.
+ *
+ * This file manages journals: areas of disk reserved for logging
+ * transactional updates.  This includes the kernel journaling thread
+ * which is responsible for scheduling updates to the log.
+ *
+ * We do not actually manage the physical storage of the journal in this
+ * file: that is left to a per-journal policy function, which allows us
+ * to store the journal within a filesystem-specified area for ext2
+ * journaling (ext2 can use a reserved inode for storing the log).
+ */
+
+#include <linux/module.h>
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/smp_lock.h>
+#include <linux/init.h>
+#include <linux/mm.h>
+#include <linux/suspend.h>
+#include <linux/pagemap.h>
+#include <linux/kthread.h>
+#include <linux/poison.h>
+#include <linux/proc_fs.h>
+
+#include <asm/uaccess.h>
+#include <asm/page.h>
+
+EXPORT_SYMBOL(jbd2_journal_start);
+EXPORT_SYMBOL(jbd2_journal_restart);
+EXPORT_SYMBOL(jbd2_journal_extend);
+EXPORT_SYMBOL(jbd2_journal_stop);
+EXPORT_SYMBOL(jbd2_journal_lock_updates);
+EXPORT_SYMBOL(jbd2_journal_unlock_updates);
+EXPORT_SYMBOL(jbd2_journal_get_write_access);
+EXPORT_SYMBOL(jbd2_journal_get_create_access);
+EXPORT_SYMBOL(jbd2_journal_get_undo_access);
+EXPORT_SYMBOL(jbd2_journal_dirty_data);
+EXPORT_SYMBOL(jbd2_journal_dirty_metadata);
+EXPORT_SYMBOL(jbd2_journal_release_buffer);
+EXPORT_SYMBOL(jbd2_journal_forget);
+#if 0
+EXPORT_SYMBOL(journal_sync_buffer);
+#endif
+EXPORT_SYMBOL(jbd2_journal_flush);
+EXPORT_SYMBOL(jbd2_journal_revoke);
+
+EXPORT_SYMBOL(jbd2_journal_init_dev);
+EXPORT_SYMBOL(jbd2_journal_init_inode);
+EXPORT_SYMBOL(jbd2_journal_update_format);
+EXPORT_SYMBOL(jbd2_journal_check_used_features);
+EXPORT_SYMBOL(jbd2_journal_check_available_features);
+EXPORT_SYMBOL(jbd2_journal_set_features);
+EXPORT_SYMBOL(jbd2_journal_create);
+EXPORT_SYMBOL(jbd2_journal_load);
+EXPORT_SYMBOL(jbd2_journal_destroy);
+EXPORT_SYMBOL(jbd2_journal_update_superblock);
+EXPORT_SYMBOL(jbd2_journal_abort);
+EXPORT_SYMBOL(jbd2_journal_errno);
+EXPORT_SYMBOL(jbd2_journal_ack_err);
+EXPORT_SYMBOL(jbd2_journal_clear_err);
+EXPORT_SYMBOL(jbd2_log_wait_commit);
+EXPORT_SYMBOL(jbd2_journal_start_commit);
+EXPORT_SYMBOL(jbd2_journal_force_commit_nested);
+EXPORT_SYMBOL(jbd2_journal_wipe);
+EXPORT_SYMBOL(jbd2_journal_blocks_per_page);
+EXPORT_SYMBOL(jbd2_journal_invalidatepage);
+EXPORT_SYMBOL(jbd2_journal_try_to_free_buffers);
+EXPORT_SYMBOL(jbd2_journal_force_commit);
+
+static int journal_convert_superblock_v1(journal_t *, journal_superblock_t *);
+static void __journal_abort_soft (journal_t *journal, int errno);
+static int jbd2_journal_create_jbd_slab(size_t slab_size);
+
+/*
+ * Helper function used to manage commit timeouts
+ */
+
+static void commit_timeout(unsigned long __data)
+{
+        struct task_struct * p = (struct task_struct *) __data;
+
+        wake_up_process(p);
+}
+
+/*
+ * kjournald2: The main thread function used to manage a logging device
+ * journal.
+ *
+ * This kernel thread is responsible for two things:
+ *
+ * 1) COMMIT:  Every so often we need to commit the current state of the
+ *    filesystem to disk.  The journal thread is responsible for writing
+ *    all of the metadata buffers to disk.
+ *
+ * 2) CHECKPOINT: We cannot reuse a used section of the log file until all
+ *    of the data in that part of the log has been rewritten elsewhere on
+ *    the disk.  Flushing these old buffers to reclaim space in the log is
+ *    known as checkpointing, and this thread is responsible for that job.
+ */
+
+static int kjournald2(void *arg)
+{
+        journal_t *journal = arg;
+        transaction_t *transaction;
+
+        /*
+         * Set up an interval timer which can be used to trigger a commit wakeup
+         * after the commit interval expires
+         */
+        setup_timer(&journal->j_commit_timer, commit_timeout,
+                        (unsigned long)current);
+
+        /* Record that the journal thread is running */
+        journal->j_task = current;
+        wake_up(&journal->j_wait_done_commit);
+
+        printk(KERN_INFO "kjournald2 starting.  Commit interval %ld seconds\n",
+                        journal->j_commit_interval / HZ);
+
+        /*
+         * And now, wait forever for commit wakeup events.
+         */
+        spin_lock(&journal->j_state_lock);
+
+loop:
+        if (journal->j_flags & JBD2_UNMOUNT)
+                goto end_loop;
+
+        jbd_debug(1, "commit_sequence=%d, commit_request=%d\n",
+                journal->j_commit_sequence, journal->j_commit_request);
+
+        if (journal->j_commit_sequence != journal->j_commit_request) {
+                jbd_debug(1, "OK, requests differ\n");
+                spin_unlock(&journal->j_state_lock);
+                del_timer_sync(&journal->j_commit_timer);
+                jbd2_journal_commit_transaction(journal);
+                spin_lock(&journal->j_state_lock);
+                goto loop;
+        }
+
+        wake_up(&journal->j_wait_done_commit);
+        if (freezing(current)) {
+                /*
+                 * The simpler the better. Flushing journal isn't a
+                 * good idea, because that depends on threads that may
+                 * be already stopped.
+                 */
+                jbd_debug(1, "Now suspending kjournald2\n");
+                spin_unlock(&journal->j_state_lock);
+                refrigerator();
+                spin_lock(&journal->j_state_lock);
+        } else {
+                /*
+                 * We assume on resume that commits are already there,
+                 * so we don't sleep
+                 */
+                DEFINE_WAIT(wait);
+                int should_sleep = 1;
+
+                prepare_to_wait(&journal->j_wait_commit, &wait,
+                                TASK_INTERRUPTIBLE);
+                if (journal->j_commit_sequence != journal->j_commit_request)
+                        should_sleep = 0;
+                transaction = journal->j_running_transaction;
+                if (transaction && time_after_eq(jiffies,
+                                                transaction->t_expires))
+                        should_sleep = 0;
+                if (journal->j_flags & JBD2_UNMOUNT)
+                        should_sleep = 0;
+                if (should_sleep) {
+                        spin_unlock(&journal->j_state_lock);
+                        schedule();
+                        spin_lock(&journal->j_state_lock);
+                }
+                finish_wait(&journal->j_wait_commit, &wait);
+        }
+
+        jbd_debug(1, "kjournald2 wakes\n");
+
+        /*
+         * Were we woken up by a commit wakeup event?
+         */
+        transaction = journal->j_running_transaction;
+        if (transaction && time_after_eq(jiffies, transaction->t_expires)) {
+                journal->j_commit_request = transaction->t_tid;
+                jbd_debug(1, "woke because of timeout\n");
+        }
+        goto loop;
+
+end_loop:
+        spin_unlock(&journal->j_state_lock);
+        del_timer_sync(&journal->j_commit_timer);
+        journal->j_task = NULL;
+        wake_up(&journal->j_wait_done_commit);
+        jbd_debug(1, "Journal thread exiting.\n");
+        return 0;
+}
+
+static void jbd2_journal_start_thread(journal_t *journal)
+{
+        kthread_run(kjournald2, journal, "kjournald2");
+        wait_event(journal->j_wait_done_commit, journal->j_task != 0);
+}
+
+static void journal_kill_thread(journal_t *journal)
+{
+        spin_lock(&journal->j_state_lock);
+        journal->j_flags |= JBD2_UNMOUNT;
+
+        while (journal->j_task) {
+                wake_up(&journal->j_wait_commit);
+                spin_unlock(&journal->j_state_lock);
+                wait_event(journal->j_wait_done_commit, journal->j_task == 0);
+                spin_lock(&journal->j_state_lock);
+        }
+        spin_unlock(&journal->j_state_lock);
+}
+
+/*
+ * jbd2_journal_write_metadata_buffer: write a metadata buffer to the journal.
+ *
+ * Writes a metadata buffer to a given disk block.  The actual IO is not
+ * performed but a new buffer_head is constructed which labels the data
+ * to be written with the correct destination disk block.
+ *
+ * Any magic-number escaping which needs to be done will cause a
+ * copy-out here.  If the buffer happens to start with the
+ * JBD2_MAGIC_NUMBER, then we can't write it to the log directly: the
+ * magic number is only written to the log for descripter blocks.  In
+ * this case, we copy the data and replace the first word with 0, and we
+ * return a result code which indicates that this buffer needs to be
+ * marked as an escaped buffer in the corresponding log descriptor
+ * block.  The missing word can then be restored when the block is read
+ * during recovery.
+ *
+ * If the source buffer has already been modified by a new transaction
+ * since we took the last commit snapshot, we use the frozen copy of
+ * that data for IO.  If we end up using the existing buffer_head's data
+ * for the write, then we *have* to lock the buffer to prevent anyone
+ * else from using and possibly modifying it while the IO is in
+ * progress.
+ *
+ * The function returns a pointer to the buffer_heads to be used for IO.
+ *
+ * We assume that the journal has already been locked in this function.
+ *
+ * Return value:
+ *  <0: Error
+ * >=0: Finished OK
+ *
+ * On success:
+ * Bit 0 set == escape performed on the data
+ * Bit 1 set == buffer copy-out performed (kfree the data after IO)
+ */
+
+int jbd2_journal_write_metadata_buffer(transaction_t *transaction,
+                                  struct journal_head  *jh_in,
+                                  struct journal_head **jh_out,
+                                  unsigned long long blocknr)
+{
+        int need_copy_out = 0;
+        int done_copy_out = 0;
+        int do_escape = 0;
+        char *mapped_data;
+        struct buffer_head *new_bh;
+        struct journal_head *new_jh;
+        struct page *new_page;
+        unsigned int new_offset;
+        struct buffer_head *bh_in = jh2bh(jh_in);
+
+        /*
+         * The buffer really shouldn't be locked: only the current committing
+         * transaction is allowed to write it, so nobody else is allowed
+         * to do any IO.
+         *
+         * akpm: except if we're journalling data, and write() output is
+         * also part of a shared mapping, and another thread has
+         * decided to launch a writepage() against this buffer.
+         */
+        J_ASSERT_BH(bh_in, buffer_jbddirty(bh_in));
+
+        new_bh = alloc_buffer_head(GFP_NOFS|__GFP_NOFAIL);
+
+        /*
+         * If a new transaction has already done a buffer copy-out, then
+         * we use that version of the data for the commit.
+         */
+        jbd_lock_bh_state(bh_in);
+repeat:
+        if (jh_in->b_frozen_data) {
+                done_copy_out = 1;
+                new_page = virt_to_page(jh_in->b_frozen_data);
+                new_offset = offset_in_page(jh_in->b_frozen_data);
+        } else {
+                new_page = jh2bh(jh_in)->b_page;
+                new_offset = offset_in_page(jh2bh(jh_in)->b_data);
+        }
+
+        mapped_data = kmap_atomic(new_page, KM_USER0);
+        /*
+         * Check for escaping
+         */
+        if (*((__be32 *)(mapped_data + new_offset)) ==
+                                cpu_to_be32(JBD2_MAGIC_NUMBER)) {
+                need_copy_out = 1;
+                do_escape = 1;
+        }
+        kunmap_atomic(mapped_data, KM_USER0);
+
+        /*
+         * Do we need to do a data copy?
+         */
+        if (need_copy_out && !done_copy_out) {
+                char *tmp;
+
+                jbd_unlock_bh_state(bh_in);
+                tmp = jbd2_slab_alloc(bh_in->b_size, GFP_NOFS);
+                jbd_lock_bh_state(bh_in);
+                if (jh_in->b_frozen_data) {
+                        jbd2_slab_free(tmp, bh_in->b_size);
+                        goto repeat;
+                }
+
+                jh_in->b_frozen_data = tmp;
+                mapped_data = kmap_atomic(new_page, KM_USER0);
+                memcpy(tmp, mapped_data + new_offset, jh2bh(jh_in)->b_size);
+                kunmap_atomic(mapped_data, KM_USER0);
+
+                new_page = virt_to_page(tmp);
+                new_offset = offset_in_page(tmp);
+                done_copy_out = 1;
+        }
+
+        /*
+         * Did we need to do an escaping?  Now we've done all the
+         * copying, we can finally do so.
+         */
+        if (do_escape) {
+                mapped_data = kmap_atomic(new_page, KM_USER0);
+                *((unsigned int *)(mapped_data + new_offset)) = 0;
+                kunmap_atomic(mapped_data, KM_USER0);
+        }
+
+        /* keep subsequent assertions sane */
+        new_bh->b_state = 0;
+        init_buffer(new_bh, NULL, NULL);
+        atomic_set(&new_bh->b_count, 1);
+        jbd_unlock_bh_state(bh_in);
+
+        new_jh = jbd2_journal_add_journal_head(new_bh); /* This sleeps */
+
+        set_bh_page(new_bh, new_page, new_offset);
+        new_jh->b_transaction = NULL;
+        new_bh->b_size = jh2bh(jh_in)->b_size;
+        new_bh->b_bdev = transaction->t_journal->j_dev;
+        new_bh->b_blocknr = blocknr;
+        set_buffer_mapped(new_bh);
+        set_buffer_dirty(new_bh);
+
+        *jh_out = new_jh;
+
+        /*
+         * The to-be-written buffer needs to get moved to the io queue,
+         * and the original buffer whose contents we are shadowing or
+         * copying is moved to the transaction's shadow queue.
+         */
+        JBUFFER_TRACE(jh_in, "file as BJ_Shadow");
+        jbd2_journal_file_buffer(jh_in, transaction, BJ_Shadow);
+        JBUFFER_TRACE(new_jh, "file as BJ_IO");
+        jbd2_journal_file_buffer(new_jh, transaction, BJ_IO);
+
+        return do_escape | (done_copy_out << 1);
+}
+
+/*
+ * Allocation code for the journal file.  Manage the space left in the
+ * journal, so that we can begin checkpointing when appropriate.
+ */
+
+/*
+ * __jbd2_log_space_left: Return the number of free blocks left in the journal.
+ *
+ * Called with the journal already locked.
+ *
+ * Called under j_state_lock
+ */
+
+int __jbd2_log_space_left(journal_t *journal)
+{
+        int left = journal->j_free;
+
+        assert_spin_locked(&journal->j_state_lock);
+
+        /*
+         * Be pessimistic here about the number of those free blocks which
+         * might be required for log descriptor control blocks.
+         */
+
+#define MIN_LOG_RESERVED_BLOCKS 32 /* Allow for rounding errors */
+
+        left -= MIN_LOG_RESERVED_BLOCKS;
+
+        if (left <= 0)
+                return 0;
+        left -= (left >> 3);
+        return left;
+}
+
+/*
+ * Called under j_state_lock.  Returns true if a transaction was started.
+ */
+int __jbd2_log_start_commit(journal_t *journal, tid_t target)
+{
+        /*
+         * Are we already doing a recent enough commit?
+         */
+        if (!tid_geq(journal->j_commit_request, target)) {
+                /*
+                 * We want a new commit: OK, mark the request and wakup the
+                 * commit thread.  We do _not_ do the commit ourselves.
+                 */
+
+                journal->j_commit_request = target;
+                jbd_debug(1, "JBD: requesting commit %d/%d\n",
+                          journal->j_commit_request,
+                          journal->j_commit_sequence);
+                wake_up(&journal->j_wait_commit);
+                return 1;
+        }
+        return 0;
+}
+
+int jbd2_log_start_commit(journal_t *journal, tid_t tid)
+{
+        int ret;
+
+        spin_lock(&journal->j_state_lock);
+        ret = __jbd2_log_start_commit(journal, tid);
+        spin_unlock(&journal->j_state_lock);
+        return ret;
+}
+
+/*
+ * Force and wait upon a commit if the calling process is not within
+ * transaction.  This is used for forcing out undo-protected data which contains
+ * bitmaps, when the fs is running out of space.
+ *
+ * We can only force the running transaction if we don't have an active handle;
+ * otherwise, we will deadlock.
+ *
+ * Returns true if a transaction was started.
+ */
+int jbd2_journal_force_commit_nested(journal_t *journal)
+{
+        transaction_t *transaction = NULL;
+        tid_t tid;
+
+        spin_lock(&journal->j_state_lock);
+        if (journal->j_running_transaction && !current->journal_info) {
+                transaction = journal->j_running_transaction;
+                __jbd2_log_start_commit(journal, transaction->t_tid);
+        } else if (journal->j_committing_transaction)
+                transaction = journal->j_committing_transaction;
+
+        if (!transaction) {
+                spin_unlock(&journal->j_state_lock);
+                return 0;       /* Nothing to retry */
+        }
+
+        tid = transaction->t_tid;
+        spin_unlock(&journal->j_state_lock);
+        jbd2_log_wait_commit(journal, tid);
+        return 1;
+}
+
+/*
+ * Start a commit of the current running transaction (if any).  Returns true
+ * if a transaction was started, and fills its tid in at *ptid
+ */
+int jbd2_journal_start_commit(journal_t *journal, tid_t *ptid)
+{
+        int ret = 0;
+
+        spin_lock(&journal->j_state_lock);
+        if (journal->j_running_transaction) {
+                tid_t tid = journal->j_running_transaction->t_tid;
+
+                ret = __jbd2_log_start_commit(journal, tid);
+                if (ret && ptid)
+                        *ptid = tid;
+        } else if (journal->j_committing_transaction && ptid) {
+                /*
+                 * If ext3_write_super() recently started a commit, then we
+                 * have to wait for completion of that transaction
+                 */
+                *ptid = journal->j_committing_transaction->t_tid;
+                ret = 1;
+        }
+        spin_unlock(&journal->j_state_lock);
+        return ret;
+}
+
+/*
+ * Wait for a specified commit to complete.
+ * The caller may not hold the journal lock.
+ */
+int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
+{
+        int err = 0;
+
+#ifdef CONFIG_JBD_DEBUG
+        spin_lock(&journal->j_state_lock);
+        if (!tid_geq(journal->j_commit_request, tid)) {
+                printk(KERN_EMERG
+                       "%s: error: j_commit_request=%d, tid=%d\n",
+                       __FUNCTION__, journal->j_commit_request, tid);
+        }
+        spin_unlock(&journal->j_state_lock);
+#endif
+        spin_lock(&journal->j_state_lock);
+        while (tid_gt(tid, journal->j_commit_sequence)) {
+                jbd_debug(1, "JBD: want %d, j_commit_sequence=%d\n",
+                                  tid, journal->j_commit_sequence);
+                wake_up(&journal->j_wait_commit);
+                spin_unlock(&journal->j_state_lock);
+                wait_event(journal->j_wait_done_commit,
+                                !tid_gt(tid, journal->j_commit_sequence));
+                spin_lock(&journal->j_state_lock);
+        }
+        spin_unlock(&journal->j_state_lock);
+
+        if (unlikely(is_journal_aborted(journal))) {
+                printk(KERN_EMERG "journal commit I/O error\n");
+                err = -EIO;
+        }
+        return err;
+}
+
+/*
+ * Log buffer allocation routines:
+ */
+
+int jbd2_journal_next_log_block(journal_t *journal, unsigned long long *retp)
+{
+        unsigned long blocknr;
+
+        spin_lock(&journal->j_state_lock);
+        J_ASSERT(journal->j_free > 1);
+
+        blocknr = journal->j_head;
+        journal->j_head++;
+        journal->j_free--;
+        if (journal->j_head == journal->j_last)
+                journal->j_head = journal->j_first;
+        spin_unlock(&journal->j_state_lock);
+        return jbd2_journal_bmap(journal, blocknr, retp);
+}
+
+/*
+ * Conversion of logical to physical block numbers for the journal
+ *
+ * On external journals the journal blocks are identity-mapped, so
+ * this is a no-op.  If needed, we can use j_blk_offset - everything is
+ * ready.
+ */
+int jbd2_journal_bmap(journal_t *journal, unsigned long blocknr,
+                 unsigned long long *retp)
+{
+        int err = 0;
+        unsigned long long ret;
+
+        if (journal->j_inode) {
+                ret = bmap(journal->j_inode, blocknr);
+                if (ret)
+                        *retp = ret;
+                else {
+                        char b[BDEVNAME_SIZE];
+
+                        printk(KERN_ALERT "%s: journal block not found "
+                                        "at offset %lu on %s\n",
+                                __FUNCTION__,
+                                blocknr,
+                                bdevname(journal->j_dev, b));
+                        err = -EIO;
+                        __journal_abort_soft(journal, err);
+                }
+        } else {
+                *retp = blocknr; /* +journal->j_blk_offset */
+        }
+        return err;
+}
+
+/*
+ * We play buffer_head aliasing tricks to write data/metadata blocks to
+ * the journal without copying their contents, but for journal
+ * descriptor blocks we do need to generate bona fide buffers.
+ *
+ * After the caller of jbd2_journal_get_descriptor_buffer() has finished modifying
+ * the buffer's contents they really should run flush_dcache_page(bh->b_page).
+ * But we don't bother doing that, so there will be coherency problems with
+ * mmaps of blockdevs which hold live JBD-controlled filesystems.
+ */
+struct journal_head *jbd2_journal_get_descriptor_buffer(journal_t *journal)
+{
+        struct buffer_head *bh;
+        unsigned long long blocknr;
+        int err;
+
+        err = jbd2_journal_next_log_block(journal, &blocknr);
+
+        if (err)
+                return NULL;
+
+        bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
+        lock_buffer(bh);
+        memset(bh->b_data, 0, journal->j_blocksize);
+        set_buffer_uptodate(bh);
+        unlock_buffer(bh);
+        BUFFER_TRACE(bh, "return this buffer");
+        return jbd2_journal_add_journal_head(bh);
+}
+
+/*
+ * Management for journal control blocks: functions to create and
+ * destroy journal_t structures, and to initialise and read existing
+ * journal blocks from disk.  */
+
+/* First: create and setup a journal_t object in memory.  We initialise
+ * very few fields yet: that has to wait until we have created the
+ * journal structures from from scratch, or loaded them from disk. */
+
+static journal_t * journal_init_common (void)
+{
+        journal_t *journal;
+        int err;
+
+        journal = jbd_kmalloc(sizeof(*journal), GFP_KERNEL);
+        if (!journal)
+                goto fail;
+        memset(journal, 0, sizeof(*journal));
+
+        init_waitqueue_head(&journal->j_wait_transaction_locked);
+        init_waitqueue_head(&journal->j_wait_logspace);
+        init_waitqueue_head(&journal->j_wait_done_commit);
+        init_waitqueue_head(&journal->j_wait_checkpoint);
+        init_waitqueue_head(&journal->j_wait_commit);
+        init_waitqueue_head(&journal->j_wait_updates);
+        mutex_init(&journal->j_barrier);
+        mutex_init(&journal->j_checkpoint_mutex);
+        spin_lock_init(&journal->j_revoke_lock);
+        spin_lock_init(&journal->j_list_lock);
+        spin_lock_init(&journal->j_state_lock);
+
+        journal->j_commit_interval = (HZ * JBD_DEFAULT_MAX_COMMIT_AGE);
+
+        /* The journal is marked for error until we succeed with recovery! */
+        journal->j_flags = JBD2_ABORT;
+
+        /* Set up a default-sized revoke table for the new mount. */
+        err = jbd2_journal_init_revoke(journal, JOURNAL_REVOKE_DEFAULT_HASH);
+        if (err) {
+                kfree(journal);
+                goto fail;
+        }
+        return journal;
+fail:
+        return NULL;
+}
+
+/* jbd2_journal_init_dev and jbd2_journal_init_inode:
+ *
+ * Create a journal structure assigned some fixed set of disk blocks to
+ * the journal.  We don't actually touch those disk blocks yet, but we
+ * need to set up all of the mapping information to tell the journaling
+ * system where the journal blocks are.
+ *
+ */
+
+/**
+ *  journal_t * jbd2_journal_init_dev() - creates an initialises a journal structure
+ *  @bdev: Block device on which to create the journal
+ *  @fs_dev: Device which hold journalled filesystem for this journal.
+ *  @start: Block nr Start of journal.
+ *  @len:  Length of the journal in blocks.
+ *  @blocksize: blocksize of journalling device
+ *  @returns: a newly created journal_t *
+ *
+ *  jbd2_journal_init_dev creates a journal which maps a fixed contiguous
+ *  range of blocks on an arbitrary block device.
+ *
+ */
+journal_t * jbd2_journal_init_dev(struct block_device *bdev,
+                        struct block_device *fs_dev,
+                        unsigned long long start, int len, int blocksize)
+{
+        journal_t *journal = journal_init_common();
+        struct buffer_head *bh;
+        int n;
+
+        if (!journal)
+                return NULL;
+
+        /* journal descriptor can store up to n blocks -bzzz */
+        journal->j_blocksize = blocksize;
+        n = journal->j_blocksize / sizeof(journal_block_tag_t);
+        journal->j_wbufsize = n;
+        journal->j_wbuf = kmalloc(n * sizeof(struct buffer_head*), GFP_KERNEL);
+        if (!journal->j_wbuf) {
+                printk(KERN_ERR "%s: Cant allocate bhs for commit thread\n",
+                        __FUNCTION__);
+                kfree(journal);
+                journal = NULL;
+                goto out;
+        }
+        journal->j_dev = bdev;
+        journal->j_fs_dev = fs_dev;
+        journal->j_blk_offset = start;
+        journal->j_maxlen = len;
+
+        bh = __getblk(journal->j_dev, start, journal->j_blocksize);
+        J_ASSERT(bh != NULL);
+        journal->j_sb_buffer = bh;
+        journal->j_superblock = (journal_superblock_t *)bh->b_data;
+out:
+        return journal;
+}
+
+/**
+ *  journal_t * jbd2_journal_init_inode () - creates a journal which maps to a inode.
+ *  @inode: An inode to create the journal in
+ *
+ * jbd2_journal_init_inode creates a journal which maps an on-disk inode as
+ * the journal.  The inode must exist already, must support bmap() and
+ * must have all data blocks preallocated.
+ */
+journal_t * jbd2_journal_init_inode (struct inode *inode)
+{
+        struct buffer_head *bh;
+        journal_t *journal = journal_init_common();
+        int err;
+        int n;
+        unsigned long long blocknr;
+
+        if (!journal)
+                return NULL;
+
+        journal->j_dev = journal->j_fs_dev = inode->i_sb->s_bdev;
+        journal->j_inode = inode;
+        jbd_debug(1,
+                  "journal %p: inode %s/%ld, size %Ld, bits %d, blksize %ld\n",
+                  journal, inode->i_sb->s_id, inode->i_ino,
+                  (long long) inode->i_size,
+                  inode->i_sb->s_blocksize_bits, inode->i_sb->s_blocksize);
+
+        journal->j_maxlen = inode->i_size >> inode->i_sb->s_blocksize_bits;
+        journal->j_blocksize = inode->i_sb->s_blocksize;
+
+        /* journal descriptor can store up to n blocks -bzzz */
+        n = journal->j_blocksize / sizeof(journal_block_tag_t);
+        journal->j_wbufsize = n;
+        journal->j_wbuf = kmalloc(n * sizeof(struct buffer_head*), GFP_KERNEL);
+        if (!journal->j_wbuf) {
+                printk(KERN_ERR "%s: Cant allocate bhs for commit thread\n",
+                        __FUNCTION__);
+                kfree(journal);
+                return NULL;
+        }
+
+        err = jbd2_journal_bmap(journal, 0, &blocknr);
+        /* If that failed, give up */
+        if (err) {
+                printk(KERN_ERR "%s: Cannnot locate journal superblock\n",
+                       __FUNCTION__);
+                kfree(journal);
+                return NULL;
+        }
+
+        bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
+        J_ASSERT(bh != NULL);
+        journal->j_sb_buffer = bh;
+        journal->j_superblock = (journal_superblock_t *)bh->b_data;
+
+        return journal;
+}
+
+/*
+ * If the journal init or create aborts, we need to mark the journal
+ * superblock as being NULL to prevent the journal destroy from writing
+ * back a bogus superblock.
+ */
+static void journal_fail_superblock (journal_t *journal)
+{
+        struct buffer_head *bh = journal->j_sb_buffer;
+        brelse(bh);
+        journal->j_sb_buffer = NULL;
+}
+
+/*
+ * Given a journal_t structure, initialise the various fields for
+ * startup of a new journaling session.  We use this both when creating
+ * a journal, and after recovering an old journal to reset it for
+ * subsequent use.
+ */
+
+static int journal_reset(journal_t *journal)
+{
+        journal_superblock_t *sb = journal->j_superblock;
+        unsigned long long first, last;
+
+        first = be32_to_cpu(sb->s_first);
+        last = be32_to_cpu(sb->s_maxlen);
+
+        journal->j_first = first;
+        journal->j_last = last;
+
+        journal->j_head = first;
+        journal->j_tail = first;
+        journal->j_free = last - first;
+
+        journal->j_tail_sequence = journal->j_transaction_sequence;
+        journal->j_commit_sequence = journal->j_transaction_sequence - 1;
+        journal->j_commit_request = journal->j_commit_sequence;
+
+        journal->j_max_transaction_buffers = journal->j_maxlen / 4;
+
+        /* Add the dynamic fields and write it to disk. */
+        jbd2_journal_update_superblock(journal, 1);
+        jbd2_journal_start_thread(journal);
+        return 0;
+}
+
+/**
+ * int jbd2_journal_create() - Initialise the new journal file
+ * @journal: Journal to create. This structure must have been initialised
+ *
+ * Given a journal_t structure which tells us which disk blocks we can
+ * use, create a new journal superblock and initialise all of the
+ * journal fields from scratch.
+ **/
+int jbd2_journal_create(journal_t *journal)
+{
+        unsigned long long blocknr;
+        struct buffer_head *bh;
+        journal_superblock_t *sb;
+        int i, err;
+
+        if (journal->j_maxlen < JBD2_MIN_JOURNAL_BLOCKS) {
+                printk (KERN_ERR "Journal length (%d blocks) too short.\n",
+                        journal->j_maxlen);
+                journal_fail_superblock(journal);
+                return -EINVAL;
+        }
+
+        if (journal->j_inode == NULL) {
+                /*
+                 * We don't know what block to start at!
+                 */
+                printk(KERN_EMERG
+                       "%s: creation of journal on external device!\n",
+                       __FUNCTION__);
+                BUG();
+        }
+
+        /* Zero out the entire journal on disk.  We cannot afford to
+           have any blocks on disk beginning with JBD2_MAGIC_NUMBER. */
+        jbd_debug(1, "JBD: Zeroing out journal blocks...\n");
+        for (i = 0; i < journal->j_maxlen; i++) {
+                err = jbd2_journal_bmap(journal, i, &blocknr);
+                if (err)
+                        return err;
+                bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
+                lock_buffer(bh);
+                memset (bh->b_data, 0, journal->j_blocksize);
+                BUFFER_TRACE(bh, "marking dirty");
+                mark_buffer_dirty(bh);
+                BUFFER_TRACE(bh, "marking uptodate");
+                set_buffer_uptodate(bh);
+                unlock_buffer(bh);
+                __brelse(bh);
+        }
+
+        sync_blockdev(journal->j_dev);
+        jbd_debug(1, "JBD: journal cleared.\n");
+
+        /* OK, fill in the initial static fields in the new superblock */
+        sb = journal->j_superblock;
+
+        sb->s_header.h_magic     = cpu_to_be32(JBD2_MAGIC_NUMBER);
+        sb->s_header.h_blocktype = cpu_to_be32(JBD2_SUPERBLOCK_V2);
+
+        sb->s_blocksize = cpu_to_be32(journal->j_blocksize);
+        sb->s_maxlen    = cpu_to_be32(journal->j_maxlen);
+        sb->s_first     = cpu_to_be32(1);
+
+        journal->j_transaction_sequence = 1;
+
+        journal->j_flags &= ~JBD2_ABORT;
+        journal->j_format_version = 2;
+
+        return journal_reset(journal);
+}
+
+/**
+ * void jbd2_journal_update_superblock() - Update journal sb on disk.
+ * @journal: The journal to update.
+ * @wait: Set to '0' if you don't want to wait for IO completion.
+ *
+ * Update a journal's dynamic superblock fields and write it to disk,
+ * optionally waiting for the IO to complete.
+ */
+void jbd2_journal_update_superblock(journal_t *journal, int wait)
+{
+        journal_superblock_t *sb = journal->j_superblock;
+        struct buffer_head *bh = journal->j_sb_buffer;
+
+        /*
+         * As a special case, if the on-disk copy is already marked as needing
+         * no recovery (s_start == 0) and there are no outstanding transactions
+         * in the filesystem, then we can safely defer the superblock update
+         * until the next commit by setting JBD2_FLUSHED.  This avoids
+         * attempting a write to a potential-readonly device.
+         */
+        if (sb->s_start == 0 && journal->j_tail_sequence ==
+                                journal->j_transaction_sequence) {
+                jbd_debug(1,"JBD: Skipping superblock update on recovered sb "
+                        "(start %ld, seq %d, errno %d)\n",
+                        journal->j_tail, journal->j_tail_sequence,
+                        journal->j_errno);
+                goto out;
+        }
+
+        spin_lock(&journal->j_state_lock);
+        jbd_debug(1,"JBD: updating superblock (start %ld, seq %d, errno %d)\n",
+                  journal->j_tail, journal->j_tail_sequence, journal->j_errno);
+
+        sb->s_sequence = cpu_to_be32(journal->j_tail_sequence);
+        sb->s_start    = cpu_to_be32(journal->j_tail);
+        sb->s_errno    = cpu_to_be32(journal->j_errno);
+        spin_unlock(&journal->j_state_lock);
+
+        BUFFER_TRACE(bh, "marking dirty");
+        mark_buffer_dirty(bh);
+        if (wait)
+                sync_dirty_buffer(bh);
+        else
+                ll_rw_block(SWRITE, 1, &bh);
+
+out:
+        /* If we have just flushed the log (by marking s_start==0), then
+         * any future commit will have to be careful to update the
+         * superblock again to re-record the true start of the log. */
+
+        spin_lock(&journal->j_state_lock);
+        if (sb->s_start)
+                journal->j_flags &= ~JBD2_FLUSHED;
+        else
+                journal->j_flags |= JBD2_FLUSHED;
+        spin_unlock(&journal->j_state_lock);
+}
+
+/*
+ * Read the superblock for a given journal, performing initial
+ * validation of the format.
+ */
+
+static int journal_get_superblock(journal_t *journal)
+{
+        struct buffer_head *bh;
+        journal_superblock_t *sb;
+        int err = -EIO;
+
+        bh = journal->j_sb_buffer;
+
+        J_ASSERT(bh != NULL);
+        if (!buffer_uptodate(bh)) {
+                ll_rw_block(READ, 1, &bh);
+                wait_on_buffer(bh);
+                if (!buffer_uptodate(bh)) {
+                        printk (KERN_ERR
+                                "JBD: IO error reading journal superblock\n");
+                        goto out;
+                }
+        }
+
+        sb = journal->j_superblock;
+
+        err = -EINVAL;
+
+        if (sb->s_header.h_magic != cpu_to_be32(JBD2_MAGIC_NUMBER) ||
+            sb->s_blocksize != cpu_to_be32(journal->j_blocksize)) {
+                printk(KERN_WARNING "JBD: no valid journal superblock found\n");
+                goto out;
+        }
+
+        switch(be32_to_cpu(sb->s_header.h_blocktype)) {
+        case JBD2_SUPERBLOCK_V1:
+                journal->j_format_version = 1;
+                break;
+        case JBD2_SUPERBLOCK_V2:
+                journal->j_format_version = 2;
+                break;
+        default:
+                printk(KERN_WARNING "JBD: unrecognised superblock format ID\n");
+                goto out;
+        }
+
+        if (be32_to_cpu(sb->s_maxlen) < journal->j_maxlen)
+                journal->j_maxlen = be32_to_cpu(sb->s_maxlen);
+        else if (be32_to_cpu(sb->s_maxlen) > journal->j_maxlen) {
+                printk (KERN_WARNING "JBD: journal file too short\n");
+                goto out;
+        }
+
+        return 0;
+
+out:
+        journal_fail_superblock(journal);
+        return err;
+}
+
+/*
+ * Load the on-disk journal superblock and read the key fields into the
+ * journal_t.
+ */
+
+static int load_superblock(journal_t *journal)
+{
+        int err;
+        journal_superblock_t *sb;
+
+        err = journal_get_superblock(journal);
+        if (err)
+                return err;
+
+        sb = journal->j_superblock;
+
+        journal->j_tail_sequence = be32_to_cpu(sb->s_sequence);
+        journal->j_tail = be32_to_cpu(sb->s_start);
+        journal->j_first = be32_to_cpu(sb->s_first);
+        journal->j_last = be32_to_cpu(sb->s_maxlen);
+        journal->j_errno = be32_to_cpu(sb->s_errno);
+
+        return 0;
+}
+
+
+/**
+ * int jbd2_journal_load() - Read journal from disk.
+ * @journal: Journal to act on.
+ *
+ * Given a journal_t structure which tells us which disk blocks contain
+ * a journal, read the journal from disk to initialise the in-memory
+ * structures.
+ */
+int jbd2_journal_load(journal_t *journal)
+{
+        int err;
+        journal_superblock_t *sb;
+
+        err = load_superblock(journal);
+        if (err)
+                return err;
+
+        sb = journal->j_superblock;
+        /* If this is a V2 superblock, then we have to check the
+         * features flags on it. */
+
+        if (journal->j_format_version >= 2) {
+                if ((sb->s_feature_ro_compat &
+                     ~cpu_to_be32(JBD2_KNOWN_ROCOMPAT_FEATURES)) ||
+                    (sb->s_feature_incompat &
+                     ~cpu_to_be32(JBD2_KNOWN_INCOMPAT_FEATURES))) {
+                        printk (KERN_WARNING
+                                "JBD: Unrecognised features on journal\n");
+                        return -EINVAL;
+                }
+        }
+
+        /*
+         * Create a slab for this blocksize
+         */
+        err = jbd2_journal_create_jbd_slab(be32_to_cpu(sb->s_blocksize));
+        if (err)
+                return err;
+
+        /* Let the recovery code check whether it needs to recover any
+         * data from the journal. */
+        if (jbd2_journal_recover(journal))
+                goto recovery_error;
+
+        /* OK, we've finished with the dynamic journal bits:
+         * reinitialise the dynamic contents of the superblock in memory
+         * and reset them on disk. */
+        if (journal_reset(journal))
+                goto recovery_error;
+
+        journal->j_flags &= ~JBD2_ABORT;
+        journal->j_flags |= JBD2_LOADED;
+        return 0;
+
+recovery_error:
+        printk (KERN_WARNING "JBD: recovery failed\n");
+        return -EIO;
+}
+
+/**
+ * void jbd2_journal_destroy() - Release a journal_t structure.
+ * @journal: Journal to act on.
+ *
+ * Release a journal_t structure once it is no longer in use by the
+ * journaled object.
+ */
+void jbd2_journal_destroy(journal_t *journal)
+{
+        /* Wait for the commit thread to wake up and die. */
+        journal_kill_thread(journal);
+
+        /* Force a final log commit */
+        if (journal->j_running_transaction)
+                jbd2_journal_commit_transaction(journal);
+
+        /* Force any old transactions to disk */
+
+        /* Totally anal locking here... */
+        spin_lock(&journal->j_list_lock);
+        while (journal->j_checkpoint_transactions != NULL) {
+                spin_unlock(&journal->j_list_lock);
+                jbd2_log_do_checkpoint(journal);
+                spin_lock(&journal->j_list_lock);
+        }
+
+        J_ASSERT(journal->j_running_transaction == NULL);
+        J_ASSERT(journal->j_committing_transaction == NULL);
+        J_ASSERT(journal->j_checkpoint_transactions == NULL);
+        spin_unlock(&journal->j_list_lock);
+
+        /* We can now mark the journal as empty. */
+        journal->j_tail = 0;
+        journal->j_tail_sequence = ++journal->j_transaction_sequence;
+        if (journal->j_sb_buffer) {
+                jbd2_journal_update_superblock(journal, 1);
+                brelse(journal->j_sb_buffer);
+        }
+
+        if (journal->j_inode)
+                iput(journal->j_inode);
+        if (journal->j_revoke)
+                jbd2_journal_destroy_revoke(journal);
+        kfree(journal->j_wbuf);
+        kfree(journal);
+}
+
+
+/**
+ *int jbd2_journal_check_used_features () - Check if features specified are used.
+ * @journal: Journal to check.
+ * @compat: bitmask of compatible features
+ * @ro: bitmask of features that force read-only mount
+ * @incompat: bitmask of incompatible features
+ *
+ * Check whether the journal uses all of a given set of
+ * features.  Return true (non-zero) if it does.
+ **/
+
+int jbd2_journal_check_used_features (journal_t *journal, unsigned long compat,
+                                 unsigned long ro, unsigned long incompat)
+{
+        journal_superblock_t *sb;
+
+        if (!compat && !ro && !incompat)
+                return 1;
+        if (journal->j_format_version == 1)
+                return 0;
+
+        sb = journal->j_superblock;
+
+        if (((be32_to_cpu(sb->s_feature_compat) & compat) == compat) &&
+            ((be32_to_cpu(sb->s_feature_ro_compat) & ro) == ro) &&
+            ((be32_to_cpu(sb->s_feature_incompat) & incompat) == incompat))
+                return 1;
+
+        return 0;
+}
+
+/**
+ * int jbd2_journal_check_available_features() - Check feature set in journalling layer
+ * @journal: Journal to check.
+ * @compat: bitmask of compatible features
+ * @ro: bitmask of features that force read-only mount
+ * @incompat: bitmask of incompatible features
+ *
+ * Check whether the journaling code supports the use of
+ * all of a given set of features on this journal.  Return true
+ * (non-zero) if it can. */
+
+int jbd2_journal_check_available_features (journal_t *journal, unsigned long compat,
+                                      unsigned long ro, unsigned long incompat)
+{
+        journal_superblock_t *sb;
+
+        if (!compat && !ro && !incompat)
+                return 1;
+
+        sb = journal->j_superblock;
+
+        /* We can support any known requested features iff the
+         * superblock is in version 2.  Otherwise we fail to support any
+         * extended sb features. */
+
+        if (journal->j_format_version != 2)
+                return 0;
+
+        if ((compat   & JBD2_KNOWN_COMPAT_FEATURES) == compat &&
+            (ro       & JBD2_KNOWN_ROCOMPAT_FEATURES) == ro &&
+            (incompat & JBD2_KNOWN_INCOMPAT_FEATURES) == incompat)
+                return 1;
+
+        return 0;
+}
+
+/**
+ * int jbd2_journal_set_features () - Mark a given journal feature in the superblock
+ * @journal: Journal to act on.
+ * @compat: bitmask of compatible features
+ * @ro: bitmask of features that force read-only mount
+ * @incompat: bitmask of incompatible features
+ *
+ * Mark a given journal feature as present on the
+ * superblock.  Returns true if the requested features could be set.
+ *
+ */
+
+int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
+                          unsigned long ro, unsigned long incompat)
+{
+        journal_superblock_t *sb;
+
+        if (jbd2_journal_check_used_features(journal, compat, ro, incompat))
+                return 1;
+
+        if (!jbd2_journal_check_available_features(journal, compat, ro, incompat))
+                return 0;
+
+        jbd_debug(1, "Setting new features 0x%lx/0x%lx/0x%lx\n",
+                  compat, ro, incompat);
+
+        sb = journal->j_superblock;
+
+        sb->s_feature_compat    |= cpu_to_be32(compat);
+        sb->s_feature_ro_compat |= cpu_to_be32(ro);
+        sb->s_feature_incompat  |= cpu_to_be32(incompat);
+
+        return 1;
+}
+
+
+/**
+ * int jbd2_journal_update_format () - Update on-disk journal structure.
+ * @journal: Journal to act on.
+ *
+ * Given an initialised but unloaded journal struct, poke about in the
+ * on-disk structure to update it to the most recent supported version.
+ */
+int jbd2_journal_update_format (journal_t *journal)
+{
+        journal_superblock_t *sb;
+        int err;
+
+        err = journal_get_superblock(journal);
+        if (err)
+                return err;
+
+        sb = journal->j_superblock;
+
+        switch (be32_to_cpu(sb->s_header.h_blocktype)) {
+        case JBD2_SUPERBLOCK_V2:
+                return 0;
+        case JBD2_SUPERBLOCK_V1:
+                return journal_convert_superblock_v1(journal, sb);
+        default:
+                break;
+        }
+        return -EINVAL;
+}
+
+static int journal_convert_superblock_v1(journal_t *journal,
+                                         journal_superblock_t *sb)
+{
+        int offset, blocksize;
+        struct buffer_head *bh;
+
+        printk(KERN_WARNING
+                "JBD: Converting superblock from version 1 to 2.\n");
+
+        /* Pre-initialise new fields to zero */
+        offset = ((char *) &(sb->s_feature_compat)) - ((char *) sb);
+        blocksize = be32_to_cpu(sb->s_blocksize);
+        memset(&sb->s_feature_compat, 0, blocksize-offset);
+
+        sb->s_nr_users = cpu_to_be32(1);
+        sb->s_header.h_blocktype = cpu_to_be32(JBD2_SUPERBLOCK_V2);
+        journal->j_format_version = 2;
+
+        bh = journal->j_sb_buffer;
+        BUFFER_TRACE(bh, "marking dirty");
+        mark_buffer_dirty(bh);
+        sync_dirty_buffer(bh);
+        return 0;
+}
+
+
+/**
+ * int jbd2_journal_flush () - Flush journal
+ * @journal: Journal to act on.
+ *
+ * Flush all data for a given journal to disk and empty the journal.
+ * Filesystems can use this when remounting readonly to ensure that
+ * recovery does not need to happen on remount.
+ */
+
+int jbd2_journal_flush(journal_t *journal)
+{
+        int err = 0;
+        transaction_t *transaction = NULL;
+        unsigned long old_tail;
+
+        spin_lock(&journal->j_state_lock);
+
+        /* Force everything buffered to the log... */
+        if (journal->j_running_transaction) {
+                transaction = journal->j_running_transaction;
+                __jbd2_log_start_commit(journal, transaction->t_tid);
+        } else if (journal->j_committing_transaction)
+                transaction = journal->j_committing_transaction;
+
+        /* Wait for the log commit to complete... */
+        if (transaction) {
+                tid_t tid = transaction->t_tid;
+
+                spin_unlock(&journal->j_state_lock);
+                jbd2_log_wait_commit(journal, tid);
+        } else {
+                spin_unlock(&journal->j_state_lock);
+        }
+
+        /* ...and flush everything in the log out to disk. */
+        spin_lock(&journal->j_list_lock);
+        while (!err && journal->j_checkpoint_transactions != NULL) {
+                spin_unlock(&journal->j_list_lock);
+                err = jbd2_log_do_checkpoint(journal);
+                spin_lock(&journal->j_list_lock);
+        }
+        spin_unlock(&journal->j_list_lock);
+        jbd2_cleanup_journal_tail(journal);
+
+        /* Finally, mark the journal as really needing no recovery.
+         * This sets s_start==0 in the underlying superblock, which is
+         * the magic code for a fully-recovered superblock.  Any future
+         * commits of data to the journal will restore the current
+         * s_start value. */
+        spin_lock(&journal->j_state_lock);
+        old_tail = journal->j_tail;
+        journal->j_tail = 0;
+        spin_unlock(&journal->j_state_lock);
+        jbd2_journal_update_superblock(journal, 1);
+        spin_lock(&journal->j_state_lock);
+        journal->j_tail = old_tail;
+
+        J_ASSERT(!journal->j_running_transaction);
+        J_ASSERT(!journal->j_committing_transaction);
+        J_ASSERT(!journal->j_checkpoint_transactions);
+        J_ASSERT(journal->j_head == journal->j_tail);
+        J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
+        spin_unlock(&journal->j_state_lock);
+        return err;
+}
+
+/**
+ * int jbd2_journal_wipe() - Wipe journal contents
+ * @journal: Journal to act on.
+ * @write: flag (see below)
+ *
+ * Wipe out all of the contents of a journal, safely.  This will produce
+ * a warning if the journal contains any valid recovery information.
+ * Must be called between journal_init_*() and jbd2_journal_load().
+ *
+ * If 'write' is non-zero, then we wipe out the journal on disk; otherwise
+ * we merely suppress recovery.
+ */
+
+int jbd2_journal_wipe(journal_t *journal, int write)
+{
+        journal_superblock_t *sb;
+        int err = 0;
+
+        J_ASSERT (!(journal->j_flags & JBD2_LOADED));
+
+        err = load_superblock(journal);
+        if (err)
+                return err;
+
+        sb = journal->j_superblock;
+
+        if (!journal->j_tail)
+                goto no_recovery;
+
+        printk (KERN_WARNING "JBD: %s recovery information on journal\n",
+                write ? "Clearing" : "Ignoring");
+
+        err = jbd2_journal_skip_recovery(journal);
+        if (write)
+                jbd2_journal_update_superblock(journal, 1);
+
+ no_recovery:
+        return err;
+}
+
+/*
+ * journal_dev_name: format a character string to describe on what
+ * device this journal is present.
+ */
+
+static const char *journal_dev_name(journal_t *journal, char *buffer)
+{
+        struct block_device *bdev;
+
+        if (journal->j_inode)
+                bdev = journal->j_inode->i_sb->s_bdev;
+        else
+                bdev = journal->j_dev;
+
+        return bdevname(bdev, buffer);
+}
+
+/*
+ * Journal abort has very specific semantics, which we describe
+ * for journal abort.
+ *
+ * Two internal function, which provide abort to te jbd layer
+ * itself are here.
+ */
+
+/*
+ * Quick version for internal journal use (doesn't lock the journal).
+ * Aborts hard --- we mark the abort as occurred, but do _nothing_ else,
+ * and don't attempt to make any other journal updates.
+ */
+void __jbd2_journal_abort_hard(journal_t *journal)
+{
+        transaction_t *transaction;
+        char b[BDEVNAME_SIZE];
+
+        if (journal->j_flags & JBD2_ABORT)
+                return;
+
+        printk(KERN_ERR "Aborting journal on device %s.\n",
+                journal_dev_name(journal, b));
+
+        spin_lock(&journal->j_state_lock);
+        journal->j_flags |= JBD2_ABORT;
+        transaction = journal->j_running_transaction;
+        if (transaction)
+                __jbd2_log_start_commit(journal, transaction->t_tid);
+        spin_unlock(&journal->j_state_lock);
+}
+
+/* Soft abort: record the abort error status in the journal superblock,
+ * but don't do any other IO. */
+static void __journal_abort_soft (journal_t *journal, int errno)
+{
+        if (journal->j_flags & JBD2_ABORT)
+                return;
+
+        if (!journal->j_errno)
+                journal->j_errno = errno;
+
+        __jbd2_journal_abort_hard(journal);
+
+        if (errno)
+                jbd2_journal_update_superblock(journal, 1);
+}
+
+/**
+ * void jbd2_journal_abort () - Shutdown the journal immediately.
+ * @journal: the journal to shutdown.
+ * @errno:   an error number to record in the journal indicating
+ *           the reason for the shutdown.
+ *
+ * Perform a complete, immediate shutdown of the ENTIRE
+ * journal (not of a single transaction).  This operation cannot be
+ * undone without closing and reopening the journal.
+ *
+ * The jbd2_journal_abort function is intended to support higher level error
+ * recovery mechanisms such as the ext2/ext3 remount-readonly error
+ * mode.
+ *
+ * Journal abort has very specific semantics.  Any existing dirty,
+ * unjournaled buffers in the main filesystem will still be written to
+ * disk by bdflush, but the journaling mechanism will be suspended
+ * immediately and no further transaction commits will be honoured.
+ *
+ * Any dirty, journaled buffers will be written back to disk without
+ * hitting the journal.  Atomicity cannot be guaranteed on an aborted
+ * filesystem, but we _do_ attempt to leave as much data as possible
+ * behind for fsck to use for cleanup.
+ *
+ * Any attempt to get a new transaction handle on a journal which is in
+ * ABORT state will just result in an -EROFS error return.  A
+ * jbd2_journal_stop on an existing handle will return -EIO if we have
+ * entered abort state during the update.
+ *
+ * Recursive transactions are not disturbed by journal abort until the
+ * final jbd2_journal_stop, which will receive the -EIO error.
+ *
+ * Finally, the jbd2_journal_abort call allows the caller to supply an errno
+ * which will be recorded (if possible) in the journal superblock.  This
+ * allows a client to record failure conditions in the middle of a
+ * transaction without having to complete the transaction to record the
+ * failure to disk.  ext3_error, for example, now uses this
+ * functionality.
+ *
+ * Errors which originate from within the journaling layer will NOT
+ * supply an errno; a null errno implies that absolutely no further
+ * writes are done to the journal (unless there are any already in
+ * progress).
+ *
+ */
+
+void jbd2_journal_abort(journal_t *journal, int errno)
+{
+        __journal_abort_soft(journal, errno);
+}
+
+/**
+ * int jbd2_journal_errno () - returns the journal's error state.
+ * @journal: journal to examine.
+ *
+ * This is the errno numbet set with jbd2_journal_abort(), the last
+ * time the journal was mounted - if the journal was stopped
+ * without calling abort this will be 0.
+ *
+ * If the journal has been aborted on this mount time -EROFS will
+ * be returned.
+ */
+int jbd2_journal_errno(journal_t *journal)
+{
+        int err;
+
+        spin_lock(&journal->j_state_lock);
+        if (journal->j_flags & JBD2_ABORT)
+                err = -EROFS;
+        else
+                err = journal->j_errno;
+        spin_unlock(&journal->j_state_lock);
+        return err;
+}
+
+/**
+ * int jbd2_journal_clear_err () - clears the journal's error state
+ * @journal: journal to act on.
+ *
+ * An error must be cleared or Acked to take a FS out of readonly
+ * mode.
+ */
+int jbd2_journal_clear_err(journal_t *journal)
+{
+        int err = 0;
+
+        spin_lock(&journal->j_state_lock);
+        if (journal->j_flags & JBD2_ABORT)
+                err = -EROFS;
+        else
+                journal->j_errno = 0;
+        spin_unlock(&journal->j_state_lock);
+        return err;
+}
+
+/**
+ * void jbd2_journal_ack_err() - Ack journal err.
+ * @journal: journal to act on.
+ *
+ * An error must be cleared or Acked to take a FS out of readonly
+ * mode.
+ */
+void jbd2_journal_ack_err(journal_t *journal)
+{
+        spin_lock(&journal->j_state_lock);
+        if (journal->j_errno)
+                journal->j_flags |= JBD2_ACK_ERR;
+        spin_unlock(&journal->j_state_lock);
+}
+
+int jbd2_journal_blocks_per_page(struct inode *inode)
+{
+        return 1 << (PAGE_CACHE_SHIFT - inode->i_sb->s_blocksize_bits);
+}
+
+/*
+ * helper functions to deal with 32 or 64bit block numbers.
+ */
+size_t journal_tag_bytes(journal_t *journal)
+{
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+                return JBD_TAG_SIZE64;
+        else
+                return JBD_TAG_SIZE32;
+}
+
+/*
+ * Simple support for retrying memory allocations.  Introduced to help to
+ * debug different VM deadlock avoidance strategies.
+ */
+void * __jbd2_kmalloc (const char *where, size_t size, gfp_t flags, int retry)
+{
+        return kmalloc(size, flags | (retry ? __GFP_NOFAIL : 0));
+}
+
+/*
+ * jbd slab management: create 1k, 2k, 4k, 8k slabs as needed
+ * and allocate frozen and commit buffers from these slabs.
+ *
+ * Reason for doing this is to avoid, SLAB_DEBUG - since it could
+ * cause bh to cross page boundary.
+ */
+
+#define JBD_MAX_SLABS 5
+#define JBD_SLAB_INDEX(size)  (size >> 11)
+
+static kmem_cache_t *jbd_slab[JBD_MAX_SLABS];
+static const char *jbd_slab_names[JBD_MAX_SLABS] = {
+        "jbd2_1k", "jbd2_2k", "jbd2_4k", NULL, "jbd2_8k"
+};
+
+static void jbd2_journal_destroy_jbd_slabs(void)
+{
+        int i;
+
+        for (i = 0; i < JBD_MAX_SLABS; i++) {
+                if (jbd_slab[i])
+                        kmem_cache_destroy(jbd_slab[i]);
+                jbd_slab[i] = NULL;
+        }
+}
+
+static int jbd2_journal_create_jbd_slab(size_t slab_size)
+{
+        int i = JBD_SLAB_INDEX(slab_size);
+
+        BUG_ON(i >= JBD_MAX_SLABS);
+
+        /*
+         * Check if we already have a slab created for this size
+         */
+        if (jbd_slab[i])
+                return 0;
+
+        /*
+         * Create a slab and force alignment to be same as slabsize -
+         * this will make sure that allocations won't cross the page
+         * boundary.
+         */
+        jbd_slab[i] = kmem_cache_create(jbd_slab_names[i],
+                                slab_size, slab_size, 0, NULL, NULL);
+        if (!jbd_slab[i]) {
+                printk(KERN_EMERG "JBD: no memory for jbd_slab cache\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+void * jbd2_slab_alloc(size_t size, gfp_t flags)
+{
+        int idx;
+
+        idx = JBD_SLAB_INDEX(size);
+        BUG_ON(jbd_slab[idx] == NULL);
+        return kmem_cache_alloc(jbd_slab[idx], flags | __GFP_NOFAIL);
+}
+
+void jbd2_slab_free(void *ptr,  size_t size)
+{
+        int idx;
+
+        idx = JBD_SLAB_INDEX(size);
+        BUG_ON(jbd_slab[idx] == NULL);
+        kmem_cache_free(jbd_slab[idx], ptr);
+}
+
+/*
+ * Journal_head storage management
+ */
+static kmem_cache_t *jbd2_journal_head_cache;
+#ifdef CONFIG_JBD_DEBUG
+static atomic_t nr_journal_heads = ATOMIC_INIT(0);
+#endif
+
+static int journal_init_jbd2_journal_head_cache(void)
+{
+        int retval;
+
+        J_ASSERT(jbd2_journal_head_cache == 0);
+        jbd2_journal_head_cache = kmem_cache_create("jbd2_journal_head",
+                                sizeof(struct journal_head),
+                                0,              /* offset */
+                                0,              /* flags */
+                                NULL,           /* ctor */
+                                NULL);          /* dtor */
+        retval = 0;
+        if (jbd2_journal_head_cache == 0) {
+                retval = -ENOMEM;
+                printk(KERN_EMERG "JBD: no memory for journal_head cache\n");
+        }
+        return retval;
+}
+
+static void jbd2_journal_destroy_jbd2_journal_head_cache(void)
+{
+        J_ASSERT(jbd2_journal_head_cache != NULL);
+        kmem_cache_destroy(jbd2_journal_head_cache);
+        jbd2_journal_head_cache = NULL;
+}
+
+/*
+ * journal_head splicing and dicing
+ */
+static struct journal_head *journal_alloc_journal_head(void)
+{
+        struct journal_head *ret;
+        static unsigned long last_warning;
+
+#ifdef CONFIG_JBD_DEBUG
+        atomic_inc(&nr_journal_heads);
+#endif
+        ret = kmem_cache_alloc(jbd2_journal_head_cache, GFP_NOFS);
+        if (ret == 0) {
+                jbd_debug(1, "out of memory for journal_head\n");
+                if (time_after(jiffies, last_warning + 5*HZ)) {
+                        printk(KERN_NOTICE "ENOMEM in %s, retrying.\n",
+                               __FUNCTION__);
+                        last_warning = jiffies;
+                }
+                while (ret == 0) {
+                        yield();
+                        ret = kmem_cache_alloc(jbd2_journal_head_cache, GFP_NOFS);
+                }
+        }
+        return ret;
+}
+
+static void journal_free_journal_head(struct journal_head *jh)
+{
+#ifdef CONFIG_JBD_DEBUG
+        atomic_dec(&nr_journal_heads);
+        memset(jh, JBD_POISON_FREE, sizeof(*jh));
+#endif
+        kmem_cache_free(jbd2_journal_head_cache, jh);
+}
+
+/*
+ * A journal_head is attached to a buffer_head whenever JBD has an
+ * interest in the buffer.
+ *
+ * Whenever a buffer has an attached journal_head, its ->b_state:BH_JBD bit
+ * is set.  This bit is tested in core kernel code where we need to take
+ * JBD-specific actions.  Testing the zeroness of ->b_private is not reliable
+ * there.
+ *
+ * When a buffer has its BH_JBD bit set, its ->b_count is elevated by one.
+ *
+ * When a buffer has its BH_JBD bit set it is immune from being released by
+ * core kernel code, mainly via ->b_count.
+ *
+ * A journal_head may be detached from its buffer_head when the journal_head's
+ * b_transaction, b_cp_transaction and b_next_transaction pointers are NULL.
+ * Various places in JBD call jbd2_journal_remove_journal_head() to indicate that the
+ * journal_head can be dropped if needed.
+ *
+ * Various places in the kernel want to attach a journal_head to a buffer_head
+ * _before_ attaching the journal_head to a transaction.  To protect the
+ * journal_head in this situation, jbd2_journal_add_journal_head elevates the
+ * journal_head's b_jcount refcount by one.  The caller must call
+ * jbd2_journal_put_journal_head() to undo this.
+ *
+ * So the typical usage would be:
+ *
+ *      (Attach a journal_head if needed.  Increments b_jcount)
+ *      struct journal_head *jh = jbd2_journal_add_journal_head(bh);
+ *      ...
+ *      jh->b_transaction = xxx;
+ *      jbd2_journal_put_journal_head(jh);
+ *
+ * Now, the journal_head's b_jcount is zero, but it is safe from being released
+ * because it has a non-zero b_transaction.
+ */
+
+/*
+ * Give a buffer_head a journal_head.
+ *
+ * Doesn't need the journal lock.
+ * May sleep.
+ */
+struct journal_head *jbd2_journal_add_journal_head(struct buffer_head *bh)
+{
+        struct journal_head *jh;
+        struct journal_head *new_jh = NULL;
+
+repeat:
+        if (!buffer_jbd(bh)) {
+                new_jh = journal_alloc_journal_head();
+                memset(new_jh, 0, sizeof(*new_jh));
+        }
+
+        jbd_lock_bh_journal_head(bh);
+        if (buffer_jbd(bh)) {
+                jh = bh2jh(bh);
+        } else {
+                J_ASSERT_BH(bh,
+                        (atomic_read(&bh->b_count) > 0) ||
+                        (bh->b_page && bh->b_page->mapping));
+
+                if (!new_jh) {
+                        jbd_unlock_bh_journal_head(bh);
+                        goto repeat;
+                }
+
+                jh = new_jh;
+                new_jh = NULL;          /* We consumed it */
+                set_buffer_jbd(bh);
+                bh->b_private = jh;
+                jh->b_bh = bh;
+                get_bh(bh);
+                BUFFER_TRACE(bh, "added journal_head");
+        }
+        jh->b_jcount++;
+        jbd_unlock_bh_journal_head(bh);
+        if (new_jh)
+                journal_free_journal_head(new_jh);
+        return bh->b_private;
+}
+
+/*
+ * Grab a ref against this buffer_head's journal_head.  If it ended up not
+ * having a journal_head, return NULL
+ */
+struct journal_head *jbd2_journal_grab_journal_head(struct buffer_head *bh)
+{
+        struct journal_head *jh = NULL;
+
+        jbd_lock_bh_journal_head(bh);
+        if (buffer_jbd(bh)) {
+                jh = bh2jh(bh);
+                jh->b_jcount++;
+        }
+        jbd_unlock_bh_journal_head(bh);
+        return jh;
+}
+
+static void __journal_remove_journal_head(struct buffer_head *bh)
+{
+        struct journal_head *jh = bh2jh(bh);
+
+        J_ASSERT_JH(jh, jh->b_jcount >= 0);
+
+        get_bh(bh);
+        if (jh->b_jcount == 0) {
+                if (jh->b_transaction == NULL &&
+                                jh->b_next_transaction == NULL &&
+                                jh->b_cp_transaction == NULL) {
+                        J_ASSERT_JH(jh, jh->b_jlist == BJ_None);
+                        J_ASSERT_BH(bh, buffer_jbd(bh));
+                        J_ASSERT_BH(bh, jh2bh(jh) == bh);
+                        BUFFER_TRACE(bh, "remove journal_head");
+                        if (jh->b_frozen_data) {
+                                printk(KERN_WARNING "%s: freeing "
+                                                "b_frozen_data\n",
+                                                __FUNCTION__);
+                                jbd2_slab_free(jh->b_frozen_data, bh->b_size);
+                        }
+                        if (jh->b_committed_data) {
+                                printk(KERN_WARNING "%s: freeing "
+                                                "b_committed_data\n",
+                                                __FUNCTION__);
+                                jbd2_slab_free(jh->b_committed_data, bh->b_size);
+                        }
+                        bh->b_private = NULL;
+                        jh->b_bh = NULL;        /* debug, really */
+                        clear_buffer_jbd(bh);
+                        __brelse(bh);
+                        journal_free_journal_head(jh);
+                } else {
+                        BUFFER_TRACE(bh, "journal_head was locked");
+                }
+        }
+}
+
+/*
+ * jbd2_journal_remove_journal_head(): if the buffer isn't attached to a transaction
+ * and has a zero b_jcount then remove and release its journal_head.   If we did
+ * see that the buffer is not used by any transaction we also "logically"
+ * decrement ->b_count.
+ *
+ * We in fact take an additional increment on ->b_count as a convenience,
+ * because the caller usually wants to do additional things with the bh
+ * after calling here.
+ * The caller of jbd2_journal_remove_journal_head() *must* run __brelse(bh) at some
+ * time.  Once the caller has run __brelse(), the buffer is eligible for
+ * reaping by try_to_free_buffers().
+ */
+void jbd2_journal_remove_journal_head(struct buffer_head *bh)
+{
+        jbd_lock_bh_journal_head(bh);
+        __journal_remove_journal_head(bh);
+        jbd_unlock_bh_journal_head(bh);
+}
+
+/*
+ * Drop a reference on the passed journal_head.  If it fell to zero then try to
+ * release the journal_head from the buffer_head.
+ */
+void jbd2_journal_put_journal_head(struct journal_head *jh)
+{
+        struct buffer_head *bh = jh2bh(jh);
+
+        jbd_lock_bh_journal_head(bh);
+        J_ASSERT_JH(jh, jh->b_jcount > 0);
+        --jh->b_jcount;
+        if (!jh->b_jcount && !jh->b_transaction) {
+                __journal_remove_journal_head(bh);
+                __brelse(bh);
+        }
+        jbd_unlock_bh_journal_head(bh);
+}
+
+/*
+ * /proc tunables
+ */
+#if defined(CONFIG_JBD_DEBUG)
+int jbd2_journal_enable_debug;
+EXPORT_SYMBOL(jbd2_journal_enable_debug);
+#endif
+
+#if defined(CONFIG_JBD_DEBUG) && defined(CONFIG_PROC_FS)
+
+static struct proc_dir_entry *proc_jbd_debug;
+
+static int read_jbd_debug(char *page, char **start, off_t off,
+                          int count, int *eof, void *data)
+{
+        int ret;
+
+        ret = sprintf(page + off, "%d\n", jbd2_journal_enable_debug);
+        *eof = 1;
+        return ret;
+}
+
+static int write_jbd_debug(struct file *file, const char __user *buffer,
+                           unsigned long count, void *data)
+{
+        char buf[32];
+
+        if (count > ARRAY_SIZE(buf) - 1)
+                count = ARRAY_SIZE(buf) - 1;
+        if (copy_from_user(buf, buffer, count))
+                return -EFAULT;
+        buf[ARRAY_SIZE(buf) - 1] = '\0';
+        jbd2_journal_enable_debug = simple_strtoul(buf, NULL, 10);
+        return count;
+}
+
+#define JBD_PROC_NAME "sys/fs/jbd2-debug"
+
+static void __init create_jbd_proc_entry(void)
+{
+        proc_jbd_debug = create_proc_entry(JBD_PROC_NAME, 0644, NULL);
+        if (proc_jbd_debug) {
+                /* Why is this so hard? */
+                proc_jbd_debug->read_proc = read_jbd_debug;
+                proc_jbd_debug->write_proc = write_jbd_debug;
+        }
+}
+
+static void __exit jbd2_remove_jbd_proc_entry(void)
+{
+        if (proc_jbd_debug)
+                remove_proc_entry(JBD_PROC_NAME, NULL);
+}
+
+#else
+
+#define create_jbd_proc_entry() do {} while (0)
+#define jbd2_remove_jbd_proc_entry() do {} while (0)
+
+#endif
+
+kmem_cache_t *jbd2_handle_cache;
+
+static int __init journal_init_handle_cache(void)
+{
+        jbd2_handle_cache = kmem_cache_create("jbd2_journal_handle",
+                                sizeof(handle_t),
+                                0,              /* offset */
+                                0,              /* flags */
+                                NULL,           /* ctor */
+                                NULL);          /* dtor */
+        if (jbd2_handle_cache == NULL) {
+                printk(KERN_EMERG "JBD: failed to create handle cache\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+static void jbd2_journal_destroy_handle_cache(void)
+{
+        if (jbd2_handle_cache)
+                kmem_cache_destroy(jbd2_handle_cache);
+}
+
+/*
+ * Module startup and shutdown
+ */
+
+static int __init journal_init_caches(void)
+{
+        int ret;
+
+        ret = jbd2_journal_init_revoke_caches();
+        if (ret == 0)
+                ret = journal_init_jbd2_journal_head_cache();
+        if (ret == 0)
+                ret = journal_init_handle_cache();
+        return ret;
+}
+
+static void jbd2_journal_destroy_caches(void)
+{
+        jbd2_journal_destroy_revoke_caches();
+        jbd2_journal_destroy_jbd2_journal_head_cache();
+        jbd2_journal_destroy_handle_cache();
+        jbd2_journal_destroy_jbd_slabs();
+}
+
+static int __init journal_init(void)
+{
+        int ret;
+
+        BUILD_BUG_ON(sizeof(struct journal_superblock_s) != 1024);
+
+        ret = journal_init_caches();
+        if (ret != 0)
+                jbd2_journal_destroy_caches();
+        create_jbd_proc_entry();
+        return ret;
+}
+
+static void __exit journal_exit(void)
+{
+#ifdef CONFIG_JBD_DEBUG
+        int n = atomic_read(&nr_journal_heads);
+        if (n)
+                printk(KERN_EMERG "JBD: leaked %d journal_heads!\n", n);
+#endif
+        jbd2_remove_jbd_proc_entry();
+        jbd2_journal_destroy_caches();
+}
+
+MODULE_LICENSE("GPL");
+module_init(journal_init);
+module_exit(journal_exit);
+
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
new file mode 100644
index 000000000000..9f10acafaf70
--- /dev/null
+++ b/fs/jbd2/recovery.c
@@ -0,0 +1,609 @@
+/*
+ * linux/fs/recovery.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1999
+ *
+ * Copyright 1999-2000 Red Hat Software --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Journal recovery routines for the generic filesystem journaling code;
+ * part of the ext2fs journaling system.
+ */
+
+#ifndef __KERNEL__
+#include "jfs_user.h"
+#else
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#endif
+
+/*
+ * Maintain information about the progress of the recovery job, so that
+ * the different passes can carry information between them.
+ */
+struct recovery_info
+{
+        tid_t           start_transaction;
+        tid_t           end_transaction;
+
+        int             nr_replays;
+        int             nr_revokes;
+        int             nr_revoke_hits;
+};
+
+enum passtype {PASS_SCAN, PASS_REVOKE, PASS_REPLAY};
+static int do_one_pass(journal_t *journal,
+                                struct recovery_info *info, enum passtype pass);
+static int scan_revoke_records(journal_t *, struct buffer_head *,
+                                tid_t, struct recovery_info *);
+
+#ifdef __KERNEL__
+
+/* Release readahead buffers after use */
+static void journal_brelse_array(struct buffer_head *b[], int n)
+{
+        while (--n >= 0)
+                brelse (b[n]);
+}
+
+
+/*
+ * When reading from the journal, we are going through the block device
+ * layer directly and so there is no readahead being done for us.  We
+ * need to implement any readahead ourselves if we want it to happen at
+ * all.  Recovery is basically one long sequential read, so make sure we
+ * do the IO in reasonably large chunks.
+ *
+ * This is not so critical that we need to be enormously clever about
+ * the readahead size, though.  128K is a purely arbitrary, good-enough
+ * fixed value.
+ */
+
+#define MAXBUF 8
+static int do_readahead(journal_t *journal, unsigned int start)
+{
+        int err;
+        unsigned int max, nbufs, next;
+        unsigned long long blocknr;
+        struct buffer_head *bh;
+
+        struct buffer_head * bufs[MAXBUF];
+
+        /* Do up to 128K of readahead */
+        max = start + (128 * 1024 / journal->j_blocksize);
+        if (max > journal->j_maxlen)
+                max = journal->j_maxlen;
+
+        /* Do the readahead itself.  We'll submit MAXBUF buffer_heads at
+         * a time to the block device IO layer. */
+
+        nbufs = 0;
+
+        for (next = start; next < max; next++) {
+                err = jbd2_journal_bmap(journal, next, &blocknr);
+
+                if (err) {
+                        printk (KERN_ERR "JBD: bad block at offset %u\n",
+                                next);
+                        goto failed;
+                }
+
+                bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
+                if (!bh) {
+                        err = -ENOMEM;
+                        goto failed;
+                }
+
+                if (!buffer_uptodate(bh) && !buffer_locked(bh)) {
+                        bufs[nbufs++] = bh;
+                        if (nbufs == MAXBUF) {
+                                ll_rw_block(READ, nbufs, bufs);
+                                journal_brelse_array(bufs, nbufs);
+                                nbufs = 0;
+                        }
+                } else
+                        brelse(bh);
+        }
+
+        if (nbufs)
+                ll_rw_block(READ, nbufs, bufs);
+        err = 0;
+
+failed:
+        if (nbufs)
+                journal_brelse_array(bufs, nbufs);
+        return err;
+}
+
+#endif /* __KERNEL__ */
+
+
+/*
+ * Read a block from the journal
+ */
+
+static int jread(struct buffer_head **bhp, journal_t *journal,
+                 unsigned int offset)
+{
+        int err;
+        unsigned long long blocknr;
+        struct buffer_head *bh;
+
+        *bhp = NULL;
+
+        if (offset >= journal->j_maxlen) {
+                printk(KERN_ERR "JBD: corrupted journal superblock\n");
+                return -EIO;
+        }
+
+        err = jbd2_journal_bmap(journal, offset, &blocknr);
+
+        if (err) {
+                printk (KERN_ERR "JBD: bad block at offset %u\n",
+                        offset);
+                return err;
+        }
+
+        bh = __getblk(journal->j_dev, blocknr, journal->j_blocksize);
+        if (!bh)
+                return -ENOMEM;
+
+        if (!buffer_uptodate(bh)) {
+                /* If this is a brand new buffer, start readahead.
+                   Otherwise, we assume we are already reading it.  */
+                if (!buffer_req(bh))
+                        do_readahead(journal, offset);
+                wait_on_buffer(bh);
+        }
+
+        if (!buffer_uptodate(bh)) {
+                printk (KERN_ERR "JBD: Failed to read block at offset %u\n",
+                        offset);
+                brelse(bh);
+                return -EIO;
+        }
+
+        *bhp = bh;
+        return 0;
+}
+
+
+/*
+ * Count the number of in-use tags in a journal descriptor block.
+ */
+
+static int count_tags(journal_t *journal, struct buffer_head *bh)
+{
+        char *                  tagp;
+        journal_block_tag_t *   tag;
+        int                     nr = 0, size = journal->j_blocksize;
+        int                     tag_bytes = journal_tag_bytes(journal);
+
+        tagp = &bh->b_data[sizeof(journal_header_t)];
+
+        while ((tagp - bh->b_data + tag_bytes) <= size) {
+                tag = (journal_block_tag_t *) tagp;
+
+                nr++;
+                tagp += tag_bytes;
+                if (!(tag->t_flags & cpu_to_be32(JBD2_FLAG_SAME_UUID)))
+                        tagp += 16;
+
+                if (tag->t_flags & cpu_to_be32(JBD2_FLAG_LAST_TAG))
+                        break;
+        }
+
+        return nr;
+}
+
+
+/* Make sure we wrap around the log correctly! */
+#define wrap(journal, var)                                              \
+do {                                                                    \
+        if (var >= (journal)->j_last)                                   \
+                var -= ((journal)->j_last - (journal)->j_first);        \
+} while (0)
+
+/**
+ * jbd2_journal_recover - recovers a on-disk journal
+ * @journal: the journal to recover
+ *
+ * The primary function for recovering the log contents when mounting a
+ * journaled device.
+ *
+ * Recovery is done in three passes.  In the first pass, we look for the
+ * end of the log.  In the second, we assemble the list of revoke
+ * blocks.  In the third and final pass, we replay any un-revoked blocks
+ * in the log.
+ */
+int jbd2_journal_recover(journal_t *journal)
+{
+        int                     err;
+        journal_superblock_t *  sb;
+
+        struct recovery_info    info;
+
+        memset(&info, 0, sizeof(info));
+        sb = journal->j_superblock;
+
+        /*
+         * The journal superblock's s_start field (the current log head)
+         * is always zero if, and only if, the journal was cleanly
+         * unmounted.
+         */
+
+        if (!sb->s_start) {
+                jbd_debug(1, "No recovery required, last transaction %d\n",
+                          be32_to_cpu(sb->s_sequence));
+                journal->j_transaction_sequence = be32_to_cpu(sb->s_sequence) + 1;
+                return 0;
+        }
+
+        err = do_one_pass(journal, &info, PASS_SCAN);
+        if (!err)
+                err = do_one_pass(journal, &info, PASS_REVOKE);
+        if (!err)
+                err = do_one_pass(journal, &info, PASS_REPLAY);
+
+        jbd_debug(0, "JBD: recovery, exit status %d, "
+                  "recovered transactions %u to %u\n",
+                  err, info.start_transaction, info.end_transaction);
+        jbd_debug(0, "JBD: Replayed %d and revoked %d/%d blocks\n",
+                  info.nr_replays, info.nr_revoke_hits, info.nr_revokes);
+
+        /* Restart the log at the next transaction ID, thus invalidating
+         * any existing commit records in the log. */
+        journal->j_transaction_sequence = ++info.end_transaction;
+
+        jbd2_journal_clear_revoke(journal);
+        sync_blockdev(journal->j_fs_dev);
+        return err;
+}
+
+/**
+ * jbd2_journal_skip_recovery - Start journal and wipe exiting records
+ * @journal: journal to startup
+ *
+ * Locate any valid recovery information from the journal and set up the
+ * journal structures in memory to ignore it (presumably because the
+ * caller has evidence that it is out of date).
+ * This function does'nt appear to be exorted..
+ *
+ * We perform one pass over the journal to allow us to tell the user how
+ * much recovery information is being erased, and to let us initialise
+ * the journal transaction sequence numbers to the next unused ID.
+ */
+int jbd2_journal_skip_recovery(journal_t *journal)
+{
+        int                     err;
+        journal_superblock_t *  sb;
+
+        struct recovery_info    info;
+
+        memset (&info, 0, sizeof(info));
+        sb = journal->j_superblock;
+
+        err = do_one_pass(journal, &info, PASS_SCAN);
+
+        if (err) {
+                printk(KERN_ERR "JBD: error %d scanning journal\n", err);
+                ++journal->j_transaction_sequence;
+        } else {
+#ifdef CONFIG_JBD_DEBUG
+                int dropped = info.end_transaction - be32_to_cpu(sb->s_sequence);
+#endif
+                jbd_debug(0,
+                          "JBD: ignoring %d transaction%s from the journal.\n",
+                          dropped, (dropped == 1) ? "" : "s");
+                journal->j_transaction_sequence = ++info.end_transaction;
+        }
+
+        journal->j_tail = 0;
+        return err;
+}
+
+static inline unsigned long long read_tag_block(int tag_bytes, journal_block_tag_t *tag)
+{
+        unsigned long long block = be32_to_cpu(tag->t_blocknr);
+        if (tag_bytes > JBD_TAG_SIZE32)
+                block |= (u64)be32_to_cpu(tag->t_blocknr_high) << 32;
+        return block;
+}
+
+static int do_one_pass(journal_t *journal,
+                        struct recovery_info *info, enum passtype pass)
+{
+        unsigned int            first_commit_ID, next_commit_ID;
+        unsigned long           next_log_block;
+        int                     err, success = 0;
+        journal_superblock_t *  sb;
+        journal_header_t *      tmp;
+        struct buffer_head *    bh;
+        unsigned int            sequence;
+        int                     blocktype;
+        int                     tag_bytes = journal_tag_bytes(journal);
+
+        /* Precompute the maximum metadata descriptors in a descriptor block */
+        int                     MAX_BLOCKS_PER_DESC;
+        MAX_BLOCKS_PER_DESC = ((journal->j_blocksize-sizeof(journal_header_t))
+                               / tag_bytes);
+
+        /*
+         * First thing is to establish what we expect to find in the log
+         * (in terms of transaction IDs), and where (in terms of log
+         * block offsets): query the superblock.
+         */
+
+        sb = journal->j_superblock;
+        next_commit_ID = be32_to_cpu(sb->s_sequence);
+        next_log_block = be32_to_cpu(sb->s_start);
+
+        first_commit_ID = next_commit_ID;
+        if (pass == PASS_SCAN)
+                info->start_transaction = first_commit_ID;
+
+        jbd_debug(1, "Starting recovery pass %d\n", pass);
+
+        /*
+         * Now we walk through the log, transaction by transaction,
+         * making sure that each transaction has a commit block in the
+         * expected place.  Each complete transaction gets replayed back
+         * into the main filesystem.
+         */
+
+        while (1) {
+                int                     flags;
+                char *                  tagp;
+                journal_block_tag_t *   tag;
+                struct buffer_head *    obh;
+                struct buffer_head *    nbh;
+
+                cond_resched();         /* We're under lock_kernel() */
+
+                /* If we already know where to stop the log traversal,
+                 * check right now that we haven't gone past the end of
+                 * the log. */
+
+                if (pass != PASS_SCAN)
+                        if (tid_geq(next_commit_ID, info->end_transaction))
+                                break;
+
+                jbd_debug(2, "Scanning for sequence ID %u at %lu/%lu\n",
+                          next_commit_ID, next_log_block, journal->j_last);
+
+                /* Skip over each chunk of the transaction looking
+                 * either the next descriptor block or the final commit
+                 * record. */
+
+                jbd_debug(3, "JBD: checking block %ld\n", next_log_block);
+                err = jread(&bh, journal, next_log_block);
+                if (err)
+                        goto failed;
+
+                next_log_block++;
+                wrap(journal, next_log_block);
+
+                /* What kind of buffer is it?
+                 *
+                 * If it is a descriptor block, check that it has the
+                 * expected sequence number.  Otherwise, we're all done
+                 * here. */
+
+                tmp = (journal_header_t *)bh->b_data;
+
+                if (tmp->h_magic != cpu_to_be32(JBD2_MAGIC_NUMBER)) {
+                        brelse(bh);
+                        break;
+                }
+
+                blocktype = be32_to_cpu(tmp->h_blocktype);
+                sequence = be32_to_cpu(tmp->h_sequence);
+                jbd_debug(3, "Found magic %d, sequence %d\n",
+                          blocktype, sequence);
+
+                if (sequence != next_commit_ID) {
+                        brelse(bh);
+                        break;
+                }
+
+                /* OK, we have a valid descriptor block which matches
+                 * all of the sequence number checks.  What are we going
+                 * to do with it?  That depends on the pass... */
+
+                switch(blocktype) {
+                case JBD2_DESCRIPTOR_BLOCK:
+                        /* If it is a valid descriptor block, replay it
+                         * in pass REPLAY; otherwise, just skip over the
+                         * blocks it describes. */
+                        if (pass != PASS_REPLAY) {
+                                next_log_block += count_tags(journal, bh);
+                                wrap(journal, next_log_block);
+                                brelse(bh);
+                                continue;
+                        }
+
+                        /* A descriptor block: we can now write all of
+                         * the data blocks.  Yay, useful work is finally
+                         * getting done here! */
+
+                        tagp = &bh->b_data[sizeof(journal_header_t)];
+                        while ((tagp - bh->b_data + tag_bytes)
+                               <= journal->j_blocksize) {
+                                unsigned long io_block;
+
+                                tag = (journal_block_tag_t *) tagp;
+                                flags = be32_to_cpu(tag->t_flags);
+
+                                io_block = next_log_block++;
+                                wrap(journal, next_log_block);
+                                err = jread(&obh, journal, io_block);
+                                if (err) {
+                                        /* Recover what we can, but
+                                         * report failure at the end. */
+                                        success = err;
+                                        printk (KERN_ERR
+                                                "JBD: IO error %d recovering "
+                                                "block %ld in log\n",
+                                                err, io_block);
+                                } else {
+                                        unsigned long long blocknr;
+
+                                        J_ASSERT(obh != NULL);
+                                        blocknr = read_tag_block(tag_bytes,
+                                                                 tag);
+
+                                        /* If the block has been
+                                         * revoked, then we're all done
+                                         * here. */
+                                        if (jbd2_journal_test_revoke
+                                            (journal, blocknr,
+                                             next_commit_ID)) {
+                                                brelse(obh);
+                                                ++info->nr_revoke_hits;
+                                                goto skip_write;
+                                        }
+
+                                        /* Find a buffer for the new
+                                         * data being restored */
+                                        nbh = __getblk(journal->j_fs_dev,
+                                                        blocknr,
+                                                        journal->j_blocksize);
+                                        if (nbh == NULL) {
+                                                printk(KERN_ERR
+                                                       "JBD: Out of memory "
+                                                       "during recovery.\n");
+                                                err = -ENOMEM;
+                                                brelse(bh);
+                                                brelse(obh);
+                                                goto failed;
+                                        }
+
+                                        lock_buffer(nbh);
+                                        memcpy(nbh->b_data, obh->b_data,
+                                                        journal->j_blocksize);
+                                        if (flags & JBD2_FLAG_ESCAPE) {
+                                                *((__be32 *)bh->b_data) =
+                                                cpu_to_be32(JBD2_MAGIC_NUMBER);
+                                        }
+
+                                        BUFFER_TRACE(nbh, "marking dirty");
+                                        set_buffer_uptodate(nbh);
+                                        mark_buffer_dirty(nbh);
+                                        BUFFER_TRACE(nbh, "marking uptodate");
+                                        ++info->nr_replays;
+                                        /* ll_rw_block(WRITE, 1, &nbh); */
+                                        unlock_buffer(nbh);
+                                        brelse(obh);
+                                        brelse(nbh);
+                                }
+
+                        skip_write:
+                                tagp += tag_bytes;
+                                if (!(flags & JBD2_FLAG_SAME_UUID))
+                                        tagp += 16;
+
+                                if (flags & JBD2_FLAG_LAST_TAG)
+                                        break;
+                        }
+
+                        brelse(bh);
+                        continue;
+
+                case JBD2_COMMIT_BLOCK:
+                        /* Found an expected commit block: not much to
+                         * do other than move on to the next sequence
+                         * number. */
+                        brelse(bh);
+                        next_commit_ID++;
+                        continue;
+
+                case JBD2_REVOKE_BLOCK:
+                        /* If we aren't in the REVOKE pass, then we can
+                         * just skip over this block. */
+                        if (pass != PASS_REVOKE) {
+                                brelse(bh);
+                                continue;
+                        }
+
+                        err = scan_revoke_records(journal, bh,
+                                                  next_commit_ID, info);
+                        brelse(bh);
+                        if (err)
+                                goto failed;
+                        continue;
+
+                default:
+                        jbd_debug(3, "Unrecognised magic %d, end of scan.\n",
+                                  blocktype);
+                        brelse(bh);
+                        goto done;
+                }
+        }
+
+ done:
+        /*
+         * We broke out of the log scan loop: either we came to the
+         * known end of the log or we found an unexpected block in the
+         * log.  If the latter happened, then we know that the "current"
+         * transaction marks the end of the valid log.
+         */
+
+        if (pass == PASS_SCAN)
+                info->end_transaction = next_commit_ID;
+        else {
+                /* It's really bad news if different passes end up at
+                 * different places (but possible due to IO errors). */
+                if (info->end_transaction != next_commit_ID) {
+                        printk (KERN_ERR "JBD: recovery pass %d ended at "
+                                "transaction %u, expected %u\n",
+                                pass, next_commit_ID, info->end_transaction);
+                        if (!success)
+                                success = -EIO;
+                }
+        }
+
+        return success;
+
+ failed:
+        return err;
+}
+
+
+/* Scan a revoke record, marking all blocks mentioned as revoked. */
+
+static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+                               tid_t sequence, struct recovery_info *info)
+{
+        jbd2_journal_revoke_header_t *header;
+        int offset, max;
+        int record_len = 4;
+
+        header = (jbd2_journal_revoke_header_t *) bh->b_data;
+        offset = sizeof(jbd2_journal_revoke_header_t);
+        max = be32_to_cpu(header->r_count);
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+                record_len = 8;
+
+        while (offset + record_len <= max) {
+                unsigned long long blocknr;
+                int err;
+
+                if (record_len == 4)
+                        blocknr = be32_to_cpu(* ((__be32 *) (bh->b_data+offset)));
+                else
+                        blocknr = be64_to_cpu(* ((__be64 *) (bh->b_data+offset)));
+                offset += record_len;
+                err = jbd2_journal_set_revoke(journal, blocknr, sequence);
+                if (err)
+                        return err;
+                ++info->nr_revokes;
+        }
+        return 0;
+}
diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
new file mode 100644
index 000000000000..380d19917f37
--- /dev/null
+++ b/fs/jbd2/revoke.c
@@ -0,0 +1,712 @@
+/*
+ * linux/fs/revoke.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 2000
+ *
+ * Copyright 2000 Red Hat corp --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Journal revoke routines for the generic filesystem journaling code;
+ * part of the ext2fs journaling system.
+ *
+ * Revoke is the mechanism used to prevent old log records for deleted
+ * metadata from being replayed on top of newer data using the same
+ * blocks.  The revoke mechanism is used in two separate places:
+ *
+ * + Commit: during commit we write the entire list of the current
+ *   transaction's revoked blocks to the journal
+ *
+ * + Recovery: during recovery we record the transaction ID of all
+ *   revoked blocks.  If there are multiple revoke records in the log
+ *   for a single block, only the last one counts, and if there is a log
+ *   entry for a block beyond the last revoke, then that log entry still
+ *   gets replayed.
+ *
+ * We can get interactions between revokes and new log data within a
+ * single transaction:
+ *
+ * Block is revoked and then journaled:
+ *   The desired end result is the journaling of the new block, so we
+ *   cancel the revoke before the transaction commits.
+ *
+ * Block is journaled and then revoked:
+ *   The revoke must take precedence over the write of the block, so we
+ *   need either to cancel the journal entry or to write the revoke
+ *   later in the log than the log block.  In this case, we choose the
+ *   latter: journaling a block cancels any revoke record for that block
+ *   in the current transaction, so any revoke for that block in the
+ *   transaction must have happened after the block was journaled and so
+ *   the revoke must take precedence.
+ *
+ * Block is revoked and then written as data:
+ *   The data write is allowed to succeed, but the revoke is _not_
+ *   cancelled.  We still need to prevent old log records from
+ *   overwriting the new data.  We don't even need to clear the revoke
+ *   bit here.
+ *
+ * Revoke information on buffers is a tri-state value:
+ *
+ * RevokeValid clear:   no cached revoke status, need to look it up
+ * RevokeValid set, Revoked clear:
+ *                      buffer has not been revoked, and cancel_revoke
+ *                      need do nothing.
+ * RevokeValid set, Revoked set:
+ *                      buffer has been revoked.
+ */
+
+#ifndef __KERNEL__
+#include "jfs_user.h"
+#else
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/list.h>
+#include <linux/smp_lock.h>
+#include <linux/init.h>
+#endif
+
+static kmem_cache_t *jbd2_revoke_record_cache;
+static kmem_cache_t *jbd2_revoke_table_cache;
+
+/* Each revoke record represents one single revoked block.  During
+   journal replay, this involves recording the transaction ID of the
+   last transaction to revoke this block. */
+
+struct jbd2_revoke_record_s
+{
+        struct list_head  hash;
+        tid_t             sequence;     /* Used for recovery only */
+        unsigned long long        blocknr;
+};
+
+
+/* The revoke table is just a simple hash table of revoke records. */
+struct jbd2_revoke_table_s
+{
+        /* It is conceivable that we might want a larger hash table
+         * for recovery.  Must be a power of two. */
+        int               hash_size;
+        int               hash_shift;
+        struct list_head *hash_table;
+};
+
+
+#ifdef __KERNEL__
+static void write_one_revoke_record(journal_t *, transaction_t *,
+                                    struct journal_head **, int *,
+                                    struct jbd2_revoke_record_s *);
+static void flush_descriptor(journal_t *, struct journal_head *, int);
+#endif
+
+/* Utility functions to maintain the revoke table */
+
+/* Borrowed from buffer.c: this is a tried and tested block hash function */
+static inline int hash(journal_t *journal, unsigned long long block)
+{
+        struct jbd2_revoke_table_s *table = journal->j_revoke;
+        int hash_shift = table->hash_shift;
+        int hash = (int)block ^ (int)((block >> 31) >> 1);
+
+        return ((hash << (hash_shift - 6)) ^
+                (hash >> 13) ^
+                (hash << (hash_shift - 12))) & (table->hash_size - 1);
+}
+
+static int insert_revoke_hash(journal_t *journal, unsigned long long blocknr,
+                              tid_t seq)
+{
+        struct list_head *hash_list;
+        struct jbd2_revoke_record_s *record;
+
+repeat:
+        record = kmem_cache_alloc(jbd2_revoke_record_cache, GFP_NOFS);
+        if (!record)
+                goto oom;
+
+        record->sequence = seq;
+        record->blocknr = blocknr;
+        hash_list = &journal->j_revoke->hash_table[hash(journal, blocknr)];
+        spin_lock(&journal->j_revoke_lock);
+        list_add(&record->hash, hash_list);
+        spin_unlock(&journal->j_revoke_lock);
+        return 0;
+
+oom:
+        if (!journal_oom_retry)
+                return -ENOMEM;
+        jbd_debug(1, "ENOMEM in %s, retrying\n", __FUNCTION__);
+        yield();
+        goto repeat;
+}
+
+/* Find a revoke record in the journal's hash table. */
+
+static struct jbd2_revoke_record_s *find_revoke_record(journal_t *journal,
+                                                      unsigned long long blocknr)
+{
+        struct list_head *hash_list;
+        struct jbd2_revoke_record_s *record;
+
+        hash_list = &journal->j_revoke->hash_table[hash(journal, blocknr)];
+
+        spin_lock(&journal->j_revoke_lock);
+        record = (struct jbd2_revoke_record_s *) hash_list->next;
+        while (&(record->hash) != hash_list) {
+                if (record->blocknr == blocknr) {
+                        spin_unlock(&journal->j_revoke_lock);
+                        return record;
+                }
+                record = (struct jbd2_revoke_record_s *) record->hash.next;
+        }
+        spin_unlock(&journal->j_revoke_lock);
+        return NULL;
+}
+
+int __init jbd2_journal_init_revoke_caches(void)
+{
+        jbd2_revoke_record_cache = kmem_cache_create("jbd2_revoke_record",
+                                           sizeof(struct jbd2_revoke_record_s),
+                                           0, SLAB_HWCACHE_ALIGN, NULL, NULL);
+        if (jbd2_revoke_record_cache == 0)
+                return -ENOMEM;
+
+        jbd2_revoke_table_cache = kmem_cache_create("jbd2_revoke_table",
+                                           sizeof(struct jbd2_revoke_table_s),
+                                           0, 0, NULL, NULL);
+        if (jbd2_revoke_table_cache == 0) {
+                kmem_cache_destroy(jbd2_revoke_record_cache);
+                jbd2_revoke_record_cache = NULL;
+                return -ENOMEM;
+        }
+        return 0;
+}
+
+void jbd2_journal_destroy_revoke_caches(void)
+{
+        kmem_cache_destroy(jbd2_revoke_record_cache);
+        jbd2_revoke_record_cache = NULL;
+        kmem_cache_destroy(jbd2_revoke_table_cache);
+        jbd2_revoke_table_cache = NULL;
+}
+
+/* Initialise the revoke table for a given journal to a given size. */
+
+int jbd2_journal_init_revoke(journal_t *journal, int hash_size)
+{
+        int shift, tmp;
+
+        J_ASSERT (journal->j_revoke_table[0] == NULL);
+
+        shift = 0;
+        tmp = hash_size;
+        while((tmp >>= 1UL) != 0UL)
+                shift++;
+
+        journal->j_revoke_table[0] = kmem_cache_alloc(jbd2_revoke_table_cache, GFP_KERNEL);
+        if (!journal->j_revoke_table[0])
+                return -ENOMEM;
+        journal->j_revoke = journal->j_revoke_table[0];
+
+        /* Check that the hash_size is a power of two */
+        J_ASSERT ((hash_size & (hash_size-1)) == 0);
+
+        journal->j_revoke->hash_size = hash_size;
+
+        journal->j_revoke->hash_shift = shift;
+
+        journal->j_revoke->hash_table =
+                kmalloc(hash_size * sizeof(struct list_head), GFP_KERNEL);
+        if (!journal->j_revoke->hash_table) {
+                kmem_cache_free(jbd2_revoke_table_cache, journal->j_revoke_table[0]);
+                journal->j_revoke = NULL;
+                return -ENOMEM;
+        }
+
+        for (tmp = 0; tmp < hash_size; tmp++)
+                INIT_LIST_HEAD(&journal->j_revoke->hash_table[tmp]);
+
+        journal->j_revoke_table[1] = kmem_cache_alloc(jbd2_revoke_table_cache, GFP_KERNEL);
+        if (!journal->j_revoke_table[1]) {
+                kfree(journal->j_revoke_table[0]->hash_table);
+                kmem_cache_free(jbd2_revoke_table_cache, journal->j_revoke_table[0]);
+                return -ENOMEM;
+        }
+
+        journal->j_revoke = journal->j_revoke_table[1];
+
+        /* Check that the hash_size is a power of two */
+        J_ASSERT ((hash_size & (hash_size-1)) == 0);
+
+        journal->j_revoke->hash_size = hash_size;
+
+        journal->j_revoke->hash_shift = shift;
+
+        journal->j_revoke->hash_table =
+                kmalloc(hash_size * sizeof(struct list_head), GFP_KERNEL);
+        if (!journal->j_revoke->hash_table) {
+                kfree(journal->j_revoke_table[0]->hash_table);
+                kmem_cache_free(jbd2_revoke_table_cache, journal->j_revoke_table[0]);
+                kmem_cache_free(jbd2_revoke_table_cache, journal->j_revoke_table[1]);
+                journal->j_revoke = NULL;
+                return -ENOMEM;
+        }
+
+        for (tmp = 0; tmp < hash_size; tmp++)
+                INIT_LIST_HEAD(&journal->j_revoke->hash_table[tmp]);
+
+        spin_lock_init(&journal->j_revoke_lock);
+
+        return 0;
+}
+
+/* Destoy a journal's revoke table.  The table must already be empty! */
+
+void jbd2_journal_destroy_revoke(journal_t *journal)
+{
+        struct jbd2_revoke_table_s *table;
+        struct list_head *hash_list;
+        int i;
+
+        table = journal->j_revoke_table[0];
+        if (!table)
+                return;
+
+        for (i=0; i<table->hash_size; i++) {
+                hash_list = &table->hash_table[i];
+                J_ASSERT (list_empty(hash_list));
+        }
+
+        kfree(table->hash_table);
+        kmem_cache_free(jbd2_revoke_table_cache, table);
+        journal->j_revoke = NULL;
+
+        table = journal->j_revoke_table[1];
+        if (!table)
+                return;
+
+        for (i=0; i<table->hash_size; i++) {
+                hash_list = &table->hash_table[i];
+                J_ASSERT (list_empty(hash_list));
+        }
+
+        kfree(table->hash_table);
+        kmem_cache_free(jbd2_revoke_table_cache, table);
+        journal->j_revoke = NULL;
+}
+
+
+#ifdef __KERNEL__
+
+/*
+ * jbd2_journal_revoke: revoke a given buffer_head from the journal.  This
+ * prevents the block from being replayed during recovery if we take a
+ * crash after this current transaction commits.  Any subsequent
+ * metadata writes of the buffer in this transaction cancel the
+ * revoke.
+ *
+ * Note that this call may block --- it is up to the caller to make
+ * sure that there are no further calls to journal_write_metadata
+ * before the revoke is complete.  In ext3, this implies calling the
+ * revoke before clearing the block bitmap when we are deleting
+ * metadata.
+ *
+ * Revoke performs a jbd2_journal_forget on any buffer_head passed in as a
+ * parameter, but does _not_ forget the buffer_head if the bh was only
+ * found implicitly.
+ *
+ * bh_in may not be a journalled buffer - it may have come off
+ * the hash tables without an attached journal_head.
+ *
+ * If bh_in is non-zero, jbd2_journal_revoke() will decrement its b_count
+ * by one.
+ */
+
+int jbd2_journal_revoke(handle_t *handle, unsigned long long blocknr,
+                   struct buffer_head *bh_in)
+{
+        struct buffer_head *bh = NULL;
+        journal_t *journal;
+        struct block_device *bdev;
+        int err;
+
+        might_sleep();
+        if (bh_in)
+                BUFFER_TRACE(bh_in, "enter");
+
+        journal = handle->h_transaction->t_journal;
+        if (!jbd2_journal_set_features(journal, 0, 0, JBD2_FEATURE_INCOMPAT_REVOKE)){
+                J_ASSERT (!"Cannot set revoke feature!");
+                return -EINVAL;
+        }
+
+        bdev = journal->j_fs_dev;
+        bh = bh_in;
+
+        if (!bh) {
+                bh = __find_get_block(bdev, blocknr, journal->j_blocksize);
+                if (bh)
+                        BUFFER_TRACE(bh, "found on hash");
+        }
+#ifdef JBD_EXPENSIVE_CHECKING
+        else {
+                struct buffer_head *bh2;
+
+                /* If there is a different buffer_head lying around in
+                 * memory anywhere... */
+                bh2 = __find_get_block(bdev, blocknr, journal->j_blocksize);
+                if (bh2) {
+                        /* ... and it has RevokeValid status... */
+                        if (bh2 != bh && buffer_revokevalid(bh2))
+                                /* ...then it better be revoked too,
+                                 * since it's illegal to create a revoke
+                                 * record against a buffer_head which is
+                                 * not marked revoked --- that would
+                                 * risk missing a subsequent revoke
+                                 * cancel. */
+                                J_ASSERT_BH(bh2, buffer_revoked(bh2));
+                        put_bh(bh2);
+                }
+        }
+#endif
+
+        /* We really ought not ever to revoke twice in a row without
+           first having the revoke cancelled: it's illegal to free a
+           block twice without allocating it in between! */
+        if (bh) {
+                if (!J_EXPECT_BH(bh, !buffer_revoked(bh),
+                                 "inconsistent data on disk")) {
+                        if (!bh_in)
+                                brelse(bh);
+                        return -EIO;
+                }
+                set_buffer_revoked(bh);
+                set_buffer_revokevalid(bh);
+                if (bh_in) {
+                        BUFFER_TRACE(bh_in, "call jbd2_journal_forget");
+                        jbd2_journal_forget(handle, bh_in);
+                } else {
+                        BUFFER_TRACE(bh, "call brelse");
+                        __brelse(bh);
+                }
+        }
+
+        jbd_debug(2, "insert revoke for block %llu, bh_in=%p\n",blocknr, bh_in);
+        err = insert_revoke_hash(journal, blocknr,
+                                handle->h_transaction->t_tid);
+        BUFFER_TRACE(bh_in, "exit");
+        return err;
+}
+
+/*
+ * Cancel an outstanding revoke.  For use only internally by the
+ * journaling code (called from jbd2_journal_get_write_access).
+ *
+ * We trust buffer_revoked() on the buffer if the buffer is already
+ * being journaled: if there is no revoke pending on the buffer, then we
+ * don't do anything here.
+ *
+ * This would break if it were possible for a buffer to be revoked and
+ * discarded, and then reallocated within the same transaction.  In such
+ * a case we would have lost the revoked bit, but when we arrived here
+ * the second time we would still have a pending revoke to cancel.  So,
+ * do not trust the Revoked bit on buffers unless RevokeValid is also
+ * set.
+ *
+ * The caller must have the journal locked.
+ */
+int jbd2_journal_cancel_revoke(handle_t *handle, struct journal_head *jh)
+{
+        struct jbd2_revoke_record_s *record;
+        journal_t *journal = handle->h_transaction->t_journal;
+        int need_cancel;
+        int did_revoke = 0;     /* akpm: debug */
+        struct buffer_head *bh = jh2bh(jh);
+
+        jbd_debug(4, "journal_head %p, cancelling revoke\n", jh);
+
+        /* Is the existing Revoke bit valid?  If so, we trust it, and
+         * only perform the full cancel if the revoke bit is set.  If
+         * not, we can't trust the revoke bit, and we need to do the
+         * full search for a revoke record. */
+        if (test_set_buffer_revokevalid(bh)) {
+                need_cancel = test_clear_buffer_revoked(bh);
+        } else {
+                need_cancel = 1;
+                clear_buffer_revoked(bh);
+        }
+
+        if (need_cancel) {
+                record = find_revoke_record(journal, bh->b_blocknr);
+                if (record) {
+                        jbd_debug(4, "cancelled existing revoke on "
+                                  "blocknr %llu\n", (unsigned long long)bh->b_blocknr);
+                        spin_lock(&journal->j_revoke_lock);
+                        list_del(&record->hash);
+                        spin_unlock(&journal->j_revoke_lock);
+                        kmem_cache_free(jbd2_revoke_record_cache, record);
+                        did_revoke = 1;
+                }
+        }
+
+#ifdef JBD_EXPENSIVE_CHECKING
+        /* There better not be one left behind by now! */
+        record = find_revoke_record(journal, bh->b_blocknr);
+        J_ASSERT_JH(jh, record == NULL);
+#endif
+
+        /* Finally, have we just cleared revoke on an unhashed
+         * buffer_head?  If so, we'd better make sure we clear the
+         * revoked status on any hashed alias too, otherwise the revoke
+         * state machine will get very upset later on. */
+        if (need_cancel) {
+                struct buffer_head *bh2;
+                bh2 = __find_get_block(bh->b_bdev, bh->b_blocknr, bh->b_size);
+                if (bh2) {
+                        if (bh2 != bh)
+                                clear_buffer_revoked(bh2);
+                        __brelse(bh2);
+                }
+        }
+        return did_revoke;
+}
+
+/* journal_switch_revoke table select j_revoke for next transaction
+ * we do not want to suspend any processing until all revokes are
+ * written -bzzz
+ */
+void jbd2_journal_switch_revoke_table(journal_t *journal)
+{
+        int i;
+
+        if (journal->j_revoke == journal->j_revoke_table[0])
+                journal->j_revoke = journal->j_revoke_table[1];
+        else
+                journal->j_revoke = journal->j_revoke_table[0];
+
+        for (i = 0; i < journal->j_revoke->hash_size; i++)
+                INIT_LIST_HEAD(&journal->j_revoke->hash_table[i]);
+}
+
+/*
+ * Write revoke records to the journal for all entries in the current
+ * revoke hash, deleting the entries as we go.
+ *
+ * Called with the journal lock held.
+ */
+
+void jbd2_journal_write_revoke_records(journal_t *journal,
+                                  transaction_t *transaction)
+{
+        struct journal_head *descriptor;
+        struct jbd2_revoke_record_s *record;
+        struct jbd2_revoke_table_s *revoke;
+        struct list_head *hash_list;
+        int i, offset, count;
+
+        descriptor = NULL;
+        offset = 0;
+        count = 0;
+
+        /* select revoke table for committing transaction */
+        revoke = journal->j_revoke == journal->j_revoke_table[0] ?
+                journal->j_revoke_table[1] : journal->j_revoke_table[0];
+
+        for (i = 0; i < revoke->hash_size; i++) {
+                hash_list = &revoke->hash_table[i];
+
+                while (!list_empty(hash_list)) {
+                        record = (struct jbd2_revoke_record_s *)
+                                hash_list->next;
+                        write_one_revoke_record(journal, transaction,
+                                                &descriptor, &offset,
+                                                record);
+                        count++;
+                        list_del(&record->hash);
+                        kmem_cache_free(jbd2_revoke_record_cache, record);
+                }
+        }
+        if (descriptor)
+                flush_descriptor(journal, descriptor, offset);
+        jbd_debug(1, "Wrote %d revoke records\n", count);
+}
+
+/*
+ * Write out one revoke record.  We need to create a new descriptor
+ * block if the old one is full or if we have not already created one.
+ */
+
+static void write_one_revoke_record(journal_t *journal,
+                                    transaction_t *transaction,
+                                    struct journal_head **descriptorp,
+                                    int *offsetp,
+                                    struct jbd2_revoke_record_s *record)
+{
+        struct journal_head *descriptor;
+        int offset;
+        journal_header_t *header;
+
+        /* If we are already aborting, this all becomes a noop.  We
+           still need to go round the loop in
+           jbd2_journal_write_revoke_records in order to free all of the
+           revoke records: only the IO to the journal is omitted. */
+        if (is_journal_aborted(journal))
+                return;
+
+        descriptor = *descriptorp;
+        offset = *offsetp;
+
+        /* Make sure we have a descriptor with space left for the record */
+        if (descriptor) {
+                if (offset == journal->j_blocksize) {
+                        flush_descriptor(journal, descriptor, offset);
+                        descriptor = NULL;
+                }
+        }
+
+        if (!descriptor) {
+                descriptor = jbd2_journal_get_descriptor_buffer(journal);
+                if (!descriptor)
+                        return;
+                header = (journal_header_t *) &jh2bh(descriptor)->b_data[0];
+                header->h_magic     = cpu_to_be32(JBD2_MAGIC_NUMBER);
+                header->h_blocktype = cpu_to_be32(JBD2_REVOKE_BLOCK);
+                header->h_sequence  = cpu_to_be32(transaction->t_tid);
+
+                /* Record it so that we can wait for IO completion later */
+                JBUFFER_TRACE(descriptor, "file as BJ_LogCtl");
+                jbd2_journal_file_buffer(descriptor, transaction, BJ_LogCtl);
+
+                offset = sizeof(jbd2_journal_revoke_header_t);
+                *descriptorp = descriptor;
+        }
+
+        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT)) {
+                * ((__be64 *)(&jh2bh(descriptor)->b_data[offset])) =
+                        cpu_to_be64(record->blocknr);
+                offset += 8;
+
+        } else {
+                * ((__be32 *)(&jh2bh(descriptor)->b_data[offset])) =
+                        cpu_to_be32(record->blocknr);
+                offset += 4;
+        }
+
+        *offsetp = offset;
+}
+
+/*
+ * Flush a revoke descriptor out to the journal.  If we are aborting,
+ * this is a noop; otherwise we are generating a buffer which needs to
+ * be waited for during commit, so it has to go onto the appropriate
+ * journal buffer list.
+ */
+
+static void flush_descriptor(journal_t *journal,
+                             struct journal_head *descriptor,
+                             int offset)
+{
+        jbd2_journal_revoke_header_t *header;
+        struct buffer_head *bh = jh2bh(descriptor);
+
+        if (is_journal_aborted(journal)) {
+                put_bh(bh);
+                return;
+        }
+
+        header = (jbd2_journal_revoke_header_t *) jh2bh(descriptor)->b_data;
+        header->r_count = cpu_to_be32(offset);
+        set_buffer_jwrite(bh);
+        BUFFER_TRACE(bh, "write");
+        set_buffer_dirty(bh);
+        ll_rw_block(SWRITE, 1, &bh);
+}
+#endif
+
+/*
+ * Revoke support for recovery.
+ *
+ * Recovery needs to be able to:
+ *
+ *  record all revoke records, including the tid of the latest instance
+ *  of each revoke in the journal
+ *
+ *  check whether a given block in a given transaction should be replayed
+ *  (ie. has not been revoked by a revoke record in that or a subsequent
+ *  transaction)
+ *
+ *  empty the revoke table after recovery.
+ */
+
+/*
+ * First, setting revoke records.  We create a new revoke record for
+ * every block ever revoked in the log as we scan it for recovery, and
+ * we update the existing records if we find multiple revokes for a
+ * single block.
+ */
+
+int jbd2_journal_set_revoke(journal_t *journal,
+                       unsigned long long blocknr,
+                       tid_t sequence)
+{
+        struct jbd2_revoke_record_s *record;
+
+        record = find_revoke_record(journal, blocknr);
+        if (record) {
+                /* If we have multiple occurrences, only record the
+                 * latest sequence number in the hashed record */
+                if (tid_gt(sequence, record->sequence))
+                        record->sequence = sequence;
+                return 0;
+        }
+        return insert_revoke_hash(journal, blocknr, sequence);
+}
+
+/*
+ * Test revoke records.  For a given block referenced in the log, has
+ * that block been revoked?  A revoke record with a given transaction
+ * sequence number revokes all blocks in that transaction and earlier
+ * ones, but later transactions still need replayed.
+ */
+
+int jbd2_journal_test_revoke(journal_t *journal,
+                        unsigned long long blocknr,
+                        tid_t sequence)
+{
+        struct jbd2_revoke_record_s *record;
+
+        record = find_revoke_record(journal, blocknr);
+        if (!record)
+                return 0;
+        if (tid_gt(sequence, record->sequence))
+                return 0;
+        return 1;
+}
+
+/*
+ * Finally, once recovery is over, we need to clear the revoke table so
+ * that it can be reused by the running filesystem.
+ */
+
+void jbd2_journal_clear_revoke(journal_t *journal)
+{
+        int i;
+        struct list_head *hash_list;
+        struct jbd2_revoke_record_s *record;
+        struct jbd2_revoke_table_s *revoke;
+
+        revoke = journal->j_revoke;
+
+        for (i = 0; i < revoke->hash_size; i++) {
+                hash_list = &revoke->hash_table[i];
+                while (!list_empty(hash_list)) {
+                        record = (struct jbd2_revoke_record_s*) hash_list->next;
+                        list_del(&record->hash);
+                        kmem_cache_free(jbd2_revoke_record_cache, record);
+                }
+        }
+}
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
new file mode 100644
index 000000000000..c051a94c8a97
--- /dev/null
+++ b/fs/jbd2/transaction.c
@@ -0,0 +1,2094 @@
+/*
+ * linux/fs/transaction.c
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1998
+ *
+ * Copyright 1998 Red Hat corp --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Generic filesystem transaction handling code; part of the ext2fs
+ * journaling system.
+ *
+ * This file manages transactions (compound commits managed by the
+ * journaling code) and handles (individual atomic operations by the
+ * filesystem).
+ */
+
+#include <linux/time.h>
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/timer.h>
+#include <linux/smp_lock.h>
+#include <linux/mm.h>
+#include <linux/highmem.h>
+
+/*
+ * jbd2_get_transaction: obtain a new transaction_t object.
+ *
+ * Simply allocate and initialise a new transaction.  Create it in
+ * RUNNING state and add it to the current journal (which should not
+ * have an existing running transaction: we only make a new transaction
+ * once we have started to commit the old one).
+ *
+ * Preconditions:
+ *      The journal MUST be locked.  We don't perform atomic mallocs on the
+ *      new transaction and we can't block without protecting against other
+ *      processes trying to touch the journal while it is in transition.
+ *
+ * Called under j_state_lock
+ */
+
+static transaction_t *
+jbd2_get_transaction(journal_t *journal, transaction_t *transaction)
+{
+        transaction->t_journal = journal;
+        transaction->t_state = T_RUNNING;
+        transaction->t_tid = journal->j_transaction_sequence++;
+        transaction->t_expires = jiffies + journal->j_commit_interval;
+        spin_lock_init(&transaction->t_handle_lock);
+
+        /* Set up the commit timer for the new transaction. */
+        journal->j_commit_timer.expires = transaction->t_expires;
+        add_timer(&journal->j_commit_timer);
+
+        J_ASSERT(journal->j_running_transaction == NULL);
+        journal->j_running_transaction = transaction;
+
+        return transaction;
+}
+
+/*
+ * Handle management.
+ *
+ * A handle_t is an object which represents a single atomic update to a
+ * filesystem, and which tracks all of the modifications which form part
+ * of that one update.
+ */
+
+/*
+ * start_this_handle: Given a handle, deal with any locking or stalling
+ * needed to make sure that there is enough journal space for the handle
+ * to begin.  Attach the handle to a transaction and set up the
+ * transaction's buffer credits.
+ */
+
+static int start_this_handle(journal_t *journal, handle_t *handle)
+{
+        transaction_t *transaction;
+        int needed;
+        int nblocks = handle->h_buffer_credits;
+        transaction_t *new_transaction = NULL;
+        int ret = 0;
+
+        if (nblocks > journal->j_max_transaction_buffers) {
+                printk(KERN_ERR "JBD: %s wants too many credits (%d > %d)\n",
+                       current->comm, nblocks,
+                       journal->j_max_transaction_buffers);
+                ret = -ENOSPC;
+                goto out;
+        }
+
+alloc_transaction:
+        if (!journal->j_running_transaction) {
+                new_transaction = jbd_kmalloc(sizeof(*new_transaction),
+                                                GFP_NOFS);
+                if (!new_transaction) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                memset(new_transaction, 0, sizeof(*new_transaction));
+        }
+
+        jbd_debug(3, "New handle %p going live.\n", handle);
+
+repeat:
+
+        /*
+         * We need to hold j_state_lock until t_updates has been incremented,
+         * for proper journal barrier handling
+         */
+        spin_lock(&journal->j_state_lock);
+repeat_locked:
+        if (is_journal_aborted(journal) ||
+            (journal->j_errno != 0 && !(journal->j_flags & JBD2_ACK_ERR))) {
+                spin_unlock(&journal->j_state_lock);
+                ret = -EROFS;
+                goto out;
+        }
+
+        /* Wait on the journal's transaction barrier if necessary */
+        if (journal->j_barrier_count) {
+                spin_unlock(&journal->j_state_lock);
+                wait_event(journal->j_wait_transaction_locked,
+                                journal->j_barrier_count == 0);
+                goto repeat;
+        }
+
+        if (!journal->j_running_transaction) {
+                if (!new_transaction) {
+                        spin_unlock(&journal->j_state_lock);
+                        goto alloc_transaction;
+                }
+                jbd2_get_transaction(journal, new_transaction);
+                new_transaction = NULL;
+        }
+
+        transaction = journal->j_running_transaction;
+
+        /*
+         * If the current transaction is locked down for commit, wait for the
+         * lock to be released.
+         */
+        if (transaction->t_state == T_LOCKED) {
+                DEFINE_WAIT(wait);
+
+                prepare_to_wait(&journal->j_wait_transaction_locked,
+                                        &wait, TASK_UNINTERRUPTIBLE);
+                spin_unlock(&journal->j_state_lock);
+                schedule();
+                finish_wait(&journal->j_wait_transaction_locked, &wait);
+                goto repeat;
+        }
+
+        /*
+         * If there is not enough space left in the log to write all potential
+         * buffers requested by this operation, we need to stall pending a log
+         * checkpoint to free some more log space.
+         */
+        spin_lock(&transaction->t_handle_lock);
+        needed = transaction->t_outstanding_credits + nblocks;
+
+        if (needed > journal->j_max_transaction_buffers) {
+                /*
+                 * If the current transaction is already too large, then start
+                 * to commit it: we can then go back and attach this handle to
+                 * a new transaction.
+                 */
+                DEFINE_WAIT(wait);
+
+                jbd_debug(2, "Handle %p starting new commit...\n", handle);
+                spin_unlock(&transaction->t_handle_lock);
+                prepare_to_wait(&journal->j_wait_transaction_locked, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                __jbd2_log_start_commit(journal, transaction->t_tid);
+                spin_unlock(&journal->j_state_lock);
+                schedule();
+                finish_wait(&journal->j_wait_transaction_locked, &wait);
+                goto repeat;
+        }
+
+        /*
+         * The commit code assumes that it can get enough log space
+         * without forcing a checkpoint.  This is *critical* for
+         * correctness: a checkpoint of a buffer which is also
+         * associated with a committing transaction creates a deadlock,
+         * so commit simply cannot force through checkpoints.
+         *
+         * We must therefore ensure the necessary space in the journal
+         * *before* starting to dirty potentially checkpointed buffers
+         * in the new transaction.
+         *
+         * The worst part is, any transaction currently committing can
+         * reduce the free space arbitrarily.  Be careful to account for
+         * those buffers when checkpointing.
+         */
+
+        /*
+         * @@@ AKPM: This seems rather over-defensive.  We're giving commit
+         * a _lot_ of headroom: 1/4 of the journal plus the size of
+         * the committing transaction.  Really, we only need to give it
+         * committing_transaction->t_outstanding_credits plus "enough" for
+         * the log control blocks.
+         * Also, this test is inconsitent with the matching one in
+         * jbd2_journal_extend().
+         */
+        if (__jbd2_log_space_left(journal) < jbd_space_needed(journal)) {
+                jbd_debug(2, "Handle %p waiting for checkpoint...\n", handle);
+                spin_unlock(&transaction->t_handle_lock);
+                __jbd2_log_wait_for_space(journal);
+                goto repeat_locked;
+        }
+
+        /* OK, account for the buffers that this operation expects to
+         * use and add the handle to the running transaction. */
+
+        handle->h_transaction = transaction;
+        transaction->t_outstanding_credits += nblocks;
+        transaction->t_updates++;
+        transaction->t_handle_count++;
+        jbd_debug(4, "Handle %p given %d credits (total %d, free %d)\n",
+                  handle, nblocks, transaction->t_outstanding_credits,
+                  __jbd2_log_space_left(journal));
+        spin_unlock(&transaction->t_handle_lock);
+        spin_unlock(&journal->j_state_lock);
+out:
+        if (unlikely(new_transaction))          /* It's usually NULL */
+                kfree(new_transaction);
+        return ret;
+}
+
+/* Allocate a new handle.  This should probably be in a slab... */
+static handle_t *new_handle(int nblocks)
+{
+        handle_t *handle = jbd_alloc_handle(GFP_NOFS);
+        if (!handle)
+                return NULL;
+        memset(handle, 0, sizeof(*handle));
+        handle->h_buffer_credits = nblocks;
+        handle->h_ref = 1;
+
+        return handle;
+}
+
+/**
+ * handle_t *jbd2_journal_start() - Obtain a new handle.
+ * @journal: Journal to start transaction on.
+ * @nblocks: number of block buffer we might modify
+ *
+ * We make sure that the transaction can guarantee at least nblocks of
+ * modified buffers in the log.  We block until the log can guarantee
+ * that much space.
+ *
+ * This function is visible to journal users (like ext3fs), so is not
+ * called with the journal already locked.
+ *
+ * Return a pointer to a newly allocated handle, or NULL on failure
+ */
+handle_t *jbd2_journal_start(journal_t *journal, int nblocks)
+{
+        handle_t *handle = journal_current_handle();
+        int err;
+
+        if (!journal)
+                return ERR_PTR(-EROFS);
+
+        if (handle) {
+                J_ASSERT(handle->h_transaction->t_journal == journal);
+                handle->h_ref++;
+                return handle;
+        }
+
+        handle = new_handle(nblocks);
+        if (!handle)
+                return ERR_PTR(-ENOMEM);
+
+        current->journal_info = handle;
+
+        err = start_this_handle(journal, handle);
+        if (err < 0) {
+                jbd_free_handle(handle);
+                current->journal_info = NULL;
+                handle = ERR_PTR(err);
+        }
+        return handle;
+}
+
+/**
+ * int jbd2_journal_extend() - extend buffer credits.
+ * @handle:  handle to 'extend'
+ * @nblocks: nr blocks to try to extend by.
+ *
+ * Some transactions, such as large extends and truncates, can be done
+ * atomically all at once or in several stages.  The operation requests
+ * a credit for a number of buffer modications in advance, but can
+ * extend its credit if it needs more.
+ *
+ * jbd2_journal_extend tries to give the running handle more buffer credits.
+ * It does not guarantee that allocation - this is a best-effort only.
+ * The calling process MUST be able to deal cleanly with a failure to
+ * extend here.
+ *
+ * Return 0 on success, non-zero on failure.
+ *
+ * return code < 0 implies an error
+ * return code > 0 implies normal transaction-full status.
+ */
+int jbd2_journal_extend(handle_t *handle, int nblocks)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        int result;
+        int wanted;
+
+        result = -EIO;
+        if (is_handle_aborted(handle))
+                goto out;
+
+        result = 1;
+
+        spin_lock(&journal->j_state_lock);
+
+        /* Don't extend a locked-down transaction! */
+        if (handle->h_transaction->t_state != T_RUNNING) {
+                jbd_debug(3, "denied handle %p %d blocks: "
+                          "transaction not running\n", handle, nblocks);
+                goto error_out;
+        }
+
+        spin_lock(&transaction->t_handle_lock);
+        wanted = transaction->t_outstanding_credits + nblocks;
+
+        if (wanted > journal->j_max_transaction_buffers) {
+                jbd_debug(3, "denied handle %p %d blocks: "
+                          "transaction too large\n", handle, nblocks);
+                goto unlock;
+        }
+
+        if (wanted > __jbd2_log_space_left(journal)) {
+                jbd_debug(3, "denied handle %p %d blocks: "
+                          "insufficient log space\n", handle, nblocks);
+                goto unlock;
+        }
+
+        handle->h_buffer_credits += nblocks;
+        transaction->t_outstanding_credits += nblocks;
+        result = 0;
+
+        jbd_debug(3, "extended handle %p by %d\n", handle, nblocks);
+unlock:
+        spin_unlock(&transaction->t_handle_lock);
+error_out:
+        spin_unlock(&journal->j_state_lock);
+out:
+        return result;
+}
+
+
+/**
+ * int jbd2_journal_restart() - restart a handle .
+ * @handle:  handle to restart
+ * @nblocks: nr credits requested
+ *
+ * Restart a handle for a multi-transaction filesystem
+ * operation.
+ *
+ * If the jbd2_journal_extend() call above fails to grant new buffer credits
+ * to a running handle, a call to jbd2_journal_restart will commit the
+ * handle's transaction so far and reattach the handle to a new
+ * transaction capabable of guaranteeing the requested number of
+ * credits.
+ */
+
+int jbd2_journal_restart(handle_t *handle, int nblocks)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        int ret;
+
+        /* If we've had an abort of any type, don't even think about
+         * actually doing the restart! */
+        if (is_handle_aborted(handle))
+                return 0;
+
+        /*
+         * First unlink the handle from its current transaction, and start the
+         * commit on that.
+         */
+        J_ASSERT(transaction->t_updates > 0);
+        J_ASSERT(journal_current_handle() == handle);
+
+        spin_lock(&journal->j_state_lock);
+        spin_lock(&transaction->t_handle_lock);
+        transaction->t_outstanding_credits -= handle->h_buffer_credits;
+        transaction->t_updates--;
+
+        if (!transaction->t_updates)
+                wake_up(&journal->j_wait_updates);
+        spin_unlock(&transaction->t_handle_lock);
+
+        jbd_debug(2, "restarting handle %p\n", handle);
+        __jbd2_log_start_commit(journal, transaction->t_tid);
+        spin_unlock(&journal->j_state_lock);
+
+        handle->h_buffer_credits = nblocks;
+        ret = start_this_handle(journal, handle);
+        return ret;
+}
+
+
+/**
+ * void jbd2_journal_lock_updates () - establish a transaction barrier.
+ * @journal:  Journal to establish a barrier on.
+ *
+ * This locks out any further updates from being started, and blocks
+ * until all existing updates have completed, returning only once the
+ * journal is in a quiescent state with no updates running.
+ *
+ * The journal lock should not be held on entry.
+ */
+void jbd2_journal_lock_updates(journal_t *journal)
+{
+        DEFINE_WAIT(wait);
+
+        spin_lock(&journal->j_state_lock);
+        ++journal->j_barrier_count;
+
+        /* Wait until there are no running updates */
+        while (1) {
+                transaction_t *transaction = journal->j_running_transaction;
+
+                if (!transaction)
+                        break;
+
+                spin_lock(&transaction->t_handle_lock);
+                if (!transaction->t_updates) {
+                        spin_unlock(&transaction->t_handle_lock);
+                        break;
+                }
+                prepare_to_wait(&journal->j_wait_updates, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                spin_unlock(&transaction->t_handle_lock);
+                spin_unlock(&journal->j_state_lock);
+                schedule();
+                finish_wait(&journal->j_wait_updates, &wait);
+                spin_lock(&journal->j_state_lock);
+        }
+        spin_unlock(&journal->j_state_lock);
+
+        /*
+         * We have now established a barrier against other normal updates, but
+         * we also need to barrier against other jbd2_journal_lock_updates() calls
+         * to make sure that we serialise special journal-locked operations
+         * too.
+         */
+        mutex_lock(&journal->j_barrier);
+}
+
+/**
+ * void jbd2_journal_unlock_updates (journal_t* journal) - release barrier
+ * @journal:  Journal to release the barrier on.
+ *
+ * Release a transaction barrier obtained with jbd2_journal_lock_updates().
+ *
+ * Should be called without the journal lock held.
+ */
+void jbd2_journal_unlock_updates (journal_t *journal)
+{
+        J_ASSERT(journal->j_barrier_count != 0);
+
+        mutex_unlock(&journal->j_barrier);
+        spin_lock(&journal->j_state_lock);
+        --journal->j_barrier_count;
+        spin_unlock(&journal->j_state_lock);
+        wake_up(&journal->j_wait_transaction_locked);
+}
+
+/*
+ * Report any unexpected dirty buffers which turn up.  Normally those
+ * indicate an error, but they can occur if the user is running (say)
+ * tune2fs to modify the live filesystem, so we need the option of
+ * continuing as gracefully as possible.  #
+ *
+ * The caller should already hold the journal lock and
+ * j_list_lock spinlock: most callers will need those anyway
+ * in order to probe the buffer's journaling state safely.
+ */
+static void jbd_unexpected_dirty_buffer(struct journal_head *jh)
+{
+        int jlist;
+
+        /* If this buffer is one which might reasonably be dirty
+         * --- ie. data, or not part of this journal --- then
+         * we're OK to leave it alone, but otherwise we need to
+         * move the dirty bit to the journal's own internal
+         * JBDDirty bit. */
+        jlist = jh->b_jlist;
+
+        if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
+            jlist == BJ_Shadow || jlist == BJ_Forget) {
+                struct buffer_head *bh = jh2bh(jh);
+
+                if (test_clear_buffer_dirty(bh))
+                        set_buffer_jbddirty(bh);
+        }
+}
+
+/*
+ * If the buffer is already part of the current transaction, then there
+ * is nothing we need to do.  If it is already part of a prior
+ * transaction which we are still committing to disk, then we need to
+ * make sure that we do not overwrite the old copy: we do copy-out to
+ * preserve the copy going to disk.  We also account the buffer against
+ * the handle's metadata buffer credits (unless the buffer is already
+ * part of the transaction, that is).
+ *
+ */
+static int
+do_get_write_access(handle_t *handle, struct journal_head *jh,
+                        int force_copy)
+{
+        struct buffer_head *bh;
+        transaction_t *transaction;
+        journal_t *journal;
+        int error;
+        char *frozen_buffer = NULL;
+        int need_copy = 0;
+
+        if (is_handle_aborted(handle))
+                return -EROFS;
+
+        transaction = handle->h_transaction;
+        journal = transaction->t_journal;
+
+        jbd_debug(5, "buffer_head %p, force_copy %d\n", jh, force_copy);
+
+        JBUFFER_TRACE(jh, "entry");
+repeat:
+        bh = jh2bh(jh);
+
+        /* @@@ Need to check for errors here at some point. */
+
+        lock_buffer(bh);
+        jbd_lock_bh_state(bh);
+
+        /* We now hold the buffer lock so it is safe to query the buffer
+         * state.  Is the buffer dirty?
+         *
+         * If so, there are two possibilities.  The buffer may be
+         * non-journaled, and undergoing a quite legitimate writeback.
+         * Otherwise, it is journaled, and we don't expect dirty buffers
+         * in that state (the buffers should be marked JBD_Dirty
+         * instead.)  So either the IO is being done under our own
+         * control and this is a bug, or it's a third party IO such as
+         * dump(8) (which may leave the buffer scheduled for read ---
+         * ie. locked but not dirty) or tune2fs (which may actually have
+         * the buffer dirtied, ugh.)  */
+
+        if (buffer_dirty(bh)) {
+                /*
+                 * First question: is this buffer already part of the current
+                 * transaction or the existing committing transaction?
+                 */
+                if (jh->b_transaction) {
+                        J_ASSERT_JH(jh,
+                                jh->b_transaction == transaction ||
+                                jh->b_transaction ==
+                                        journal->j_committing_transaction);
+                        if (jh->b_next_transaction)
+                                J_ASSERT_JH(jh, jh->b_next_transaction ==
+                                                        transaction);
+                }
+                /*
+                 * In any case we need to clean the dirty flag and we must
+                 * do it under the buffer lock to be sure we don't race
+                 * with running write-out.
+                 */
+                JBUFFER_TRACE(jh, "Unexpected dirty buffer");
+                jbd_unexpected_dirty_buffer(jh);
+        }
+
+        unlock_buffer(bh);
+
+        error = -EROFS;
+        if (is_handle_aborted(handle)) {
+                jbd_unlock_bh_state(bh);
+                goto out;
+        }
+        error = 0;
+
+        /*
+         * The buffer is already part of this transaction if b_transaction or
+         * b_next_transaction points to it
+         */
+        if (jh->b_transaction == transaction ||
+            jh->b_next_transaction == transaction)
+                goto done;
+
+        /*
+         * If there is already a copy-out version of this buffer, then we don't
+         * need to make another one
+         */
+        if (jh->b_frozen_data) {
+                JBUFFER_TRACE(jh, "has frozen data");
+                J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+                jh->b_next_transaction = transaction;
+                goto done;
+        }
+
+        /* Is there data here we need to preserve? */
+
+        if (jh->b_transaction && jh->b_transaction != transaction) {
+                JBUFFER_TRACE(jh, "owned by older transaction");
+                J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+                J_ASSERT_JH(jh, jh->b_transaction ==
+                                        journal->j_committing_transaction);
+
+                /* There is one case we have to be very careful about.
+                 * If the committing transaction is currently writing
+                 * this buffer out to disk and has NOT made a copy-out,
+                 * then we cannot modify the buffer contents at all
+                 * right now.  The essence of copy-out is that it is the
+                 * extra copy, not the primary copy, which gets
+                 * journaled.  If the primary copy is already going to
+                 * disk then we cannot do copy-out here. */
+
+                if (jh->b_jlist == BJ_Shadow) {
+                        DEFINE_WAIT_BIT(wait, &bh->b_state, BH_Unshadow);
+                        wait_queue_head_t *wqh;
+
+                        wqh = bit_waitqueue(&bh->b_state, BH_Unshadow);
+
+                        JBUFFER_TRACE(jh, "on shadow: sleep");
+                        jbd_unlock_bh_state(bh);
+                        /* commit wakes up all shadow buffers after IO */
+                        for ( ; ; ) {
+                                prepare_to_wait(wqh, &wait.wait,
+                                                TASK_UNINTERRUPTIBLE);
+                                if (jh->b_jlist != BJ_Shadow)
+                                        break;
+                                schedule();
+                        }
+                        finish_wait(wqh, &wait.wait);
+                        goto repeat;
+                }
+
+                /* Only do the copy if the currently-owning transaction
+                 * still needs it.  If it is on the Forget list, the
+                 * committing transaction is past that stage.  The
+                 * buffer had better remain locked during the kmalloc,
+                 * but that should be true --- we hold the journal lock
+                 * still and the buffer is already on the BUF_JOURNAL
+                 * list so won't be flushed.
+                 *
+                 * Subtle point, though: if this is a get_undo_access,
+                 * then we will be relying on the frozen_data to contain
+                 * the new value of the committed_data record after the
+                 * transaction, so we HAVE to force the frozen_data copy
+                 * in that case. */
+
+                if (jh->b_jlist != BJ_Forget || force_copy) {
+                        JBUFFER_TRACE(jh, "generate frozen data");
+                        if (!frozen_buffer) {
+                                JBUFFER_TRACE(jh, "allocate memory for buffer");
+                                jbd_unlock_bh_state(bh);
+                                frozen_buffer =
+                                        jbd2_slab_alloc(jh2bh(jh)->b_size,
+                                                         GFP_NOFS);
+                                if (!frozen_buffer) {
+                                        printk(KERN_EMERG
+                                               "%s: OOM for frozen_buffer\n",
+                                               __FUNCTION__);
+                                        JBUFFER_TRACE(jh, "oom!");
+                                        error = -ENOMEM;
+                                        jbd_lock_bh_state(bh);
+                                        goto done;
+                                }
+                                goto repeat;
+                        }
+                        jh->b_frozen_data = frozen_buffer;
+                        frozen_buffer = NULL;
+                        need_copy = 1;
+                }
+                jh->b_next_transaction = transaction;
+        }
+
+
+        /*
+         * Finally, if the buffer is not journaled right now, we need to make
+         * sure it doesn't get written to disk before the caller actually
+         * commits the new data
+         */
+        if (!jh->b_transaction) {
+                JBUFFER_TRACE(jh, "no transaction");
+                J_ASSERT_JH(jh, !jh->b_next_transaction);
+                jh->b_transaction = transaction;
+                JBUFFER_TRACE(jh, "file as BJ_Reserved");
+                spin_lock(&journal->j_list_lock);
+                __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
+                spin_unlock(&journal->j_list_lock);
+        }
+
+done:
+        if (need_copy) {
+                struct page *page;
+                int offset;
+                char *source;
+
+                J_EXPECT_JH(jh, buffer_uptodate(jh2bh(jh)),
+                            "Possible IO failure.\n");
+                page = jh2bh(jh)->b_page;
+                offset = ((unsigned long) jh2bh(jh)->b_data) & ~PAGE_MASK;
+                source = kmap_atomic(page, KM_USER0);
+                memcpy(jh->b_frozen_data, source+offset, jh2bh(jh)->b_size);
+                kunmap_atomic(source, KM_USER0);
+        }
+        jbd_unlock_bh_state(bh);
+
+        /*
+         * If we are about to journal a buffer, then any revoke pending on it is
+         * no longer valid
+         */
+        jbd2_journal_cancel_revoke(handle, jh);
+
+out:
+        if (unlikely(frozen_buffer))    /* It's usually NULL */
+                jbd2_slab_free(frozen_buffer, bh->b_size);
+
+        JBUFFER_TRACE(jh, "exit");
+        return error;
+}
+
+/**
+ * int jbd2_journal_get_write_access() - notify intent to modify a buffer for metadata (not data) update.
+ * @handle: transaction to add buffer modifications to
+ * @bh:     bh to be used for metadata writes
+ * @credits: variable that will receive credits for the buffer
+ *
+ * Returns an error code or 0 on success.
+ *
+ * In full data journalling mode the buffer may be of type BJ_AsyncData,
+ * because we're write()ing a buffer which is also part of a shared mapping.
+ */
+
+int jbd2_journal_get_write_access(handle_t *handle, struct buffer_head *bh)
+{
+        struct journal_head *jh = jbd2_journal_add_journal_head(bh);
+        int rc;
+
+        /* We do not want to get caught playing with fields which the
+         * log thread also manipulates.  Make sure that the buffer
+         * completes any outstanding IO before proceeding. */
+        rc = do_get_write_access(handle, jh, 0);
+        jbd2_journal_put_journal_head(jh);
+        return rc;
+}
+
+
+/*
+ * When the user wants to journal a newly created buffer_head
+ * (ie. getblk() returned a new buffer and we are going to populate it
+ * manually rather than reading off disk), then we need to keep the
+ * buffer_head locked until it has been completely filled with new
+ * data.  In this case, we should be able to make the assertion that
+ * the bh is not already part of an existing transaction.
+ *
+ * The buffer should already be locked by the caller by this point.
+ * There is no lock ranking violation: it was a newly created,
+ * unlocked buffer beforehand. */
+
+/**
+ * int jbd2_journal_get_create_access () - notify intent to use newly created bh
+ * @handle: transaction to new buffer to
+ * @bh: new buffer.
+ *
+ * Call this if you create a new bh.
+ */
+int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        struct journal_head *jh = jbd2_journal_add_journal_head(bh);
+        int err;
+
+        jbd_debug(5, "journal_head %p\n", jh);
+        err = -EROFS;
+        if (is_handle_aborted(handle))
+                goto out;
+        err = 0;
+
+        JBUFFER_TRACE(jh, "entry");
+        /*
+         * The buffer may already belong to this transaction due to pre-zeroing
+         * in the filesystem's new_block code.  It may also be on the previous,
+         * committing transaction's lists, but it HAS to be in Forget state in
+         * that case: the transaction must have deleted the buffer for it to be
+         * reused here.
+         */
+        jbd_lock_bh_state(bh);
+        spin_lock(&journal->j_list_lock);
+        J_ASSERT_JH(jh, (jh->b_transaction == transaction ||
+                jh->b_transaction == NULL ||
+                (jh->b_transaction == journal->j_committing_transaction &&
+                          jh->b_jlist == BJ_Forget)));
+
+        J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+        J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
+
+        if (jh->b_transaction == NULL) {
+                jh->b_transaction = transaction;
+                JBUFFER_TRACE(jh, "file as BJ_Reserved");
+                __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved);
+        } else if (jh->b_transaction == journal->j_committing_transaction) {
+                JBUFFER_TRACE(jh, "set next transaction");
+                jh->b_next_transaction = transaction;
+        }
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh);
+
+        /*
+         * akpm: I added this.  ext3_alloc_branch can pick up new indirect
+         * blocks which contain freed but then revoked metadata.  We need
+         * to cancel the revoke in case we end up freeing it yet again
+         * and the reallocating as data - this would cause a second revoke,
+         * which hits an assertion error.
+         */
+        JBUFFER_TRACE(jh, "cancelling revoke");
+        jbd2_journal_cancel_revoke(handle, jh);
+        jbd2_journal_put_journal_head(jh);
+out:
+        return err;
+}
+
+/**
+ * int jbd2_journal_get_undo_access() -  Notify intent to modify metadata with
+ *     non-rewindable consequences
+ * @handle: transaction
+ * @bh: buffer to undo
+ * @credits: store the number of taken credits here (if not NULL)
+ *
+ * Sometimes there is a need to distinguish between metadata which has
+ * been committed to disk and that which has not.  The ext3fs code uses
+ * this for freeing and allocating space, we have to make sure that we
+ * do not reuse freed space until the deallocation has been committed,
+ * since if we overwrote that space we would make the delete
+ * un-rewindable in case of a crash.
+ *
+ * To deal with that, jbd2_journal_get_undo_access requests write access to a
+ * buffer for parts of non-rewindable operations such as delete
+ * operations on the bitmaps.  The journaling code must keep a copy of
+ * the buffer's contents prior to the undo_access call until such time
+ * as we know that the buffer has definitely been committed to disk.
+ *
+ * We never need to know which transaction the committed data is part
+ * of, buffers touched here are guaranteed to be dirtied later and so
+ * will be committed to a new transaction in due course, at which point
+ * we can discard the old committed data pointer.
+ *
+ * Returns error number or 0 on success.
+ */
+int jbd2_journal_get_undo_access(handle_t *handle, struct buffer_head *bh)
+{
+        int err;
+        struct journal_head *jh = jbd2_journal_add_journal_head(bh);
+        char *committed_data = NULL;
+
+        JBUFFER_TRACE(jh, "entry");
+
+        /*
+         * Do this first --- it can drop the journal lock, so we want to
+         * make sure that obtaining the committed_data is done
+         * atomically wrt. completion of any outstanding commits.
+         */
+        err = do_get_write_access(handle, jh, 1);
+        if (err)
+                goto out;
+
+repeat:
+        if (!jh->b_committed_data) {
+                committed_data = jbd2_slab_alloc(jh2bh(jh)->b_size, GFP_NOFS);
+                if (!committed_data) {
+                        printk(KERN_EMERG "%s: No memory for committed data\n",
+                                __FUNCTION__);
+                        err = -ENOMEM;
+                        goto out;
+                }
+        }
+
+        jbd_lock_bh_state(bh);
+        if (!jh->b_committed_data) {
+                /* Copy out the current buffer contents into the
+                 * preserved, committed copy. */
+                JBUFFER_TRACE(jh, "generate b_committed data");
+                if (!committed_data) {
+                        jbd_unlock_bh_state(bh);
+                        goto repeat;
+                }
+
+                jh->b_committed_data = committed_data;
+                committed_data = NULL;
+                memcpy(jh->b_committed_data, bh->b_data, bh->b_size);
+        }
+        jbd_unlock_bh_state(bh);
+out:
+        jbd2_journal_put_journal_head(jh);
+        if (unlikely(committed_data))
+                jbd2_slab_free(committed_data, bh->b_size);
+        return err;
+}
+
+/**
+ * int jbd2_journal_dirty_data() -  mark a buffer as containing dirty data which
+ *                             needs to be flushed before we can commit the
+ *                             current transaction.
+ * @handle: transaction
+ * @bh: bufferhead to mark
+ *
+ * The buffer is placed on the transaction's data list and is marked as
+ * belonging to the transaction.
+ *
+ * Returns error number or 0 on success.
+ *
+ * jbd2_journal_dirty_data() can be called via page_launder->ext3_writepage
+ * by kswapd.
+ */
+int jbd2_journal_dirty_data(handle_t *handle, struct buffer_head *bh)
+{
+        journal_t *journal = handle->h_transaction->t_journal;
+        int need_brelse = 0;
+        struct journal_head *jh;
+
+        if (is_handle_aborted(handle))
+                return 0;
+
+        jh = jbd2_journal_add_journal_head(bh);
+        JBUFFER_TRACE(jh, "entry");
+
+        /*
+         * The buffer could *already* be dirty.  Writeout can start
+         * at any time.
+         */
+        jbd_debug(4, "jh: %p, tid:%d\n", jh, handle->h_transaction->t_tid);
+
+        /*
+         * What if the buffer is already part of a running transaction?
+         *
+         * There are two cases:
+         * 1) It is part of the current running transaction.  Refile it,
+         *    just in case we have allocated it as metadata, deallocated
+         *    it, then reallocated it as data.
+         * 2) It is part of the previous, still-committing transaction.
+         *    If all we want to do is to guarantee that the buffer will be
+         *    written to disk before this new transaction commits, then
+         *    being sure that the *previous* transaction has this same
+         *    property is sufficient for us!  Just leave it on its old
+         *    transaction.
+         *
+         * In case (2), the buffer must not already exist as metadata
+         * --- that would violate write ordering (a transaction is free
+         * to write its data at any point, even before the previous
+         * committing transaction has committed).  The caller must
+         * never, ever allow this to happen: there's nothing we can do
+         * about it in this layer.
+         */
+        jbd_lock_bh_state(bh);
+        spin_lock(&journal->j_list_lock);
+
+        /* Now that we have bh_state locked, are we really still mapped? */
+        if (!buffer_mapped(bh)) {
+                JBUFFER_TRACE(jh, "unmapped buffer, bailing out");
+                goto no_journal;
+        }
+
+        if (jh->b_transaction) {
+                JBUFFER_TRACE(jh, "has transaction");
+                if (jh->b_transaction != handle->h_transaction) {
+                        JBUFFER_TRACE(jh, "belongs to older transaction");
+                        J_ASSERT_JH(jh, jh->b_transaction ==
+                                        journal->j_committing_transaction);
+
+                        /* @@@ IS THIS TRUE  ? */
+                        /*
+                         * Not any more.  Scenario: someone does a write()
+                         * in data=journal mode.  The buffer's transaction has
+                         * moved into commit.  Then someone does another
+                         * write() to the file.  We do the frozen data copyout
+                         * and set b_next_transaction to point to j_running_t.
+                         * And while we're in that state, someone does a
+                         * writepage() in an attempt to pageout the same area
+                         * of the file via a shared mapping.  At present that
+                         * calls jbd2_journal_dirty_data(), and we get right here.
+                         * It may be too late to journal the data.  Simply
+                         * falling through to the next test will suffice: the
+                         * data will be dirty and wil be checkpointed.  The
+                         * ordering comments in the next comment block still
+                         * apply.
+                         */
+                        //J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
+                        /*
+                         * If we're journalling data, and this buffer was
+                         * subject to a write(), it could be metadata, forget
+                         * or shadow against the committing transaction.  Now,
+                         * someone has dirtied the same darn page via a mapping
+                         * and it is being writepage()'d.
+                         * We *could* just steal the page from commit, with some
+                         * fancy locking there.  Instead, we just skip it -
+                         * don't tie the page's buffers to the new transaction
+                         * at all.
+                         * Implication: if we crash before the writepage() data
+                         * is written into the filesystem, recovery will replay
+                         * the write() data.
+                         */
+                        if (jh->b_jlist != BJ_None &&
+                                        jh->b_jlist != BJ_SyncData &&
+                                        jh->b_jlist != BJ_Locked) {
+                                JBUFFER_TRACE(jh, "Not stealing");
+                                goto no_journal;
+                        }
+
+                        /*
+                         * This buffer may be undergoing writeout in commit.  We
+                         * can't return from here and let the caller dirty it
+                         * again because that can cause the write-out loop in
+                         * commit to never terminate.
+                         */
+                        if (buffer_dirty(bh)) {
+                                get_bh(bh);
+                                spin_unlock(&journal->j_list_lock);
+                                jbd_unlock_bh_state(bh);
+                                need_brelse = 1;
+                                sync_dirty_buffer(bh);
+                                jbd_lock_bh_state(bh);
+                                spin_lock(&journal->j_list_lock);
+                                /* Since we dropped the lock... */
+                                if (!buffer_mapped(bh)) {
+                                        JBUFFER_TRACE(jh, "buffer got unmapped");
+                                        goto no_journal;
+                                }
+                                /* The buffer may become locked again at any
+                                   time if it is redirtied */
+                        }
+
+                        /* journal_clean_data_list() may have got there first */
+                        if (jh->b_transaction != NULL) {
+                                JBUFFER_TRACE(jh, "unfile from commit");
+                                __jbd2_journal_temp_unlink_buffer(jh);
+                                /* It still points to the committing
+                                 * transaction; move it to this one so
+                                 * that the refile assert checks are
+                                 * happy. */
+                                jh->b_transaction = handle->h_transaction;
+                        }
+                        /* The buffer will be refiled below */
+
+                }
+                /*
+                 * Special case --- the buffer might actually have been
+                 * allocated and then immediately deallocated in the previous,
+                 * committing transaction, so might still be left on that
+                 * transaction's metadata lists.
+                 */
+                if (jh->b_jlist != BJ_SyncData && jh->b_jlist != BJ_Locked) {
+                        JBUFFER_TRACE(jh, "not on correct data list: unfile");
+                        J_ASSERT_JH(jh, jh->b_jlist != BJ_Shadow);
+                        __jbd2_journal_temp_unlink_buffer(jh);
+                        jh->b_transaction = handle->h_transaction;
+                        JBUFFER_TRACE(jh, "file as data");
+                        __jbd2_journal_file_buffer(jh, handle->h_transaction,
+                                                BJ_SyncData);
+                }
+        } else {
+                JBUFFER_TRACE(jh, "not on a transaction");
+                __jbd2_journal_file_buffer(jh, handle->h_transaction, BJ_SyncData);
+        }
+no_journal:
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh);
+        if (need_brelse) {
+                BUFFER_TRACE(bh, "brelse");
+                __brelse(bh);
+        }
+        JBUFFER_TRACE(jh, "exit");
+        jbd2_journal_put_journal_head(jh);
+        return 0;
+}
+
+/**
+ * int jbd2_journal_dirty_metadata() -  mark a buffer as containing dirty metadata
+ * @handle: transaction to add buffer to.
+ * @bh: buffer to mark
+ *
+ * mark dirty metadata which needs to be journaled as part of the current
+ * transaction.
+ *
+ * The buffer is placed on the transaction's metadata list and is marked
+ * as belonging to the transaction.
+ *
+ * Returns error number or 0 on success.
+ *
+ * Special care needs to be taken if the buffer already belongs to the
+ * current committing transaction (in which case we should have frozen
+ * data present for that commit).  In that case, we don't relink the
+ * buffer: that only gets done when the old transaction finally
+ * completes its commit.
+ */
+int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        struct journal_head *jh = bh2jh(bh);
+
+        jbd_debug(5, "journal_head %p\n", jh);
+        JBUFFER_TRACE(jh, "entry");
+        if (is_handle_aborted(handle))
+                goto out;
+
+        jbd_lock_bh_state(bh);
+
+        if (jh->b_modified == 0) {
+                /*
+                 * This buffer's got modified and becoming part
+                 * of the transaction. This needs to be done
+                 * once a transaction -bzzz
+                 */
+                jh->b_modified = 1;
+                J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
+                handle->h_buffer_credits--;
+        }
+
+        /*
+         * fastpath, to avoid expensive locking.  If this buffer is already
+         * on the running transaction's metadata list there is nothing to do.
+         * Nobody can take it off again because there is a handle open.
+         * I _think_ we're OK here with SMP barriers - a mistaken decision will
+         * result in this test being false, so we go in and take the locks.
+         */
+        if (jh->b_transaction == transaction && jh->b_jlist == BJ_Metadata) {
+                JBUFFER_TRACE(jh, "fastpath");
+                J_ASSERT_JH(jh, jh->b_transaction ==
+                                        journal->j_running_transaction);
+                goto out_unlock_bh;
+        }
+
+        set_buffer_jbddirty(bh);
+
+        /*
+         * Metadata already on the current transaction list doesn't
+         * need to be filed.  Metadata on another transaction's list must
+         * be committing, and will be refiled once the commit completes:
+         * leave it alone for now.
+         */
+        if (jh->b_transaction != transaction) {
+                JBUFFER_TRACE(jh, "already on other transaction");
+                J_ASSERT_JH(jh, jh->b_transaction ==
+                                        journal->j_committing_transaction);
+                J_ASSERT_JH(jh, jh->b_next_transaction == transaction);
+                /* And this case is illegal: we can't reuse another
+                 * transaction's data buffer, ever. */
+                goto out_unlock_bh;
+        }
+
+        /* That test should have eliminated the following case: */
+        J_ASSERT_JH(jh, jh->b_frozen_data == 0);
+
+        JBUFFER_TRACE(jh, "file as BJ_Metadata");
+        spin_lock(&journal->j_list_lock);
+        __jbd2_journal_file_buffer(jh, handle->h_transaction, BJ_Metadata);
+        spin_unlock(&journal->j_list_lock);
+out_unlock_bh:
+        jbd_unlock_bh_state(bh);
+out:
+        JBUFFER_TRACE(jh, "exit");
+        return 0;
+}
+
+/*
+ * jbd2_journal_release_buffer: undo a get_write_access without any buffer
+ * updates, if the update decided in the end that it didn't need access.
+ *
+ */
+void
+jbd2_journal_release_buffer(handle_t *handle, struct buffer_head *bh)
+{
+        BUFFER_TRACE(bh, "entry");
+}
+
+/**
+ * void jbd2_journal_forget() - bforget() for potentially-journaled buffers.
+ * @handle: transaction handle
+ * @bh:     bh to 'forget'
+ *
+ * We can only do the bforget if there are no commits pending against the
+ * buffer.  If the buffer is dirty in the current running transaction we
+ * can safely unlink it.
+ *
+ * bh may not be a journalled buffer at all - it may be a non-JBD
+ * buffer which came off the hashtable.  Check for this.
+ *
+ * Decrements bh->b_count by one.
+ *
+ * Allow this call even if the handle has aborted --- it may be part of
+ * the caller's cleanup after an abort.
+ */
+int jbd2_journal_forget (handle_t *handle, struct buffer_head *bh)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        struct journal_head *jh;
+        int drop_reserve = 0;
+        int err = 0;
+
+        BUFFER_TRACE(bh, "entry");
+
+        jbd_lock_bh_state(bh);
+        spin_lock(&journal->j_list_lock);
+
+        if (!buffer_jbd(bh))
+                goto not_jbd;
+        jh = bh2jh(bh);
+
+        /* Critical error: attempting to delete a bitmap buffer, maybe?
+         * Don't do any jbd operations, and return an error. */
+        if (!J_EXPECT_JH(jh, !jh->b_committed_data,
+                         "inconsistent data on disk")) {
+                err = -EIO;
+                goto not_jbd;
+        }
+
+        /*
+         * The buffer's going from the transaction, we must drop
+         * all references -bzzz
+         */
+        jh->b_modified = 0;
+
+        if (jh->b_transaction == handle->h_transaction) {
+                J_ASSERT_JH(jh, !jh->b_frozen_data);
+
+                /* If we are forgetting a buffer which is already part
+                 * of this transaction, then we can just drop it from
+                 * the transaction immediately. */
+                clear_buffer_dirty(bh);
+                clear_buffer_jbddirty(bh);
+
+                JBUFFER_TRACE(jh, "belongs to current transaction: unfile");
+
+                drop_reserve = 1;
+
+                /*
+                 * We are no longer going to journal this buffer.
+                 * However, the commit of this transaction is still
+                 * important to the buffer: the delete that we are now
+                 * processing might obsolete an old log entry, so by
+                 * committing, we can satisfy the buffer's checkpoint.
+                 *
+                 * So, if we have a checkpoint on the buffer, we should
+                 * now refile the buffer on our BJ_Forget list so that
+                 * we know to remove the checkpoint after we commit.
+                 */
+
+                if (jh->b_cp_transaction) {
+                        __jbd2_journal_temp_unlink_buffer(jh);
+                        __jbd2_journal_file_buffer(jh, transaction, BJ_Forget);
+                } else {
+                        __jbd2_journal_unfile_buffer(jh);
+                        jbd2_journal_remove_journal_head(bh);
+                        __brelse(bh);
+                        if (!buffer_jbd(bh)) {
+                                spin_unlock(&journal->j_list_lock);
+                                jbd_unlock_bh_state(bh);
+                                __bforget(bh);
+                                goto drop;
+                        }
+                }
+        } else if (jh->b_transaction) {
+                J_ASSERT_JH(jh, (jh->b_transaction ==
+                                 journal->j_committing_transaction));
+                /* However, if the buffer is still owned by a prior
+                 * (committing) transaction, we can't drop it yet... */
+                JBUFFER_TRACE(jh, "belongs to older transaction");
+                /* ... but we CAN drop it from the new transaction if we
+                 * have also modified it since the original commit. */
+
+                if (jh->b_next_transaction) {
+                        J_ASSERT(jh->b_next_transaction == transaction);
+                        jh->b_next_transaction = NULL;
+                        drop_reserve = 1;
+                }
+        }
+
+not_jbd:
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh);
+        __brelse(bh);
+drop:
+        if (drop_reserve) {
+                /* no need to reserve log space for this block -bzzz */
+                handle->h_buffer_credits++;
+        }
+        return err;
+}
+
+/**
+ * int jbd2_journal_stop() - complete a transaction
+ * @handle: tranaction to complete.
+ *
+ * All done for a particular handle.
+ *
+ * There is not much action needed here.  We just return any remaining
+ * buffer credits to the transaction and remove the handle.  The only
+ * complication is that we need to start a commit operation if the
+ * filesystem is marked for synchronous update.
+ *
+ * jbd2_journal_stop itself will not usually return an error, but it may
+ * do so in unusual circumstances.  In particular, expect it to
+ * return -EIO if a jbd2_journal_abort has been executed since the
+ * transaction began.
+ */
+int jbd2_journal_stop(handle_t *handle)
+{
+        transaction_t *transaction = handle->h_transaction;
+        journal_t *journal = transaction->t_journal;
+        int old_handle_count, err;
+        pid_t pid;
+
+        J_ASSERT(journal_current_handle() == handle);
+
+        if (is_handle_aborted(handle))
+                err = -EIO;
+        else {
+                J_ASSERT(transaction->t_updates > 0);
+                err = 0;
+        }
+
+        if (--handle->h_ref > 0) {
+                jbd_debug(4, "h_ref %d -> %d\n", handle->h_ref + 1,
+                          handle->h_ref);
+                return err;
+        }
+
+        jbd_debug(4, "Handle %p going down\n", handle);
+
+        /*
+         * Implement synchronous transaction batching.  If the handle
+         * was synchronous, don't force a commit immediately.  Let's
+         * yield and let another thread piggyback onto this transaction.
+         * Keep doing that while new threads continue to arrive.
+         * It doesn't cost much - we're about to run a commit and sleep
+         * on IO anyway.  Speeds up many-threaded, many-dir operations
+         * by 30x or more...
+         *
+         * But don't do this if this process was the most recent one to
+         * perform a synchronous write.  We do this to detect the case where a
+         * single process is doing a stream of sync writes.  No point in waiting
+         * for joiners in that case.
+         */
+        pid = current->pid;
+        if (handle->h_sync && journal->j_last_sync_writer != pid) {
+                journal->j_last_sync_writer = pid;
+                do {
+                        old_handle_count = transaction->t_handle_count;
+                        schedule_timeout_uninterruptible(1);
+                } while (old_handle_count != transaction->t_handle_count);
+        }
+
+        current->journal_info = NULL;
+        spin_lock(&journal->j_state_lock);
+        spin_lock(&transaction->t_handle_lock);
+        transaction->t_outstanding_credits -= handle->h_buffer_credits;
+        transaction->t_updates--;
+        if (!transaction->t_updates) {
+                wake_up(&journal->j_wait_updates);
+                if (journal->j_barrier_count)
+                        wake_up(&journal->j_wait_transaction_locked);
+        }
+
+        /*
+         * If the handle is marked SYNC, we need to set another commit
+         * going!  We also want to force a commit if the current
+         * transaction is occupying too much of the log, or if the
+         * transaction is too old now.
+         */
+        if (handle->h_sync ||
+                        transaction->t_outstanding_credits >
+                                journal->j_max_transaction_buffers ||
+                        time_after_eq(jiffies, transaction->t_expires)) {
+                /* Do this even for aborted journals: an abort still
+                 * completes the commit thread, it just doesn't write
+                 * anything to disk. */
+                tid_t tid = transaction->t_tid;
+
+                spin_unlock(&transaction->t_handle_lock);
+                jbd_debug(2, "transaction too old, requesting commit for "
+                                        "handle %p\n", handle);
+                /* This is non-blocking */
+                __jbd2_log_start_commit(journal, transaction->t_tid);
+                spin_unlock(&journal->j_state_lock);
+
+                /*
+                 * Special case: JBD2_SYNC synchronous updates require us
+                 * to wait for the commit to complete.
+                 */
+                if (handle->h_sync && !(current->flags & PF_MEMALLOC))
+                        err = jbd2_log_wait_commit(journal, tid);
+        } else {
+                spin_unlock(&transaction->t_handle_lock);
+                spin_unlock(&journal->j_state_lock);
+        }
+
+        jbd_free_handle(handle);
+        return err;
+}
+
+/**int jbd2_journal_force_commit() - force any uncommitted transactions
+ * @journal: journal to force
+ *
+ * For synchronous operations: force any uncommitted transactions
+ * to disk.  May seem kludgy, but it reuses all the handle batching
+ * code in a very simple manner.
+ */
+int jbd2_journal_force_commit(journal_t *journal)
+{
+        handle_t *handle;
+        int ret;
+
+        handle = jbd2_journal_start(journal, 1);
+        if (IS_ERR(handle)) {
+                ret = PTR_ERR(handle);
+        } else {
+                handle->h_sync = 1;
+                ret = jbd2_journal_stop(handle);
+        }
+        return ret;
+}
+
+/*
+ *
+ * List management code snippets: various functions for manipulating the
+ * transaction buffer lists.
+ *
+ */
+
+/*
+ * Append a buffer to a transaction list, given the transaction's list head
+ * pointer.
+ *
+ * j_list_lock is held.
+ *
+ * jbd_lock_bh_state(jh2bh(jh)) is held.
+ */
+
+static inline void
+__blist_add_buffer(struct journal_head **list, struct journal_head *jh)
+{
+        if (!*list) {
+                jh->b_tnext = jh->b_tprev = jh;
+                *list = jh;
+        } else {
+                /* Insert at the tail of the list to preserve order */
+                struct journal_head *first = *list, *last = first->b_tprev;
+                jh->b_tprev = last;
+                jh->b_tnext = first;
+                last->b_tnext = first->b_tprev = jh;
+        }
+}
+
+/*
+ * Remove a buffer from a transaction list, given the transaction's list
+ * head pointer.
+ *
+ * Called with j_list_lock held, and the journal may not be locked.
+ *
+ * jbd_lock_bh_state(jh2bh(jh)) is held.
+ */
+
+static inline void
+__blist_del_buffer(struct journal_head **list, struct journal_head *jh)
+{
+        if (*list == jh) {
+                *list = jh->b_tnext;
+                if (*list == jh)
+                        *list = NULL;
+        }
+        jh->b_tprev->b_tnext = jh->b_tnext;
+        jh->b_tnext->b_tprev = jh->b_tprev;
+}
+
+/*
+ * Remove a buffer from the appropriate transaction list.
+ *
+ * Note that this function can *change* the value of
+ * bh->b_transaction->t_sync_datalist, t_buffers, t_forget,
+ * t_iobuf_list, t_shadow_list, t_log_list or t_reserved_list.  If the caller
+ * is holding onto a copy of one of thee pointers, it could go bad.
+ * Generally the caller needs to re-read the pointer from the transaction_t.
+ *
+ * Called under j_list_lock.  The journal may not be locked.
+ */
+void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
+{
+        struct journal_head **list = NULL;
+        transaction_t *transaction;
+        struct buffer_head *bh = jh2bh(jh);
+
+        J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
+        transaction = jh->b_transaction;
+        if (transaction)
+                assert_spin_locked(&transaction->t_journal->j_list_lock);
+
+        J_ASSERT_JH(jh, jh->b_jlist < BJ_Types);
+        if (jh->b_jlist != BJ_None)
+                J_ASSERT_JH(jh, transaction != 0);
+
+        switch (jh->b_jlist) {
+        case BJ_None:
+                return;
+        case BJ_SyncData:
+                list = &transaction->t_sync_datalist;
+                break;
+        case BJ_Metadata:
+                transaction->t_nr_buffers--;
+                J_ASSERT_JH(jh, transaction->t_nr_buffers >= 0);
+                list = &transaction->t_buffers;
+                break;
+        case BJ_Forget:
+                list = &transaction->t_forget;
+                break;
+        case BJ_IO:
+                list = &transaction->t_iobuf_list;
+                break;
+        case BJ_Shadow:
+                list = &transaction->t_shadow_list;
+                break;
+        case BJ_LogCtl:
+                list = &transaction->t_log_list;
+                break;
+        case BJ_Reserved:
+                list = &transaction->t_reserved_list;
+                break;
+        case BJ_Locked:
+                list = &transaction->t_locked_list;
+                break;
+        }
+
+        __blist_del_buffer(list, jh);
+        jh->b_jlist = BJ_None;
+        if (test_clear_buffer_jbddirty(bh))
+                mark_buffer_dirty(bh);  /* Expose it to the VM */
+}
+
+void __jbd2_journal_unfile_buffer(struct journal_head *jh)
+{
+        __jbd2_journal_temp_unlink_buffer(jh);
+        jh->b_transaction = NULL;
+}
+
+void jbd2_journal_unfile_buffer(journal_t *journal, struct journal_head *jh)
+{
+        jbd_lock_bh_state(jh2bh(jh));
+        spin_lock(&journal->j_list_lock);
+        __jbd2_journal_unfile_buffer(jh);
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(jh2bh(jh));
+}
+
+/*
+ * Called from jbd2_journal_try_to_free_buffers().
+ *
+ * Called under jbd_lock_bh_state(bh)
+ */
+static void
+__journal_try_to_free_buffer(journal_t *journal, struct buffer_head *bh)
+{
+        struct journal_head *jh;
+
+        jh = bh2jh(bh);
+
+        if (buffer_locked(bh) || buffer_dirty(bh))
+                goto out;
+
+        if (jh->b_next_transaction != 0)
+                goto out;
+
+        spin_lock(&journal->j_list_lock);
+        if (jh->b_transaction != 0 && jh->b_cp_transaction == 0) {
+                if (jh->b_jlist == BJ_SyncData || jh->b_jlist == BJ_Locked) {
+                        /* A written-back ordered data buffer */
+                        JBUFFER_TRACE(jh, "release data");
+                        __jbd2_journal_unfile_buffer(jh);
+                        jbd2_journal_remove_journal_head(bh);
+                        __brelse(bh);
+                }
+        } else if (jh->b_cp_transaction != 0 && jh->b_transaction == 0) {
+                /* written-back checkpointed metadata buffer */
+                if (jh->b_jlist == BJ_None) {
+                        JBUFFER_TRACE(jh, "remove from checkpoint list");
+                        __jbd2_journal_remove_checkpoint(jh);
+                        jbd2_journal_remove_journal_head(bh);
+                        __brelse(bh);
+                }
+        }
+        spin_unlock(&journal->j_list_lock);
+out:
+        return;
+}
+
+
+/**
+ * int jbd2_journal_try_to_free_buffers() - try to free page buffers.
+ * @journal: journal for operation
+ * @page: to try and free
+ * @unused_gfp_mask: unused
+ *
+ *
+ * For all the buffers on this page,
+ * if they are fully written out ordered data, move them onto BUF_CLEAN
+ * so try_to_free_buffers() can reap them.
+ *
+ * This function returns non-zero if we wish try_to_free_buffers()
+ * to be called. We do this if the page is releasable by try_to_free_buffers().
+ * We also do it if the page has locked or dirty buffers and the caller wants
+ * us to perform sync or async writeout.
+ *
+ * This complicates JBD locking somewhat.  We aren't protected by the
+ * BKL here.  We wish to remove the buffer from its committing or
+ * running transaction's ->t_datalist via __jbd2_journal_unfile_buffer.
+ *
+ * This may *change* the value of transaction_t->t_datalist, so anyone
+ * who looks at t_datalist needs to lock against this function.
+ *
+ * Even worse, someone may be doing a jbd2_journal_dirty_data on this
+ * buffer.  So we need to lock against that.  jbd2_journal_dirty_data()
+ * will come out of the lock with the buffer dirty, which makes it
+ * ineligible for release here.
+ *
+ * Who else is affected by this?  hmm...  Really the only contender
+ * is do_get_write_access() - it could be looking at the buffer while
+ * journal_try_to_free_buffer() is changing its state.  But that
+ * cannot happen because we never reallocate freed data as metadata
+ * while the data is part of a transaction.  Yes?
+ */
+int jbd2_journal_try_to_free_buffers(journal_t *journal,
+                                struct page *page, gfp_t unused_gfp_mask)
+{
+        struct buffer_head *head;
+        struct buffer_head *bh;
+        int ret = 0;
+
+        J_ASSERT(PageLocked(page));
+
+        head = page_buffers(page);
+        bh = head;
+        do {
+                struct journal_head *jh;
+
+                /*
+                 * We take our own ref against the journal_head here to avoid
+                 * having to add tons of locking around each instance of
+                 * jbd2_journal_remove_journal_head() and jbd2_journal_put_journal_head().
+                 */
+                jh = jbd2_journal_grab_journal_head(bh);
+                if (!jh)
+                        continue;
+
+                jbd_lock_bh_state(bh);
+                __journal_try_to_free_buffer(journal, bh);
+                jbd2_journal_put_journal_head(jh);
+                jbd_unlock_bh_state(bh);
+                if (buffer_jbd(bh))
+                        goto busy;
+        } while ((bh = bh->b_this_page) != head);
+        ret = try_to_free_buffers(page);
+busy:
+        return ret;
+}
+
+/*
+ * This buffer is no longer needed.  If it is on an older transaction's
+ * checkpoint list we need to record it on this transaction's forget list
+ * to pin this buffer (and hence its checkpointing transaction) down until
+ * this transaction commits.  If the buffer isn't on a checkpoint list, we
+ * release it.
+ * Returns non-zero if JBD no longer has an interest in the buffer.
+ *
+ * Called under j_list_lock.
+ *
+ * Called under jbd_lock_bh_state(bh).
+ */
+static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction)
+{
+        int may_free = 1;
+        struct buffer_head *bh = jh2bh(jh);
+
+        __jbd2_journal_unfile_buffer(jh);
+
+        if (jh->b_cp_transaction) {
+                JBUFFER_TRACE(jh, "on running+cp transaction");
+                __jbd2_journal_file_buffer(jh, transaction, BJ_Forget);
+                clear_buffer_jbddirty(bh);
+                may_free = 0;
+        } else {
+                JBUFFER_TRACE(jh, "on running transaction");
+                jbd2_journal_remove_journal_head(bh);
+                __brelse(bh);
+        }
+        return may_free;
+}
+
+/*
+ * jbd2_journal_invalidatepage
+ *
+ * This code is tricky.  It has a number of cases to deal with.
+ *
+ * There are two invariants which this code relies on:
+ *
+ * i_size must be updated on disk before we start calling invalidatepage on the
+ * data.
+ *
+ *  This is done in ext3 by defining an ext3_setattr method which
+ *  updates i_size before truncate gets going.  By maintaining this
+ *  invariant, we can be sure that it is safe to throw away any buffers
+ *  attached to the current transaction: once the transaction commits,
+ *  we know that the data will not be needed.
+ *
+ *  Note however that we can *not* throw away data belonging to the
+ *  previous, committing transaction!
+ *
+ * Any disk blocks which *are* part of the previous, committing
+ * transaction (and which therefore cannot be discarded immediately) are
+ * not going to be reused in the new running transaction
+ *
+ *  The bitmap committed_data images guarantee this: any block which is
+ *  allocated in one transaction and removed in the next will be marked
+ *  as in-use in the committed_data bitmap, so cannot be reused until
+ *  the next transaction to delete the block commits.  This means that
+ *  leaving committing buffers dirty is quite safe: the disk blocks
+ *  cannot be reallocated to a different file and so buffer aliasing is
+ *  not possible.
+ *
+ *
+ * The above applies mainly to ordered data mode.  In writeback mode we
+ * don't make guarantees about the order in which data hits disk --- in
+ * particular we don't guarantee that new dirty data is flushed before
+ * transaction commit --- so it is always safe just to discard data
+ * immediately in that mode.  --sct
+ */
+
+/*
+ * The journal_unmap_buffer helper function returns zero if the buffer
+ * concerned remains pinned as an anonymous buffer belonging to an older
+ * transaction.
+ *
+ * We're outside-transaction here.  Either or both of j_running_transaction
+ * and j_committing_transaction may be NULL.
+ */
+static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
+{
+        transaction_t *transaction;
+        struct journal_head *jh;
+        int may_free = 1;
+        int ret;
+
+        BUFFER_TRACE(bh, "entry");
+
+        /*
+         * It is safe to proceed here without the j_list_lock because the
+         * buffers cannot be stolen by try_to_free_buffers as long as we are
+         * holding the page lock. --sct
+         */
+
+        if (!buffer_jbd(bh))
+                goto zap_buffer_unlocked;
+
+        spin_lock(&journal->j_state_lock);
+        jbd_lock_bh_state(bh);
+        spin_lock(&journal->j_list_lock);
+
+        jh = jbd2_journal_grab_journal_head(bh);
+        if (!jh)
+                goto zap_buffer_no_jh;
+
+        transaction = jh->b_transaction;
+        if (transaction == NULL) {
+                /* First case: not on any transaction.  If it
+                 * has no checkpoint link, then we can zap it:
+                 * it's a writeback-mode buffer so we don't care
+                 * if it hits disk safely. */
+                if (!jh->b_cp_transaction) {
+                        JBUFFER_TRACE(jh, "not on any transaction: zap");
+                        goto zap_buffer;
+                }
+
+                if (!buffer_dirty(bh)) {
+                        /* bdflush has written it.  We can drop it now */
+                        goto zap_buffer;
+                }
+
+                /* OK, it must be in the journal but still not
+                 * written fully to disk: it's metadata or
+                 * journaled data... */
+
+                if (journal->j_running_transaction) {
+                        /* ... and once the current transaction has
+                         * committed, the buffer won't be needed any
+                         * longer. */
+                        JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget");
+                        ret = __dispose_buffer(jh,
+                                        journal->j_running_transaction);
+                        jbd2_journal_put_journal_head(jh);
+                        spin_unlock(&journal->j_list_lock);
+                        jbd_unlock_bh_state(bh);
+                        spin_unlock(&journal->j_state_lock);
+                        return ret;
+                } else {
+                        /* There is no currently-running transaction. So the
+                         * orphan record which we wrote for this file must have
+                         * passed into commit.  We must attach this buffer to
+                         * the committing transaction, if it exists. */
+                        if (journal->j_committing_transaction) {
+                                JBUFFER_TRACE(jh, "give to committing trans");
+                                ret = __dispose_buffer(jh,
+                                        journal->j_committing_transaction);
+                                jbd2_journal_put_journal_head(jh);
+                                spin_unlock(&journal->j_list_lock);
+                                jbd_unlock_bh_state(bh);
+                                spin_unlock(&journal->j_state_lock);
+                                return ret;
+                        } else {
+                                /* The orphan record's transaction has
+                                 * committed.  We can cleanse this buffer */
+                                clear_buffer_jbddirty(bh);
+                                goto zap_buffer;
+                        }
+                }
+        } else if (transaction == journal->j_committing_transaction) {
+                JBUFFER_TRACE(jh, "on committing transaction");
+                if (jh->b_jlist == BJ_Locked) {
+                        /*
+                         * The buffer is on the committing transaction's locked
+                         * list.  We have the buffer locked, so I/O has
+                         * completed.  So we can nail the buffer now.
+                         */
+                        may_free = __dispose_buffer(jh, transaction);
+                        goto zap_buffer;
+                }
+                /*
+                 * If it is committing, we simply cannot touch it.  We
+                 * can remove it's next_transaction pointer from the
+                 * running transaction if that is set, but nothing
+                 * else. */
+                set_buffer_freed(bh);
+                if (jh->b_next_transaction) {
+                        J_ASSERT(jh->b_next_transaction ==
+                                        journal->j_running_transaction);
+                        jh->b_next_transaction = NULL;
+                }
+                jbd2_journal_put_journal_head(jh);
+                spin_unlock(&journal->j_list_lock);
+                jbd_unlock_bh_state(bh);
+                spin_unlock(&journal->j_state_lock);
+                return 0;
+        } else {
+                /* Good, the buffer belongs to the running transaction.
+                 * We are writing our own transaction's data, not any
+                 * previous one's, so it is safe to throw it away
+                 * (remember that we expect the filesystem to have set
+                 * i_size already for this truncate so recovery will not
+                 * expose the disk blocks we are discarding here.) */
+                J_ASSERT_JH(jh, transaction == journal->j_running_transaction);
+                JBUFFER_TRACE(jh, "on running transaction");
+                may_free = __dispose_buffer(jh, transaction);
+        }
+
+zap_buffer:
+        jbd2_journal_put_journal_head(jh);
+zap_buffer_no_jh:
+        spin_unlock(&journal->j_list_lock);
+        jbd_unlock_bh_state(bh);
+        spin_unlock(&journal->j_state_lock);
+zap_buffer_unlocked:
+        clear_buffer_dirty(bh);
+        J_ASSERT_BH(bh, !buffer_jbddirty(bh));
+        clear_buffer_mapped(bh);
+        clear_buffer_req(bh);
+        clear_buffer_new(bh);
+        bh->b_bdev = NULL;
+        return may_free;
+}
+
+/**
+ * void jbd2_journal_invalidatepage()
+ * @journal: journal to use for flush...
+ * @page:    page to flush
+ * @offset:  length of page to invalidate.
+ *
+ * Reap page buffers containing data after offset in page.
+ *
+ */
+void jbd2_journal_invalidatepage(journal_t *journal,
+                      struct page *page,
+                      unsigned long offset)
+{
+        struct buffer_head *head, *bh, *next;
+        unsigned int curr_off = 0;
+        int may_free = 1;
+
+        if (!PageLocked(page))
+                BUG();
+        if (!page_has_buffers(page))
+                return;
+
+        /* We will potentially be playing with lists other than just the
+         * data lists (especially for journaled data mode), so be
+         * cautious in our locking. */
+
+        head = bh = page_buffers(page);
+        do {
+                unsigned int next_off = curr_off + bh->b_size;
+                next = bh->b_this_page;
+
+                if (offset <= curr_off) {
+                        /* This block is wholly outside the truncation point */
+                        lock_buffer(bh);
+                        may_free &= journal_unmap_buffer(journal, bh);
+                        unlock_buffer(bh);
+                }
+                curr_off = next_off;
+                bh = next;
+
+        } while (bh != head);
+
+        if (!offset) {
+                if (may_free && try_to_free_buffers(page))
+                        J_ASSERT(!page_has_buffers(page));
+        }
+}
+
+/*
+ * File a buffer on the given transaction list.
+ */
+void __jbd2_journal_file_buffer(struct journal_head *jh,
+                        transaction_t *transaction, int jlist)
+{
+        struct journal_head **list = NULL;
+        int was_dirty = 0;
+        struct buffer_head *bh = jh2bh(jh);
+
+        J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
+        assert_spin_locked(&transaction->t_journal->j_list_lock);
+
+        J_ASSERT_JH(jh, jh->b_jlist < BJ_Types);
+        J_ASSERT_JH(jh, jh->b_transaction == transaction ||
+                                jh->b_transaction == 0);
+
+        if (jh->b_transaction && jh->b_jlist == jlist)
+                return;
+
+        /* The following list of buffer states needs to be consistent
+         * with __jbd_unexpected_dirty_buffer()'s handling of dirty
+         * state. */
+
+        if (jlist == BJ_Metadata || jlist == BJ_Reserved ||
+            jlist == BJ_Shadow || jlist == BJ_Forget) {
+                if (test_clear_buffer_dirty(bh) ||
+                    test_clear_buffer_jbddirty(bh))
+                        was_dirty = 1;
+        }
+
+        if (jh->b_transaction)
+                __jbd2_journal_temp_unlink_buffer(jh);
+        jh->b_transaction = transaction;
+
+        switch (jlist) {
+        case BJ_None:
+                J_ASSERT_JH(jh, !jh->b_committed_data);
+                J_ASSERT_JH(jh, !jh->b_frozen_data);
+                return;
+        case BJ_SyncData:
+                list = &transaction->t_sync_datalist;
+                break;
+        case BJ_Metadata:
+                transaction->t_nr_buffers++;
+                list = &transaction->t_buffers;
+                break;
+        case BJ_Forget:
+                list = &transaction->t_forget;
+                break;
+        case BJ_IO:
+                list = &transaction->t_iobuf_list;
+                break;
+        case BJ_Shadow:
+                list = &transaction->t_shadow_list;
+                break;
+        case BJ_LogCtl:
+                list = &transaction->t_log_list;
+                break;
+        case BJ_Reserved:
+                list = &transaction->t_reserved_list;
+                break;
+        case BJ_Locked:
+                list =  &transaction->t_locked_list;
+                break;
+        }
+
+        __blist_add_buffer(list, jh);
+        jh->b_jlist = jlist;
+
+        if (was_dirty)
+                set_buffer_jbddirty(bh);
+}
+
+void jbd2_journal_file_buffer(struct journal_head *jh,
+                                transaction_t *transaction, int jlist)
+{
+        jbd_lock_bh_state(jh2bh(jh));
+        spin_lock(&transaction->t_journal->j_list_lock);
+        __jbd2_journal_file_buffer(jh, transaction, jlist);
+        spin_unlock(&transaction->t_journal->j_list_lock);
+        jbd_unlock_bh_state(jh2bh(jh));
+}
+
+/*
+ * Remove a buffer from its current buffer list in preparation for
+ * dropping it from its current transaction entirely.  If the buffer has
+ * already started to be used by a subsequent transaction, refile the
+ * buffer on that transaction's metadata list.
+ *
+ * Called under journal->j_list_lock
+ *
+ * Called under jbd_lock_bh_state(jh2bh(jh))
+ */
+void __jbd2_journal_refile_buffer(struct journal_head *jh)
+{
+        int was_dirty;
+        struct buffer_head *bh = jh2bh(jh);
+
+        J_ASSERT_JH(jh, jbd_is_locked_bh_state(bh));
+        if (jh->b_transaction)
+                assert_spin_locked(&jh->b_transaction->t_journal->j_list_lock);
+
+        /* If the buffer is now unused, just drop it. */
+        if (jh->b_next_transaction == NULL) {
+                __jbd2_journal_unfile_buffer(jh);
+                return;
+        }
+
+        /*
+         * It has been modified by a later transaction: add it to the new
+         * transaction's metadata list.
+         */
+
+        was_dirty = test_clear_buffer_jbddirty(bh);
+        __jbd2_journal_temp_unlink_buffer(jh);
+        jh->b_transaction = jh->b_next_transaction;
+        jh->b_next_transaction = NULL;
+        __jbd2_journal_file_buffer(jh, jh->b_transaction,
+                                was_dirty ? BJ_Metadata : BJ_Reserved);
+        J_ASSERT_JH(jh, jh->b_transaction->t_state == T_RUNNING);
+
+        if (was_dirty)
+                set_buffer_jbddirty(bh);
+}
+
+/*
+ * For the unlocked version of this call, also make sure that any
+ * hanging journal_head is cleaned up if necessary.
+ *
+ * __jbd2_journal_refile_buffer is usually called as part of a single locked
+ * operation on a buffer_head, in which the caller is probably going to
+ * be hooking the journal_head onto other lists.  In that case it is up
+ * to the caller to remove the journal_head if necessary.  For the
+ * unlocked jbd2_journal_refile_buffer call, the caller isn't going to be
+ * doing anything else to the buffer so we need to do the cleanup
+ * ourselves to avoid a jh leak.
+ *
+ * *** The journal_head may be freed by this call! ***
+ */
+void jbd2_journal_refile_buffer(journal_t *journal, struct journal_head *jh)
+{
+        struct buffer_head *bh = jh2bh(jh);
+
+        jbd_lock_bh_state(bh);
+        spin_lock(&journal->j_list_lock);
+
+        __jbd2_journal_refile_buffer(jh);
+        jbd_unlock_bh_state(bh);
+        jbd2_journal_remove_journal_head(bh);
+
+        spin_unlock(&journal->j_list_lock);
+        __brelse(bh);
+}
diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c
index 6de374513c01..bc4b8106a490 100644
--- a/fs/jffs2/super.c
+++ b/fs/jffs2/super.c
@@ -334,10 +334,10 @@ static int __init init_jffs2_fs(void)
            which means just 'no padding', without the alignment
            thing. But GCC doesn't have that -- we have to just
            hope the structs are the right sizes, instead. */
-        BUG_ON(sizeof(struct jffs2_unknown_node) != 12);
-        BUG_ON(sizeof(struct jffs2_raw_dirent) != 40);
-        BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
-        BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
+        BUILD_BUG_ON(sizeof(struct jffs2_unknown_node) != 12);
+        BUILD_BUG_ON(sizeof(struct jffs2_raw_dirent) != 40);
+        BUILD_BUG_ON(sizeof(struct jffs2_raw_inode) != 68);
+        BUILD_BUG_ON(sizeof(struct jffs2_raw_summary) != 32);
 
         printk(KERN_INFO "JFFS2 version 2.2."
 #ifdef CONFIG_JFFS2_FS_WRITEBUFFER
diff --git a/fs/jfs/file.c b/fs/jfs/file.c
index 34181b8f5a0a..aa9132d04920 100644
--- a/fs/jfs/file.c
+++ b/fs/jfs/file.c
@@ -109,6 +109,8 @@ const struct file_operations jfs_file_operations = {
         .aio_write      = generic_file_aio_write,
         .mmap           = generic_file_mmap,
         .sendfile       = generic_file_sendfile,
+        .splice_read    = generic_file_splice_read,
+        .splice_write   = generic_file_splice_write,
         .fsync          = jfs_fsync,
         .release        = jfs_release,
         .ioctl          = jfs_ioctl,
diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c
index 489a3d63002d..ee9b473b7b80 100644
--- a/fs/jfs/jfs_imap.c
+++ b/fs/jfs/jfs_imap.c
@@ -318,7 +318,7 @@ int diRead(struct inode *ip)
         struct inomap *imap;
         int block_offset;
         int inodes_left;
-        uint pageno;
+        unsigned long pageno;
         int rel_inode;
 
         jfs_info("diRead: ino = %ld", ip->i_ino);
@@ -606,7 +606,7 @@ int diWrite(tid_t tid, struct inode *ip)
         int block_offset;
         int inodes_left;
         struct metapage *mp;
-        uint pageno;
+        unsigned long pageno;
         int rel_inode;
         int dioffset;
         struct inode *ipimap;
diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c
index 4c7985ebca92..b753ba216450 100644
--- a/fs/jfs/xattr.c
+++ b/fs/jfs/xattr.c
@@ -756,6 +756,11 @@ static int can_set_system_xattr(struct inode *inode, const char *name,
         return -EOPNOTSUPP;
 }
 
+/*
+ * Most of the permission checking is done by xattr_permission in the vfs.
+ * The local file system is responsible for handling the system.* namespace.
+ * We also need to verify that this is a namespace that we recognize.
+ */
 static int can_set_xattr(struct inode *inode, const char *name,
                          const void *value, size_t value_len)
 {
@@ -771,10 +776,6 @@ static int can_set_xattr(struct inode *inode, const char *name,
             strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN))
                 return -EOPNOTSUPP;
 
-        if (!S_ISREG(inode->i_mode) &&
-            (!S_ISDIR(inode->i_mode) || inode->i_mode &S_ISVTX))
-                return -EPERM;
-
         return 0;
 }
 
diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index e8c7765419e8..b85a0ad2cfb6 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -100,12 +100,12 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout)
 /*
  * The server lockd has called us back to tell us the lock was granted
  */
-u32 nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *lock)
+__be32 nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *lock)
 {
         const struct file_lock *fl = &lock->fl;
         const struct nfs_fh *fh = &lock->fh;
         struct nlm_wait *block;
-        u32 res = nlm_lck_denied;
+        __be32 res = nlm_lck_denied;
 
         /*
          * Look up blocked request based on arguments. 
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index e0179f8c327f..eb243edf8932 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -148,8 +148,8 @@ nsm_create(void)
  * XDR functions for NSM.
  */
 
-static u32 *
-xdr_encode_common(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
+static __be32 *
+xdr_encode_common(struct rpc_rqst *rqstp, __be32 *p, struct nsm_args *argp)
 {
         char    buffer[20], *name;
 
@@ -176,7 +176,7 @@ xdr_encode_common(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
 }
 
 static int
-xdr_encode_mon(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
+xdr_encode_mon(struct rpc_rqst *rqstp, __be32 *p, struct nsm_args *argp)
 {
         p = xdr_encode_common(rqstp, p, argp);
         if (IS_ERR(p))
@@ -192,7 +192,7 @@ xdr_encode_mon(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
 }
 
 static int
-xdr_encode_unmon(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
+xdr_encode_unmon(struct rpc_rqst *rqstp, __be32 *p, struct nsm_args *argp)
 {
         p = xdr_encode_common(rqstp, p, argp);
         if (IS_ERR(p))
@@ -202,7 +202,7 @@ xdr_encode_unmon(struct rpc_rqst *rqstp, u32 *p, struct nsm_args *argp)
 }
 
 static int
-xdr_decode_stat_res(struct rpc_rqst *rqstp, u32 *p, struct nsm_res *resp)
+xdr_decode_stat_res(struct rpc_rqst *rqstp, __be32 *p, struct nsm_res *resp)
 {
         resp->status = ntohl(*p++);
         resp->state = ntohl(*p++);
@@ -212,7 +212,7 @@ xdr_decode_stat_res(struct rpc_rqst *rqstp, u32 *p, struct nsm_res *resp)
 }
 
 static int
-xdr_decode_stat(struct rpc_rqst *rqstp, u32 *p, struct nsm_res *resp)
+xdr_decode_stat(struct rpc_rqst *rqstp, __be32 *p, struct nsm_res *resp)
 {
         resp->state = ntohl(*p++);
         return 0;
diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index 634139232aaf..8ca18085e68d 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -353,9 +353,6 @@ EXPORT_SYMBOL(lockd_down);
  * Sysctl parameters (same as module parameters, different interface).
  */
 
-/* Something that isn't CTL_ANY, CTL_NONE or a value that may clash. */
-#define CTL_UNNUMBERED          -2
-
 static ctl_table nlm_sysctls[] = {
         {
                 .ctl_name       = CTL_UNNUMBERED,
diff --git a/fs/lockd/svc4proc.c b/fs/lockd/svc4proc.c
index fa370f6eb07b..0ce5c81ff507 100644
--- a/fs/lockd/svc4proc.c
+++ b/fs/lockd/svc4proc.c
@@ -24,14 +24,14 @@
 /*
  * Obtain client and file from arguments
  */
-static u32
+static __be32
 nlm4svc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp,
                         struct nlm_host **hostp, struct nlm_file **filp)
 {
         struct nlm_host         *host = NULL;
         struct nlm_file         *file = NULL;
         struct nlm_lock         *lock = &argp->lock;
-        u32                     error = 0;
+        __be32                  error = 0;
 
         /* nfsd callbacks must have been installed for this procedure */
         if (!nlmsvc_ops)
@@ -68,7 +68,7 @@ no_locks:
 /*
  * NULL: Test for presence of service
  */
-static int
+static __be32
 nlm4svc_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         dprintk("lockd: NULL          called\n");
@@ -78,7 +78,7 @@ nlm4svc_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 /*
  * TEST: Check for conflicting lock
  */
-static int
+static __be32
 nlm4svc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
                                          struct nlm_res  *resp)
 {
@@ -96,7 +96,7 @@ nlm4svc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now check for conflicting locks */
         resp->status = nlmsvc_testlock(file, &argp->lock, &resp->lock);
@@ -107,7 +107,7 @@ nlm4svc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
         return rpc_success;
 }
 
-static int
+static __be32
 nlm4svc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                          struct nlm_res  *resp)
 {
@@ -126,7 +126,7 @@ nlm4svc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
 #if 0
         /* If supplied state doesn't match current state, we assume it's
@@ -150,7 +150,7 @@ nlm4svc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
         return rpc_success;
 }
 
-static int
+static __be32
 nlm4svc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
                                            struct nlm_res  *resp)
 {
@@ -169,7 +169,7 @@ nlm4svc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Try to cancel request. */
         resp->status = nlmsvc_cancel_blocked(file, &argp->lock);
@@ -183,7 +183,7 @@ nlm4svc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * UNLOCK: release a lock
  */
-static int
+static __be32
 nlm4svc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                            struct nlm_res  *resp)
 {
@@ -202,7 +202,7 @@ nlm4svc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to remove the lock */
         resp->status = nlmsvc_unlock(file, &argp->lock);
@@ -217,7 +217,7 @@ nlm4svc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
  * GRANTED: A server calls us to tell that a process' lock request
  * was granted
  */
-static int
+static __be32
 nlm4svc_proc_granted(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -253,12 +253,12 @@ static const struct rpc_call_ops nlm4svc_callback_ops = {
  * because we send the callback before the reply proper. I hope this
  * doesn't break any clients.
  */
-static int nlm4svc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *argp,
-                int (*func)(struct svc_rqst *, struct nlm_args *, struct nlm_res  *))
+static __be32 nlm4svc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *argp,
+                __be32 (*func)(struct svc_rqst *, struct nlm_args *, struct nlm_res  *))
 {
         struct nlm_host *host;
         struct nlm_rqst *call;
-        int stat;
+        __be32 stat;
 
         host = nlmsvc_lookup_host(rqstp,
                                   argp->lock.caller,
@@ -282,35 +282,35 @@ static int nlm4svc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *a
         return rpc_success;
 }
 
-static int nlm4svc_proc_test_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlm4svc_proc_test_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
         dprintk("lockd: TEST_MSG      called\n");
         return nlm4svc_callback(rqstp, NLMPROC_TEST_RES, argp, nlm4svc_proc_test);
 }
 
-static int nlm4svc_proc_lock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlm4svc_proc_lock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
         dprintk("lockd: LOCK_MSG      called\n");
         return nlm4svc_callback(rqstp, NLMPROC_LOCK_RES, argp, nlm4svc_proc_lock);
 }
 
-static int nlm4svc_proc_cancel_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlm4svc_proc_cancel_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                void            *resp)
 {
         dprintk("lockd: CANCEL_MSG    called\n");
         return nlm4svc_callback(rqstp, NLMPROC_CANCEL_RES, argp, nlm4svc_proc_cancel);
 }
 
-static int nlm4svc_proc_unlock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlm4svc_proc_unlock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                void            *resp)
 {
         dprintk("lockd: UNLOCK_MSG    called\n");
         return nlm4svc_callback(rqstp, NLMPROC_UNLOCK_RES, argp, nlm4svc_proc_unlock);
 }
 
-static int nlm4svc_proc_granted_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlm4svc_proc_granted_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                 void            *resp)
 {
         dprintk("lockd: GRANTED_MSG   called\n");
@@ -320,7 +320,7 @@ static int nlm4svc_proc_granted_msg(struct svc_rqst *rqstp, struct nlm_args *arg
 /*
  * SHARE: create a DOS share or alter existing share.
  */
-static int
+static __be32
 nlm4svc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
                                           struct nlm_res  *resp)
 {
@@ -339,7 +339,7 @@ nlm4svc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to create the share */
         resp->status = nlmsvc_share_file(host, file, argp);
@@ -353,7 +353,7 @@ nlm4svc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * UNSHARE: Release a DOS share.
  */
-static int
+static __be32
 nlm4svc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -372,7 +372,7 @@ nlm4svc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlm4svc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to lock the file */
         resp->status = nlmsvc_unshare_file(host, file, argp);
@@ -386,7 +386,7 @@ nlm4svc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * NM_LOCK: Create an unmonitored lock
  */
-static int
+static __be32
 nlm4svc_proc_nm_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -399,7 +399,7 @@ nlm4svc_proc_nm_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * FREE_ALL: Release all locks and shares held by client
  */
-static int
+static __be32
 nlm4svc_proc_free_all(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
@@ -417,7 +417,7 @@ nlm4svc_proc_free_all(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * SM_NOTIFY: private callback from statd (not part of official NLM proto)
  */
-static int
+static __be32
 nlm4svc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
                                               void              *resp)
 {
@@ -446,7 +446,7 @@ nlm4svc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
 /*
  * client sent a GRANTED_RES, let's remove the associated block
  */
-static int
+static __be32
 nlm4svc_proc_granted_res(struct svc_rqst *rqstp, struct nlm_res  *argp,
                                                 void            *resp)
 {
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 814c6064c9e0..7e219b938552 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -334,13 +334,13 @@ static void nlmsvc_freegrantargs(struct nlm_rqst *call)
  * Attempt to establish a lock, and if it can't be granted, block it
  * if required.
  */
-u32
+__be32
 nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                         struct nlm_lock *lock, int wait, struct nlm_cookie *cookie)
 {
         struct nlm_block        *block, *newblock = NULL;
         int                     error;
-        u32                     ret;
+        __be32                  ret;
 
         dprintk("lockd: nlmsvc_lock(%s/%ld, ty=%d, pi=%d, %Ld-%Ld, bl=%d)\n",
                                 file->f_file->f_dentry->d_inode->i_sb->s_id,
@@ -415,7 +415,7 @@ out:
 /*
  * Test for presence of a conflicting lock.
  */
-u32
+__be32
 nlmsvc_testlock(struct nlm_file *file, struct nlm_lock *lock,
                                        struct nlm_lock *conflock)
 {
@@ -448,7 +448,7 @@ nlmsvc_testlock(struct nlm_file *file, struct nlm_lock *lock,
  * afterwards. In this case the block will still be there, and hence
  * must be removed.
  */
-u32
+__be32
 nlmsvc_unlock(struct nlm_file *file, struct nlm_lock *lock)
 {
         int     error;
@@ -476,7 +476,7 @@ nlmsvc_unlock(struct nlm_file *file, struct nlm_lock *lock)
  * be in progress.
  * The calling procedure must check whether the file can be closed.
  */
-u32
+__be32
 nlmsvc_cancel_blocked(struct nlm_file *file, struct nlm_lock *lock)
 {
         struct nlm_block        *block;
diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c
index 75b2c81bcb93..32e99a6e8dca 100644
--- a/fs/lockd/svcproc.c
+++ b/fs/lockd/svcproc.c
@@ -22,8 +22,8 @@
 #define NLMDBG_FACILITY         NLMDBG_CLIENT
 
 #ifdef CONFIG_LOCKD_V4
-static u32
-cast_to_nlm(u32 status, u32 vers)
+static __be32
+cast_to_nlm(__be32 status, u32 vers)
 {
         /* Note: status is assumed to be in network byte order !!! */
         if (vers != 4){
@@ -52,14 +52,14 @@ cast_to_nlm(u32 status, u32 vers)
 /*
  * Obtain client and file from arguments
  */
-static u32
+static __be32
 nlmsvc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp,
                         struct nlm_host **hostp, struct nlm_file **filp)
 {
         struct nlm_host         *host = NULL;
         struct nlm_file         *file = NULL;
         struct nlm_lock         *lock = &argp->lock;
-        u32                     error;
+        __be32                  error = 0;
 
         /* nfsd callbacks must have been installed for this procedure */
         if (!nlmsvc_ops)
@@ -88,13 +88,15 @@ nlmsvc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp,
 no_locks:
         if (host)
                 nlm_release_host(host);
+        if (error)
+                return error;
         return nlm_lck_denied_nolocks;
 }
 
 /*
  * NULL: Test for presence of service
  */
-static int
+static __be32
 nlmsvc_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         dprintk("lockd: NULL          called\n");
@@ -104,7 +106,7 @@ nlmsvc_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 /*
  * TEST: Check for conflicting lock
  */
-static int
+static __be32
 nlmsvc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
                                          struct nlm_res  *resp)
 {
@@ -122,7 +124,7 @@ nlmsvc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now check for conflicting locks */
         resp->status = cast_status(nlmsvc_testlock(file, &argp->lock, &resp->lock));
@@ -134,7 +136,7 @@ nlmsvc_proc_test(struct svc_rqst *rqstp, struct nlm_args *argp,
         return rpc_success;
 }
 
-static int
+static __be32
 nlmsvc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                          struct nlm_res  *resp)
 {
@@ -153,7 +155,7 @@ nlmsvc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
 #if 0
         /* If supplied state doesn't match current state, we assume it's
@@ -177,7 +179,7 @@ nlmsvc_proc_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
         return rpc_success;
 }
 
-static int
+static __be32
 nlmsvc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
                                            struct nlm_res  *resp)
 {
@@ -196,7 +198,7 @@ nlmsvc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Try to cancel request. */
         resp->status = cast_status(nlmsvc_cancel_blocked(file, &argp->lock));
@@ -210,7 +212,7 @@ nlmsvc_proc_cancel(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * UNLOCK: release a lock
  */
-static int
+static __be32
 nlmsvc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                            struct nlm_res  *resp)
 {
@@ -229,7 +231,7 @@ nlmsvc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to remove the lock */
         resp->status = cast_status(nlmsvc_unlock(file, &argp->lock));
@@ -244,7 +246,7 @@ nlmsvc_proc_unlock(struct svc_rqst *rqstp, struct nlm_args *argp,
  * GRANTED: A server calls us to tell that a process' lock request
  * was granted
  */
-static int
+static __be32
 nlmsvc_proc_granted(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -280,12 +282,12 @@ static const struct rpc_call_ops nlmsvc_callback_ops = {
  * because we send the callback before the reply proper. I hope this
  * doesn't break any clients.
  */
-static int nlmsvc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *argp,
-                int (*func)(struct svc_rqst *, struct nlm_args *, struct nlm_res  *))
+static __be32 nlmsvc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *argp,
+                __be32 (*func)(struct svc_rqst *, struct nlm_args *, struct nlm_res  *))
 {
         struct nlm_host *host;
         struct nlm_rqst *call;
-        int stat;
+        __be32 stat;
 
         host = nlmsvc_lookup_host(rqstp,
                                   argp->lock.caller,
@@ -309,28 +311,28 @@ static int nlmsvc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args *ar
         return rpc_success;
 }
 
-static int nlmsvc_proc_test_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlmsvc_proc_test_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
         dprintk("lockd: TEST_MSG      called\n");
         return nlmsvc_callback(rqstp, NLMPROC_TEST_RES, argp, nlmsvc_proc_test);
 }
 
-static int nlmsvc_proc_lock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlmsvc_proc_lock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
         dprintk("lockd: LOCK_MSG      called\n");
         return nlmsvc_callback(rqstp, NLMPROC_LOCK_RES, argp, nlmsvc_proc_lock);
 }
 
-static int nlmsvc_proc_cancel_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
+static __be32 nlmsvc_proc_cancel_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                void            *resp)
 {
         dprintk("lockd: CANCEL_MSG    called\n");
         return nlmsvc_callback(rqstp, NLMPROC_CANCEL_RES, argp, nlmsvc_proc_cancel);
 }
 
-static int
+static __be32
 nlmsvc_proc_unlock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                void            *resp)
 {
@@ -338,7 +340,7 @@ nlmsvc_proc_unlock_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
         return nlmsvc_callback(rqstp, NLMPROC_UNLOCK_RES, argp, nlmsvc_proc_unlock);
 }
 
-static int
+static __be32
 nlmsvc_proc_granted_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
                                                 void            *resp)
 {
@@ -349,7 +351,7 @@ nlmsvc_proc_granted_msg(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * SHARE: create a DOS share or alter existing share.
  */
-static int
+static __be32
 nlmsvc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
                                           struct nlm_res  *resp)
 {
@@ -368,7 +370,7 @@ nlmsvc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to create the share */
         resp->status = cast_status(nlmsvc_share_file(host, file, argp));
@@ -382,7 +384,7 @@ nlmsvc_proc_share(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * UNSHARE: Release a DOS share.
  */
-static int
+static __be32
 nlmsvc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -401,7 +403,7 @@ nlmsvc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
 
         /* Obtain client and file */
         if ((resp->status = nlmsvc_retrieve_args(rqstp, argp, &host, &file)))
-                return rpc_success;
+                return resp->status == nlm_drop_reply ? rpc_drop_reply :rpc_success;
 
         /* Now try to unshare the file */
         resp->status = cast_status(nlmsvc_unshare_file(host, file, argp));
@@ -415,7 +417,7 @@ nlmsvc_proc_unshare(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * NM_LOCK: Create an unmonitored lock
  */
-static int
+static __be32
 nlmsvc_proc_nm_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
                                             struct nlm_res  *resp)
 {
@@ -428,7 +430,7 @@ nlmsvc_proc_nm_lock(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * FREE_ALL: Release all locks and shares held by client
  */
-static int
+static __be32
 nlmsvc_proc_free_all(struct svc_rqst *rqstp, struct nlm_args *argp,
                                              void            *resp)
 {
@@ -446,7 +448,7 @@ nlmsvc_proc_free_all(struct svc_rqst *rqstp, struct nlm_args *argp,
 /*
  * SM_NOTIFY: private callback from statd (not part of official NLM proto)
  */
-static int
+static __be32
 nlmsvc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
                                               void              *resp)
 {
@@ -475,7 +477,7 @@ nlmsvc_proc_sm_notify(struct svc_rqst *rqstp, struct nlm_reboot *argp,
 /*
  * client sent a GRANTED_RES, let's remove the associated block
  */
-static int
+static __be32
 nlmsvc_proc_granted_res(struct svc_rqst *rqstp, struct nlm_res  *argp,
                                                 void            *resp)
 {
diff --git a/fs/lockd/svcshare.c b/fs/lockd/svcshare.c
index b9926ce8782e..6220dc2a3f2c 100644
--- a/fs/lockd/svcshare.c
+++ b/fs/lockd/svcshare.c
@@ -23,7 +23,7 @@ nlm_cmp_owner(struct nlm_share *share, struct xdr_netobj *oh)
             && !memcmp(share->s_owner.data, oh->data, oh->len);
 }
 
-u32
+__be32
 nlmsvc_share_file(struct nlm_host *host, struct nlm_file *file,
                         struct nlm_args *argp)
 {
@@ -64,7 +64,7 @@ update:
 /*
  * Delete a share.
  */
-u32
+__be32
 nlmsvc_unshare_file(struct nlm_host *host, struct nlm_file *file,
                         struct nlm_args *argp)
 {
diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c
index 514f5f20701e..e83024e16042 100644
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -78,14 +78,14 @@ static inline unsigned int file_hash(struct nfs_fh *f)
  * This is not quite right, but for now, we assume the client performs
  * the proper R/W checking.
  */
-u32
+__be32
 nlm_lookup_file(struct svc_rqst *rqstp, struct nlm_file **result,
                                         struct nfs_fh *f)
 {
         struct hlist_node *pos;
         struct nlm_file *file;
         unsigned int    hash;
-        u32             nfserr;
+        __be32          nfserr;
 
         nlm_debug_print_fh("nlm_file_lookup", f);
 
@@ -135,12 +135,6 @@ out_unlock:
 
 out_free:
         kfree(file);
-#ifdef CONFIG_LOCKD_V4
-        if (nfserr == 1)
-                nfserr = nlm4_stale_fh;
-        else
-#endif
-        nfserr = nlm_lck_denied;
         goto out_unlock;
 }
 
@@ -324,7 +318,16 @@ nlmsvc_same_host(struct nlm_host *host, struct nlm_host *other)
 static int
 nlmsvc_is_client(struct nlm_host *host, struct nlm_host *dummy)
 {
-        return host->h_server;
+        if (host->h_server) {
+                /* we are destroying locks even though the client
+                 * hasn't asked us too, so don't unmonitor the
+                 * client
+                 */
+                if (host->h_nsmhandle)
+                        host->h_nsmhandle->sm_sticky = 1;
+                return 1;
+        } else
+                return 0;
 }
 
 /*
diff --git a/fs/lockd/xdr.c b/fs/lockd/xdr.c
index 61c46facf257..b7c949256e5a 100644
--- a/fs/lockd/xdr.c
+++ b/fs/lockd/xdr.c
@@ -43,7 +43,7 @@ loff_t_to_s32(loff_t offset)
 /*
  * XDR functions for basic NLM types
  */
-static u32 *nlm_decode_cookie(u32 *p, struct nlm_cookie *c)
+static __be32 *nlm_decode_cookie(__be32 *p, struct nlm_cookie *c)
 {
         unsigned int    len;
 
@@ -69,8 +69,8 @@ static u32 *nlm_decode_cookie(u32 *p, struct nlm_cookie *c)
         return p;
 }
 
-static inline u32 *
-nlm_encode_cookie(u32 *p, struct nlm_cookie *c)
+static inline __be32 *
+nlm_encode_cookie(__be32 *p, struct nlm_cookie *c)
 {
         *p++ = htonl(c->len);
         memcpy(p, c->data, c->len);
@@ -78,8 +78,8 @@ nlm_encode_cookie(u32 *p, struct nlm_cookie *c)
         return p;
 }
 
-static u32 *
-nlm_decode_fh(u32 *p, struct nfs_fh *f)
+static __be32 *
+nlm_decode_fh(__be32 *p, struct nfs_fh *f)
 {
         unsigned int    len;
 
@@ -95,8 +95,8 @@ nlm_decode_fh(u32 *p, struct nfs_fh *f)
         return p + XDR_QUADLEN(NFS2_FHSIZE);
 }
 
-static inline u32 *
-nlm_encode_fh(u32 *p, struct nfs_fh *f)
+static inline __be32 *
+nlm_encode_fh(__be32 *p, struct nfs_fh *f)
 {
         *p++ = htonl(NFS2_FHSIZE);
         memcpy(p, f->data, NFS2_FHSIZE);
@@ -106,20 +106,20 @@ nlm_encode_fh(u32 *p, struct nfs_fh *f)
 /*
  * Encode and decode owner handle
  */
-static inline u32 *
-nlm_decode_oh(u32 *p, struct xdr_netobj *oh)
+static inline __be32 *
+nlm_decode_oh(__be32 *p, struct xdr_netobj *oh)
 {
         return xdr_decode_netobj(p, oh);
 }
 
-static inline u32 *
-nlm_encode_oh(u32 *p, struct xdr_netobj *oh)
+static inline __be32 *
+nlm_encode_oh(__be32 *p, struct xdr_netobj *oh)
 {
         return xdr_encode_netobj(p, oh);
 }
 
-static u32 *
-nlm_decode_lock(u32 *p, struct nlm_lock *lock)
+static __be32 *
+nlm_decode_lock(__be32 *p, struct nlm_lock *lock)
 {
         struct file_lock        *fl = &lock->fl;
         s32                     start, len, end;
@@ -153,8 +153,8 @@ nlm_decode_lock(u32 *p, struct nlm_lock *lock)
 /*
  * Encode a lock as part of an NLM call
  */
-static u32 *
-nlm_encode_lock(u32 *p, struct nlm_lock *lock)
+static __be32 *
+nlm_encode_lock(__be32 *p, struct nlm_lock *lock)
 {
         struct file_lock        *fl = &lock->fl;
         __s32                   start, len;
@@ -184,8 +184,8 @@ nlm_encode_lock(u32 *p, struct nlm_lock *lock)
 /*
  * Encode result of a TEST/TEST_MSG call
  */
-static u32 *
-nlm_encode_testres(u32 *p, struct nlm_res *resp)
+static __be32 *
+nlm_encode_testres(__be32 *p, struct nlm_res *resp)
 {
         s32             start, len;
 
@@ -221,7 +221,7 @@ nlm_encode_testres(u32 *p, struct nlm_res *resp)
  * First, the server side XDR functions
  */
 int
-nlmsvc_decode_testargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlmsvc_decode_testargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -238,7 +238,7 @@ nlmsvc_decode_testargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlmsvc_encode_testres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlmsvc_encode_testres(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_encode_testres(p, resp)))
                 return 0;
@@ -246,7 +246,7 @@ nlmsvc_encode_testres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlmsvc_decode_lockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlmsvc_decode_lockargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -266,7 +266,7 @@ nlmsvc_decode_lockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlmsvc_decode_cancargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlmsvc_decode_cancargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -282,7 +282,7 @@ nlmsvc_decode_cancargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlmsvc_decode_unlockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlmsvc_decode_unlockargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         if (!(p = nlm_decode_cookie(p, &argp->cookie))
          || !(p = nlm_decode_lock(p, &argp->lock)))
@@ -292,7 +292,7 @@ nlmsvc_decode_unlockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlmsvc_decode_shareargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlmsvc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -313,7 +313,7 @@ nlmsvc_decode_shareargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlmsvc_encode_shareres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlmsvc_encode_shareres(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_encode_cookie(p, &resp->cookie)))
                 return 0;
@@ -323,7 +323,7 @@ nlmsvc_encode_shareres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlmsvc_encode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlmsvc_encode_res(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_encode_cookie(p, &resp->cookie)))
                 return 0;
@@ -332,7 +332,7 @@ nlmsvc_encode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlmsvc_decode_notify(struct svc_rqst *rqstp, u32 *p, struct nlm_args *argp)
+nlmsvc_decode_notify(struct svc_rqst *rqstp, __be32 *p, struct nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -344,7 +344,7 @@ nlmsvc_decode_notify(struct svc_rqst *rqstp, u32 *p, struct nlm_args *argp)
 }
 
 int
-nlmsvc_decode_reboot(struct svc_rqst *rqstp, u32 *p, struct nlm_reboot *argp)
+nlmsvc_decode_reboot(struct svc_rqst *rqstp, __be32 *p, struct nlm_reboot *argp)
 {
         if (!(p = xdr_decode_string_inplace(p, &argp->mon, &argp->len, SM_MAXSTRLEN)))
                 return 0;
@@ -357,7 +357,7 @@ nlmsvc_decode_reboot(struct svc_rqst *rqstp, u32 *p, struct nlm_reboot *argp)
 }
 
 int
-nlmsvc_decode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlmsvc_decode_res(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_decode_cookie(p, &resp->cookie)))
                 return 0;
@@ -366,13 +366,13 @@ nlmsvc_decode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlmsvc_decode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nlmsvc_decode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_argsize_check(rqstp, p);
 }
 
 int
-nlmsvc_encode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nlmsvc_encode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
@@ -389,7 +389,7 @@ nlmclt_decode_void(struct rpc_rqst *req, u32 *p, void *ptr)
 #endif
 
 static int
-nlmclt_encode_testargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlmclt_encode_testargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -403,7 +403,7 @@ nlmclt_encode_testargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlmclt_decode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlmclt_decode_testres(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_decode_cookie(p, &resp->cookie)))
                 return -EIO;
@@ -438,7 +438,7 @@ nlmclt_decode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 
 
 static int
-nlmclt_encode_lockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlmclt_encode_lockargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -455,7 +455,7 @@ nlmclt_encode_lockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlmclt_encode_cancargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlmclt_encode_cancargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -470,7 +470,7 @@ nlmclt_encode_cancargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlmclt_encode_unlockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlmclt_encode_unlockargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -483,7 +483,7 @@ nlmclt_encode_unlockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlmclt_encode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlmclt_encode_res(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_encode_cookie(p, &resp->cookie)))
                 return -EIO;
@@ -493,7 +493,7 @@ nlmclt_encode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 }
 
 static int
-nlmclt_encode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlmclt_encode_testres(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_encode_testres(p, resp)))
                 return -EIO;
@@ -502,7 +502,7 @@ nlmclt_encode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 }
 
 static int
-nlmclt_decode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlmclt_decode_res(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm_decode_cookie(p, &resp->cookie)))
                 return -EIO;
diff --git a/fs/lockd/xdr4.c b/fs/lockd/xdr4.c
index 36eb175ec335..f4c0b2b9f75a 100644
--- a/fs/lockd/xdr4.c
+++ b/fs/lockd/xdr4.c
@@ -44,8 +44,8 @@ loff_t_to_s64(loff_t offset)
 /*
  * XDR functions for basic NLM types
  */
-static u32 *
-nlm4_decode_cookie(u32 *p, struct nlm_cookie *c)
+static __be32 *
+nlm4_decode_cookie(__be32 *p, struct nlm_cookie *c)
 {
         unsigned int    len;
 
@@ -71,8 +71,8 @@ nlm4_decode_cookie(u32 *p, struct nlm_cookie *c)
         return p;
 }
 
-static u32 *
-nlm4_encode_cookie(u32 *p, struct nlm_cookie *c)
+static __be32 *
+nlm4_encode_cookie(__be32 *p, struct nlm_cookie *c)
 {
         *p++ = htonl(c->len);
         memcpy(p, c->data, c->len);
@@ -80,8 +80,8 @@ nlm4_encode_cookie(u32 *p, struct nlm_cookie *c)
         return p;
 }
 
-static u32 *
-nlm4_decode_fh(u32 *p, struct nfs_fh *f)
+static __be32 *
+nlm4_decode_fh(__be32 *p, struct nfs_fh *f)
 {
         memset(f->data, 0, sizeof(f->data));
         f->size = ntohl(*p++);
@@ -95,8 +95,8 @@ nlm4_decode_fh(u32 *p, struct nfs_fh *f)
         return p + XDR_QUADLEN(f->size);
 }
 
-static u32 *
-nlm4_encode_fh(u32 *p, struct nfs_fh *f)
+static __be32 *
+nlm4_encode_fh(__be32 *p, struct nfs_fh *f)
 {
         *p++ = htonl(f->size);
         if (f->size) p[XDR_QUADLEN(f->size)-1] = 0; /* don't leak anything */
@@ -107,20 +107,20 @@ nlm4_encode_fh(u32 *p, struct nfs_fh *f)
 /*
  * Encode and decode owner handle
  */
-static u32 *
-nlm4_decode_oh(u32 *p, struct xdr_netobj *oh)
+static __be32 *
+nlm4_decode_oh(__be32 *p, struct xdr_netobj *oh)
 {
         return xdr_decode_netobj(p, oh);
 }
 
-static u32 *
-nlm4_encode_oh(u32 *p, struct xdr_netobj *oh)
+static __be32 *
+nlm4_encode_oh(__be32 *p, struct xdr_netobj *oh)
 {
         return xdr_encode_netobj(p, oh);
 }
 
-static u32 *
-nlm4_decode_lock(u32 *p, struct nlm_lock *lock)
+static __be32 *
+nlm4_decode_lock(__be32 *p, struct nlm_lock *lock)
 {
         struct file_lock        *fl = &lock->fl;
         __s64                   len, start, end;
@@ -153,8 +153,8 @@ nlm4_decode_lock(u32 *p, struct nlm_lock *lock)
 /*
  * Encode a lock as part of an NLM call
  */
-static u32 *
-nlm4_encode_lock(u32 *p, struct nlm_lock *lock)
+static __be32 *
+nlm4_encode_lock(__be32 *p, struct nlm_lock *lock)
 {
         struct file_lock        *fl = &lock->fl;
         __s64                   start, len;
@@ -185,8 +185,8 @@ nlm4_encode_lock(u32 *p, struct nlm_lock *lock)
 /*
  * Encode result of a TEST/TEST_MSG call
  */
-static u32 *
-nlm4_encode_testres(u32 *p, struct nlm_res *resp)
+static __be32 *
+nlm4_encode_testres(__be32 *p, struct nlm_res *resp)
 {
         s64             start, len;
 
@@ -227,7 +227,7 @@ nlm4_encode_testres(u32 *p, struct nlm_res *resp)
  * First, the server side XDR functions
  */
 int
-nlm4svc_decode_testargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlm4svc_decode_testargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -244,7 +244,7 @@ nlm4svc_decode_testargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlm4svc_encode_testres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlm4svc_encode_testres(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_encode_testres(p, resp)))
                 return 0;
@@ -252,7 +252,7 @@ nlm4svc_encode_testres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlm4svc_decode_lockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlm4svc_decode_lockargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -272,7 +272,7 @@ nlm4svc_decode_lockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlm4svc_decode_cancargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlm4svc_decode_cancargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         u32     exclusive;
 
@@ -288,7 +288,7 @@ nlm4svc_decode_cancargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlm4svc_decode_unlockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlm4svc_decode_unlockargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         if (!(p = nlm4_decode_cookie(p, &argp->cookie))
          || !(p = nlm4_decode_lock(p, &argp->lock)))
@@ -298,7 +298,7 @@ nlm4svc_decode_unlockargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlm4svc_decode_shareargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
+nlm4svc_decode_shareargs(struct svc_rqst *rqstp, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -319,7 +319,7 @@ nlm4svc_decode_shareargs(struct svc_rqst *rqstp, u32 *p, nlm_args *argp)
 }
 
 int
-nlm4svc_encode_shareres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlm4svc_encode_shareres(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_encode_cookie(p, &resp->cookie)))
                 return 0;
@@ -329,7 +329,7 @@ nlm4svc_encode_shareres(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlm4svc_encode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlm4svc_encode_res(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_encode_cookie(p, &resp->cookie)))
                 return 0;
@@ -338,7 +338,7 @@ nlm4svc_encode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlm4svc_decode_notify(struct svc_rqst *rqstp, u32 *p, struct nlm_args *argp)
+nlm4svc_decode_notify(struct svc_rqst *rqstp, __be32 *p, struct nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -350,7 +350,7 @@ nlm4svc_decode_notify(struct svc_rqst *rqstp, u32 *p, struct nlm_args *argp)
 }
 
 int
-nlm4svc_decode_reboot(struct svc_rqst *rqstp, u32 *p, struct nlm_reboot *argp)
+nlm4svc_decode_reboot(struct svc_rqst *rqstp, __be32 *p, struct nlm_reboot *argp)
 {
         if (!(p = xdr_decode_string_inplace(p, &argp->mon, &argp->len, SM_MAXSTRLEN)))
                 return 0;
@@ -363,7 +363,7 @@ nlm4svc_decode_reboot(struct svc_rqst *rqstp, u32 *p, struct nlm_reboot *argp)
 }
 
 int
-nlm4svc_decode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
+nlm4svc_decode_res(struct svc_rqst *rqstp, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_decode_cookie(p, &resp->cookie)))
                 return 0;
@@ -372,13 +372,13 @@ nlm4svc_decode_res(struct svc_rqst *rqstp, u32 *p, struct nlm_res *resp)
 }
 
 int
-nlm4svc_decode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nlm4svc_decode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_argsize_check(rqstp, p);
 }
 
 int
-nlm4svc_encode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nlm4svc_encode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
@@ -388,14 +388,14 @@ nlm4svc_encode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
  */
 #ifdef NLMCLNT_SUPPORT_SHARES
 static int
-nlm4clt_decode_void(struct rpc_rqst *req, u32 *p, void *ptr)
+nlm4clt_decode_void(struct rpc_rqst *req, __be32 *p, void *ptr)
 {
         return 0;
 }
 #endif
 
 static int
-nlm4clt_encode_testargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlm4clt_encode_testargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -409,7 +409,7 @@ nlm4clt_encode_testargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlm4clt_decode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlm4clt_decode_testres(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_decode_cookie(p, &resp->cookie)))
                 return -EIO;
@@ -444,7 +444,7 @@ nlm4clt_decode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 
 
 static int
-nlm4clt_encode_lockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlm4clt_encode_lockargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -461,7 +461,7 @@ nlm4clt_encode_lockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlm4clt_encode_cancargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlm4clt_encode_cancargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -476,7 +476,7 @@ nlm4clt_encode_cancargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlm4clt_encode_unlockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
+nlm4clt_encode_unlockargs(struct rpc_rqst *req, __be32 *p, nlm_args *argp)
 {
         struct nlm_lock *lock = &argp->lock;
 
@@ -489,7 +489,7 @@ nlm4clt_encode_unlockargs(struct rpc_rqst *req, u32 *p, nlm_args *argp)
 }
 
 static int
-nlm4clt_encode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlm4clt_encode_res(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_encode_cookie(p, &resp->cookie)))
                 return -EIO;
@@ -499,7 +499,7 @@ nlm4clt_encode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 }
 
 static int
-nlm4clt_encode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlm4clt_encode_testres(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_encode_testres(p, resp)))
                 return -EIO;
@@ -508,7 +508,7 @@ nlm4clt_encode_testres(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
 }
 
 static int
-nlm4clt_decode_res(struct rpc_rqst *req, u32 *p, struct nlm_res *resp)
+nlm4clt_decode_res(struct rpc_rqst *req, __be32 *p, struct nlm_res *resp)
 {
         if (!(p = nlm4_decode_cookie(p, &resp->cookie)))
                 return -EIO;
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index c11a4b9fb863..1e36bae4d0eb 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -149,12 +149,8 @@ static int minix_fill_super(struct super_block *s, void *data, int silent)
                 return -ENOMEM;
         s->s_fs_info = sbi;
 
-        /* N.B. These should be compile-time tests.
-           Unfortunately that is impossible. */
-        if (32 != sizeof (struct minix_inode))
-                panic("bad V1 i-node size");
-        if (64 != sizeof(struct minix2_inode))
-                panic("bad V2 i-node size");
+        BUILD_BUG_ON(32 != sizeof (struct minix_inode));
+        BUILD_BUG_ON(64 != sizeof(struct minix2_inode));
 
         if (!sb_set_blocksize(s, BLOCK_SIZE))
                 goto out_bad_hblock;
diff --git a/fs/msdos/namei.c b/fs/msdos/namei.c
index b0f01b3b0536..452461955cbd 100644
--- a/fs/msdos/namei.c
+++ b/fs/msdos/namei.c
@@ -654,6 +654,7 @@ static struct inode_operations msdos_dir_inode_operations = {
         .rmdir          = msdos_rmdir,
         .rename         = msdos_rename,
         .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
 
 static int msdos_fill_super(struct super_block *sb, void *data, int silent)
diff --git a/fs/nfs/callback.h b/fs/nfs/callback.h
index 5676163d26e8..db3d7919c601 100644
--- a/fs/nfs/callback.h
+++ b/fs/nfs/callback.h
@@ -31,10 +31,10 @@ struct cb_compound_hdr_arg {
 };
 
 struct cb_compound_hdr_res {
-        uint32_t *status;
+        __be32 *status;
         int taglen;
         const char *tag;
-        uint32_t *nops;
+        __be32 *nops;
 };
 
 struct cb_getattrargs {
@@ -44,7 +44,7 @@ struct cb_getattrargs {
 };
 
 struct cb_getattrres {
-        uint32_t status;
+        __be32 status;
         uint32_t bitmap[2];
         uint64_t size;
         uint64_t change_attr;
@@ -59,8 +59,8 @@ struct cb_recallargs {
         uint32_t truncate;
 };
 
-extern unsigned nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res);
-extern unsigned nfs4_callback_recall(struct cb_recallargs *args, void *dummy);
+extern __be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res);
+extern __be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy);
 
 #ifdef CONFIG_NFS_V4
 extern int nfs_callback_up(void);
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index 97cf8f71451f..72e55d83756d 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -14,7 +14,7 @@
 
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
  
-unsigned nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res)
+__be32 nfs4_callback_getattr(struct cb_getattrargs *args, struct cb_getattrres *res)
 {
         struct nfs_client *clp;
         struct nfs_delegation *delegation;
@@ -55,11 +55,11 @@ out:
         return res->status;
 }
 
-unsigned nfs4_callback_recall(struct cb_recallargs *args, void *dummy)
+__be32 nfs4_callback_recall(struct cb_recallargs *args, void *dummy)
 {
         struct nfs_client *clp;
         struct inode *inode;
-        unsigned res;
+        __be32 res;
         
         res = htonl(NFS4ERR_BADHANDLE);
         clp = nfs_find_client(args->addr, 4);
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 29f932192054..f8ea1f51f590 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -22,9 +22,9 @@
 
 #define NFSDBG_FACILITY NFSDBG_CALLBACK
 
-typedef unsigned (*callback_process_op_t)(void *, void *);
-typedef unsigned (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
-typedef unsigned (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
+typedef __be32 (*callback_process_op_t)(void *, void *);
+typedef __be32 (*callback_decode_arg_t)(struct svc_rqst *, struct xdr_stream *, void *);
+typedef __be32 (*callback_encode_res_t)(struct svc_rqst *, struct xdr_stream *, void *);
 
 
 struct callback_op {
@@ -36,24 +36,24 @@ struct callback_op {
 
 static struct callback_op callback_ops[];
 
-static int nfs4_callback_null(struct svc_rqst *rqstp, void *argp, void *resp)
+static __be32 nfs4_callback_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return htonl(NFS4_OK);
 }
 
-static int nfs4_decode_void(struct svc_rqst *rqstp, uint32_t *p, void *dummy)
+static int nfs4_decode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_argsize_check(rqstp, p);
 }
 
-static int nfs4_encode_void(struct svc_rqst *rqstp, uint32_t *p, void *dummy)
+static int nfs4_encode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
 
-static uint32_t *read_buf(struct xdr_stream *xdr, int nbytes)
+static __be32 *read_buf(struct xdr_stream *xdr, int nbytes)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = xdr_inline_decode(xdr, nbytes);
         if (unlikely(p == NULL))
@@ -61,9 +61,9 @@ static uint32_t *read_buf(struct xdr_stream *xdr, int nbytes)
         return p;
 }
 
-static unsigned decode_string(struct xdr_stream *xdr, unsigned int *len, const char **str)
+static __be32 decode_string(struct xdr_stream *xdr, unsigned int *len, const char **str)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = read_buf(xdr, 4);
         if (unlikely(p == NULL))
@@ -81,9 +81,9 @@ static unsigned decode_string(struct xdr_stream *xdr, unsigned int *len, const c
         return 0;
 }
 
-static unsigned decode_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
+static __be32 decode_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = read_buf(xdr, 4);
         if (unlikely(p == NULL))
@@ -99,9 +99,9 @@ static unsigned decode_fh(struct xdr_stream *xdr, struct nfs_fh *fh)
         return 0;
 }
 
-static unsigned decode_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
+static __be32 decode_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
 {
-        uint32_t *p;
+        __be32 *p;
         unsigned int attrlen;
 
         p = read_buf(xdr, 4);
@@ -118,9 +118,9 @@ static unsigned decode_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
         return 0;
 }
 
-static unsigned decode_stateid(struct xdr_stream *xdr, nfs4_stateid *stateid)
+static __be32 decode_stateid(struct xdr_stream *xdr, nfs4_stateid *stateid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = read_buf(xdr, 16);
         if (unlikely(p == NULL))
@@ -129,11 +129,11 @@ static unsigned decode_stateid(struct xdr_stream *xdr, nfs4_stateid *stateid)
         return 0;
 }
 
-static unsigned decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compound_hdr_arg *hdr)
+static __be32 decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compound_hdr_arg *hdr)
 {
-        uint32_t *p;
+        __be32 *p;
         unsigned int minor_version;
-        unsigned status;
+        __be32 status;
 
         status = decode_string(xdr, &hdr->taglen, &hdr->tag);
         if (unlikely(status != 0))
@@ -159,9 +159,9 @@ static unsigned decode_compound_hdr_arg(struct xdr_stream *xdr, struct cb_compou
         return 0;
 }
 
-static unsigned decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
+static __be32 decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
 {
-        uint32_t *p;
+        __be32 *p;
         p = read_buf(xdr, 4);
         if (unlikely(p == NULL))
                 return htonl(NFS4ERR_RESOURCE);
@@ -169,9 +169,9 @@ static unsigned decode_op_hdr(struct xdr_stream *xdr, unsigned int *op)
         return 0;
 }
 
-static unsigned decode_getattr_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_getattrargs *args)
+static __be32 decode_getattr_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_getattrargs *args)
 {
-        unsigned status;
+        __be32 status;
 
         status = decode_fh(xdr, &args->fh);
         if (unlikely(status != 0))
@@ -183,10 +183,10 @@ out:
         return status;
 }
 
-static unsigned decode_recall_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_recallargs *args)
+static __be32 decode_recall_args(struct svc_rqst *rqstp, struct xdr_stream *xdr, struct cb_recallargs *args)
 {
-        uint32_t *p;
-        unsigned status;
+        __be32 *p;
+        __be32 status;
 
         args->addr = &rqstp->rq_addr;
         status = decode_stateid(xdr, &args->stateid);
@@ -204,9 +204,9 @@ out:
         return status;
 }
 
-static unsigned encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
+static __be32 encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = xdr_reserve_space(xdr, 4 + len);
         if (unlikely(p == NULL))
@@ -217,10 +217,10 @@ static unsigned encode_string(struct xdr_stream *xdr, unsigned int len, const ch
 
 #define CB_SUPPORTED_ATTR0 (FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE)
 #define CB_SUPPORTED_ATTR1 (FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY)
-static unsigned encode_attr_bitmap(struct xdr_stream *xdr, const uint32_t *bitmap, uint32_t **savep)
+static __be32 encode_attr_bitmap(struct xdr_stream *xdr, const uint32_t *bitmap, __be32 **savep)
 {
-        uint32_t bm[2];
-        uint32_t *p;
+        __be32 bm[2];
+        __be32 *p;
 
         bm[0] = htonl(bitmap[0] & CB_SUPPORTED_ATTR0);
         bm[1] = htonl(bitmap[1] & CB_SUPPORTED_ATTR1);
@@ -247,9 +247,9 @@ static unsigned encode_attr_bitmap(struct xdr_stream *xdr, const uint32_t *bitma
         return 0;
 }
 
-static unsigned encode_attr_change(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t change)
+static __be32 encode_attr_change(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t change)
 {
-        uint32_t *p;
+        __be32 *p;
 
         if (!(bitmap[0] & FATTR4_WORD0_CHANGE))
                 return 0;
@@ -260,9 +260,9 @@ static unsigned encode_attr_change(struct xdr_stream *xdr, const uint32_t *bitma
         return 0;
 }
 
-static unsigned encode_attr_size(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t size)
+static __be32 encode_attr_size(struct xdr_stream *xdr, const uint32_t *bitmap, uint64_t size)
 {
-        uint32_t *p;
+        __be32 *p;
 
         if (!(bitmap[0] & FATTR4_WORD0_SIZE))
                 return 0;
@@ -273,9 +273,9 @@ static unsigned encode_attr_size(struct xdr_stream *xdr, const uint32_t *bitmap,
         return 0;
 }
 
-static unsigned encode_attr_time(struct xdr_stream *xdr, const struct timespec *time)
+static __be32 encode_attr_time(struct xdr_stream *xdr, const struct timespec *time)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = xdr_reserve_space(xdr, 12);
         if (unlikely(p == 0))
@@ -285,23 +285,23 @@ static unsigned encode_attr_time(struct xdr_stream *xdr, const struct timespec *
         return 0;
 }
 
-static unsigned encode_attr_ctime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
+static __be32 encode_attr_ctime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
 {
         if (!(bitmap[1] & FATTR4_WORD1_TIME_METADATA))
                 return 0;
         return encode_attr_time(xdr,time);
 }
 
-static unsigned encode_attr_mtime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
+static __be32 encode_attr_mtime(struct xdr_stream *xdr, const uint32_t *bitmap, const struct timespec *time)
 {
         if (!(bitmap[1] & FATTR4_WORD1_TIME_MODIFY))
                 return 0;
         return encode_attr_time(xdr,time);
 }
 
-static unsigned encode_compound_hdr_res(struct xdr_stream *xdr, struct cb_compound_hdr_res *hdr)
+static __be32 encode_compound_hdr_res(struct xdr_stream *xdr, struct cb_compound_hdr_res *hdr)
 {
-        unsigned status;
+        __be32 status;
 
         hdr->status = xdr_reserve_space(xdr, 4);
         if (unlikely(hdr->status == NULL))
@@ -315,9 +315,9 @@ static unsigned encode_compound_hdr_res(struct xdr_stream *xdr, struct cb_compou
         return 0;
 }
 
-static unsigned encode_op_hdr(struct xdr_stream *xdr, uint32_t op, uint32_t res)
+static __be32 encode_op_hdr(struct xdr_stream *xdr, uint32_t op, __be32 res)
 {
-        uint32_t *p;
+        __be32 *p;
         
         p = xdr_reserve_space(xdr, 8);
         if (unlikely(p == NULL))
@@ -327,10 +327,10 @@ static unsigned encode_op_hdr(struct xdr_stream *xdr, uint32_t op, uint32_t res)
         return 0;
 }
 
-static unsigned encode_getattr_res(struct svc_rqst *rqstp, struct xdr_stream *xdr, const struct cb_getattrres *res)
+static __be32 encode_getattr_res(struct svc_rqst *rqstp, struct xdr_stream *xdr, const struct cb_getattrres *res)
 {
-        uint32_t *savep = NULL;
-        unsigned status = res->status;
+        __be32 *savep = NULL;
+        __be32 status = res->status;
         
         if (unlikely(status != 0))
                 goto out;
@@ -353,15 +353,15 @@ out:
         return status;
 }
 
-static unsigned process_op(struct svc_rqst *rqstp,
+static __be32 process_op(struct svc_rqst *rqstp,
                 struct xdr_stream *xdr_in, void *argp,
                 struct xdr_stream *xdr_out, void *resp)
 {
         struct callback_op *op = &callback_ops[0];
         unsigned int op_nr = OP_CB_ILLEGAL;
-        unsigned int status = 0;
+        __be32 status = 0;
         long maxlen;
-        unsigned res;
+        __be32 res;
 
         dprintk("%s: start\n", __FUNCTION__);
         status = decode_op_hdr(xdr_in, &op_nr);
@@ -399,20 +399,20 @@ static unsigned process_op(struct svc_rqst *rqstp,
 /*
  * Decode, process and encode a COMPOUND
  */
-static int nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *resp)
+static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         struct cb_compound_hdr_arg hdr_arg;
         struct cb_compound_hdr_res hdr_res;
         struct xdr_stream xdr_in, xdr_out;
-        uint32_t *p;
-        unsigned int status;
+        __be32 *p;
+        __be32 status;
         unsigned int nops = 1;
 
         dprintk("%s: start\n", __FUNCTION__);
 
         xdr_init_decode(&xdr_in, &rqstp->rq_arg, rqstp->rq_arg.head[0].iov_base);
 
-        p = (uint32_t*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
+        p = (__be32*)((char *)rqstp->rq_res.head[0].iov_base + rqstp->rq_res.head[0].iov_len);
         xdr_init_encode(&xdr_out, &rqstp->rq_res, p);
 
         decode_compound_hdr_arg(&xdr_in, &hdr_arg);
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 34c3996bd0f5..5fea638743e4 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -232,11 +232,15 @@ void nfs_put_client(struct nfs_client *clp)
  * Find a client by address
  * - caller must hold nfs_client_lock
  */
-static struct nfs_client *__nfs_find_client(const struct sockaddr_in *addr, int nfsversion)
+static struct nfs_client *__nfs_find_client(const struct sockaddr_in *addr, int nfsversion, int match_port)
 {
         struct nfs_client *clp;
 
         list_for_each_entry(clp, &nfs_client_list, cl_share_link) {
+                /* Don't match clients that failed to initialise properly */
+                if (clp->cl_cons_state < 0)
+                        continue;
+
                 /* Different NFS versions cannot share the same nfs_client */
                 if (clp->cl_nfsversion != nfsversion)
                         continue;
@@ -245,7 +249,7 @@ static struct nfs_client *__nfs_find_client(const struct sockaddr_in *addr, int
                            sizeof(clp->cl_addr.sin_addr)) != 0)
                         continue;
 
-                if (clp->cl_addr.sin_port == addr->sin_port)
+                if (!match_port || clp->cl_addr.sin_port == addr->sin_port)
                         goto found;
         }
 
@@ -265,11 +269,12 @@ struct nfs_client *nfs_find_client(const struct sockaddr_in *addr, int nfsversio
         struct nfs_client *clp;
 
         spin_lock(&nfs_client_lock);
-        clp = __nfs_find_client(addr, nfsversion);
+        clp = __nfs_find_client(addr, nfsversion, 0);
         spin_unlock(&nfs_client_lock);
-
-        BUG_ON(clp && clp->cl_cons_state == 0);
-
+        if (clp != NULL && clp->cl_cons_state != NFS_CS_READY) {
+                nfs_put_client(clp);
+                clp = NULL;
+        }
         return clp;
 }
 
@@ -292,7 +297,7 @@ static struct nfs_client *nfs_get_client(const char *hostname,
         do {
                 spin_lock(&nfs_client_lock);
 
-                clp = __nfs_find_client(addr, nfsversion);
+                clp = __nfs_find_client(addr, nfsversion, 1);
                 if (clp)
                         goto found_client;
                 if (new)
@@ -849,6 +854,7 @@ error:
  */
 static int nfs4_init_client(struct nfs_client *clp,
                 int proto, int timeo, int retrans,
+                const char *ip_addr,
                 rpc_authflavor_t authflavour)
 {
         int error;
@@ -865,6 +871,7 @@ static int nfs4_init_client(struct nfs_client *clp,
         error = nfs_create_rpc_client(clp, proto, timeo, retrans, authflavour);
         if (error < 0)
                 goto error;
+        memcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr));
 
         error = nfs_idmap_new(clp);
         if (error < 0) {
@@ -888,6 +895,7 @@ error:
  */
 static int nfs4_set_client(struct nfs_server *server,
                 const char *hostname, const struct sockaddr_in *addr,
+                const char *ip_addr,
                 rpc_authflavor_t authflavour,
                 int proto, int timeo, int retrans)
 {
@@ -902,7 +910,7 @@ static int nfs4_set_client(struct nfs_server *server,
                 error = PTR_ERR(clp);
                 goto error;
         }
-        error = nfs4_init_client(clp, proto, timeo, retrans, authflavour);
+        error = nfs4_init_client(clp, proto, timeo, retrans, ip_addr, authflavour);
         if (error < 0)
                 goto error_put;
 
@@ -971,7 +979,7 @@ struct nfs_server *nfs4_create_server(const struct nfs4_mount_data *data,
                 return ERR_PTR(-ENOMEM);
 
         /* Get a client record */
-        error = nfs4_set_client(server, hostname, addr, authflavour,
+        error = nfs4_set_client(server, hostname, addr, ip_addr, authflavour,
                         data->proto, data->timeo, data->retrans);
         if (error < 0)
                 goto error;
@@ -1041,6 +1049,7 @@ struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *data,
         /* Get a client representation.
          * Note: NFSv4 always uses TCP, */
         error = nfs4_set_client(server, data->hostname, data->addr,
+                        parent_client->cl_ipaddr,
                         data->authflavor,
                         parent_server->client->cl_xprt->prot,
                         parent_client->retrans_timeo,
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 481f8892a919..b34cd16f472f 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -142,12 +142,12 @@ nfs_opendir(struct inode *inode, struct file *filp)
         return res;
 }
 
-typedef u32 * (*decode_dirent_t)(u32 *, struct nfs_entry *, int);
+typedef __be32 * (*decode_dirent_t)(__be32 *, struct nfs_entry *, int);
 typedef struct {
         struct file     *file;
         struct page     *page;
         unsigned long   page_index;
-        u32             *ptr;
+        __be32          *ptr;
         u64             *dir_cookie;
         loff_t          current_index;
         struct nfs_entry *entry;
@@ -203,8 +203,10 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page *page)
          * Note: assumes we have exclusive access to this mapping either
          *       through inode->i_mutex or some other mechanism.
          */
-        if (page->index == 0)
-                invalidate_inode_pages2_range(inode->i_mapping, PAGE_CACHE_SIZE, -1);
+        if (page->index == 0 && invalidate_inode_pages2_range(inode->i_mapping, PAGE_CACHE_SIZE, -1) < 0) {
+                /* Should never happen */
+                nfs_zap_mapping(inode, inode->i_mapping);
+        }
         unlock_page(page);
         return 0;
  error:
@@ -218,7 +220,7 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page *page)
 static inline
 int dir_decode(nfs_readdir_descriptor_t *desc)
 {
-        u32     *p = desc->ptr;
+        __be32  *p = desc->ptr;
         p = desc->decode(p, desc->entry, desc->plus);
         if (IS_ERR(p))
                 return PTR_ERR(p);
@@ -933,8 +935,17 @@ static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, stru
 
 no_entry:
         res = d_materialise_unique(dentry, inode);
-        if (res != NULL)
+        if (res != NULL) {
+                struct dentry *parent;
+                if (IS_ERR(res))
+                        goto out_unlock;
+                /* Was a directory renamed! */
+                parent = dget_parent(res);
+                if (!IS_ROOT(parent))
+                        nfs_mark_for_revalidate(parent->d_inode);
+                dput(parent);
                 dentry = res;
+        }
         nfs_renew_times(dentry);
         nfs_set_verifier(dentry, nfs_save_change_attribute(dir));
 out_unlock:
@@ -1130,6 +1141,8 @@ static struct dentry *nfs_readdir_lookup(nfs_readdir_descriptor_t *desc)
         alias = d_materialise_unique(dentry, inode);
         if (alias != NULL) {
                 dput(dentry);
+                if (IS_ERR(alias))
+                        return NULL;
                 dentry = alias;
         }
 
@@ -1517,8 +1530,8 @@ static int nfs_symlink(struct inode *dir, struct dentry *dentry, const char *sym
         pagevec_init(&lru_pvec, 0);
         if (!add_to_page_cache(page, dentry->d_inode->i_mapping, 0,
                                                         GFP_KERNEL)) {
-                if (!pagevec_add(&lru_pvec, page))
-                        __pagevec_lru_add(&lru_pvec);
+                pagevec_add(&lru_pvec, page);
+                pagevec_lru_add(&lru_pvec);
                 SetPageUptodate(page);
                 unlock_page(page);
         } else
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index 9f7f8b9ea1e2..bdfabf854a51 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -497,6 +497,7 @@ static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode
                         if (dreq->commit_data != NULL)
                                 nfs_commit_free(dreq->commit_data);
                         nfs_direct_free_writedata(dreq);
+                        nfs_zap_mapping(inode, inode->i_mapping);
                         nfs_direct_complete(dreq);
         }
 }
@@ -517,6 +518,7 @@ static void nfs_direct_write_complete(struct nfs_direct_req *dreq, struct inode
 {
         nfs_end_data_update(inode);
         nfs_direct_free_writedata(dreq);
+        nfs_zap_mapping(inode, inode->i_mapping);
         nfs_direct_complete(dreq);
 }
 #endif
@@ -532,10 +534,12 @@ static void nfs_direct_write_result(struct rpc_task *task, void *calldata)
 
         spin_lock(&dreq->lock);
 
-        if (likely(status >= 0))
-                dreq->count += data->res.count;
-        else
-                dreq->error = task->tk_status;
+        if (unlikely(status < 0)) {
+                dreq->error = status;
+                goto out_unlock;
+        }
+
+        dreq->count += data->res.count;
 
         if (data->res.verf->committed != NFS_FILE_SYNC) {
                 switch (dreq->flags) {
@@ -550,7 +554,7 @@ static void nfs_direct_write_result(struct rpc_task *task, void *calldata)
                                 }
                 }
         }
-
+out_unlock:
         spin_unlock(&dreq->lock);
 }
 
@@ -828,17 +832,6 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, const struct iovec *iov,
 
         retval = nfs_direct_write(iocb, (unsigned long) buf, count, pos);
 
-        /*
-         * XXX: nfs_end_data_update() already ensures this file's
-         *      cached data is subsequently invalidated.  Do we really
-         *      need to call invalidate_inode_pages2() again here?
-         *
-         *      For aio writes, this invalidation will almost certainly
-         *      occur before the writes complete.  Kind of racey.
-         */
-        if (mapping->nrpages)
-                invalidate_inode_pages2(mapping);
-
         if (retval > 0)
                 iocb->ki_pos = pos + retval;
 
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index bc9376ca86cd..08cc4c5919ab 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -131,6 +131,15 @@ void nfs_zap_caches(struct inode *inode)
         spin_unlock(&inode->i_lock);
 }
 
+void nfs_zap_mapping(struct inode *inode, struct address_space *mapping)
+{
+        if (mapping->nrpages != 0) {
+                spin_lock(&inode->i_lock);
+                NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
+                spin_unlock(&inode->i_lock);
+        }
+}
+
 static void nfs_zap_acl_cache(struct inode *inode)
 {
         void (*clear_acl_cache)(struct inode *);
@@ -574,7 +583,7 @@ __nfs_revalidate_inode(struct nfs_server *server, struct inode *inode)
 
         nfs_inc_stats(inode, NFSIOS_INODEREVALIDATE);
         lock_kernel();
-        if (!inode || is_bad_inode(inode))
+        if (is_bad_inode(inode))
                 goto out_nowait;
         if (NFS_STALE(inode))
                 goto out_nowait;
@@ -671,13 +680,20 @@ int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
         if ((nfsi->cache_validity & NFS_INO_REVAL_PAGECACHE)
                         || nfs_attribute_timeout(inode))
                 ret = __nfs_revalidate_inode(NFS_SERVER(inode), inode);
+        if (ret < 0)
+                goto out;
 
         if (nfsi->cache_validity & NFS_INO_INVALID_DATA) {
-                nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
-                if (S_ISREG(inode->i_mode))
-                        nfs_sync_mapping(mapping);
-                invalidate_inode_pages2(mapping);
-
+                if (mapping->nrpages != 0) {
+                        if (S_ISREG(inode->i_mode)) {
+                                ret = nfs_sync_mapping(mapping);
+                                if (ret < 0)
+                                        goto out;
+                        }
+                        ret = invalidate_inode_pages2(mapping);
+                        if (ret < 0)
+                                goto out;
+                }
                 spin_lock(&inode->i_lock);
                 nfsi->cache_validity &= ~NFS_INO_INVALID_DATA;
                 if (S_ISDIR(inode->i_mode)) {
@@ -687,10 +703,12 @@ int nfs_revalidate_mapping(struct inode *inode, struct address_space *mapping)
                 }
                 spin_unlock(&inode->i_lock);
 
+                nfs_inc_stats(inode, NFSIOS_DATAINVALIDATE);
                 dfprintk(PAGECACHE, "NFS: (%s/%Ld) data cache invalidated\n",
                                 inode->i_sb->s_id,
                                 (long long)NFS_FILEID(inode));
         }
+out:
         return ret;
 }
 
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index bea0b016bd70..d205466233f6 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -93,15 +93,15 @@ extern void nfs_destroy_directcache(void);
 /* nfs2xdr.c */
 extern int nfs_stat_to_errno(int);
 extern struct rpc_procinfo nfs_procedures[];
-extern u32 * nfs_decode_dirent(u32 *, struct nfs_entry *, int);
+extern __be32 * nfs_decode_dirent(__be32 *, struct nfs_entry *, int);
 
 /* nfs3xdr.c */
 extern struct rpc_procinfo nfs3_procedures[];
-extern u32 *nfs3_decode_dirent(u32 *, struct nfs_entry *, int);
+extern __be32 *nfs3_decode_dirent(__be32 *, struct nfs_entry *, int);
 
 /* nfs4xdr.c */
 #ifdef CONFIG_NFS_V4
-extern u32 *nfs4_decode_dirent(u32 *p, struct nfs_entry *entry, int plus);
+extern __be32 *nfs4_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus);
 #endif
 
 /* nfs4proc.c */
diff --git a/fs/nfs/mount_clnt.c b/fs/nfs/mount_clnt.c
index d507b021207f..f75fe72b4160 100644
--- a/fs/nfs/mount_clnt.c
+++ b/fs/nfs/mount_clnt.c
@@ -95,7 +95,7 @@ mnt_create(char *hostname, struct sockaddr_in *srvaddr, int version,
  * XDR encode/decode functions for MOUNT
  */
 static int
-xdr_encode_dirpath(struct rpc_rqst *req, u32 *p, const char *path)
+xdr_encode_dirpath(struct rpc_rqst *req, __be32 *p, const char *path)
 {
         p = xdr_encode_string(p, path);
 
@@ -104,7 +104,7 @@ xdr_encode_dirpath(struct rpc_rqst *req, u32 *p, const char *path)
 }
 
 static int
-xdr_decode_fhstatus(struct rpc_rqst *req, u32 *p, struct mnt_fhstatus *res)
+xdr_decode_fhstatus(struct rpc_rqst *req, __be32 *p, struct mnt_fhstatus *res)
 {
         struct nfs_fh *fh = res->fh;
 
@@ -116,7 +116,7 @@ xdr_decode_fhstatus(struct rpc_rqst *req, u32 *p, struct mnt_fhstatus *res)
 }
 
 static int
-xdr_decode_fhstatus3(struct rpc_rqst *req, u32 *p, struct mnt_fhstatus *res)
+xdr_decode_fhstatus3(struct rpc_rqst *req, __be32 *p, struct mnt_fhstatus *res)
 {
         struct nfs_fh *fh = res->fh;
 
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index b49501fc0a79..3be4e72a0227 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -66,15 +66,15 @@
 /*
  * Common NFS XDR functions as inlines
  */
-static inline u32 *
-xdr_encode_fhandle(u32 *p, struct nfs_fh *fhandle)
+static inline __be32 *
+xdr_encode_fhandle(__be32 *p, struct nfs_fh *fhandle)
 {
         memcpy(p, fhandle->data, NFS2_FHSIZE);
         return p + XDR_QUADLEN(NFS2_FHSIZE);
 }
 
-static inline u32 *
-xdr_decode_fhandle(u32 *p, struct nfs_fh *fhandle)
+static inline __be32 *
+xdr_decode_fhandle(__be32 *p, struct nfs_fh *fhandle)
 {
         /* NFSv2 handles have a fixed length */
         fhandle->size = NFS2_FHSIZE;
@@ -82,8 +82,8 @@ xdr_decode_fhandle(u32 *p, struct nfs_fh *fhandle)
         return p + XDR_QUADLEN(NFS2_FHSIZE);
 }
 
-static inline u32*
-xdr_encode_time(u32 *p, struct timespec *timep)
+static inline __be32*
+xdr_encode_time(__be32 *p, struct timespec *timep)
 {
         *p++ = htonl(timep->tv_sec);
         /* Convert nanoseconds into microseconds */
@@ -91,8 +91,8 @@ xdr_encode_time(u32 *p, struct timespec *timep)
         return p;
 }
 
-static inline u32*
-xdr_encode_current_server_time(u32 *p, struct timespec *timep)
+static inline __be32*
+xdr_encode_current_server_time(__be32 *p, struct timespec *timep)
 {
         /*
          * Passing the invalid value useconds=1000000 is a
@@ -108,8 +108,8 @@ xdr_encode_current_server_time(u32 *p, struct timespec *timep)
         return p;
 }
 
-static inline u32*
-xdr_decode_time(u32 *p, struct timespec *timep)
+static inline __be32*
+xdr_decode_time(__be32 *p, struct timespec *timep)
 {
         timep->tv_sec = ntohl(*p++);
         /* Convert microseconds into nanoseconds */
@@ -117,8 +117,8 @@ xdr_decode_time(u32 *p, struct timespec *timep)
         return p;
 }
 
-static u32 *
-xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
+static __be32 *
+xdr_decode_fattr(__be32 *p, struct nfs_fattr *fattr)
 {
         u32 rdev;
         fattr->type = (enum nfs_ftype) ntohl(*p++);
@@ -146,10 +146,10 @@ xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
         return p;
 }
 
-static inline u32 *
-xdr_encode_sattr(u32 *p, struct iattr *attr)
+static inline __be32 *
+xdr_encode_sattr(__be32 *p, struct iattr *attr)
 {
-        const u32 not_set = __constant_htonl(0xFFFFFFFF);
+        const __be32 not_set = __constant_htonl(0xFFFFFFFF);
 
         *p++ = (attr->ia_valid & ATTR_MODE) ? htonl(attr->ia_mode) : not_set;
         *p++ = (attr->ia_valid & ATTR_UID) ? htonl(attr->ia_uid) : not_set;
@@ -184,7 +184,7 @@ xdr_encode_sattr(u32 *p, struct iattr *attr)
  * GETATTR, READLINK, STATFS
  */
 static int
-nfs_xdr_fhandle(struct rpc_rqst *req, u32 *p, struct nfs_fh *fh)
+nfs_xdr_fhandle(struct rpc_rqst *req, __be32 *p, struct nfs_fh *fh)
 {
         p = xdr_encode_fhandle(p, fh);
         req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
@@ -195,7 +195,7 @@ nfs_xdr_fhandle(struct rpc_rqst *req, u32 *p, struct nfs_fh *fh)
  * Encode SETATTR arguments
  */
 static int
-nfs_xdr_sattrargs(struct rpc_rqst *req, u32 *p, struct nfs_sattrargs *args)
+nfs_xdr_sattrargs(struct rpc_rqst *req, __be32 *p, struct nfs_sattrargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_sattr(p, args->sattr);
@@ -208,7 +208,7 @@ nfs_xdr_sattrargs(struct rpc_rqst *req, u32 *p, struct nfs_sattrargs *args)
  * LOOKUP, REMOVE, RMDIR
  */
 static int
-nfs_xdr_diropargs(struct rpc_rqst *req, u32 *p, struct nfs_diropargs *args)
+nfs_xdr_diropargs(struct rpc_rqst *req, __be32 *p, struct nfs_diropargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -222,7 +222,7 @@ nfs_xdr_diropargs(struct rpc_rqst *req, u32 *p, struct nfs_diropargs *args)
  * exactly to the page we want to fetch.
  */
 static int
-nfs_xdr_readargs(struct rpc_rqst *req, u32 *p, struct nfs_readargs *args)
+nfs_xdr_readargs(struct rpc_rqst *req, __be32 *p, struct nfs_readargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
@@ -246,7 +246,7 @@ nfs_xdr_readargs(struct rpc_rqst *req, u32 *p, struct nfs_readargs *args)
  * Decode READ reply
  */
 static int
-nfs_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
+nfs_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
 {
         struct kvec *iov = req->rq_rcv_buf.head;
         int     status, count, recvd, hdrlen;
@@ -286,7 +286,7 @@ nfs_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
  * Write arguments. Splice the buffer to be written into the iovec.
  */
 static int
-nfs_xdr_writeargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
+nfs_xdr_writeargs(struct rpc_rqst *req, __be32 *p, struct nfs_writeargs *args)
 {
         struct xdr_buf *sndbuf = &req->rq_snd_buf;
         u32 offset = (u32)args->offset;
@@ -309,7 +309,7 @@ nfs_xdr_writeargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
  * CREATE, MKDIR
  */
 static int
-nfs_xdr_createargs(struct rpc_rqst *req, u32 *p, struct nfs_createargs *args)
+nfs_xdr_createargs(struct rpc_rqst *req, __be32 *p, struct nfs_createargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -322,7 +322,7 @@ nfs_xdr_createargs(struct rpc_rqst *req, u32 *p, struct nfs_createargs *args)
  * Encode RENAME arguments
  */
 static int
-nfs_xdr_renameargs(struct rpc_rqst *req, u32 *p, struct nfs_renameargs *args)
+nfs_xdr_renameargs(struct rpc_rqst *req, __be32 *p, struct nfs_renameargs *args)
 {
         p = xdr_encode_fhandle(p, args->fromfh);
         p = xdr_encode_array(p, args->fromname, args->fromlen);
@@ -336,7 +336,7 @@ nfs_xdr_renameargs(struct rpc_rqst *req, u32 *p, struct nfs_renameargs *args)
  * Encode LINK arguments
  */
 static int
-nfs_xdr_linkargs(struct rpc_rqst *req, u32 *p, struct nfs_linkargs *args)
+nfs_xdr_linkargs(struct rpc_rqst *req, __be32 *p, struct nfs_linkargs *args)
 {
         p = xdr_encode_fhandle(p, args->fromfh);
         p = xdr_encode_fhandle(p, args->tofh);
@@ -349,7 +349,7 @@ nfs_xdr_linkargs(struct rpc_rqst *req, u32 *p, struct nfs_linkargs *args)
  * Encode SYMLINK arguments
  */
 static int
-nfs_xdr_symlinkargs(struct rpc_rqst *req, u32 *p, struct nfs_symlinkargs *args)
+nfs_xdr_symlinkargs(struct rpc_rqst *req, __be32 *p, struct nfs_symlinkargs *args)
 {
         struct xdr_buf *sndbuf = &req->rq_snd_buf;
         size_t pad;
@@ -378,7 +378,7 @@ nfs_xdr_symlinkargs(struct rpc_rqst *req, u32 *p, struct nfs_symlinkargs *args)
  * Encode arguments to readdir call
  */
 static int
-nfs_xdr_readdirargs(struct rpc_rqst *req, u32 *p, struct nfs_readdirargs *args)
+nfs_xdr_readdirargs(struct rpc_rqst *req, __be32 *p, struct nfs_readdirargs *args)
 {
         struct rpc_task *task = req->rq_task;
         struct rpc_auth *auth = task->tk_auth;
@@ -404,7 +404,7 @@ nfs_xdr_readdirargs(struct rpc_rqst *req, u32 *p, struct nfs_readdirargs *args)
  * from nfs_readdir for each entry.
  */
 static int
-nfs_xdr_readdirres(struct rpc_rqst *req, u32 *p, void *dummy)
+nfs_xdr_readdirres(struct rpc_rqst *req, __be32 *p, void *dummy)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
@@ -412,7 +412,7 @@ nfs_xdr_readdirres(struct rpc_rqst *req, u32 *p, void *dummy)
         int hdrlen, recvd;
         int status, nr;
         unsigned int len, pglen;
-        u32 *end, *entry, *kaddr;
+        __be32 *end, *entry, *kaddr;
 
         if ((status = ntohl(*p++)))
                 return -nfs_stat_to_errno(status);
@@ -432,8 +432,8 @@ nfs_xdr_readdirres(struct rpc_rqst *req, u32 *p, void *dummy)
         if (pglen > recvd)
                 pglen = recvd;
         page = rcvbuf->pages;
-        kaddr = p = (u32 *)kmap_atomic(*page, KM_USER0);
-        end = (u32 *)((char *)p + pglen);
+        kaddr = p = kmap_atomic(*page, KM_USER0);
+        end = (__be32 *)((char *)p + pglen);
         entry = p;
         for (nr = 0; *p++; nr++) {
                 if (p + 2 > end)
@@ -468,8 +468,8 @@ err_unmap:
         goto out;
 }
 
-u32 *
-nfs_decode_dirent(u32 *p, struct nfs_entry *entry, int plus)
+__be32 *
+nfs_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus)
 {
         if (!*p++) {
                 if (!*p)
@@ -496,7 +496,7 @@ nfs_decode_dirent(u32 *p, struct nfs_entry *entry, int plus)
  * Decode simple status reply
  */
 static int
-nfs_xdr_stat(struct rpc_rqst *req, u32 *p, void *dummy)
+nfs_xdr_stat(struct rpc_rqst *req, __be32 *p, void *dummy)
 {
         int     status;
 
@@ -510,7 +510,7 @@ nfs_xdr_stat(struct rpc_rqst *req, u32 *p, void *dummy)
  * GETATTR, SETATTR, WRITE
  */
 static int
-nfs_xdr_attrstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
+nfs_xdr_attrstat(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         int     status;
 
@@ -525,7 +525,7 @@ nfs_xdr_attrstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
  * LOOKUP, CREATE, MKDIR
  */
 static int
-nfs_xdr_diropres(struct rpc_rqst *req, u32 *p, struct nfs_diropok *res)
+nfs_xdr_diropres(struct rpc_rqst *req, __be32 *p, struct nfs_diropok *res)
 {
         int     status;
 
@@ -540,7 +540,7 @@ nfs_xdr_diropres(struct rpc_rqst *req, u32 *p, struct nfs_diropok *res)
  * Encode READLINK args
  */
 static int
-nfs_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs_readlinkargs *args)
+nfs_xdr_readlinkargs(struct rpc_rqst *req, __be32 *p, struct nfs_readlinkargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
@@ -558,7 +558,7 @@ nfs_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs_readlinkargs *args
  * Decode READLINK reply
  */
 static int
-nfs_xdr_readlinkres(struct rpc_rqst *req, u32 *p, void *dummy)
+nfs_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, void *dummy)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
@@ -601,7 +601,7 @@ nfs_xdr_readlinkres(struct rpc_rqst *req, u32 *p, void *dummy)
  * Decode WRITE reply
  */
 static int
-nfs_xdr_writeres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
+nfs_xdr_writeres(struct rpc_rqst *req, __be32 *p, struct nfs_writeres *res)
 {
         res->verf->committed = NFS_FILE_SYNC;
         return nfs_xdr_attrstat(req, p, res->fattr);
@@ -611,7 +611,7 @@ nfs_xdr_writeres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
  * Decode STATFS reply
  */
 static int
-nfs_xdr_statfsres(struct rpc_rqst *req, u32 *p, struct nfs2_fsstat *res)
+nfs_xdr_statfsres(struct rpc_rqst *req, __be32 *p, struct nfs2_fsstat *res)
 {
         int     status;
 
diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 3b234d4601e7..e5f128ffc32d 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -668,7 +668,7 @@ nfs3_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
 {
         struct inode            *dir = dentry->d_inode;
         struct nfs_fattr        dir_attr;
-        u32                     *verf = NFS_COOKIEVERF(dir);
+        __be32                  *verf = NFS_COOKIEVERF(dir);
         struct nfs3_readdirargs arg = {
                 .fh             = NFS_FH(dir),
                 .cookie         = cookie,
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index 16556fa4effb..0ace092d126f 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -105,14 +105,14 @@ static struct {
 /*
  * Common NFS XDR functions as inlines
  */
-static inline u32 *
-xdr_encode_fhandle(u32 *p, struct nfs_fh *fh)
+static inline __be32 *
+xdr_encode_fhandle(__be32 *p, struct nfs_fh *fh)
 {
         return xdr_encode_array(p, fh->data, fh->size);
 }
 
-static inline u32 *
-xdr_decode_fhandle(u32 *p, struct nfs_fh *fh)
+static inline __be32 *
+xdr_decode_fhandle(__be32 *p, struct nfs_fh *fh)
 {
         if ((fh->size = ntohl(*p++)) <= NFS3_FHSIZE) {
                 memcpy(fh->data, p, fh->size);
@@ -124,24 +124,24 @@ xdr_decode_fhandle(u32 *p, struct nfs_fh *fh)
 /*
  * Encode/decode time.
  */
-static inline u32 *
-xdr_encode_time3(u32 *p, struct timespec *timep)
+static inline __be32 *
+xdr_encode_time3(__be32 *p, struct timespec *timep)
 {
         *p++ = htonl(timep->tv_sec);
         *p++ = htonl(timep->tv_nsec);
         return p;
 }
 
-static inline u32 *
-xdr_decode_time3(u32 *p, struct timespec *timep)
+static inline __be32 *
+xdr_decode_time3(__be32 *p, struct timespec *timep)
 {
         timep->tv_sec = ntohl(*p++);
         timep->tv_nsec = ntohl(*p++);
         return p;
 }
 
-static u32 *
-xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
+static __be32 *
+xdr_decode_fattr(__be32 *p, struct nfs_fattr *fattr)
 {
         unsigned int    type, major, minor;
         int             fmode;
@@ -177,8 +177,8 @@ xdr_decode_fattr(u32 *p, struct nfs_fattr *fattr)
         return p;
 }
 
-static inline u32 *
-xdr_encode_sattr(u32 *p, struct iattr *attr)
+static inline __be32 *
+xdr_encode_sattr(__be32 *p, struct iattr *attr)
 {
         if (attr->ia_valid & ATTR_MODE) {
                 *p++ = xdr_one;
@@ -223,8 +223,8 @@ xdr_encode_sattr(u32 *p, struct iattr *attr)
         return p;
 }
 
-static inline u32 *
-xdr_decode_wcc_attr(u32 *p, struct nfs_fattr *fattr)
+static inline __be32 *
+xdr_decode_wcc_attr(__be32 *p, struct nfs_fattr *fattr)
 {
         p = xdr_decode_hyper(p, &fattr->pre_size);
         p = xdr_decode_time3(p, &fattr->pre_mtime);
@@ -233,16 +233,16 @@ xdr_decode_wcc_attr(u32 *p, struct nfs_fattr *fattr)
         return p;
 }
 
-static inline u32 *
-xdr_decode_post_op_attr(u32 *p, struct nfs_fattr *fattr)
+static inline __be32 *
+xdr_decode_post_op_attr(__be32 *p, struct nfs_fattr *fattr)
 {
         if (*p++)
                 p = xdr_decode_fattr(p, fattr);
         return p;
 }
 
-static inline u32 *
-xdr_decode_pre_op_attr(u32 *p, struct nfs_fattr *fattr)
+static inline __be32 *
+xdr_decode_pre_op_attr(__be32 *p, struct nfs_fattr *fattr)
 {
         if (*p++)
                 return xdr_decode_wcc_attr(p, fattr);
@@ -250,8 +250,8 @@ xdr_decode_pre_op_attr(u32 *p, struct nfs_fattr *fattr)
 }
 
 
-static inline u32 *
-xdr_decode_wcc_data(u32 *p, struct nfs_fattr *fattr)
+static inline __be32 *
+xdr_decode_wcc_data(__be32 *p, struct nfs_fattr *fattr)
 {
         p = xdr_decode_pre_op_attr(p, fattr);
         return xdr_decode_post_op_attr(p, fattr);
@@ -265,7 +265,7 @@ xdr_decode_wcc_data(u32 *p, struct nfs_fattr *fattr)
  * Encode file handle argument
  */
 static int
-nfs3_xdr_fhandle(struct rpc_rqst *req, u32 *p, struct nfs_fh *fh)
+nfs3_xdr_fhandle(struct rpc_rqst *req, __be32 *p, struct nfs_fh *fh)
 {
         p = xdr_encode_fhandle(p, fh);
         req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
@@ -276,7 +276,7 @@ nfs3_xdr_fhandle(struct rpc_rqst *req, u32 *p, struct nfs_fh *fh)
  * Encode SETATTR arguments
  */
 static int
-nfs3_xdr_sattrargs(struct rpc_rqst *req, u32 *p, struct nfs3_sattrargs *args)
+nfs3_xdr_sattrargs(struct rpc_rqst *req, __be32 *p, struct nfs3_sattrargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_sattr(p, args->sattr);
@@ -291,7 +291,7 @@ nfs3_xdr_sattrargs(struct rpc_rqst *req, u32 *p, struct nfs3_sattrargs *args)
  * Encode directory ops argument
  */
 static int
-nfs3_xdr_diropargs(struct rpc_rqst *req, u32 *p, struct nfs3_diropargs *args)
+nfs3_xdr_diropargs(struct rpc_rqst *req, __be32 *p, struct nfs3_diropargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -303,7 +303,7 @@ nfs3_xdr_diropargs(struct rpc_rqst *req, u32 *p, struct nfs3_diropargs *args)
  * Encode access() argument
  */
 static int
-nfs3_xdr_accessargs(struct rpc_rqst *req, u32 *p, struct nfs3_accessargs *args)
+nfs3_xdr_accessargs(struct rpc_rqst *req, __be32 *p, struct nfs3_accessargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         *p++ = htonl(args->access);
@@ -317,7 +317,7 @@ nfs3_xdr_accessargs(struct rpc_rqst *req, u32 *p, struct nfs3_accessargs *args)
  * exactly to the page we want to fetch.
  */
 static int
-nfs3_xdr_readargs(struct rpc_rqst *req, u32 *p, struct nfs_readargs *args)
+nfs3_xdr_readargs(struct rpc_rqst *req, __be32 *p, struct nfs_readargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
@@ -339,7 +339,7 @@ nfs3_xdr_readargs(struct rpc_rqst *req, u32 *p, struct nfs_readargs *args)
  * Write arguments. Splice the buffer to be written into the iovec.
  */
 static int
-nfs3_xdr_writeargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
+nfs3_xdr_writeargs(struct rpc_rqst *req, __be32 *p, struct nfs_writeargs *args)
 {
         struct xdr_buf *sndbuf = &req->rq_snd_buf;
         u32 count = args->count;
@@ -360,7 +360,7 @@ nfs3_xdr_writeargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
  * Encode CREATE arguments
  */
 static int
-nfs3_xdr_createargs(struct rpc_rqst *req, u32 *p, struct nfs3_createargs *args)
+nfs3_xdr_createargs(struct rpc_rqst *req, __be32 *p, struct nfs3_createargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -380,7 +380,7 @@ nfs3_xdr_createargs(struct rpc_rqst *req, u32 *p, struct nfs3_createargs *args)
  * Encode MKDIR arguments
  */
 static int
-nfs3_xdr_mkdirargs(struct rpc_rqst *req, u32 *p, struct nfs3_mkdirargs *args)
+nfs3_xdr_mkdirargs(struct rpc_rqst *req, __be32 *p, struct nfs3_mkdirargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -393,7 +393,7 @@ nfs3_xdr_mkdirargs(struct rpc_rqst *req, u32 *p, struct nfs3_mkdirargs *args)
  * Encode SYMLINK arguments
  */
 static int
-nfs3_xdr_symlinkargs(struct rpc_rqst *req, u32 *p, struct nfs3_symlinkargs *args)
+nfs3_xdr_symlinkargs(struct rpc_rqst *req, __be32 *p, struct nfs3_symlinkargs *args)
 {
         p = xdr_encode_fhandle(p, args->fromfh);
         p = xdr_encode_array(p, args->fromname, args->fromlen);
@@ -410,7 +410,7 @@ nfs3_xdr_symlinkargs(struct rpc_rqst *req, u32 *p, struct nfs3_symlinkargs *args
  * Encode MKNOD arguments
  */
 static int
-nfs3_xdr_mknodargs(struct rpc_rqst *req, u32 *p, struct nfs3_mknodargs *args)
+nfs3_xdr_mknodargs(struct rpc_rqst *req, __be32 *p, struct nfs3_mknodargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_array(p, args->name, args->len);
@@ -429,7 +429,7 @@ nfs3_xdr_mknodargs(struct rpc_rqst *req, u32 *p, struct nfs3_mknodargs *args)
  * Encode RENAME arguments
  */
 static int
-nfs3_xdr_renameargs(struct rpc_rqst *req, u32 *p, struct nfs3_renameargs *args)
+nfs3_xdr_renameargs(struct rpc_rqst *req, __be32 *p, struct nfs3_renameargs *args)
 {
         p = xdr_encode_fhandle(p, args->fromfh);
         p = xdr_encode_array(p, args->fromname, args->fromlen);
@@ -443,7 +443,7 @@ nfs3_xdr_renameargs(struct rpc_rqst *req, u32 *p, struct nfs3_renameargs *args)
  * Encode LINK arguments
  */
 static int
-nfs3_xdr_linkargs(struct rpc_rqst *req, u32 *p, struct nfs3_linkargs *args)
+nfs3_xdr_linkargs(struct rpc_rqst *req, __be32 *p, struct nfs3_linkargs *args)
 {
         p = xdr_encode_fhandle(p, args->fromfh);
         p = xdr_encode_fhandle(p, args->tofh);
@@ -456,7 +456,7 @@ nfs3_xdr_linkargs(struct rpc_rqst *req, u32 *p, struct nfs3_linkargs *args)
  * Encode arguments to readdir call
  */
 static int
-nfs3_xdr_readdirargs(struct rpc_rqst *req, u32 *p, struct nfs3_readdirargs *args)
+nfs3_xdr_readdirargs(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
@@ -485,7 +485,7 @@ nfs3_xdr_readdirargs(struct rpc_rqst *req, u32 *p, struct nfs3_readdirargs *args
  * We just check for syntactical correctness.
  */
 static int
-nfs3_xdr_readdirres(struct rpc_rqst *req, u32 *p, struct nfs3_readdirres *res)
+nfs3_xdr_readdirres(struct rpc_rqst *req, __be32 *p, struct nfs3_readdirres *res)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
@@ -493,7 +493,7 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, u32 *p, struct nfs3_readdirres *res)
         int hdrlen, recvd;
         int status, nr;
         unsigned int len, pglen;
-        u32 *entry, *end, *kaddr;
+        __be32 *entry, *end, *kaddr;
 
         status = ntohl(*p++);
         /* Decode post_op_attrs */
@@ -523,8 +523,8 @@ nfs3_xdr_readdirres(struct rpc_rqst *req, u32 *p, struct nfs3_readdirres *res)
         if (pglen > recvd)
                 pglen = recvd;
         page = rcvbuf->pages;
-        kaddr = p = (u32 *)kmap_atomic(*page, KM_USER0);
-        end = (u32 *)((char *)p + pglen);
+        kaddr = p = kmap_atomic(*page, KM_USER0);
+        end = (__be32 *)((char *)p + pglen);
         entry = p;
         for (nr = 0; *p++; nr++) {
                 if (p + 3 > end)
@@ -583,8 +583,8 @@ err_unmap:
         goto out;
 }
 
-u32 *
-nfs3_decode_dirent(u32 *p, struct nfs_entry *entry, int plus)
+__be32 *
+nfs3_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus)
 {
         struct nfs_entry old = *entry;
 
@@ -626,7 +626,7 @@ nfs3_decode_dirent(u32 *p, struct nfs_entry *entry, int plus)
  * Encode COMMIT arguments
  */
 static int
-nfs3_xdr_commitargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
+nfs3_xdr_commitargs(struct rpc_rqst *req, __be32 *p, struct nfs_writeargs *args)
 {
         p = xdr_encode_fhandle(p, args->fh);
         p = xdr_encode_hyper(p, args->offset);
@@ -640,7 +640,7 @@ nfs3_xdr_commitargs(struct rpc_rqst *req, u32 *p, struct nfs_writeargs *args)
  * Encode GETACL arguments
  */
 static int
-nfs3_xdr_getaclargs(struct rpc_rqst *req, u32 *p,
+nfs3_xdr_getaclargs(struct rpc_rqst *req, __be32 *p,
                     struct nfs3_getaclargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
@@ -664,7 +664,7 @@ nfs3_xdr_getaclargs(struct rpc_rqst *req, u32 *p,
  * Encode SETACL arguments
  */
 static int
-nfs3_xdr_setaclargs(struct rpc_rqst *req, u32 *p,
+nfs3_xdr_setaclargs(struct rpc_rqst *req, __be32 *p,
                    struct nfs3_setaclargs *args)
 {
         struct xdr_buf *buf = &req->rq_snd_buf;
@@ -711,7 +711,7 @@ nfs3_xdr_setaclargs(struct rpc_rqst *req, u32 *p,
  * Decode attrstat reply.
  */
 static int
-nfs3_xdr_attrstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
+nfs3_xdr_attrstat(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         int     status;
 
@@ -726,7 +726,7 @@ nfs3_xdr_attrstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
  * SATTR, REMOVE, RMDIR
  */
 static int
-nfs3_xdr_wccstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
+nfs3_xdr_wccstat(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         int     status;
 
@@ -740,7 +740,7 @@ nfs3_xdr_wccstat(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
  * Decode LOOKUP reply
  */
 static int
-nfs3_xdr_lookupres(struct rpc_rqst *req, u32 *p, struct nfs3_diropres *res)
+nfs3_xdr_lookupres(struct rpc_rqst *req, __be32 *p, struct nfs3_diropres *res)
 {
         int     status;
 
@@ -759,7 +759,7 @@ nfs3_xdr_lookupres(struct rpc_rqst *req, u32 *p, struct nfs3_diropres *res)
  * Decode ACCESS reply
  */
 static int
-nfs3_xdr_accessres(struct rpc_rqst *req, u32 *p, struct nfs3_accessres *res)
+nfs3_xdr_accessres(struct rpc_rqst *req, __be32 *p, struct nfs3_accessres *res)
 {
         int     status = ntohl(*p++);
 
@@ -771,7 +771,7 @@ nfs3_xdr_accessres(struct rpc_rqst *req, u32 *p, struct nfs3_accessres *res)
 }
 
 static int
-nfs3_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs3_readlinkargs *args)
+nfs3_xdr_readlinkargs(struct rpc_rqst *req, __be32 *p, struct nfs3_readlinkargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
@@ -789,7 +789,7 @@ nfs3_xdr_readlinkargs(struct rpc_rqst *req, u32 *p, struct nfs3_readlinkargs *ar
  * Decode READLINK reply
  */
 static int
-nfs3_xdr_readlinkres(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
+nfs3_xdr_readlinkres(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
@@ -837,7 +837,7 @@ nfs3_xdr_readlinkres(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
  * Decode READ reply
  */
 static int
-nfs3_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
+nfs3_xdr_readres(struct rpc_rqst *req, __be32 *p, struct nfs_readres *res)
 {
         struct kvec *iov = req->rq_rcv_buf.head;
         int     status, count, ocount, recvd, hdrlen;
@@ -888,7 +888,7 @@ nfs3_xdr_readres(struct rpc_rqst *req, u32 *p, struct nfs_readres *res)
  * Decode WRITE response
  */
 static int
-nfs3_xdr_writeres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
+nfs3_xdr_writeres(struct rpc_rqst *req, __be32 *p, struct nfs_writeres *res)
 {
         int     status;
 
@@ -910,7 +910,7 @@ nfs3_xdr_writeres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
  * Decode a CREATE response
  */
 static int
-nfs3_xdr_createres(struct rpc_rqst *req, u32 *p, struct nfs3_diropres *res)
+nfs3_xdr_createres(struct rpc_rqst *req, __be32 *p, struct nfs3_diropres *res)
 {
         int     status;
 
@@ -937,7 +937,7 @@ nfs3_xdr_createres(struct rpc_rqst *req, u32 *p, struct nfs3_diropres *res)
  * Decode RENAME reply
  */
 static int
-nfs3_xdr_renameres(struct rpc_rqst *req, u32 *p, struct nfs3_renameres *res)
+nfs3_xdr_renameres(struct rpc_rqst *req, __be32 *p, struct nfs3_renameres *res)
 {
         int     status;
 
@@ -952,7 +952,7 @@ nfs3_xdr_renameres(struct rpc_rqst *req, u32 *p, struct nfs3_renameres *res)
  * Decode LINK reply
  */
 static int
-nfs3_xdr_linkres(struct rpc_rqst *req, u32 *p, struct nfs3_linkres *res)
+nfs3_xdr_linkres(struct rpc_rqst *req, __be32 *p, struct nfs3_linkres *res)
 {
         int     status;
 
@@ -967,7 +967,7 @@ nfs3_xdr_linkres(struct rpc_rqst *req, u32 *p, struct nfs3_linkres *res)
  * Decode FSSTAT reply
  */
 static int
-nfs3_xdr_fsstatres(struct rpc_rqst *req, u32 *p, struct nfs_fsstat *res)
+nfs3_xdr_fsstatres(struct rpc_rqst *req, __be32 *p, struct nfs_fsstat *res)
 {
         int             status;
 
@@ -992,7 +992,7 @@ nfs3_xdr_fsstatres(struct rpc_rqst *req, u32 *p, struct nfs_fsstat *res)
  * Decode FSINFO reply
  */
 static int
-nfs3_xdr_fsinfores(struct rpc_rqst *req, u32 *p, struct nfs_fsinfo *res)
+nfs3_xdr_fsinfores(struct rpc_rqst *req, __be32 *p, struct nfs_fsinfo *res)
 {
         int             status;
 
@@ -1020,7 +1020,7 @@ nfs3_xdr_fsinfores(struct rpc_rqst *req, u32 *p, struct nfs_fsinfo *res)
  * Decode PATHCONF reply
  */
 static int
-nfs3_xdr_pathconfres(struct rpc_rqst *req, u32 *p, struct nfs_pathconf *res)
+nfs3_xdr_pathconfres(struct rpc_rqst *req, __be32 *p, struct nfs_pathconf *res)
 {
         int             status;
 
@@ -1040,7 +1040,7 @@ nfs3_xdr_pathconfres(struct rpc_rqst *req, u32 *p, struct nfs_pathconf *res)
  * Decode COMMIT reply
  */
 static int
-nfs3_xdr_commitres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
+nfs3_xdr_commitres(struct rpc_rqst *req, __be32 *p, struct nfs_writeres *res)
 {
         int             status;
 
@@ -1059,7 +1059,7 @@ nfs3_xdr_commitres(struct rpc_rqst *req, u32 *p, struct nfs_writeres *res)
  * Decode GETACL reply
  */
 static int
-nfs3_xdr_getaclres(struct rpc_rqst *req, u32 *p,
+nfs3_xdr_getaclres(struct rpc_rqst *req, __be32 *p,
                    struct nfs3_getaclres *res)
 {
         struct xdr_buf *buf = &req->rq_rcv_buf;
@@ -1091,7 +1091,7 @@ nfs3_xdr_getaclres(struct rpc_rqst *req, u32 *p,
  * Decode setacl reply.
  */
 static int
-nfs3_xdr_setaclres(struct rpc_rqst *req, u32 *p, struct nfs_fattr *fattr)
+nfs3_xdr_setaclres(struct rpc_rqst *req, __be32 *p, struct nfs_fattr *fattr)
 {
         int status = ntohl(*p++);
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 61095fe4b5ca..6f346677332d 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -212,7 +212,7 @@ extern void nfs_free_seqid(struct nfs_seqid *seqid);
 extern const nfs4_stateid zero_stateid;
 
 /* nfs4xdr.c */
-extern uint32_t *nfs4_decode_dirent(uint32_t *p, struct nfs_entry *entry, int plus);
+extern __be32 *nfs4_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus);
 extern struct rpc_procinfo nfs4_procedures[];
 
 struct nfs4_mount_data;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 47c7e6e3910d..8118036cc449 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -138,10 +138,10 @@ const u32 nfs4_fs_locations_bitmap[2] = {
         | FATTR4_WORD1_MOUNTED_ON_FILEID
 };
 
-static void nfs4_setup_readdir(u64 cookie, u32 *verifier, struct dentry *dentry,
+static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dentry,
                 struct nfs4_readdir_arg *readdir)
 {
-        u32 *start, *p;
+        __be32 *start, *p;
 
         BUG_ON(readdir->count < 80);
         if (cookie > 2) {
@@ -162,7 +162,7 @@ static void nfs4_setup_readdir(u64 cookie, u32 *verifier, struct dentry *dentry,
          * when talking to the server, we always send cookie 0
          * instead of 1 or 2.
          */
-        start = p = (u32 *)kmap_atomic(*readdir->pages, KM_USER0);
+        start = p = kmap_atomic(*readdir->pages, KM_USER0);
         
         if (cookie == 0) {
                 *p++ = xdr_one;                                  /* next */
@@ -1314,11 +1314,9 @@ nfs4_open_revalidate(struct inode *dir, struct dentry *dentry, int openflags, st
                         case -EROFS:
                                 lookup_instantiate_filp(nd, (struct dentry *)state, NULL);
                                 return 1;
-                        case -ENOENT:
-                                if (dentry->d_inode == NULL)
-                                        return 1;
+                        default:
+                                goto out_drop;
                 }
-                goto out_drop;
         }
         if (state->inode == dentry->d_inode) {
                 nfs4_intent_set_file(nd, dentry, state);
@@ -2917,11 +2915,11 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program, unsigned short po
                 .rpc_resp = clp,
                 .rpc_cred = cred,
         };
-        u32 *p;
+        __be32 *p;
         int loop = 0;
         int status;
 
-        p = (u32*)sc_verifier.data;
+        p = (__be32*)sc_verifier.data;
         *p++ = htonl((u32)clp->cl_boot_time.tv_sec);
         *p = htonl((u32)clp->cl_boot_time.tv_nsec);
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 3dd413f52da1..0cf3fa312a33 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -471,7 +471,7 @@ struct compound_hdr {
 
 static void encode_string(struct xdr_stream *xdr, unsigned int len, const char *str)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = xdr_reserve_space(xdr, 4 + len);
         BUG_ON(p == NULL);
@@ -480,7 +480,7 @@ static void encode_string(struct xdr_stream *xdr, unsigned int len, const char *
 
 static int encode_compound_hdr(struct xdr_stream *xdr, struct compound_hdr *hdr)
 {
-        uint32_t *p;
+        __be32 *p;
 
         dprintk("encode_compound: tag=%.*s\n", (int)hdr->taglen, hdr->tag);
         BUG_ON(hdr->taglen > NFS4_MAXTAGLEN);
@@ -494,7 +494,7 @@ static int encode_compound_hdr(struct xdr_stream *xdr, struct compound_hdr *hdr)
 
 static void encode_nfs4_verifier(struct xdr_stream *xdr, const nfs4_verifier *verf)
 {
-        uint32_t *p;
+        __be32 *p;
 
         p = xdr_reserve_space(xdr, NFS4_VERIFIER_SIZE);
         BUG_ON(p == NULL);
@@ -507,8 +507,8 @@ static int encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const s
         char owner_group[IDMAP_NAMESZ];
         int owner_namelen = 0;
         int owner_grouplen = 0;
-        uint32_t *p;
-        uint32_t *q;
+        __be32 *p;
+        __be32 *q;
         int len;
         uint32_t bmval0 = 0;
         uint32_t bmval1 = 0;
@@ -630,7 +630,7 @@ static int encode_attrs(struct xdr_stream *xdr, const struct iattr *iap, const s
 
 static int encode_access(struct xdr_stream *xdr, u32 access)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8);
         WRITE32(OP_ACCESS);
@@ -641,7 +641,7 @@ static int encode_access(struct xdr_stream *xdr, u32 access)
 
 static int encode_close(struct xdr_stream *xdr, const struct nfs_closeargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8+sizeof(arg->stateid->data));
         WRITE32(OP_CLOSE);
@@ -653,7 +653,7 @@ static int encode_close(struct xdr_stream *xdr, const struct nfs_closeargs *arg)
 
 static int encode_commit(struct xdr_stream *xdr, const struct nfs_writeargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
         
         RESERVE_SPACE(16);
         WRITE32(OP_COMMIT);
@@ -665,7 +665,7 @@ static int encode_commit(struct xdr_stream *xdr, const struct nfs_writeargs *arg
 
 static int encode_create(struct xdr_stream *xdr, const struct nfs4_create_arg *create)
 {
-        uint32_t *p;
+        __be32 *p;
         
         RESERVE_SPACE(8);
         WRITE32(OP_CREATE);
@@ -697,7 +697,7 @@ static int encode_create(struct xdr_stream *xdr, const struct nfs4_create_arg *c
 
 static int encode_getattr_one(struct xdr_stream *xdr, uint32_t bitmap)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(12);
         WRITE32(OP_GETATTR);
@@ -708,7 +708,7 @@ static int encode_getattr_one(struct xdr_stream *xdr, uint32_t bitmap)
 
 static int encode_getattr_two(struct xdr_stream *xdr, uint32_t bm0, uint32_t bm1)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(16);
         WRITE32(OP_GETATTR);
@@ -740,7 +740,7 @@ static int encode_fs_locations(struct xdr_stream *xdr, const u32* bitmask)
 
 static int encode_getfh(struct xdr_stream *xdr)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_GETFH);
@@ -750,7 +750,7 @@ static int encode_getfh(struct xdr_stream *xdr)
 
 static int encode_link(struct xdr_stream *xdr, const struct qstr *name)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8 + name->len);
         WRITE32(OP_LINK);
@@ -780,7 +780,7 @@ static inline uint64_t nfs4_lock_length(struct file_lock *fl)
  */
 static int encode_lock(struct xdr_stream *xdr, const struct nfs_lock_args *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(32);
         WRITE32(OP_LOCK);
@@ -809,7 +809,7 @@ static int encode_lock(struct xdr_stream *xdr, const struct nfs_lock_args *args)
 
 static int encode_lockt(struct xdr_stream *xdr, const struct nfs_lockt_args *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(40);
         WRITE32(OP_LOCKT);
@@ -825,7 +825,7 @@ static int encode_lockt(struct xdr_stream *xdr, const struct nfs_lockt_args *arg
 
 static int encode_locku(struct xdr_stream *xdr, const struct nfs_locku_args *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(44);
         WRITE32(OP_LOCKU);
@@ -841,7 +841,7 @@ static int encode_locku(struct xdr_stream *xdr, const struct nfs_locku_args *arg
 static int encode_lookup(struct xdr_stream *xdr, const struct qstr *name)
 {
         int len = name->len;
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8 + len);
         WRITE32(OP_LOOKUP);
@@ -853,7 +853,7 @@ static int encode_lookup(struct xdr_stream *xdr, const struct qstr *name)
 
 static void encode_share_access(struct xdr_stream *xdr, int open_flags)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8);
         switch (open_flags & (FMODE_READ|FMODE_WRITE)) {
@@ -874,7 +874,7 @@ static void encode_share_access(struct xdr_stream *xdr, int open_flags)
 
 static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_openargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
  /*
  * opcode 4, seqid 4, share_access 4, share_deny 4, clientid 8, ownerlen 4,
  * owner 4 = 32
@@ -891,7 +891,7 @@ static inline void encode_openhdr(struct xdr_stream *xdr, const struct nfs_opena
 
 static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_openargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         switch(arg->open_flags & O_EXCL) {
@@ -907,7 +907,7 @@ static inline void encode_createmode(struct xdr_stream *xdr, const struct nfs_op
 
 static void encode_opentype(struct xdr_stream *xdr, const struct nfs_openargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         switch (arg->open_flags & O_CREAT) {
@@ -923,7 +923,7 @@ static void encode_opentype(struct xdr_stream *xdr, const struct nfs_openargs *a
 
 static inline void encode_delegation_type(struct xdr_stream *xdr, int delegation_type)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         switch (delegation_type) {
@@ -943,7 +943,7 @@ static inline void encode_delegation_type(struct xdr_stream *xdr, int delegation
 
 static inline void encode_claim_null(struct xdr_stream *xdr, const struct qstr *name)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(NFS4_OPEN_CLAIM_NULL);
@@ -952,7 +952,7 @@ static inline void encode_claim_null(struct xdr_stream *xdr, const struct qstr *
 
 static inline void encode_claim_previous(struct xdr_stream *xdr, int type)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(NFS4_OPEN_CLAIM_PREVIOUS);
@@ -961,7 +961,7 @@ static inline void encode_claim_previous(struct xdr_stream *xdr, int type)
 
 static inline void encode_claim_delegate_cur(struct xdr_stream *xdr, const struct qstr *name, const nfs4_stateid *stateid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4+sizeof(stateid->data));
         WRITE32(NFS4_OPEN_CLAIM_DELEGATE_CUR);
@@ -991,7 +991,7 @@ static int encode_open(struct xdr_stream *xdr, const struct nfs_openargs *arg)
 
 static int encode_open_confirm(struct xdr_stream *xdr, const struct nfs_open_confirmargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8+sizeof(arg->stateid->data));
         WRITE32(OP_OPEN_CONFIRM);
@@ -1003,7 +1003,7 @@ static int encode_open_confirm(struct xdr_stream *xdr, const struct nfs_open_con
 
 static int encode_open_downgrade(struct xdr_stream *xdr, const struct nfs_closeargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8+sizeof(arg->stateid->data));
         WRITE32(OP_OPEN_DOWNGRADE);
@@ -1017,7 +1017,7 @@ static int
 encode_putfh(struct xdr_stream *xdr, const struct nfs_fh *fh)
 {
         int len = fh->size;
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8 + len);
         WRITE32(OP_PUTFH);
@@ -1029,7 +1029,7 @@ encode_putfh(struct xdr_stream *xdr, const struct nfs_fh *fh)
 
 static int encode_putrootfh(struct xdr_stream *xdr)
 {
-        uint32_t *p;
+        __be32 *p;
         
         RESERVE_SPACE(4);
         WRITE32(OP_PUTROOTFH);
@@ -1040,7 +1040,7 @@ static int encode_putrootfh(struct xdr_stream *xdr)
 static void encode_stateid(struct xdr_stream *xdr, const struct nfs_open_context *ctx)
 {
         nfs4_stateid stateid;
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(16);
         if (ctx->state != NULL) {
@@ -1052,7 +1052,7 @@ static void encode_stateid(struct xdr_stream *xdr, const struct nfs_open_context
 
 static int encode_read(struct xdr_stream *xdr, const struct nfs_readargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_READ);
@@ -1074,7 +1074,7 @@ static int encode_readdir(struct xdr_stream *xdr, const struct nfs4_readdir_arg
                 FATTR4_WORD1_MOUNTED_ON_FILEID,
         };
         int replen;
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(32+sizeof(nfs4_verifier));
         WRITE32(OP_READDIR);
@@ -1116,7 +1116,7 @@ static int encode_readlink(struct xdr_stream *xdr, const struct nfs4_readlink *r
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         unsigned int replen;
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_READLINK);
@@ -1134,7 +1134,7 @@ static int encode_readlink(struct xdr_stream *xdr, const struct nfs4_readlink *r
 
 static int encode_remove(struct xdr_stream *xdr, const struct qstr *name)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8 + name->len);
         WRITE32(OP_REMOVE);
@@ -1146,7 +1146,7 @@ static int encode_remove(struct xdr_stream *xdr, const struct qstr *name)
 
 static int encode_rename(struct xdr_stream *xdr, const struct qstr *oldname, const struct qstr *newname)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(8 + oldname->len);
         WRITE32(OP_RENAME);
@@ -1162,7 +1162,7 @@ static int encode_rename(struct xdr_stream *xdr, const struct qstr *oldname, con
 
 static int encode_renew(struct xdr_stream *xdr, const struct nfs_client *client_stateid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(12);
         WRITE32(OP_RENEW);
@@ -1174,7 +1174,7 @@ static int encode_renew(struct xdr_stream *xdr, const struct nfs_client *client_
 static int
 encode_restorefh(struct xdr_stream *xdr)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_RESTOREFH);
@@ -1185,7 +1185,7 @@ encode_restorefh(struct xdr_stream *xdr)
 static int
 encode_setacl(struct xdr_stream *xdr, struct nfs_setaclargs *arg)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4+sizeof(zero_stateid.data));
         WRITE32(OP_SETATTR);
@@ -1204,7 +1204,7 @@ encode_setacl(struct xdr_stream *xdr, struct nfs_setaclargs *arg)
 static int
 encode_savefh(struct xdr_stream *xdr)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_SAVEFH);
@@ -1215,7 +1215,7 @@ encode_savefh(struct xdr_stream *xdr)
 static int encode_setattr(struct xdr_stream *xdr, const struct nfs_setattrargs *arg, const struct nfs_server *server)
 {
         int status;
-        uint32_t *p;
+        __be32 *p;
         
         RESERVE_SPACE(4+sizeof(arg->stateid.data));
         WRITE32(OP_SETATTR);
@@ -1229,7 +1229,7 @@ static int encode_setattr(struct xdr_stream *xdr, const struct nfs_setattrargs *
 
 static int encode_setclientid(struct xdr_stream *xdr, const struct nfs4_setclientid *setclientid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4 + sizeof(setclientid->sc_verifier->data));
         WRITE32(OP_SETCLIENTID);
@@ -1248,7 +1248,7 @@ static int encode_setclientid(struct xdr_stream *xdr, const struct nfs4_setclien
 
 static int encode_setclientid_confirm(struct xdr_stream *xdr, const struct nfs_client *client_state)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(12 + sizeof(client_state->cl_confirm.data));
         WRITE32(OP_SETCLIENTID_CONFIRM);
@@ -1260,7 +1260,7 @@ static int encode_setclientid_confirm(struct xdr_stream *xdr, const struct nfs_c
 
 static int encode_write(struct xdr_stream *xdr, const struct nfs_writeargs *args)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(4);
         WRITE32(OP_WRITE);
@@ -1279,7 +1279,7 @@ static int encode_write(struct xdr_stream *xdr, const struct nfs_writeargs *args
 
 static int encode_delegreturn(struct xdr_stream *xdr, const nfs4_stateid *stateid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         RESERVE_SPACE(20);
 
@@ -1295,7 +1295,7 @@ static int encode_delegreturn(struct xdr_stream *xdr, const nfs4_stateid *statei
 /*
  * Encode an ACCESS request
  */
-static int nfs4_xdr_enc_access(struct rpc_rqst *req, uint32_t *p, const struct nfs4_accessargs *args)
+static int nfs4_xdr_enc_access(struct rpc_rqst *req, __be32 *p, const struct nfs4_accessargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1313,7 +1313,7 @@ static int nfs4_xdr_enc_access(struct rpc_rqst *req, uint32_t *p, const struct n
 /*
  * Encode LOOKUP request
  */
-static int nfs4_xdr_enc_lookup(struct rpc_rqst *req, uint32_t *p, const struct nfs4_lookup_arg *args)
+static int nfs4_xdr_enc_lookup(struct rpc_rqst *req, __be32 *p, const struct nfs4_lookup_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1337,7 +1337,7 @@ out:
 /*
  * Encode LOOKUP_ROOT request
  */
-static int nfs4_xdr_enc_lookup_root(struct rpc_rqst *req, uint32_t *p, const struct nfs4_lookup_root_arg *args)
+static int nfs4_xdr_enc_lookup_root(struct rpc_rqst *req, __be32 *p, const struct nfs4_lookup_root_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1358,7 +1358,7 @@ out:
 /*
  * Encode REMOVE request
  */
-static int nfs4_xdr_enc_remove(struct rpc_rqst *req, uint32_t *p, const struct nfs4_remove_arg *args)
+static int nfs4_xdr_enc_remove(struct rpc_rqst *req, __be32 *p, const struct nfs4_remove_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1380,7 +1380,7 @@ out:
 /*
  * Encode RENAME request
  */
-static int nfs4_xdr_enc_rename(struct rpc_rqst *req, uint32_t *p, const struct nfs4_rename_arg *args)
+static int nfs4_xdr_enc_rename(struct rpc_rqst *req, __be32 *p, const struct nfs4_rename_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1410,7 +1410,7 @@ out:
 /*
  * Encode LINK request
  */
-static int nfs4_xdr_enc_link(struct rpc_rqst *req, uint32_t *p, const struct nfs4_link_arg *args)
+static int nfs4_xdr_enc_link(struct rpc_rqst *req, __be32 *p, const struct nfs4_link_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1440,7 +1440,7 @@ out:
 /*
  * Encode CREATE request
  */
-static int nfs4_xdr_enc_create(struct rpc_rqst *req, uint32_t *p, const struct nfs4_create_arg *args)
+static int nfs4_xdr_enc_create(struct rpc_rqst *req, __be32 *p, const struct nfs4_create_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1470,7 +1470,7 @@ out:
 /*
  * Encode SYMLINK request
  */
-static int nfs4_xdr_enc_symlink(struct rpc_rqst *req, uint32_t *p, const struct nfs4_create_arg *args)
+static int nfs4_xdr_enc_symlink(struct rpc_rqst *req, __be32 *p, const struct nfs4_create_arg *args)
 {
         return nfs4_xdr_enc_create(req, p, args);
 }
@@ -1478,7 +1478,7 @@ static int nfs4_xdr_enc_symlink(struct rpc_rqst *req, uint32_t *p, const struct
 /*
  * Encode GETATTR request
  */
-static int nfs4_xdr_enc_getattr(struct rpc_rqst *req, uint32_t *p, const struct nfs4_getattr_arg *args)
+static int nfs4_xdr_enc_getattr(struct rpc_rqst *req, __be32 *p, const struct nfs4_getattr_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1496,7 +1496,7 @@ static int nfs4_xdr_enc_getattr(struct rpc_rqst *req, uint32_t *p, const struct
 /*
  * Encode a CLOSE request
  */
-static int nfs4_xdr_enc_close(struct rpc_rqst *req, uint32_t *p, struct nfs_closeargs *args)
+static int nfs4_xdr_enc_close(struct rpc_rqst *req, __be32 *p, struct nfs_closeargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1520,7 +1520,7 @@ out:
 /*
  * Encode an OPEN request
  */
-static int nfs4_xdr_enc_open(struct rpc_rqst *req, uint32_t *p, struct nfs_openargs *args)
+static int nfs4_xdr_enc_open(struct rpc_rqst *req, __be32 *p, struct nfs_openargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1556,7 +1556,7 @@ out:
 /*
  * Encode an OPEN_CONFIRM request
  */
-static int nfs4_xdr_enc_open_confirm(struct rpc_rqst *req, uint32_t *p, struct nfs_open_confirmargs *args)
+static int nfs4_xdr_enc_open_confirm(struct rpc_rqst *req, __be32 *p, struct nfs_open_confirmargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1577,7 +1577,7 @@ out:
 /*
  * Encode an OPEN request with no attributes.
  */
-static int nfs4_xdr_enc_open_noattr(struct rpc_rqst *req, uint32_t *p, struct nfs_openargs *args)
+static int nfs4_xdr_enc_open_noattr(struct rpc_rqst *req, __be32 *p, struct nfs_openargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1601,7 +1601,7 @@ out:
 /*
  * Encode an OPEN_DOWNGRADE request
  */
-static int nfs4_xdr_enc_open_downgrade(struct rpc_rqst *req, uint32_t *p, struct nfs_closeargs *args)
+static int nfs4_xdr_enc_open_downgrade(struct rpc_rqst *req, __be32 *p, struct nfs_closeargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1625,7 +1625,7 @@ out:
 /*
  * Encode a LOCK request
  */
-static int nfs4_xdr_enc_lock(struct rpc_rqst *req, uint32_t *p, struct nfs_lock_args *args)
+static int nfs4_xdr_enc_lock(struct rpc_rqst *req, __be32 *p, struct nfs_lock_args *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1646,7 +1646,7 @@ out:
 /*
  * Encode a LOCKT request
  */
-static int nfs4_xdr_enc_lockt(struct rpc_rqst *req, uint32_t *p, struct nfs_lockt_args *args)
+static int nfs4_xdr_enc_lockt(struct rpc_rqst *req, __be32 *p, struct nfs_lockt_args *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1667,7 +1667,7 @@ out:
 /*
  * Encode a LOCKU request
  */
-static int nfs4_xdr_enc_locku(struct rpc_rqst *req, uint32_t *p, struct nfs_locku_args *args)
+static int nfs4_xdr_enc_locku(struct rpc_rqst *req, __be32 *p, struct nfs_locku_args *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1688,7 +1688,7 @@ out:
 /*
  * Encode a READLINK request
  */
-static int nfs4_xdr_enc_readlink(struct rpc_rqst *req, uint32_t *p, const struct nfs4_readlink *args)
+static int nfs4_xdr_enc_readlink(struct rpc_rqst *req, __be32 *p, const struct nfs4_readlink *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1709,7 +1709,7 @@ out:
 /*
  * Encode a READDIR request
  */
-static int nfs4_xdr_enc_readdir(struct rpc_rqst *req, uint32_t *p, const struct nfs4_readdir_arg *args)
+static int nfs4_xdr_enc_readdir(struct rpc_rqst *req, __be32 *p, const struct nfs4_readdir_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1730,7 +1730,7 @@ out:
 /*
  * Encode a READ request
  */
-static int nfs4_xdr_enc_read(struct rpc_rqst *req, uint32_t *p, struct nfs_readargs *args)
+static int nfs4_xdr_enc_read(struct rpc_rqst *req, __be32 *p, struct nfs_readargs *args)
 {
         struct rpc_auth *auth = req->rq_task->tk_auth;
         struct xdr_stream xdr;
@@ -1762,7 +1762,7 @@ out:
 /*
  * Encode an SETATTR request
  */
-static int nfs4_xdr_enc_setattr(struct rpc_rqst *req, uint32_t *p, struct nfs_setattrargs *args)
+static int nfs4_xdr_enc_setattr(struct rpc_rqst *req, __be32 *p, struct nfs_setattrargs *args)
 
 {
         struct xdr_stream xdr;
@@ -1788,7 +1788,7 @@ out:
  * Encode a GETACL request
  */
 static int
-nfs4_xdr_enc_getacl(struct rpc_rqst *req, uint32_t *p,
+nfs4_xdr_enc_getacl(struct rpc_rqst *req, __be32 *p,
                 struct nfs_getaclargs *args)
 {
         struct xdr_stream xdr;
@@ -1815,7 +1815,7 @@ out:
 /*
  * Encode a WRITE request
  */
-static int nfs4_xdr_enc_write(struct rpc_rqst *req, uint32_t *p, struct nfs_writeargs *args)
+static int nfs4_xdr_enc_write(struct rpc_rqst *req, __be32 *p, struct nfs_writeargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1839,7 +1839,7 @@ out:
 /*
  *  a COMMIT request
  */
-static int nfs4_xdr_enc_commit(struct rpc_rqst *req, uint32_t *p, struct nfs_writeargs *args)
+static int nfs4_xdr_enc_commit(struct rpc_rqst *req, __be32 *p, struct nfs_writeargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1863,7 +1863,7 @@ out:
 /*
  * FSINFO request
  */
-static int nfs4_xdr_enc_fsinfo(struct rpc_rqst *req, uint32_t *p, struct nfs4_fsinfo_arg *args)
+static int nfs4_xdr_enc_fsinfo(struct rpc_rqst *req, __be32 *p, struct nfs4_fsinfo_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1882,7 +1882,7 @@ static int nfs4_xdr_enc_fsinfo(struct rpc_rqst *req, uint32_t *p, struct nfs4_fs
 /*
  * a PATHCONF request
  */
-static int nfs4_xdr_enc_pathconf(struct rpc_rqst *req, uint32_t *p, const struct nfs4_pathconf_arg *args)
+static int nfs4_xdr_enc_pathconf(struct rpc_rqst *req, __be32 *p, const struct nfs4_pathconf_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1902,7 +1902,7 @@ static int nfs4_xdr_enc_pathconf(struct rpc_rqst *req, uint32_t *p, const struct
 /*
  * a STATFS request
  */
-static int nfs4_xdr_enc_statfs(struct rpc_rqst *req, uint32_t *p, const struct nfs4_statfs_arg *args)
+static int nfs4_xdr_enc_statfs(struct rpc_rqst *req, __be32 *p, const struct nfs4_statfs_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1923,7 +1923,7 @@ static int nfs4_xdr_enc_statfs(struct rpc_rqst *req, uint32_t *p, const struct n
 /*
  * GETATTR_BITMAP request
  */
-static int nfs4_xdr_enc_server_caps(struct rpc_rqst *req, uint32_t *p, const struct nfs_fh *fhandle)
+static int nfs4_xdr_enc_server_caps(struct rpc_rqst *req, __be32 *p, const struct nfs_fh *fhandle)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1945,7 +1945,7 @@ static int nfs4_xdr_enc_server_caps(struct rpc_rqst *req, uint32_t *p, const str
 /*
  * a RENEW request
  */
-static int nfs4_xdr_enc_renew(struct rpc_rqst *req, uint32_t *p, struct nfs_client *clp)
+static int nfs4_xdr_enc_renew(struct rpc_rqst *req, __be32 *p, struct nfs_client *clp)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1960,7 +1960,7 @@ static int nfs4_xdr_enc_renew(struct rpc_rqst *req, uint32_t *p, struct nfs_clie
 /*
  * a SETCLIENTID request
  */
-static int nfs4_xdr_enc_setclientid(struct rpc_rqst *req, uint32_t *p, struct nfs4_setclientid *sc)
+static int nfs4_xdr_enc_setclientid(struct rpc_rqst *req, __be32 *p, struct nfs4_setclientid *sc)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1975,7 +1975,7 @@ static int nfs4_xdr_enc_setclientid(struct rpc_rqst *req, uint32_t *p, struct nf
 /*
  * a SETCLIENTID_CONFIRM request
  */
-static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, uint32_t *p, struct nfs_client *clp)
+static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, __be32 *p, struct nfs_client *clp)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -1997,7 +1997,7 @@ static int nfs4_xdr_enc_setclientid_confirm(struct rpc_rqst *req, uint32_t *p, s
 /*
  * DELEGRETURN request
  */
-static int nfs4_xdr_enc_delegreturn(struct rpc_rqst *req, uint32_t *p, const struct nfs4_delegreturnargs *args)
+static int nfs4_xdr_enc_delegreturn(struct rpc_rqst *req, __be32 *p, const struct nfs4_delegreturnargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -2021,7 +2021,7 @@ out:
 /*
  * Encode FS_LOCATIONS request
  */
-static int nfs4_xdr_enc_fs_locations(struct rpc_rqst *req, uint32_t *p, struct nfs4_fs_locations_arg *args)
+static int nfs4_xdr_enc_fs_locations(struct rpc_rqst *req, __be32 *p, struct nfs4_fs_locations_arg *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -2086,7 +2086,7 @@ out:
 
 static int decode_opaque_inline(struct xdr_stream *xdr, unsigned int *len, char **string)
 {
-        uint32_t *p;
+        __be32 *p;
 
         READ_BUF(4);
         READ32(*len);
@@ -2097,7 +2097,7 @@ static int decode_opaque_inline(struct xdr_stream *xdr, unsigned int *len, char
 
 static int decode_compound_hdr(struct xdr_stream *xdr, struct compound_hdr *hdr)
 {
-        uint32_t *p;
+        __be32 *p;
 
         READ_BUF(8);
         READ32(hdr->status);
@@ -2112,7 +2112,7 @@ static int decode_compound_hdr(struct xdr_stream *xdr, struct compound_hdr *hdr)
 
 static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t opnum;
         int32_t nfserr;
 
@@ -2134,7 +2134,7 @@ static int decode_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
 /* Dummy routine */
 static int decode_ace(struct xdr_stream *xdr, void *ace, struct nfs_client *clp)
 {
-        uint32_t *p;
+        __be32 *p;
         unsigned int strlen;
         char *str;
 
@@ -2144,7 +2144,8 @@ static int decode_ace(struct xdr_stream *xdr, void *ace, struct nfs_client *clp)
 
 static int decode_attr_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
 {
-        uint32_t bmlen, *p;
+        uint32_t bmlen;
+        __be32 *p;
 
         READ_BUF(4);
         READ32(bmlen);
@@ -2159,9 +2160,9 @@ static int decode_attr_bitmap(struct xdr_stream *xdr, uint32_t *bitmap)
         return 0;
 }
 
-static inline int decode_attr_length(struct xdr_stream *xdr, uint32_t *attrlen, uint32_t **savep)
+static inline int decode_attr_length(struct xdr_stream *xdr, uint32_t *attrlen, __be32 **savep)
 {
-        uint32_t *p;
+        __be32 *p;
 
         READ_BUF(4);
         READ32(*attrlen);
@@ -2182,7 +2183,7 @@ static int decode_attr_supported(struct xdr_stream *xdr, uint32_t *bitmap, uint3
 
 static int decode_attr_type(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *type)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *type = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_TYPE - 1U)))
@@ -2202,7 +2203,7 @@ static int decode_attr_type(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *
 
 static int decode_attr_change(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *change)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *change = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_CHANGE - 1U)))
@@ -2219,7 +2220,7 @@ static int decode_attr_change(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t
 
 static int decode_attr_size(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *size)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *size = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_SIZE - 1U)))
@@ -2235,7 +2236,7 @@ static int decode_attr_size(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *
 
 static int decode_attr_link_support(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *res = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_LINK_SUPPORT - 1U)))
@@ -2251,7 +2252,7 @@ static int decode_attr_link_support(struct xdr_stream *xdr, uint32_t *bitmap, ui
 
 static int decode_attr_symlink_support(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *res = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_SYMLINK_SUPPORT - 1U)))
@@ -2267,7 +2268,7 @@ static int decode_attr_symlink_support(struct xdr_stream *xdr, uint32_t *bitmap,
 
 static int decode_attr_fsid(struct xdr_stream *xdr, uint32_t *bitmap, struct nfs_fsid *fsid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         fsid->major = 0;
         fsid->minor = 0;
@@ -2287,7 +2288,7 @@ static int decode_attr_fsid(struct xdr_stream *xdr, uint32_t *bitmap, struct nfs
 
 static int decode_attr_lease_time(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *res = 60;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_LEASE_TIME - 1U)))
@@ -2303,7 +2304,7 @@ static int decode_attr_lease_time(struct xdr_stream *xdr, uint32_t *bitmap, uint
 
 static int decode_attr_aclsupport(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *res = ACL4_SUPPORT_ALLOW_ACL|ACL4_SUPPORT_DENY_ACL;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_ACLSUPPORT - 1U)))
@@ -2319,7 +2320,7 @@ static int decode_attr_aclsupport(struct xdr_stream *xdr, uint32_t *bitmap, uint
 
 static int decode_attr_fileid(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *fileid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *fileid = 0;
         if (unlikely(bitmap[0] & (FATTR4_WORD0_FILEID - 1U)))
@@ -2335,7 +2336,7 @@ static int decode_attr_fileid(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t
 
 static int decode_attr_mounted_on_fileid(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *fileid)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *fileid = 0;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_MOUNTED_ON_FILEID - 1U)))
@@ -2351,7 +2352,7 @@ static int decode_attr_mounted_on_fileid(struct xdr_stream *xdr, uint32_t *bitma
 
 static int decode_attr_files_avail(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2368,7 +2369,7 @@ static int decode_attr_files_avail(struct xdr_stream *xdr, uint32_t *bitmap, uin
 
 static int decode_attr_files_free(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2385,7 +2386,7 @@ static int decode_attr_files_free(struct xdr_stream *xdr, uint32_t *bitmap, uint
 
 static int decode_attr_files_total(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2403,7 +2404,7 @@ static int decode_attr_files_total(struct xdr_stream *xdr, uint32_t *bitmap, uin
 static int decode_pathname(struct xdr_stream *xdr, struct nfs4_pathname *path)
 {
         int n;
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         READ_BUF(4);
@@ -2448,7 +2449,7 @@ out_eio:
 static int decode_attr_fs_locations(struct xdr_stream *xdr, uint32_t *bitmap, struct nfs4_fs_locations *res)
 {
         int n;
-        uint32_t *p;
+        __be32 *p;
         int status = -EIO;
 
         if (unlikely(bitmap[0] & (FATTR4_WORD0_FS_LOCATIONS -1U)))
@@ -2512,7 +2513,7 @@ out_eio:
 
 static int decode_attr_maxfilesize(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2529,7 +2530,7 @@ static int decode_attr_maxfilesize(struct xdr_stream *xdr, uint32_t *bitmap, uin
 
 static int decode_attr_maxlink(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *maxlink)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *maxlink = 1;
@@ -2546,7 +2547,7 @@ static int decode_attr_maxlink(struct xdr_stream *xdr, uint32_t *bitmap, uint32_
 
 static int decode_attr_maxname(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *maxname)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *maxname = 1024;
@@ -2563,7 +2564,7 @@ static int decode_attr_maxname(struct xdr_stream *xdr, uint32_t *bitmap, uint32_
 
 static int decode_attr_maxread(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 1024;
@@ -2584,7 +2585,7 @@ static int decode_attr_maxread(struct xdr_stream *xdr, uint32_t *bitmap, uint32_
 
 static int decode_attr_maxwrite(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 1024;
@@ -2605,7 +2606,7 @@ static int decode_attr_maxwrite(struct xdr_stream *xdr, uint32_t *bitmap, uint32
 
 static int decode_attr_mode(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *mode)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *mode = 0;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_MODE - 1U)))
@@ -2622,7 +2623,7 @@ static int decode_attr_mode(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *
 
 static int decode_attr_nlink(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t *nlink)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *nlink = 1;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_NUMLINKS - 1U)))
@@ -2638,7 +2639,8 @@ static int decode_attr_nlink(struct xdr_stream *xdr, uint32_t *bitmap, uint32_t
 
 static int decode_attr_owner(struct xdr_stream *xdr, uint32_t *bitmap, struct nfs_client *clp, int32_t *uid)
 {
-        uint32_t len, *p;
+        uint32_t len;
+        __be32 *p;
 
         *uid = -2;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_OWNER - 1U)))
@@ -2662,7 +2664,8 @@ static int decode_attr_owner(struct xdr_stream *xdr, uint32_t *bitmap, struct nf
 
 static int decode_attr_group(struct xdr_stream *xdr, uint32_t *bitmap, struct nfs_client *clp, int32_t *gid)
 {
-        uint32_t len, *p;
+        uint32_t len;
+        __be32 *p;
 
         *gid = -2;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_OWNER_GROUP - 1U)))
@@ -2686,7 +2689,8 @@ static int decode_attr_group(struct xdr_stream *xdr, uint32_t *bitmap, struct nf
 
 static int decode_attr_rdev(struct xdr_stream *xdr, uint32_t *bitmap, dev_t *rdev)
 {
-        uint32_t major = 0, minor = 0, *p;
+        uint32_t major = 0, minor = 0;
+        __be32 *p;
 
         *rdev = MKDEV(0,0);
         if (unlikely(bitmap[1] & (FATTR4_WORD1_RAWDEV - 1U)))
@@ -2708,7 +2712,7 @@ static int decode_attr_rdev(struct xdr_stream *xdr, uint32_t *bitmap, dev_t *rde
 
 static int decode_attr_space_avail(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2725,7 +2729,7 @@ static int decode_attr_space_avail(struct xdr_stream *xdr, uint32_t *bitmap, uin
 
 static int decode_attr_space_free(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2742,7 +2746,7 @@ static int decode_attr_space_free(struct xdr_stream *xdr, uint32_t *bitmap, uint
 
 static int decode_attr_space_total(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status = 0;
 
         *res = 0;
@@ -2759,7 +2763,7 @@ static int decode_attr_space_total(struct xdr_stream *xdr, uint32_t *bitmap, uin
 
 static int decode_attr_space_used(struct xdr_stream *xdr, uint32_t *bitmap, uint64_t *used)
 {
-        uint32_t *p;
+        __be32 *p;
 
         *used = 0;
         if (unlikely(bitmap[1] & (FATTR4_WORD1_SPACE_USED - 1U)))
@@ -2776,7 +2780,7 @@ static int decode_attr_space_used(struct xdr_stream *xdr, uint32_t *bitmap, uint
 
 static int decode_attr_time(struct xdr_stream *xdr, struct timespec *time)
 {
-        uint32_t *p;
+        __be32 *p;
         uint64_t sec;
         uint32_t nsec;
 
@@ -2836,7 +2840,7 @@ static int decode_attr_time_modify(struct xdr_stream *xdr, uint32_t *bitmap, str
         return status;
 }
 
-static int verify_attr_len(struct xdr_stream *xdr, uint32_t *savep, uint32_t attrlen)
+static int verify_attr_len(struct xdr_stream *xdr, __be32 *savep, uint32_t attrlen)
 {
         unsigned int attrwords = XDR_QUADLEN(attrlen);
         unsigned int nwords = xdr->p - savep;
@@ -2854,7 +2858,7 @@ static int verify_attr_len(struct xdr_stream *xdr, uint32_t *savep, uint32_t att
 
 static int decode_change_info(struct xdr_stream *xdr, struct nfs4_change_info *cinfo)
 {
-        uint32_t *p;
+        __be32 *p;
 
         READ_BUF(20);
         READ32(cinfo->atomic);
@@ -2865,7 +2869,7 @@ static int decode_change_info(struct xdr_stream *xdr, struct nfs4_change_info *c
 
 static int decode_access(struct xdr_stream *xdr, struct nfs4_accessres *access)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t supp, acc;
         int status;
 
@@ -2882,7 +2886,7 @@ static int decode_access(struct xdr_stream *xdr, struct nfs4_accessres *access)
 
 static int decode_close(struct xdr_stream *xdr, struct nfs_closeres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_CLOSE);
@@ -2895,7 +2899,7 @@ static int decode_close(struct xdr_stream *xdr, struct nfs_closeres *res)
 
 static int decode_commit(struct xdr_stream *xdr, struct nfs_writeres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_COMMIT);
@@ -2908,7 +2912,7 @@ static int decode_commit(struct xdr_stream *xdr, struct nfs_writeres *res)
 
 static int decode_create(struct xdr_stream *xdr, struct nfs4_change_info *cinfo)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t bmlen;
         int status;
 
@@ -2925,7 +2929,7 @@ static int decode_create(struct xdr_stream *xdr, struct nfs4_change_info *cinfo)
 
 static int decode_server_caps(struct xdr_stream *xdr, struct nfs4_server_caps_res *res)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen, 
                  bitmap[2] = {0};
         int status;
@@ -2952,7 +2956,7 @@ xdr_error:
         
 static int decode_statfs(struct xdr_stream *xdr, struct nfs_fsstat *fsstat)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen, 
                  bitmap[2] = {0};
         int status;
@@ -2985,7 +2989,7 @@ xdr_error:
 
 static int decode_pathconf(struct xdr_stream *xdr, struct nfs_pathconf *pathconf)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen, 
                  bitmap[2] = {0};
         int status;
@@ -3010,7 +3014,7 @@ xdr_error:
 
 static int decode_getfattr(struct xdr_stream *xdr, struct nfs_fattr *fattr, const struct nfs_server *server)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen,
                  bitmap[2] = {0},
                  type;
@@ -3079,7 +3083,7 @@ xdr_error:
 
 static int decode_fsinfo(struct xdr_stream *xdr, struct nfs_fsinfo *fsinfo)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen, bitmap[2];
         int status;
 
@@ -3111,7 +3115,7 @@ xdr_error:
 
 static int decode_getfh(struct xdr_stream *xdr, struct nfs_fh *fh)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t len;
         int status;
 
@@ -3147,7 +3151,7 @@ static int decode_link(struct xdr_stream *xdr, struct nfs4_change_info *cinfo)
 static int decode_lock_denied (struct xdr_stream *xdr, struct file_lock *fl)
 {
         uint64_t offset, length, clientid;
-        uint32_t *p;
+        __be32 *p;
         uint32_t namelen, type;
 
         READ_BUF(32);
@@ -3172,7 +3176,7 @@ static int decode_lock_denied (struct xdr_stream *xdr, struct file_lock *fl)
 
 static int decode_lock(struct xdr_stream *xdr, struct nfs_lock_res *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_LOCK);
@@ -3195,7 +3199,7 @@ static int decode_lockt(struct xdr_stream *xdr, struct nfs_lockt_res *res)
 
 static int decode_locku(struct xdr_stream *xdr, struct nfs_locku_res *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_LOCKU);
@@ -3214,7 +3218,7 @@ static int decode_lookup(struct xdr_stream *xdr)
 /* This is too sick! */
 static int decode_space_limit(struct xdr_stream *xdr, u64 *maxsize)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t limit_type, nblocks, blocksize;
 
         READ_BUF(12);
@@ -3233,7 +3237,7 @@ static int decode_space_limit(struct xdr_stream *xdr, u64 *maxsize)
 
 static int decode_delegation(struct xdr_stream *xdr, struct nfs_openres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t delegation_type;
 
         READ_BUF(4);
@@ -3259,7 +3263,7 @@ static int decode_delegation(struct xdr_stream *xdr, struct nfs_openres *res)
 
 static int decode_open(struct xdr_stream *xdr, struct nfs_openres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t bmlen;
         int status;
 
@@ -3287,7 +3291,7 @@ xdr_error:
 
 static int decode_open_confirm(struct xdr_stream *xdr, struct nfs_open_confirmres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_OPEN_CONFIRM);
@@ -3300,7 +3304,7 @@ static int decode_open_confirm(struct xdr_stream *xdr, struct nfs_open_confirmre
 
 static int decode_open_downgrade(struct xdr_stream *xdr, struct nfs_closeres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_OPEN_DOWNGRADE);
@@ -3324,7 +3328,7 @@ static int decode_putrootfh(struct xdr_stream *xdr)
 static int decode_read(struct xdr_stream *xdr, struct rpc_rqst *req, struct nfs_readres *res)
 {
         struct kvec *iov = req->rq_rcv_buf.head;
-        uint32_t *p;
+        __be32 *p;
         uint32_t count, eof, recvd, hdrlen;
         int status;
 
@@ -3354,7 +3358,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         struct page     *page = *rcvbuf->pages;
         struct kvec     *iov = rcvbuf->head;
         unsigned int    nr, pglen = rcvbuf->page_len;
-        uint32_t        *end, *entry, *p, *kaddr;
+        __be32          *end, *entry, *p, *kaddr;
         uint32_t        len, attrlen, xlen;
         int             hdrlen, recvd, status;
 
@@ -3376,7 +3380,7 @@ static int decode_readdir(struct xdr_stream *xdr, struct rpc_rqst *req, struct n
         xdr_read_pages(xdr, pglen);
 
         BUG_ON(pglen + readdir->pgbase > PAGE_CACHE_SIZE);
-        kaddr = p = (uint32_t *) kmap_atomic(page, KM_USER0);
+        kaddr = p = kmap_atomic(page, KM_USER0);
         end = p + ((pglen + readdir->pgbase) >> 2);
         entry = p;
         for (nr = 0; *p++; nr++) {
@@ -3428,7 +3432,7 @@ static int decode_readlink(struct xdr_stream *xdr, struct rpc_rqst *req)
         struct xdr_buf *rcvbuf = &req->rq_rcv_buf;
         struct kvec *iov = rcvbuf->head;
         int hdrlen, len, recvd;
-        uint32_t *p;
+        __be32 *p;
         char *kaddr;
         int status;
 
@@ -3505,7 +3509,7 @@ decode_restorefh(struct xdr_stream *xdr)
 static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 size_t *acl_len)
 {
-        uint32_t *savep;
+        __be32 *savep;
         uint32_t attrlen,
                  bitmap[2] = {0};
         struct kvec *iov = req->rq_rcv_buf.head;
@@ -3551,7 +3555,7 @@ decode_savefh(struct xdr_stream *xdr)
 
 static int decode_setattr(struct xdr_stream *xdr, struct nfs_setattrres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t bmlen;
         int status;
 
@@ -3567,7 +3571,7 @@ static int decode_setattr(struct xdr_stream *xdr, struct nfs_setattrres *res)
 
 static int decode_setclientid(struct xdr_stream *xdr, struct nfs_client *clp)
 {
-        uint32_t *p;
+        __be32 *p;
         uint32_t opnum;
         int32_t nfserr;
 
@@ -3610,7 +3614,7 @@ static int decode_setclientid_confirm(struct xdr_stream *xdr)
 
 static int decode_write(struct xdr_stream *xdr, struct nfs_writeres *res)
 {
-        uint32_t *p;
+        __be32 *p;
         int status;
 
         status = decode_op_hdr(xdr, OP_WRITE);
@@ -3632,7 +3636,7 @@ static int decode_delegreturn(struct xdr_stream *xdr)
 /*
  * Decode OPEN_DOWNGRADE response
  */
-static int nfs4_xdr_dec_open_downgrade(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_closeres *res)
+static int nfs4_xdr_dec_open_downgrade(struct rpc_rqst *rqstp, __be32 *p, struct nfs_closeres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3660,7 +3664,7 @@ out:
 /*
  * Decode ACCESS response
  */
-static int nfs4_xdr_dec_access(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_accessres *res)
+static int nfs4_xdr_dec_access(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_accessres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3678,7 +3682,7 @@ out:
 /*
  * Decode LOOKUP response
  */
-static int nfs4_xdr_dec_lookup(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_lookup_res *res)
+static int nfs4_xdr_dec_lookup(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_lookup_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3701,7 +3705,7 @@ out:
 /*
  * Decode LOOKUP_ROOT response
  */
-static int nfs4_xdr_dec_lookup_root(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_lookup_res *res)
+static int nfs4_xdr_dec_lookup_root(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_lookup_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3721,7 +3725,7 @@ out:
 /*
  * Decode REMOVE response
  */
-static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_remove_res *res)
+static int nfs4_xdr_dec_remove(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_remove_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3742,7 +3746,7 @@ out:
 /*
  * Decode RENAME response
  */
-static int nfs4_xdr_dec_rename(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_rename_res *res)
+static int nfs4_xdr_dec_rename(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_rename_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3772,7 +3776,7 @@ out:
 /*
  * Decode LINK response
  */
-static int nfs4_xdr_dec_link(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_link_res *res)
+static int nfs4_xdr_dec_link(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_link_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3805,7 +3809,7 @@ out:
 /*
  * Decode CREATE response
  */
-static int nfs4_xdr_dec_create(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_create_res *res)
+static int nfs4_xdr_dec_create(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_create_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3834,7 +3838,7 @@ out:
 /*
  * Decode SYMLINK response
  */
-static int nfs4_xdr_dec_symlink(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_create_res *res)
+static int nfs4_xdr_dec_symlink(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_create_res *res)
 {
         return nfs4_xdr_dec_create(rqstp, p, res);
 }
@@ -3842,7 +3846,7 @@ static int nfs4_xdr_dec_symlink(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4
 /*
  * Decode GETATTR response
  */
-static int nfs4_xdr_dec_getattr(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_getattr_res *res)
+static int nfs4_xdr_dec_getattr(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_getattr_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3865,7 +3869,7 @@ out:
  * Encode an SETACL request
  */
 static int
-nfs4_xdr_enc_setacl(struct rpc_rqst *req, uint32_t *p, struct nfs_setaclargs *args)
+nfs4_xdr_enc_setacl(struct rpc_rqst *req, __be32 *p, struct nfs_setaclargs *args)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr = {
@@ -3886,7 +3890,7 @@ out:
  * Decode SETACL response
  */
 static int
-nfs4_xdr_dec_setacl(struct rpc_rqst *rqstp, uint32_t *p, void *res)
+nfs4_xdr_dec_setacl(struct rpc_rqst *rqstp, __be32 *p, void *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3908,7 +3912,7 @@ out:
  * Decode GETACL response
  */
 static int
-nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, uint32_t *p, size_t *acl_len)
+nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, __be32 *p, size_t *acl_len)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3930,7 +3934,7 @@ out:
 /*
  * Decode CLOSE response
  */
-static int nfs4_xdr_dec_close(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_closeres *res)
+static int nfs4_xdr_dec_close(struct rpc_rqst *rqstp, __be32 *p, struct nfs_closeres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3960,7 +3964,7 @@ out:
 /*
  * Decode OPEN response
  */
-static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_openres *res)
+static int nfs4_xdr_dec_open(struct rpc_rqst *rqstp, __be32 *p, struct nfs_openres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -3994,7 +3998,7 @@ out:
 /*
  * Decode OPEN_CONFIRM response
  */
-static int nfs4_xdr_dec_open_confirm(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_open_confirmres *res)
+static int nfs4_xdr_dec_open_confirm(struct rpc_rqst *rqstp, __be32 *p, struct nfs_open_confirmres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4015,7 +4019,7 @@ out:
 /*
  * Decode OPEN response
  */
-static int nfs4_xdr_dec_open_noattr(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_openres *res)
+static int nfs4_xdr_dec_open_noattr(struct rpc_rqst *rqstp, __be32 *p, struct nfs_openres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4039,7 +4043,7 @@ out:
 /*
  * Decode SETATTR response
  */
-static int nfs4_xdr_dec_setattr(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_setattrres *res)
+static int nfs4_xdr_dec_setattr(struct rpc_rqst *rqstp, __be32 *p, struct nfs_setattrres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4065,7 +4069,7 @@ out:
 /*
  * Decode LOCK response
  */
-static int nfs4_xdr_dec_lock(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_lock_res *res)
+static int nfs4_xdr_dec_lock(struct rpc_rqst *rqstp, __be32 *p, struct nfs_lock_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4086,7 +4090,7 @@ out:
 /*
  * Decode LOCKT response
  */
-static int nfs4_xdr_dec_lockt(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_lockt_res *res)
+static int nfs4_xdr_dec_lockt(struct rpc_rqst *rqstp, __be32 *p, struct nfs_lockt_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4107,7 +4111,7 @@ out:
 /*
  * Decode LOCKU response
  */
-static int nfs4_xdr_dec_locku(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_locku_res *res)
+static int nfs4_xdr_dec_locku(struct rpc_rqst *rqstp, __be32 *p, struct nfs_locku_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4128,7 +4132,7 @@ out:
 /*
  * Decode READLINK response
  */
-static int nfs4_xdr_dec_readlink(struct rpc_rqst *rqstp, uint32_t *p, void *res)
+static int nfs4_xdr_dec_readlink(struct rpc_rqst *rqstp, __be32 *p, void *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4149,7 +4153,7 @@ out:
 /*
  * Decode READDIR response
  */
-static int nfs4_xdr_dec_readdir(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_readdir_res *res)
+static int nfs4_xdr_dec_readdir(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_readdir_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4170,7 +4174,7 @@ out:
 /*
  * Decode Read response
  */
-static int nfs4_xdr_dec_read(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_readres *res)
+static int nfs4_xdr_dec_read(struct rpc_rqst *rqstp, __be32 *p, struct nfs_readres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4193,7 +4197,7 @@ out:
 /*
  * Decode WRITE response
  */
-static int nfs4_xdr_dec_write(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_writeres *res)
+static int nfs4_xdr_dec_write(struct rpc_rqst *rqstp, __be32 *p, struct nfs_writeres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4219,7 +4223,7 @@ out:
 /*
  * Decode COMMIT response
  */
-static int nfs4_xdr_dec_commit(struct rpc_rqst *rqstp, uint32_t *p, struct nfs_writeres *res)
+static int nfs4_xdr_dec_commit(struct rpc_rqst *rqstp, __be32 *p, struct nfs_writeres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4243,7 +4247,7 @@ out:
 /*
  * FSINFO request
  */
-static int nfs4_xdr_dec_fsinfo(struct rpc_rqst *req, uint32_t *p, struct nfs_fsinfo *fsinfo)
+static int nfs4_xdr_dec_fsinfo(struct rpc_rqst *req, __be32 *p, struct nfs_fsinfo *fsinfo)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4263,7 +4267,7 @@ static int nfs4_xdr_dec_fsinfo(struct rpc_rqst *req, uint32_t *p, struct nfs_fsi
 /*
  * PATHCONF request
  */
-static int nfs4_xdr_dec_pathconf(struct rpc_rqst *req, uint32_t *p, struct nfs_pathconf *pathconf)
+static int nfs4_xdr_dec_pathconf(struct rpc_rqst *req, __be32 *p, struct nfs_pathconf *pathconf)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4281,7 +4285,7 @@ static int nfs4_xdr_dec_pathconf(struct rpc_rqst *req, uint32_t *p, struct nfs_p
 /*
  * STATFS request
  */
-static int nfs4_xdr_dec_statfs(struct rpc_rqst *req, uint32_t *p, struct nfs_fsstat *fsstat)
+static int nfs4_xdr_dec_statfs(struct rpc_rqst *req, __be32 *p, struct nfs_fsstat *fsstat)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4299,7 +4303,7 @@ static int nfs4_xdr_dec_statfs(struct rpc_rqst *req, uint32_t *p, struct nfs_fss
 /*
  * GETATTR_BITMAP request
  */
-static int nfs4_xdr_dec_server_caps(struct rpc_rqst *req, uint32_t *p, struct nfs4_server_caps_res *res)
+static int nfs4_xdr_dec_server_caps(struct rpc_rqst *req, __be32 *p, struct nfs4_server_caps_res *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4318,7 +4322,7 @@ out:
 /*
  * Decode RENEW response
  */
-static int nfs4_xdr_dec_renew(struct rpc_rqst *rqstp, uint32_t *p, void *dummy)
+static int nfs4_xdr_dec_renew(struct rpc_rqst *rqstp, __be32 *p, void *dummy)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4334,7 +4338,7 @@ static int nfs4_xdr_dec_renew(struct rpc_rqst *rqstp, uint32_t *p, void *dummy)
 /*
  * a SETCLIENTID request
  */
-static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, uint32_t *p,
+static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, __be32 *p,
                 struct nfs_client *clp)
 {
         struct xdr_stream xdr;
@@ -4353,7 +4357,7 @@ static int nfs4_xdr_dec_setclientid(struct rpc_rqst *req, uint32_t *p,
 /*
  * a SETCLIENTID_CONFIRM request
  */
-static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, uint32_t *p, struct nfs_fsinfo *fsinfo)
+static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, __be32 *p, struct nfs_fsinfo *fsinfo)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4375,7 +4379,7 @@ static int nfs4_xdr_dec_setclientid_confirm(struct rpc_rqst *req, uint32_t *p, s
 /*
  * DELEGRETURN request
  */
-static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, uint32_t *p, struct nfs4_delegreturnres *res)
+static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nfs4_delegreturnres *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4397,7 +4401,7 @@ out:
 /*
  * FS_LOCATIONS request
  */
-static int nfs4_xdr_dec_fs_locations(struct rpc_rqst *req, uint32_t *p, struct nfs4_fs_locations *res)
+static int nfs4_xdr_dec_fs_locations(struct rpc_rqst *req, __be32 *p, struct nfs4_fs_locations *res)
 {
         struct xdr_stream xdr;
         struct compound_hdr hdr;
@@ -4417,7 +4421,7 @@ out:
         return status;
 }
 
-uint32_t *nfs4_decode_dirent(uint32_t *p, struct nfs_entry *entry, int plus)
+__be32 *nfs4_decode_dirent(__be32 *p, struct nfs_entry *entry, int plus)
 {
         uint32_t bitmap[2] = {0};
         uint32_t len;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 28659a919d6e..28108c82b887 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -834,7 +834,7 @@ static int nfs4_get_sb(struct file_system_type *fs_type,
         }
         /* RFC3530: The default port for NFS is 2049 */
         if (addr.sin_port == 0)
-                addr.sin_port = NFS_PORT;
+                addr.sin_port = htons(NFS_PORT);
 
         /* Grab the authentication type */
         authflavour = RPC_AUTH_UNIX;
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index 2fe3403c2409..3ea50ac64820 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -18,11 +18,6 @@
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
 static struct ctl_table_header *nfs_callback_sysctl_table;
-/*
- * Something that isn't CTL_ANY, CTL_NONE or a value that may clash.
- * Use the same values as fs/lockd/svc.c
- */
-#define CTL_UNNUMBERED -2
 
 static ctl_table nfs_cb_sysctls[] = {
 #ifdef CONFIG_NFS_V4
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index f6675d2c386c..883dd4a1c157 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -57,6 +57,8 @@
 #include <linux/nfs_fs.h>
 #include <linux/nfs_mount.h>
 #include <linux/nfs_page.h>
+#include <linux/backing-dev.h>
+
 #include <asm/uaccess.h>
 #include <linux/smp_lock.h>
 
@@ -395,7 +397,7 @@ int nfs_writepages(struct address_space *mapping, struct writeback_control *wbc)
 out:
         clear_bit(BDI_write_congested, &bdi->state);
         wake_up_all(&nfs_write_congestion);
-        writeback_congestion_end();
+        congestion_end(WRITE);
         return err;
 }
 
@@ -588,10 +590,10 @@ static void nfs_cancel_commit_list(struct list_head *head)
 
         while(!list_empty(head)) {
                 req = nfs_list_entry(head->next);
+                dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
                 nfs_list_remove_request(req);
                 nfs_inode_remove_request(req);
-                dec_zone_page_state(req->wb_page, NR_UNSTABLE_NFS);
-                nfs_clear_page_writeback(req);
+                nfs_unlock_request(req);
         }
 }
 
diff --git a/fs/nfs_common/nfsacl.c b/fs/nfs_common/nfsacl.c
index 0c2be8c0307d..c11f5375d7c1 100644
--- a/fs/nfs_common/nfsacl.c
+++ b/fs/nfs_common/nfsacl.c
@@ -46,7 +46,7 @@ xdr_nfsace_encode(struct xdr_array2_desc *desc, void *elem)
 {
         struct nfsacl_encode_desc *nfsacl_desc =
                 (struct nfsacl_encode_desc *) desc;
-        u32 *p = (u32 *) elem;
+        __be32 *p = elem;
 
         struct posix_acl_entry *entry =
                 &nfsacl_desc->acl->a_entries[nfsacl_desc->count++];
@@ -127,7 +127,7 @@ xdr_nfsace_decode(struct xdr_array2_desc *desc, void *elem)
 {
         struct nfsacl_decode_desc *nfsacl_desc =
                 (struct nfsacl_decode_desc *) desc;
-        u32 *p = (u32 *) elem;
+        __be32 *p = elem;
         struct posix_acl_entry *entry;
 
         if (!nfsacl_desc->acl) {
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index e13fa23bd108..f37df46d2eaa 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -1148,12 +1148,12 @@ exp_find(struct auth_domain *clp, int fsid_type, u32 *fsidv,
  * for a given NFSv4 client.   The root is defined to be the
  * export point with fsid==0
  */
-int
+__be32
 exp_pseudoroot(struct auth_domain *clp, struct svc_fh *fhp,
                struct cache_req *creq)
 {
         struct svc_export *exp;
-        int rv;
+        __be32 rv;
         u32 fsidv[2];
 
         mk_fsid_v1(fsidv, 0);
diff --git a/fs/nfsd/lockd.c b/fs/nfsd/lockd.c
index 7b889ff15ae6..11fdaf7721b4 100644
--- a/fs/nfsd/lockd.c
+++ b/fs/nfsd/lockd.c
@@ -25,7 +25,7 @@
 static u32
 nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
 {
-        u32             nfserr;
+        __be32          nfserr;
         struct svc_fh   fh;
 
         /* must initialize before using! but maxsize doesn't matter */
@@ -39,18 +39,20 @@ nlm_fopen(struct svc_rqst *rqstp, struct nfs_fh *f, struct file **filp)
         fh_put(&fh);
         rqstp->rq_client = NULL;
         exp_readunlock();
-        /* nlm and nfsd don't share error codes.
-         * we invent: 0 = no error
-         *            1 = stale file handle
-         *            2 = other error
+        /* We return nlm error codes as nlm doesn't know
+         * about nfsd, but nfsd does know about nlm..
          */
         switch (nfserr) {
         case nfs_ok:
                 return 0;
+        case nfserr_dropit:
+                return nlm_drop_reply;
+#ifdef CONFIG_LOCKD_V4
         case nfserr_stale:
-                return 1;
+                return nlm4_stale_fh;
+#endif
         default:
-                return 2;
+                return nlm_lck_denied;
         }
 }
 
diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c
index 9187755661df..e3eca0816986 100644
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -21,7 +21,7 @@
 /*
  * NULL call.
  */
-static int
+static __be32
 nfsacld_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return nfs_ok;
@@ -30,12 +30,12 @@ nfsacld_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 /*
  * Get the Access and/or Default ACL of a file.
  */
-static int nfsacld_proc_getacl(struct svc_rqst * rqstp,
+static __be32 nfsacld_proc_getacl(struct svc_rqst * rqstp,
                 struct nfsd3_getaclargs *argp, struct nfsd3_getaclres *resp)
 {
         svc_fh *fh;
         struct posix_acl *acl;
-        int nfserr = 0;
+        __be32 nfserr = 0;
 
         dprintk("nfsd: GETACL(2acl)   %s\n", SVCFH_fmt(&argp->fh));
 
@@ -97,12 +97,12 @@ fail:
 /*
  * Set the Access and/or Default ACL of a file.
  */
-static int nfsacld_proc_setacl(struct svc_rqst * rqstp,
+static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
                 struct nfsd3_setaclargs *argp,
                 struct nfsd_attrstat *resp)
 {
         svc_fh *fh;
-        int nfserr = 0;
+        __be32 nfserr = 0;
 
         dprintk("nfsd: SETACL(2acl)   %s\n", SVCFH_fmt(&argp->fh));
 
@@ -128,7 +128,7 @@ static int nfsacld_proc_setacl(struct svc_rqst * rqstp,
 /*
  * Check file attributes
  */
-static int nfsacld_proc_getattr(struct svc_rqst * rqstp,
+static __be32 nfsacld_proc_getattr(struct svc_rqst * rqstp,
                 struct nfsd_fhandle *argp, struct nfsd_attrstat *resp)
 {
         dprintk("nfsd: GETATTR  %s\n", SVCFH_fmt(&argp->fh));
@@ -140,10 +140,10 @@ static int nfsacld_proc_getattr(struct svc_rqst * rqstp,
 /*
  * Check file access
  */
-static int nfsacld_proc_access(struct svc_rqst *rqstp, struct nfsd3_accessargs *argp,
+static __be32 nfsacld_proc_access(struct svc_rqst *rqstp, struct nfsd3_accessargs *argp,
                 struct nfsd3_accessres *resp)
 {
-        int nfserr;
+        __be32 nfserr;
 
         dprintk("nfsd: ACCESS(2acl)   %s 0x%x\n",
                         SVCFH_fmt(&argp->fh),
@@ -158,7 +158,7 @@ static int nfsacld_proc_access(struct svc_rqst *rqstp, struct nfsd3_accessargs *
 /*
  * XDR decode functions
  */
-static int nfsaclsvc_decode_getaclargs(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_decode_getaclargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclargs *argp)
 {
         if (!(p = nfs2svc_decode_fh(p, &argp->fh)))
@@ -169,7 +169,7 @@ static int nfsaclsvc_decode_getaclargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 
-static int nfsaclsvc_decode_setaclargs(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_decode_setaclargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_setaclargs *argp)
 {
         struct kvec *head = rqstp->rq_arg.head;
@@ -194,7 +194,7 @@ static int nfsaclsvc_decode_setaclargs(struct svc_rqst *rqstp, u32 *p,
         return (n > 0);
 }
 
-static int nfsaclsvc_decode_fhandleargs(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_decode_fhandleargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd_fhandle *argp)
 {
         if (!(p = nfs2svc_decode_fh(p, &argp->fh)))
@@ -202,7 +202,7 @@ static int nfsaclsvc_decode_fhandleargs(struct svc_rqst *rqstp, u32 *p,
         return xdr_argsize_check(rqstp, p);
 }
 
-static int nfsaclsvc_decode_accessargs(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_decode_accessargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_accessargs *argp)
 {
         if (!(p = nfs2svc_decode_fh(p, &argp->fh)))
@@ -217,7 +217,7 @@ static int nfsaclsvc_decode_accessargs(struct svc_rqst *rqstp, u32 *p,
  */
 
 /* GETACL */
-static int nfsaclsvc_encode_getaclres(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_encode_getaclres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclres *resp)
 {
         struct dentry *dentry = resp->fh.fh_dentry;
@@ -259,7 +259,7 @@ static int nfsaclsvc_encode_getaclres(struct svc_rqst *rqstp, u32 *p,
         return 1;
 }
 
-static int nfsaclsvc_encode_attrstatres(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_encode_attrstatres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd_attrstat *resp)
 {
         p = nfs2svc_encode_fattr(rqstp, p, &resp->fh);
@@ -267,7 +267,7 @@ static int nfsaclsvc_encode_attrstatres(struct svc_rqst *rqstp, u32 *p,
 }
 
 /* ACCESS */
-static int nfsaclsvc_encode_accessres(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_encode_accessres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_accessres *resp)
 {
         p = nfs2svc_encode_fattr(rqstp, p, &resp->fh);
@@ -278,7 +278,7 @@ static int nfsaclsvc_encode_accessres(struct svc_rqst *rqstp, u32 *p,
 /*
  * XDR release functions
  */
-static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclres *resp)
 {
         fh_put(&resp->fh);
@@ -287,7 +287,7 @@ static int nfsaclsvc_release_getacl(struct svc_rqst *rqstp, u32 *p,
         return 1;
 }
 
-static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
+static int nfsaclsvc_release_fhandle(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd_fhandle *resp)
 {
         fh_put(&resp->fh);
diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c
index d4bdc00c1169..fcad2895ddb0 100644
--- a/fs/nfsd/nfs3acl.c
+++ b/fs/nfsd/nfs3acl.c
@@ -19,7 +19,7 @@
 /*
  * NULL call.
  */
-static int
+static __be32
 nfsd3_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return nfs_ok;
@@ -28,12 +28,12 @@ nfsd3_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 /*
  * Get the Access and/or Default ACL of a file.
  */
-static int nfsd3_proc_getacl(struct svc_rqst * rqstp,
+static __be32 nfsd3_proc_getacl(struct svc_rqst * rqstp,
                 struct nfsd3_getaclargs *argp, struct nfsd3_getaclres *resp)
 {
         svc_fh *fh;
         struct posix_acl *acl;
-        int nfserr = 0;
+        __be32 nfserr = 0;
 
         fh = fh_copy(&resp->fh, &argp->fh);
         if ((nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_NOP)))
@@ -93,12 +93,12 @@ fail:
 /*
  * Set the Access and/or Default ACL of a file.
  */
-static int nfsd3_proc_setacl(struct svc_rqst * rqstp,
+static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
                 struct nfsd3_setaclargs *argp,
                 struct nfsd3_attrstat *resp)
 {
         svc_fh *fh;
-        int nfserr = 0;
+        __be32 nfserr = 0;
 
         fh = fh_copy(&resp->fh, &argp->fh);
         nfserr = fh_verify(rqstp, &resp->fh, 0, MAY_SATTR);
@@ -122,7 +122,7 @@ static int nfsd3_proc_setacl(struct svc_rqst * rqstp,
 /*
  * XDR decode functions
  */
-static int nfs3svc_decode_getaclargs(struct svc_rqst *rqstp, u32 *p,
+static int nfs3svc_decode_getaclargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclargs *args)
 {
         if (!(p = nfs3svc_decode_fh(p, &args->fh)))
@@ -133,7 +133,7 @@ static int nfs3svc_decode_getaclargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 
-static int nfs3svc_decode_setaclargs(struct svc_rqst *rqstp, u32 *p,
+static int nfs3svc_decode_setaclargs(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_setaclargs *args)
 {
         struct kvec *head = rqstp->rq_arg.head;
@@ -163,7 +163,7 @@ static int nfs3svc_decode_setaclargs(struct svc_rqst *rqstp, u32 *p,
  */
 
 /* GETACL */
-static int nfs3svc_encode_getaclres(struct svc_rqst *rqstp, u32 *p,
+static int nfs3svc_encode_getaclres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclres *resp)
 {
         struct dentry *dentry = resp->fh.fh_dentry;
@@ -208,7 +208,7 @@ static int nfs3svc_encode_getaclres(struct svc_rqst *rqstp, u32 *p,
 }
 
 /* SETACL */
-static int nfs3svc_encode_setaclres(struct svc_rqst *rqstp, u32 *p,
+static int nfs3svc_encode_setaclres(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_attrstat *resp)
 {
         p = nfs3svc_encode_post_op_attr(rqstp, p, &resp->fh);
@@ -219,7 +219,7 @@ static int nfs3svc_encode_setaclres(struct svc_rqst *rqstp, u32 *p,
 /*
  * XDR release functions
  */
-static int nfs3svc_release_getacl(struct svc_rqst *rqstp, u32 *p,
+static int nfs3svc_release_getacl(struct svc_rqst *rqstp, __be32 *p,
                 struct nfsd3_getaclres *resp)
 {
         fh_put(&resp->fh);
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index a5ebc7dbb384..7f5bad0393b1 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -43,7 +43,7 @@ static int	nfs3_ftypes[] = {
 /*
  * NULL call.
  */
-static int
+static __be32
 nfsd3_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return nfs_ok;
@@ -52,11 +52,12 @@ nfsd3_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 /*
  * Get a file's attributes
  */
-static int
+static __be32
 nfsd3_proc_getattr(struct svc_rqst *rqstp, struct nfsd_fhandle  *argp,
                                            struct nfsd3_attrstat *resp)
 {
-        int     err, nfserr;
+        int     err;
+        __be32  nfserr;
 
         dprintk("nfsd: GETATTR(3)  %s\n",
                 SVCFH_fmt(&argp->fh));
@@ -76,11 +77,11 @@ nfsd3_proc_getattr(struct svc_rqst *rqstp, struct nfsd_fhandle  *argp,
 /*
  * Set a file's attributes
  */
-static int
+static __be32
 nfsd3_proc_setattr(struct svc_rqst *rqstp, struct nfsd3_sattrargs *argp,
                                            struct nfsd3_attrstat  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: SETATTR(3)  %s\n",
                                 SVCFH_fmt(&argp->fh));
@@ -94,11 +95,11 @@ nfsd3_proc_setattr(struct svc_rqst *rqstp, struct nfsd3_sattrargs *argp,
 /*
  * Look up a path name component
  */
-static int
+static __be32
 nfsd3_proc_lookup(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
                                           struct nfsd3_diropres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: LOOKUP(3)   %s %.*s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -118,11 +119,11 @@ nfsd3_proc_lookup(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
 /*
  * Check file access
  */
-static int
+static __be32
 nfsd3_proc_access(struct svc_rqst *rqstp, struct nfsd3_accessargs *argp,
                                           struct nfsd3_accessres *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: ACCESS(3)   %s 0x%x\n",
                                 SVCFH_fmt(&argp->fh),
@@ -137,11 +138,11 @@ nfsd3_proc_access(struct svc_rqst *rqstp, struct nfsd3_accessargs *argp,
 /*
  * Read a symlink.
  */
-static int
+static __be32
 nfsd3_proc_readlink(struct svc_rqst *rqstp, struct nfsd3_readlinkargs *argp,
                                            struct nfsd3_readlinkres *resp)
 {
-        int nfserr;
+        __be32 nfserr;
 
         dprintk("nfsd: READLINK(3) %s\n", SVCFH_fmt(&argp->fh));
 
@@ -155,11 +156,11 @@ nfsd3_proc_readlink(struct svc_rqst *rqstp, struct nfsd3_readlinkargs *argp,
 /*
  * Read a portion of a file.
  */
-static int
+static __be32
 nfsd3_proc_read(struct svc_rqst *rqstp, struct nfsd3_readargs *argp,
                                         struct nfsd3_readres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
         u32     max_blocksize = svc_max_payload(rqstp);
 
         dprintk("nfsd: READ(3) %s %lu bytes at %lu\n",
@@ -195,11 +196,11 @@ nfsd3_proc_read(struct svc_rqst *rqstp, struct nfsd3_readargs *argp,
 /*
  * Write data to a file
  */
-static int
+static __be32
 nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp,
                                          struct nfsd3_writeres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: WRITE(3)    %s %d bytes at %ld%s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -223,13 +224,13 @@ nfsd3_proc_write(struct svc_rqst *rqstp, struct nfsd3_writeargs *argp,
  * At least in theory; we'll see how it fares in practice when the
  * first reports about SunOS compatibility problems start to pour in...
  */
-static int
+static __be32
 nfsd3_proc_create(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
                                           struct nfsd3_diropres   *resp)
 {
         svc_fh          *dirfhp, *newfhp = NULL;
         struct iattr    *attr;
-        u32             nfserr;
+        __be32          nfserr;
 
         dprintk("nfsd: CREATE(3)   %s %.*s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -257,7 +258,7 @@ nfsd3_proc_create(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
         /* Now create the file and set attributes */
         nfserr = nfsd_create_v3(rqstp, dirfhp, argp->name, argp->len,
                                 attr, newfhp,
-                                argp->createmode, argp->verf, NULL);
+                                argp->createmode, argp->verf, NULL, NULL);
 
         RETURN_STATUS(nfserr);
 }
@@ -265,11 +266,11 @@ nfsd3_proc_create(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
 /*
  * Make directory. This operation is not idempotent.
  */
-static int
+static __be32
 nfsd3_proc_mkdir(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
                                          struct nfsd3_diropres   *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: MKDIR(3)    %s %.*s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -285,11 +286,11 @@ nfsd3_proc_mkdir(struct svc_rqst *rqstp, struct nfsd3_createargs *argp,
         RETURN_STATUS(nfserr);
 }
 
-static int
+static __be32
 nfsd3_proc_symlink(struct svc_rqst *rqstp, struct nfsd3_symlinkargs *argp,
                                            struct nfsd3_diropres    *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: SYMLINK(3)  %s %.*s -> %.*s\n",
                                 SVCFH_fmt(&argp->ffh),
@@ -307,11 +308,12 @@ nfsd3_proc_symlink(struct svc_rqst *rqstp, struct nfsd3_symlinkargs *argp,
 /*
  * Make socket/fifo/device.
  */
-static int
+static __be32
 nfsd3_proc_mknod(struct svc_rqst *rqstp, struct nfsd3_mknodargs *argp,
                                          struct nfsd3_diropres  *resp)
 {
-        int     nfserr, type;
+        __be32  nfserr;
+        int type;
         dev_t   rdev = 0;
 
         dprintk("nfsd: MKNOD(3)    %s %.*s\n",
@@ -343,11 +345,11 @@ nfsd3_proc_mknod(struct svc_rqst *rqstp, struct nfsd3_mknodargs *argp,
 /*
  * Remove file/fifo/socket etc.
  */
-static int
+static __be32
 nfsd3_proc_remove(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
                                           struct nfsd3_attrstat  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: REMOVE(3)   %s %.*s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -363,11 +365,11 @@ nfsd3_proc_remove(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
 /*
  * Remove a directory
  */
-static int
+static __be32
 nfsd3_proc_rmdir(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
                                          struct nfsd3_attrstat  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: RMDIR(3)    %s %.*s\n",
                                 SVCFH_fmt(&argp->fh),
@@ -379,11 +381,11 @@ nfsd3_proc_rmdir(struct svc_rqst *rqstp, struct nfsd3_diropargs *argp,
         RETURN_STATUS(nfserr);
 }
 
-static int
+static __be32
 nfsd3_proc_rename(struct svc_rqst *rqstp, struct nfsd3_renameargs *argp,
                                           struct nfsd3_renameres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: RENAME(3)   %s %.*s ->\n",
                                 SVCFH_fmt(&argp->ffh),
@@ -401,11 +403,11 @@ nfsd3_proc_rename(struct svc_rqst *rqstp, struct nfsd3_renameargs *argp,
         RETURN_STATUS(nfserr);
 }
 
-static int
+static __be32
 nfsd3_proc_link(struct svc_rqst *rqstp, struct nfsd3_linkargs *argp,
                                         struct nfsd3_linkres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: LINK(3)     %s ->\n",
                                 SVCFH_fmt(&argp->ffh));
@@ -424,11 +426,12 @@ nfsd3_proc_link(struct svc_rqst *rqstp, struct nfsd3_linkargs *argp,
 /*
  * Read a portion of a directory.
  */
-static int
+static __be32
 nfsd3_proc_readdir(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp,
                                            struct nfsd3_readdirres  *resp)
 {
-        int             nfserr, count;
+        __be32          nfserr;
+        int             count;
 
         dprintk("nfsd: READDIR(3)  %s %d bytes at %d\n",
                                 SVCFH_fmt(&argp->fh),
@@ -459,11 +462,12 @@ nfsd3_proc_readdir(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp,
  * Read a portion of a directory, including file handles and attrs.
  * For now, we choose to ignore the dircount parameter.
  */
-static int
+static __be32
 nfsd3_proc_readdirplus(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp,
                                                struct nfsd3_readdirres  *resp)
 {
-        int     nfserr, count = 0;
+        __be32  nfserr;
+        int     count = 0;
         loff_t  offset;
         int     i;
         caddr_t page_addr = NULL;
@@ -517,11 +521,11 @@ nfsd3_proc_readdirplus(struct svc_rqst *rqstp, struct nfsd3_readdirargs *argp,
 /*
  * Get file system stats
  */
-static int
+static __be32
 nfsd3_proc_fsstat(struct svc_rqst * rqstp, struct nfsd_fhandle    *argp,
                                            struct nfsd3_fsstatres *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: FSSTAT(3)   %s\n",
                                 SVCFH_fmt(&argp->fh));
@@ -534,11 +538,11 @@ nfsd3_proc_fsstat(struct svc_rqst * rqstp, struct nfsd_fhandle    *argp,
 /*
  * Get file system info
  */
-static int
+static __be32
 nfsd3_proc_fsinfo(struct svc_rqst * rqstp, struct nfsd_fhandle    *argp,
                                            struct nfsd3_fsinfores *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
         u32     max_blocksize = svc_max_payload(rqstp);
 
         dprintk("nfsd: FSINFO(3)   %s\n",
@@ -576,11 +580,11 @@ nfsd3_proc_fsinfo(struct svc_rqst * rqstp, struct nfsd_fhandle    *argp,
 /*
  * Get pathconf info for the specified file
  */
-static int
+static __be32
 nfsd3_proc_pathconf(struct svc_rqst * rqstp, struct nfsd_fhandle      *argp,
                                              struct nfsd3_pathconfres *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: PATHCONF(3) %s\n",
                                 SVCFH_fmt(&argp->fh));
@@ -619,11 +623,11 @@ nfsd3_proc_pathconf(struct svc_rqst * rqstp, struct nfsd_fhandle      *argp,
 /*
  * Commit a file (range) to stable storage.
  */
-static int
+static __be32
 nfsd3_proc_commit(struct svc_rqst * rqstp, struct nfsd3_commitargs *argp,
                                            struct nfsd3_commitres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: COMMIT(3)   %s %u@%Lu\n",
                                 SVCFH_fmt(&argp->fh),
diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
index 247d518248bf..b4baca3053c3 100644
--- a/fs/nfsd/nfs3xdr.c
+++ b/fs/nfsd/nfs3xdr.c
@@ -42,23 +42,23 @@ static u32	nfs3_ftypes[] = {
 /*
  * XDR functions for basic NFS types
  */
-static inline u32 *
-encode_time3(u32 *p, struct timespec *time)
+static inline __be32 *
+encode_time3(__be32 *p, struct timespec *time)
 {
         *p++ = htonl((u32) time->tv_sec); *p++ = htonl(time->tv_nsec);
         return p;
 }
 
-static inline u32 *
-decode_time3(u32 *p, struct timespec *time)
+static inline __be32 *
+decode_time3(__be32 *p, struct timespec *time)
 {
         time->tv_sec = ntohl(*p++);
         time->tv_nsec = ntohl(*p++);
         return p;
 }
 
-static inline u32 *
-decode_fh(u32 *p, struct svc_fh *fhp)
+static inline __be32 *
+decode_fh(__be32 *p, struct svc_fh *fhp)
 {
         unsigned int size;
         fh_init(fhp, NFS3_FHSIZE);
@@ -72,13 +72,13 @@ decode_fh(u32 *p, struct svc_fh *fhp)
 }
 
 /* Helper function for NFSv3 ACL code */
-u32 *nfs3svc_decode_fh(u32 *p, struct svc_fh *fhp)
+__be32 *nfs3svc_decode_fh(__be32 *p, struct svc_fh *fhp)
 {
         return decode_fh(p, fhp);
 }
 
-static inline u32 *
-encode_fh(u32 *p, struct svc_fh *fhp)
+static inline __be32 *
+encode_fh(__be32 *p, struct svc_fh *fhp)
 {
         unsigned int size = fhp->fh_handle.fh_size;
         *p++ = htonl(size);
@@ -91,8 +91,8 @@ encode_fh(u32 *p, struct svc_fh *fhp)
  * Decode a file name and make sure that the path contains
  * no slashes or null bytes.
  */
-static inline u32 *
-decode_filename(u32 *p, char **namp, int *lenp)
+static inline __be32 *
+decode_filename(__be32 *p, char **namp, int *lenp)
 {
         char            *name;
         int             i;
@@ -107,8 +107,8 @@ decode_filename(u32 *p, char **namp, int *lenp)
         return p;
 }
 
-static inline u32 *
-decode_sattr3(u32 *p, struct iattr *iap)
+static inline __be32 *
+decode_sattr3(__be32 *p, struct iattr *iap)
 {
         u32     tmp;
 
@@ -153,8 +153,8 @@ decode_sattr3(u32 *p, struct iattr *iap)
         return p;
 }
 
-static inline u32 *
-encode_fattr3(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp,
+static inline __be32 *
+encode_fattr3(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp,
               struct kstat *stat)
 {
         struct dentry   *dentry = fhp->fh_dentry;
@@ -186,8 +186,8 @@ encode_fattr3(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp,
         return p;
 }
 
-static inline u32 *
-encode_saved_post_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
+static inline __be32 *
+encode_saved_post_attr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct inode    *inode = fhp->fh_dentry->d_inode;
 
@@ -224,8 +224,8 @@ encode_saved_post_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
  * The inode may be NULL if the call failed because of a stale file
  * handle. In this case, no attributes are returned.
  */
-static u32 *
-encode_post_op_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
+static __be32 *
+encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct dentry *dentry = fhp->fh_dentry;
         if (dentry && dentry->d_inode != NULL) {
@@ -243,8 +243,8 @@ encode_post_op_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
 }
 
 /* Helper for NFSv3 ACLs */
-u32 *
-nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
+__be32 *
+nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         return encode_post_op_attr(rqstp, p, fhp);
 }
@@ -252,8 +252,8 @@ nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
 /*
  * Enocde weak cache consistency data
  */
-static u32 *
-encode_wcc_data(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
+static __be32 *
+encode_wcc_data(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct dentry   *dentry = fhp->fh_dentry;
 
@@ -278,7 +278,7 @@ encode_wcc_data(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
  * XDR decode functions
  */
 int
-nfs3svc_decode_fhandle(struct svc_rqst *rqstp, u32 *p, struct nfsd_fhandle *args)
+nfs3svc_decode_fhandle(struct svc_rqst *rqstp, __be32 *p, struct nfsd_fhandle *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
                 return 0;
@@ -286,7 +286,7 @@ nfs3svc_decode_fhandle(struct svc_rqst *rqstp, u32 *p, struct nfsd_fhandle *args
 }
 
 int
-nfs3svc_decode_sattrargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_sattrargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -303,7 +303,7 @@ nfs3svc_decode_sattrargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_diropargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_diropargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_diropargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -314,7 +314,7 @@ nfs3svc_decode_diropargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_accessargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_accessargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_accessargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
@@ -325,7 +325,7 @@ nfs3svc_decode_accessargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readargs *args)
 {
         unsigned int len;
@@ -355,7 +355,7 @@ nfs3svc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_writeargs *args)
 {
         unsigned int len, v, hdr;
@@ -393,7 +393,7 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_createargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_createargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_createargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -417,7 +417,7 @@ nfs3svc_decode_createargs(struct svc_rqst *rqstp, u32 *p,
         return xdr_argsize_check(rqstp, p);
 }
 int
-nfs3svc_decode_mkdirargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_mkdirargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_createargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -429,7 +429,7 @@ nfs3svc_decode_mkdirargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_symlinkargs *args)
 {
         unsigned int len;
@@ -481,7 +481,7 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_mknodargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_mknodargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_mknodargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -505,7 +505,7 @@ nfs3svc_decode_mknodargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_renameargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_renameargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_renameargs *args)
 {
         if (!(p = decode_fh(p, &args->ffh))
@@ -518,7 +518,7 @@ nfs3svc_decode_renameargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readlinkargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
@@ -530,7 +530,7 @@ nfs3svc_decode_readlinkargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_linkargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_linkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_linkargs *args)
 {
         if (!(p = decode_fh(p, &args->ffh))
@@ -542,7 +542,7 @@ nfs3svc_decode_linkargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readdirargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
@@ -562,7 +562,7 @@ nfs3svc_decode_readdirargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readdirargs *args)
 {
         int len, pn;
@@ -590,7 +590,7 @@ nfs3svc_decode_readdirplusargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_decode_commitargs(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_decode_commitargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_commitargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
@@ -609,14 +609,14 @@ nfs3svc_decode_commitargs(struct svc_rqst *rqstp, u32 *p,
  * will work properly.
  */
 int
-nfs3svc_encode_voidres(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nfs3svc_encode_voidres(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
 
 /* GETATTR */
 int
-nfs3svc_encode_attrstat(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_attrstat(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_attrstat *resp)
 {
         if (resp->status == 0)
@@ -626,7 +626,7 @@ nfs3svc_encode_attrstat(struct svc_rqst *rqstp, u32 *p,
 
 /* SETATTR, REMOVE, RMDIR */
 int
-nfs3svc_encode_wccstat(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_wccstat(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_attrstat *resp)
 {
         p = encode_wcc_data(rqstp, p, &resp->fh);
@@ -635,7 +635,7 @@ nfs3svc_encode_wccstat(struct svc_rqst *rqstp, u32 *p,
 
 /* LOOKUP */
 int
-nfs3svc_encode_diropres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_diropres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_diropres *resp)
 {
         if (resp->status == 0) {
@@ -648,7 +648,7 @@ nfs3svc_encode_diropres(struct svc_rqst *rqstp, u32 *p,
 
 /* ACCESS */
 int
-nfs3svc_encode_accessres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_accessres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_accessres *resp)
 {
         p = encode_post_op_attr(rqstp, p, &resp->fh);
@@ -659,7 +659,7 @@ nfs3svc_encode_accessres(struct svc_rqst *rqstp, u32 *p,
 
 /* READLINK */
 int
-nfs3svc_encode_readlinkres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_readlinkres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readlinkres *resp)
 {
         p = encode_post_op_attr(rqstp, p, &resp->fh);
@@ -680,7 +680,7 @@ nfs3svc_encode_readlinkres(struct svc_rqst *rqstp, u32 *p,
 
 /* READ */
 int
-nfs3svc_encode_readres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_readres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readres *resp)
 {
         p = encode_post_op_attr(rqstp, p, &resp->fh);
@@ -704,7 +704,7 @@ nfs3svc_encode_readres(struct svc_rqst *rqstp, u32 *p,
 
 /* WRITE */
 int
-nfs3svc_encode_writeres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_writeres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_writeres *resp)
 {
         p = encode_wcc_data(rqstp, p, &resp->fh);
@@ -719,7 +719,7 @@ nfs3svc_encode_writeres(struct svc_rqst *rqstp, u32 *p,
 
 /* CREATE, MKDIR, SYMLINK, MKNOD */
 int
-nfs3svc_encode_createres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_createres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_diropres *resp)
 {
         if (resp->status == 0) {
@@ -733,7 +733,7 @@ nfs3svc_encode_createres(struct svc_rqst *rqstp, u32 *p,
 
 /* RENAME */
 int
-nfs3svc_encode_renameres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_renameres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_renameres *resp)
 {
         p = encode_wcc_data(rqstp, p, &resp->ffh);
@@ -743,7 +743,7 @@ nfs3svc_encode_renameres(struct svc_rqst *rqstp, u32 *p,
 
 /* LINK */
 int
-nfs3svc_encode_linkres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_linkres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_linkres *resp)
 {
         p = encode_post_op_attr(rqstp, p, &resp->fh);
@@ -753,7 +753,7 @@ nfs3svc_encode_linkres(struct svc_rqst *rqstp, u32 *p,
 
 /* READDIR */
 int
-nfs3svc_encode_readdirres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_readdirres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_readdirres *resp)
 {
         p = encode_post_op_attr(rqstp, p, &resp->fh);
@@ -776,8 +776,8 @@ nfs3svc_encode_readdirres(struct svc_rqst *rqstp, u32 *p,
                 return xdr_ressize_check(rqstp, p);
 }
 
-static inline u32 *
-encode_entry_baggage(struct nfsd3_readdirres *cd, u32 *p, const char *name,
+static inline __be32 *
+encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
              int namlen, ino_t ino)
 {
         *p++ = xdr_one;                          /* mark entry present */
@@ -790,8 +790,8 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, u32 *p, const char *name,
         return p;
 }
 
-static inline u32 *
-encode_entryplus_baggage(struct nfsd3_readdirres *cd, u32 *p,
+static inline __be32 *
+encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p,
                 struct svc_fh *fhp)
 {
                 p = encode_post_op_attr(cd->rqstp, p, fhp);
@@ -853,7 +853,7 @@ encode_entry(struct readdir_cd *ccd, const char *name,
 {
         struct nfsd3_readdirres *cd = container_of(ccd, struct nfsd3_readdirres,
                                                         common);
-        u32             *p = cd->buffer;
+        __be32          *p = cd->buffer;
         caddr_t         curr_page_addr = NULL;
         int             pn;             /* current page number */
         int             slen;           /* string (name) length */
@@ -919,7 +919,7 @@ encode_entry(struct readdir_cd *ccd, const char *name,
         } else if (cd->rqstp->rq_respages[pn+1] != NULL) {
                 /* temporarily encode entry into next page, then move back to
                  * current and next page in rq_respages[] */
-                u32 *p1, *tmp;
+                __be32 *p1, *tmp;
                 int len1, len2;
 
                 /* grab next page for temporary storage of entry */
@@ -1009,7 +1009,7 @@ nfs3svc_encode_entry_plus(struct readdir_cd *cd, const char *name,
 
 /* FSSTAT */
 int
-nfs3svc_encode_fsstatres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_fsstatres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_fsstatres *resp)
 {
         struct kstatfs  *s = &resp->stats;
@@ -1031,7 +1031,7 @@ nfs3svc_encode_fsstatres(struct svc_rqst *rqstp, u32 *p,
 
 /* FSINFO */
 int
-nfs3svc_encode_fsinfores(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_fsinfores(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_fsinfores *resp)
 {
         *p++ = xdr_zero;        /* no post_op_attr */
@@ -1055,7 +1055,7 @@ nfs3svc_encode_fsinfores(struct svc_rqst *rqstp, u32 *p,
 
 /* PATHCONF */
 int
-nfs3svc_encode_pathconfres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_pathconfres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_pathconfres *resp)
 {
         *p++ = xdr_zero;        /* no post_op_attr */
@@ -1074,7 +1074,7 @@ nfs3svc_encode_pathconfres(struct svc_rqst *rqstp, u32 *p,
 
 /* COMMIT */
 int
-nfs3svc_encode_commitres(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_encode_commitres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_commitres *resp)
 {
         p = encode_wcc_data(rqstp, p, &resp->fh);
@@ -1090,7 +1090,7 @@ nfs3svc_encode_commitres(struct svc_rqst *rqstp, u32 *p,
  * XDR release functions
  */
 int
-nfs3svc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_release_fhandle(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_attrstat *resp)
 {
         fh_put(&resp->fh);
@@ -1098,7 +1098,7 @@ nfs3svc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfs3svc_release_fhandle2(struct svc_rqst *rqstp, u32 *p,
+nfs3svc_release_fhandle2(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd3_fhandle_pair *resp)
 {
         fh_put(&resp->fh1);
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index f6ca9fb3fc63..f57655a7a2b6 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -85,8 +85,8 @@ enum nfs_cb_opnum4 {
 /*
 * Generic encode routines from fs/nfs/nfs4xdr.c
 */
-static inline u32 *
-xdr_writemem(u32 *p, const void *ptr, int nbytes)
+static inline __be32 *
+xdr_writemem(__be32 *p, const void *ptr, int nbytes)
 {
         int tmp = XDR_QUADLEN(nbytes);
         if (!tmp)
@@ -205,7 +205,7 @@ nfs_cb_stat_to_errno(int stat)
 static int
 encode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr)
 {
-        u32 * p;
+        __be32 * p;
 
         RESERVE_SPACE(16);
         WRITE32(0);            /* tag length is always 0 */
@@ -218,7 +218,7 @@ encode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr)
 static int
 encode_cb_recall(struct xdr_stream *xdr, struct nfs4_cb_recall *cb_rec)
 {
-        u32 *p;
+        __be32 *p;
         int len = cb_rec->cbr_fhlen;
 
         RESERVE_SPACE(12+sizeof(cb_rec->cbr_stateid) + len);
@@ -231,7 +231,7 @@ encode_cb_recall(struct xdr_stream *xdr, struct nfs4_cb_recall *cb_rec)
 }
 
 static int
-nfs4_xdr_enc_cb_null(struct rpc_rqst *req, u32 *p)
+nfs4_xdr_enc_cb_null(struct rpc_rqst *req, __be32 *p)
 {
         struct xdr_stream xdrs, *xdr = &xdrs;
 
@@ -241,7 +241,7 @@ nfs4_xdr_enc_cb_null(struct rpc_rqst *req, u32 *p)
 }
 
 static int
-nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, u32 *p, struct nfs4_cb_recall *args)
+nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, __be32 *p, struct nfs4_cb_recall *args)
 {
         struct xdr_stream xdr;
         struct nfs4_cb_compound_hdr hdr = {
@@ -257,7 +257,7 @@ nfs4_xdr_enc_cb_recall(struct rpc_rqst *req, u32 *p, struct nfs4_cb_recall *args
 
 static int
 decode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr){
-        u32 *p;
+        __be32 *p;
 
         READ_BUF(8);
         READ32(hdr->status);
@@ -272,7 +272,7 @@ decode_cb_compound_hdr(struct xdr_stream *xdr, struct nfs4_cb_compound_hdr *hdr)
 static int
 decode_cb_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
 {
-        u32 *p;
+        __be32 *p;
         u32 op;
         int32_t nfserr;
 
@@ -291,13 +291,13 @@ decode_cb_op_hdr(struct xdr_stream *xdr, enum nfs_opnum4 expected)
 }
 
 static int
-nfs4_xdr_dec_cb_null(struct rpc_rqst *req, u32 *p)
+nfs4_xdr_dec_cb_null(struct rpc_rqst *req, __be32 *p)
 {
         return 0;
 }
 
 static int
-nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp, u32 *p)
+nfs4_xdr_dec_cb_recall(struct rpc_rqst *rqstp, __be32 *p)
 {
         struct xdr_stream xdr;
         struct nfs4_cb_compound_hdr hdr;
@@ -421,7 +421,7 @@ nfsd4_probe_callback(struct nfs4_client *clp)
 
         /* Create RPC client */
         cb->cb_client = rpc_create(&args);
-        if (!cb->cb_client) {
+        if (IS_ERR(cb->cb_client)) {
                 dprintk("NFSD: couldn't create callback client\n");
                 goto out_err;
         }
@@ -448,10 +448,10 @@ nfsd4_probe_callback(struct nfs4_client *clp)
 out_rpciod:
         atomic_dec(&clp->cl_count);
         rpciod_down();
-        cb->cb_client = NULL;
 out_clnt:
         rpc_shutdown_client(cb->cb_client);
 out_err:
+        cb->cb_client = NULL;
         dprintk("NFSD: warning: no callback path to client %.*s\n",
                 (int)clp->cl_name.len, clp->cl_name.data);
 }
@@ -461,7 +461,7 @@ nfs4_cb_null(struct rpc_task *task, void *dummy)
 {
         struct nfs4_client *clp = (struct nfs4_client *)task->tk_msg.rpc_argp;
         struct nfs4_callback *cb = &clp->cl_callback;
-        u32 addr = htonl(cb->cb_addr);
+        __be32 addr = htonl(cb->cb_addr);
 
         dprintk("NFSD: nfs4_cb_null task->tk_status %d\n", task->tk_status);
 
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 8333db12caca..50bc94243ca1 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -67,32 +67,33 @@ fh_dup2(struct svc_fh *dst, struct svc_fh *src)
         *dst = *src;
 }
 
-static int
-do_open_permission(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
+static __be32
+do_open_permission(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open, int accmode)
 {
-        int accmode, status;
+        __be32 status;
 
         if (open->op_truncate &&
                 !(open->op_share_access & NFS4_SHARE_ACCESS_WRITE))
                 return nfserr_inval;
 
-        accmode = MAY_NOP;
         if (open->op_share_access & NFS4_SHARE_ACCESS_READ)
-                accmode = MAY_READ;
-        if (open->op_share_deny & NFS4_SHARE_ACCESS_WRITE)
+                accmode |= MAY_READ;
+        if (open->op_share_access & NFS4_SHARE_ACCESS_WRITE)
                 accmode |= (MAY_WRITE | MAY_TRUNC);
-        accmode |= MAY_OWNER_OVERRIDE;
+        if (open->op_share_deny & NFS4_SHARE_DENY_WRITE)
+                accmode |= MAY_WRITE;
 
         status = fh_verify(rqstp, current_fh, S_IFREG, accmode);
 
         return status;
 }
 
-static int
+static __be32
 do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
 {
         struct svc_fh resfh;
-        int status;
+        __be32 status;
+        int created = 0;
 
         fh_init(&resfh, NFS4_FHSIZE);
         open->op_truncate = 0;
@@ -105,36 +106,35 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
                 status = nfsd_create_v3(rqstp, current_fh, open->op_fname.data,
                                         open->op_fname.len, &open->op_iattr,
                                         &resfh, open->op_createmode,
-                                        (u32 *)open->op_verf.data, &open->op_truncate);
-        }
-        else {
+                                        (u32 *)open->op_verf.data, &open->op_truncate, &created);
+        } else {
                 status = nfsd_lookup(rqstp, current_fh,
                                      open->op_fname.data, open->op_fname.len, &resfh);
                 fh_unlock(current_fh);
         }
+        if (status)
+                goto out;
 
-        if (!status) {
-                set_change_info(&open->op_cinfo, current_fh);
+        set_change_info(&open->op_cinfo, current_fh);
 
-                /* set reply cache */
-                fh_dup2(current_fh, &resfh);
-                open->op_stateowner->so_replay.rp_openfh_len =
-                        resfh.fh_handle.fh_size;
-                memcpy(open->op_stateowner->so_replay.rp_openfh,
-                                &resfh.fh_handle.fh_base,
-                                resfh.fh_handle.fh_size);
+        /* set reply cache */
+        fh_dup2(current_fh, &resfh);
+        open->op_stateowner->so_replay.rp_openfh_len = resfh.fh_handle.fh_size;
+        memcpy(open->op_stateowner->so_replay.rp_openfh,
+                        &resfh.fh_handle.fh_base, resfh.fh_handle.fh_size);
 
-                status = do_open_permission(rqstp, current_fh, open);
-        }
+        if (!created)
+                status = do_open_permission(rqstp, current_fh, open, MAY_NOP);
 
+out:
         fh_put(&resfh);
         return status;
 }
 
-static int
+static __be32
 do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
 {
-        int status;
+        __be32 status;
 
         /* Only reclaims from previously confirmed clients are valid */
         if ((status = nfs4_check_open_reclaim(&open->op_clientid)))
@@ -155,16 +155,16 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
         open->op_truncate = (open->op_iattr.ia_valid & ATTR_SIZE) &&
                 (open->op_iattr.ia_size == 0);
 
-        status = do_open_permission(rqstp, current_fh, open);
+        status = do_open_permission(rqstp, current_fh, open, MAY_OWNER_OVERRIDE);
 
         return status;
 }
 
 
-static inline int
+static inline __be32
 nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open, struct nfs4_stateowner **replay_owner)
 {
-        int status;
+        __be32 status;
         dprintk("NFSD: nfsd4_open filename %.*s op_stateowner %p\n",
                 (int)open->op_fname.len, open->op_fname.data,
                 open->op_stateowner);
@@ -177,7 +177,7 @@ nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open
 
         /* check seqid for replay. set nfs4_owner */
         status = nfsd4_process_open1(open);
-        if (status == NFSERR_REPLAY_ME) {
+        if (status == nfserr_replay_me) {
                 struct nfs4_replay *rp = &open->op_stateowner->so_replay;
                 fh_put(current_fh);
                 current_fh->fh_handle.fh_size = rp->rp_openfh_len;
@@ -188,7 +188,7 @@ nfsd4_open(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open
                         dprintk("nfsd4_open: replay failed"
                                 " restoring previous filehandle\n");
                 else
-                        status = NFSERR_REPLAY_ME;
+                        status = nfserr_replay_me;
         }
         if (status)
                 goto out;
@@ -261,7 +261,7 @@ out:
 /*
  * filehandle-manipulating ops.
  */
-static inline int
+static inline __be32
 nfsd4_getfh(struct svc_fh *current_fh, struct svc_fh **getfh)
 {
         if (!current_fh->fh_dentry)
@@ -271,7 +271,7 @@ nfsd4_getfh(struct svc_fh *current_fh, struct svc_fh **getfh)
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfsd4_putfh(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_putfh *putfh)
 {
         fh_put(current_fh);
@@ -280,10 +280,10 @@ nfsd4_putfh(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_putf
         return fh_verify(rqstp, current_fh, 0, MAY_NOP);
 }
 
-static inline int
+static inline __be32
 nfsd4_putrootfh(struct svc_rqst *rqstp, struct svc_fh *current_fh)
 {
-        int status;
+        __be32 status;
 
         fh_put(current_fh);
         status = exp_pseudoroot(rqstp->rq_client, current_fh,
@@ -291,7 +291,7 @@ nfsd4_putrootfh(struct svc_rqst *rqstp, struct svc_fh *current_fh)
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_restorefh(struct svc_fh *current_fh, struct svc_fh *save_fh)
 {
         if (!save_fh->fh_dentry)
@@ -301,7 +301,7 @@ nfsd4_restorefh(struct svc_fh *current_fh, struct svc_fh *save_fh)
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfsd4_savefh(struct svc_fh *current_fh, struct svc_fh *save_fh)
 {
         if (!current_fh->fh_dentry)
@@ -314,7 +314,7 @@ nfsd4_savefh(struct svc_fh *current_fh, struct svc_fh *save_fh)
 /*
  * misc nfsv4 ops
  */
-static inline int
+static inline __be32
 nfsd4_access(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_access *access)
 {
         if (access->ac_req_access & ~NFS3_ACCESS_FULL)
@@ -324,10 +324,10 @@ nfsd4_access(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_acc
         return nfsd_access(rqstp, current_fh, &access->ac_resp_access, &access->ac_supported);
 }
 
-static inline int
+static inline __be32
 nfsd4_commit(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_commit *commit)
 {
-        int status;
+        __be32 status;
 
         u32 *p = (u32 *)commit->co_verf.data;
         *p++ = nfssvc_boot.tv_sec;
@@ -339,11 +339,11 @@ nfsd4_commit(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_com
         return status;
 }
 
-static int
+static __be32
 nfsd4_create(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_create *create)
 {
         struct svc_fh resfh;
-        int status;
+        __be32 status;
         dev_t rdev;
 
         fh_init(&resfh, NFS4_FHSIZE);
@@ -423,10 +423,10 @@ nfsd4_create(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_cre
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_getattr(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_getattr *getattr)
 {
-        int status;
+        __be32 status;
 
         status = fh_verify(rqstp, current_fh, 0, MAY_NOP);
         if (status)
@@ -442,11 +442,11 @@ nfsd4_getattr(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_ge
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfsd4_link(struct svc_rqst *rqstp, struct svc_fh *current_fh,
            struct svc_fh *save_fh, struct nfsd4_link *link)
 {
-        int status = nfserr_nofilehandle;
+        __be32 status = nfserr_nofilehandle;
 
         if (!save_fh->fh_dentry)
                 return status;
@@ -456,11 +456,11 @@ nfsd4_link(struct svc_rqst *rqstp, struct svc_fh *current_fh,
         return status;
 }
 
-static int
+static __be32
 nfsd4_lookupp(struct svc_rqst *rqstp, struct svc_fh *current_fh)
 {
         struct svc_fh tmp_fh;
-        int ret;
+        __be32 ret;
 
         fh_init(&tmp_fh, NFS4_FHSIZE);
         if((ret = exp_pseudoroot(rqstp->rq_client, &tmp_fh,
@@ -474,16 +474,16 @@ nfsd4_lookupp(struct svc_rqst *rqstp, struct svc_fh *current_fh)
         return nfsd_lookup(rqstp, current_fh, "..", 2, current_fh);
 }
 
-static inline int
+static inline __be32
 nfsd4_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lookup *lookup)
 {
         return nfsd_lookup(rqstp, current_fh, lookup->lo_name, lookup->lo_len, current_fh);
 }
 
-static inline int
+static inline __be32
 nfsd4_read(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_read *read)
 {
-        int status;
+        __be32 status;
 
         /* no need to check permission - this will be done in nfsd_read() */
 
@@ -508,7 +508,7 @@ out:
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_readdir(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_readdir *readdir)
 {
         u64 cookie = readdir->rd_cookie;
@@ -531,7 +531,7 @@ nfsd4_readdir(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_re
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfsd4_readlink(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_readlink *readlink)
 {
         readlink->rl_rqstp = rqstp;
@@ -539,10 +539,10 @@ nfsd4_readlink(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_r
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfsd4_remove(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_remove *remove)
 {
-        int status;
+        __be32 status;
 
         if (nfs4_in_grace())
                 return nfserr_grace;
@@ -556,11 +556,11 @@ nfsd4_remove(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_rem
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_rename(struct svc_rqst *rqstp, struct svc_fh *current_fh,
              struct svc_fh *save_fh, struct nfsd4_rename *rename)
 {
-        int status = nfserr_nofilehandle;
+        __be32 status = nfserr_nofilehandle;
 
         if (!save_fh->fh_dentry)
                 return status;
@@ -589,10 +589,10 @@ nfsd4_rename(struct svc_rqst *rqstp, struct svc_fh *current_fh,
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_setattr(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_setattr *setattr)
 {
-        int status = nfs_ok;
+        __be32 status = nfs_ok;
 
         if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
                 nfs4_lock_state();
@@ -614,13 +614,13 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_se
         return status;
 }
 
-static inline int
+static inline __be32
 nfsd4_write(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_write *write)
 {
         stateid_t *stateid = &write->wr_stateid;
         struct file *filp = NULL;
         u32 *p;
-        int status = nfs_ok;
+        __be32 status = nfs_ok;
 
         /* no need to check permission - this will be done in nfsd_write() */
 
@@ -661,12 +661,12 @@ nfsd4_write(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_writ
  * attributes matched.  VERIFY is implemented by mapping NFSERR_SAME
  * to NFS_OK after the call; NVERIFY by mapping NFSERR_NOT_SAME to NFS_OK.
  */
-static int
+static __be32
 nfsd4_verify(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_verify *verify)
 {
-        u32 *buf, *p;
+        __be32 *buf, *p;
         int count;
-        int status;
+        __be32 status;
 
         status = fh_verify(rqstp, current_fh, 0, MAY_NOP);
         if (status)
@@ -715,7 +715,7 @@ out_kfree:
 /*
  * NULL call.
  */
-static int
+static __be32
 nfsd4_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return nfs_ok;
@@ -731,7 +731,7 @@ static inline void nfsd4_increment_op_stats(u32 opnum)
 /*
  * COMPOUND call.
  */
-static int
+static __be32
 nfsd4_proc_compound(struct svc_rqst *rqstp,
                     struct nfsd4_compoundargs *args,
                     struct nfsd4_compoundres *resp)
@@ -741,7 +741,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
         struct svc_fh   *save_fh = NULL;
         struct nfs4_stateowner *replay_owner = NULL;
         int             slack_space;    /* in words, not bytes! */
-        int             status;
+        __be32          status;
 
         status = nfserr_resource;
         current_fh = kmalloc(sizeof(*current_fh), GFP_KERNEL);
@@ -937,7 +937,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
                 }
 
 encode_op:
-                if (op->status == NFSERR_REPLAY_ME) {
+                if (op->status == nfserr_replay_me) {
                         op->replay = &replay_owner->so_replay;
                         nfsd4_encode_replay(resp, op);
                         status = op->status = op->replay->rp_status;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 1cbd2e4ee122..81b8565d3837 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -83,13 +83,13 @@ md5_to_hex(char *out, char *md5)
         *out = '\0';
 }
 
-int
+__be32
 nfs4_make_rec_clidname(char *dname, struct xdr_netobj *clname)
 {
         struct xdr_netobj cksum;
         struct hash_desc desc;
         struct scatterlist sg[1];
-        int status = nfserr_resource;
+        __be32 status = nfserr_resource;
 
         dprintk("NFSD: nfs4_make_rec_clidname for %.*s\n",
                         clname->len, clname->data);
@@ -193,7 +193,7 @@ nfsd4_build_dentrylist(void *arg, const char *name, int namlen,
         struct dentry_list *child;
 
         if (name && isdotent(name, namlen))
-                return nfs_ok;
+                return 0;
         dentry = lookup_one_len(name, parent, namlen);
         if (IS_ERR(dentry))
                 return PTR_ERR(dentry);
@@ -274,7 +274,7 @@ nfsd4_clear_clid_dir(struct dentry *dir, struct dentry *dentry)
          * any regular files anyway, just in case the directory was created by
          * a kernel from the future.... */
         nfsd4_list_rec_dir(dentry, nfsd4_remove_clid_file);
-        mutex_lock(&dir->d_inode->i_mutex);
+        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
         status = vfs_rmdir(dir->d_inode, dentry);
         mutex_unlock(&dir->d_inode->i_mutex);
         return status;
@@ -333,14 +333,14 @@ purge_old(struct dentry *parent, struct dentry *child)
         int status;
 
         if (nfs4_has_reclaimed_state(child->d_name.name))
-                return nfs_ok;
+                return 0;
 
         status = nfsd4_clear_clid_dir(parent, child);
         if (status)
                 printk("failed to remove client recovery directory %s\n",
                                 child->d_name.name);
         /* Keep trying, success or failure: */
-        return nfs_ok;
+        return 0;
 }
 
 void
@@ -365,10 +365,10 @@ load_recdir(struct dentry *parent, struct dentry *child)
                 printk("nfsd4: illegal name %s in recovery directory\n",
                                 child->d_name.name);
                 /* Keep trying; maybe the others are OK: */
-                return nfs_ok;
+                return 0;
         }
         nfs4_client_to_reclaim(child->d_name.name);
-        return nfs_ok;
+        return 0;
 }
 
 int
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index ebcf226a9e4a..293b6495829f 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -710,10 +710,10 @@ out_err:
  *              as described above.
  *
  */
-int
+__be32
 nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_setclientid *setclid)
 {
-        u32                     ip_addr = rqstp->rq_addr.sin_addr.s_addr;
+        __be32                  ip_addr = rqstp->rq_addr.sin_addr.s_addr;
         struct xdr_netobj       clname = { 
                 .len = setclid->se_namelen,
                 .data = setclid->se_name,
@@ -721,7 +721,7 @@ nfsd4_setclientid(struct svc_rqst *rqstp, struct nfsd4_setclientid *setclid)
         nfs4_verifier           clverifier = setclid->se_verf;
         unsigned int            strhashval;
         struct nfs4_client      *conf, *unconf, *new;
-        int                     status;
+        __be32                  status;
         char                    dname[HEXDIR_LEN];
         
         if (!check_name(clname))
@@ -875,14 +875,14 @@ out:
  *
  * NOTE: callback information will be processed here in a future patch
  */
-int
+__be32
 nfsd4_setclientid_confirm(struct svc_rqst *rqstp, struct nfsd4_setclientid_confirm *setclientid_confirm)
 {
-        u32 ip_addr = rqstp->rq_addr.sin_addr.s_addr;
+        __be32 ip_addr = rqstp->rq_addr.sin_addr.s_addr;
         struct nfs4_client *conf, *unconf;
         nfs4_verifier confirm = setclientid_confirm->sc_confirm; 
         clientid_t * clid = &setclientid_confirm->sc_clientid;
-        int status;
+        __be32 status;
 
         if (STALE_CLIENTID(clid))
                 return nfserr_stale_clientid;
@@ -1280,13 +1280,13 @@ test_share(struct nfs4_stateid *stp, struct nfsd4_open *open) {
  * Called to check deny when READ with all zero stateid or
  * WRITE with all zero or all one stateid
  */
-static int
+static __be32
 nfs4_share_conflict(struct svc_fh *current_fh, unsigned int deny_type)
 {
         struct inode *ino = current_fh->fh_dentry->d_inode;
         struct nfs4_file *fp;
         struct nfs4_stateid *stp;
-        int ret;
+        __be32 ret;
 
         dprintk("NFSD: nfs4_share_conflict\n");
 
@@ -1444,7 +1444,7 @@ static struct lock_manager_operations nfsd_lease_mng_ops = {
 };
 
 
-int
+__be32
 nfsd4_process_open1(struct nfsd4_open *open)
 {
         clientid_t *clientid = &open->op_clientid;
@@ -1477,7 +1477,7 @@ nfsd4_process_open1(struct nfsd4_open *open)
         }
         if (open->op_seqid == sop->so_seqid - 1) {
                 if (sop->so_replay.rp_buflen)
-                        return NFSERR_REPLAY_ME;
+                        return nfserr_replay_me;
                 /* The original OPEN failed so spectacularly
                  * that we don't even have replay data saved!
                  * Therefore, we have no choice but to continue
@@ -1501,7 +1501,7 @@ renew:
         return nfs_ok;
 }
 
-static inline int
+static inline __be32
 nfs4_check_delegmode(struct nfs4_delegation *dp, int flags)
 {
         if ((flags & WR_STATE) && (dp->dl_type == NFS4_OPEN_DELEGATE_READ))
@@ -1522,12 +1522,12 @@ find_delegation_file(struct nfs4_file *fp, stateid_t *stid)
         return NULL;
 }
 
-static int
+static __be32
 nfs4_check_deleg(struct nfs4_file *fp, struct nfsd4_open *open,
                 struct nfs4_delegation **dp)
 {
         int flags;
-        int status = nfserr_bad_stateid;
+        __be32 status = nfserr_bad_stateid;
 
         *dp = find_delegation_file(fp, &open->op_delegate_stateid);
         if (*dp == NULL)
@@ -1546,11 +1546,11 @@ out:
         return nfs_ok;
 }
 
-static int
+static __be32
 nfs4_check_open(struct nfs4_file *fp, struct nfsd4_open *open, struct nfs4_stateid **stpp)
 {
         struct nfs4_stateid *local;
-        int status = nfserr_share_denied;
+        __be32 status = nfserr_share_denied;
         struct nfs4_stateowner *sop = open->op_stateowner;
 
         list_for_each_entry(local, &fp->fi_stateids, st_perfile) {
@@ -1575,7 +1575,7 @@ nfs4_alloc_stateid(void)
         return kmem_cache_alloc(stateid_slab, GFP_KERNEL);
 }
 
-static int
+static __be32
 nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
                 struct nfs4_delegation *dp,
                 struct svc_fh *cur_fh, int flags)
@@ -1590,7 +1590,7 @@ nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
                 get_file(dp->dl_vfs_file);
                 stp->st_vfs_file = dp->dl_vfs_file;
         } else {
-                int status;
+                __be32 status;
                 status = nfsd_open(rqstp, cur_fh, S_IFREG, flags,
                                 &stp->st_vfs_file);
                 if (status) {
@@ -1604,7 +1604,7 @@ nfs4_new_open(struct svc_rqst *rqstp, struct nfs4_stateid **stpp,
         return 0;
 }
 
-static inline int
+static inline __be32
 nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
                 struct nfsd4_open *open)
 {
@@ -1619,22 +1619,22 @@ nfsd4_truncate(struct svc_rqst *rqstp, struct svc_fh *fh,
         return nfsd_setattr(rqstp, fh, &iattr, 0, (time_t)0);
 }
 
-static int
+static __be32
 nfs4_upgrade_open(struct svc_rqst *rqstp, struct svc_fh *cur_fh, struct nfs4_stateid *stp, struct nfsd4_open *open)
 {
         struct file *filp = stp->st_vfs_file;
         struct inode *inode = filp->f_dentry->d_inode;
         unsigned int share_access, new_writer;
-        int status;
+        __be32 status;
 
         set_access(&share_access, stp->st_access_bmap);
         new_writer = (~share_access) & open->op_share_access
                         & NFS4_SHARE_ACCESS_WRITE;
 
         if (new_writer) {
-                status = get_write_access(inode);
-                if (status)
-                        return nfserrno(status);
+                int err = get_write_access(inode);
+                if (err)
+                        return nfserrno(err);
         }
         status = nfsd4_truncate(rqstp, cur_fh, open);
         if (status) {
@@ -1738,14 +1738,14 @@ out:
 /*
  * called with nfs4_lock_state() held.
  */
-int
+__be32
 nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
 {
         struct nfs4_file *fp = NULL;
         struct inode *ino = current_fh->fh_dentry->d_inode;
         struct nfs4_stateid *stp = NULL;
         struct nfs4_delegation *dp = NULL;
-        int status;
+        __be32 status;
 
         status = nfserr_inval;
         if (!access_valid(open->op_share_access)
@@ -1833,11 +1833,11 @@ static struct work_struct laundromat_work;
 static void laundromat_main(void *);
 static DECLARE_WORK(laundromat_work, laundromat_main, NULL);
 
-int 
+__be32
 nfsd4_renew(clientid_t *clid)
 {
         struct nfs4_client *clp;
-        int status;
+        __be32 status;
 
         nfs4_lock_state();
         dprintk("process_renew(%08x/%08x): starting\n", 
@@ -1996,9 +1996,9 @@ access_permit_write(unsigned long access_bmap)
 }
 
 static
-int nfs4_check_openmode(struct nfs4_stateid *stp, int flags)
+__be32 nfs4_check_openmode(struct nfs4_stateid *stp, int flags)
 {
-        int status = nfserr_openmode;
+        __be32 status = nfserr_openmode;
 
         if ((flags & WR_STATE) && (!access_permit_write(stp->st_access_bmap)))
                 goto out;
@@ -2009,7 +2009,7 @@ out:
         return status;
 }
 
-static inline int
+static inline __be32
 check_special_stateids(svc_fh *current_fh, stateid_t *stateid, int flags)
 {
         /* Trying to call delegreturn with a special stateid? Yuch: */
@@ -2043,14 +2043,14 @@ io_during_grace_disallowed(struct inode *inode, int flags)
 /*
 * Checks for stateid operations
 */
-int
+__be32
 nfs4_preprocess_stateid_op(struct svc_fh *current_fh, stateid_t *stateid, int flags, struct file **filpp)
 {
         struct nfs4_stateid *stp = NULL;
         struct nfs4_delegation *dp = NULL;
         stateid_t *stidp;
         struct inode *ino = current_fh->fh_dentry->d_inode;
-        int status;
+        __be32 status;
 
         dprintk("NFSD: preprocess_stateid_op: stateid = (%08x/%08x/%08x/%08x)\n",
                 stateid->si_boot, stateid->si_stateownerid, 
@@ -2125,7 +2125,7 @@ setlkflg (int type)
 /* 
  * Checks for sequence id mutating operations. 
  */
-static int
+static __be32
 nfs4_preprocess_seqid_op(struct svc_fh *current_fh, u32 seqid, stateid_t *stateid, int flags, struct nfs4_stateowner **sopp, struct nfs4_stateid **stpp, struct nfsd4_lock *lock)
 {
         struct nfs4_stateid *stp;
@@ -2169,7 +2169,7 @@ nfs4_preprocess_seqid_op(struct svc_fh *current_fh, u32 seqid, stateid_t *statei
                 clientid_t *lockclid = &lock->v.new.clientid;
                 struct nfs4_client *clp = sop->so_client;
                 int lkflg = 0;
-                int status;
+                __be32 status;
 
                 lkflg = setlkflg(lock->lk_type);
 
@@ -2233,7 +2233,7 @@ check_replay:
         if (seqid == sop->so_seqid - 1) {
                 dprintk("NFSD: preprocess_seqid_op: retransmission?\n");
                 /* indicate replay to calling function */
-                return NFSERR_REPLAY_ME;
+                return nfserr_replay_me;
         }
         printk("NFSD: preprocess_seqid_op: bad seqid (expected %d, got %d)\n",
                         sop->so_seqid, seqid);
@@ -2241,10 +2241,10 @@ check_replay:
         return nfserr_bad_seqid;
 }
 
-int
+__be32
 nfsd4_open_confirm(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_confirm *oc, struct nfs4_stateowner **replay_owner)
 {
-        int status;
+        __be32 status;
         struct nfs4_stateowner *sop;
         struct nfs4_stateid *stp;
 
@@ -2310,10 +2310,10 @@ reset_union_bmap_deny(unsigned long deny, unsigned long *bmap)
         }
 }
 
-int
+__be32
 nfsd4_open_downgrade(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open_downgrade *od, struct nfs4_stateowner **replay_owner)
 {
-        int status;
+        __be32 status;
         struct nfs4_stateid *stp;
         unsigned int share_access;
 
@@ -2365,10 +2365,10 @@ out:
 /*
  * nfs4_unlock_state() called after encode
  */
-int
+__be32
 nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_close *close, struct nfs4_stateowner **replay_owner)
 {
-        int status;
+        __be32 status;
         struct nfs4_stateid *stp;
 
         dprintk("NFSD: nfsd4_close on file %.*s\n", 
@@ -2404,10 +2404,10 @@ out:
         return status;
 }
 
-int
+__be32
 nfsd4_delegreturn(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_delegreturn *dr)
 {
-        int status;
+        __be32 status;
 
         if ((status = fh_verify(rqstp, current_fh, S_IFREG, 0)))
                 goto out;
@@ -2635,7 +2635,7 @@ check_lock_length(u64 offset, u64 length)
 /*
  *  LOCK operation 
  */
-int
+__be32
 nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock *lock, struct nfs4_stateowner **replay_owner)
 {
         struct nfs4_stateowner *open_sop = NULL;
@@ -2644,8 +2644,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         struct file *filp;
         struct file_lock file_lock;
         struct file_lock conflock;
-        int status = 0;
+        __be32 status = 0;
         unsigned int strhashval;
+        int err;
 
         dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
                 (long long) lock->lk_offset,
@@ -2758,13 +2759,14 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
          * locks_copy_lock: */
         conflock.fl_ops = NULL;
         conflock.fl_lmops = NULL;
-        status = posix_lock_file_conf(filp, &file_lock, &conflock);
+        err = posix_lock_file_conf(filp, &file_lock, &conflock);
         dprintk("NFSD: nfsd4_lock: posix_lock_file_conf status %d\n",status);
-        switch (-status) {
+        switch (-err) {
         case 0: /* success! */
                 update_stateid(&lock_stp->st_stateid);
                 memcpy(&lock->lk_resp_stateid, &lock_stp->st_stateid, 
                                 sizeof(stateid_t));
+                status = 0;
                 break;
         case (EAGAIN):          /* conflock holds conflicting lock */
                 status = nfserr_denied;
@@ -2775,7 +2777,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                 status = nfserr_deadlock;
                 break;
         default:        
-                dprintk("NFSD: nfsd4_lock: posix_lock_file_conf() failed! status %d\n",status);
+                dprintk("NFSD: nfsd4_lock: posix_lock_file_conf() failed! status %d\n",err);
                 status = nfserr_resource;
                 break;
         }
@@ -2793,14 +2795,14 @@ out:
 /*
  * LOCKT operation
  */
-int
+__be32
 nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lockt *lockt)
 {
         struct inode *inode;
         struct file file;
         struct file_lock file_lock;
         struct file_lock conflock;
-        int status;
+        __be32 status;
 
         if (nfs4_in_grace())
                 return nfserr_grace;
@@ -2873,13 +2875,14 @@ out:
         return status;
 }
 
-int
+__be32
 nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_locku *locku, struct nfs4_stateowner **replay_owner)
 {
         struct nfs4_stateid *stp;
         struct file *filp = NULL;
         struct file_lock file_lock;
-        int status;
+        __be32 status;
+        int err;
                                                         
         dprintk("NFSD: nfsd4_locku: start=%Ld length=%Ld\n",
                 (long long) locku->lu_offset,
@@ -2917,8 +2920,8 @@ nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         /*
         *  Try to unlock the file in the VFS.
         */
-        status = posix_lock_file(filp, &file_lock); 
-        if (status) {
+        err = posix_lock_file(filp, &file_lock);
+        if (err) {
                 dprintk("NFSD: nfs4_locku: posix_lock_file failed!\n");
                 goto out_nfserr;
         }
@@ -2937,7 +2940,7 @@ out:
         return status;
 
 out_nfserr:
-        status = nfserrno(status);
+        status = nfserrno(err);
         goto out;
 }
 
@@ -2965,7 +2968,7 @@ out:
         return status;
 }
 
-int
+__be32
 nfsd4_release_lockowner(struct svc_rqst *rqstp, struct nfsd4_release_lockowner *rlockowner)
 {
         clientid_t *clid = &rlockowner->rl_clientid;
@@ -2974,7 +2977,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, struct nfsd4_release_lockowner *
         struct xdr_netobj *owner = &rlockowner->rl_owner;
         struct list_head matches;
         int i;
-        int status;
+        __be32 status;
 
         dprintk("nfsd4_release_lockowner clientid: (%08x/%08x):\n",
                 clid->cl_boot, clid->cl_id);
@@ -3111,7 +3114,7 @@ nfs4_find_reclaim_client(clientid_t *clid)
 /*
 * Called from OPEN. Look for clientid in reclaim list.
 */
-int
+__be32
 nfs4_check_open_reclaim(clientid_t *clid)
 {
         return nfs4_find_reclaim_client(clid) ? nfs_ok : nfserr_reclaim_bad;
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 41fc241b729a..f3f239db04bb 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -68,8 +68,8 @@
 #define NFS4_REFERRAL_FSID_MAJOR        0x8000000ULL
 #define NFS4_REFERRAL_FSID_MINOR        0x8000000ULL
 
-static int
-check_filename(char *str, int len, int err)
+static __be32
+check_filename(char *str, int len, __be32 err)
 {
         int i;
 
@@ -94,8 +94,8 @@ check_filename(char *str, int len, int err)
  * consistent with the style used in NFSv2/v3...
  */
 #define DECODE_HEAD                             \
-        u32 *p;                                 \
-        int status
+        __be32 *p;                              \
+        __be32 status
 #define DECODE_TAIL                             \
         status = 0;                             \
 out:                                            \
@@ -144,13 +144,13 @@ xdr_error:					\
         }                                       \
 } while (0)
 
-static u32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes)
+static __be32 *read_buf(struct nfsd4_compoundargs *argp, int nbytes)
 {
         /* We want more bytes than seem to be available.
          * Maybe we need a new page, maybe we have just run out
          */
         int avail = (char*)argp->end - (char*)argp->p;
-        u32 *p;
+        __be32 *p;
         if (avail + argp->pagelen < nbytes)
                 return NULL;
         if (avail + PAGE_SIZE < nbytes) /* need more than a page !! */
@@ -197,7 +197,7 @@ defer_free(struct nfsd4_compoundargs *argp,
         return 0;
 }
 
-static char *savemem(struct nfsd4_compoundargs *argp, u32 *p, int nbytes)
+static char *savemem(struct nfsd4_compoundargs *argp, __be32 *p, int nbytes)
 {
         void *new = NULL;
         if (p == argp->tmp) {
@@ -217,7 +217,7 @@ static char *savemem(struct nfsd4_compoundargs *argp, u32 *p, int nbytes)
 }
 
 
-static int
+static __be32
 nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval)
 {
         u32 bmlen;
@@ -240,13 +240,14 @@ nfsd4_decode_bitmap(struct nfsd4_compoundargs *argp, u32 *bmval)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *iattr,
     struct nfs4_acl **acl)
 {
         int expected_len, len = 0;
         u32 dummy32;
         char *buf;
+        int host_err;
 
         DECODE_HEAD;
         iattr->ia_valid = 0;
@@ -280,7 +281,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
 
                 *acl = nfs4_acl_new();
                 if (*acl == NULL) {
-                        status = -ENOMEM;
+                        host_err = -ENOMEM;
                         goto out_nfserr;
                 }
                 defer_free(argp, (void (*)(const void *))nfs4_acl_free, *acl);
@@ -295,20 +296,20 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
                         len += XDR_QUADLEN(dummy32) << 2;
                         READMEM(buf, dummy32);
                         ace.whotype = nfs4_acl_get_whotype(buf, dummy32);
-                        status = 0;
+                        host_err = 0;
                         if (ace.whotype != NFS4_ACL_WHO_NAMED)
                                 ace.who = 0;
                         else if (ace.flag & NFS4_ACE_IDENTIFIER_GROUP)
-                                status = nfsd_map_name_to_gid(argp->rqstp,
+                                host_err = nfsd_map_name_to_gid(argp->rqstp,
                                                 buf, dummy32, &ace.who);
                         else
-                                status = nfsd_map_name_to_uid(argp->rqstp,
+                                host_err = nfsd_map_name_to_uid(argp->rqstp,
                                                 buf, dummy32, &ace.who);
-                        if (status)
+                        if (host_err)
                                 goto out_nfserr;
-                        status = nfs4_acl_add_ace(*acl, ace.type, ace.flag,
+                        host_err = nfs4_acl_add_ace(*acl, ace.type, ace.flag,
                                  ace.access_mask, ace.whotype, ace.who);
-                        if (status)
+                        if (host_err)
                                 goto out_nfserr;
                 }
         } else
@@ -327,7 +328,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
                 READ_BUF(dummy32);
                 len += (XDR_QUADLEN(dummy32) << 2);
                 READMEM(buf, dummy32);
-                if ((status = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
+                if ((host_err = nfsd_map_name_to_uid(argp->rqstp, buf, dummy32, &iattr->ia_uid)))
                         goto out_nfserr;
                 iattr->ia_valid |= ATTR_UID;
         }
@@ -338,7 +339,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
                 READ_BUF(dummy32);
                 len += (XDR_QUADLEN(dummy32) << 2);
                 READMEM(buf, dummy32);
-                if ((status = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
+                if ((host_err = nfsd_map_name_to_gid(argp->rqstp, buf, dummy32, &iattr->ia_gid)))
                         goto out_nfserr;
                 iattr->ia_valid |= ATTR_GID;
         }
@@ -414,11 +415,11 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
         DECODE_TAIL;
 
 out_nfserr:
-        status = nfserrno(status);
+        status = nfserrno(host_err);
         goto out;
 }
 
-static int
+static __be32
 nfsd4_decode_access(struct nfsd4_compoundargs *argp, struct nfsd4_access *access)
 {
         DECODE_HEAD;
@@ -429,7 +430,7 @@ nfsd4_decode_access(struct nfsd4_compoundargs *argp, struct nfsd4_access *access
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_close(struct nfsd4_compoundargs *argp, struct nfsd4_close *close)
 {
         DECODE_HEAD;
@@ -444,7 +445,7 @@ nfsd4_decode_close(struct nfsd4_compoundargs *argp, struct nfsd4_close *close)
 }
 
 
-static int
+static __be32
 nfsd4_decode_commit(struct nfsd4_compoundargs *argp, struct nfsd4_commit *commit)
 {
         DECODE_HEAD;
@@ -456,7 +457,7 @@ nfsd4_decode_commit(struct nfsd4_compoundargs *argp, struct nfsd4_commit *commit
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create)
 {
         DECODE_HEAD;
@@ -496,7 +497,7 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
         DECODE_TAIL;
 }
 
-static inline int
+static inline __be32
 nfsd4_decode_delegreturn(struct nfsd4_compoundargs *argp, struct nfsd4_delegreturn *dr)
 {
         DECODE_HEAD;
@@ -508,13 +509,13 @@ nfsd4_decode_delegreturn(struct nfsd4_compoundargs *argp, struct nfsd4_delegretu
         DECODE_TAIL;
 }
 
-static inline int
+static inline __be32
 nfsd4_decode_getattr(struct nfsd4_compoundargs *argp, struct nfsd4_getattr *getattr)
 {
         return nfsd4_decode_bitmap(argp, getattr->ga_bmval);
 }
 
-static int
+static __be32
 nfsd4_decode_link(struct nfsd4_compoundargs *argp, struct nfsd4_link *link)
 {
         DECODE_HEAD;
@@ -529,7 +530,7 @@ nfsd4_decode_link(struct nfsd4_compoundargs *argp, struct nfsd4_link *link)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_lock(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
 {
         DECODE_HEAD;
@@ -568,7 +569,7 @@ nfsd4_decode_lock(struct nfsd4_compoundargs *argp, struct nfsd4_lock *lock)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_lockt(struct nfsd4_compoundargs *argp, struct nfsd4_lockt *lockt)
 {
         DECODE_HEAD;
@@ -587,7 +588,7 @@ nfsd4_decode_lockt(struct nfsd4_compoundargs *argp, struct nfsd4_lockt *lockt)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_locku(struct nfsd4_compoundargs *argp, struct nfsd4_locku *locku)
 {
         DECODE_HEAD;
@@ -606,7 +607,7 @@ nfsd4_decode_locku(struct nfsd4_compoundargs *argp, struct nfsd4_locku *locku)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_lookup(struct nfsd4_compoundargs *argp, struct nfsd4_lookup *lookup)
 {
         DECODE_HEAD;
@@ -621,7 +622,7 @@ nfsd4_decode_lookup(struct nfsd4_compoundargs *argp, struct nfsd4_lookup *lookup
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
 {
         DECODE_HEAD;
@@ -699,7 +700,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_open_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_open_confirm *open_conf)
 {
         DECODE_HEAD;
@@ -713,7 +714,7 @@ nfsd4_decode_open_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_open_con
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_open_downgrade(struct nfsd4_compoundargs *argp, struct nfsd4_open_downgrade *open_down)
 {
         DECODE_HEAD;
@@ -729,7 +730,7 @@ nfsd4_decode_open_downgrade(struct nfsd4_compoundargs *argp, struct nfsd4_open_d
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, struct nfsd4_putfh *putfh)
 {
         DECODE_HEAD;
@@ -744,7 +745,7 @@ nfsd4_decode_putfh(struct nfsd4_compoundargs *argp, struct nfsd4_putfh *putfh)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_read(struct nfsd4_compoundargs *argp, struct nfsd4_read *read)
 {
         DECODE_HEAD;
@@ -758,7 +759,7 @@ nfsd4_decode_read(struct nfsd4_compoundargs *argp, struct nfsd4_read *read)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_readdir(struct nfsd4_compoundargs *argp, struct nfsd4_readdir *readdir)
 {
         DECODE_HEAD;
@@ -774,7 +775,7 @@ nfsd4_decode_readdir(struct nfsd4_compoundargs *argp, struct nfsd4_readdir *read
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_remove(struct nfsd4_compoundargs *argp, struct nfsd4_remove *remove)
 {
         DECODE_HEAD;
@@ -789,7 +790,7 @@ nfsd4_decode_remove(struct nfsd4_compoundargs *argp, struct nfsd4_remove *remove
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename)
 {
         DECODE_HEAD;
@@ -809,7 +810,7 @@ nfsd4_decode_rename(struct nfsd4_compoundargs *argp, struct nfsd4_rename *rename
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_renew(struct nfsd4_compoundargs *argp, clientid_t *clientid)
 {
         DECODE_HEAD;
@@ -820,7 +821,7 @@ nfsd4_decode_renew(struct nfsd4_compoundargs *argp, clientid_t *clientid)
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, struct nfsd4_setattr *setattr)
 {
         DECODE_HEAD;
@@ -834,7 +835,7 @@ nfsd4_decode_setattr(struct nfsd4_compoundargs *argp, struct nfsd4_setattr *seta
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid *setclientid)
 {
         DECODE_HEAD;
@@ -859,7 +860,7 @@ nfsd4_decode_setclientid(struct nfsd4_compoundargs *argp, struct nfsd4_setclient
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_setclientid_confirm *scd_c)
 {
         DECODE_HEAD;
@@ -872,7 +873,7 @@ nfsd4_decode_setclientid_confirm(struct nfsd4_compoundargs *argp, struct nfsd4_s
 }
 
 /* Also used for NVERIFY */
-static int
+static __be32
 nfsd4_decode_verify(struct nfsd4_compoundargs *argp, struct nfsd4_verify *verify)
 {
 #if 0
@@ -908,7 +909,7 @@ nfsd4_decode_verify(struct nfsd4_compoundargs *argp, struct nfsd4_verify *verify
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
 {
         int avail;
@@ -951,15 +952,15 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
                         argp->pagelen -= len;
                 }
         }
-        argp->end = (u32*) (argp->rqstp->rq_vec[v].iov_base + argp->rqstp->rq_vec[v].iov_len);
-        argp->p = (u32*)  (argp->rqstp->rq_vec[v].iov_base + (XDR_QUADLEN(len) << 2));
+        argp->end = (__be32*) (argp->rqstp->rq_vec[v].iov_base + argp->rqstp->rq_vec[v].iov_len);
+        argp->p = (__be32*)  (argp->rqstp->rq_vec[v].iov_base + (XDR_QUADLEN(len) << 2));
         argp->rqstp->rq_vec[v].iov_len = len;
         write->wr_vlen = v+1;
 
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_release_lockowner(struct nfsd4_compoundargs *argp, struct nfsd4_release_lockowner *rlockowner)
 {
         DECODE_HEAD;
@@ -973,7 +974,7 @@ nfsd4_decode_release_lockowner(struct nfsd4_compoundargs *argp, struct nfsd4_rel
         DECODE_TAIL;
 }
 
-static int
+static __be32
 nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
 {
         DECODE_HEAD;
@@ -1179,7 +1180,7 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
  * task to translate them into Linux-specific versions which are more
  * consistent with the style used in NFSv2/v3...
  */
-#define ENCODE_HEAD              u32 *p
+#define ENCODE_HEAD              __be32 *p
 
 #define WRITE32(n)               *p++ = htonl(n)
 #define WRITE64(n)               do {                           \
@@ -1209,8 +1210,8 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
  * Header routine to setup seqid operation replay cache
  */
 #define ENCODE_SEQID_OP_HEAD                                    \
-        u32 *p;                                                 \
-        u32 *save;                                              \
+        __be32 *p;                                              \
+        __be32 *save;                                           \
                                                                 \
         save = resp->p;
 
@@ -1234,11 +1235,11 @@ nfsd4_decode_compound(struct nfsd4_compoundargs *argp)
 /* Encode as an array of strings the string given with components
  * seperated @sep.
  */
-static int nfsd4_encode_components(char sep, char *components,
-                                   u32 **pp, int *buflen)
+static __be32 nfsd4_encode_components(char sep, char *components,
+                                   __be32 **pp, int *buflen)
 {
-        u32 *p = *pp;
-        u32 *countp = p;
+        __be32 *p = *pp;
+        __be32 *countp = p;
         int strlen, count=0;
         char *str, *end;
 
@@ -1271,11 +1272,11 @@ static int nfsd4_encode_components(char sep, char *components,
 /*
  * encode a location element of a fs_locations structure
  */
-static int nfsd4_encode_fs_location4(struct nfsd4_fs_location *location,
-                                    u32 **pp, int *buflen)
+static __be32 nfsd4_encode_fs_location4(struct nfsd4_fs_location *location,
+                                    __be32 **pp, int *buflen)
 {
-        int status;
-        u32 *p = *pp;
+        __be32 status;
+        __be32 *p = *pp;
 
         status = nfsd4_encode_components(':', location->hosts, &p, buflen);
         if (status)
@@ -1292,16 +1293,15 @@ static int nfsd4_encode_fs_location4(struct nfsd4_fs_location *location,
  * Returned string is safe to use as long as the caller holds a reference
  * to @exp.
  */
-static char *nfsd4_path(struct svc_rqst *rqstp, struct svc_export *exp)
+static char *nfsd4_path(struct svc_rqst *rqstp, struct svc_export *exp, __be32 *stat)
 {
         struct svc_fh tmp_fh;
         char *path, *rootpath;
-        int stat;
 
         fh_init(&tmp_fh, NFS4_FHSIZE);
-        stat = exp_pseudoroot(rqstp->rq_client, &tmp_fh, &rqstp->rq_chandle);
-        if (stat)
-                return ERR_PTR(stat);
+        *stat = exp_pseudoroot(rqstp->rq_client, &tmp_fh, &rqstp->rq_chandle);
+        if (*stat)
+                return NULL;
         rootpath = tmp_fh.fh_export->ex_path;
 
         path = exp->ex_path;
@@ -1309,7 +1309,8 @@ static char *nfsd4_path(struct svc_rqst *rqstp, struct svc_export *exp)
         if (strncmp(path, rootpath, strlen(rootpath))) {
                 printk("nfsd: fs_locations failed;"
                         "%s is not contained in %s\n", path, rootpath);
-                return ERR_PTR(-EOPNOTSUPP);
+                *stat = nfserr_notsupp;
+                return NULL;
         }
 
         return path + strlen(rootpath);
@@ -1318,17 +1319,18 @@ static char *nfsd4_path(struct svc_rqst *rqstp, struct svc_export *exp)
 /*
  *  encode a fs_locations structure
  */
-static int nfsd4_encode_fs_locations(struct svc_rqst *rqstp,
+static __be32 nfsd4_encode_fs_locations(struct svc_rqst *rqstp,
                                      struct svc_export *exp,
-                                     u32 **pp, int *buflen)
+                                     __be32 **pp, int *buflen)
 {
-        int status, i;
-        u32 *p = *pp;
+        __be32 status;
+        int i;
+        __be32 *p = *pp;
         struct nfsd4_fs_locations *fslocs = &exp->ex_fslocs;
-        char *root = nfsd4_path(rqstp, exp);
+        char *root = nfsd4_path(rqstp, exp, &status);
 
-        if (IS_ERR(root))
-                return PTR_ERR(root);
+        if (status)
+                return status;
         status = nfsd4_encode_components('/', root, &p, buflen);
         if (status)
                 return status;
@@ -1352,9 +1354,9 @@ static u32 nfs4_ftypes[16] = {
         NF4SOCK, NF4BAD,  NF4LNK, NF4BAD,
 };
 
-static int
+static __be32
 nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
-                        u32 **p, int *buflen)
+                        __be32 **p, int *buflen)
 {
         int status;
 
@@ -1374,21 +1376,21 @@ nfsd4_encode_name(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
         return 0;
 }
 
-static inline int
-nfsd4_encode_user(struct svc_rqst *rqstp, uid_t uid, u32 **p, int *buflen)
+static inline __be32
+nfsd4_encode_user(struct svc_rqst *rqstp, uid_t uid, __be32 **p, int *buflen)
 {
         return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, uid, 0, p, buflen);
 }
 
-static inline int
-nfsd4_encode_group(struct svc_rqst *rqstp, uid_t gid, u32 **p, int *buflen)
+static inline __be32
+nfsd4_encode_group(struct svc_rqst *rqstp, uid_t gid, __be32 **p, int *buflen)
 {
         return nfsd4_encode_name(rqstp, NFS4_ACL_WHO_NAMED, gid, 1, p, buflen);
 }
 
-static inline int
+static inline __be32
 nfsd4_encode_aclname(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
-                u32 **p, int *buflen)
+                __be32 **p, int *buflen)
 {
         return nfsd4_encode_name(rqstp, whotype, id, group, p, buflen);
 }
@@ -1397,7 +1399,7 @@ nfsd4_encode_aclname(struct svc_rqst *rqstp, int whotype, uid_t id, int group,
                               FATTR4_WORD0_RDATTR_ERROR)
 #define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID
 
-static int fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
+static __be32 fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
 {
         /* As per referral draft:  */
         if (*bmval0 & ~WORD0_ABSENT_FS_ATTRS ||
@@ -1420,9 +1422,9 @@ static int fattr_handle_absent_fs(u32 *bmval0, u32 *bmval1, u32 *rdattr_err)
  * @countp is the buffer size in _words_; upon successful return this becomes
  * replaced with the number of words written.
  */
-int
+__be32
 nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
-                struct dentry *dentry, u32 *buffer, int *countp, u32 *bmval,
+                struct dentry *dentry, __be32 *buffer, int *countp, u32 *bmval,
                 struct svc_rqst *rqstp)
 {
         u32 bmval0 = bmval[0];
@@ -1431,12 +1433,13 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
         struct svc_fh tempfh;
         struct kstatfs statfs;
         int buflen = *countp << 2;
-        u32 *attrlenp;
+        __be32 *attrlenp;
         u32 dummy;
         u64 dummy64;
         u32 rdattr_err = 0;
-        u32 *p = buffer;
-        int status;
+        __be32 *p = buffer;
+        __be32 status;
+        int err;
         int aclsupport = 0;
         struct nfs4_acl *acl = NULL;
 
@@ -1450,14 +1453,14 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
                         goto out;
         }
 
-        status = vfs_getattr(exp->ex_mnt, dentry, &stat);
-        if (status)
+        err = vfs_getattr(exp->ex_mnt, dentry, &stat);
+        if (err)
                 goto out_nfserr;
         if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL)) ||
             (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
                        FATTR4_WORD1_SPACE_TOTAL))) {
-                status = vfs_statfs(dentry, &statfs);
-                if (status)
+                err = vfs_statfs(dentry, &statfs);
+                if (err)
                         goto out_nfserr;
         }
         if ((bmval0 & (FATTR4_WORD0_FILEHANDLE | FATTR4_WORD0_FSID)) && !fhp) {
@@ -1469,15 +1472,15 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
         }
         if (bmval0 & (FATTR4_WORD0_ACL | FATTR4_WORD0_ACLSUPPORT
                         | FATTR4_WORD0_SUPPORTED_ATTRS)) {
-                status = nfsd4_get_nfs4_acl(rqstp, dentry, &acl);
-                aclsupport = (status == 0);
+                err = nfsd4_get_nfs4_acl(rqstp, dentry, &acl);
+                aclsupport = (err == 0);
                 if (bmval0 & FATTR4_WORD0_ACL) {
-                        if (status == -EOPNOTSUPP)
+                        if (err == -EOPNOTSUPP)
                                 bmval0 &= ~FATTR4_WORD0_ACL;
-                        else if (status == -EINVAL) {
+                        else if (err == -EINVAL) {
                                 status = nfserr_attrnotsupp;
                                 goto out;
-                        } else if (status != 0)
+                        } else if (err != 0)
                                 goto out_nfserr;
                 }
         }
@@ -1817,7 +1820,7 @@ out:
                 fh_put(&tempfh);
         return status;
 out_nfserr:
-        status = nfserrno(status);
+        status = nfserrno(err);
         goto out;
 out_resource:
         *countp = 0;
@@ -1828,13 +1831,13 @@ out_serverfault:
         goto out;
 }
 
-static int
+static __be32
 nfsd4_encode_dirent_fattr(struct nfsd4_readdir *cd,
-                const char *name, int namlen, u32 *p, int *buflen)
+                const char *name, int namlen, __be32 *p, int *buflen)
 {
         struct svc_export *exp = cd->rd_fhp->fh_export;
         struct dentry *dentry;
-        int nfserr;
+        __be32 nfserr;
 
         dentry = lookup_one_len(name, cd->rd_fhp->fh_dentry, namlen);
         if (IS_ERR(dentry))
@@ -1863,10 +1866,10 @@ out_put:
         return nfserr;
 }
 
-static u32 *
-nfsd4_encode_rdattr_error(u32 *p, int buflen, int nfserr)
+static __be32 *
+nfsd4_encode_rdattr_error(__be32 *p, int buflen, __be32 nfserr)
 {
-        u32 *attrlenp;
+        __be32 *attrlenp;
 
         if (buflen < 6)
                 return NULL;
@@ -1886,8 +1889,8 @@ nfsd4_encode_dirent(struct readdir_cd *ccd, const char *name, int namlen,
 {
         struct nfsd4_readdir *cd = container_of(ccd, struct nfsd4_readdir, common);
         int buflen;
-        u32 *p = cd->buffer;
-        int nfserr = nfserr_toosmall;
+        __be32 *p = cd->buffer;
+        __be32 nfserr = nfserr_toosmall;
 
         /* In nfsv4, "." and ".." never make it onto the wire.. */
         if (name && isdotent(name, namlen)) {
@@ -1943,7 +1946,7 @@ fail:
 }
 
 static void
-nfsd4_encode_access(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_access *access)
+nfsd4_encode_access(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_access *access)
 {
         ENCODE_HEAD;
 
@@ -1956,7 +1959,7 @@ nfsd4_encode_access(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_acc
 }
 
 static void
-nfsd4_encode_close(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_close *close)
+nfsd4_encode_close(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_close *close)
 {
         ENCODE_SEQID_OP_HEAD;
 
@@ -1971,7 +1974,7 @@ nfsd4_encode_close(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_clos
 
 
 static void
-nfsd4_encode_commit(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_commit *commit)
+nfsd4_encode_commit(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_commit *commit)
 {
         ENCODE_HEAD;
 
@@ -1983,7 +1986,7 @@ nfsd4_encode_commit(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_com
 }
 
 static void
-nfsd4_encode_create(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_create *create)
+nfsd4_encode_create(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_create *create)
 {
         ENCODE_HEAD;
 
@@ -1997,8 +2000,8 @@ nfsd4_encode_create(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_cre
         }
 }
 
-static int
-nfsd4_encode_getattr(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_getattr *getattr)
+static __be32
+nfsd4_encode_getattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_getattr *getattr)
 {
         struct svc_fh *fhp = getattr->ga_fhp;
         int buflen;
@@ -2016,7 +2019,7 @@ nfsd4_encode_getattr(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_ge
 }
 
 static void
-nfsd4_encode_getfh(struct nfsd4_compoundres *resp, int nfserr, struct svc_fh *fhp)
+nfsd4_encode_getfh(struct nfsd4_compoundres *resp, __be32 nfserr, struct svc_fh *fhp)
 {
         unsigned int len;
         ENCODE_HEAD;
@@ -2056,7 +2059,7 @@ nfsd4_encode_lock_denied(struct nfsd4_compoundres *resp, struct nfsd4_lock_denie
 }
 
 static void
-nfsd4_encode_lock(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_lock *lock)
+nfsd4_encode_lock(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lock *lock)
 {
         ENCODE_SEQID_OP_HEAD;
 
@@ -2072,14 +2075,14 @@ nfsd4_encode_lock(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_lock
 }
 
 static void
-nfsd4_encode_lockt(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_lockt *lockt)
+nfsd4_encode_lockt(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_lockt *lockt)
 {
         if (nfserr == nfserr_denied)
                 nfsd4_encode_lock_denied(resp, &lockt->lt_denied);
 }
 
 static void
-nfsd4_encode_locku(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_locku *locku)
+nfsd4_encode_locku(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_locku *locku)
 {
         ENCODE_SEQID_OP_HEAD;
 
@@ -2095,7 +2098,7 @@ nfsd4_encode_locku(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_lock
 
 
 static void
-nfsd4_encode_link(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_link *link)
+nfsd4_encode_link(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_link *link)
 {
         ENCODE_HEAD;
 
@@ -2108,7 +2111,7 @@ nfsd4_encode_link(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_link
 
 
 static void
-nfsd4_encode_open(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_open *open)
+nfsd4_encode_open(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open *open)
 {
         ENCODE_SEQID_OP_HEAD;
 
@@ -2173,7 +2176,7 @@ out:
 }
 
 static void
-nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_open_confirm *oc)
+nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_confirm *oc)
 {
         ENCODE_SEQID_OP_HEAD;
                                         
@@ -2188,7 +2191,7 @@ nfsd4_encode_open_confirm(struct nfsd4_compoundres *resp, int nfserr, struct nfs
 }
 
 static void
-nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_open_downgrade *od)
+nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_open_downgrade *od)
 {
         ENCODE_SEQID_OP_HEAD;
                                         
@@ -2202,8 +2205,8 @@ nfsd4_encode_open_downgrade(struct nfsd4_compoundres *resp, int nfserr, struct n
         ENCODE_SEQID_OP_TAIL(od->od_stateowner);
 }
 
-static int
-nfsd4_encode_read(struct nfsd4_compoundres *resp, int nfserr,
+static __be32
+nfsd4_encode_read(struct nfsd4_compoundres *resp, __be32 nfserr,
                   struct nfsd4_read *read)
 {
         u32 eof;
@@ -2267,8 +2270,8 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, int nfserr,
         return 0;
 }
 
-static int
-nfsd4_encode_readlink(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_readlink *readlink)
+static __be32
+nfsd4_encode_readlink(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readlink *readlink)
 {
         int maxcount;
         char *page;
@@ -2315,12 +2318,12 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_r
         return 0;
 }
 
-static int
-nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_readdir *readdir)
+static __be32
+nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_readdir *readdir)
 {
         int maxcount;
         loff_t offset;
-        u32 *page, *savep, *tailbase;
+        __be32 *page, *savep, *tailbase;
         ENCODE_HEAD;
 
         if (nfserr)
@@ -2395,7 +2398,7 @@ err_no_verf:
 }
 
 static void
-nfsd4_encode_remove(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_remove *remove)
+nfsd4_encode_remove(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_remove *remove)
 {
         ENCODE_HEAD;
 
@@ -2407,7 +2410,7 @@ nfsd4_encode_remove(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_rem
 }
 
 static void
-nfsd4_encode_rename(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_rename *rename)
+nfsd4_encode_rename(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_rename *rename)
 {
         ENCODE_HEAD;
 
@@ -2424,7 +2427,7 @@ nfsd4_encode_rename(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_ren
  * regardless of the error status.
  */
 static void
-nfsd4_encode_setattr(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_setattr *setattr)
+nfsd4_encode_setattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setattr *setattr)
 {
         ENCODE_HEAD;
 
@@ -2443,7 +2446,7 @@ nfsd4_encode_setattr(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_se
 }
 
 static void
-nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_setclientid *scd)
+nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_setclientid *scd)
 {
         ENCODE_HEAD;
 
@@ -2462,7 +2465,7 @@ nfsd4_encode_setclientid(struct nfsd4_compoundres *resp, int nfserr, struct nfsd
 }
 
 static void
-nfsd4_encode_write(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_write *write)
+nfsd4_encode_write(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4_write *write)
 {
         ENCODE_HEAD;
 
@@ -2478,7 +2481,7 @@ nfsd4_encode_write(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_writ
 void
 nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
 {
-        u32 *statp;
+        __be32 *statp;
         ENCODE_HEAD;
 
         RESERVE_SPACE(8);
@@ -2616,7 +2619,7 @@ nfsd4_encode_replay(struct nfsd4_compoundres *resp, struct nfsd4_op *op)
  */
 
 int
-nfs4svc_encode_voidres(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nfs4svc_encode_voidres(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
@@ -2638,9 +2641,9 @@ void nfsd4_release_compoundargs(struct nfsd4_compoundargs *args)
 }
 
 int
-nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, u32 *p, struct nfsd4_compoundargs *args)
+nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundargs *args)
 {
-        int status;
+        __be32 status;
 
         args->p = p;
         args->end = rqstp->rq_arg.head[0].iov_base + rqstp->rq_arg.head[0].iov_len;
@@ -2659,7 +2662,7 @@ nfs4svc_decode_compoundargs(struct svc_rqst *rqstp, u32 *p, struct nfsd4_compoun
 }
 
 int
-nfs4svc_encode_compoundres(struct svc_rqst *rqstp, u32 *p, struct nfsd4_compoundres *resp)
+nfs4svc_encode_compoundres(struct svc_rqst *rqstp, __be32 *p, struct nfsd4_compoundres *resp)
 {
         /*
          * All that remains is to write the tag and operation count...
diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
index fdf7cf3dfadc..6100bbe27432 100644
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -29,7 +29,7 @@
  */
 #define CACHESIZE               1024
 #define HASHSIZE                64
-#define REQHASH(xid)            ((((xid) >> 24) ^ (xid)) & (HASHSIZE-1))
+#define REQHASH(xid)            (((((__force __u32)xid) >> 24) ^ ((__force __u32)xid)) & (HASHSIZE-1))
 
 static struct hlist_head *      hash_list;
 static struct list_head         lru_head;
@@ -127,8 +127,8 @@ nfsd_cache_lookup(struct svc_rqst *rqstp, int type)
         struct hlist_node       *hn;
         struct hlist_head       *rh;
         struct svc_cacherep     *rp;
-        u32                     xid = rqstp->rq_xid,
-                                proto =  rqstp->rq_prot,
+        __be32                  xid = rqstp->rq_xid;
+        u32                     proto =  rqstp->rq_prot,
                                 vers = rqstp->rq_vers,
                                 proc = rqstp->rq_proc;
         unsigned long           age;
@@ -258,7 +258,7 @@ found_entry:
  * In this case, nfsd_cache_update is called with statp == NULL.
  */
 void
-nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, u32 *statp)
+nfsd_cache_update(struct svc_rqst *rqstp, int cachetype, __be32 *statp)
 {
         struct svc_cacherep *rp;
         struct kvec     *resv = &rqstp->rq_res.head[0], *cachv;
diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c
index 501d83884530..727ab3bd450d 100644
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -76,7 +76,7 @@ static int nfsd_acceptable(void *expv, struct dentry *dentry)
  * comment in the NFSv3 spec says this is incorrect (implementation notes for
  * the write call).
  */
-static inline int
+static inline __be32
 nfsd_mode_check(struct svc_rqst *rqstp, umode_t mode, int type)
 {
         /* Type can be negative when creating hardlinks - not to a dir */
@@ -110,13 +110,13 @@ nfsd_mode_check(struct svc_rqst *rqstp, umode_t mode, int type)
  * This is only called at the start of an nfsproc call, so fhp points to
  * a svc_fh which is all 0 except for the over-the-wire file handle.
  */
-u32
+__be32
 fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access)
 {
         struct knfsd_fh *fh = &fhp->fh_handle;
         struct svc_export *exp = NULL;
         struct dentry   *dentry;
-        u32             error = 0;
+        __be32          error = 0;
 
         dprintk("nfsd: fh_verify(%s)\n", SVCFH_fmt(fhp));
 
@@ -315,7 +315,7 @@ static inline void _fh_update_old(struct dentry *dentry,
                 fh->ofh_dirino = 0;
 }
 
-int
+__be32
 fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, struct svc_fh *ref_fh)
 {
         /* ref_fh is a reference file handle.
@@ -451,7 +451,7 @@ fh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, st
  * Update file handle information after changing a dentry.
  * This is only called by nfsd_create, nfsd_create_v3 and nfsd_proc_create
  */
-int
+__be32
 fh_update(struct svc_fh *fhp)
 {
         struct dentry *dentry;
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 9ee1dab5d44a..ec983b777680 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -30,22 +30,22 @@ typedef struct svc_buf	svc_buf;
 #define NFSDDBG_FACILITY                NFSDDBG_PROC
 
 
-static int
+static __be32
 nfsd_proc_null(struct svc_rqst *rqstp, void *argp, void *resp)
 {
         return nfs_ok;
 }
 
-static int
-nfsd_return_attrs(int err, struct nfsd_attrstat *resp)
+static __be32
+nfsd_return_attrs(__be32 err, struct nfsd_attrstat *resp)
 {
         if (err) return err;
         return nfserrno(vfs_getattr(resp->fh.fh_export->ex_mnt,
                                     resp->fh.fh_dentry,
                                     &resp->stat));
 }
-static int
-nfsd_return_dirop(int err, struct nfsd_diropres *resp)
+static __be32
+nfsd_return_dirop(__be32 err, struct nfsd_diropres *resp)
 {
         if (err) return err;
         return nfserrno(vfs_getattr(resp->fh.fh_export->ex_mnt,
@@ -56,11 +56,11 @@ nfsd_return_dirop(int err, struct nfsd_diropres *resp)
  * Get a file's attributes
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_getattr(struct svc_rqst *rqstp, struct nfsd_fhandle  *argp,
                                           struct nfsd_attrstat *resp)
 {
-        int nfserr;
+        __be32 nfserr;
         dprintk("nfsd: GETATTR  %s\n", SVCFH_fmt(&argp->fh));
 
         fh_copy(&resp->fh, &argp->fh);
@@ -72,11 +72,11 @@ nfsd_proc_getattr(struct svc_rqst *rqstp, struct nfsd_fhandle  *argp,
  * Set a file's attributes
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_setattr(struct svc_rqst *rqstp, struct nfsd_sattrargs *argp,
                                           struct nfsd_attrstat  *resp)
 {
-        int nfserr;
+        __be32 nfserr;
         dprintk("nfsd: SETATTR  %s, valid=%x, size=%ld\n",
                 SVCFH_fmt(&argp->fh),
                 argp->attrs.ia_valid, (long) argp->attrs.ia_size);
@@ -92,11 +92,11 @@ nfsd_proc_setattr(struct svc_rqst *rqstp, struct nfsd_sattrargs *argp,
  * doesn't exist yet.
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_lookup(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
                                          struct nfsd_diropres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: LOOKUP   %s %.*s\n",
                 SVCFH_fmt(&argp->fh), argp->len, argp->name);
@@ -112,11 +112,11 @@ nfsd_proc_lookup(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
 /*
  * Read a symlink.
  */
-static int
+static __be32
 nfsd_proc_readlink(struct svc_rqst *rqstp, struct nfsd_readlinkargs *argp,
                                            struct nfsd_readlinkres *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: READLINK %s\n", SVCFH_fmt(&argp->fh));
 
@@ -132,11 +132,11 @@ nfsd_proc_readlink(struct svc_rqst *rqstp, struct nfsd_readlinkargs *argp,
  * Read a portion of a file.
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_read(struct svc_rqst *rqstp, struct nfsd_readargs *argp,
                                        struct nfsd_readres  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: READ    %s %d bytes at %d\n",
                 SVCFH_fmt(&argp->fh),
@@ -172,11 +172,11 @@ nfsd_proc_read(struct svc_rqst *rqstp, struct nfsd_readargs *argp,
  * Write data to a file
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_write(struct svc_rqst *rqstp, struct nfsd_writeargs *argp,
                                         struct nfsd_attrstat  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
         int     stable = 1;
 
         dprintk("nfsd: WRITE    %s %d bytes at %d\n",
@@ -197,7 +197,7 @@ nfsd_proc_write(struct svc_rqst *rqstp, struct nfsd_writeargs *argp,
  * and the actual create() call in compliance with VFS protocols.
  * N.B. After this call _both_ argp->fh and resp->fh need an fh_put
  */
-static int
+static __be32
 nfsd_proc_create(struct svc_rqst *rqstp, struct nfsd_createargs *argp,
                                          struct nfsd_diropres   *resp)
 {
@@ -206,7 +206,8 @@ nfsd_proc_create(struct svc_rqst *rqstp, struct nfsd_createargs *argp,
         struct iattr    *attr = &argp->attrs;
         struct inode    *inode;
         struct dentry   *dchild;
-        int             nfserr, type, mode;
+        int             type, mode;
+        __be32          nfserr;
         dev_t           rdev = 0, wanted = new_decode_dev(attr->ia_size);
 
         dprintk("nfsd: CREATE   %s %.*s\n",
@@ -348,11 +349,11 @@ done:
         return nfsd_return_dirop(nfserr, resp);
 }
 
-static int
+static __be32
 nfsd_proc_remove(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
                                          void                  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: REMOVE   %s %.*s\n", SVCFH_fmt(&argp->fh),
                 argp->len, argp->name);
@@ -363,11 +364,11 @@ nfsd_proc_remove(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
         return nfserr;
 }
 
-static int
+static __be32
 nfsd_proc_rename(struct svc_rqst *rqstp, struct nfsd_renameargs *argp,
                                          void                   *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: RENAME   %s %.*s -> \n",
                 SVCFH_fmt(&argp->ffh), argp->flen, argp->fname);
@@ -381,11 +382,11 @@ nfsd_proc_rename(struct svc_rqst *rqstp, struct nfsd_renameargs *argp,
         return nfserr;
 }
 
-static int
+static __be32
 nfsd_proc_link(struct svc_rqst *rqstp, struct nfsd_linkargs *argp,
                                 void                        *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: LINK     %s ->\n",
                 SVCFH_fmt(&argp->ffh));
@@ -401,12 +402,12 @@ nfsd_proc_link(struct svc_rqst *rqstp, struct nfsd_linkargs *argp,
         return nfserr;
 }
 
-static int
+static __be32
 nfsd_proc_symlink(struct svc_rqst *rqstp, struct nfsd_symlinkargs *argp,
                                           void                    *resp)
 {
         struct svc_fh   newfh;
-        int             nfserr;
+        __be32          nfserr;
 
         dprintk("nfsd: SYMLINK  %s %.*s -> %.*s\n",
                 SVCFH_fmt(&argp->ffh), argp->flen, argp->fname,
@@ -430,11 +431,11 @@ nfsd_proc_symlink(struct svc_rqst *rqstp, struct nfsd_symlinkargs *argp,
  * Make directory. This operation is not idempotent.
  * N.B. After this call resp->fh needs an fh_put
  */
-static int
+static __be32
 nfsd_proc_mkdir(struct svc_rqst *rqstp, struct nfsd_createargs *argp,
                                         struct nfsd_diropres   *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: MKDIR    %s %.*s\n", SVCFH_fmt(&argp->fh), argp->len, argp->name);
 
@@ -454,11 +455,11 @@ nfsd_proc_mkdir(struct svc_rqst *rqstp, struct nfsd_createargs *argp,
 /*
  * Remove a directory
  */
-static int
+static __be32
 nfsd_proc_rmdir(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
                                         void                  *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: RMDIR    %s %.*s\n", SVCFH_fmt(&argp->fh), argp->len, argp->name);
 
@@ -470,11 +471,12 @@ nfsd_proc_rmdir(struct svc_rqst *rqstp, struct nfsd_diropargs *argp,
 /*
  * Read a portion of a directory.
  */
-static int
+static __be32
 nfsd_proc_readdir(struct svc_rqst *rqstp, struct nfsd_readdirargs *argp,
                                           struct nfsd_readdirres  *resp)
 {
-        int             nfserr, count;
+        int             count;
+        __be32          nfserr;
         loff_t          offset;
 
         dprintk("nfsd: READDIR  %s %d bytes at %d\n",
@@ -509,11 +511,11 @@ nfsd_proc_readdir(struct svc_rqst *rqstp, struct nfsd_readdirargs *argp,
 /*
  * Get file system info
  */
-static int
+static __be32
 nfsd_proc_statfs(struct svc_rqst * rqstp, struct nfsd_fhandle   *argp,
                                           struct nfsd_statfsres *resp)
 {
-        int     nfserr;
+        __be32  nfserr;
 
         dprintk("nfsd: STATFS   %s\n", SVCFH_fmt(&argp->fh));
 
@@ -579,11 +581,11 @@ struct svc_version	nfsd_version2 = {
 /*
  * Map errnos to NFS errnos.
  */
-int
+__be32
 nfserrno (int errno)
 {
         static struct {
-                int     nfserr;
+                __be32  nfserr;
                 int     syserr;
         } nfs_errtbl[] = {
                 { nfs_ok, 0 },
@@ -615,11 +617,10 @@ nfserrno (int errno)
                 { nfserr_badname, -ESRCH },
                 { nfserr_io, -ETXTBSY },
                 { nfserr_notsupp, -EOPNOTSUPP },
-                { -1, -EIO }
         };
         int     i;
 
-        for (i = 0; nfs_errtbl[i].nfserr != -1; i++) {
+        for (i = 0; i < ARRAY_SIZE(nfs_errtbl); i++) {
                 if (nfs_errtbl[i].syserr == errno)
                         return nfs_errtbl[i].nfserr;
         }
diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c
index 013b38996e64..0aaccb03bf76 100644
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -491,12 +491,12 @@ out:
 }
 
 int
-nfsd_dispatch(struct svc_rqst *rqstp, u32 *statp)
+nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp)
 {
         struct svc_procedure    *proc;
         kxdrproc_t              xdr;
-        u32                     nfserr;
-        u32                     *nfserrp;
+        __be32                  nfserr;
+        __be32                  *nfserrp;
 
         dprintk("nfsd_dispatch: vers %d proc %d\n",
                                 rqstp->rq_vers, rqstp->rq_proc);
@@ -515,7 +515,7 @@ nfsd_dispatch(struct svc_rqst *rqstp, u32 *statp)
 
         /* Decode arguments */
         xdr = proc->pc_decode;
-        if (xdr && !xdr(rqstp, (u32*)rqstp->rq_arg.head[0].iov_base,
+        if (xdr && !xdr(rqstp, (__be32*)rqstp->rq_arg.head[0].iov_base,
                         rqstp->rq_argp)) {
                 dprintk("nfsd: failed to decode arguments!\n");
                 nfsd_cache_update(rqstp, RC_NOCACHE, NULL);
@@ -528,7 +528,7 @@ nfsd_dispatch(struct svc_rqst *rqstp, u32 *statp)
          */
         nfserrp = rqstp->rq_res.head[0].iov_base
                 + rqstp->rq_res.head[0].iov_len;
-        rqstp->rq_res.head[0].iov_len += sizeof(u32);
+        rqstp->rq_res.head[0].iov_len += sizeof(__be32);
 
         /* Now call the procedure handler, and encode NFS status. */
         nfserr = proc->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c
index 1135c0d14557..56ebb1443e0e 100644
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -37,8 +37,8 @@ static u32	nfs_ftypes[] = {
 /*
  * XDR functions for basic NFS types
  */
-static u32 *
-decode_fh(u32 *p, struct svc_fh *fhp)
+static __be32 *
+decode_fh(__be32 *p, struct svc_fh *fhp)
 {
         fh_init(fhp, NFS_FHSIZE);
         memcpy(&fhp->fh_handle.fh_base, p, NFS_FHSIZE);
@@ -50,13 +50,13 @@ decode_fh(u32 *p, struct svc_fh *fhp)
 }
 
 /* Helper function for NFSv2 ACL code */
-u32 *nfs2svc_decode_fh(u32 *p, struct svc_fh *fhp)
+__be32 *nfs2svc_decode_fh(__be32 *p, struct svc_fh *fhp)
 {
         return decode_fh(p, fhp);
 }
 
-static inline u32 *
-encode_fh(u32 *p, struct svc_fh *fhp)
+static inline __be32 *
+encode_fh(__be32 *p, struct svc_fh *fhp)
 {
         memcpy(p, &fhp->fh_handle.fh_base, NFS_FHSIZE);
         return p + (NFS_FHSIZE>> 2);
@@ -66,8 +66,8 @@ encode_fh(u32 *p, struct svc_fh *fhp)
  * Decode a file name and make sure that the path contains
  * no slashes or null bytes.
  */
-static inline u32 *
-decode_filename(u32 *p, char **namp, int *lenp)
+static inline __be32 *
+decode_filename(__be32 *p, char **namp, int *lenp)
 {
         char            *name;
         int             i;
@@ -82,8 +82,8 @@ decode_filename(u32 *p, char **namp, int *lenp)
         return p;
 }
 
-static inline u32 *
-decode_pathname(u32 *p, char **namp, int *lenp)
+static inline __be32 *
+decode_pathname(__be32 *p, char **namp, int *lenp)
 {
         char            *name;
         int             i;
@@ -98,8 +98,8 @@ decode_pathname(u32 *p, char **namp, int *lenp)
         return p;
 }
 
-static inline u32 *
-decode_sattr(u32 *p, struct iattr *iap)
+static inline __be32 *
+decode_sattr(__be32 *p, struct iattr *iap)
 {
         u32     tmp, tmp1;
 
@@ -151,8 +151,8 @@ decode_sattr(u32 *p, struct iattr *iap)
         return p;
 }
 
-static u32 *
-encode_fattr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp,
+static __be32 *
+encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp,
              struct kstat *stat)
 {
         struct dentry   *dentry = fhp->fh_dentry;
@@ -195,7 +195,7 @@ encode_fattr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp,
 }
 
 /* Helper function for NFSv2 ACL code */
-u32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
+__be32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp)
 {
         struct kstat stat;
         vfs_getattr(fhp->fh_export->ex_mnt, fhp->fh_dentry, &stat);
@@ -206,13 +206,13 @@ u32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp)
  * XDR decode functions
  */
 int
-nfssvc_decode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nfssvc_decode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_argsize_check(rqstp, p);
 }
 
 int
-nfssvc_decode_fhandle(struct svc_rqst *rqstp, u32 *p, struct nfsd_fhandle *args)
+nfssvc_decode_fhandle(struct svc_rqst *rqstp, __be32 *p, struct nfsd_fhandle *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
                 return 0;
@@ -220,7 +220,7 @@ nfssvc_decode_fhandle(struct svc_rqst *rqstp, u32 *p, struct nfsd_fhandle *args)
 }
 
 int
-nfssvc_decode_sattrargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_sattrargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_sattrargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -231,7 +231,7 @@ nfssvc_decode_sattrargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_diropargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_diropargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_diropargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -242,7 +242,7 @@ nfssvc_decode_diropargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_readargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_readargs *args)
 {
         unsigned int len;
@@ -273,7 +273,7 @@ nfssvc_decode_readargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_writeargs *args)
 {
         unsigned int len;
@@ -303,7 +303,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_createargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_createargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_createargs *args)
 {
         if (!(p = decode_fh(p, &args->fh))
@@ -315,7 +315,7 @@ nfssvc_decode_createargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_renameargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_renameargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_renameargs *args)
 {
         if (!(p = decode_fh(p, &args->ffh))
@@ -328,7 +328,7 @@ nfssvc_decode_renameargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, u32 *p, struct nfsd_readlinkargs *args)
+nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, __be32 *p, struct nfsd_readlinkargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
                 return 0;
@@ -338,7 +338,7 @@ nfssvc_decode_readlinkargs(struct svc_rqst *rqstp, u32 *p, struct nfsd_readlinka
 }
 
 int
-nfssvc_decode_linkargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_linkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_linkargs *args)
 {
         if (!(p = decode_fh(p, &args->ffh))
@@ -350,7 +350,7 @@ nfssvc_decode_linkargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_symlinkargs *args)
 {
         if (!(p = decode_fh(p, &args->ffh))
@@ -363,7 +363,7 @@ nfssvc_decode_symlinkargs(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_decode_readdirargs(struct svc_rqst *rqstp, u32 *p,
+nfssvc_decode_readdirargs(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_readdirargs *args)
 {
         if (!(p = decode_fh(p, &args->fh)))
@@ -382,13 +382,13 @@ nfssvc_decode_readdirargs(struct svc_rqst *rqstp, u32 *p,
  * XDR encode functions
  */
 int
-nfssvc_encode_void(struct svc_rqst *rqstp, u32 *p, void *dummy)
+nfssvc_encode_void(struct svc_rqst *rqstp, __be32 *p, void *dummy)
 {
         return xdr_ressize_check(rqstp, p);
 }
 
 int
-nfssvc_encode_attrstat(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_attrstat(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_attrstat *resp)
 {
         p = encode_fattr(rqstp, p, &resp->fh, &resp->stat);
@@ -396,7 +396,7 @@ nfssvc_encode_attrstat(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_encode_diropres(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_diropres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_diropres *resp)
 {
         p = encode_fh(p, &resp->fh);
@@ -405,7 +405,7 @@ nfssvc_encode_diropres(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_encode_readlinkres(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_readlinkres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_readlinkres *resp)
 {
         *p++ = htonl(resp->len);
@@ -421,7 +421,7 @@ nfssvc_encode_readlinkres(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_encode_readres(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_readres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_readres *resp)
 {
         p = encode_fattr(rqstp, p, &resp->fh, &resp->stat);
@@ -440,7 +440,7 @@ nfssvc_encode_readres(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_encode_readdirres(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_readdirres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_readdirres *resp)
 {
         xdr_ressize_check(rqstp, p);
@@ -453,7 +453,7 @@ nfssvc_encode_readdirres(struct svc_rqst *rqstp, u32 *p,
 }
 
 int
-nfssvc_encode_statfsres(struct svc_rqst *rqstp, u32 *p,
+nfssvc_encode_statfsres(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_statfsres *resp)
 {
         struct kstatfs  *stat = &resp->stats;
@@ -471,7 +471,7 @@ nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
                     int namlen, loff_t offset, ino_t ino, unsigned int d_type)
 {
         struct nfsd_readdirres *cd = container_of(ccd, struct nfsd_readdirres, common);
-        u32     *p = cd->buffer;
+        __be32  *p = cd->buffer;
         int     buflen, slen;
 
         /*
@@ -497,7 +497,7 @@ nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
         *p++ = htonl((u32) ino);                /* file id */
         p    = xdr_encode_array(p, name, namlen);/* name length & name */
         cd->offset = p;                 /* remember pointer */
-        *p++ = ~(u32) 0;                /* offset of next entry */
+        *p++ = htonl(~0U);              /* offset of next entry */
 
         cd->buflen = buflen;
         cd->buffer = p;
@@ -509,7 +509,7 @@ nfssvc_encode_entry(struct readdir_cd *ccd, const char *name,
  * XDR release functions
  */
 int
-nfssvc_release_fhandle(struct svc_rqst *rqstp, u32 *p,
+nfssvc_release_fhandle(struct svc_rqst *rqstp, __be32 *p,
                                         struct nfsd_fhandle *resp)
 {
         fh_put(&resp->fh);
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 1141bd29e4e3..bb4d926e4487 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -110,7 +110,7 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
         struct dentry *dentry = *dpp;
         struct vfsmount *mnt = mntget(exp->ex_mnt);
         struct dentry *mounts = dget(dentry);
-        int err = nfs_ok;
+        int err = 0;
 
         while (follow_down(&mnt,&mounts)&&d_mountpoint(mounts));
 
@@ -148,14 +148,15 @@ out:
  *   clients and is explicitly disallowed for NFSv3
  *      NeilBrown <neilb@cse.unsw.edu.au>
  */
-int
+__be32
 nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
                                         int len, struct svc_fh *resfh)
 {
         struct svc_export       *exp;
         struct dentry           *dparent;
         struct dentry           *dentry;
-        int                     err;
+        __be32                  err;
+        int                     host_err;
 
         dprintk("nfsd: nfsd_lookup(fh %s, %.*s)\n", SVCFH_fmt(fhp), len,name);
 
@@ -193,7 +194,7 @@ nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
                         exp2 = exp_parent(exp->ex_client, mnt, dentry,
                                           &rqstp->rq_chandle);
                         if (IS_ERR(exp2)) {
-                                err = PTR_ERR(exp2);
+                                host_err = PTR_ERR(exp2);
                                 dput(dentry);
                                 mntput(mnt);
                                 goto out_nfserr;
@@ -210,14 +211,14 @@ nfsd_lookup(struct svc_rqst *rqstp, struct svc_fh *fhp, const char *name,
         } else {
                 fh_lock(fhp);
                 dentry = lookup_one_len(name, dparent, len);
-                err = PTR_ERR(dentry);
+                host_err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))
                         goto out_nfserr;
                 /*
                  * check if we have crossed a mount point ...
                  */
                 if (d_mountpoint(dentry)) {
-                        if ((err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
+                        if ((host_err = nfsd_cross_mnt(rqstp, &dentry, &exp))) {
                                 dput(dentry);
                                 goto out_nfserr;
                         }
@@ -236,7 +237,7 @@ out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 
@@ -244,7 +245,7 @@ out_nfserr:
  * Set various file attributes.
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
              int check_guard, time_t guardtime)
 {
@@ -253,7 +254,8 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         int             accmode = MAY_SATTR;
         int             ftype = 0;
         int             imode;
-        int             err;
+        __be32          err;
+        int             host_err;
         int             size_change = 0;
 
         if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
@@ -319,19 +321,19 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
                  * If we are changing the size of the file, then
                  * we need to break all leases.
                  */
-                err = break_lease(inode, FMODE_WRITE | O_NONBLOCK);
-                if (err == -EWOULDBLOCK)
-                        err = -ETIMEDOUT;
-                if (err) /* ENOMEM or EWOULDBLOCK */
+                host_err = break_lease(inode, FMODE_WRITE | O_NONBLOCK);
+                if (host_err == -EWOULDBLOCK)
+                        host_err = -ETIMEDOUT;
+                if (host_err) /* ENOMEM or EWOULDBLOCK */
                         goto out_nfserr;
 
-                err = get_write_access(inode);
-                if (err)
+                host_err = get_write_access(inode);
+                if (host_err)
                         goto out_nfserr;
 
                 size_change = 1;
-                err = locks_verify_truncate(inode, NULL, iap->ia_size);
-                if (err) {
+                host_err = locks_verify_truncate(inode, NULL, iap->ia_size);
+                if (host_err) {
                         put_write_access(inode);
                         goto out_nfserr;
                 }
@@ -357,8 +359,8 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
         err = nfserr_notsync;
         if (!check_guard || guardtime == inode->i_ctime.tv_sec) {
                 fh_lock(fhp);
-                err = notify_change(dentry, iap);
-                err = nfserrno(err);
+                host_err = notify_change(dentry, iap);
+                err = nfserrno(host_err);
                 fh_unlock(fhp);
         }
         if (size_change)
@@ -370,7 +372,7 @@ out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 
@@ -420,11 +422,12 @@ out:
         return error;
 }
 
-int
+__be32
 nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
     struct nfs4_acl *acl)
 {
-        int error;
+        __be32 error;
+        int host_error;
         struct dentry *dentry;
         struct inode *inode;
         struct posix_acl *pacl = NULL, *dpacl = NULL;
@@ -440,20 +443,20 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (S_ISDIR(inode->i_mode))
                 flags = NFS4_ACL_DIR;
 
-        error = nfs4_acl_nfsv4_to_posix(acl, &pacl, &dpacl, flags);
-        if (error == -EINVAL) {
+        host_error = nfs4_acl_nfsv4_to_posix(acl, &pacl, &dpacl, flags);
+        if (host_error == -EINVAL) {
                 error = nfserr_attrnotsupp;
                 goto out;
-        } else if (error < 0)
+        } else if (host_error < 0)
                 goto out_nfserr;
 
-        error = set_nfsv4_acl_one(dentry, pacl, POSIX_ACL_XATTR_ACCESS);
-        if (error < 0)
+        host_error = set_nfsv4_acl_one(dentry, pacl, POSIX_ACL_XATTR_ACCESS);
+        if (host_error < 0)
                 goto out_nfserr;
 
         if (S_ISDIR(inode->i_mode)) {
-                error = set_nfsv4_acl_one(dentry, dpacl, POSIX_ACL_XATTR_DEFAULT);
-                if (error < 0)
+                host_error = set_nfsv4_acl_one(dentry, dpacl, POSIX_ACL_XATTR_DEFAULT);
+                if (host_error < 0)
                         goto out_nfserr;
         }
 
@@ -464,7 +467,7 @@ out:
         posix_acl_release(dpacl);
         return (error);
 out_nfserr:
-        error = nfserrno(error);
+        error = nfserrno(host_error);
         goto out;
 }
 
@@ -571,14 +574,14 @@ static struct accessmap	nfs3_anyaccess[] = {
     {   0,                      0                               }
 };
 
-int
+__be32
 nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *supported)
 {
         struct accessmap        *map;
         struct svc_export       *export;
         struct dentry           *dentry;
         u32                     query, result = 0, sresult = 0;
-        unsigned int            error;
+        __be32                  error;
 
         error = fh_verify(rqstp, fhp, 0, MAY_NOP);
         if (error)
@@ -598,7 +601,7 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
         query = *access;
         for  (; map->access; map++) {
                 if (map->access & query) {
-                        unsigned int err2;
+                        __be32 err2;
 
                         sresult |= map->access;
 
@@ -637,13 +640,15 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
  * The access argument indicates the type of open (read/write/lock)
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                         int access, struct file **filp)
 {
         struct dentry   *dentry;
         struct inode    *inode;
-        int             flags = O_RDONLY|O_LARGEFILE, err;
+        int             flags = O_RDONLY|O_LARGEFILE;
+        __be32          err;
+        int             host_err;
 
         /*
          * If we get here, then the client has already done an "open",
@@ -673,10 +678,10 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
          * Check to see if there are any leases on this file.
          * This may block while leases are broken.
          */
-        err = break_lease(inode, O_NONBLOCK | ((access & MAY_WRITE) ? FMODE_WRITE : 0));
-        if (err == -EWOULDBLOCK)
-                err = -ETIMEDOUT;
-        if (err) /* NOMEM or WOULDBLOCK */
+        host_err = break_lease(inode, O_NONBLOCK | ((access & MAY_WRITE) ? FMODE_WRITE : 0));
+        if (host_err == -EWOULDBLOCK)
+                host_err = -ETIMEDOUT;
+        if (host_err) /* NOMEM or WOULDBLOCK */
                 goto out_nfserr;
 
         if (access & MAY_WRITE) {
@@ -689,10 +694,9 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         }
         *filp = dentry_open(dget(dentry), mntget(fhp->fh_export->ex_mnt), flags);
         if (IS_ERR(*filp))
-                err = PTR_ERR(*filp);
+                host_err = PTR_ERR(*filp);
 out_nfserr:
-        if (err)
-                err = nfserrno(err);
+        err = nfserrno(host_err);
 out:
         return err;
 }
@@ -830,14 +834,15 @@ nfsd_read_actor(read_descriptor_t *desc, struct page *page, unsigned long offset
         return size;
 }
 
-static int
+static __be32
 nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
               loff_t offset, struct kvec *vec, int vlen, unsigned long *count)
 {
         struct inode *inode;
         struct raparms  *ra;
         mm_segment_t    oldfs;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = nfserr_perm;
         inode = file->f_dentry->d_inode;
@@ -855,12 +860,12 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 
         if (file->f_op->sendfile && rqstp->rq_sendfile_ok) {
                 rqstp->rq_resused = 1;
-                err = file->f_op->sendfile(file, &offset, *count,
+                host_err = file->f_op->sendfile(file, &offset, *count,
                                                  nfsd_read_actor, rqstp);
         } else {
                 oldfs = get_fs();
                 set_fs(KERNEL_DS);
-                err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
+                host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
                 set_fs(oldfs);
         }
 
@@ -874,13 +879,13 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                 spin_unlock(&rab->pb_lock);
         }
 
-        if (err >= 0) {
-                nfsdstats.io_read += err;
-                *count = err;
+        if (host_err >= 0) {
+                nfsdstats.io_read += host_err;
+                *count = host_err;
                 err = 0;
                 fsnotify_access(file->f_dentry);
         } else 
-                err = nfserrno(err);
+                err = nfserrno(host_err);
 out:
         return err;
 }
@@ -895,7 +900,7 @@ static void kill_suid(struct dentry *dentry)
         mutex_unlock(&dentry->d_inode->i_mutex);
 }
 
-static int
+static __be32
 nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                                 loff_t offset, struct kvec *vec, int vlen,
                                 unsigned long cnt, int *stablep)
@@ -904,7 +909,8 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
         struct dentry           *dentry;
         struct inode            *inode;
         mm_segment_t            oldfs;
-        int                     err = 0;
+        __be32                  err = 0;
+        int                     host_err;
         int                     stable = *stablep;
 
 #ifdef MSNFS
@@ -940,18 +946,18 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 
         /* Write the data. */
         oldfs = get_fs(); set_fs(KERNEL_DS);
-        err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+        host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
         set_fs(oldfs);
-        if (err >= 0) {
+        if (host_err >= 0) {
                 nfsdstats.io_write += cnt;
                 fsnotify_modify(file->f_dentry);
         }
 
         /* clear setuid/setgid flag after write */
-        if (err >= 0 && (inode->i_mode & (S_ISUID | S_ISGID)))
+        if (host_err >= 0 && (inode->i_mode & (S_ISUID | S_ISGID)))
                 kill_suid(dentry);
 
-        if (err >= 0 && stable) {
+        if (host_err >= 0 && stable) {
                 static ino_t    last_ino;
                 static dev_t    last_dev;
 
@@ -977,7 +983,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 
                         if (inode->i_state & I_DIRTY) {
                                 dprintk("nfsd: write sync %d\n", current->pid);
-                                err=nfsd_sync(file);
+                                host_err=nfsd_sync(file);
                         }
 #if 0
                         wake_up(&inode->i_wait);
@@ -987,11 +993,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                 last_dev = inode->i_sb->s_dev;
         }
 
-        dprintk("nfsd: write complete err=%d\n", err);
-        if (err >= 0)
+        dprintk("nfsd: write complete host_err=%d\n", host_err);
+        if (host_err >= 0)
                 err = 0;
         else 
-                err = nfserrno(err);
+                err = nfserrno(host_err);
 out:
         return err;
 }
@@ -1001,12 +1007,12 @@ out:
  * on entry. On return, *count contains the number of bytes actually read.
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                 loff_t offset, struct kvec *vec, int vlen,
                 unsigned long *count)
 {
-        int             err;
+        __be32          err;
 
         if (file) {
                 err = nfsd_permission(fhp->fh_export, fhp->fh_dentry,
@@ -1030,12 +1036,12 @@ out:
  * The stable flag requests synchronous writes.
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
                 loff_t offset, struct kvec *vec, int vlen, unsigned long cnt,
                 int *stablep)
 {
-        int                     err = 0;
+        __be32                  err = 0;
 
         if (file) {
                 err = nfsd_permission(fhp->fh_export, fhp->fh_dentry,
@@ -1067,12 +1073,12 @@ out:
  * Unfortunately we cannot lock the file to make sure we return full WCC
  * data to the client, as locking happens lower down in the filesystem.
  */
-int
+__be32
 nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
                loff_t offset, unsigned long count)
 {
         struct file     *file;
-        int             err;
+        __be32          err;
 
         if ((u64)count > ~(u64)offset)
                 return nfserr_inval;
@@ -1100,14 +1106,15 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp,
  *
  * N.B. Every call to nfsd_create needs an fh_put for _both_ fhp and resfhp
  */
-int
+__be32
 nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 char *fname, int flen, struct iattr *iap,
                 int type, dev_t rdev, struct svc_fh *resfhp)
 {
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = nfserr_perm;
         if (!flen)
@@ -1134,7 +1141,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 /* called from nfsd_proc_mkdir, or possibly nfsd3_proc_create */
                 fh_lock_nested(fhp, I_MUTEX_PARENT);
                 dchild = lookup_one_len(fname, dentry, flen);
-                err = PTR_ERR(dchild);
+                host_err = PTR_ERR(dchild);
                 if (IS_ERR(dchild))
                         goto out_nfserr;
                 err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
@@ -1170,25 +1177,25 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         /*
          * Get the dir op function pointer.
          */
-        err = nfserr_perm;
+        err = 0;
         switch (type) {
         case S_IFREG:
-                err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
+                host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
                 break;
         case S_IFDIR:
-                err = vfs_mkdir(dirp, dchild, iap->ia_mode);
+                host_err = vfs_mkdir(dirp, dchild, iap->ia_mode);
                 break;
         case S_IFCHR:
         case S_IFBLK:
         case S_IFIFO:
         case S_IFSOCK:
-                err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
+                host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
                 break;
         default:
                 printk("nfsd: bad file type %o in nfsd_create\n", type);
-                err = -EINVAL;
+                host_err = -EINVAL;
         }
-        if (err < 0)
+        if (host_err < 0)
                 goto out_nfserr;
 
         if (EX_ISSYNC(fhp->fh_export)) {
@@ -1203,7 +1210,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
          * directories via NFS.
          */
         if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID|ATTR_MODE)) != 0) {
-                int err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
+                __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
                 if (err2)
                         err = err2;
         }
@@ -1218,7 +1225,7 @@ out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 
@@ -1226,15 +1233,16 @@ out_nfserr:
 /*
  * NFSv3 version of nfsd_create
  */
-int
+__be32
 nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 char *fname, int flen, struct iattr *iap,
                 struct svc_fh *resfhp, int createmode, u32 *verifier,
-                int *truncp)
+                int *truncp, int *created)
 {
         struct dentry   *dentry, *dchild = NULL;
         struct inode    *dirp;
-        int             err;
+        __be32          err;
+        int             host_err;
         __u32           v_mtime=0, v_atime=0;
         int             v_mode=0;
 
@@ -1264,7 +1272,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
          * Compose the response file handle.
          */
         dchild = lookup_one_len(fname, dentry, flen);
-        err = PTR_ERR(dchild);
+        host_err = PTR_ERR(dchild);
         if (IS_ERR(dchild))
                 goto out_nfserr;
 
@@ -1320,9 +1328,11 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
                 goto out;
         }
 
-        err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
-        if (err < 0)
+        host_err = vfs_create(dirp, dchild, iap->ia_mode, NULL);
+        if (host_err < 0)
                 goto out_nfserr;
+        if (created)
+                *created = 1;
 
         if (EX_ISSYNC(fhp->fh_export)) {
                 err = nfserrno(nfsd_sync_dir(dentry));
@@ -1350,7 +1360,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
          */
  set_attr:
         if ((iap->ia_valid &= ~(ATTR_UID|ATTR_GID)) != 0) {
-                int err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
+                __be32 err2 = nfsd_setattr(rqstp, resfhp, iap, 0, (time_t)0);
                 if (err2)
                         err = err2;
         }
@@ -1368,7 +1378,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
         return err;
  
  out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 #endif /* CONFIG_NFSD_V3 */
@@ -1378,13 +1388,14 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
  * fits into the buffer. On return, it contains the true length.
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
 {
         struct dentry   *dentry;
         struct inode    *inode;
         mm_segment_t    oldfs;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = fh_verify(rqstp, fhp, S_IFLNK, MAY_NOP);
         if (err)
@@ -1403,18 +1414,18 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
          */
 
         oldfs = get_fs(); set_fs(KERNEL_DS);
-        err = inode->i_op->readlink(dentry, buf, *lenp);
+        host_err = inode->i_op->readlink(dentry, buf, *lenp);
         set_fs(oldfs);
 
-        if (err < 0)
+        if (host_err < 0)
                 goto out_nfserr;
-        *lenp = err;
+        *lenp = host_err;
         err = 0;
 out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 
@@ -1422,7 +1433,7 @@ out_nfserr:
  * Create a symlink and look up its inode
  * N.B. After this call _both_ fhp and resfhp need an fh_put
  */
-int
+__be32
 nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
                                 char *fname, int flen,
                                 char *path,  int plen,
@@ -1430,7 +1441,8 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
                                 struct iattr *iap)
 {
         struct dentry   *dentry, *dnew;
-        int             err, cerr;
+        __be32          err, cerr;
+        int             host_err;
         umode_t         mode;
 
         err = nfserr_noent;
@@ -1446,7 +1458,7 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
         fh_lock(fhp);
         dentry = fhp->fh_dentry;
         dnew = lookup_one_len(fname, dentry, flen);
-        err = PTR_ERR(dnew);
+        host_err = PTR_ERR(dnew);
         if (IS_ERR(dnew))
                 goto out_nfserr;
 
@@ -1458,21 +1470,21 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (unlikely(path[plen] != 0)) {
                 char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
                 if (path_alloced == NULL)
-                        err = -ENOMEM;
+                        host_err = -ENOMEM;
                 else {
                         strncpy(path_alloced, path, plen);
                         path_alloced[plen] = 0;
-                        err = vfs_symlink(dentry->d_inode, dnew, path_alloced, mode);
+                        host_err = vfs_symlink(dentry->d_inode, dnew, path_alloced, mode);
                         kfree(path_alloced);
                 }
         } else
-                err = vfs_symlink(dentry->d_inode, dnew, path, mode);
+                host_err = vfs_symlink(dentry->d_inode, dnew, path, mode);
 
-        if (!err)
+        if (!host_err) {
                 if (EX_ISSYNC(fhp->fh_export))
-                        err = nfsd_sync_dir(dentry);
-        if (err)
-                err = nfserrno(err);
+                        host_err = nfsd_sync_dir(dentry);
+        }
+        err = nfserrno(host_err);
         fh_unlock(fhp);
 
         cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
@@ -1482,7 +1494,7 @@ out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out;
 }
 
@@ -1490,13 +1502,14 @@ out_nfserr:
  * Create a hardlink
  * N.B. After this call _both_ ffhp and tfhp need an fh_put
  */
-int
+__be32
 nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
                                 char *name, int len, struct svc_fh *tfhp)
 {
         struct dentry   *ddir, *dnew, *dold;
         struct inode    *dirp, *dest;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = fh_verify(rqstp, ffhp, S_IFDIR, MAY_CREATE);
         if (err)
@@ -1517,24 +1530,25 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
         dirp = ddir->d_inode;
 
         dnew = lookup_one_len(name, ddir, len);
-        err = PTR_ERR(dnew);
+        host_err = PTR_ERR(dnew);
         if (IS_ERR(dnew))
                 goto out_nfserr;
 
         dold = tfhp->fh_dentry;
         dest = dold->d_inode;
 
-        err = vfs_link(dold, dirp, dnew);
-        if (!err) {
+        host_err = vfs_link(dold, dirp, dnew);
+        if (!host_err) {
                 if (EX_ISSYNC(ffhp->fh_export)) {
                         err = nfserrno(nfsd_sync_dir(ddir));
                         write_inode_now(dest, 1);
                 }
+                err = 0;
         } else {
-                if (err == -EXDEV && rqstp->rq_vers == 2)
+                if (host_err == -EXDEV && rqstp->rq_vers == 2)
                         err = nfserr_acces;
                 else
-                        err = nfserrno(err);
+                        err = nfserrno(host_err);
         }
 
         dput(dnew);
@@ -1544,7 +1558,7 @@ out:
         return err;
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
         goto out_unlock;
 }
 
@@ -1552,13 +1566,14 @@ out_nfserr:
  * Rename a file
  * N.B. After this call _both_ ffhp and tfhp need an fh_put
  */
-int
+__be32
 nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
                             struct svc_fh *tfhp, char *tname, int tlen)
 {
         struct dentry   *fdentry, *tdentry, *odentry, *ndentry, *trap;
         struct inode    *fdir, *tdir;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = fh_verify(rqstp, ffhp, S_IFDIR, MAY_REMOVE);
         if (err)
@@ -1589,22 +1604,22 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
         fill_pre_wcc(tfhp);
 
         odentry = lookup_one_len(fname, fdentry, flen);
-        err = PTR_ERR(odentry);
+        host_err = PTR_ERR(odentry);
         if (IS_ERR(odentry))
                 goto out_nfserr;
 
-        err = -ENOENT;
+        host_err = -ENOENT;
         if (!odentry->d_inode)
                 goto out_dput_old;
-        err = -EINVAL;
+        host_err = -EINVAL;
         if (odentry == trap)
                 goto out_dput_old;
 
         ndentry = lookup_one_len(tname, tdentry, tlen);
-        err = PTR_ERR(ndentry);
+        host_err = PTR_ERR(ndentry);
         if (IS_ERR(ndentry))
                 goto out_dput_old;
-        err = -ENOTEMPTY;
+        host_err = -ENOTEMPTY;
         if (ndentry == trap)
                 goto out_dput_new;
 
@@ -1612,14 +1627,14 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
         if ((ffhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
                 ((atomic_read(&odentry->d_count) > 1)
                  || (atomic_read(&ndentry->d_count) > 1))) {
-                        err = -EPERM;
+                        host_err = -EPERM;
         } else
 #endif
-        err = vfs_rename(fdir, odentry, tdir, ndentry);
-        if (!err && EX_ISSYNC(tfhp->fh_export)) {
-                err = nfsd_sync_dir(tdentry);
-                if (!err)
-                        err = nfsd_sync_dir(fdentry);
+        host_err = vfs_rename(fdir, odentry, tdir, ndentry);
+        if (!host_err && EX_ISSYNC(tfhp->fh_export)) {
+                host_err = nfsd_sync_dir(tdentry);
+                if (!host_err)
+                        host_err = nfsd_sync_dir(fdentry);
         }
 
  out_dput_new:
@@ -1627,8 +1642,7 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen,
  out_dput_old:
         dput(odentry);
  out_nfserr:
-        if (err)
-                err = nfserrno(err);
+        err = nfserrno(host_err);
 
         /* we cannot reply on fh_unlock on the two filehandles,
          * as that would do the wrong thing if the two directories
@@ -1647,13 +1661,14 @@ out:
  * Unlink a file or directory
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                                 char *fname, int flen)
 {
         struct dentry   *dentry, *rdentry;
         struct inode    *dirp;
-        int             err;
+        __be32          err;
+        int             host_err;
 
         err = nfserr_acces;
         if (!flen || isdotent(fname, flen))
@@ -1667,7 +1682,7 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
         dirp = dentry->d_inode;
 
         rdentry = lookup_one_len(fname, dentry, flen);
-        err = PTR_ERR(rdentry);
+        host_err = PTR_ERR(rdentry);
         if (IS_ERR(rdentry))
                 goto out_nfserr;
 
@@ -1684,22 +1699,23 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
 #ifdef MSNFS
                 if ((fhp->fh_export->ex_flags & NFSEXP_MSNFS) &&
                         (atomic_read(&rdentry->d_count) > 1)) {
-                        err = -EPERM;
+                        host_err = -EPERM;
                 } else
 #endif
-                err = vfs_unlink(dirp, rdentry);
+                host_err = vfs_unlink(dirp, rdentry);
         } else { /* It's RMDIR */
-                err = vfs_rmdir(dirp, rdentry);
+                host_err = vfs_rmdir(dirp, rdentry);
         }
 
         dput(rdentry);
 
-        if (err == 0 &&
-            EX_ISSYNC(fhp->fh_export))
-                        err = nfsd_sync_dir(dentry);
+        if (host_err)
+                goto out_nfserr;
+        if (EX_ISSYNC(fhp->fh_export))
+                host_err = nfsd_sync_dir(dentry);
 
 out_nfserr:
-        err = nfserrno(err);
+        err = nfserrno(host_err);
 out:
         return err;
 }
@@ -1708,11 +1724,12 @@ out:
  * Read entries from a directory.
  * The  NFSv3/4 verifier we ignore for now.
  */
-int
+__be32
 nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp, 
              struct readdir_cd *cdp, encode_dent_fn func)
 {
-        int             err;
+        __be32          err;
+        int             host_err;
         struct file     *file;
         loff_t          offset = *offsetp;
 
@@ -1734,10 +1751,10 @@ nfsd_readdir(struct svc_rqst *rqstp, struct svc_fh *fhp, loff_t *offsetp,
 
         do {
                 cdp->err = nfserr_eof; /* will be cleared on successful read */
-                err = vfs_readdir(file, (filldir_t) func, cdp);
-        } while (err >=0 && cdp->err == nfs_ok);
-        if (err)
-                err = nfserrno(err);
+                host_err = vfs_readdir(file, (filldir_t) func, cdp);
+        } while (host_err >=0 && cdp->err == nfs_ok);
+        if (host_err)
+                err = nfserrno(host_err);
         else
                 err = cdp->err;
         *offsetp = vfs_llseek(file, 0, 1);
@@ -1754,10 +1771,10 @@ out:
  * Get file system stats
  * N.B. After this call fhp needs an fh_put
  */
-int
+__be32
 nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat)
 {
-        int err = fh_verify(rqstp, fhp, 0, MAY_NOP);
+        __be32 err = fh_verify(rqstp, fhp, 0, MAY_NOP);
         if (!err && vfs_statfs(fhp->fh_dentry,stat))
                 err = nfserr_io;
         return err;
@@ -1766,7 +1783,7 @@ nfsd_statfs(struct svc_rqst *rqstp, struct svc_fh *fhp, struct kstatfs *stat)
 /*
  * Check for a user's access permissions to this inode.
  */
-int
+__be32
 nfsd_permission(struct svc_export *exp, struct dentry *dentry, int acc)
 {
         struct inode    *inode = dentry->d_inode;
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index e1fceb8aa32d..d11753c50bc1 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -152,14 +152,16 @@ static struct o2nm_node *o2nm_node_ip_tree_lookup(struct o2nm_cluster *cluster,
         struct o2nm_node *node, *ret = NULL;
 
         while (*p) {
+                int cmp;
+
                 parent = *p;
                 node = rb_entry(parent, struct o2nm_node, nd_ip_node);
 
-                if (memcmp(&ip_needle, &node->nd_ipv4_address,
-                           sizeof(ip_needle)) < 0)
+                cmp = memcmp(&ip_needle, &node->nd_ipv4_address,
+                                sizeof(ip_needle));
+                if (cmp < 0)
                         p = &(*p)->rb_left;
-                else if (memcmp(&ip_needle, &node->nd_ipv4_address,
-                                sizeof(ip_needle)) > 0)
+                else if (cmp > 0)
                         p = &(*p)->rb_right;
                 else {
                         ret = node;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index d9ba0a931a03..1be74c4e7814 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -30,6 +30,7 @@
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
 #include <linux/uio.h>
+#include <linux/sched.h>
 
 #define MLOG_MASK_PREFIX ML_INODE
 #include <cluster/masklog.h>
@@ -691,6 +692,12 @@ static int ocfs2_zero_extend(struct inode *inode,
                 }
 
                 start_off += sb->s_blocksize;
+
+                /*
+                 * Very large extends have the potential to lock up
+                 * the cpu for extended periods of time.
+                 */
+                cond_resched();
         }
 
 out:
@@ -728,31 +735,36 @@ static int ocfs2_extend_file(struct inode *inode,
         clusters_to_add = ocfs2_clusters_for_bytes(inode->i_sb, new_i_size) - 
                 OCFS2_I(inode)->ip_clusters;
 
-        if (clusters_to_add) {
-                /* 
-                 * protect the pages that ocfs2_zero_extend is going to
-                 * be pulling into the page cache.. we do this before the
-                 * metadata extend so that we don't get into the situation
-                 * where we've extended the metadata but can't get the data
-                 * lock to zero.
-                 */
-                ret = ocfs2_data_lock(inode, 1);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        goto out;
-                }
+        /* 
+         * protect the pages that ocfs2_zero_extend is going to be
+         * pulling into the page cache.. we do this before the
+         * metadata extend so that we don't get into the situation
+         * where we've extended the metadata but can't get the data
+         * lock to zero.
+         */
+        ret = ocfs2_data_lock(inode, 1);
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out;
+        }
 
+        if (clusters_to_add) {
                 ret = ocfs2_extend_allocation(inode, clusters_to_add);
                 if (ret < 0) {
                         mlog_errno(ret);
                         goto out_unlock;
                 }
+        }
 
-                ret = ocfs2_zero_extend(inode, (u64)new_i_size - tail_to_skip);
-                if (ret < 0) {
-                        mlog_errno(ret);
-                        goto out_unlock;
-                }
+        /*
+         * Call this even if we don't add any clusters to the tree. We
+         * still need to zero the area between the old i_size and the
+         * new i_size.
+         */
+        ret = ocfs2_zero_extend(inode, (u64)new_i_size - tail_to_skip);
+        if (ret < 0) {
+                mlog_errno(ret);
+                goto out_unlock;
         }
 
         if (!tail_to_skip) {
@@ -764,8 +776,7 @@ static int ocfs2_extend_file(struct inode *inode,
         }
 
 out_unlock:
-        if (clusters_to_add) /* this is the only case in which we lock */
-                ocfs2_data_unlock(inode, 1);
+        ocfs2_data_unlock(inode, 1);
 
 out:
         return ret;
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index 259155f0eb2e..a57b751d4f40 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1085,14 +1085,6 @@ static int ocfs2_rename(struct inode *old_dir,
                         BUG();
         }
 
-        if (atomic_read(&old_dentry->d_count) > 2) {
-                shrink_dcache_parent(old_dentry);
-                if (atomic_read(&old_dentry->d_count) > 2) {
-                        status = -EBUSY;
-                        goto bail;
-                }
-        }
-
         /* Assume a directory heirarchy thusly:
          * a/b/c
          * a/d
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 4c29cd7cc8e6..76b46ebbb10c 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -339,7 +339,7 @@ static unsigned long long ocfs2_max_file_offset(unsigned int blockshift)
 
 #if BITS_PER_LONG == 32
 # if defined(CONFIG_LBD)
-        BUG_ON(sizeof(sector_t) != 8);
+        BUILD_BUG_ON(sizeof(sector_t) != 8);
         pagefactor = PAGE_CACHE_SIZE;
         bitshift = BITS_PER_LONG;
 # else
diff --git a/fs/partitions/check.c b/fs/partitions/check.c
index 51c6a748df49..6fb4b6150d77 100644
--- a/fs/partitions/check.c
+++ b/fs/partitions/check.c
@@ -376,18 +376,48 @@ static char *make_block_name(struct gendisk *disk)
         return name;
 }
 
-static void disk_sysfs_symlinks(struct gendisk *disk)
+static int disk_sysfs_symlinks(struct gendisk *disk)
 {
         struct device *target = get_device(disk->driverfs_dev);
+        int err;
+        char *disk_name = NULL;
+
         if (target) {
-                char *disk_name = make_block_name(disk);
-                sysfs_create_link(&disk->kobj,&target->kobj,"device");
-                if (disk_name) {
-                        sysfs_create_link(&target->kobj,&disk->kobj,disk_name);
-                        kfree(disk_name);
+                disk_name = make_block_name(disk);
+                if (!disk_name) {
+                        err = -ENOMEM;
+                        goto err_out;
                 }
+
+                err = sysfs_create_link(&disk->kobj, &target->kobj, "device");
+                if (err)
+                        goto err_out_disk_name;
+
+                err = sysfs_create_link(&target->kobj, &disk->kobj, disk_name);
+                if (err)
+                        goto err_out_dev_link;
         }
-        sysfs_create_link(&disk->kobj, &block_subsys.kset.kobj, "subsystem");
+
+        err = sysfs_create_link(&disk->kobj, &block_subsys.kset.kobj,
+                                "subsystem");
+        if (err)
+                goto err_out_disk_name_lnk;
+
+        kfree(disk_name);
+
+        return 0;
+
+err_out_disk_name_lnk:
+        if (target) {
+                sysfs_remove_link(&target->kobj, disk_name);
+err_out_dev_link:
+                sysfs_remove_link(&disk->kobj, "device");
+err_out_disk_name:
+                kfree(disk_name);
+err_out:
+                put_device(target);
+        }
+        return err;
 }
 
 /* Not exported, helper to add_disk(). */
@@ -406,7 +436,11 @@ void register_disk(struct gendisk *disk)
                 *s = '!';
         if ((err = kobject_add(&disk->kobj)))
                 return;
-        disk_sysfs_symlinks(disk);
+        err = disk_sysfs_symlinks(disk);
+        if (err) {
+                kobject_del(&disk->kobj);
+                return;
+        }
         disk_sysfs_add_subdirs(disk);
 
         /* No minors to use for partitions */
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 82da55b5cffe..8df27401d292 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -72,6 +72,7 @@
 #include <linux/audit.h>
 #include <linux/poll.h>
 #include <linux/nsproxy.h>
+#include <linux/oom.h>
 #include "internal.h"
 
 /* NOTE:
@@ -86,7 +87,7 @@
 
 
 /* Worst case buffer size needed for holding an integer. */
-#define PROC_NUMBUF 10
+#define PROC_NUMBUF 13
 
 struct pid_entry {
         int len;
@@ -689,7 +690,8 @@ static ssize_t oom_adjust_write(struct file *file, const char __user *buf,
         if (copy_from_user(buffer, buf, count))
                 return -EFAULT;
         oom_adjust = simple_strtol(buffer, &end, 0);
-        if ((oom_adjust < -16 || oom_adjust > 15) && oom_adjust != OOM_DISABLE)
+        if ((oom_adjust < OOM_ADJUST_MIN || oom_adjust > OOM_ADJUST_MAX) &&
+             oom_adjust != OOM_DISABLE)
                 return -EINVAL;
         if (*end == '\n')
                 end++;
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index ad8cbc49883a..85ce23268302 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -53,6 +53,7 @@
 #include <linux/workqueue.h>
 #include <linux/writeback.h>
 #include <linux/blkdev.h>
+#include <linux/backing-dev.h>
 
 /* gets a struct reiserfs_journal_list * from a list head */
 #define JOURNAL_LIST_ENTRY(h) (list_entry((h), struct reiserfs_journal_list, \
@@ -970,7 +971,7 @@ int reiserfs_async_progress_wait(struct super_block *s)
         DEFINE_WAIT(wait);
         struct reiserfs_journal *j = SB_JOURNAL(s);
         if (atomic_read(&j->j_async_throttle))
-                blk_congestion_wait(WRITE, HZ / 10);
+                congestion_wait(WRITE, HZ / 10);
         return 0;
 }
 
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index c89aa2338191..17249994110f 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -430,20 +430,29 @@ int remove_save_link(struct inode *inode, int truncate)
         return journal_end(&th, inode->i_sb, JOURNAL_PER_BALANCE_CNT);
 }
 
-static void reiserfs_put_super(struct super_block *s)
+static void reiserfs_kill_sb(struct super_block *s)
 {
-        struct reiserfs_transaction_handle th;
-        th.t_trans_id = 0;
+        if (REISERFS_SB(s)) {
+                if (REISERFS_SB(s)->xattr_root) {
+                        d_invalidate(REISERFS_SB(s)->xattr_root);
+                        dput(REISERFS_SB(s)->xattr_root);
+                        REISERFS_SB(s)->xattr_root = NULL;
+                }
 
-        if (REISERFS_SB(s)->xattr_root) {
-                d_invalidate(REISERFS_SB(s)->xattr_root);
-                dput(REISERFS_SB(s)->xattr_root);
+                if (REISERFS_SB(s)->priv_root) {
+                        d_invalidate(REISERFS_SB(s)->priv_root);
+                        dput(REISERFS_SB(s)->priv_root);
+                        REISERFS_SB(s)->priv_root = NULL;
+                }
         }
 
-        if (REISERFS_SB(s)->priv_root) {
-                d_invalidate(REISERFS_SB(s)->priv_root);
-                dput(REISERFS_SB(s)->priv_root);
-        }
+        kill_block_super(s);
+}
+
+static void reiserfs_put_super(struct super_block *s)
+{
+        struct reiserfs_transaction_handle th;
+        th.t_trans_id = 0;
 
         /* change file system state to current state if it was mounted with read-write permissions */
         if (!(s->s_flags & MS_RDONLY)) {
@@ -1610,6 +1619,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
                       "jmacd-8: reiserfs_fill_super: unable to read bitmap");
                 goto error;
         }
+        errval = -EINVAL;
 #ifdef CONFIG_REISERFS_CHECK
         SWARN(silent, s, "CONFIG_REISERFS_CHECK is set ON");
         SWARN(silent, s, "- it is slow mode for debugging.");
@@ -2156,7 +2166,7 @@ struct file_system_type reiserfs_fs_type = {
         .owner = THIS_MODULE,
         .name = "reiserfs",
         .get_sb = get_super_block,
-        .kill_sb = kill_block_super,
+        .kill_sb = reiserfs_kill_sb,
         .fs_flags = FS_REQUIRES_DEV,
 };
 
diff --git a/fs/splice.c b/fs/splice.c
index 13e92dd19fbb..da74583a00ee 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -74,7 +74,7 @@ static int page_cache_pipe_buf_steal(struct pipe_inode_info *pipe,
                 wait_on_page_writeback(page);
 
                 if (PagePrivate(page))
-                        try_to_release_page(page, mapping_gfp_mask(mapping));
+                        try_to_release_page(page, GFP_KERNEL);
 
                 /*
                  * If we succeeded in removing the mapping, set LRU flag
@@ -333,7 +333,7 @@ __generic_file_splice_read(struct file *in, loff_t *ppos,
                                 break;
 
                         error = add_to_page_cache_lru(page, mapping, index,
-                                              mapping_gfp_mask(mapping));
+                                              GFP_KERNEL);
                         if (unlikely(error)) {
                                 page_cache_release(page);
                                 if (error == -EEXIST)
@@ -557,7 +557,6 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
 {
         struct file *file = sd->file;
         struct address_space *mapping = file->f_mapping;
-        gfp_t gfp_mask = mapping_gfp_mask(mapping);
         unsigned int offset, this_len;
         struct page *page;
         pgoff_t index;
@@ -591,7 +590,7 @@ static int pipe_to_file(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
                         goto find_page;
 
                 page = buf->page;
-                if (add_to_page_cache(page, mapping, index, gfp_mask)) {
+                if (add_to_page_cache(page, mapping, index, GFP_KERNEL)) {
                         unlock_page(page);
                         goto find_page;
                 }
@@ -607,13 +606,13 @@ find_page:
                         ret = -ENOMEM;
                         page = page_cache_alloc_cold(mapping);
                         if (unlikely(!page))
-                                goto out_nomem;
+                                goto out_ret;
 
                         /*
                          * This will also lock the page
                          */
                         ret = add_to_page_cache_lru(page, mapping, index,
-                                                    gfp_mask);
+                                                    GFP_KERNEL);
                         if (unlikely(ret))
                                 goto out;
                 }
@@ -666,7 +665,7 @@ find_page:
                 if (sd->pos + this_len > isize)
                         vmtruncate(mapping->host, isize);
 
-                goto out;
+                goto out_ret;
         }
 
         if (buf->page != page) {
@@ -698,7 +697,7 @@ find_page:
 out:
         page_cache_release(page);
         unlock_page(page);
-out_nomem:
+out_ret:
         return ret;
 }
 
@@ -707,9 +706,9 @@ out_nomem:
  * key here is the 'actor' worker passed in that actually moves the data
  * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
  */
-ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
-                         loff_t *ppos, size_t len, unsigned int flags,
-                         splice_actor *actor)
+static ssize_t __splice_from_pipe(struct pipe_inode_info *pipe,
+                                  struct file *out, loff_t *ppos, size_t len,
+                                  unsigned int flags, splice_actor *actor)
 {
         int ret, do_wakeup, err;
         struct splice_desc sd;
@@ -722,9 +721,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
         sd.file = out;
         sd.pos = *ppos;
 
-        if (pipe->inode)
-                mutex_lock(&pipe->inode->i_mutex);
-
         for (;;) {
                 if (pipe->nrbufs) {
                         struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
@@ -797,9 +793,6 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                 pipe_wait(pipe);
         }
 
-        if (pipe->inode)
-                mutex_unlock(&pipe->inode->i_mutex);
-
         if (do_wakeup) {
                 smp_mb();
                 if (waitqueue_active(&pipe->wait))
@@ -810,6 +803,73 @@ ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
         return ret;
 }
 
+ssize_t splice_from_pipe(struct pipe_inode_info *pipe, struct file *out,
+                         loff_t *ppos, size_t len, unsigned int flags,
+                         splice_actor *actor)
+{
+        ssize_t ret;
+        struct inode *inode = out->f_mapping->host;
+
+        /*
+         * The actor worker might be calling ->prepare_write and
+         * ->commit_write. Most of the time, these expect i_mutex to
+         * be held. Since this may result in an ABBA deadlock with
+         * pipe->inode, we have to order lock acquiry here.
+         */
+        inode_double_lock(inode, pipe->inode);
+        ret = __splice_from_pipe(pipe, out, ppos, len, flags, actor);
+        inode_double_unlock(inode, pipe->inode);
+
+        return ret;
+}
+
+/**
+ * generic_file_splice_write_nolock - generic_file_splice_write without mutexes
+ * @pipe:       pipe info
+ * @out:        file to write to
+ * @len:        number of bytes to splice
+ * @flags:      splice modifier flags
+ *
+ * Will either move or copy pages (determined by @flags options) from
+ * the given pipe inode to the given file. The caller is responsible
+ * for acquiring i_mutex on both inodes.
+ *
+ */
+ssize_t
+generic_file_splice_write_nolock(struct pipe_inode_info *pipe, struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        struct address_space *mapping = out->f_mapping;
+        struct inode *inode = mapping->host;
+        ssize_t ret;
+        int err;
+
+        err = remove_suid(out->f_dentry);
+        if (unlikely(err))
+                return err;
+
+        ret = __splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
+        if (ret > 0) {
+                *ppos += ret;
+
+                /*
+                 * If file or inode is SYNC and we actually wrote some data,
+                 * sync it.
+                 */
+                if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
+                        err = generic_osync_inode(inode, mapping,
+                                                  OSYNC_METADATA|OSYNC_DATA);
+
+                        if (err)
+                                ret = err;
+                }
+        }
+
+        return ret;
+}
+
+EXPORT_SYMBOL(generic_file_splice_write_nolock);
+
 /**
  * generic_file_splice_write - splice data from a pipe to a file
  * @pipe:       pipe info
@@ -826,12 +886,21 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                           loff_t *ppos, size_t len, unsigned int flags)
 {
         struct address_space *mapping = out->f_mapping;
+        struct inode *inode = mapping->host;
         ssize_t ret;
+        int err;
+
+        err = should_remove_suid(out->f_dentry);
+        if (unlikely(err)) {
+                mutex_lock(&inode->i_mutex);
+                err = __remove_suid(out->f_dentry, err);
+                mutex_unlock(&inode->i_mutex);
+                if (err)
+                        return err;
+        }
 
         ret = splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_file);
         if (ret > 0) {
-                struct inode *inode = mapping->host;
-
                 *ppos += ret;
 
                 /*
@@ -839,8 +908,6 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
                  * sync it.
                  */
                 if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(inode))) {
-                        int err;
-
                         mutex_lock(&inode->i_mutex);
                         err = generic_osync_inode(inode, mapping,
                                                   OSYNC_METADATA|OSYNC_DATA);
@@ -1042,6 +1109,19 @@ out_release:
 EXPORT_SYMBOL(do_splice_direct);
 
 /*
+ * After the inode slimming patch, i_pipe/i_bdev/i_cdev share the same
+ * location, so checking ->i_pipe is not enough to verify that this is a
+ * pipe.
+ */
+static inline struct pipe_inode_info *pipe_info(struct inode *inode)
+{
+        if (S_ISFIFO(inode->i_mode))
+                return inode->i_pipe;
+
+        return NULL;
+}
+
+/*
  * Determine where to splice to/from.
  */
 static long do_splice(struct file *in, loff_t __user *off_in,
@@ -1052,7 +1132,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
         loff_t offset, *off;
         long ret;
 
-        pipe = in->f_dentry->d_inode->i_pipe;
+        pipe = pipe_info(in->f_dentry->d_inode);
         if (pipe) {
                 if (off_in)
                         return -ESPIPE;
@@ -1073,7 +1153,7 @@ static long do_splice(struct file *in, loff_t __user *off_in,
                 return ret;
         }
 
-        pipe = out->f_dentry->d_inode->i_pipe;
+        pipe = pipe_info(out->f_dentry->d_inode);
         if (pipe) {
                 if (off_out)
                         return -ESPIPE;
@@ -1231,7 +1311,7 @@ static int get_iovec_page_array(const struct iovec __user *iov,
 static long do_vmsplice(struct file *file, const struct iovec __user *iov,
                         unsigned long nr_segs, unsigned int flags)
 {
-        struct pipe_inode_info *pipe = file->f_dentry->d_inode->i_pipe;
+        struct pipe_inode_info *pipe;
         struct page *pages[PIPE_BUFFERS];
         struct partial_page partial[PIPE_BUFFERS];
         struct splice_pipe_desc spd = {
@@ -1241,7 +1321,8 @@ static long do_vmsplice(struct file *file, const struct iovec __user *iov,
                 .ops = &user_page_pipe_buf_ops,
         };
 
-        if (unlikely(!pipe))
+        pipe = pipe_info(file->f_dentry->d_inode);
+        if (!pipe)
                 return -EBADF;
         if (unlikely(nr_segs > UIO_MAXIOV))
                 return -EINVAL;
@@ -1400,13 +1481,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
          * grabbing by inode address. Otherwise two different processes
          * could deadlock (one doing tee from A -> B, the other from B -> A).
          */
-        if (ipipe->inode < opipe->inode) {
-                mutex_lock_nested(&ipipe->inode->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&opipe->inode->i_mutex, I_MUTEX_CHILD);
-        } else {
-                mutex_lock_nested(&opipe->inode->i_mutex, I_MUTEX_PARENT);
-                mutex_lock_nested(&ipipe->inode->i_mutex, I_MUTEX_CHILD);
-        }
+        inode_double_lock(ipipe->inode, opipe->inode);
 
         do {
                 if (!opipe->readers) {
@@ -1450,8 +1525,7 @@ static int link_pipe(struct pipe_inode_info *ipipe,
                 i++;
         } while (len);
 
-        mutex_unlock(&ipipe->inode->i_mutex);
-        mutex_unlock(&opipe->inode->i_mutex);
+        inode_double_unlock(ipipe->inode, opipe->inode);
 
         /*
          * If we put data in the output pipe, wakeup any potential readers.
@@ -1475,8 +1549,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
 static long do_tee(struct file *in, struct file *out, size_t len,
                    unsigned int flags)
 {
-        struct pipe_inode_info *ipipe = in->f_dentry->d_inode->i_pipe;
-        struct pipe_inode_info *opipe = out->f_dentry->d_inode->i_pipe;
+        struct pipe_inode_info *ipipe = pipe_info(in->f_dentry->d_inode);
+        struct pipe_inode_info *opipe = pipe_info(out->f_dentry->d_inode);
         int ret = -EINVAL;
 
         /*
diff --git a/fs/super.c b/fs/super.c
index aec99ddbe53f..47e554c12e76 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -260,17 +260,17 @@ int fsync_super(struct super_block *sb)
  *      that need destruction out of superblock, call generic_shutdown_super()
  *      and release aforementioned objects.  Note: dentries and inodes _are_
  *      taken care of and do not need specific handling.
+ *
+ *      Upon calling this function, the filesystem may no longer alter or
+ *      rearrange the set of dentries belonging to this super_block, nor may it
+ *      change the attachments of dentries to inodes.
  */
 void generic_shutdown_super(struct super_block *sb)
 {
-        struct dentry *root = sb->s_root;
         struct super_operations *sop = sb->s_op;
 
-        if (root) {
-                sb->s_root = NULL;
-                shrink_dcache_parent(root);
-                shrink_dcache_sb(sb);
-                dput(root);
+        if (sb->s_root) {
+                shrink_dcache_for_umount(sb);
                 fsync_super(sb);
                 lock_super(sb);
                 sb->s_flags &= ~MS_ACTIVE;
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 146f1dedec84..298303b5a716 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -483,17 +483,12 @@ int sysfs_update_file(struct kobject * kobj, const struct attribute * attr)
                     (victim->d_parent->d_inode == dir->d_inode)) {
                         victim->d_inode->i_mtime = CURRENT_TIME;
                         fsnotify_modify(victim);
-
-                        /**
-                         * Drop reference from initial sysfs_get_dentry().
-                         */
-                        dput(victim);
                         res = 0;
                 } else
                         d_drop(victim);
                 
                 /**
-                 * Drop the reference acquired from sysfs_get_dentry() above.
+                 * Drop the reference acquired from lookup_one_len() above.
                  */
                 dput(victim);
         }
diff --git a/fs/sysv/super.c b/fs/sysv/super.c
index 350cba5d6803..dc9e7dc07fb7 100644
--- a/fs/sysv/super.c
+++ b/fs/sysv/super.c
@@ -358,16 +358,11 @@ static int sysv_fill_super(struct super_block *sb, void *data, int silent)
         unsigned long blocknr;
         int size = 0, i;
         
-        if (1024 != sizeof (struct xenix_super_block))
-                panic("Xenix FS: bad superblock size");
-        if (512 != sizeof (struct sysv4_super_block))
-                panic("SystemV FS: bad superblock size");
-        if (512 != sizeof (struct sysv2_super_block))
-                panic("SystemV FS: bad superblock size");
-        if (500 != sizeof (struct coh_super_block))
-                panic("Coherent FS: bad superblock size");
-        if (64 != sizeof (struct sysv_inode))
-                panic("sysv fs: bad inode size");
+        BUILD_BUG_ON(1024 != sizeof (struct xenix_super_block));
+        BUILD_BUG_ON(512 != sizeof (struct sysv4_super_block));
+        BUILD_BUG_ON(512 != sizeof (struct sysv2_super_block));
+        BUILD_BUG_ON(500 != sizeof (struct coh_super_block));
+        BUILD_BUG_ON(64 != sizeof (struct sysv_inode));
 
         sbi = kzalloc(sizeof(struct sysv_sb_info), GFP_KERNEL);
         if (!sbi)
diff --git a/fs/vfat/namei.c b/fs/vfat/namei.c
index edb711ff7b05..0afd745a37cd 100644
--- a/fs/vfat/namei.c
+++ b/fs/vfat/namei.c
@@ -1004,6 +1004,7 @@ static struct inode_operations vfat_dir_inode_operations = {
         .rmdir          = vfat_rmdir,
         .rename         = vfat_rename,
         .setattr        = fat_notify_change,
+        .getattr        = fat_getattr,
 };
 
 static int vfat_fill_super(struct super_block *sb, void *data, int silent)
diff --git a/fs/xattr.c b/fs/xattr.c
index 395635100f77..0901bdc2ce24 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -48,14 +48,21 @@ xattr_permission(struct inode *inode, const char *name, int mask)
                 return 0;
 
         /*
-         * The trusted.* namespace can only accessed by a privilegued user.
+         * The trusted.* namespace can only be accessed by a privileged user.
          */
         if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
                 return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM);
 
+        /* In user.* namespace, only regular files and directories can have
+         * extended attributes. For sticky directories, only the owner and
+         * privileged user can write attributes.
+         */
         if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
-                if (!S_ISREG(inode->i_mode) &&
-                    (!S_ISDIR(inode->i_mode) || inode->i_mode & S_ISVTX))
+                if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+                        return -EPERM;
+                if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
+                    (mask & MAY_WRITE) && (current->fsuid != inode->i_uid) &&
+                    !capable(CAP_FOWNER))
                         return -EPERM;
         }
 
diff --git a/fs/xfs/Makefile-linux-2.6 b/fs/xfs/Makefile-linux-2.6
index 291948d5085a..b49989bb89ad 100644
--- a/fs/xfs/Makefile-linux-2.6
+++ b/fs/xfs/Makefile-linux-2.6
@@ -21,22 +21,7 @@ EXTRA_CFLAGS +=	 -Ifs/xfs -Ifs/xfs/linux-2.6 -funsigned-char
 XFS_LINUX := linux-2.6
 
 ifeq ($(CONFIG_XFS_DEBUG),y)
-        EXTRA_CFLAGS += -g -DSTATIC="" -DDEBUG
-        EXTRA_CFLAGS += -DXFS_BUF_LOCK_TRACKING
-endif
-ifeq ($(CONFIG_XFS_TRACE),y)
-        EXTRA_CFLAGS += -DXFS_ALLOC_TRACE
-        EXTRA_CFLAGS += -DXFS_ATTR_TRACE
-        EXTRA_CFLAGS += -DXFS_BLI_TRACE
-        EXTRA_CFLAGS += -DXFS_BMAP_TRACE
-        EXTRA_CFLAGS += -DXFS_BMBT_TRACE
-        EXTRA_CFLAGS += -DXFS_DIR2_TRACE
-        EXTRA_CFLAGS += -DXFS_DQUOT_TRACE
-        EXTRA_CFLAGS += -DXFS_ILOCK_TRACE
-        EXTRA_CFLAGS += -DXFS_LOG_TRACE
-        EXTRA_CFLAGS += -DXFS_RW_TRACE
-        EXTRA_CFLAGS += -DXFS_BUF_TRACE
-        EXTRA_CFLAGS += -DXFS_VNODE_TRACE
+        EXTRA_CFLAGS += -g
 endif
 
 obj-$(CONFIG_XFS_FS)            += xfs.o
diff --git a/fs/xfs/linux-2.6/kmem.c b/fs/xfs/linux-2.6/kmem.c
index d59737589815..004baf600611 100644
--- a/fs/xfs/linux-2.6/kmem.c
+++ b/fs/xfs/linux-2.6/kmem.c
@@ -21,6 +21,7 @@
 #include <linux/highmem.h>
 #include <linux/swap.h>
 #include <linux/blkdev.h>
+#include <linux/backing-dev.h>
 #include "time.h"
 #include "kmem.h"
 
@@ -53,7 +54,7 @@ kmem_alloc(size_t size, unsigned int __nocast flags)
                         printk(KERN_ERR "XFS: possible memory allocation "
                                         "deadlock in %s (mode:0x%x)\n",
                                         __FUNCTION__, lflags);
-                blk_congestion_wait(WRITE, HZ/50);
+                congestion_wait(WRITE, HZ/50);
         } while (1);
 }
 
@@ -131,7 +132,7 @@ kmem_zone_alloc(kmem_zone_t *zone, unsigned int __nocast flags)
                         printk(KERN_ERR "XFS: possible memory allocation "
                                         "deadlock in %s (mode:0x%x)\n",
                                         __FUNCTION__, lflags);
-                blk_congestion_wait(WRITE, HZ/50);
+                congestion_wait(WRITE, HZ/50);
         } while (1);
 }
 
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 9bbadafdcb00..d3382843698e 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -15,6 +15,7 @@
  * along with this program; if not, write the Free Software Foundation,
  * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
+#include "xfs.h"
 #include <linux/stddef.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
@@ -30,7 +31,7 @@
 #include <linux/hash.h>
 #include <linux/kthread.h>
 #include <linux/migrate.h>
-#include "xfs_linux.h"
+#include <linux/backing-dev.h>
 
 STATIC kmem_zone_t *xfs_buf_zone;
 STATIC kmem_shaker_t xfs_buf_shake;
@@ -395,7 +396,7 @@ _xfs_buf_lookup_pages(
 
                         XFS_STATS_INC(xb_page_retries);
                         xfsbufd_wakeup(0, gfp_mask);
-                        blk_congestion_wait(WRITE, HZ/50);
+                        congestion_wait(WRITE, HZ/50);
                         goto retry;
                 }
 
@@ -1405,7 +1406,7 @@ xfs_alloc_bufhash(
         btp->bt_hashshift = external ? 3 : 8;   /* 8 or 256 buckets */
         btp->bt_hashmask = (1 << btp->bt_hashshift) - 1;
         btp->bt_hash = kmem_zalloc((1 << btp->bt_hashshift) *
-                                        sizeof(xfs_bufhash_t), KM_SLEEP);
+                                        sizeof(xfs_bufhash_t), KM_SLEEP | KM_LARGE);
         for (i = 0; i < (1 << btp->bt_hashshift); i++) {
                 spin_lock_init(&btp->bt_hash[i].bh_lock);
                 INIT_LIST_HEAD(&btp->bt_hash[i].bh_list);
diff --git a/fs/xfs/linux-2.6/xfs_dmapi_priv.h b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
new file mode 100644
index 000000000000..a8b0b1685eed
--- /dev/null
+++ b/fs/xfs/linux-2.6/xfs_dmapi_priv.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2000-2006 Silicon Graphics, Inc.
+ * All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it would be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write the Free Software Foundation,
+ * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+#ifndef __XFS_DMAPI_PRIV_H__
+#define __XFS_DMAPI_PRIV_H__
+
+/*
+ *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ */
+#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
+                              DM_FLAGS_IMUX : 0)
+#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
+
+#endif /*__XFS_DMAPI_PRIV_H__*/
diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c
index a74f854d91e6..74d094829a4d 100644
--- a/fs/xfs/linux-2.6/xfs_ioctl.c
+++ b/fs/xfs/linux-2.6/xfs_ioctl.c
@@ -341,8 +341,11 @@ xfs_open_by_handle(
                 put_unused_fd(new_fd);
                 return -XFS_ERROR(-PTR_ERR(filp));
         }
-        if (inode->i_mode & S_IFREG)
+        if (inode->i_mode & S_IFREG) {
+                /* invisible operation should not change atime */
+                filp->f_flags |= O_NOATIME;
                 filp->f_op = &xfs_invis_file_operations;
+        }
 
         fd_install(new_fd, filp);
         return new_fd;
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 38c4d128a8c0..de05abbbe7fd 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -227,9 +227,7 @@ xfs_initialize_vnode(
                 xfs_revalidate_inode(XFS_BHVTOM(bdp), vp, ip);
                 xfs_set_inodeops(inode);
 
-                spin_lock(&ip->i_flags_lock);
-                ip->i_flags &= ~XFS_INEW;
-                spin_unlock(&ip->i_flags_lock);
+                xfs_iflags_clear(ip, XFS_INEW);
                 barrier();
 
                 unlock_new_inode(inode);
diff --git a/fs/xfs/support/debug.c b/fs/xfs/support/debug.c
index c75f68361e33..4363512d2f90 100644
--- a/fs/xfs/support/debug.c
+++ b/fs/xfs/support/debug.c
@@ -15,11 +15,9 @@
  * along with this program; if not, write the Free Software Foundation,
  * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
+#include <xfs.h>
 #include "debug.h"
 #include "spin.h"
-#include <asm/page.h>
-#include <linux/sched.h>
-#include <linux/kernel.h>
 
 static char             message[256];   /* keep it off the stack */
 static DEFINE_SPINLOCK(xfs_err_lock);
diff --git a/fs/xfs/support/move.c b/fs/xfs/support/move.c
index caefa17b80fe..ac8617ca3909 100644
--- a/fs/xfs/support/move.c
+++ b/fs/xfs/support/move.c
@@ -22,7 +22,7 @@
  * as we go.
  */
 int
-uio_read(caddr_t src, size_t len, struct uio *uio)
+xfs_uio_read(caddr_t src, size_t len, struct uio *uio)
 {
         size_t  count;
 
diff --git a/fs/xfs/support/move.h b/fs/xfs/support/move.h
index 97a2498d2da3..977879c24ff5 100644
--- a/fs/xfs/support/move.h
+++ b/fs/xfs/support/move.h
@@ -65,6 +65,6 @@ struct uio {
 typedef struct uio uio_t;
 typedef struct iovec iovec_t;
 
-extern int      uio_read (caddr_t, size_t, uio_t *);
+extern int      xfs_uio_read (caddr_t, size_t, uio_t *);
 
 #endif  /* __XFS_SUPPORT_MOVE_H__ */
diff --git a/fs/xfs/xfs.h b/fs/xfs/xfs.h
index 1a48dbb902a7..bf0a12040b13 100644
--- a/fs/xfs/xfs.h
+++ b/fs/xfs/xfs.h
@@ -17,5 +17,28 @@
  */
 #ifndef __XFS_H__
 #define __XFS_H__
+
+#ifdef CONFIG_XFS_DEBUG
+#define STATIC
+#define DEBUG 1
+#define XFS_BUF_LOCK_TRACKING 1
+/* #define QUOTADEBUG 1 */
+#endif
+
+#ifdef CONFIG_XFS_TRACE
+#define XFS_ALLOC_TRACE 1
+#define XFS_ATTR_TRACE 1
+#define XFS_BLI_TRACE 1
+#define XFS_BMAP_TRACE 1
+#define XFS_BMBT_TRACE 1
+#define XFS_DIR2_TRACE 1
+#define XFS_DQUOT_TRACE 1
+#define XFS_ILOCK_TRACE 1
+#define XFS_LOG_TRACE 1
+#define XFS_RW_TRACE 1
+#define XFS_BUF_TRACE 1
+#define XFS_VNODE_TRACE 1
+#endif
+
 #include <linux-2.6/xfs_linux.h>
 #endif  /* __XFS_H__ */
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index 5b050c06795f..498ad50d1f45 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -1171,6 +1171,8 @@ xfs_bmap_add_extent_delay_real(
                 xfs_bmap_trace_pre_update(fname, "0", ip, idx, XFS_DATA_FORK);
                 xfs_bmbt_set_blockcount(ep, temp);
                 r[0] = *new;
+                r[1].br_state = PREV.br_state;
+                r[1].br_startblock = 0;
                 r[1].br_startoff = new_endoff;
                 temp2 = PREV.br_startoff + PREV.br_blockcount - new_endoff;
                 r[1].br_blockcount = temp2;
diff --git a/fs/xfs/xfs_dir2.c b/fs/xfs/xfs_dir2.c
index 8edbe1adb95b..8e8e5279334a 100644
--- a/fs/xfs/xfs_dir2.c
+++ b/fs/xfs/xfs_dir2.c
@@ -678,7 +678,7 @@ xfs_dir2_put_dirent64_uio(
         idbp->d_off = pa->cook;
         idbp->d_name[namelen] = '\0';
         memcpy(idbp->d_name, pa->name, namelen);
-        rval = uio_read((caddr_t)idbp, reclen, uio);
+        rval = xfs_uio_read((caddr_t)idbp, reclen, uio);
         pa->done = (rval == 0);
         return rval;
 }
diff --git a/fs/xfs/xfs_dmapi.h b/fs/xfs/xfs_dmapi.h
index 4e7865ad6f0e..adc3d251240d 100644
--- a/fs/xfs/xfs_dmapi.h
+++ b/fs/xfs/xfs_dmapi.h
@@ -157,27 +157,9 @@ typedef enum {
 #define DM_FLAGS_IALLOCSEM_WR   0x020   /* thread holds i_alloc_sem wr */
 
 /*
- *      Based on IO_ISDIRECT, decide which i_ flag is set.
+ *      Pull in platform specific event flags defines
  */
-#if LINUX_VERSION_CODE > KERNEL_VERSION(2,6,0)
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IMUX : 0)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-
-#if (LINUX_VERSION_CODE < KERNEL_VERSION(2,6,0)) && \
-    (LINUX_VERSION_CODE >= KERNEL_VERSION(2,4,22))
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              DM_FLAGS_IALLOCSEM_RD : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IALLOCSEM_WR | DM_FLAGS_IMUX)
-#endif
-
-#if LINUX_VERSION_CODE <= KERNEL_VERSION(2,4,21)
-#define DM_SEM_FLAG_RD(ioflags) (((ioflags) & IO_ISDIRECT) ? \
-                              0 : DM_FLAGS_IMUX)
-#define DM_SEM_FLAG_WR  (DM_FLAGS_IMUX)
-#endif
-
+#include "xfs_dmapi_priv.h"
 
 /*
  *      Macros to turn caller specified delay/block flags into
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index b73d216ecaf9..c1c89dac19cc 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -215,7 +215,7 @@ again:
                          * If INEW is set this inode is being set up
                          * we need to pause and try again.
                          */
-                        if (ip->i_flags & XFS_INEW) {
+                        if (xfs_iflags_test(ip, XFS_INEW)) {
                                 read_unlock(&ih->ih_lock);
                                 delay(1);
                                 XFS_STATS_INC(xs_ig_frecycle);
@@ -230,22 +230,50 @@ again:
                                  * on its way out of the system,
                                  * we need to pause and try again.
                                  */
-                                if (ip->i_flags & XFS_IRECLAIM) {
+                                if (xfs_iflags_test(ip, XFS_IRECLAIM)) {
                                         read_unlock(&ih->ih_lock);
                                         delay(1);
                                         XFS_STATS_INC(xs_ig_frecycle);
 
                                         goto again;
                                 }
+                                ASSERT(xfs_iflags_test(ip, XFS_IRECLAIMABLE));
+
+                                /*
+                                 * If lookup is racing with unlink, then we
+                                 * should return an error immediately so we
+                                 * don't remove it from the reclaim list and
+                                 * potentially leak the inode.
+                                 */
+                                if ((ip->i_d.di_mode == 0) &&
+                                    !(flags & XFS_IGET_CREATE)) {
+                                        read_unlock(&ih->ih_lock);
+                                        return ENOENT;
+                                }
+
+                                /*
+                                 * There may be transactions sitting in the
+                                 * incore log buffers or being flushed to disk
+                                 * at this time.  We can't clear the
+                                 * XFS_IRECLAIMABLE flag until these
+                                 * transactions have hit the disk, otherwise we
+                                 * will void the guarantee the flag provides
+                                 * xfs_iunpin()
+                                 */
+                                if (xfs_ipincount(ip)) {
+                                        read_unlock(&ih->ih_lock);
+                                        xfs_log_force(mp, 0,
+                                                XFS_LOG_FORCE|XFS_LOG_SYNC);
+                                        XFS_STATS_INC(xs_ig_frecycle);
+                                        goto again;
+                                }
 
                                 vn_trace_exit(vp, "xfs_iget.alloc",
                                         (inst_t *)__return_address);
 
                                 XFS_STATS_INC(xs_ig_found);
 
-                                spin_lock(&ip->i_flags_lock);
-                                ip->i_flags &= ~XFS_IRECLAIMABLE;
-                                spin_unlock(&ip->i_flags_lock);
+                                xfs_iflags_clear(ip, XFS_IRECLAIMABLE);
                                 version = ih->ih_version;
                                 read_unlock(&ih->ih_lock);
                                 xfs_ihash_promote(ih, ip, version);
@@ -299,10 +327,7 @@ finish_inode:
                         if (lock_flags != 0)
                                 xfs_ilock(ip, lock_flags);
 
-                        spin_lock(&ip->i_flags_lock);
-                        ip->i_flags &= ~XFS_ISTALE;
-                        spin_unlock(&ip->i_flags_lock);
-
+                        xfs_iflags_clear(ip, XFS_ISTALE);
                         vn_trace_exit(vp, "xfs_iget.found",
                                                 (inst_t *)__return_address);
                         goto return_ip;
@@ -371,10 +396,7 @@ finish_inode:
         ih->ih_next = ip;
         ip->i_udquot = ip->i_gdquot = NULL;
         ih->ih_version++;
-        spin_lock(&ip->i_flags_lock);
-        ip->i_flags |= XFS_INEW;
-        spin_unlock(&ip->i_flags_lock);
-
+        xfs_iflags_set(ip, XFS_INEW);
         write_unlock(&ih->ih_lock);
 
         /*
@@ -625,7 +647,7 @@ xfs_iput_new(xfs_inode_t	*ip,
         vn_trace_entry(vp, "xfs_iput_new", (inst_t *)__return_address);
 
         if ((ip->i_d.di_mode == 0)) {
-                ASSERT(!(ip->i_flags & XFS_IRECLAIMABLE));
+                ASSERT(!xfs_iflags_test(ip, XFS_IRECLAIMABLE));
                 vn_mark_bad(vp);
         }
         if (inode->i_state & I_NEW)
@@ -683,6 +705,7 @@ xfs_ireclaim(xfs_inode_t *ip)
         /*
          * Free all memory associated with the inode.
          */
+        xfs_iunlock(ip, XFS_ILOCK_EXCL | XFS_IOLOCK_EXCL);
         xfs_idestroy(ip);
 }
 
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index c27d7d495aa0..44dfac521285 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2193,7 +2193,7 @@ xfs_ifree_cluster(
                         /* Inode not in memory or we found it already,
                          * nothing to do
                          */
-                        if (!ip || (ip->i_flags & XFS_ISTALE)) {
+                        if (!ip || xfs_iflags_test(ip, XFS_ISTALE)) {
                                 read_unlock(&ih->ih_lock);
                                 continue;
                         }
@@ -2215,10 +2215,7 @@ xfs_ifree_cluster(
 
                         if (ip == free_ip) {
                                 if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
-
+                                        xfs_iflags_set(ip, XFS_ISTALE);
                                         if (xfs_inode_clean(ip)) {
                                                 xfs_ifunlock(ip);
                                         } else {
@@ -2231,9 +2228,7 @@ xfs_ifree_cluster(
 
                         if (xfs_ilock_nowait(ip, XFS_ILOCK_EXCL)) {
                                 if (xfs_iflock_nowait(ip)) {
-                                        spin_lock(&ip->i_flags_lock);
-                                        ip->i_flags |= XFS_ISTALE;
-                                        spin_unlock(&ip->i_flags_lock);
+                                        xfs_iflags_set(ip, XFS_ISTALE);
 
                                         if (xfs_inode_clean(ip)) {
                                                 xfs_ifunlock(ip);
@@ -2263,9 +2258,7 @@ xfs_ifree_cluster(
                                 AIL_LOCK(mp,s);
                                 iip->ili_flush_lsn = iip->ili_item.li_lsn;
                                 AIL_UNLOCK(mp, s);
-                                spin_lock(&iip->ili_inode->i_flags_lock);
-                                iip->ili_inode->i_flags |= XFS_ISTALE;
-                                spin_unlock(&iip->ili_inode->i_flags_lock);
+                                xfs_iflags_set(iip->ili_inode, XFS_ISTALE);
                                 pre_flushed++;
                         }
                         lip = lip->li_bio_list;
@@ -2748,42 +2741,39 @@ xfs_iunpin(
 {
         ASSERT(atomic_read(&ip->i_pincount) > 0);
 
-        if (atomic_dec_and_test(&ip->i_pincount)) {
+        if (atomic_dec_and_lock(&ip->i_pincount, &ip->i_flags_lock)) {
+
                 /*
-                 * If the inode is currently being reclaimed, the
-                 * linux inode _and_ the xfs vnode may have been
-                 * freed so we cannot reference either of them safely.
-                 * Hence we should not try to do anything to them
-                 * if the xfs inode is currently in the reclaim
-                 * path.
+                 * If the inode is currently being reclaimed, the link between
+                 * the bhv_vnode and the xfs_inode will be broken after the
+                 * XFS_IRECLAIM* flag is set. Hence, if these flags are not
+                 * set, then we can move forward and mark the linux inode dirty
+                 * knowing that it is still valid as it won't freed until after
+                 * the bhv_vnode<->xfs_inode link is broken in xfs_reclaim. The
+                 * i_flags_lock is used to synchronise the setting of the
+                 * XFS_IRECLAIM* flags and the breaking of the link, and so we
+                 * can execute atomically w.r.t to reclaim by holding this lock
+                 * here.
                  *
-                 * However, we still need to issue the unpin wakeup
-                 * call as the inode reclaim may be blocked waiting for
-                 * the inode to become unpinned.
+                 * However, we still need to issue the unpin wakeup call as the
+                 * inode reclaim may be blocked waiting for the inode to become
+                 * unpinned.
                  */
-                struct inode *inode = NULL;
 
-                spin_lock(&ip->i_flags_lock);
-                if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
+                if (!__xfs_iflags_test(ip, XFS_IRECLAIM|XFS_IRECLAIMABLE)) {
                         bhv_vnode_t     *vp = XFS_ITOV_NULL(ip);
+                        struct inode *inode = NULL;
+
+                        BUG_ON(vp == NULL);
+                        inode = vn_to_inode(vp);
+                        BUG_ON(inode->i_state & I_CLEAR);
 
                         /* make sync come back and flush this inode */
-                        if (vp) {
-                                inode = vn_to_inode(vp);
-
-                                if (!(inode->i_state &
-                                                (I_NEW|I_FREEING|I_CLEAR))) {
-                                        inode = igrab(inode);
-                                        if (inode)
-                                                mark_inode_dirty_sync(inode);
-                                } else
-                                        inode = NULL;
-                        }
+                        if (!(inode->i_state & (I_NEW|I_FREEING)))
+                                mark_inode_dirty_sync(inode);
                 }
                 spin_unlock(&ip->i_flags_lock);
                 wake_up(&ip->i_ipin_wait);
-                if (inode)
-                        iput(inode);
         }
 }
 
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index e96eb0835fe6..bc823720d88f 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -305,6 +305,47 @@ typedef struct xfs_inode {
 #endif
 } xfs_inode_t;
 
+
+/*
+ * i_flags helper functions
+ */
+static inline void
+__xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        ip->i_flags |= flags;
+}
+
+static inline void
+xfs_iflags_set(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        __xfs_iflags_set(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+}
+
+static inline void
+xfs_iflags_clear(xfs_inode_t *ip, unsigned short flags)
+{
+        spin_lock(&ip->i_flags_lock);
+        ip->i_flags &= ~flags;
+        spin_unlock(&ip->i_flags_lock);
+}
+
+static inline int
+__xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        return (ip->i_flags & flags);
+}
+
+static inline int
+xfs_iflags_test(xfs_inode_t *ip, unsigned short flags)
+{
+        int ret;
+        spin_lock(&ip->i_flags_lock);
+        ret = __xfs_iflags_test(ip, flags);
+        spin_unlock(&ip->i_flags_lock);
+        return ret;
+}
 #endif  /* __KERNEL__ */
 
 
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index 061e2ffdd1de..bda774a04b8f 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -1013,7 +1013,7 @@ xfs_readlink(
         pathlen = (int)ip->i_d.di_size;
 
         if (ip->i_df.if_flags & XFS_IFINLINE) {
-                error = uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
+                error = xfs_uio_read(ip->i_df.if_u1.if_data, pathlen, uiop);
         }
         else {
                 /*
@@ -1044,7 +1044,7 @@ xfs_readlink(
                                 byte_cnt = pathlen;
                         pathlen -= byte_cnt;
 
-                        error = uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
+                        error = xfs_uio_read(XFS_BUF_PTR(bp), byte_cnt, uiop);
                         xfs_buf_relse (bp);
                 }
 
@@ -3827,11 +3827,16 @@ xfs_reclaim(
          */
         xfs_synchronize_atime(ip);
 
-        /* If we have nothing to flush with this inode then complete the
-         * teardown now, otherwise break the link between the xfs inode
-         * and the linux inode and clean up the xfs inode later. This
-         * avoids flushing the inode to disk during the delete operation
-         * itself.
+        /*
+         * If we have nothing to flush with this inode then complete the
+         * teardown now, otherwise break the link between the xfs inode and the
+         * linux inode and clean up the xfs inode later. This avoids flushing
+         * the inode to disk during the delete operation itself.
+         *
+         * When breaking the link, we need to set the XFS_IRECLAIMABLE flag
+         * first to ensure that xfs_iunpin() will never see an xfs inode
+         * that has a linux inode being reclaimed. Synchronisation is provided
+         * by the i_flags_lock.
          */
         if (!ip->i_update_core && (ip->i_itemp == NULL)) {
                 xfs_ilock(ip, XFS_ILOCK_EXCL);
@@ -3840,13 +3845,13 @@ xfs_reclaim(
         } else {
                 xfs_mount_t     *mp = ip->i_mount;
 
-                /* Protect sync from us */
+                /* Protect sync and unpin from us */
                 XFS_MOUNT_ILOCK(mp);
-                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
-                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                 spin_lock(&ip->i_flags_lock);
-                ip->i_flags |= XFS_IRECLAIMABLE;
+                __xfs_iflags_set(ip, XFS_IRECLAIMABLE);
+                vn_bhv_remove(VN_BHV_HEAD(vp), XFS_ITOBHV(ip));
                 spin_unlock(&ip->i_flags_lock);
+                list_add_tail(&ip->i_reclaim, &mp->m_del_inodes);
                 XFS_MOUNT_IUNLOCK(mp);
         }
         return 0;
@@ -3872,8 +3877,8 @@ xfs_finish_reclaim(
          */
         write_lock(&ih->ih_lock);
         spin_lock(&ip->i_flags_lock);
-        if ((ip->i_flags & XFS_IRECLAIM) ||
-            (!(ip->i_flags & XFS_IRECLAIMABLE) && vp == NULL)) {
+        if (__xfs_iflags_test(ip, XFS_IRECLAIM) ||
+            (!__xfs_iflags_test(ip, XFS_IRECLAIMABLE) && vp == NULL)) {
                 spin_unlock(&ip->i_flags_lock);
                 write_unlock(&ih->ih_lock);
                 if (locked) {
@@ -3882,7 +3887,7 @@ xfs_finish_reclaim(
                 }
                 return 1;
         }
-        ip->i_flags |= XFS_IRECLAIM;
+        __xfs_iflags_set(ip, XFS_IRECLAIM);
         spin_unlock(&ip->i_flags_lock);
         write_unlock(&ih->ih_lock);
 
diff --git a/include/acpi/pdc_intel.h b/include/acpi/pdc_intel.h
index c5472be6f3a2..e72bfdd887f9 100644
--- a/include/acpi/pdc_intel.h
+++ b/include/acpi/pdc_intel.h
@@ -13,6 +13,7 @@
 #define ACPI_PDC_SMP_C_SWCOORD          (0x0040)
 #define ACPI_PDC_SMP_T_SWCOORD          (0x0080)
 #define ACPI_PDC_C_C1_FFH               (0x0100)
+#define ACPI_PDC_C_C2C3_FFH             (0x0200)
 
 #define ACPI_PDC_EST_CAPABILITY_SMP     (ACPI_PDC_SMP_C1PT | \
                                          ACPI_PDC_C_C1_HALT | \
@@ -23,8 +24,10 @@
                                          ACPI_PDC_SMP_P_SWCOORD | \
                                          ACPI_PDC_P_FFH)
 
-#define ACPI_PDC_C_CAPABILITY_SMP       (ACPI_PDC_SMP_C2C3 | \
-                                         ACPI_PDC_SMP_C1PT | \
-                                         ACPI_PDC_C_C1_HALT)
+#define ACPI_PDC_C_CAPABILITY_SMP       (ACPI_PDC_SMP_C2C3  | \
+                                         ACPI_PDC_SMP_C1PT  | \
+                                         ACPI_PDC_C_C1_HALT | \
+                                         ACPI_PDC_C_C1_FFH  | \
+                                         ACPI_PDC_C_C2C3_FFH)
 
 #endif                          /* __PDC_INTEL_H__ */
diff --git a/include/acpi/processor.h b/include/acpi/processor.h
index 9dd5b75961f8..7798d2a9f793 100644
--- a/include/acpi/processor.h
+++ b/include/acpi/processor.h
@@ -29,6 +29,9 @@
 #define DOMAIN_COORD_TYPE_SW_ANY        0xfd
 #define DOMAIN_COORD_TYPE_HW_ALL        0xfe
 
+#define ACPI_CSTATE_SYSTEMIO    (0)
+#define ACPI_CSTATE_FFH         (1)
+
 /* Power Management */
 
 struct acpi_processor_cx;
@@ -58,6 +61,8 @@ struct acpi_processor_cx {
         u8 valid;
         u8 type;
         u32 address;
+        u8 space_id;
+        u8 index;
         u32 latency;
         u32 latency_ticks;
         u32 power;
@@ -206,6 +211,9 @@ void arch_acpi_processor_init_pdc(struct acpi_processor *pr);
 #ifdef ARCH_HAS_POWER_INIT
 void acpi_processor_power_init_bm_check(struct acpi_processor_flags *flags,
                                         unsigned int cpu);
+int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+                struct acpi_processor_cx *cx, struct acpi_power_register *reg);
+void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx *cstate);
 #else
 static inline void acpi_processor_power_init_bm_check(struct
                                                       acpi_processor_flags
@@ -214,6 +222,16 @@ static inline void acpi_processor_power_init_bm_check(struct
         flags->bm_check = 1;
         return;
 }
+static inline int acpi_processor_ffh_cstate_probe(unsigned int cpu,
+                struct acpi_processor_cx *cx, struct acpi_power_register *reg)
+{
+        return -1;
+}
+static inline void acpi_processor_ffh_cstate_enter(
+                struct acpi_processor_cx *cstate)
+{
+        return;
+}
 #endif
 
 /* in processor_perflib.c */
diff --git a/include/asm-alpha/io.h b/include/asm-alpha/io.h
index f5ae98c25d1f..5d15af24573b 100644
--- a/include/asm-alpha/io.h
+++ b/include/asm-alpha/io.h
@@ -533,19 +533,6 @@ extern void outsl (unsigned long port, const void *src, unsigned long count);
 #define eth_io_copy_and_sum(skb,src,len,unused) \
   memcpy_fromio((skb)->data,src,len)
 
-static inline int
-check_signature(const volatile void __iomem *io_addr,
-                const unsigned char *signature, int length)
-{
-        do {
-                if (readb(io_addr) != *signature)
-                        return 0;
-                io_addr++;
-                signature++;
-        } while (--length);
-        return 1;
-}
-
 /*
  * The Alpha Jensen hardware for some rather strange reason puts
  * the RTC clock at 0x170 instead of 0x70. Probably due to some
diff --git a/include/asm-arm/arch-pxa/irqs.h b/include/asm-arm/arch-pxa/irqs.h
index f3bc70eee35b..67ed43674c63 100644
--- a/include/asm-arm/arch-pxa/irqs.h
+++ b/include/asm-arm/arch-pxa/irqs.h
@@ -73,7 +73,7 @@
 #define IRQ_TO_GPIO(i)  (((i) < IRQ_GPIO(2)) ? ((i) - IRQ_GPIO0) : IRQ_TO_GPIO_2_x(i))
 
 #if defined(CONFIG_PXA25x)
-#define PXA_LAST_GPIO   80
+#define PXA_LAST_GPIO   84
 #elif defined(CONFIG_PXA27x)
 #define PXA_LAST_GPIO   127
 #endif
diff --git a/include/asm-arm/arch-pxa/pxa-regs.h b/include/asm-arm/arch-pxa/pxa-regs.h
index f5cc65dd7d0d..cff752f35230 100644
--- a/include/asm-arm/arch-pxa/pxa-regs.h
+++ b/include/asm-arm/arch-pxa/pxa-regs.h
@@ -1681,6 +1681,7 @@
 #define SSSR_TINT               (1 << 19)       /* Receiver Time-out Interrupt */
 #define SSSR_PINT               (1 << 18)       /* Peripheral Trailing Byte Interrupt */
 
+#define SSPSP_FSRT              (1 << 25)       /* Frame Sync Relative Timing */
 #define SSPSP_DMYSTOP(x)        (x << 23)       /* Dummy Stop */
 #define SSPSP_SFRMWDTH(x)       (x << 16)       /* Serial Frame Width */
 #define SSPSP_SFRMDLY(x)        (x << 9)        /* Serial Frame Delay */
@@ -2241,7 +2242,7 @@
 
 #define CICR1_TBIT      (1 << 31)       /* Transparency bit */
 #define CICR1_RGBT_CONV (0x3 << 30)     /* RGBT conversion mask */
-#define CICR1_PPL       (0x3f << 15)    /* Pixels per line mask */
+#define CICR1_PPL       (0x7ff << 15)   /* Pixels per line mask */
 #define CICR1_RGB_CONV  (0x7 << 12)     /* RGB conversion mask */
 #define CICR1_RGB_F     (1 << 11)       /* RGB format */
 #define CICR1_YCBCR_F   (1 << 10)       /* YCbCr format */
@@ -2267,7 +2268,7 @@
 #define CICR3_VSW       (0x3f << 10)    /* Vertical sync pulse width mask */
 #define CICR3_BFPW      (0x3f << 3)     /* Beginning-of-frame pixel clock
                                            wait count mask */
-#define CICR3_LPF       (0x3ff << 0)    /* Lines per frame mask */
+#define CICR3_LPF       (0x7ff << 0)    /* Lines per frame mask */
 
 #define CICR4_MCLK_DLY  (0x3 << 24)     /* MCLK Data Capture Delay mask */
 #define CICR4_PCLK_EN   (1 << 23)       /* Pixel clock enable */
@@ -2288,8 +2289,8 @@
 #define CISR_EOL        (1 << 8)        /* End of line */
 #define CISR_PAR_ERR    (1 << 7)        /* Parity error */
 #define CISR_CQD        (1 << 6)        /* Camera interface quick disable */
-#define CISR_SOF        (1 << 5)        /* Start of frame */
-#define CISR_CDD        (1 << 4)        /* Camera interface disable done */
+#define CISR_CDD        (1 << 5)        /* Camera interface disable done */
+#define CISR_SOF        (1 << 4)        /* Start of frame */
 #define CISR_EOF        (1 << 3)        /* End of frame */
 #define CISR_IFO_2      (1 << 2)        /* FIFO overrun for Channel 2 */
 #define CISR_IFO_1      (1 << 1)        /* FIFO overrun for Channel 1 */
diff --git a/include/asm-arm/arch-sa1100/jornada720.h b/include/asm-arm/arch-sa1100/jornada720.h
index 1b8e8a304800..3f37ca07806d 100644
--- a/include/asm-arm/arch-sa1100/jornada720.h
+++ b/include/asm-arm/arch-sa1100/jornada720.h
@@ -19,6 +19,20 @@
 #define GPIO_JORNADA720_KEYBOARD_IRQ    IRQ_GPIO0
 #define GPIO_JORNADA720_MOUSE_IRQ               IRQ_GPIO9
 
+/* MCU COMMANDS */
+#define MCU_GetBatteryData  0xc0
+#define MCU_GetScanKeyCode  0x90
+#define MCU_GetTouchSamples 0xa0
+#define MCU_GetContrast     0xD0
+#define MCU_SetContrast     0xD1
+#define MCU_GetBrightness   0xD2
+#define MCU_SetBrightness   0xD3
+#define MCU_ContrastOff     0xD8
+#define MCU_BrightnessOff   0xD9
+#define MCU_PWMOFF          0xDF
+#define MCU_TxDummy         0x11
+#define MCU_ErrorCode       0x00
+
 #ifndef __ASSEMBLY__
 
 void jornada720_mcu_init(void);
diff --git a/include/asm-arm/arch-versatile/hardware.h b/include/asm-arm/arch-versatile/hardware.h
index 41c1bee342ad..edc06598d187 100644
--- a/include/asm-arm/arch-versatile/hardware.h
+++ b/include/asm-arm/arch-versatile/hardware.h
@@ -28,8 +28,8 @@
 /*
  * PCI space virtual addresses
  */
-#define VERSATILE_PCI_VIRT_BASE         0xe8000000
-#define VERSATILE_PCI_CFG_VIRT_BASE     0xe9000000
+#define VERSATILE_PCI_VIRT_BASE         (void __iomem *)0xe8000000ul
+#define VERSATILE_PCI_CFG_VIRT_BASE     (void __iomem *)0xe9000000ul
 
 #if 0
 #define VERSATILE_PCI_VIRT_MEM_BASE0    0xf4000000
diff --git a/include/asm-arm/io.h b/include/asm-arm/io.h
index 34aaaac4f617..ae999fd5dc67 100644
--- a/include/asm-arm/io.h
+++ b/include/asm-arm/io.h
@@ -193,23 +193,6 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
 #define eth_io_copy_and_sum(s,c,l,b) \
                                 eth_copy_and_sum((s),__mem_pci(c),(l),(b))
 
-static inline int
-check_signature(void __iomem *io_addr, const unsigned char *signature,
-                int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 #elif !defined(readb)
 
 #define readb(c)                        (__readwrite_bug("readb"),0)
diff --git a/include/asm-arm/uaccess.h b/include/asm-arm/uaccess.h
index 87aba57a66c4..5f420a0149f1 100644
--- a/include/asm-arm/uaccess.h
+++ b/include/asm-arm/uaccess.h
@@ -110,7 +110,7 @@ extern int __get_user_4(void *);
 #define get_user(x,p)                                                   \
         ({                                                              \
                 const register typeof(*(p)) __user *__p asm("r0") = (p);\
-                register unsigned int __r2 asm("r2");                   \
+                register unsigned long __r2 asm("r2");                  \
                 register int __e asm("r0");                             \
                 switch (sizeof(*(__p))) {                               \
                 case 1:                                                 \
@@ -383,19 +383,19 @@ do {									\
 
 
 #ifdef CONFIG_MMU
-extern unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n);
-extern unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n);
-extern unsigned long __clear_user(void __user *addr, unsigned long n);
+extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
+extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
+extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
 #else
 #define __copy_from_user(to,from,n)     (memcpy(to, (void __force *)from, n), 0)
 #define __copy_to_user(to,from,n)       (memcpy((void __force *)to, from, n), 0)
 #define __clear_user(addr,n)            (memset((void __force *)addr, 0, n), 0)
 #endif
 
-extern unsigned long __strncpy_from_user(char *to, const char __user *from, unsigned long count);
-extern unsigned long __strnlen_user(const char __user *s, long n);
+extern unsigned long __must_check __strncpy_from_user(char *to, const char __user *from, unsigned long count);
+extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
 
-static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         if (access_ok(VERIFY_READ, from, n))
                 n = __copy_from_user(to, from, n);
@@ -404,7 +404,7 @@ static inline unsigned long copy_from_user(void *to, const void __user *from, un
         return n;
 }
 
-static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         if (access_ok(VERIFY_WRITE, to, n))
                 n = __copy_to_user(to, from, n);
@@ -414,14 +414,14 @@ static inline unsigned long copy_to_user(void __user *to, const void *from, unsi
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-static inline unsigned long clear_user(void __user *to, unsigned long n)
+static inline unsigned long __must_check clear_user(void __user *to, unsigned long n)
 {
         if (access_ok(VERIFY_WRITE, to, n))
                 n = __clear_user(to, n);
         return n;
 }
 
-static inline long strncpy_from_user(char *dst, const char __user *src, long count)
+static inline long __must_check strncpy_from_user(char *dst, const char __user *src, long count)
 {
         long res = -EFAULT;
         if (access_ok(VERIFY_READ, src, 1))
@@ -431,7 +431,7 @@ static inline long strncpy_from_user(char *dst, const char __user *src, long cou
 
 #define strlen_user(s)  strnlen_user(s, ~0UL >> 1)
 
-static inline long strnlen_user(const char __user *s, long n)
+static inline long __must_check strnlen_user(const char __user *s, long n)
 {
         unsigned long res = 0;
 
diff --git a/include/asm-avr32/atomic.h b/include/asm-avr32/atomic.h
index e0b9c44c126c..c40b6032c480 100644
--- a/include/asm-avr32/atomic.h
+++ b/include/asm-avr32/atomic.h
@@ -41,7 +41,7 @@ static inline int atomic_sub_return(int i, atomic_t *v)
                 "       stcond  %1, %0\n"
                 "       brne    1b"
                 : "=&r"(result), "=o"(v->counter)
-                : "m"(v->counter), "ir"(i)
+                : "m"(v->counter), "rKs21"(i)
                 : "cc");
 
         return result;
@@ -58,7 +58,7 @@ static inline int atomic_add_return(int i, atomic_t *v)
 {
         int result;
 
-        if (__builtin_constant_p(i))
+        if (__builtin_constant_p(i) && (i >= -1048575) && (i <= 1048576))
                 result = atomic_sub_return(-i, v);
         else
                 asm volatile(
@@ -101,7 +101,7 @@ static inline int atomic_sub_unless(atomic_t *v, int a, int u)
                 "       mov     %1, 1\n"
                 "1:"
                 : "=&r"(tmp), "=&r"(result), "=o"(v->counter)
-                : "m"(v->counter), "ir"(a), "ir"(u)
+                : "m"(v->counter), "rKs21"(a), "rKs21"(u)
                 : "cc", "memory");
 
         return result;
@@ -121,7 +121,7 @@ static inline int atomic_add_unless(atomic_t *v, int a, int u)
 {
         int tmp, result;
 
-        if (__builtin_constant_p(a))
+        if (__builtin_constant_p(a) && (a >= -1048575) && (a <= 1048576))
                 result = atomic_sub_unless(v, -a, u);
         else {
                 result = 0;
diff --git a/include/asm-avr32/io.h b/include/asm-avr32/io.h
index 2fc8f111dce9..eec47500fa66 100644
--- a/include/asm-avr32/io.h
+++ b/include/asm-avr32/io.h
@@ -76,6 +76,39 @@ static inline unsigned int readl(const volatile void __iomem *addr)
 #define readsw(p, d, l)         __raw_readsw((unsigned int)p, d, l)
 #define readsl(p, d, l)         __raw_readsl((unsigned int)p, d, l)
 
+
+/*
+ * io{read,write}{8,16,32} macros in both le (for PCI style consumers) and native be
+ */
+#ifndef ioread8
+
+#define ioread8(p)      ({ unsigned int __v = __raw_readb(p); __v; })
+
+#define ioread16(p)     ({ unsigned int __v = le16_to_cpu(__raw_readw(p)); __v; })
+#define ioread16be(p)   ({ unsigned int __v = be16_to_cpu(__raw_readw(p)); __v; })
+
+#define ioread32(p)     ({ unsigned int __v = le32_to_cpu(__raw_readl(p)); __v; })
+#define ioread32be(p)   ({ unsigned int __v = be32_to_cpu(__raw_readl(p)); __v; })
+
+#define iowrite8(v,p)   __raw_writeb(v, p)
+
+#define iowrite16(v,p)  __raw_writew(cpu_to_le16(v), p)
+#define iowrite16be(v,p)        __raw_writew(cpu_to_be16(v), p)
+
+#define iowrite32(v,p)  __raw_writel(cpu_to_le32(v), p)
+#define iowrite32be(v,p)        __raw_writel(cpu_to_be32(v), p)
+
+#define ioread8_rep(p,d,c)      __raw_readsb(p,d,c)
+#define ioread16_rep(p,d,c)     __raw_readsw(p,d,c)
+#define ioread32_rep(p,d,c)     __raw_readsl(p,d,c)
+
+#define iowrite8_rep(p,s,c)     __raw_writesb(p,s,c)
+#define iowrite16_rep(p,s,c)    __raw_writesw(p,s,c)
+#define iowrite32_rep(p,s,c)    __raw_writesl(p,s,c)
+
+#endif
+
+
 /*
  * These two are only here because ALSA _thinks_ it needs them...
  */
diff --git a/include/asm-avr32/irq_regs.h b/include/asm-avr32/irq_regs.h
new file mode 100644
index 000000000000..3dd9c0b70270
--- /dev/null
+++ b/include/asm-avr32/irq_regs.h
@@ -0,0 +1 @@
+#include <asm-generic/irq_regs.h>
diff --git a/include/asm-avr32/unistd.h b/include/asm-avr32/unistd.h
index a50e5004550c..56ed1f9d348a 100644
--- a/include/asm-avr32/unistd.h
+++ b/include/asm-avr32/unistd.h
@@ -280,9 +280,10 @@
 #define __NR_sync_file_range    262
 #define __NR_tee                263
 #define __NR_vmsplice           264
+#define __NR_epoll_pwait        265
 
 #ifdef __KERNEL__
-#define NR_syscalls             265
+#define NR_syscalls             266
 
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
diff --git a/include/asm-frv/highmem.h b/include/asm-frv/highmem.h
index e2247c22a638..0f390f41f816 100644
--- a/include/asm-frv/highmem.h
+++ b/include/asm-frv/highmem.h
@@ -82,11 +82,11 @@ extern struct page *kmap_atomic_to_page(void *ptr);
         dampr = paddr | xAMPRx_L | xAMPRx_M | xAMPRx_S | xAMPRx_SS_16Kb | xAMPRx_V;             \
                                                                                                 \
         if (type != __KM_CACHE)                                                                 \
-                asm volatile("movgs %0,dampr"#ampr :: "r"(dampr));                              \
+                asm volatile("movgs %0,dampr"#ampr :: "r"(dampr) : "memory");                   \
         else                                                                                    \
                 asm volatile("movgs %0,iampr"#ampr"\n"                                          \
                              "movgs %0,dampr"#ampr"\n"                                          \
-                             :: "r"(dampr)                                                      \
+                             :: "r"(dampr) : "memory"                                           \
                              );                                                                 \
                                                                                                 \
         asm("movsg damlr"#ampr",%0" : "=r"(damlr));                                             \
@@ -104,7 +104,7 @@ extern struct page *kmap_atomic_to_page(void *ptr);
         asm volatile("movgs %0,tplr \n"                                                           \
                      "movgs %1,tppr \n"                                                           \
                      "tlbpr %0,gr0,#2,#1"                                                         \
-                     : : "r"(damlr), "r"(dampr));                                                 \
+                     : : "r"(damlr), "r"(dampr) : "memory");                                      \
                                                                                                   \
         /*printk("TLB: SECN sl=%d L=%08lx P=%08lx\n", slot, damlr, dampr);*/                      \
                                                                                                   \
@@ -115,7 +115,7 @@ static inline void *kmap_atomic(struct page *page, enum km_type type)
 {
         unsigned long paddr;
 
-        preempt_disable();
+        inc_preempt_count();
         paddr = page_to_phys(page);
 
         switch (type) {
@@ -138,16 +138,16 @@ static inline void *kmap_atomic(struct page *page, enum km_type type)
         }
 }
 
-#define __kunmap_atomic_primary(type, ampr)                     \
-do {                                                            \
-        asm volatile("movgs gr0,dampr"#ampr"\n");               \
-        if (type == __KM_CACHE)                                 \
-                asm volatile("movgs gr0,iampr"#ampr"\n");       \
+#define __kunmap_atomic_primary(type, ampr)                             \
+do {                                                                    \
+        asm volatile("movgs gr0,dampr"#ampr"\n" ::: "memory");          \
+        if (type == __KM_CACHE)                                         \
+                asm volatile("movgs gr0,iampr"#ampr"\n" ::: "memory");  \
 } while(0)
 
-#define __kunmap_atomic_secondary(slot, vaddr)                  \
-do {                                                            \
-        asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr));      \
+#define __kunmap_atomic_secondary(slot, vaddr)                          \
+do {                                                                    \
+        asm volatile("tlbpr %0,gr0,#4,#1" : : "r"(vaddr) : "memory");   \
 } while(0)
 
 static inline void kunmap_atomic(void *kvaddr, enum km_type type)
@@ -170,7 +170,8 @@ static inline void kunmap_atomic(void *kvaddr, enum km_type type)
         default:
                 BUG();
         }
-        preempt_enable();
+        dec_preempt_count();
+        preempt_check_resched();
 }
 
 #endif /* !__ASSEMBLY__ */
diff --git a/include/asm-frv/io.h b/include/asm-frv/io.h
index 7765f5528894..20e44fe00abf 100644
--- a/include/asm-frv/io.h
+++ b/include/asm-frv/io.h
@@ -385,27 +385,6 @@ static inline void pci_iounmap(struct pci_dev *dev, void __iomem *p)
  */
 #define xlate_dev_kmem_ptr(p)   p
 
-/*
- * Check BIOS signature
- */
-static inline int check_signature(volatile void __iomem *io_addr,
-                                  const unsigned char *signature, int length)
-{
-        int retval = 0;
-
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-
-        retval = 1;
-out:
-        return retval;
-}
-
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_IO_H */
diff --git a/include/asm-generic/bitops/sched.h b/include/asm-generic/bitops/sched.h
index 5ef93a4d009f..815bb0148060 100644
--- a/include/asm-generic/bitops/sched.h
+++ b/include/asm-generic/bitops/sched.h
@@ -15,7 +15,7 @@ static inline int sched_find_first_bit(const unsigned long *b)
 #if BITS_PER_LONG == 64
         if (unlikely(b[0]))
                 return __ffs(b[0]);
-        if (unlikely(b[1]))
+        if (likely(b[1]))
                 return __ffs(b[1]) + 64;
         return __ffs(b[2]) + 128;
 #elif BITS_PER_LONG == 32
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 1d9573cf4a0b..c92ae0f166ff 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -37,7 +37,10 @@
 #endif
 
 #ifndef HAVE_ARCH_WARN_ON
-#define WARN_ON(condition) unlikely((condition))
+#define WARN_ON(condition) ({                                           \
+        typeof(condition) __ret_warn_on = (condition);                  \
+        unlikely(__ret_warn_on);                                        \
+})
 #endif
 #endif
 
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index 69240b52f8e1..e60d6f21fa62 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -125,6 +125,10 @@
                 *(__param)                                              \
                 VMLINUX_SYMBOL(__stop___param) = .;                     \
         }                                                               \
+                                                                        \
+        /* Unwind data binary search table */                           \
+        EH_FRAME_HDR                                                    \
+                                                                        \
         __end_rodata = .;                                               \
         . = ALIGN(4096);
 
@@ -157,6 +161,18 @@
                 *(.kprobes.text)                                        \
                 VMLINUX_SYMBOL(__kprobes_text_end) = .;
 
+#ifdef CONFIG_STACK_UNWIND
+                /* Unwind data binary search table */
+#define EH_FRAME_HDR                                                    \
+                .eh_frame_hdr : AT(ADDR(.eh_frame_hdr) - LOAD_OFFSET) { \
+                        VMLINUX_SYMBOL(__start_unwind_hdr) = .;         \
+                        *(.eh_frame_hdr)                                \
+                        VMLINUX_SYMBOL(__end_unwind_hdr) = .;           \
+                }
+#else
+#define EH_FRAME_HDR
+#endif
+
                 /* DWARF debug sections.
                 Symbols in the DWARF debugging sections are relative to
                 the beginning of the section so we begin them at 0.  */
@@ -197,3 +213,22 @@
 
 #define NOTES                                                           \
                 .notes : { *(.note.*) } :note
+
+#define INITCALLS                                                       \
+        *(.initcall0.init)                                              \
+        *(.initcall0s.init)                                             \
+        *(.initcall1.init)                                              \
+        *(.initcall1s.init)                                             \
+        *(.initcall2.init)                                              \
+        *(.initcall2s.init)                                             \
+        *(.initcall3.init)                                              \
+        *(.initcall3s.init)                                             \
+        *(.initcall4.init)                                              \
+        *(.initcall4s.init)                                             \
+        *(.initcall5.init)                                              \
+        *(.initcall5s.init)                                             \
+        *(.initcall6.init)                                              \
+        *(.initcall6s.init)                                             \
+        *(.initcall7.init)                                              \
+        *(.initcall7s.init)
+
diff --git a/include/asm-i386/acpi.h b/include/asm-i386/acpi.h
index 6016632d032f..c80b3a94511a 100644
--- a/include/asm-i386/acpi.h
+++ b/include/asm-i386/acpi.h
@@ -132,6 +132,7 @@ extern int acpi_gsi_to_irq(u32 gsi, unsigned int *irq);
 
 #ifdef CONFIG_X86_IO_APIC
 extern int acpi_skip_timer_override;
+extern int acpi_use_timer_override;
 #endif
 
 static inline void acpi_noirq_set(void) { acpi_noirq = 1; }
diff --git a/include/asm-i386/io.h b/include/asm-i386/io.h
index b3724fe93ff1..68df0dc3ab8f 100644
--- a/include/asm-i386/io.h
+++ b/include/asm-i386/io.h
@@ -224,33 +224,6 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src, int
 
 #define eth_io_copy_and_sum(a,b,c,d)            eth_copy_and_sum((a),(void __force *)(b),(c),(d))
 
-/**
- *      check_signature         -       find BIOS signatures
- *      @io_addr: mmio address to check 
- *      @signature:  signature block
- *      @length: length of signature
- *
- *      Perform a signature comparison with the mmio address io_addr. This
- *      address should have been obtained by ioremap.
- *      Returns 1 on a match.
- */
- 
-static inline int check_signature(volatile void __iomem * io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /*
  *      Cache management
  *
diff --git a/include/asm-i386/io_apic.h b/include/asm-i386/io_apic.h
index 276ea7e8144a..059a9ff28b4d 100644
--- a/include/asm-i386/io_apic.h
+++ b/include/asm-i386/io_apic.h
@@ -12,10 +12,6 @@
 
 #ifdef CONFIG_X86_IO_APIC
 
-#define IO_APIC_BASE(idx) \
-                ((volatile int *)(__fix_to_virt(FIX_IO_APIC_BASE_0 + idx) \
-                + (mp_ioapics[idx].mpc_apicaddr & ~PAGE_MASK)))
-
 /*
  * The structure of the IO-APIC:
  */
@@ -119,31 +115,8 @@ extern struct mpc_config_intsrc mp_irqs[MAX_IRQ_SOURCES];
 /* non-0 if default (table-less) MP configuration */
 extern int mpc_default_type;
 
-static inline unsigned int io_apic_read(unsigned int apic, unsigned int reg)
-{
-        *IO_APIC_BASE(apic) = reg;
-        return *(IO_APIC_BASE(apic)+4);
-}
-
-static inline void io_apic_write(unsigned int apic, unsigned int reg, unsigned int value)
-{
-        *IO_APIC_BASE(apic) = reg;
-        *(IO_APIC_BASE(apic)+4) = value;
-}
-
-/*
- * Re-write a value: to be used for read-modify-write
- * cycles where the read already set up the index register.
- *
- * Older SiS APIC requires we rewrite the index regiser
- */
+/* Older SiS APIC requires we rewrite the index register */
 extern int sis_apic_bug;
-static inline void io_apic_modify(unsigned int apic, unsigned int reg, unsigned int value)
-{
-        if (sis_apic_bug)
-                *IO_APIC_BASE(apic) = reg;
-        *(IO_APIC_BASE(apic)+4) = value;
-}
 
 /* 1 if "noapic" boot option passed */
 extern int skip_ioapic_setup;
diff --git a/include/asm-i386/mach-visws/do_timer.h b/include/asm-i386/mach-visws/do_timer.h
deleted file mode 100644
index 21cd696d4d0f..000000000000
--- a/include/asm-i386/mach-visws/do_timer.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/* defines for inline arch setup functions */
-
-#include <asm/fixmap.h>
-#include <asm/i8259.h>
-#include "cobalt.h"
-
-static inline void do_timer_interrupt_hook(void)
-{
-        /* Clear the interrupt */
-        co_cpu_write(CO_CPU_STAT,co_cpu_read(CO_CPU_STAT) & ~CO_STAT_TIMEINTR);
-
-        do_timer(1);
-#ifndef CONFIG_SMP
-        update_process_times(user_mode_vm(irq_regs));
-#endif
-/*
- * In the SMP case we use the local APIC timer interrupt to do the
- * profiling, except when we simulate SMP mode on a uniprocessor
- * system, in that case we have to call the local interrupt handler.
- */
-#ifndef CONFIG_X86_LOCAL_APIC
-        profile_tick(CPU_PROFILING);
-#else
-        if (!using_apic_timer)
-                smp_local_timer_interrupt();
-#endif
-}
-
-static inline int do_timer_overflow(int count)
-{
-        int i;
-
-        spin_lock(&i8259A_lock);
-        /*
-         * This is tricky when I/O APICs are used;
-         * see do_timer_interrupt().
-         */
-        i = inb(0x20);
-        spin_unlock(&i8259A_lock);
-        
-        /* assumption about timer being IRQ0 */
-        if (i & 0x01) {
-                /*
-                 * We cannot detect lost timer interrupts ... 
-                 * well, that's why we call them lost, don't we? :)
-                 * [hmm, on the Pentium and Alpha we can ... sort of]
-                 */
-                count -= LATCH;
-        } else {
-                printk("do_slow_gettimeoffset(): hardware timer problem?\n");
-        }
-        return count;
-}
diff --git a/include/asm-i386/mach-visws/mach_apic.h b/include/asm-i386/mach-visws/mach_apic.h
index de438c7147a8..18afe6b6fc4d 100644
--- a/include/asm-i386/mach-visws/mach_apic.h
+++ b/include/asm-i386/mach-visws/mach_apic.h
@@ -51,6 +51,11 @@ static inline void clustered_apic_check(void)
 {
 }
 
+static inline int apicid_to_node(int logical_apicid)
+{
+        return 0;
+}
+
 /* Mapping from cpu number to logical apicid */
 static inline int cpu_to_logical_apicid(int cpu)
 {
diff --git a/include/asm-i386/processor.h b/include/asm-i386/processor.h
index 2277127696d2..e0ddca94d50c 100644
--- a/include/asm-i386/processor.h
+++ b/include/asm-i386/processor.h
@@ -306,6 +306,8 @@ static inline void __mwait(unsigned long eax, unsigned long ecx)
                 : :"a" (eax), "c" (ecx));
 }
 
+extern void mwait_idle_with_hints(unsigned long eax, unsigned long ecx);
+
 /* from system description table in BIOS.  Mostly for MCA use, but
 others may find it useful. */
 extern unsigned int machine_id;
diff --git a/include/asm-i386/uaccess.h b/include/asm-i386/uaccess.h
index 54d905ebc63d..eef5133b9ce2 100644
--- a/include/asm-i386/uaccess.h
+++ b/include/asm-i386/uaccess.h
@@ -404,20 +404,6 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero(void *to,
  * anything, so this is accurate.
  */
 
-/**
- * __copy_to_user: - Copy a block of data into user space, with less checking.
- * @to:   Destination address, in user space.
- * @from: Source address, in kernel space.
- * @n:    Number of bytes to copy.
- *
- * Context: User context only.  This function may sleep.
- *
- * Copy data from kernel space to user space.  Caller must check
- * the specified block with access_ok() before calling this function.
- *
- * Returns number of bytes that could not be copied.
- * On success, this will be zero.
- */
 static __always_inline unsigned long __must_check
 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
 {
@@ -439,35 +425,27 @@ __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
         return __copy_to_user_ll(to, from, n);
 }
 
-static __always_inline unsigned long __must_check
-__copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-       might_sleep();
-       return __copy_to_user_inatomic(to, from, n);
-}
-
 /**
- * __copy_from_user: - Copy a block of data from user space, with less checking.
- * @to:   Destination address, in kernel space.
- * @from: Source address, in user space.
+ * __copy_to_user: - Copy a block of data into user space, with less checking.
+ * @to:   Destination address, in user space.
+ * @from: Source address, in kernel space.
  * @n:    Number of bytes to copy.
  *
  * Context: User context only.  This function may sleep.
  *
- * Copy data from user space to kernel space.  Caller must check
+ * Copy data from kernel space to user space.  Caller must check
  * the specified block with access_ok() before calling this function.
  *
  * Returns number of bytes that could not be copied.
  * On success, this will be zero.
- *
- * If some data could not be copied, this function will pad the copied
- * data to the requested size using zero bytes.
- *
- * An alternate version - __copy_from_user_inatomic() - may be called from
- * atomic context and will fail rather than sleep.  In this case the
- * uncopied bytes will *NOT* be padded with zeros.  See fs/filemap.h
- * for explanation of why this is needed.
  */
+static __always_inline unsigned long __must_check
+__copy_to_user(void __user *to, const void *from, unsigned long n)
+{
+       might_sleep();
+       return __copy_to_user_inatomic(to, from, n);
+}
+
 static __always_inline unsigned long
 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
 {
@@ -493,6 +471,29 @@ __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
         }
         return __copy_from_user_ll_nozero(to, from, n);
 }
+
+/**
+ * __copy_from_user: - Copy a block of data from user space, with less checking.
+ * @to:   Destination address, in kernel space.
+ * @from: Source address, in user space.
+ * @n:    Number of bytes to copy.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Copy data from user space to kernel space.  Caller must check
+ * the specified block with access_ok() before calling this function.
+ *
+ * Returns number of bytes that could not be copied.
+ * On success, this will be zero.
+ *
+ * If some data could not be copied, this function will pad the copied
+ * data to the requested size using zero bytes.
+ *
+ * An alternate version - __copy_from_user_inatomic() - may be called from
+ * atomic context and will fail rather than sleep.  In this case the
+ * uncopied bytes will *NOT* be padded with zeros.  See fs/filemap.h
+ * for explanation of why this is needed.
+ */
 static __always_inline unsigned long
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index 3ca7ab963d7d..beeeaf6b054a 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -324,10 +324,11 @@
 #define __NR_vmsplice           316
 #define __NR_move_pages         317
 #define __NR_getcpu             318
+#define __NR_epoll_pwait        319
 
 #ifdef __KERNEL__
 
-#define NR_syscalls 319
+#define NR_syscalls 320
 #include <linux/err.h>
 
 /*
diff --git a/include/asm-i386/vic.h b/include/asm-i386/vic.h
index 4abfcfb91eb8..53100f353612 100644
--- a/include/asm-i386/vic.h
+++ b/include/asm-i386/vic.h
@@ -58,4 +58,4 @@ static const int VIC_CPI_Registers[] =
 
 #define VIC_BOOT_INTERRUPT_MASK         0xfe
 
-extern void smp_vic_timer_interrupt(struct pt_regs *regs);
+extern void smp_vic_timer_interrupt(void);
diff --git a/include/asm-i386/voyager.h b/include/asm-i386/voyager.h
index e74c54aa757f..5b27838905b2 100644
--- a/include/asm-i386/voyager.h
+++ b/include/asm-i386/voyager.h
@@ -118,33 +118,33 @@ typedef struct voyager_module {
 } voyager_module_t;
 
 typedef struct voyager_eeprom_hdr {
-         __u8  module_id[4] __attribute__((packed)); 
-         __u8  version_id __attribute__((packed));
-         __u8  config_id __attribute__((packed)); 
-         __u16 boundry_id __attribute__((packed));      /* boundary scan id */
-         __u16 ee_size __attribute__((packed));         /* size of EEPROM */
-         __u8  assembly[11] __attribute__((packed));    /* assembly # */
-         __u8  assembly_rev __attribute__((packed));    /* assembly rev */
-         __u8  tracer[4] __attribute__((packed));       /* tracer number */
-         __u16 assembly_cksum __attribute__((packed));  /* asm checksum */
-         __u16 power_consump __attribute__((packed));   /* pwr requirements */
-         __u16 num_asics __attribute__((packed));       /* number of asics */
-         __u16 bist_time __attribute__((packed));       /* min. bist time */
-         __u16 err_log_offset __attribute__((packed));  /* error log offset */
-         __u16 scan_path_offset __attribute__((packed));/* scan path offset */
-         __u16 cct_offset __attribute__((packed));
-         __u16 log_length __attribute__((packed));      /* length of err log */
-         __u16 xsum_end __attribute__((packed));        /* offset to end of
+         __u8  module_id[4];
+         __u8  version_id;
+         __u8  config_id;
+         __u16 boundry_id;      /* boundary scan id */
+         __u16 ee_size;         /* size of EEPROM */
+         __u8  assembly[11];    /* assembly # */
+         __u8  assembly_rev;    /* assembly rev */
+         __u8  tracer[4];       /* tracer number */
+         __u16 assembly_cksum;  /* asm checksum */
+         __u16 power_consump;   /* pwr requirements */
+         __u16 num_asics;       /* number of asics */
+         __u16 bist_time;       /* min. bist time */
+         __u16 err_log_offset;  /* error log offset */
+         __u16 scan_path_offset;/* scan path offset */
+         __u16 cct_offset;
+         __u16 log_length;      /* length of err log */
+         __u16 xsum_end;        /* offset to end of
                                                            checksum */
-         __u8  reserved[4] __attribute__((packed));
-         __u8  sflag __attribute__((packed));           /* starting sentinal */
-         __u8  part_number[13] __attribute__((packed)); /* prom part number */
-         __u8  version[10] __attribute__((packed));     /* version number */
-         __u8  signature[8] __attribute__((packed));
-         __u16 eeprom_chksum __attribute__((packed));
-         __u32  data_stamp_offset __attribute__((packed));
-         __u8  eflag  __attribute__((packed));           /* ending sentinal */
-} voyager_eprom_hdr_t;
+         __u8  reserved[4];
+         __u8  sflag;           /* starting sentinal */
+         __u8  part_number[13]; /* prom part number */
+         __u8  version[10];     /* version number */
+         __u8  signature[8];
+         __u16 eeprom_chksum;
+         __u32  data_stamp_offset;
+         __u8  eflag ;           /* ending sentinal */
+} __attribute__((packed)) voyager_eprom_hdr_t;
 
 
 
@@ -155,30 +155,30 @@ typedef struct voyager_eeprom_hdr {
  * in the module EPROMs.  We really only care about the IDs and
  * offsets */
 typedef struct voyager_sp_table {
-        __u8 asic_id __attribute__((packed));
-        __u8 bypass_flag __attribute__((packed));
-        __u16 asic_data_offset __attribute__((packed));
-        __u16 config_data_offset __attribute__((packed));
-} voyager_sp_table_t;
+        __u8 asic_id;
+        __u8 bypass_flag;
+        __u16 asic_data_offset;
+        __u16 config_data_offset;
+} __attribute__((packed)) voyager_sp_table_t;
 
 typedef struct voyager_jtag_table {
-        __u8 icode[4] __attribute__((packed));
-        __u8 runbist[4] __attribute__((packed));
-        __u8 intest[4] __attribute__((packed));
-        __u8 samp_preld[4] __attribute__((packed));
-        __u8 ireg_len __attribute__((packed));
-} voyager_jtt_t;
+        __u8 icode[4];
+        __u8 runbist[4];
+        __u8 intest[4];
+        __u8 samp_preld[4];
+        __u8 ireg_len;
+} __attribute__((packed)) voyager_jtt_t;
 
 typedef struct voyager_asic_data_table {
-        __u8 jtag_id[4] __attribute__((packed));
-        __u16 length_bsr __attribute__((packed));
-        __u16 length_bist_reg __attribute__((packed));
-        __u32 bist_clk __attribute__((packed));
-        __u16 subaddr_bits __attribute__((packed));
-        __u16 seed_bits __attribute__((packed));
-        __u16 sig_bits __attribute__((packed));
-        __u16 jtag_offset __attribute__((packed));
-} voyager_at_t;
+        __u8 jtag_id[4];
+        __u16 length_bsr;
+        __u16 length_bist_reg;
+        __u32 bist_clk;
+        __u16 subaddr_bits;
+        __u16 seed_bits;
+        __u16 sig_bits;
+        __u16 jtag_offset;
+} __attribute__((packed)) voyager_at_t;
 
 /* Voyager Interrupt Controller (VIC) registers */
 
@@ -328,52 +328,52 @@ struct voyager_bios_info {
 #define NUMBER_OF_POS_REGS      8
 
 typedef struct {
-        __u8    MC_Slot __attribute__((packed));
-        __u8    POS_Values[NUMBER_OF_POS_REGS] __attribute__((packed));
-} MC_SlotInformation_t;
+        __u8    MC_Slot;
+        __u8    POS_Values[NUMBER_OF_POS_REGS];
+} __attribute__((packed)) MC_SlotInformation_t;
 
 struct QuadDescription {
-        __u8  Type __attribute__((packed));     /* for type 0 (DYADIC or MONADIC) all fields
+        __u8  Type;     /* for type 0 (DYADIC or MONADIC) all fields
                          * will be zero except for slot */
-        __u8 StructureVersion __attribute__((packed));
-        __u32 CPI_BaseAddress __attribute__((packed));
-        __u32  LARC_BankSize __attribute__((packed));   
-        __u32 LocalMemoryStateBits __attribute__((packed));
-        __u8  Slot __attribute__((packed)); /* Processor slots 1 - 4 */
-}; 
+        __u8 StructureVersion;
+        __u32 CPI_BaseAddress;
+        __u32  LARC_BankSize;
+        __u32 LocalMemoryStateBits;
+        __u8  Slot; /* Processor slots 1 - 4 */
+} __attribute__((packed));
 
 struct ProcBoardInfo { 
-        __u8 Type __attribute__((packed));    
-        __u8 StructureVersion __attribute__((packed));
-        __u8 NumberOfBoards __attribute__((packed));
-        struct QuadDescription QuadData[MAX_PROCESSOR_BOARDS] __attribute__((packed));
-};
+        __u8 Type;
+        __u8 StructureVersion;
+        __u8 NumberOfBoards;
+        struct QuadDescription QuadData[MAX_PROCESSOR_BOARDS];
+} __attribute__((packed));
 
 struct CacheDescription {
-        __u8 Level __attribute__((packed));
-        __u32 TotalSize __attribute__((packed));
-        __u16 LineSize __attribute__((packed));
-        __u8  Associativity __attribute__((packed));
-        __u8  CacheType __attribute__((packed));
-        __u8  WriteType __attribute__((packed));
-        __u8  Number_CPUs_SharedBy __attribute__((packed));
-        __u8  Shared_CPUs_Hardware_IDs[MAX_SHARED_CPUS] __attribute__((packed));
+        __u8 Level;
+        __u32 TotalSize;
+        __u16 LineSize;
+        __u8  Associativity;
+        __u8  CacheType;
+        __u8  WriteType;
+        __u8  Number_CPUs_SharedBy;
+        __u8  Shared_CPUs_Hardware_IDs[MAX_SHARED_CPUS];
 
-};
+} __attribute__((packed));
 
 struct CPU_Description {
-        __u8 CPU_HardwareId __attribute__((packed));
-        char *FRU_String __attribute__((packed));
-        __u8 NumberOfCacheLevels __attribute__((packed));
-        struct CacheDescription CacheLevelData[MAX_CACHE_LEVELS] __attribute__((packed));
-};
+        __u8 CPU_HardwareId;
+        char *FRU_String;
+        __u8 NumberOfCacheLevels;
+        struct CacheDescription CacheLevelData[MAX_CACHE_LEVELS];
+} __attribute__((packed));
 
 struct CPU_Info {
-        __u8 Type __attribute__((packed));
-        __u8 StructureVersion __attribute__((packed));
-        __u8 NumberOf_CPUs __attribute__((packed));
-        struct CPU_Description CPU_Data[MAX_CPUS] __attribute__((packed));
-};
+        __u8 Type;
+        __u8 StructureVersion;
+        __u8 NumberOf_CPUs;
+        struct CPU_Description CPU_Data[MAX_CPUS];
+} __attribute__((packed));
 
 
 /*
diff --git a/include/asm-ia64/io.h b/include/asm-ia64/io.h
index 43bfff6c6b87..855c30af72a9 100644
--- a/include/asm-ia64/io.h
+++ b/include/asm-ia64/io.h
@@ -417,6 +417,8 @@ __writeq (unsigned long val, volatile void __iomem *addr)
 # define outl_p         outl
 #endif
 
+# ifdef __KERNEL__
+
 extern void __iomem * ioremap(unsigned long offset, unsigned long size);
 extern void __iomem * ioremap_nocache (unsigned long offset, unsigned long size);
 
@@ -430,8 +432,6 @@ iounmap (volatile void __iomem *addr)
 #define dmi_iounmap(x,l) iounmap(x)
 #define dmi_alloc(l) kmalloc(l, GFP_ATOMIC)
 
-# ifdef __KERNEL__
-
 /*
  * String version of IO memory access ops:
  */
diff --git a/include/asm-ia64/pal.h b/include/asm-ia64/pal.h
index 2c8fd92d0ece..4283ddcc25fb 100644
--- a/include/asm-ia64/pal.h
+++ b/include/asm-ia64/pal.h
@@ -764,7 +764,7 @@ struct ia64_pal_retval {
  * (generally 0) MUST be passed.  Reserved parameters are not optional
  * parameters.
  */
-extern struct ia64_pal_retval ia64_pal_call_static (u64, u64, u64, u64, u64);
+extern struct ia64_pal_retval ia64_pal_call_static (u64, u64, u64, u64);
 extern struct ia64_pal_retval ia64_pal_call_stacked (u64, u64, u64, u64);
 extern struct ia64_pal_retval ia64_pal_call_phys_static (u64, u64, u64, u64);
 extern struct ia64_pal_retval ia64_pal_call_phys_stacked (u64, u64, u64, u64);
@@ -774,14 +774,7 @@ extern void ia64_load_scratch_fpregs (struct ia64_fpreg *);
 #define PAL_CALL(iprv,a0,a1,a2,a3) do {                 \
         struct ia64_fpreg fr[6];                        \
         ia64_save_scratch_fpregs(fr);                   \
-        iprv = ia64_pal_call_static(a0, a1, a2, a3, 0); \
-        ia64_load_scratch_fpregs(fr);                   \
-} while (0)
-
-#define PAL_CALL_IC_OFF(iprv,a0,a1,a2,a3) do {          \
-        struct ia64_fpreg fr[6];                        \
-        ia64_save_scratch_fpregs(fr);                   \
-        iprv = ia64_pal_call_static(a0, a1, a2, a3, 1); \
+        iprv = ia64_pal_call_static(a0, a1, a2, a3);    \
         ia64_load_scratch_fpregs(fr);                   \
 } while (0)
 
diff --git a/include/asm-ia64/sal.h b/include/asm-ia64/sal.h
index 0b210abbe003..d000689d9142 100644
--- a/include/asm-ia64/sal.h
+++ b/include/asm-ia64/sal.h
@@ -659,6 +659,7 @@ ia64_sal_freq_base (unsigned long which, unsigned long *ticks_per_second,
 }
 
 extern s64 ia64_sal_cache_flush (u64 cache_type);
+extern void __init check_sal_cache_flush (void);
 
 /* Initialize all the processor and platform level instruction and data caches */
 static inline s64
diff --git a/include/asm-ia64/sn/addrs.h b/include/asm-ia64/sn/addrs.h
index 1d9efe541662..e715c794b186 100644
--- a/include/asm-ia64/sn/addrs.h
+++ b/include/asm-ia64/sn/addrs.h
@@ -136,9 +136,13 @@
  */
 #define TO_PHYS(x)              (TO_PHYS_MASK & (x))
 #define TO_CAC(x)               (CAC_BASE     | TO_PHYS(x))
+#ifdef CONFIG_SGI_SN
 #define TO_AMO(x)               (AMO_BASE     | TO_PHYS(x))
 #define TO_GET(x)               (GET_BASE     | TO_PHYS(x))
-
+#else
+#define TO_AMO(x)               ({ BUG(); x; })
+#define TO_GET(x)               ({ BUG(); x; })
+#endif
 
 /*
  * Covert from processor physical address to II/TIO physical address:
diff --git a/include/asm-ia64/uaccess.h b/include/asm-ia64/uaccess.h
index 9adb51211c22..449c8c0fa2bd 100644
--- a/include/asm-ia64/uaccess.h
+++ b/include/asm-ia64/uaccess.h
@@ -389,7 +389,7 @@ xlate_dev_kmem_ptr (char * p)
         struct page *page;
         char * ptr;
 
-        page = virt_to_page((unsigned long)p >> PAGE_SHIFT);
+        page = virt_to_page((unsigned long)p);
         if (PageUncached(page))
                 ptr = (char *)__pa(p) + __IA64_UNCACHED_OFFSET;
         else
diff --git a/include/asm-m32r/io.h b/include/asm-m32r/io.h
index 70ad1c949c2b..d06933bd6318 100644
--- a/include/asm-m32r/io.h
+++ b/include/asm-m32r/io.h
@@ -166,38 +166,6 @@ static inline void _writel(unsigned long l, unsigned long addr)
 
 #define flush_write_buffers() do { } while (0)  /* M32R_FIXME */
 
-/**
- *      check_signature         -       find BIOS signatures
- *      @io_addr: mmio address to check
- *      @signature:  signature block
- *      @length: length of signature
- *
- *      Perform a signature comparison with the ISA mmio address io_addr.
- *      Returns 1 on a match.
- *
- *      This function is deprecated. New drivers should use ioremap and
- *      check_signature.
- */
-
-static inline int check_signature(void __iomem *io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-#if 0
-printk("check_signature\n");
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-#endif
-        return retval;
-}
-
 static inline void
 memset_io(volatile void __iomem *addr, unsigned char val, int count)
 {
diff --git a/include/asm-m68k/sun3mmu.h b/include/asm-m68k/sun3mmu.h
index 6c8c17d047a1..d8f17a0d8c9f 100644
--- a/include/asm-m68k/sun3mmu.h
+++ b/include/asm-m68k/sun3mmu.h
@@ -4,6 +4,7 @@
 #ifndef __SUN3_MMU_H__
 #define __SUN3_MMU_H__
 
+#include <linux/types.h>
 #include <asm/movs.h>
 #include <asm/sun3-head.h>
 
@@ -160,7 +161,7 @@ static inline void sun3_put_context(unsigned char c)
         return;
 }
 
-extern void *sun3_ioremap(unsigned long phys, unsigned long size,
+extern void __iomem *sun3_ioremap(unsigned long phys, unsigned long size,
                           unsigned long type);
 
 extern int sun3_map_test(unsigned long addr, char *val);
diff --git a/include/asm-m68k/uaccess.h b/include/asm-m68k/uaccess.h
index 88b1f47400e1..e4c9f080ff20 100644
--- a/include/asm-m68k/uaccess.h
+++ b/include/asm-m68k/uaccess.h
@@ -76,7 +76,7 @@ asm volatile ("\n"					\
                 break;                                                  \
         case 8:                                                         \
             {                                                           \
-                const void *__pu_ptr = (ptr);                           \
+                const void __user *__pu_ptr = (ptr);                    \
                 asm volatile ("\n"                                      \
                         "1:     moves.l %2,(%1)+\n"                     \
                         "2:     moves.l %R2,(%1)\n"                     \
@@ -125,7 +125,7 @@ asm volatile ("\n"					\
                 "       .previous"                              \
                 : "+d" (res), "=&" #reg (__gu_val)              \
                 : "m" (*(ptr)), "i" (err));                     \
-        (x) = (typeof(*(ptr)))(long)__gu_val;                   \
+        (x) = (typeof(*(ptr)))(unsigned long)__gu_val;          \
 })
 
 #define __get_user(x, ptr)                                              \
@@ -221,16 +221,16 @@ __constant_copy_from_user(void *to, const void __user *from, unsigned long n)
 
         switch (n) {
         case 1:
-                __get_user_asm(res, *(u8 *)to, (u8 *)from, u8, b, d, 1);
+                __get_user_asm(res, *(u8 *)to, (u8 __user *)from, u8, b, d, 1);
                 break;
         case 2:
-                __get_user_asm(res, *(u16 *)to, (u16 *)from, u16, w, d, 2);
+                __get_user_asm(res, *(u16 *)to, (u16 __user *)from, u16, w, d, 2);
                 break;
         case 3:
                 __constant_copy_from_user_asm(res, to, from, tmp, 3, w, b,);
                 break;
         case 4:
-                __get_user_asm(res, *(u32 *)to, (u32 *)from, u32, l, r, 4);
+                __get_user_asm(res, *(u32 *)to, (u32 __user *)from, u32, l, r, 4);
                 break;
         case 5:
                 __constant_copy_from_user_asm(res, to, from, tmp, 5, l, b,);
@@ -302,16 +302,16 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
 
         switch (n) {
         case 1:
-                __put_user_asm(res, *(u8 *)from, (u8 *)to, b, d, 1);
+                __put_user_asm(res, *(u8 *)from, (u8 __user *)to, b, d, 1);
                 break;
         case 2:
-                __put_user_asm(res, *(u16 *)from, (u16 *)to, w, d, 2);
+                __put_user_asm(res, *(u16 *)from, (u16 __user *)to, w, d, 2);
                 break;
         case 3:
                 __constant_copy_to_user_asm(res, to, from, tmp, 3, w, b,);
                 break;
         case 4:
-                __put_user_asm(res, *(u32 *)from, (u32 *)to, l, r, 4);
+                __put_user_asm(res, *(u32 *)from, (u32 __user *)to, l, r, 4);
                 break;
         case 5:
                 __constant_copy_to_user_asm(res, to, from, tmp, 5, l, b,);
diff --git a/include/asm-m68knommu/irq_regs.h b/include/asm-m68knommu/irq_regs.h
new file mode 100644
index 000000000000..3dd9c0b70270
--- /dev/null
+++ b/include/asm-m68knommu/irq_regs.h
@@ -0,0 +1 @@
+#include <asm-generic/irq_regs.h>
diff --git a/include/asm-m68knommu/irqnode.h b/include/asm-m68knommu/irqnode.h
index a2503dfc554c..6132a9858b52 100644
--- a/include/asm-m68knommu/irqnode.h
+++ b/include/asm-m68knommu/irqnode.h
@@ -8,7 +8,7 @@
  * interrupt source (if it supports chaining).
  */
 typedef struct irq_node {
-        irqreturn_t     (*handler)(int, void *, struct pt_regs *);
+        irq_handler_t   handler;
         unsigned long   flags;
         void            *dev_id;
         const char      *devname;
@@ -18,12 +18,12 @@ typedef struct irq_node {
 /*
  * This structure has only 4 elements for speed reasons
  */
-typedef struct irq_handler {
-        irqreturn_t     (*handler)(int, void *, struct pt_regs *);
+struct irq_entry {
+        irq_handler_t   handler;
         unsigned long   flags;
         void            *dev_id;
         const char      *devname;
-} irq_handler_t;
+};
 
 /* count of spurious interrupts */
 extern volatile unsigned int num_spurious;
diff --git a/include/asm-m68knommu/machdep.h b/include/asm-m68knommu/machdep.h
index 27c90afd3339..6ce28f8e0ead 100644
--- a/include/asm-m68knommu/machdep.h
+++ b/include/asm-m68knommu/machdep.h
@@ -18,7 +18,7 @@ extern int (*mach_kbdrate) (struct kbd_repeat *);
 extern void (*mach_kbd_leds) (unsigned int);
 /* machine dependent irq functions */
 extern void (*mach_init_IRQ) (void);
-extern irqreturn_t (*(*mach_default_handler)[]) (int, void *, struct pt_regs *);
+extern irq_handler_t mach_default_handler;
 extern int (*mach_request_irq) (unsigned int irq, void (*handler)(int, void *, struct pt_regs *),
                                 unsigned long flags, const char *devname, void *dev_id);
 extern void (*mach_free_irq) (unsigned int irq, void *dev_id);
diff --git a/include/asm-m68knommu/unistd.h b/include/asm-m68knommu/unistd.h
index daafb5d43ef1..ebaf03197114 100644
--- a/include/asm-m68knommu/unistd.h
+++ b/include/asm-m68knommu/unistd.h
@@ -281,14 +281,43 @@
 #define __NR_mq_notify          275
 #define __NR_mq_getsetattr      276
 #define __NR_waitid             277
-#define __NR_sys_setaltroot     278
+#define __NR_vserver            278
 #define __NR_add_key            279
 #define __NR_request_key        280
 #define __NR_keyctl             281
- 
+#define __NR_ioprio_set         282
+#define __NR_ioprio_get         283
+#define __NR_inotify_init       284
+#define __NR_inotify_add_watch  285
+#define __NR_inotify_rm_watch   286
+#define __NR_migrate_pages      287
+#define __NR_openat             288
+#define __NR_mkdirat            289
+#define __NR_mknodat            290
+#define __NR_fchownat           291
+#define __NR_futimesat          292
+#define __NR_fstatat64          293
+#define __NR_unlinkat           294
+#define __NR_renameat           295
+#define __NR_linkat             296
+#define __NR_symlinkat          297
+#define __NR_readlinkat         298
+#define __NR_fchmodat           299
+#define __NR_faccessat          300
+#define __NR_pselect6           301
+#define __NR_ppoll              302
+#define __NR_unshare            303
+#define __NR_set_robust_list    304
+#define __NR_get_robust_list    305
+#define __NR_splice             306
+#define __NR_sync_file_range    307
+#define __NR_tee                308
+#define __NR_vmsplice           309
+#define __NR_move_pages         310
+
 #ifdef __KERNEL__
 
-#define NR_syscalls             282
+#define NR_syscalls             311
 #include <linux/err.h>
 
 /* user-visible error numbers are in the range -1 - -MAX_ERRNO: see
diff --git a/include/asm-mips/asm.h b/include/asm-mips/asm.h
index e3038a4599ee..838eb3144d81 100644
--- a/include/asm-mips/asm.h
+++ b/include/asm-mips/asm.h
@@ -344,6 +344,7 @@ symbol		=	value
 #define PTR_L           lw
 #define PTR_S           sw
 #define PTR_LA          la
+#define PTR_LI          li
 #define PTR_SLL         sll
 #define PTR_SLLV        sllv
 #define PTR_SRL         srl
@@ -368,6 +369,7 @@ symbol		=	value
 #define PTR_L           ld
 #define PTR_S           sd
 #define PTR_LA          dla
+#define PTR_LI          dli
 #define PTR_SLL         dsll
 #define PTR_SLLV        dsllv
 #define PTR_SRL         dsrl
diff --git a/include/asm-mips/cacheflush.h b/include/asm-mips/cacheflush.h
index 9ab59e2bb233..e3c9925876a3 100644
--- a/include/asm-mips/cacheflush.h
+++ b/include/asm-mips/cacheflush.h
@@ -55,24 +55,13 @@ extern void (*flush_icache_range)(unsigned long start, unsigned long end);
 #define flush_cache_vmap(start, end)            flush_cache_all()
 #define flush_cache_vunmap(start, end)          flush_cache_all()
 
-static inline void copy_to_user_page(struct vm_area_struct *vma,
+extern void copy_to_user_page(struct vm_area_struct *vma,
         struct page *page, unsigned long vaddr, void *dst, const void *src,
-        unsigned long len)
-{
-        if (cpu_has_dc_aliases)
-                flush_cache_page(vma, vaddr, page_to_pfn(page));
-        memcpy(dst, src, len);
-        __flush_icache_page(vma, page);
-}
+        unsigned long len);
 
-static inline void copy_from_user_page(struct vm_area_struct *vma,
+extern void copy_from_user_page(struct vm_area_struct *vma,
         struct page *page, unsigned long vaddr, void *dst, const void *src,
-        unsigned long len)
-{
-        if (cpu_has_dc_aliases)
-                flush_cache_page(vma, vaddr, page_to_pfn(page));
-        memcpy(dst, src, len);
-}
+        unsigned long len);
 
 extern void (*flush_cache_sigtramp)(unsigned long addr);
 extern void (*flush_icache_all)(void);
diff --git a/include/asm-mips/div64.h b/include/asm-mips/div64.h
index 5f7dcf5452e7..d107832de1b6 100644
--- a/include/asm-mips/div64.h
+++ b/include/asm-mips/div64.h
@@ -83,27 +83,6 @@
 #if (_MIPS_SZLONG == 64)
 
 /*
- * Don't use this one in new code
- */
-#define do_div64_32(res, high, low, base) ({ \
-        unsigned int __quot, __mod; \
-        unsigned long __div; \
-        unsigned int __low, __high, __base; \
-        \
-        __high = (high); \
-        __low = (low); \
-        __div = __high; \
-        __div = __div << 32 | __low; \
-        __base = (base); \
-        \
-        __mod = __div % __base; \
-        __div = __div / __base; \
-        \
-        __quot = __div; \
-        (res) = __quot; \
-        __mod; })
-
-/*
  * Hey, we're already 64-bit, no
  * need to play games..
  */
diff --git a/include/asm-mips/fixmap.h b/include/asm-mips/fixmap.h
index 6959bdb59310..02c8a13fc894 100644
--- a/include/asm-mips/fixmap.h
+++ b/include/asm-mips/fixmap.h
@@ -45,8 +45,16 @@
  * fix-mapped?
  */
 enum fixed_addresses {
+#define FIX_N_COLOURS 8
+        FIX_CMAP_BEGIN,
+#ifdef CONFIG_MIPS_MT_SMTC
+        FIX_CMAP_END = FIX_CMAP_BEGIN + (FIX_N_COLOURS * NR_CPUS),
+#else
+        FIX_CMAP_END = FIX_CMAP_BEGIN + FIX_N_COLOURS,
+#endif
 #ifdef CONFIG_HIGHMEM
-        FIX_KMAP_BEGIN, /* reserved pte's for temporary kernel mappings */
+        /* reserved pte's for temporary kernel mappings */
+        FIX_KMAP_BEGIN = FIX_CMAP_END + 1,
         FIX_KMAP_END = FIX_KMAP_BEGIN+(KM_TYPE_NR*NR_CPUS)-1,
 #endif
         __end_of_fixed_addresses
@@ -70,9 +78,9 @@ extern void __set_fixmap (enum fixed_addresses idx,
  * at the top of mem..
  */
 #if defined(CONFIG_CPU_TX39XX) || defined(CONFIG_CPU_TX49XX)
-#define FIXADDR_TOP     (0xff000000UL - 0x2000)
+#define FIXADDR_TOP     ((unsigned long)(long)(int)(0xff000000 - 0x20000))
 #else
-#define FIXADDR_TOP     (0xffffe000UL)
+#define FIXADDR_TOP     ((unsigned long)(long)(int)0xfffe0000)
 #endif
 #define FIXADDR_SIZE    (__end_of_fixed_addresses << PAGE_SHIFT)
 #define FIXADDR_START   (FIXADDR_TOP - FIXADDR_SIZE)
diff --git a/include/asm-mips/io.h b/include/asm-mips/io.h
index df624e1ee6e2..bc5f3c53155f 100644
--- a/include/asm-mips/io.h
+++ b/include/asm-mips/io.h
@@ -172,7 +172,7 @@ extern unsigned long isa_slot_offset;
 #define page_to_phys(page)      ((dma_addr_t)page_to_pfn(page) << PAGE_SHIFT)
 
 extern void __iomem * __ioremap(phys_t offset, phys_t size, unsigned long flags);
-extern void __iounmap(volatile void __iomem *addr);
+extern void __iounmap(const volatile void __iomem *addr);
 
 static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
         unsigned long flags)
@@ -279,7 +279,7 @@ static inline void __iomem * __ioremap_mode(phys_t offset, unsigned long size,
 #define ioremap_uncached_accelerated(offset, size)                      \
         __ioremap_mode((offset), (size), _CACHE_UNCACHED_ACCELERATED)
 
-static inline void iounmap(volatile void __iomem *addr)
+static inline void iounmap(const volatile void __iomem *addr)
 {
 #define __IS_KSEG1(addr) (((unsigned long)(addr) & ~0x1fffffffUL) == CKSEG1)
 
@@ -562,32 +562,6 @@ extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
 #define eth_io_copy_and_sum(skb,src,len,unused) memcpy_fromio((skb)->data,(src),(len))
 
 /*
- *     check_signature         -       find BIOS signatures
- *     @io_addr: mmio address to check
- *     @signature:  signature block
- *     @length: length of signature
- *
- *     Perform a signature comparison with the mmio address io_addr. This
- *     address should have been obtained by ioremap.
- *     Returns 1 on a match.
- */
-static inline int check_signature(char __iomem *io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
-/*
  * The caches on some architectures aren't dma-coherent and have need to
  * handle this in software.  There are three types of operations that
  * can be applied to dma buffers.
diff --git a/include/asm-mips/irq.h b/include/asm-mips/irq.h
index 1a9804c65369..35a05ca5560c 100644
--- a/include/asm-mips/irq.h
+++ b/include/asm-mips/irq.h
@@ -24,8 +24,6 @@ static inline int irq_canonicalize(int irq)
 #define irq_canonicalize(irq) (irq)     /* Sane hardware, sane code ... */
 #endif
 
-struct pt_regs;
-
 extern asmlinkage unsigned int do_IRQ(unsigned int irq);
 
 #ifdef CONFIG_MIPS_MT_SMTC
@@ -76,4 +74,8 @@ extern int setup_irq_smtc(unsigned int irq, struct irqaction * new,
                           unsigned long hwmask);
 #endif /* CONFIG_MIPS_MT_SMTC */
 
+extern int allocate_irqno(void);
+extern void alloc_legacy_irqno(void);
+extern void free_irqno(unsigned int irq);
+
 #endif /* _ASM_IRQ_H */
diff --git a/include/asm-mips/mipsmtregs.h b/include/asm-mips/mipsmtregs.h
index f637ce70758f..3e9468f424f4 100644
--- a/include/asm-mips/mipsmtregs.h
+++ b/include/asm-mips/mipsmtregs.h
@@ -352,6 +352,8 @@ do {									\
 #define write_vpe_c0_vpecontrol(val)    mttc0(1, 1, val)
 #define read_vpe_c0_vpeconf0()          mftc0(1, 2)
 #define write_vpe_c0_vpeconf0(val)      mttc0(1, 2, val)
+#define read_vpe_c0_count()             mftc0(9, 0)
+#define write_vpe_c0_count(val)         mttc0(9, 0, val)
 #define read_vpe_c0_status()            mftc0(12, 0)
 #define write_vpe_c0_status(val)        mttc0(12, 0, val)
 #define read_vpe_c0_cause()             mftc0(13, 0)
diff --git a/include/asm-mips/pgalloc.h b/include/asm-mips/pgalloc.h
index 582c1fe6cc4a..af121c67dc71 100644
--- a/include/asm-mips/pgalloc.h
+++ b/include/asm-mips/pgalloc.h
@@ -48,7 +48,7 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
 
         ret = (pgd_t *) __get_free_pages(GFP_KERNEL, PGD_ORDER);
         if (ret) {
-                init = pgd_offset(&init_mm, 0);
+                init = pgd_offset(&init_mm, 0UL);
                 pgd_init((unsigned long)ret);
                 memcpy(ret + USER_PTRS_PER_PGD, init + USER_PTRS_PER_PGD,
                        (PTRS_PER_PGD - USER_PTRS_PER_PGD) * sizeof(pgd_t));
diff --git a/include/asm-mips/pgtable-64.h b/include/asm-mips/pgtable-64.h
index d05fb6f38aa7..7e7320300aa3 100644
--- a/include/asm-mips/pgtable-64.h
+++ b/include/asm-mips/pgtable-64.h
@@ -174,7 +174,7 @@ static inline void pud_clear(pud_t *pudp)
 #define __pmd_offset(address)   pmd_index(address)
 
 /* to find an entry in a kernel page-table-directory */
-#define pgd_offset_k(address) pgd_offset(&init_mm, 0)
+#define pgd_offset_k(address) pgd_offset(&init_mm, 0UL)
 
 #define pgd_index(address)      (((address) >> PGDIR_SHIFT) & (PTRS_PER_PGD-1))
 #define pmd_index(address)      (((address) >> PMD_SHIFT) & (PTRS_PER_PMD-1))
diff --git a/include/asm-mips/sibyte/sb1250.h b/include/asm-mips/sibyte/sb1250.h
index b09e16c93ca0..2ba6988ddc8e 100644
--- a/include/asm-mips/sibyte/sb1250.h
+++ b/include/asm-mips/sibyte/sb1250.h
@@ -51,8 +51,8 @@ extern void sb1250_mask_irq(int cpu, int irq);
 extern void sb1250_unmask_irq(int cpu, int irq);
 extern void sb1250_smp_finish(void);
 
+extern void bcm1480_hpt_setup(void);
 extern void bcm1480_time_init(void);
-extern unsigned long bcm1480_gettimeoffset(void);
 extern void bcm1480_mask_irq(int cpu, int irq);
 extern void bcm1480_unmask_irq(int cpu, int irq);
 extern void bcm1480_smp_finish(void);
diff --git a/include/asm-mips/stackframe.h b/include/asm-mips/stackframe.h
index 158a4cd12e46..1fae5dc58138 100644
--- a/include/asm-mips/stackframe.h
+++ b/include/asm-mips/stackframe.h
@@ -59,69 +59,43 @@
                 .endm
 
 #ifdef CONFIG_SMP
-                .macro  get_saved_sp    /* SMP variation */
-#ifdef CONFIG_32BIT
 #ifdef CONFIG_MIPS_MT_SMTC
-                .set    mips32
-                mfc0    k0, CP0_TCBIND;
-                .set    mips0
-                lui     k1, %hi(kernelsp)
-                srl     k0, k0, 19
-                /* No need to shift down and up to clear bits 0-1 */
+#define PTEBASE_SHIFT   19      /* TCBIND */
 #else
-                mfc0    k0, CP0_CONTEXT
-                lui     k1, %hi(kernelsp)
-                srl     k0, k0, 23
-#endif
-                addu    k1, k0
-                LONG_L  k1, %lo(kernelsp)(k1)
+#define PTEBASE_SHIFT   23      /* CONTEXT */
 #endif
-#ifdef CONFIG_64BIT
+                .macro  get_saved_sp    /* SMP variation */
 #ifdef CONFIG_MIPS_MT_SMTC
-                .set    mips64
-                mfc0    k0, CP0_TCBIND;
-                .set    mips0
-                lui     k0, %highest(kernelsp)
-                dsrl    k1, 19
-                /* No need to shift down and up to clear bits 0-2 */
+                mfc0    k0, CP0_TCBIND
 #else
-                MFC0    k1, CP0_CONTEXT
-                lui     k0, %highest(kernelsp)
-                dsrl    k1, 23
-                daddiu  k0, %higher(kernelsp)
-                dsll    k0, k0, 16
-                daddiu  k0, %hi(kernelsp)
-                dsll    k0, k0, 16
-#endif /* CONFIG_MIPS_MT_SMTC */
-                daddu   k1, k1, k0
+                MFC0    k0, CP0_CONTEXT
+#endif
+#if defined(CONFIG_BUILD_ELF64) || (defined(CONFIG_64BIT) && __GNUC__ < 4)
+                lui     k1, %highest(kernelsp)
+                daddiu  k1, %higher(kernelsp)
+                dsll    k1, 16
+                daddiu  k1, %hi(kernelsp)
+                dsll    k1, 16
+#else
+                lui     k1, %hi(kernelsp)
+#endif
+                LONG_SRL        k0, PTEBASE_SHIFT
+                LONG_ADDU       k1, k0
                 LONG_L  k1, %lo(kernelsp)(k1)
-#endif /* CONFIG_64BIT */
                 .endm
 
                 .macro  set_saved_sp stackp temp temp2
-#ifdef CONFIG_32BIT
-#ifdef CONFIG_MIPS_MT_SMTC
-                mfc0    \temp, CP0_TCBIND
-                srl     \temp, 19
-#else
-                mfc0    \temp, CP0_CONTEXT
-                srl     \temp, 23
-#endif
-#endif
-#ifdef CONFIG_64BIT
 #ifdef CONFIG_MIPS_MT_SMTC
                 mfc0    \temp, CP0_TCBIND
-                dsrl    \temp, 19
 #else
                 MFC0    \temp, CP0_CONTEXT
-                dsrl    \temp, 23
-#endif
 #endif
+                LONG_SRL        \temp, PTEBASE_SHIFT
                 LONG_S  \stackp, kernelsp(\temp)
                 .endm
 #else
                 .macro  get_saved_sp    /* Uniprocessor variation */
-#ifdef CONFIG_64BIT
+#if defined(CONFIG_BUILD_ELF64) || (defined(CONFIG_64BIT) && __GNUC__ < 4)
                 lui     k1, %highest(kernelsp)
                 daddiu  k1, %higher(kernelsp)
                 dsll    k1, k1, 16
diff --git a/include/asm-mips/system.h b/include/asm-mips/system.h
index dcb4701d5728..3056feed5a36 100644
--- a/include/asm-mips/system.h
+++ b/include/asm-mips/system.h
@@ -392,7 +392,7 @@ static inline unsigned long __cmpxchg_u64(volatile int * m, unsigned long old,
 {
         __u64 retval;
 
-        if (cpu_has_llsc) {
+        if (cpu_has_llsc && R10000_LLSC_WAR) {
                 __asm__ __volatile__(
                 "       .set    push                                    \n"
                 "       .set    noat                                    \n"
diff --git a/include/asm-mips/termbits.h b/include/asm-mips/termbits.h
index fa6d04dac56b..b62ec7c521cc 100644
--- a/include/asm-mips/termbits.h
+++ b/include/asm-mips/termbits.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1995, 1996, 1999, 2001 Ralf Baechle
+ * Copyright (C) 1995, 96, 99, 2001, 06 Ralf Baechle
  * Copyright (C) 1999 Silicon Graphics, Inc.
  * Copyright (C) 2001 MIPS Technologies, Inc.
  */
@@ -13,14 +13,8 @@
 #include <linux/posix_types.h>
 
 typedef unsigned char cc_t;
-#if (_MIPS_SZLONG == 32)
-typedef unsigned long speed_t;
-typedef unsigned long tcflag_t;
-#endif
-#if (_MIPS_SZLONG == 64)
-typedef __u32 speed_t;
-typedef __u32 tcflag_t;
-#endif
+typedef unsigned int speed_t;
+typedef unsigned int tcflag_t;
 
 /*
  * The ABI says nothing about NCC but seems to use NCCS as
diff --git a/include/asm-mips/time.h b/include/asm-mips/time.h
index 28512ba2266e..625acd337bc3 100644
--- a/include/asm-mips/time.h
+++ b/include/asm-mips/time.h
@@ -48,7 +48,8 @@ extern void (*mips_timer_ack)(void);
  * If mips_hpt_read is NULL, an R4k-compatible timer setup is attempted.
  */
 extern unsigned int (*mips_hpt_read)(void);
-extern void (*mips_hpt_init)(unsigned int);
+extern void (*mips_hpt_init)(void);
+extern unsigned int mips_hpt_mask;
 
 /*
  * to_tm() converts system time back to (year, mon, day, hour, min, sec).
@@ -58,13 +59,6 @@ extern void (*mips_hpt_init)(unsigned int);
 extern void to_tm(unsigned long tim, struct rtc_time *tm);
 
 /*
- * do_gettimeoffset(). By default, this func pointer points to
- * do_null_gettimeoffset(), which leads to the same resolution as HZ.
- * Higher resolution versions are available, which give ~1us resolution.
- */
-extern unsigned long (*do_gettimeoffset)(void);
-
-/*
  * high-level timer interrupt routines.
  */
 extern irqreturn_t timer_interrupt(int irq, void *dev_id);
diff --git a/include/asm-mips/unistd.h b/include/asm-mips/unistd.h
index 685c91467e63..ec56aa52f669 100644
--- a/include/asm-mips/unistd.h
+++ b/include/asm-mips/unistd.h
@@ -331,16 +331,19 @@
 #define __NR_move_pages                 (__NR_Linux + 308)
 #define __NR_set_robust_list            (__NR_Linux + 309)
 #define __NR_get_robust_list            (__NR_Linux + 310)
+#define __NR_kexec_load                 (__NR_Linux + 311)
+#define __NR_getcpu                     (__NR_Linux + 312)
+#define __NR_epoll_pwait                (__NR_Linux + 313)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             310
+#define __NR_Linux_syscalls             313
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         310
+#define __NR_O32_Linux_syscalls         313
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -618,16 +621,19 @@
 #define __NR_move_pages                 (__NR_Linux + 267)
 #define __NR_set_robust_list            (__NR_Linux + 268)
 #define __NR_get_robust_list            (__NR_Linux + 269)
+#define __NR_kexec_load                 (__NR_Linux + 270)
+#define __NR_getcpu                     (__NR_Linux + 271)
+#define __NR_epoll_pwait                (__NR_Linux + 272)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             269
+#define __NR_Linux_syscalls             272
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          269
+#define __NR_64_Linux_syscalls          272
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -909,16 +915,19 @@
 #define __NR_move_pages                 (__NR_Linux + 271)
 #define __NR_set_robust_list            (__NR_Linux + 272)
 #define __NR_get_robust_list            (__NR_Linux + 273)
+#define __NR_kexec_load                 (__NR_Linux + 274)
+#define __NR_getcpu                     (__NR_Linux + 275)
+#define __NR_epoll_pwait                (__NR_Linux + 276)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             273
+#define __NR_Linux_syscalls             276
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         273
+#define __NR_N32_Linux_syscalls         276
 
 #ifdef __KERNEL__
 
@@ -1186,6 +1195,7 @@ type name (atype a,btype b,ctype c,dtype d,etype e,ftype f) \
 #endif /* (_MIPS_SIM == _MIPS_SIM_NABI32) || (_MIPS_SIM == _MIPS_SIM_ABI64) */
 
 
+#define __ARCH_OMIT_COMPAT_SYS_GETDENTS64
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
diff --git a/include/asm-mips/vr41xx/vr41xx.h b/include/asm-mips/vr41xx/vr41xx.h
index dd3eb3dc5886..88b492f6ea9c 100644
--- a/include/asm-mips/vr41xx/vr41xx.h
+++ b/include/asm-mips/vr41xx/vr41xx.h
@@ -75,7 +75,7 @@ extern void vr41xx_mask_clock(vr41xx_clock_t clock);
  * Interrupt Control Unit
  */
 extern int vr41xx_set_intassign(unsigned int irq, unsigned char intassign);
-extern int cascade_irq(unsigned int irq, int (*get_irq)(unsigned int, struct pt_regs *));
+extern int cascade_irq(unsigned int irq, int (*get_irq)(unsigned int));
 
 #define PIUINT_COMMAND          0x0040
 #define PIUINT_DATA             0x0020
diff --git a/include/asm-powerpc/asm-compat.h b/include/asm-powerpc/asm-compat.h
index 8e64be0cc47d..c89bd58ee283 100644
--- a/include/asm-powerpc/asm-compat.h
+++ b/include/asm-powerpc/asm-compat.h
@@ -14,6 +14,58 @@
 #  define ASM_CONST(x)          __ASM_CONST(x)
 #endif
 
+
+/*
+ * Feature section common macros
+ *
+ * Note that the entries now contain offsets between the table entry
+ * and the code rather than absolute code pointers in order to be
+ * useable with the vdso shared library. There is also an assumption
+ * that values will be negative, that is, the fixup table has to be
+ * located after the code it fixes up.
+ */
+#ifdef CONFIG_PPC64
+#ifdef __powerpc64__
+/* 64 bits kernel, 64 bits code */
+#define MAKE_FTR_SECTION_ENTRY(msk, val, label, sect)   \
+99:                                                     \
+        .section sect,"a";                              \
+        .align 3;                                       \
+98:                                                     \
+        .llong msk;                                     \
+        .llong val;                                     \
+        .llong label##b-98b;                            \
+        .llong 99b-98b;                                 \
+        .previous
+#else /* __powerpc64__ */
+/* 64 bits kernel, 32 bits code (ie. vdso32) */
+#define MAKE_FTR_SECTION_ENTRY(msk, val, label, sect)   \
+99:                                                     \
+        .section sect,"a";                              \
+        .align 3;                                       \
+98:                                                     \
+        .llong msk;                                     \
+        .llong val;                                     \
+        .long 0xffffffff;                               \
+        .long label##b-98b;                             \
+        .long 0xffffffff;                               \
+        .long 99b-98b;                                  \
+        .previous
+#endif /* !__powerpc64__ */
+#else /* CONFIG_PPC64 */
+/* 32 bits kernel, 32 bits code */
+#define MAKE_FTR_SECTION_ENTRY(msk, val, label, sect)   \
+99:                                                     \
+        .section sect,"a";                              \
+        .align 2;                                       \
+98:                                                     \
+        .long msk;                                      \
+        .long val;                                      \
+        .long label##b-98b;                             \
+        .long 99b-98b;                                  \
+        .previous
+#endif /* !CONFIG_PPC64 */
+
 #ifdef __powerpc64__
 
 /* operations for longs and pointers */
diff --git a/include/asm-powerpc/cputable.h b/include/asm-powerpc/cputable.h
index 12707ab9dc98..a9a40149a7c0 100644
--- a/include/asm-powerpc/cputable.h
+++ b/include/asm-powerpc/cputable.h
@@ -89,8 +89,11 @@ struct cpu_spec {
 
 extern struct cpu_spec          *cur_cpu_spec;
 
-extern void identify_cpu(unsigned long offset, unsigned long cpu);
-extern void do_cpu_ftr_fixups(unsigned long offset);
+extern unsigned int __start___ftr_fixup, __stop___ftr_fixup;
+
+extern struct cpu_spec *identify_cpu(unsigned long offset);
+extern void do_feature_fixups(unsigned long value, void *fixup_start,
+                              void *fixup_end);
 
 #endif /* __ASSEMBLY__ */
 
@@ -144,6 +147,7 @@ extern void do_cpu_ftr_fixups(unsigned long offset);
 #define CPU_FTR_CI_LARGE_PAGE           LONG_ASM_CONST(0x0000100000000000)
 #define CPU_FTR_PAUSE_ZERO              LONG_ASM_CONST(0x0000200000000000)
 #define CPU_FTR_PURR                    LONG_ASM_CONST(0x0000400000000000)
+#define CPU_FTR_CELL_TB_BUG             LONG_ASM_CONST(0x0000800000000000)
 
 #ifndef __ASSEMBLY__
 
@@ -332,7 +336,7 @@ extern void do_cpu_ftr_fixups(unsigned long offset);
 #define CPU_FTRS_CELL   (CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | \
             CPU_FTR_HPTE_TABLE | CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \
             CPU_FTR_ALTIVEC_COMP | CPU_FTR_MMCRA | CPU_FTR_SMT | \
-            CPU_FTR_PAUSE_ZERO | CPU_FTR_CI_LARGE_PAGE)
+            CPU_FTR_PAUSE_ZERO | CPU_FTR_CI_LARGE_PAGE | CPU_FTR_CELL_TB_BUG)
 #define CPU_FTRS_PA6T (CPU_FTR_SPLIT_ID_CACHE | CPU_FTR_USE_TB | \
             CPU_FTR_HPTE_TABLE | CPU_FTR_PPCAS_ARCH_V2 | \
             CPU_FTR_ALTIVEC_COMP | CPU_FTR_CI_LARGE_PAGE | \
@@ -431,29 +435,12 @@ static inline int cpu_has_feature(unsigned long feature)
 
 #ifdef __ASSEMBLY__
 
-#define BEGIN_FTR_SECTION               98:
-
-#ifndef __powerpc64__
+#define BEGIN_FTR_SECTION_NESTED(label) label:
+#define BEGIN_FTR_SECTION               BEGIN_FTR_SECTION_NESTED(97)
+#define END_FTR_SECTION_NESTED(msk, val, label) \
+        MAKE_FTR_SECTION_ENTRY(msk, val, label, __ftr_fixup)
 #define END_FTR_SECTION(msk, val)               \
-99:                                             \
-        .section __ftr_fixup,"a";               \
-        .align 2;                               \
-        .long msk;                              \
-        .long val;                              \
-        .long 98b;                              \
-        .long 99b;                              \
-        .previous
-#else /* __powerpc64__ */
-#define END_FTR_SECTION(msk, val)               \
-99:                                             \
-        .section __ftr_fixup,"a";               \
-        .align 3;                               \
-        .llong msk;                             \
-        .llong val;                             \
-        .llong 98b;                             \
-        .llong 99b;                             \
-        .previous
-#endif /* __powerpc64__ */
+        END_FTR_SECTION_NESTED(msk, val, 97)
 
 #define END_FTR_SECTION_IFSET(msk)      END_FTR_SECTION((msk), (msk))
 #define END_FTR_SECTION_IFCLR(msk)      END_FTR_SECTION((msk), 0)
diff --git a/include/asm-powerpc/current.h b/include/asm-powerpc/current.h
index 1938d6abd255..b8708aedf925 100644
--- a/include/asm-powerpc/current.h
+++ b/include/asm-powerpc/current.h
@@ -14,7 +14,17 @@ struct task_struct;
 #ifdef __powerpc64__
 #include <asm/paca.h>
 
-#define current         (get_paca()->__current)
+static inline struct task_struct *get_current(void)
+{
+        struct task_struct *task;
+
+        __asm__ __volatile__("ld %0,%1(13)"
+        : "=r" (task)
+        : "i" (offsetof(struct paca_struct, __current)));
+
+        return task;
+}
+#define current get_current()
 
 #else
 
diff --git a/include/asm-powerpc/firmware.h b/include/asm-powerpc/firmware.h
index 1022737f4f34..fdf9aff71150 100644
--- a/include/asm-powerpc/firmware.h
+++ b/include/asm-powerpc/firmware.h
@@ -96,19 +96,16 @@ extern void machine_check_fwnmi(void);
 /* This is true if we are using the firmware NMI handler (typically LPAR) */
 extern int fwnmi_active;
 
-#else /* __ASSEMBLY__ */
+extern unsigned int __start___fw_ftr_fixup, __stop___fw_ftr_fixup;
 
-#define BEGIN_FW_FTR_SECTION            96:
+#else /* __ASSEMBLY__ */
 
+#define BEGIN_FW_FTR_SECTION_NESTED(label)      label:
+#define BEGIN_FW_FTR_SECTION                    BEGIN_FW_FTR_SECTION_NESTED(97)
+#define END_FW_FTR_SECTION_NESTED(msk, val, label) \
+        MAKE_FTR_SECTION_ENTRY(msk, val, label, __fw_ftr_fixup)
 #define END_FW_FTR_SECTION(msk, val)            \
-97:                                             \
-        .section __fw_ftr_fixup,"a";            \
-        .align 3;                               \
-        .llong msk;                             \
-        .llong val;                             \
-        .llong 96b;                             \
-        .llong 97b;                             \
-        .previous
+        END_FW_FTR_SECTION_NESTED(msk, val, 97)
 
 #define END_FW_FTR_SECTION_IFSET(msk)   END_FW_FTR_SECTION((msk), (msk))
 #define END_FW_FTR_SECTION_IFCLR(msk)   END_FW_FTR_SECTION((msk), 0)
diff --git a/include/asm-powerpc/i8259.h b/include/asm-powerpc/i8259.h
index 78489fb8d140..db1362f8c603 100644
--- a/include/asm-powerpc/i8259.h
+++ b/include/asm-powerpc/i8259.h
@@ -7,6 +7,7 @@
 #ifdef CONFIG_PPC_MERGE
 extern void i8259_init(struct device_node *node, unsigned long intack_addr);
 extern unsigned int i8259_irq(void);
+extern struct irq_host *i8259_get_host(void);
 #else
 extern void i8259_init(unsigned long intack_addr, int offset);
 extern int i8259_irq(void);
diff --git a/include/asm-powerpc/io.h b/include/asm-powerpc/io.h
index cbbd8c648df1..c2c5f14b5f5f 100644
--- a/include/asm-powerpc/io.h
+++ b/include/asm-powerpc/io.h
@@ -163,8 +163,11 @@ extern void _outsl_ns(volatile u32 __iomem *port, const void *buf, long count);
 
 static inline void mmiowb(void)
 {
-        __asm__ __volatile__ ("sync" : : : "memory");
-        get_paca()->io_sync = 0;
+        unsigned long tmp;
+
+        __asm__ __volatile__("sync; li %0,0; stb %0,%1(13)"
+        : "=&r" (tmp) : "i" (offsetof(struct paca_struct, io_sync))
+        : "memory");
 }
 
 /*
@@ -404,32 +407,6 @@ static inline void __out_be64(volatile unsigned long __iomem *addr, unsigned lon
 
 #include <asm/eeh.h>
 
-/**
- *      check_signature         -       find BIOS signatures
- *      @io_addr: mmio address to check
- *      @signature:  signature block
- *      @length: length of signature
- *
- *      Perform a signature comparison with the mmio address io_addr. This
- *      address should have been obtained by ioremap.
- *      Returns 1 on a match.
- */
-static inline int check_signature(const volatile void __iomem * io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /* Nothing to do */
 
 #define dma_cache_inv(_start,_size)             do { } while (0)
diff --git a/include/asm-powerpc/iommu.h b/include/asm-powerpc/iommu.h
index a5e98641a2ae..39fad685ffab 100644
--- a/include/asm-powerpc/iommu.h
+++ b/include/asm-powerpc/iommu.h
@@ -22,17 +22,35 @@
 #define _ASM_IOMMU_H
 #ifdef __KERNEL__
 
-#include <asm/types.h>
+#include <linux/compiler.h>
 #include <linux/spinlock.h>
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
+#include <asm/types.h>
+#include <asm/bitops.h>
+
+#define IOMMU_PAGE_SHIFT      12
+#define IOMMU_PAGE_SIZE       (ASM_CONST(1) << IOMMU_PAGE_SHIFT)
+#define IOMMU_PAGE_MASK       (~((1 << IOMMU_PAGE_SHIFT) - 1))
+#define IOMMU_PAGE_ALIGN(addr) _ALIGN_UP(addr, IOMMU_PAGE_SIZE)
+
+#ifndef __ASSEMBLY__
+
+/* Pure 2^n version of get_order */
+static __inline__ __attribute_const__ int get_iommu_order(unsigned long size)
+{
+        return __ilog2((size - 1) >> IOMMU_PAGE_SHIFT) + 1;
+}
+
+#endif   /* __ASSEMBLY__ */
+
 
 /*
  * IOMAP_MAX_ORDER defines the largest contiguous block
  * of dma space we can get.  IOMAP_MAX_ORDER = 13
  * allows up to 2**12 pages (4096 * 4096) = 16 MB
  */
-#define IOMAP_MAX_ORDER 13
+#define IOMAP_MAX_ORDER         13
 
 struct iommu_table {
         unsigned long  it_busno;     /* Bus number this table belongs to */
diff --git a/include/asm-powerpc/oprofile_impl.h b/include/asm-powerpc/oprofile_impl.h
index 5b33994cd488..07a10e590c1d 100644
--- a/include/asm-powerpc/oprofile_impl.h
+++ b/include/asm-powerpc/oprofile_impl.h
@@ -42,7 +42,7 @@ struct op_powerpc_model {
         void (*reg_setup) (struct op_counter_config *,
                            struct op_system_config *,
                            int num_counters);
-        void (*cpu_setup) (void *);
+        void (*cpu_setup) (struct op_counter_config *);
         void (*start) (struct op_counter_config *);
         void (*stop) (void);
         void (*handle_interrupt) (struct pt_regs *,
@@ -121,7 +121,90 @@ static inline void ctr_write(unsigned int i, unsigned int val)
                 break;
         }
 }
-#endif /* !CONFIG_FSL_BOOKE */
+#else /* CONFIG_FSL_BOOKE */
+static inline u32 get_pmlca(int ctr)
+{
+        u32 pmlca;
+
+        switch (ctr) {
+                case 0:
+                        pmlca = mfpmr(PMRN_PMLCA0);
+                        break;
+                case 1:
+                        pmlca = mfpmr(PMRN_PMLCA1);
+                        break;
+                case 2:
+                        pmlca = mfpmr(PMRN_PMLCA2);
+                        break;
+                case 3:
+                        pmlca = mfpmr(PMRN_PMLCA3);
+                        break;
+                default:
+                        panic("Bad ctr number\n");
+        }
+
+        return pmlca;
+}
+
+static inline void set_pmlca(int ctr, u32 pmlca)
+{
+        switch (ctr) {
+                case 0:
+                        mtpmr(PMRN_PMLCA0, pmlca);
+                        break;
+                case 1:
+                        mtpmr(PMRN_PMLCA1, pmlca);
+                        break;
+                case 2:
+                        mtpmr(PMRN_PMLCA2, pmlca);
+                        break;
+                case 3:
+                        mtpmr(PMRN_PMLCA3, pmlca);
+                        break;
+                default:
+                        panic("Bad ctr number\n");
+        }
+}
+
+static inline unsigned int ctr_read(unsigned int i)
+{
+        switch(i) {
+                case 0:
+                        return mfpmr(PMRN_PMC0);
+                case 1:
+                        return mfpmr(PMRN_PMC1);
+                case 2:
+                        return mfpmr(PMRN_PMC2);
+                case 3:
+                        return mfpmr(PMRN_PMC3);
+                default:
+                        return 0;
+        }
+}
+
+static inline void ctr_write(unsigned int i, unsigned int val)
+{
+        switch(i) {
+                case 0:
+                        mtpmr(PMRN_PMC0, val);
+                        break;
+                case 1:
+                        mtpmr(PMRN_PMC1, val);
+                        break;
+                case 2:
+                        mtpmr(PMRN_PMC2, val);
+                        break;
+                case 3:
+                        mtpmr(PMRN_PMC3, val);
+                        break;
+                default:
+                        break;
+        }
+}
+
+
+#endif /* CONFIG_FSL_BOOKE */
+
 
 extern void op_powerpc_backtrace(struct pt_regs * const regs, unsigned int depth);
 
diff --git a/include/asm-powerpc/pmc.h b/include/asm-powerpc/pmc.h
index 07d6a4279319..8588be68e0ad 100644
--- a/include/asm-powerpc/pmc.h
+++ b/include/asm-powerpc/pmc.h
@@ -32,18 +32,5 @@ void release_pmc_hardware(void);
 void power4_enable_pmcs(void);
 #endif
 
-#ifdef CONFIG_FSL_BOOKE
-void init_pmc_stop(int ctr);
-void set_pmc_event(int ctr, int event);
-void set_pmc_user_kernel(int ctr, int user, int kernel);
-void set_pmc_marked(int ctr, int mark0, int mark1);
-void pmc_start_ctr(int ctr, int enable);
-void pmc_start_ctrs(int enable);
-void pmc_stop_ctrs(void);
-void dump_pmcs(void);
-
-extern struct op_powerpc_model op_model_fsl_booke;
-#endif
-
 #endif /* __KERNEL__ */
 #endif /* _POWERPC_PMC_H */
diff --git a/include/asm-powerpc/ppc_asm.h b/include/asm-powerpc/ppc_asm.h
index a940cfe040da..fa083d8e4663 100644
--- a/include/asm-powerpc/ppc_asm.h
+++ b/include/asm-powerpc/ppc_asm.h
@@ -30,9 +30,9 @@ BEGIN_FTR_SECTION;							\
         mfspr   ra,SPRN_PURR;           /* get processor util. reg */   \
 END_FTR_SECTION_IFSET(CPU_FTR_PURR);                                    \
 BEGIN_FTR_SECTION;                                                      \
-        mftb    ra;                     /* or get TB if no PURR */      \
+        MFTB(ra);                       /* or get TB if no PURR */      \
 END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                                    \
-        ld      rb,PACA_STARTPURR(r13);                         \
+        ld      rb,PACA_STARTPURR(r13);                                 \
         std     ra,PACA_STARTPURR(r13);                                 \
         subf    rb,rb,ra;               /* subtract start value */      \
         ld      ra,PACA_USER_TIME(r13);                                 \
@@ -45,9 +45,9 @@ BEGIN_FTR_SECTION;							\
         mfspr   ra,SPRN_PURR;           /* get processor util. reg */   \
 END_FTR_SECTION_IFSET(CPU_FTR_PURR);                                    \
 BEGIN_FTR_SECTION;                                                      \
-        mftb    ra;                     /* or get TB if no PURR */      \
+        MFTB(ra);                       /* or get TB if no PURR */      \
 END_FTR_SECTION_IFCLR(CPU_FTR_PURR);                                    \
-        ld      rb,PACA_STARTPURR(r13);                         \
+        ld      rb,PACA_STARTPURR(r13);                                 \
         std     ra,PACA_STARTPURR(r13);                                 \
         subf    rb,rb,ra;               /* subtract start value */      \
         ld      ra,PACA_SYSTEM_TIME(r13);                               \
@@ -274,6 +274,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_601)
 #define ISYNC_601
 #endif
 
+#ifdef CONFIG_PPC_CELL
+#define MFTB(dest)                      \
+90:     mftb  dest;                     \
+BEGIN_FTR_SECTION_NESTED(96);           \
+        cmpwi dest,0;                   \
+        beq-  90b;                      \
+END_FTR_SECTION_NESTED(CPU_FTR_CELL_TB_BUG, CPU_FTR_CELL_TB_BUG, 96)
+#else
+#define MFTB(dest)                      mftb dest
+#endif
 
 #ifndef CONFIG_SMP
 #define TLBSYNC
diff --git a/include/asm-powerpc/prom.h b/include/asm-powerpc/prom.h
index 524629769336..ec11d44eaeb5 100644
--- a/include/asm-powerpc/prom.h
+++ b/include/asm-powerpc/prom.h
@@ -134,7 +134,7 @@ extern struct device_node *of_find_all_nodes(struct device_node *prev);
 extern struct device_node *of_get_parent(const struct device_node *node);
 extern struct device_node *of_get_next_child(const struct device_node *node,
                                              struct device_node *prev);
-extern struct property *of_find_property(struct device_node *np,
+extern struct property *of_find_property(const struct device_node *np,
                                          const char *name,
                                          int *lenp);
 extern struct device_node *of_node_get(struct device_node *node);
@@ -158,10 +158,12 @@ extern void of_detach_node(const struct device_node *);
 extern void finish_device_tree(void);
 extern void unflatten_device_tree(void);
 extern void early_init_devtree(void *);
-extern int device_is_compatible(struct device_node *device, const char *);
+extern int device_is_compatible(const struct device_node *device,
+                                const char *);
 extern int machine_is_compatible(const char *compat);
-extern const void *get_property(struct device_node *node, const char *name,
-                int *lenp);
+extern const void *get_property(const struct device_node *node,
+                                const char *name,
+                                int *lenp);
 extern void print_properties(struct device_node *node);
 extern int prom_n_addr_cells(struct device_node* np);
 extern int prom_n_size_cells(struct device_node* np);
diff --git a/include/asm-powerpc/reg.h b/include/asm-powerpc/reg.h
index 8fb96811b55d..6faae7b14d55 100644
--- a/include/asm-powerpc/reg.h
+++ b/include/asm-powerpc/reg.h
@@ -591,6 +591,7 @@
 #define PV_630          0x0040
 #define PV_630p 0x0041
 #define PV_970MP        0x0044
+#define PV_970GX        0x0045
 #define PV_BE           0x0070
 #define PV_PA6T         0x0090
 
@@ -618,10 +619,35 @@
                                 : "=r" (rval)); rval;})
 #define mtspr(rn, v)    asm volatile("mtspr " __stringify(rn) ",%0" : : "r" (v))
 
+#ifdef __powerpc64__
+#ifdef CONFIG_PPC_CELL
+#define mftb()          ({unsigned long rval;                           \
+                        asm volatile(                                   \
+                                "90:    mftb %0;\n"                     \
+                                "97:    cmpwi %0,0;\n"                  \
+                                "       beq- 90b;\n"                    \
+                                "99:\n"                                 \
+                                ".section __ftr_fixup,\"a\"\n"          \
+                                ".align 3\n"                            \
+                                "98:\n"                                 \
+                                "       .llong %1\n"                    \
+                                "       .llong %1\n"                    \
+                                "       .llong 97b-98b\n"               \
+                                "       .llong 99b-98b\n"               \
+                                ".previous"                             \
+                        : "=r" (rval) : "i" (CPU_FTR_CELL_TB_BUG)); rval;})
+#else
 #define mftb()          ({unsigned long rval;   \
                         asm volatile("mftb %0" : "=r" (rval)); rval;})
+#endif /* !CONFIG_PPC_CELL */
+
+#else /* __powerpc64__ */
+
 #define mftbl()         ({unsigned long rval;   \
                         asm volatile("mftbl %0" : "=r" (rval)); rval;})
+#define mftbu()         ({unsigned long rval;   \
+                        asm volatile("mftbu %0" : "=r" (rval)); rval;})
+#endif /* !__powerpc64__ */
 
 #define mttbl(v)        asm volatile("mttbl %0":: "r"(v))
 #define mttbu(v)        asm volatile("mttbu %0":: "r"(v))
diff --git a/include/asm-powerpc/systbl.h b/include/asm-powerpc/systbl.h
index eac85ce101b6..97b435484177 100644
--- a/include/asm-powerpc/systbl.h
+++ b/include/asm-powerpc/systbl.h
@@ -261,7 +261,7 @@ SYSX(sys_ni_syscall, ppc_fadvise64_64, ppc_fadvise64_64)
 PPC_SYS_SPU(rtas)
 OLDSYS(debug_setcontext)
 SYSCALL(ni_syscall)
-SYSCALL(ni_syscall)
+COMPAT_SYS(migrate_pages)
 COMPAT_SYS(mbind)
 COMPAT_SYS(get_mempolicy)
 COMPAT_SYS(set_mempolicy)
@@ -304,3 +304,4 @@ SYSCALL_SPU(fchmodat)
 SYSCALL_SPU(faccessat)
 COMPAT_SYS_SPU(get_robust_list)
 COMPAT_SYS_SPU(set_robust_list)
+COMPAT_SYS(move_pages)
diff --git a/include/asm-powerpc/system.h b/include/asm-powerpc/system.h
index 43627596003b..f7b1227d6454 100644
--- a/include/asm-powerpc/system.h
+++ b/include/asm-powerpc/system.h
@@ -25,8 +25,8 @@
  *
  * We have to use the sync instructions for mb(), since lwsync doesn't
  * order loads with respect to previous stores.  Lwsync is fine for
- * rmb(), though.  Note that lwsync is interpreted as sync by
- * 32-bit and older 64-bit CPUs.
+ * rmb(), though. Note that rmb() actually uses a sync on 32-bit
+ * architectures.
  *
  * For wmb(), we use sync since wmb is used in drivers to order
  * stores to system memory with respect to writes to the device.
@@ -34,7 +34,7 @@
  * SMP since it is only used to order updates to system memory.
  */
 #define mb()   __asm__ __volatile__ ("sync" : : : "memory")
-#define rmb()  __asm__ __volatile__ ("lwsync" : : : "memory")
+#define rmb()  __asm__ __volatile__ (__stringify(LWSYNC) : : : "memory")
 #define wmb()  __asm__ __volatile__ ("sync" : : : "memory")
 #define read_barrier_depends()  do { } while(0)
 
diff --git a/include/asm-powerpc/tce.h b/include/asm-powerpc/tce.h
index c9483adbf599..f663634cccc9 100644
--- a/include/asm-powerpc/tce.h
+++ b/include/asm-powerpc/tce.h
@@ -22,6 +22,8 @@
 #define _ASM_POWERPC_TCE_H
 #ifdef __KERNEL__
 
+#include <asm/iommu.h>
+
 /*
  * Tces come in two formats, one for the virtual bus and a different
  * format for PCI
@@ -33,7 +35,6 @@
 
 #define TCE_SHIFT       12
 #define TCE_PAGE_SIZE   (1 << TCE_SHIFT)
-#define TCE_PAGE_FACTOR (PAGE_SHIFT - TCE_SHIFT)
 
 #define TCE_ENTRY_SIZE          8               /* each TCE is 64 bits */
 
diff --git a/include/asm-powerpc/time.h b/include/asm-powerpc/time.h
index b051d4c88c3b..4cff977ad526 100644
--- a/include/asm-powerpc/time.h
+++ b/include/asm-powerpc/time.h
@@ -39,10 +39,6 @@ extern void generic_calibrate_decr(void);
 extern void wakeup_decrementer(void);
 extern void snapshot_timebase(void);
 
-#ifdef CONFIG_RTC_CLASS
-extern int __init rtc_class_hookup(void);
-#endif
-
 /* Some sane defaults: 125 MHz timebase, 1GHz processor */
 extern unsigned long ppc_proc_freq;
 #define DEFAULT_PROC_FREQ       (DEFAULT_TB_FREQ * 8)
@@ -82,30 +78,35 @@ struct div_result {
 #define __USE_RTC()     0
 #endif
 
-/* On ppc64 this gets us the whole timebase; on ppc32 just the lower half */
+#ifdef CONFIG_PPC64
+
+/* For compatibility, get_tbl() is defined as get_tb() on ppc64 */
+#define get_tbl         get_tb
+
+#else
+
 static inline unsigned long get_tbl(void)
 {
-        unsigned long tbl;
-
 #if defined(CONFIG_403GCX)
+        unsigned long tbl;
         asm volatile("mfspr %0, 0x3dd" : "=r" (tbl));
+        return tbl;
 #else
-        asm volatile("mftb %0" : "=r" (tbl));
+        return mftbl();
 #endif
-        return tbl;
 }
 
 static inline unsigned int get_tbu(void)
 {
+#ifdef CONFIG_403GCX
         unsigned int tbu;
-
-#if defined(CONFIG_403GCX)
         asm volatile("mfspr %0, 0x3dc" : "=r" (tbu));
+        return tbu;
 #else
-        asm volatile("mftbu %0" : "=r" (tbu));
+        return mftbu();
 #endif
-        return tbu;
 }
+#endif /* !CONFIG_PPC64 */
 
 static inline unsigned int get_rtcl(void)
 {
@@ -131,7 +132,7 @@ static inline u64 get_tb(void)
 {
         return mftb();
 }
-#else
+#else /* CONFIG_PPC64 */
 static inline u64 get_tb(void)
 {
         unsigned int tbhi, tblo, tbhi2;
@@ -144,7 +145,7 @@ static inline u64 get_tb(void)
 
         return ((u64)tbhi << 32) | tblo;
 }
-#endif
+#endif /* !CONFIG_PPC64 */
 
 static inline void set_tb(unsigned int upper, unsigned int lower)
 {
diff --git a/include/asm-powerpc/timex.h b/include/asm-powerpc/timex.h
index 3b9a8e786806..92dedde761d1 100644
--- a/include/asm-powerpc/timex.h
+++ b/include/asm-powerpc/timex.h
@@ -8,6 +8,7 @@
  */
 
 #include <asm/cputable.h>
+#include <asm/reg.h>
 
 #define CLOCK_TICK_RATE 1024000 /* Underlying HZ */
 
@@ -15,13 +16,11 @@ typedef unsigned long cycles_t;
 
 static inline cycles_t get_cycles(void)
 {
-        cycles_t ret;
-
 #ifdef __powerpc64__
-
-        __asm__ __volatile__("mftb %0" : "=r" (ret) : );
-
+        return mftb();
 #else
+        cycles_t ret;
+
         /*
          * For the "cycle" counter we use the timebase lower half.
          * Currently only used on SMP.
@@ -30,18 +29,19 @@ static inline cycles_t get_cycles(void)
         ret = 0;
 
         __asm__ __volatile__(
-                "98:    mftb %0\n"
+                "97:    mftb %0\n"
                 "99:\n"
                 ".section __ftr_fixup,\"a\"\n"
+                ".align 2\n"
+                "98:\n"
                 "       .long %1\n"
                 "       .long 0\n"
-                "       .long 98b\n"
-                "       .long 99b\n"
+                "       .long 97b-98b\n"
+                "       .long 99b-98b\n"
                 ".previous"
                 : "=r" (ret) : "i" (CPU_FTR_601));
-#endif
-
         return ret;
+#endif
 }
 
 #endif  /* __KERNEL__ */
diff --git a/include/asm-powerpc/topology.h b/include/asm-powerpc/topology.h
index 8f7ee16781a4..9fe7894ee035 100644
--- a/include/asm-powerpc/topology.h
+++ b/include/asm-powerpc/topology.h
@@ -96,7 +96,13 @@ static inline void sysfs_remove_device_from_node(struct sys_device *dev,
 
 #ifdef CONFIG_SMP
 #include <asm/cputable.h>
-#define smt_capable()           (cpu_has_feature(CPU_FTR_SMT))
+#define smt_capable()           (cpu_has_feature(CPU_FTR_SMT))
+
+#ifdef CONFIG_PPC64
+#include <asm/smp.h>
+
+#define topology_thread_siblings(cpu)   (cpu_sibling_map[cpu])
+#endif
 #endif
 
 #endif /* __KERNEL__ */
diff --git a/include/asm-powerpc/unistd.h b/include/asm-powerpc/unistd.h
index 464a48cce7f5..0e4ea37f6466 100644
--- a/include/asm-powerpc/unistd.h
+++ b/include/asm-powerpc/unistd.h
@@ -276,7 +276,7 @@
 #define __NR_rtas               255
 #define __NR_sys_debug_setcontext 256
 /* Number 257 is reserved for vserver */
-/* 258 currently unused */
+#define __NR_migrate_pages      258
 #define __NR_mbind              259
 #define __NR_get_mempolicy      260
 #define __NR_set_mempolicy      261
@@ -323,10 +323,11 @@
 #define __NR_faccessat          298
 #define __NR_get_robust_list    299
 #define __NR_set_robust_list    300
+#define __NR_move_pages         301
 
 #ifdef __KERNEL__
 
-#define __NR_syscalls           301
+#define __NR_syscalls           302
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/include/asm-ppc/io.h b/include/asm-ppc/io.h
index 3d9a9e6f3321..a4c411b753ef 100644
--- a/include/asm-ppc/io.h
+++ b/include/asm-ppc/io.h
@@ -439,22 +439,6 @@ extern inline void * phys_to_virt(unsigned long address)
 #define iobarrier_r()  eieio()
 #define iobarrier_w()  eieio()
 
-static inline int check_signature(volatile void __iomem * io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /*
  * Here comes the ppc implementation of the IOMAP 
  * interfaces.
diff --git a/include/asm-s390/cio.h b/include/asm-s390/cio.h
index da063cd5f0a0..81287d86329d 100644
--- a/include/asm-s390/cio.h
+++ b/include/asm-s390/cio.h
@@ -275,6 +275,12 @@ struct ccw_dev_id {
         u16 devno;
 };
 
+static inline int ccw_dev_id_is_equal(struct ccw_dev_id *dev_id1,
+                                      struct ccw_dev_id *dev_id2)
+{
+        return !memcmp(dev_id1, dev_id2, sizeof(struct ccw_dev_id));
+}
+
 extern int diag210(struct diag210 *addr);
 
 extern void wait_cons_dev(void);
diff --git a/include/asm-s390/pgtable.h b/include/asm-s390/pgtable.h
index 519f0a5ff181..36bb6dacf008 100644
--- a/include/asm-s390/pgtable.h
+++ b/include/asm-s390/pgtable.h
@@ -200,18 +200,45 @@ extern char empty_zero_page[PAGE_SIZE];
  */
 
 /* Hardware bits in the page table entry */
-#define _PAGE_RO        0x200          /* HW read-only                     */
-#define _PAGE_INVALID   0x400          /* HW invalid                       */
+#define _PAGE_RO        0x200           /* HW read-only bit  */
+#define _PAGE_INVALID   0x400           /* HW invalid bit    */
+#define _PAGE_SWT       0x001           /* SW pte type bit t */
+#define _PAGE_SWX       0x002           /* SW pte type bit x */
 
-/* Mask and six different types of pages. */
-#define _PAGE_TYPE_MASK         0x601
+/* Six different types of pages. */
 #define _PAGE_TYPE_EMPTY        0x400
 #define _PAGE_TYPE_NONE         0x401
-#define _PAGE_TYPE_SWAP         0x600
-#define _PAGE_TYPE_FILE         0x601
+#define _PAGE_TYPE_SWAP         0x403
+#define _PAGE_TYPE_FILE         0x601   /* bit 0x002 is used for offset !! */
 #define _PAGE_TYPE_RO           0x200
 #define _PAGE_TYPE_RW           0x000
 
+/*
+ * PTE type bits are rather complicated. handle_pte_fault uses pte_present,
+ * pte_none and pte_file to find out the pte type WITHOUT holding the page
+ * table lock. ptep_clear_flush on the other hand uses ptep_clear_flush to
+ * invalidate a given pte. ipte sets the hw invalid bit and clears all tlbs
+ * for the page. The page table entry is set to _PAGE_TYPE_EMPTY afterwards.
+ * This change is done while holding the lock, but the intermediate step
+ * of a previously valid pte with the hw invalid bit set can be observed by
+ * handle_pte_fault. That makes it necessary that all valid pte types with
+ * the hw invalid bit set must be distinguishable from the four pte types
+ * empty, none, swap and file.
+ *
+ *                      irxt  ipte  irxt
+ * _PAGE_TYPE_EMPTY     1000   ->   1000
+ * _PAGE_TYPE_NONE      1001   ->   1001
+ * _PAGE_TYPE_SWAP      1011   ->   1011
+ * _PAGE_TYPE_FILE      11?1   ->   11?1
+ * _PAGE_TYPE_RO        0100   ->   1100
+ * _PAGE_TYPE_RW        0000   ->   1000
+ *
+ * pte_none is true for bits combinations 1000, 1100
+ * pte_present is true for bits combinations 0000, 0010, 0100, 0110, 1001
+ * pte_file is true for bits combinations 1101, 1111
+ * swap pte is 1011 and 0001, 0011, 0101, 0111, 1010 and 1110 are invalid.
+ */
+
 #ifndef __s390x__
 
 /* Bits in the segment table entry */
@@ -365,18 +392,21 @@ static inline int pmd_bad(pmd_t pmd)
 
 static inline int pte_none(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_TYPE_MASK) == _PAGE_TYPE_EMPTY;
+        return (pte_val(pte) & _PAGE_INVALID) && !(pte_val(pte) & _PAGE_SWT);
 }
 
 static inline int pte_present(pte_t pte)
 {
-        return !(pte_val(pte) & _PAGE_INVALID) ||
-                (pte_val(pte) & _PAGE_TYPE_MASK) == _PAGE_TYPE_NONE;
+        unsigned long mask = _PAGE_RO | _PAGE_INVALID | _PAGE_SWT | _PAGE_SWX;
+        return (pte_val(pte) & mask) == _PAGE_TYPE_NONE ||
+                (!(pte_val(pte) & _PAGE_INVALID) &&
+                 !(pte_val(pte) & _PAGE_SWT));
 }
 
 static inline int pte_file(pte_t pte)
 {
-        return (pte_val(pte) & _PAGE_TYPE_MASK) == _PAGE_TYPE_FILE;
+        unsigned long mask = _PAGE_RO | _PAGE_INVALID | _PAGE_SWT;
+        return (pte_val(pte) & mask) == _PAGE_TYPE_FILE;
 }
 
 #define pte_same(a,b)   (pte_val(a) == pte_val(b))
diff --git a/include/asm-s390/timer.h b/include/asm-s390/timer.h
index fcd6c256a2d1..30e5cbe570f2 100644
--- a/include/asm-s390/timer.h
+++ b/include/asm-s390/timer.h
@@ -26,7 +26,7 @@ struct vtimer_list {
         spinlock_t lock;
         unsigned long magic;
 
-        void (*function)(unsigned long, struct pt_regs*);
+        void (*function)(unsigned long);
         unsigned long data;
 };
 
diff --git a/include/asm-s390/unistd.h b/include/asm-s390/unistd.h
index a19238cbcffa..71d3c21b84f0 100644
--- a/include/asm-s390/unistd.h
+++ b/include/asm-s390/unistd.h
@@ -249,8 +249,9 @@
 #define __NR_vmsplice           309
 /* Number 310 is reserved for new sys_move_pages */
 #define __NR_getcpu             311
+#define __NR_epoll_pwait        312
 
-#define NR_syscalls 312
+#define NR_syscalls 313
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/include/asm-sh/cpu-sh4/ubc.h b/include/asm-sh/cpu-sh4/ubc.h
index 3d0943167659..c86e17050935 100644
--- a/include/asm-sh/cpu-sh4/ubc.h
+++ b/include/asm-sh/cpu-sh4/ubc.h
@@ -3,6 +3,7 @@
  *
  * Copyright (C) 1999 Niibe Yutaka
  * Copyright (C) 2003 Paul Mundt
+ * Copyright (C) 2006 Lineo Solutions Inc. support SH4A UBC
  *
  * This file is subject to the terms and conditions of the GNU General Public
  * License.  See the file "COPYING" in the main directory of this archive
@@ -11,6 +12,41 @@
 #ifndef __ASM_CPU_SH4_UBC_H
 #define __ASM_CPU_SH4_UBC_H
 
+#if defined(CONFIG_CPU_SH4A)
+#define UBC_CBR0                0xff200000
+#define UBC_CRR0                0xff200004
+#define UBC_CAR0                0xff200008
+#define UBC_CAMR0               0xff20000c
+#define UBC_CBR1                0xff200020
+#define UBC_CRR1                0xff200024
+#define UBC_CAR1                0xff200028
+#define UBC_CAMR1               0xff20002c
+#define UBC_CDR1                0xff200030
+#define UBC_CDMR1               0xff200034
+#define UBC_CETR1               0xff200038
+#define UBC_CCMFR               0xff200600
+#define UBC_CBCR                0xff200620
+
+/* CBR  */
+#define UBC_CBR_AIE             (0x01<<30)
+#define UBC_CBR_ID_INST         (0x01<<4)
+#define UBC_CBR_RW_READ         (0x01<<1)
+#define UBC_CBR_CE              (0x01)
+
+#define UBC_CBR_AIV_MASK        (0x00FF0000)
+#define UBC_CBR_AIV_SHIFT       (16)
+#define UBC_CBR_AIV_SET(asid)   (((asid)<<UBC_CBR_AIV_SHIFT) & UBC_CBR_AIV_MASK)
+
+#define UBC_CBR_INIT            0x20000000
+
+/* CRR  */
+#define UBC_CRR_RES             (0x01<<13)
+#define UBC_CRR_PCB             (0x01<<1)
+#define UBC_CRR_BIE             (0x01)
+
+#define UBC_CRR_INIT            0x00002000
+
+#else   /* CONFIG_CPU_SH4 */
 #define UBC_BARA                0xff200000
 #define UBC_BAMRA               0xff200004
 #define UBC_BBRA                0xff200008
@@ -22,6 +58,7 @@
 #define UBC_BDRB                0xff200018
 #define UBC_BDMRB               0xff20001c
 #define UBC_BRCR                0xff200020
+#endif  /* CONFIG_CPU_SH4 */
 
 #endif /* __ASM_CPU_SH4_UBC_H */
 
diff --git a/include/asm-sh/edosk7705/io.h b/include/asm-sh/edosk7705.h
index a1089a65bc36..a1089a65bc36 100644
--- a/include/asm-sh/edosk7705/io.h
+++ b/include/asm-sh/edosk7705.h
diff --git a/include/asm-sh/hp6xx/hp6xx.h b/include/asm-sh/hp6xx.h
index f35134c159dd..f35134c159dd 100644
--- a/include/asm-sh/hp6xx/hp6xx.h
+++ b/include/asm-sh/hp6xx.h
diff --git a/include/asm-sh/hp6xx/ide.h b/include/asm-sh/hp6xx/ide.h
deleted file mode 100644
index 570395a5ebe5..000000000000
--- a/include/asm-sh/hp6xx/ide.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __ASM_SH_HP6XX_IDE_H
-#define __ASM_SH_HP6XX_IDE_H
-
-#define IRQ_CFCARD      93
-#define IRQ_PCMCIA      94
-
-#endif /* __ASM_SH_HP6XX_IDE_H */
-
diff --git a/include/asm-sh/hp6xx/io.h b/include/asm-sh/hp6xx/io.h
deleted file mode 100644
index 2044476ab199..000000000000
--- a/include/asm-sh/hp6xx/io.h
+++ /dev/null
@@ -1,10 +0,0 @@
-#ifndef __ASM_SH_HP6XX_IO_H
-#define __ASM_SH_HP6XX_IO_H
-
-/*
- * Nothing special here.. just use the generic cchip io routines.
- */
-#include <asm/hd64461.h>
-
-#endif /* __ASM_SH_HP6XX_IO_H */
-
diff --git a/include/asm-sh/hs7751rvoip/hs7751rvoip.h b/include/asm-sh/hs7751rvoip.h
index c4cff9d33927..c4cff9d33927 100644
--- a/include/asm-sh/hs7751rvoip/hs7751rvoip.h
+++ b/include/asm-sh/hs7751rvoip.h
diff --git a/include/asm-sh/hs7751rvoip/ide.h b/include/asm-sh/hs7751rvoip/ide.h
deleted file mode 100644
index 65ad1d0f763b..000000000000
--- a/include/asm-sh/hs7751rvoip/ide.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __ASM_SH_HS7751RVOIP_IDE_H
-#define __ASM_SH_HS7751RVOIP_IDE_H
-
-/* Nothing to see here.. */
-#include <asm/hs7751rvoip/hs7751rvoip.h>
-
-#endif /* __ASM_SH_HS7751RVOIP_IDE_H */
-
diff --git a/include/asm-sh/hw_irq.h b/include/asm-sh/hw_irq.h
index fed26616967a..80ee1cda7498 100644
--- a/include/asm-sh/hw_irq.h
+++ b/include/asm-sh/hw_irq.h
@@ -1,4 +1,8 @@
 #ifndef __ASM_SH_HW_IRQ_H
 #define __ASM_SH_HW_IRQ_H
 
+#include <asm/atomic.h>
+
+extern atomic_t irq_err_count;
+
 #endif /* __ASM_SH_HW_IRQ_H */
diff --git a/include/asm-sh/io.h b/include/asm-sh/io.h
index ed12d38e8c00..a0e55b09e4fd 100644
--- a/include/asm-sh/io.h
+++ b/include/asm-sh/io.h
@@ -304,22 +304,6 @@ __ioremap_mode(unsigned long offset, unsigned long size, unsigned long flags)
 #define iounmap(addr)                                   \
         __iounmap((addr))
 
-static inline int check_signature(char __iomem *io_addr,
-                        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /*
  * The caches on some architectures aren't dma-coherent and have need to
  * handle this in software.  There are three types of operations that
diff --git a/include/asm-sh/irq-sh7780.h b/include/asm-sh/irq-sh7780.h
index 895c5780e454..19912ae6a7f7 100644
--- a/include/asm-sh/irq-sh7780.h
+++ b/include/asm-sh/irq-sh7780.h
@@ -6,16 +6,6 @@
  *
  * Copyright (C) 2004 Takashi SHUDO <shudo@hitachi-ul.co.jp>
  */
-
-#ifdef CONFIG_IDE
-# ifndef IRQ_CFCARD
-#  define IRQ_CFCARD    14
-# endif
-# ifndef IRQ_PCMCIA
-#  define IRQ_PCMCIA    15
-# endif
-#endif
-
 #define INTC_BASE       0xffd00000
 #define INTC_ICR0       (INTC_BASE+0x0)
 #define INTC_ICR1       (INTC_BASE+0x1c)
diff --git a/include/asm-sh/irq.h b/include/asm-sh/irq.h
index 0e5f365aff70..6cd3e9e2a76a 100644
--- a/include/asm-sh/irq.h
+++ b/include/asm-sh/irq.h
@@ -14,16 +14,6 @@
 #include <asm/machvec.h>
 #include <asm/ptrace.h>         /* for pt_regs */
 
-#if defined(CONFIG_SH_HP6XX) || \
-    defined(CONFIG_SH_RTS7751R2D) || \
-    defined(CONFIG_SH_HS7751RVOIP) || \
-    defined(CONFIG_SH_HS7751RVOIP) || \
-    defined(CONFIG_SH_SH03) || \
-    defined(CONFIG_SH_R7780RP) || \
-    defined(CONFIG_SH_LANDISK)
-#include <asm/mach/ide.h>
-#endif
-
 #ifndef CONFIG_CPU_SUBTYPE_SH7780
 
 #define INTC_DMAC0_MSK  0
@@ -38,15 +28,6 @@
 #define INTC_IPRD       0xffd00010UL
 #endif
 
-#ifdef CONFIG_IDE
-# ifndef IRQ_CFCARD
-#  define IRQ_CFCARD    14
-# endif
-# ifndef IRQ_PCMCIA
-#  define IRQ_PCMCIA    15
-# endif
-#endif
-
 #define TIMER_IRQ       16
 #define TIMER_IPR_ADDR  INTC_IPRA
 #define TIMER_IPR_POS    3
@@ -346,11 +327,17 @@ extern unsigned short *irq_mask_register;
  */
 void init_IRQ_pint(void);
 
+struct ipr_data {
+        unsigned int irq;
+        unsigned int addr;      /* Address of Interrupt Priority Register */
+        int shift;              /* Shifts of the 16-bit data */
+        int priority;           /* The priority */
+};
+
 /*
  * Function for "on chip support modules".
  */
-extern void make_ipr_irq(unsigned int irq, unsigned int addr,
-                         int pos,  int priority);
+extern void make_ipr_irq(struct ipr_data *table, unsigned int nr_irqs);
 extern void make_imask_irq(unsigned int irq);
 
 #if defined(CONFIG_CPU_SUBTYPE_SH7300)
@@ -697,13 +684,15 @@ extern int ipr_irq_demux(int irq);
 
 #define INTC2_INTPRI_OFFSET     0x00
 
-void make_intc2_irq(unsigned int irq,
-                    unsigned int ipr_offset, unsigned int ipr_shift,
-                    unsigned int msk_offset, unsigned int msk_shift,
-                    unsigned int priority);
-void init_IRQ_intc2(void);
-void intc2_add_clear_irq(int irq, int (*fn)(int));
+struct intc2_data {
+        unsigned short irq;
+        unsigned char ipr_offset, ipr_shift;
+        unsigned char msk_offset, msk_shift;
+        unsigned char priority;
+};
 
+void make_intc2_irq(struct intc2_data *, unsigned int nr_irqs);
+void init_IRQ_intc2(void);
 #endif
 
 extern int shmse_irq_demux(int irq);
diff --git a/include/asm-sh/irq_regs.h b/include/asm-sh/irq_regs.h
new file mode 100644
index 000000000000..3dd9c0b70270
--- /dev/null
+++ b/include/asm-sh/irq_regs.h
@@ -0,0 +1 @@
+#include <asm-generic/irq_regs.h>
diff --git a/include/asm-sh/landisk/ide.h b/include/asm-sh/landisk/ide.h
deleted file mode 100644
index 6490e28415ed..000000000000
--- a/include/asm-sh/landisk/ide.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/*
- * modifed by kogiidena
- * 2005.03.03
- */
-
-#ifndef __ASM_SH_LANDISK_IDE_H
-#define __ASM_SH_LANDISK_IDE_H
-
-/* Nothing to see here.. */
-#include <asm/landisk/iodata_landisk.h>
-#define IRQ_CFCARD      IRQ_FATA        /* CF Card IRQ */
-#define IRQ_PCMCIA      IRQ_ATA         /* PCMCIA IRQ */
-
-#endif /* __ASM_SH_LANDISK_IDE_H  */
diff --git a/include/asm-sh/processor.h b/include/asm-sh/processor.h
index 474773853cd1..45bb74e35d32 100644
--- a/include/asm-sh/processor.h
+++ b/include/asm-sh/processor.h
@@ -255,6 +255,8 @@ extern void save_fpu(struct task_struct *__tsk, struct pt_regs *regs);
  */
 #define thread_saved_pc(tsk)    (tsk->thread.pc)
 
+void show_trace(struct task_struct *tsk, unsigned long *sp,
+                struct pt_regs *regs);
 extern unsigned long get_wchan(struct task_struct *p);
 
 #define KSTK_EIP(tsk)  ((tsk)->thread.pc)
diff --git a/include/asm-sh/r7780rp/r7780rp.h b/include/asm-sh/r7780rp.h
index f95d9dba31a2..c18f648a7995 100644
--- a/include/asm-sh/r7780rp/r7780rp.h
+++ b/include/asm-sh/r7780rp.h
@@ -72,8 +72,6 @@
 
 #define PA_AX88796L     0xa4100400      /* AX88796L Area */
 #define PA_SC1602BSLB   0xa6000000      /* SC1602BSLB Area */
-#define PA_AREA5_IO     0xb4000000      /* Area 5 IO Memory */
-#define PA_AREA6_IO     0xb8000000      /* Area 6 IO Memory */
 #define PA_IDE_OFFSET   0x1f0           /* CF IDE Offset */
 #define AX88796L_IO_BASE        0x1000  /* AX88796L IO Base Address */
 
@@ -83,7 +81,6 @@
 #define IRQ_PCISLOT2    66              /* PCI Slot #2 IRQ */
 #define IRQ_PCISLOT3    67              /* PCI Slot #3 IRQ */
 #define IRQ_PCISLOT4    68              /* PCI Slot #4 IRQ */
-#define IRQ_CFCARD      1               /* CF Card IRQ */
 // #define IRQ_CFINST   0               /* CF Card Insert IRQ */
 #define IRQ_TP          2               /* Touch Panel IRQ */
 #define IRQ_SCI1        3               /* SCI1 IRQ */
@@ -146,8 +143,6 @@
 
 #define PA_AX88796L     0xa5800400      /* AX88796L Area */
 #define PA_SC1602BSLB   0xa6000000      /* SC1602BSLB Area */
-#define PA_AREA5_IO     0xb4000000      /* Area 5 IO Memory */
-#define PA_AREA6_IO     0xb8000000      /* Area 6 IO Memory */
 #define PA_IDE_OFFSET   0x1f0           /* CF IDE Offset */
 #define AX88796L_IO_BASE        0x1000  /* AX88796L IO Base Address */
 
@@ -157,7 +152,6 @@
 #define IRQ_PCISLOT2    1               /* PCI Slot #2 IRQ */
 #define IRQ_PCISLOT3    2               /* PCI Slot #3 IRQ */
 #define IRQ_PCISLOT4    3               /* PCI Slot #4 IRQ */
-#define IRQ_CFCARD      4               /* CF Card IRQ */
 #define IRQ_CFINST      5               /* CF Card Insert IRQ */
 #define IRQ_M66596      6               /* M66596 IRQ */
 #define IRQ_SDCARD      7               /* SD Card IRQ */
diff --git a/include/asm-sh/r7780rp/ide.h b/include/asm-sh/r7780rp/ide.h
deleted file mode 100644
index a1ed78e0f617..000000000000
--- a/include/asm-sh/r7780rp/ide.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __ASM_SH_R7780RP_IDE_H
-#define __ASM_SH_R7780RP_IDE_H
-
-/* Nothing to see here.. */
-#include <asm/mach/r7780rp.h>
-
-#endif /* __ASM_SH_R7780RP_IDE_H */
-
diff --git a/include/asm-sh/rts7751r2d/rts7751r2d.h b/include/asm-sh/rts7751r2d.h
index 796b8fcb81a8..796b8fcb81a8 100644
--- a/include/asm-sh/rts7751r2d/rts7751r2d.h
+++ b/include/asm-sh/rts7751r2d.h
diff --git a/include/asm-sh/rts7751r2d/ide.h b/include/asm-sh/rts7751r2d/ide.h
deleted file mode 100644
index 416f96b407cb..000000000000
--- a/include/asm-sh/rts7751r2d/ide.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef __ASM_SH_RTS7751R2D_IDE_H
-#define __ASM_SH_RTS7751R2D_IDE_H
-
-/* Nothing to see here.. */
-#include <asm/rts7751r2d/rts7751r2d.h>
-
-#endif /* __ASM_SH_RTS7751R2D_IDE_H */
-
diff --git a/include/asm-sh/sh03/ide.h b/include/asm-sh/sh03/ide.h
deleted file mode 100644
index 73ee92e5c79e..000000000000
--- a/include/asm-sh/sh03/ide.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef __ASM_SH_SH03_IDE_H
-#define __ASM_SH_SH03_IDE_H
-
-#define IRQ_CFCARD      8
-#define IRQ_PCMCIA      8
-
-#endif /* __ASM_SH_SH03_IDE_H */
diff --git a/include/asm-sh/shmin/shmin.h b/include/asm-sh/shmin.h
index 36ba138a81fb..36ba138a81fb 100644
--- a/include/asm-sh/shmin/shmin.h
+++ b/include/asm-sh/shmin.h
diff --git a/include/asm-sh/system.h b/include/asm-sh/system.h
index 6c1f8fde5ac4..3340126f4e0f 100644
--- a/include/asm-sh/system.h
+++ b/include/asm-sh/system.h
@@ -353,6 +353,13 @@ static inline unsigned long __cmpxchg(volatile void * ptr, unsigned long old,
                                     (unsigned long)_n_, sizeof(*(ptr))); \
   })
 
+extern void *set_exception_table_vec(unsigned int vec, void *handler);
+
+static inline void *set_exception_table_evt(unsigned int evt, void *handler)
+{
+        return set_exception_table_vec(evt >> 5, handler);
+}
+
 /* XXX
  * disable hlt during certain critical i/o operations
  */
diff --git a/include/asm-sh/timer.h b/include/asm-sh/timer.h
index c7ab28095ba0..5df842bcf7b6 100644
--- a/include/asm-sh/timer.h
+++ b/include/asm-sh/timer.h
@@ -8,8 +8,9 @@ struct sys_timer_ops {
         int (*init)(void);
         int (*start)(void);
         int (*stop)(void);
+#ifndef CONFIG_GENERIC_TIME
         unsigned long (*get_offset)(void);
-        unsigned long (*get_frequency)(void);
+#endif
 };
 
 struct sys_timer {
@@ -24,21 +25,17 @@ struct sys_timer {
 extern struct sys_timer tmu_timer;
 extern struct sys_timer *sys_timer;
 
+#ifndef CONFIG_GENERIC_TIME
 static inline unsigned long get_timer_offset(void)
 {
         return sys_timer->ops->get_offset();
 }
-
-static inline unsigned long get_timer_frequency(void)
-{
-        return sys_timer->ops->get_frequency();
-}
+#endif
 
 /* arch/sh/kernel/timers/timer.c */
 struct sys_timer *get_sys_timer(void);
 
 /* arch/sh/kernel/time.c */
-void handle_timer_tick(struct pt_regs *);
+void handle_timer_tick(void);
 
 #endif /* __ASM_SH_TIMER_H */
-
diff --git a/include/asm-sh/unistd.h b/include/asm-sh/unistd.h
index f1a0cbc966be..1c2abde122cd 100644
--- a/include/asm-sh/unistd.h
+++ b/include/asm-sh/unistd.h
@@ -324,8 +324,11 @@
 #define __NR_sync_file_range    314
 #define __NR_tee                315
 #define __NR_vmsplice           316
+#define __NR_move_pages         317
+#define __NR_getcpu             318
+#define __NR_epoll_pwait        319
 
-#define NR_syscalls 317
+#define NR_syscalls 320
 
 #ifdef __KERNEL__
 
diff --git a/include/asm-sh64/io.h b/include/asm-sh64/io.h
index 252fedbb6621..14d8e7b4bf4b 100644
--- a/include/asm-sh64/io.h
+++ b/include/asm-sh64/io.h
@@ -178,22 +178,6 @@ extern void iounmap(void *addr);
 unsigned long onchip_remap(unsigned long addr, unsigned long size, const char* name);
 extern void onchip_unmap(unsigned long vaddr);
 
-static __inline__ int check_signature(volatile void __iomem *io_addr,
-                        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /*
  * The caches on some architectures aren't dma-coherent and have need to
  * handle this in software.  There are three types of operations that
diff --git a/include/asm-sparc/elf.h b/include/asm-sparc/elf.h
index 83a3dd15a6ed..aaf6ef40ee2f 100644
--- a/include/asm-sparc/elf.h
+++ b/include/asm-sparc/elf.h
@@ -8,11 +8,6 @@
 
 #include <asm/ptrace.h>
 
-#ifdef __KERNEL__
-#include <asm/mbus.h>
-#include <asm/uaccess.h>
-#endif
-
 /*
  * Sparc section types
  */
@@ -77,6 +72,23 @@ typedef unsigned long elf_greg_t;
 #define ELF_NGREG 38
 typedef elf_greg_t elf_gregset_t[ELF_NGREG];
 
+typedef struct {
+        union {
+                unsigned long   pr_regs[32];
+                double          pr_dregs[16];
+        } pr_fr;
+        unsigned long __unused;
+        unsigned long   pr_fsr;
+        unsigned char   pr_qcnt;
+        unsigned char   pr_q_entrysize;
+        unsigned char   pr_en;
+        unsigned int    pr_q[64];
+} elf_fpregset_t;
+
+#ifdef __KERNEL__
+#include <asm/mbus.h>
+#include <asm/uaccess.h>
+
 /* Format is:
  *      G0 --> G7
  *      O0 --> O7
@@ -99,20 +111,7 @@ do {	unsigned long *dest = &(__elf_regs[0]);		\
         dest[34] = src->npc;                            \
         dest[35] = src->y;                              \
         dest[36] = dest[37] = 0; /* XXX */              \
-} while(0); /* Janitors: Don't touch this colon. */
-
-typedef struct {
-        union {
-                unsigned long   pr_regs[32];
-                double          pr_dregs[16];
-        } pr_fr;
-        unsigned long __unused;
-        unsigned long   pr_fsr;
-        unsigned char   pr_qcnt;
-        unsigned char   pr_q_entrysize;
-        unsigned char   pr_en;
-        unsigned int    pr_q[64];
-} elf_fpregset_t;
+} while(0); /* Janitors: Don't touch this semicolon. */
 
 #define ELF_CORE_COPY_TASK_REGS(__tsk, __elf_regs)      \
         ({ ELF_CORE_COPY_REGS((*(__elf_regs)), (__tsk)->thread.kregs); 1; })
@@ -165,8 +164,8 @@ typedef struct {
 
 #define ELF_PLATFORM    (NULL)
 
-#ifdef __KERNEL__
 #define SET_PERSONALITY(ex, ibcs2) set_personality((ibcs2)?PER_SVR4:PER_LINUX)
-#endif
+
+#endif /* __KERNEL__ */
 
 #endif /* !(__ASMSPARC_ELF_H) */
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index c7a495afc82e..f7827fa4cd5e 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -318,12 +318,15 @@
 #define __NR_unshare            299
 #define __NR_set_robust_list    300
 #define __NR_get_robust_list    301
+#define __NR_migrate_pages      302
+
+#define NR_SYSCALLS             303
 
 #ifdef __KERNEL__
-/* WARNING: You MAY NOT add syscall numbers larger than 301, since
+/* WARNING: You MAY NOT add syscall numbers larger than 302, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 301 entries (starting at zero).  Therefore
- *          find a free slot in the 0-301 range.
+ *          sized to have 302 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-302 range.
  */
 
 #define _syscall0(type,name) \
diff --git a/include/asm-sparc64/compat.h b/include/asm-sparc64/compat.h
index c73935dc7ba1..36511ca51416 100644
--- a/include/asm-sparc64/compat.h
+++ b/include/asm-sparc64/compat.h
@@ -164,7 +164,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static __inline__ void __user *compat_alloc_user_space(long len)
+static inline void __user *compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = current_thread_info()->kregs;
         unsigned long usp = regs->u_regs[UREG_I6];
@@ -174,7 +174,10 @@ static __inline__ void __user *compat_alloc_user_space(long len)
         else
                 usp &= 0xffffffffUL;
 
-        return (void __user *) (usp - len);
+        usp -= len;
+        usp &= ~0x7UL;
+
+        return (void __user *) usp;
 }
 
 struct compat_ipc64_perm {
diff --git a/include/asm-sparc64/futex.h b/include/asm-sparc64/futex.h
index dee40206b221..7392fc4a954e 100644
--- a/include/asm-sparc64/futex.h
+++ b/include/asm-sparc64/futex.h
@@ -87,24 +87,22 @@ static inline int
 futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
 {
         __asm__ __volatile__(
-        "\n1:   lduwa   [%2] %%asi, %0\n"
-        "2:     casa    [%2] %%asi, %0, %1\n"
-        "3:\n"
+        "\n1:   casa    [%3] %%asi, %2, %0\n"
+        "2:\n"
         "       .section .fixup,#alloc,#execinstr\n"
         "       .align  4\n"
-        "4:     ba      3b\n"
-        "        mov    %3, %0\n"
+        "3:     ba      2b\n"
+        "        mov    %4, %0\n"
         "       .previous\n"
         "       .section __ex_table,\"a\"\n"
         "       .align  4\n"
-        "       .word   1b, 4b\n"
-        "       .word   2b, 4b\n"
+        "       .word   1b, 3b\n"
         "       .previous\n"
-        : "=&r" (oldval)
-        : "r" (newval), "r" (uaddr), "i" (-EFAULT)
+        : "=r" (newval)
+        : "0" (newval), "r" (oldval), "r" (uaddr), "i" (-EFAULT)
         : "memory");
 
-        return oldval;
+        return newval;
 }
 
 #endif /* !(_SPARC64_FUTEX_H) */
diff --git a/include/asm-sparc64/io.h b/include/asm-sparc64/io.h
index 0056770e83ad..30b912d8e8bc 100644
--- a/include/asm-sparc64/io.h
+++ b/include/asm-sparc64/io.h
@@ -440,21 +440,6 @@ _memcpy_toio(volatile void __iomem *dst, const void *src, __kernel_size_t n)
 
 #define memcpy_toio(d,s,sz)     _memcpy_toio(d,s,sz)
 
-static inline int check_signature(void __iomem *io_addr,
-                                  const unsigned char *signature,
-                                  int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature++)
-                        goto out;
-                io_addr++;
-        } while (--length);
-        retval = 1;
-out:
-        return retval;
-}
-
 #define mmiowb()
 
 #ifdef __KERNEL__
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index 124cf076717f..63669dad0d72 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -320,12 +320,16 @@
 #define __NR_unshare            299
 #define __NR_set_robust_list    300
 #define __NR_get_robust_list    301
+#define __NR_migrate_pages      302
+
+#define NR_SYSCALLS             303
 
 #ifdef __KERNEL__
-/* WARNING: You MAY NOT add syscall numbers larger than 301, since
+
+/* WARNING: You MAY NOT add syscall numbers larger than 302, since
  *          all of the syscall tables in the Sparc kernel are
- *          sized to have 301 entries (starting at zero).  Therefore
- *          find a free slot in the 0-301 range.
+ *          sized to have 302 entries (starting at zero).  Therefore
+ *          find a free slot in the 0-302 range.
  */
 
 #define _syscall0(type,name) \
diff --git a/include/asm-um/archparam-ppc.h b/include/asm-um/archparam-ppc.h
index 172cd6ffacc4..4269d8a37b4f 100644
--- a/include/asm-um/archparam-ppc.h
+++ b/include/asm-um/archparam-ppc.h
@@ -1,15 +1,6 @@
 #ifndef __UM_ARCHPARAM_PPC_H
 #define __UM_ARCHPARAM_PPC_H
 
-/********* Bits for asm-um/hw_irq.h **********/
-
-struct hw_interrupt_type;
-
-/********* Bits for asm-um/hardirq.h **********/
-
-#define irq_enter(cpu, irq) hardirq_enter(cpu)
-#define irq_exit(cpu, irq) hardirq_exit(cpu)
-
 /********* Bits for asm-um/string.h **********/
 
 #define __HAVE_ARCH_STRRCHR
diff --git a/include/asm-um/common.lds.S b/include/asm-um/common.lds.S
index 1010153faaf9..f0454516dd31 100644
--- a/include/asm-um/common.lds.S
+++ b/include/asm-um/common.lds.S
@@ -42,13 +42,7 @@
         
   __initcall_start = .;
   .initcall.init : {
-        *(.initcall1.init) 
-        *(.initcall2.init) 
-        *(.initcall3.init) 
-        *(.initcall4.init) 
-        *(.initcall5.init) 
-        *(.initcall6.init) 
-        *(.initcall7.init)
+        INITCALLS
   }
   __initcall_end = .;
 
diff --git a/include/asm-x86_64/acpi.h b/include/asm-x86_64/acpi.h
index ed59aa4c6ff9..9d1916e59c04 100644
--- a/include/asm-x86_64/acpi.h
+++ b/include/asm-x86_64/acpi.h
@@ -163,6 +163,7 @@ extern u8 x86_acpiid_to_apicid[];
 #define ARCH_HAS_POWER_INIT 1
 
 extern int acpi_skip_timer_override;
+extern int acpi_use_timer_override;
 
 #endif /*__KERNEL__*/
 
diff --git a/include/asm-x86_64/hw_irq.h b/include/asm-x86_64/hw_irq.h
index 792dd52fcd70..179cce755aa7 100644
--- a/include/asm-x86_64/hw_irq.h
+++ b/include/asm-x86_64/hw_irq.h
@@ -76,6 +76,8 @@
 #ifndef __ASSEMBLY__
 typedef int vector_irq_t[NR_VECTORS];
 DECLARE_PER_CPU(vector_irq_t, vector_irq);
+extern void __setup_vector_irq(int cpu);
+extern spinlock_t vector_lock;
 
 /*
  * Various low-level irq details needed by irq.c, process.c,
diff --git a/include/asm-x86_64/io.h b/include/asm-x86_64/io.h
index 70e91fe76344..6ee9fadaaacb 100644
--- a/include/asm-x86_64/io.h
+++ b/include/asm-x86_64/io.h
@@ -254,33 +254,6 @@ void memset_io(volatile void __iomem *a, int b, size_t c);
 
 #define eth_io_copy_and_sum(a,b,c,d)            eth_copy_and_sum((a),(void *)(b),(c),(d))
 
-/**
- *      check_signature         -       find BIOS signatures
- *      @io_addr: mmio address to check 
- *      @signature:  signature block
- *      @length: length of signature
- *
- *      Perform a signature comparison with the mmio address io_addr. This
- *      address should have been obtained by ioremap.
- *      Returns 1 on a match.
- */
- 
-static inline int check_signature(void __iomem *io_addr,
-        const unsigned char *signature, int length)
-{
-        int retval = 0;
-        do {
-                if (readb(io_addr) != *signature)
-                        goto out;
-                io_addr++;
-                signature++;
-                length--;
-        } while (length);
-        retval = 1;
-out:
-        return retval;
-}
-
 /* Nothing to do */
 
 #define dma_cache_inv(_start,_size)             do { } while (0)
diff --git a/include/asm-x86_64/io_apic.h b/include/asm-x86_64/io_apic.h
index 171ec2dc8c04..561ecbfd4cb5 100644
--- a/include/asm-x86_64/io_apic.h
+++ b/include/asm-x86_64/io_apic.h
@@ -12,10 +12,6 @@
 
 #define APIC_MISMATCH_DEBUG
 
-#define IO_APIC_BASE(idx) \
-                ((volatile int *)(__fix_to_virt(FIX_IO_APIC_BASE_0 + idx) \
-                + (mp_ioapics[idx].mpc_apicaddr & ~PAGE_MASK)))
-
 /*
  * The structure of the IO-APIC:
  */
@@ -119,36 +115,6 @@ extern struct mpc_config_intsrc mp_irqs[MAX_IRQ_SOURCES];
 /* non-0 if default (table-less) MP configuration */
 extern int mpc_default_type;
 
-static inline unsigned int io_apic_read(unsigned int apic, unsigned int reg)
-{
-        *IO_APIC_BASE(apic) = reg;
-        return *(IO_APIC_BASE(apic)+4);
-}
-
-static inline void io_apic_write(unsigned int apic, unsigned int reg, unsigned int value)
-{
-        *IO_APIC_BASE(apic) = reg;
-        *(IO_APIC_BASE(apic)+4) = value;
-}
-
-/*
- * Re-write a value: to be used for read-modify-write
- * cycles where the read already set up the index register.
- */
-static inline void io_apic_modify(unsigned int apic, unsigned int value)
-{
-        *(IO_APIC_BASE(apic)+4) = value;
-}
-
-/*
- * Synchronize the IO-APIC and the CPU by doing
- * a dummy read from the IO-APIC
- */
-static inline void io_apic_sync(unsigned int apic)
-{
-        (void) *(IO_APIC_BASE(apic)+4);
-}
-
 /* 1 if "noapic" boot option passed */
 extern int skip_ioapic_setup;
 
diff --git a/include/asm-x86_64/pda.h b/include/asm-x86_64/pda.h
index 14996d962bac..5642634843c4 100644
--- a/include/asm-x86_64/pda.h
+++ b/include/asm-x86_64/pda.h
@@ -109,6 +109,15 @@ extern struct x8664_pda _proxy_pda;
 #define sub_pda(field,val) pda_to_op("sub",field,val)
 #define or_pda(field,val) pda_to_op("or",field,val)
 
+/* This is not atomic against other CPUs -- CPU preemption needs to be off */
+#define test_and_clear_bit_pda(bit,field) ({            \
+        int old__;                                              \
+        asm volatile("btr %2,%%gs:%c3\n\tsbbl %0,%0"            \
+            : "=r" (old__), "+m" (_proxy_pda.field)             \
+            : "dIr" (bit), "i" (pda_offset(field)) : "memory"); \
+        old__;                                                  \
+})
+
 #endif
 
 #define PDA_STACKOFFSET (5*8)
diff --git a/include/asm-x86_64/pgtable.h b/include/asm-x86_64/pgtable.h
index 6899e770b173..0555c1c4d8fa 100644
--- a/include/asm-x86_64/pgtable.h
+++ b/include/asm-x86_64/pgtable.h
@@ -366,6 +366,7 @@ static inline pte_t mk_pte_phys(unsigned long physpage, pgprot_t pgprot)
 { 
         pte_t pte;
         pte_val(pte) = physpage | pgprot_val(pgprot); 
+        pte_val(pte) &= __supported_pte_mask;
         return pte; 
 }
  
diff --git a/include/asm-x86_64/processor.h b/include/asm-x86_64/processor.h
index de9c3147ee4c..cef17e0f828c 100644
--- a/include/asm-x86_64/processor.h
+++ b/include/asm-x86_64/processor.h
@@ -475,6 +475,8 @@ static inline void __mwait(unsigned long eax, unsigned long ecx)
                 : :"a" (eax), "c" (ecx));
 }
 
+extern void mwait_idle_with_hints(unsigned long eax, unsigned long ecx);
+
 #define stack_current() \
 ({                                                              \
         struct thread_info *ti;                                 \
diff --git a/include/asm-x86_64/proto.h b/include/asm-x86_64/proto.h
index c181fef786e4..e72cfcdf5344 100644
--- a/include/asm-x86_64/proto.h
+++ b/include/asm-x86_64/proto.h
@@ -122,6 +122,8 @@ extern int fix_aperture;
 extern int reboot_force;
 extern int notsc_setup(char *);
 
+extern int timer_over_8254;
+
 extern int gsi_irq_sharing(int gsi);
 
 extern void smp_local_timer_interrupt(void);
diff --git a/include/asm-x86_64/vsyscall.h b/include/asm-x86_64/vsyscall.h
index fd452fc2c037..01d1c17e2849 100644
--- a/include/asm-x86_64/vsyscall.h
+++ b/include/asm-x86_64/vsyscall.h
@@ -59,8 +59,6 @@ extern seqlock_t xtime_lock;
 
 extern int sysctl_vsyscall;
 
-extern void vsyscall_set_cpu(int cpu);
-
 #define ARCH_HAVE_XTIME_LOCK 1
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 5114ff18101d..a1155a2beb32 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -120,6 +120,7 @@ header-y += netrom.h
 header-y += nfs2.h
 header-y += nfs4_mount.h
 header-y += nfs_mount.h
+header-y += oom.h
 header-y += param.h
 header-y += pci_ids.h
 header-y += pci_regs.h
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 88b5dfd8ee12..2b0c955590fe 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -494,6 +494,9 @@ void acpi_pci_unregister_driver(struct acpi_pci_driver *driver);
 
 extern int ec_read(u8 addr, u8 *val);
 extern int ec_write(u8 addr, u8 val);
+extern int ec_transaction(u8 command,
+                          const u8 *wdata, unsigned wdata_len,
+                          u8 *rdata, unsigned rdata_len);
 
 #endif /*CONFIG_ACPI_EC*/
 
diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h
index f7a1390d67f5..7011d6255593 100644
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -10,6 +10,8 @@
 
 #include <asm/atomic.h>
 
+struct page;
+
 /*
  * Bits in backing_dev_info.state
  */
@@ -88,6 +90,11 @@ static inline int bdi_rw_congested(struct backing_dev_info *bdi)
                                   (1 << BDI_write_congested));
 }
 
+void clear_bdi_congested(struct backing_dev_info *bdi, int rw);
+void set_bdi_congested(struct backing_dev_info *bdi, int rw);
+long congestion_wait(int rw, long timeout);
+void congestion_end(int rw);
+
 #define bdi_cap_writeback_dirty(bdi) \
         (!((bdi)->capabilities & BDI_CAP_NO_WRITEBACK))
 
diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h
index dcc5de7cc487..64b4641904fe 100644
--- a/include/linux/bitmap.h
+++ b/include/linux/bitmap.h
@@ -46,7 +46,8 @@
  * bitmap_remap(dst, src, old, new, nbits)      *dst = map(old, new)(src)
  * bitmap_bitremap(oldbit, old, new, nbits)     newbit = map(old, new)(oldbit)
  * bitmap_scnprintf(buf, len, src, nbits)       Print bitmap src to buf
- * bitmap_parse(ubuf, ulen, dst, nbits)         Parse bitmap dst from user buf
+ * bitmap_parse(buf, buflen, dst, nbits)        Parse bitmap dst from kernel buf
+ * bitmap_parse_user(ubuf, ulen, dst, nbits)    Parse bitmap dst from user buf
  * bitmap_scnlistprintf(buf, len, src, nbits)   Print bitmap src as list to buf
  * bitmap_parselist(buf, dst, nbits)            Parse bitmap dst from list
  * bitmap_find_free_region(bitmap, bits, order) Find and allocate bit region
@@ -106,7 +107,9 @@ extern int __bitmap_weight(const unsigned long *bitmap, int bits);
 
 extern int bitmap_scnprintf(char *buf, unsigned int len,
                         const unsigned long *src, int nbits);
-extern int bitmap_parse(const char __user *ubuf, unsigned int ulen,
+extern int __bitmap_parse(const char *buf, unsigned int buflen, int is_user,
+                        unsigned long *dst, int nbits);
+extern int bitmap_parse_user(const char __user *ubuf, unsigned int ulen,
                         unsigned long *dst, int nbits);
 extern int bitmap_scnlistprintf(char *buf, unsigned int len,
                         const unsigned long *src, int nbits);
@@ -270,6 +273,12 @@ static inline void bitmap_shift_left(unsigned long *dst,
                 __bitmap_shift_left(dst, src, n, nbits);
 }
 
+static inline int bitmap_parse(const char *buf, unsigned int buflen,
+                        unsigned long *maskp, int nmaskbits)
+{
+        return __bitmap_parse(buf, buflen, 0, maskp, nmaskbits);
+}
+
 #endif /* __ASSEMBLY__ */
 
 #endif /* __LINUX_BITMAP_H */
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 26f7856ff812..7bfcde2d5578 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -157,6 +157,7 @@ enum rq_cmd_type_bits {
         REQ_TYPE_ATA_CMD,
         REQ_TYPE_ATA_TASK,
         REQ_TYPE_ATA_TASKFILE,
+        REQ_TYPE_ATA_PC,
 };
 
 /*
@@ -650,6 +651,26 @@ extern void blk_recount_segments(request_queue_t *, struct bio *);
 extern int scsi_cmd_ioctl(struct file *, struct gendisk *, unsigned int, void __user *);
 extern int sg_scsi_ioctl(struct file *, struct request_queue *,
                 struct gendisk *, struct scsi_ioctl_command __user *);
+
+/*
+ * A queue has just exitted congestion.  Note this in the global counter of
+ * congested queues, and wake up anyone who was waiting for requests to be
+ * put back.
+ */
+static inline void blk_clear_queue_congested(request_queue_t *q, int rw)
+{
+        clear_bdi_congested(&q->backing_dev_info, rw);
+}
+
+/*
+ * A queue has just entered congestion.  Flag that in the queue's VM-visible
+ * state flags and increment the global gounter of congested queues.
+ */
+static inline void blk_set_queue_congested(request_queue_t *q, int rw)
+{
+        set_bdi_congested(&q->backing_dev_info, rw);
+}
+
 extern void blk_start_queue(request_queue_t *q);
 extern void blk_stop_queue(request_queue_t *q);
 extern void blk_sync_queue(struct request_queue *q);
@@ -764,10 +785,8 @@ extern int blk_queue_init_tags(request_queue_t *, int, struct blk_queue_tag *);
 extern void blk_queue_free_tags(request_queue_t *);
 extern int blk_queue_resize_tags(request_queue_t *, int);
 extern void blk_queue_invalidate_tags(request_queue_t *);
-extern long blk_congestion_wait(int rw, long timeout);
 extern struct blk_queue_tag *blk_init_tags(int);
 extern void blk_free_tags(struct blk_queue_tag *);
-extern void blk_congestion_end(int rw);
 
 static inline struct request *blk_map_queue_find_tag(struct blk_queue_tag *bqt,
                                                 int tag)
diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
index 131ffd37e716..5d9fb0e94156 100644
--- a/include/linux/buffer_head.h
+++ b/include/linux/buffer_head.h
@@ -69,6 +69,8 @@ struct buffer_head {
         bh_end_io_t *b_end_io;          /* I/O completion */
         void *b_private;                /* reserved for b_end_io */
         struct list_head b_assoc_buffers; /* associated with another mapping */
+        struct address_space *b_assoc_map;      /* mapping this buffer is
+                                                   associated with */
         atomic_t b_count;               /* users using this buffer_head */
 };
 
diff --git a/include/linux/carta_random32.h b/include/linux/carta_random32.h
new file mode 100644
index 000000000000..f6f3bd9f20b5
--- /dev/null
+++ b/include/linux/carta_random32.h
@@ -0,0 +1,29 @@
+/*
+ * Fast, simple, yet decent quality random number generator based on
+ * a paper by David G. Carta ("Two Fast Implementations of the
+ * `Minimal Standard' Random Number Generator," Communications of the
+ * ACM, January, 1990).
+ *
+ * Copyright (c) 2002-2006 Hewlett-Packard Development Company, L.P.
+ *      Contributed by Stephane Eranian <eranian@hpl.hp.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of version 2 of the GNU General Public
+ * License as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+ * 02111-1307 USA
+ */
+#ifndef _LINUX_CARTA_RANDOM32_H_
+#define _LINUX_CARTA_RANDOM32_H_
+
+u64 carta_random32(u64 seed);
+
+#endif /* _LINUX_CARTA_RANDOM32_H_ */
diff --git a/include/linux/compat.h b/include/linux/compat.h
index f4ebf96f5308..80b17f440ec1 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -196,7 +196,7 @@ asmlinkage long compat_sys_select(int n, compat_ulong_t __user *inp,
 #define BITS_TO_COMPAT_LONGS(bits) \
         (((bits)+BITS_PER_COMPAT_LONG-1)/BITS_PER_COMPAT_LONG)
 
-long compat_get_bitmap(unsigned long *mask, compat_ulong_t __user *umask,
+long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask,
                        unsigned long bitmap_size);
 long compat_put_bitmap(compat_ulong_t __user *umask, unsigned long *mask,
                        unsigned long bitmap_size);
@@ -230,5 +230,9 @@ asmlinkage long compat_sys_adjtimex(struct compat_timex __user *utp);
 extern int compat_printk(const char *fmt, ...);
 extern void sigset_from_compat(sigset_t *set, compat_sigset_t *compat);
 
+asmlinkage long compat_sys_migrate_pages(compat_pid_t pid,
+                compat_ulong_t maxnode, const compat_ulong_t __user *old_nodes,
+                const compat_ulong_t __user *new_nodes);
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/compat_ioctl.h b/include/linux/compat_ioctl.h
index 4e1663d7691e..c26c3adcfacf 100644
--- a/include/linux/compat_ioctl.h
+++ b/include/linux/compat_ioctl.h
@@ -61,17 +61,23 @@ COMPATIBLE_IOCTL(FIGETBSZ)
  *         Some need translations, these do not.
  */
 COMPATIBLE_IOCTL(HDIO_GET_IDENTITY)
-COMPATIBLE_IOCTL(HDIO_SET_DMA)
-COMPATIBLE_IOCTL(HDIO_SET_UNMASKINTR)
-COMPATIBLE_IOCTL(HDIO_SET_NOWERR)
-COMPATIBLE_IOCTL(HDIO_SET_32BIT)
-COMPATIBLE_IOCTL(HDIO_SET_MULTCOUNT)
-COMPATIBLE_IOCTL(HDIO_DRIVE_CMD)
 COMPATIBLE_IOCTL(HDIO_DRIVE_TASK)
-COMPATIBLE_IOCTL(HDIO_SET_PIO_MODE)
-COMPATIBLE_IOCTL(HDIO_SET_NICE)
-COMPATIBLE_IOCTL(HDIO_SET_KEEPSETTINGS)
+COMPATIBLE_IOCTL(HDIO_DRIVE_CMD)
+ULONG_IOCTL(HDIO_SET_MULTCOUNT)
+ULONG_IOCTL(HDIO_SET_UNMASKINTR)
+ULONG_IOCTL(HDIO_SET_KEEPSETTINGS)
+ULONG_IOCTL(HDIO_SET_32BIT)
+ULONG_IOCTL(HDIO_SET_NOWERR)
+ULONG_IOCTL(HDIO_SET_DMA)
+ULONG_IOCTL(HDIO_SET_PIO_MODE)
+ULONG_IOCTL(HDIO_SET_NICE)
+ULONG_IOCTL(HDIO_SET_WCACHE)
+ULONG_IOCTL(HDIO_SET_ACOUSTIC)
+ULONG_IOCTL(HDIO_SET_BUSSTATE)
+ULONG_IOCTL(HDIO_SET_ADDRESS)
 COMPATIBLE_IOCTL(HDIO_SCAN_HWIF)
+/* 0x330 is reserved -- it used to be HDIO_GETGEO_BIG */
+COMPATIBLE_IOCTL(0x330)
 /* 0x02 -- Floppy ioctls */
 COMPATIBLE_IOCTL(FDMSGON)
 COMPATIBLE_IOCTL(FDMSGOFF)
@@ -125,6 +131,7 @@ COMPATIBLE_IOCTL(RUN_ARRAY)
 COMPATIBLE_IOCTL(STOP_ARRAY)
 COMPATIBLE_IOCTL(STOP_ARRAY_RO)
 COMPATIBLE_IOCTL(RESTART_ARRAY_RW)
+COMPATIBLE_IOCTL(GET_BITMAP_FILE)
 ULONG_IOCTL(SET_BITMAP_FILE)
 /* DM */
 COMPATIBLE_IOCTL(DM_VERSION_32)
diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
index b268a3c0c376..d0e8c8b0e34d 100644
--- a/include/linux/cpumask.h
+++ b/include/linux/cpumask.h
@@ -8,8 +8,8 @@
  * See detailed comments in the file linux/bitmap.h describing the
  * data type on which these cpumasks are based.
  *
- * For details of cpumask_scnprintf() and cpumask_parse(),
- * see bitmap_scnprintf() and bitmap_parse() in lib/bitmap.c.
+ * For details of cpumask_scnprintf() and cpumask_parse_user(),
+ * see bitmap_scnprintf() and bitmap_parse_user() in lib/bitmap.c.
  * For details of cpulist_scnprintf() and cpulist_parse(), see
  * bitmap_scnlistprintf() and bitmap_parselist(), also in bitmap.c.
  * For details of cpu_remap(), see bitmap_bitremap in lib/bitmap.c
@@ -49,7 +49,7 @@
  * unsigned long *cpus_addr(mask)       Array of unsigned long's in mask
  *
  * int cpumask_scnprintf(buf, len, mask) Format cpumask for printing
- * int cpumask_parse(ubuf, ulen, mask)  Parse ascii string as cpumask
+ * int cpumask_parse_user(ubuf, ulen, mask)     Parse ascii string as cpumask
  * int cpulist_scnprintf(buf, len, mask) Format cpumask as list for printing
  * int cpulist_parse(buf, map)          Parse ascii string as cpulist
  * int cpu_remap(oldbit, old, new)      newbit = map(old, new)(oldbit)
@@ -273,12 +273,12 @@ static inline int __cpumask_scnprintf(char *buf, int len,
         return bitmap_scnprintf(buf, len, srcp->bits, nbits);
 }
 
-#define cpumask_parse(ubuf, ulen, dst) \
-                        __cpumask_parse((ubuf), (ulen), &(dst), NR_CPUS)
-static inline int __cpumask_parse(const char __user *buf, int len,
+#define cpumask_parse_user(ubuf, ulen, dst) \
+                        __cpumask_parse_user((ubuf), (ulen), &(dst), NR_CPUS)
+static inline int __cpumask_parse_user(const char __user *buf, int len,
                                         cpumask_t *dstp, int nbits)
 {
-        return bitmap_parse(buf, len, dstp->bits, nbits);
+        return bitmap_parse_user(buf, len, dstp->bits, nbits);
 }
 
 #define cpulist_scnprintf(buf, len, src) \
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 8f2ffa4caabf..6485e9716b36 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -245,7 +245,7 @@ int crypto_alg_available(const char *name, u32 flags)
         __deprecated_for_modules;
 int crypto_has_alg(const char *name, u32 type, u32 mask);
 #else
-static int crypto_alg_available(const char *name, u32 flags);
+static int crypto_alg_available(const char *name, u32 flags)
         __deprecated_for_modules;
 static inline int crypto_alg_available(const char *name, u32 flags)
 {
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 44605be59409..63f64a9a5bf7 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -230,6 +230,7 @@ extern struct dentry * d_alloc_anon(struct inode *);
 extern struct dentry * d_splice_alias(struct inode *, struct dentry *);
 extern void shrink_dcache_sb(struct super_block *);
 extern void shrink_dcache_parent(struct dentry *);
+extern void shrink_dcache_for_umount(struct super_block *);
 extern int d_invalidate(struct dentry *);
 
 /* only used at mount-time */
diff --git a/include/linux/device.h b/include/linux/device.h
index 662e6a10144e..9d4f6a963936 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -393,7 +393,7 @@ extern void device_unregister(struct device * dev);
 extern void device_initialize(struct device * dev);
 extern int __must_check device_add(struct device * dev);
 extern void device_del(struct device * dev);
-extern int __must_check device_for_each_child(struct device *, void *,
+extern int device_for_each_child(struct device *, void *,
                      int (*fn)(struct device *, void *));
 extern int device_rename(struct device *dev, char *new_name);
 
diff --git a/include/linux/dmi.h b/include/linux/dmi.h
index 38dc403be70b..904bf3d2d90b 100644
--- a/include/linux/dmi.h
+++ b/include/linux/dmi.h
@@ -69,6 +69,7 @@ extern struct dmi_device * dmi_find_device(int type, const char *name,
         struct dmi_device *from);
 extern void dmi_scan_machine(void);
 extern int dmi_get_year(int field);
+extern int dmi_name_in_vendors(char *str);
 
 #else
 
@@ -77,6 +78,7 @@ static inline char * dmi_get_system_info(int field) { return NULL; }
 static inline struct dmi_device * dmi_find_device(int type, const char *name,
         struct dmi_device *from) { return NULL; }
 static inline int dmi_get_year(int year) { return 0; }
+static inline int dmi_name_in_vendors(char *s) { return 0; }
 
 #endif
 
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index b3370ef5164d..2fa9f1144228 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -70,7 +70,6 @@ struct elevator_type
 {
         struct list_head list;
         struct elevator_ops ops;
-        struct elevator_type *elevator_type;
         struct elv_fs_entry *elevator_attrs;
         char elevator_name[ELV_NAME_MAX];
         struct module *elevator_owner;
diff --git a/include/linux/ext4_fs.h b/include/linux/ext4_fs.h
new file mode 100644
index 000000000000..498503ee613d
--- /dev/null
+++ b/include/linux/ext4_fs.h
@@ -0,0 +1,994 @@
+/*
+ *  linux/include/linux/ext4_fs.h
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/include/linux/minix_fs.h
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+#ifndef _LINUX_EXT4_FS_H
+#define _LINUX_EXT4_FS_H
+
+#include <linux/types.h>
+#include <linux/blkdev.h>
+#include <linux/magic.h>
+
+/*
+ * The second extended filesystem constants/structures
+ */
+
+/*
+ * Define EXT4FS_DEBUG to produce debug messages
+ */
+#undef EXT4FS_DEBUG
+
+/*
+ * Define EXT4_RESERVATION to reserve data blocks for expanding files
+ */
+#define EXT4_DEFAULT_RESERVE_BLOCKS     8
+/*max window size: 1024(direct blocks) + 3([t,d]indirect blocks) */
+#define EXT4_MAX_RESERVE_BLOCKS         1027
+#define EXT4_RESERVE_WINDOW_NOT_ALLOCATED 0
+/*
+ * Always enable hashed directories
+ */
+#define CONFIG_EXT4_INDEX
+
+/*
+ * Debug code
+ */
+#ifdef EXT4FS_DEBUG
+#define ext4_debug(f, a...)                                             \
+        do {                                                            \
+                printk (KERN_DEBUG "EXT4-fs DEBUG (%s, %d): %s:",       \
+                        __FILE__, __LINE__, __FUNCTION__);              \
+                printk (KERN_DEBUG f, ## a);                            \
+        } while (0)
+#else
+#define ext4_debug(f, a...)     do {} while (0)
+#endif
+
+/*
+ * Special inodes numbers
+ */
+#define EXT4_BAD_INO             1      /* Bad blocks inode */
+#define EXT4_ROOT_INO            2      /* Root inode */
+#define EXT4_BOOT_LOADER_INO     5      /* Boot loader inode */
+#define EXT4_UNDEL_DIR_INO       6      /* Undelete directory inode */
+#define EXT4_RESIZE_INO          7      /* Reserved group descriptors inode */
+#define EXT4_JOURNAL_INO         8      /* Journal inode */
+
+/* First non-reserved inode for old ext4 filesystems */
+#define EXT4_GOOD_OLD_FIRST_INO 11
+
+/*
+ * Maximal count of links to a file
+ */
+#define EXT4_LINK_MAX           32000
+
+/*
+ * Macro-instructions used to manage several block sizes
+ */
+#define EXT4_MIN_BLOCK_SIZE             1024
+#define EXT4_MAX_BLOCK_SIZE             4096
+#define EXT4_MIN_BLOCK_LOG_SIZE           10
+#ifdef __KERNEL__
+# define EXT4_BLOCK_SIZE(s)             ((s)->s_blocksize)
+#else
+# define EXT4_BLOCK_SIZE(s)             (EXT4_MIN_BLOCK_SIZE << (s)->s_log_block_size)
+#endif
+#define EXT4_ADDR_PER_BLOCK(s)          (EXT4_BLOCK_SIZE(s) / sizeof (__u32))
+#ifdef __KERNEL__
+# define EXT4_BLOCK_SIZE_BITS(s)        ((s)->s_blocksize_bits)
+#else
+# define EXT4_BLOCK_SIZE_BITS(s)        ((s)->s_log_block_size + 10)
+#endif
+#ifdef __KERNEL__
+#define EXT4_ADDR_PER_BLOCK_BITS(s)     (EXT4_SB(s)->s_addr_per_block_bits)
+#define EXT4_INODE_SIZE(s)              (EXT4_SB(s)->s_inode_size)
+#define EXT4_FIRST_INO(s)               (EXT4_SB(s)->s_first_ino)
+#else
+#define EXT4_INODE_SIZE(s)      (((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
+                                 EXT4_GOOD_OLD_INODE_SIZE : \
+                                 (s)->s_inode_size)
+#define EXT4_FIRST_INO(s)       (((s)->s_rev_level == EXT4_GOOD_OLD_REV) ? \
+                                 EXT4_GOOD_OLD_FIRST_INO : \
+                                 (s)->s_first_ino)
+#endif
+
+/*
+ * Macro-instructions used to manage fragments
+ */
+#define EXT4_MIN_FRAG_SIZE              1024
+#define EXT4_MAX_FRAG_SIZE              4096
+#define EXT4_MIN_FRAG_LOG_SIZE            10
+#ifdef __KERNEL__
+# define EXT4_FRAG_SIZE(s)              (EXT4_SB(s)->s_frag_size)
+# define EXT4_FRAGS_PER_BLOCK(s)        (EXT4_SB(s)->s_frags_per_block)
+#else
+# define EXT4_FRAG_SIZE(s)              (EXT4_MIN_FRAG_SIZE << (s)->s_log_frag_size)
+# define EXT4_FRAGS_PER_BLOCK(s)        (EXT4_BLOCK_SIZE(s) / EXT4_FRAG_SIZE(s))
+#endif
+
+/*
+ * Structure of a blocks group descriptor
+ */
+struct ext4_group_desc
+{
+        __le32  bg_block_bitmap;                /* Blocks bitmap block */
+        __le32  bg_inode_bitmap;                /* Inodes bitmap block */
+        __le32  bg_inode_table;         /* Inodes table block */
+        __le16  bg_free_blocks_count;   /* Free blocks count */
+        __le16  bg_free_inodes_count;   /* Free inodes count */
+        __le16  bg_used_dirs_count;     /* Directories count */
+        __u16   bg_flags;
+        __u32   bg_reserved[3];
+        __le32  bg_block_bitmap_hi;     /* Blocks bitmap block MSB */
+        __le32  bg_inode_bitmap_hi;     /* Inodes bitmap block MSB */
+        __le32  bg_inode_table_hi;      /* Inodes table block MSB */
+};
+
+#ifdef __KERNEL__
+#include <linux/ext4_fs_i.h>
+#include <linux/ext4_fs_sb.h>
+#endif
+/*
+ * Macro-instructions used to manage group descriptors
+ */
+#define EXT4_MIN_DESC_SIZE              32
+#define EXT4_MIN_DESC_SIZE_64BIT        64
+#define EXT4_MAX_DESC_SIZE              EXT4_MIN_BLOCK_SIZE
+#define EXT4_DESC_SIZE(s)               (EXT4_SB(s)->s_desc_size)
+#ifdef __KERNEL__
+# define EXT4_BLOCKS_PER_GROUP(s)       (EXT4_SB(s)->s_blocks_per_group)
+# define EXT4_DESC_PER_BLOCK(s)         (EXT4_SB(s)->s_desc_per_block)
+# define EXT4_INODES_PER_GROUP(s)       (EXT4_SB(s)->s_inodes_per_group)
+# define EXT4_DESC_PER_BLOCK_BITS(s)    (EXT4_SB(s)->s_desc_per_block_bits)
+#else
+# define EXT4_BLOCKS_PER_GROUP(s)       ((s)->s_blocks_per_group)
+# define EXT4_DESC_PER_BLOCK(s)         (EXT4_BLOCK_SIZE(s) / EXT4_DESC_SIZE(s))
+# define EXT4_INODES_PER_GROUP(s)       ((s)->s_inodes_per_group)
+#endif
+
+/*
+ * Constants relative to the data blocks
+ */
+#define EXT4_NDIR_BLOCKS                12
+#define EXT4_IND_BLOCK                  EXT4_NDIR_BLOCKS
+#define EXT4_DIND_BLOCK                 (EXT4_IND_BLOCK + 1)
+#define EXT4_TIND_BLOCK                 (EXT4_DIND_BLOCK + 1)
+#define EXT4_N_BLOCKS                   (EXT4_TIND_BLOCK + 1)
+
+/*
+ * Inode flags
+ */
+#define EXT4_SECRM_FL                   0x00000001 /* Secure deletion */
+#define EXT4_UNRM_FL                    0x00000002 /* Undelete */
+#define EXT4_COMPR_FL                   0x00000004 /* Compress file */
+#define EXT4_SYNC_FL                    0x00000008 /* Synchronous updates */
+#define EXT4_IMMUTABLE_FL               0x00000010 /* Immutable file */
+#define EXT4_APPEND_FL                  0x00000020 /* writes to file may only append */
+#define EXT4_NODUMP_FL                  0x00000040 /* do not dump file */
+#define EXT4_NOATIME_FL                 0x00000080 /* do not update atime */
+/* Reserved for compression usage... */
+#define EXT4_DIRTY_FL                   0x00000100
+#define EXT4_COMPRBLK_FL                0x00000200 /* One or more compressed clusters */
+#define EXT4_NOCOMPR_FL                 0x00000400 /* Don't compress */
+#define EXT4_ECOMPR_FL                  0x00000800 /* Compression error */
+/* End compression flags --- maybe not all used */
+#define EXT4_INDEX_FL                   0x00001000 /* hash-indexed directory */
+#define EXT4_IMAGIC_FL                  0x00002000 /* AFS directory */
+#define EXT4_JOURNAL_DATA_FL            0x00004000 /* file data should be journaled */
+#define EXT4_NOTAIL_FL                  0x00008000 /* file tail should not be merged */
+#define EXT4_DIRSYNC_FL                 0x00010000 /* dirsync behaviour (directories only) */
+#define EXT4_TOPDIR_FL                  0x00020000 /* Top of directory hierarchies*/
+#define EXT4_RESERVED_FL                0x80000000 /* reserved for ext4 lib */
+#define EXT4_EXTENTS_FL                 0x00080000 /* Inode uses extents */
+
+#define EXT4_FL_USER_VISIBLE            0x000BDFFF /* User visible flags */
+#define EXT4_FL_USER_MODIFIABLE         0x000380FF /* User modifiable flags */
+
+/*
+ * Inode dynamic state flags
+ */
+#define EXT4_STATE_JDATA                0x00000001 /* journaled data exists */
+#define EXT4_STATE_NEW                  0x00000002 /* inode is newly created */
+#define EXT4_STATE_XATTR                0x00000004 /* has in-inode xattrs */
+
+/* Used to pass group descriptor data when online resize is done */
+struct ext4_new_group_input {
+        __u32 group;            /* Group number for this data */
+        __u64 block_bitmap;     /* Absolute block number of block bitmap */
+        __u64 inode_bitmap;     /* Absolute block number of inode bitmap */
+        __u64 inode_table;      /* Absolute block number of inode table start */
+        __u32 blocks_count;     /* Total number of blocks in this group */
+        __u16 reserved_blocks;  /* Number of reserved blocks in this group */
+        __u16 unused;
+};
+
+/* The struct ext4_new_group_input in kernel space, with free_blocks_count */
+struct ext4_new_group_data {
+        __u32 group;
+        __u64 block_bitmap;
+        __u64 inode_bitmap;
+        __u64 inode_table;
+        __u32 blocks_count;
+        __u16 reserved_blocks;
+        __u16 unused;
+        __u32 free_blocks_count;
+};
+
+
+/*
+ * ioctl commands
+ */
+#define EXT4_IOC_GETFLAGS               FS_IOC_GETFLAGS
+#define EXT4_IOC_SETFLAGS               FS_IOC_SETFLAGS
+#define EXT4_IOC_GETVERSION             _IOR('f', 3, long)
+#define EXT4_IOC_SETVERSION             _IOW('f', 4, long)
+#define EXT4_IOC_GROUP_EXTEND           _IOW('f', 7, unsigned long)
+#define EXT4_IOC_GROUP_ADD              _IOW('f', 8,struct ext4_new_group_input)
+#define EXT4_IOC_GETVERSION_OLD         FS_IOC_GETVERSION
+#define EXT4_IOC_SETVERSION_OLD         FS_IOC_SETVERSION
+#ifdef CONFIG_JBD_DEBUG
+#define EXT4_IOC_WAIT_FOR_READONLY      _IOR('f', 99, long)
+#endif
+#define EXT4_IOC_GETRSVSZ               _IOR('f', 5, long)
+#define EXT4_IOC_SETRSVSZ               _IOW('f', 6, long)
+
+/*
+ * ioctl commands in 32 bit emulation
+ */
+#define EXT4_IOC32_GETFLAGS             FS_IOC32_GETFLAGS
+#define EXT4_IOC32_SETFLAGS             FS_IOC32_SETFLAGS
+#define EXT4_IOC32_GETVERSION           _IOR('f', 3, int)
+#define EXT4_IOC32_SETVERSION           _IOW('f', 4, int)
+#define EXT4_IOC32_GETRSVSZ             _IOR('f', 5, int)
+#define EXT4_IOC32_SETRSVSZ             _IOW('f', 6, int)
+#define EXT4_IOC32_GROUP_EXTEND         _IOW('f', 7, unsigned int)
+#ifdef CONFIG_JBD_DEBUG
+#define EXT4_IOC32_WAIT_FOR_READONLY    _IOR('f', 99, int)
+#endif
+#define EXT4_IOC32_GETVERSION_OLD       FS_IOC32_GETVERSION
+#define EXT4_IOC32_SETVERSION_OLD       FS_IOC32_SETVERSION
+
+
+/*
+ *  Mount options
+ */
+struct ext4_mount_options {
+        unsigned long s_mount_opt;
+        uid_t s_resuid;
+        gid_t s_resgid;
+        unsigned long s_commit_interval;
+#ifdef CONFIG_QUOTA
+        int s_jquota_fmt;
+        char *s_qf_names[MAXQUOTAS];
+#endif
+};
+
+/*
+ * Structure of an inode on the disk
+ */
+struct ext4_inode {
+        __le16  i_mode;         /* File mode */
+        __le16  i_uid;          /* Low 16 bits of Owner Uid */
+        __le32  i_size;         /* Size in bytes */
+        __le32  i_atime;        /* Access time */
+        __le32  i_ctime;        /* Creation time */
+        __le32  i_mtime;        /* Modification time */
+        __le32  i_dtime;        /* Deletion Time */
+        __le16  i_gid;          /* Low 16 bits of Group Id */
+        __le16  i_links_count;  /* Links count */
+        __le32  i_blocks;       /* Blocks count */
+        __le32  i_flags;        /* File flags */
+        union {
+                struct {
+                        __u32  l_i_reserved1;
+                } linux1;
+                struct {
+                        __u32  h_i_translator;
+                } hurd1;
+                struct {
+                        __u32  m_i_reserved1;
+                } masix1;
+        } osd1;                         /* OS dependent 1 */
+        __le32  i_block[EXT4_N_BLOCKS];/* Pointers to blocks */
+        __le32  i_generation;   /* File version (for NFS) */
+        __le32  i_file_acl;     /* File ACL */
+        __le32  i_dir_acl;      /* Directory ACL */
+        __le32  i_faddr;        /* Fragment address */
+        union {
+                struct {
+                        __u8    l_i_frag;       /* Fragment number */
+                        __u8    l_i_fsize;      /* Fragment size */
+                        __le16  l_i_file_acl_high;
+                        __le16  l_i_uid_high;   /* these 2 fields    */
+                        __le16  l_i_gid_high;   /* were reserved2[0] */
+                        __u32   l_i_reserved2;
+                } linux2;
+                struct {
+                        __u8    h_i_frag;       /* Fragment number */
+                        __u8    h_i_fsize;      /* Fragment size */
+                        __u16   h_i_mode_high;
+                        __u16   h_i_uid_high;
+                        __u16   h_i_gid_high;
+                        __u32   h_i_author;
+                } hurd2;
+                struct {
+                        __u8    m_i_frag;       /* Fragment number */
+                        __u8    m_i_fsize;      /* Fragment size */
+                        __le16  m_i_file_acl_high;
+                        __u32   m_i_reserved2[2];
+                } masix2;
+        } osd2;                         /* OS dependent 2 */
+        __le16  i_extra_isize;
+        __le16  i_pad1;
+};
+
+#define i_size_high     i_dir_acl
+
+#if defined(__KERNEL__) || defined(__linux__)
+#define i_reserved1     osd1.linux1.l_i_reserved1
+#define i_frag          osd2.linux2.l_i_frag
+#define i_fsize         osd2.linux2.l_i_fsize
+#define i_file_acl_high osd2.linux2.l_i_file_acl_high
+#define i_uid_low       i_uid
+#define i_gid_low       i_gid
+#define i_uid_high      osd2.linux2.l_i_uid_high
+#define i_gid_high      osd2.linux2.l_i_gid_high
+#define i_reserved2     osd2.linux2.l_i_reserved2
+
+#elif defined(__GNU__)
+
+#define i_translator    osd1.hurd1.h_i_translator
+#define i_frag          osd2.hurd2.h_i_frag;
+#define i_fsize         osd2.hurd2.h_i_fsize;
+#define i_uid_high      osd2.hurd2.h_i_uid_high
+#define i_gid_high      osd2.hurd2.h_i_gid_high
+#define i_author        osd2.hurd2.h_i_author
+
+#elif defined(__masix__)
+
+#define i_reserved1     osd1.masix1.m_i_reserved1
+#define i_frag          osd2.masix2.m_i_frag
+#define i_fsize         osd2.masix2.m_i_fsize
+#define i_file_acl_high osd2.masix2.m_i_file_acl_high
+#define i_reserved2     osd2.masix2.m_i_reserved2
+
+#endif /* defined(__KERNEL__) || defined(__linux__) */
+
+/*
+ * File system states
+ */
+#define EXT4_VALID_FS                   0x0001  /* Unmounted cleanly */
+#define EXT4_ERROR_FS                   0x0002  /* Errors detected */
+#define EXT4_ORPHAN_FS                  0x0004  /* Orphans being recovered */
+
+/*
+ * Mount flags
+ */
+#define EXT4_MOUNT_CHECK                0x00001 /* Do mount-time checks */
+#define EXT4_MOUNT_OLDALLOC             0x00002  /* Don't use the new Orlov allocator */
+#define EXT4_MOUNT_GRPID                0x00004 /* Create files with directory's group */
+#define EXT4_MOUNT_DEBUG                0x00008 /* Some debugging messages */
+#define EXT4_MOUNT_ERRORS_CONT          0x00010 /* Continue on errors */
+#define EXT4_MOUNT_ERRORS_RO            0x00020 /* Remount fs ro on errors */
+#define EXT4_MOUNT_ERRORS_PANIC         0x00040 /* Panic on errors */
+#define EXT4_MOUNT_MINIX_DF             0x00080 /* Mimics the Minix statfs */
+#define EXT4_MOUNT_NOLOAD               0x00100 /* Don't use existing journal*/
+#define EXT4_MOUNT_ABORT                0x00200 /* Fatal error detected */
+#define EXT4_MOUNT_DATA_FLAGS           0x00C00 /* Mode for data writes: */
+#define EXT4_MOUNT_JOURNAL_DATA         0x00400 /* Write data to journal */
+#define EXT4_MOUNT_ORDERED_DATA         0x00800 /* Flush data before commit */
+#define EXT4_MOUNT_WRITEBACK_DATA       0x00C00 /* No data ordering */
+#define EXT4_MOUNT_UPDATE_JOURNAL       0x01000 /* Update the journal format */
+#define EXT4_MOUNT_NO_UID32             0x02000  /* Disable 32-bit UIDs */
+#define EXT4_MOUNT_XATTR_USER           0x04000 /* Extended user attributes */
+#define EXT4_MOUNT_POSIX_ACL            0x08000 /* POSIX Access Control Lists */
+#define EXT4_MOUNT_RESERVATION          0x10000 /* Preallocation */
+#define EXT4_MOUNT_BARRIER              0x20000 /* Use block barriers */
+#define EXT4_MOUNT_NOBH                 0x40000 /* No bufferheads */
+#define EXT4_MOUNT_QUOTA                0x80000 /* Some quota option set */
+#define EXT4_MOUNT_USRQUOTA             0x100000 /* "old" user quota */
+#define EXT4_MOUNT_GRPQUOTA             0x200000 /* "old" group quota */
+#define EXT4_MOUNT_EXTENTS              0x400000 /* Extents support */
+
+/* Compatibility, for having both ext2_fs.h and ext4_fs.h included at once */
+#ifndef _LINUX_EXT2_FS_H
+#define clear_opt(o, opt)               o &= ~EXT4_MOUNT_##opt
+#define set_opt(o, opt)                 o |= EXT4_MOUNT_##opt
+#define test_opt(sb, opt)               (EXT4_SB(sb)->s_mount_opt & \
+                                         EXT4_MOUNT_##opt)
+#else
+#define EXT2_MOUNT_NOLOAD               EXT4_MOUNT_NOLOAD
+#define EXT2_MOUNT_ABORT                EXT4_MOUNT_ABORT
+#define EXT2_MOUNT_DATA_FLAGS           EXT4_MOUNT_DATA_FLAGS
+#endif
+
+#define ext4_set_bit                    ext2_set_bit
+#define ext4_set_bit_atomic             ext2_set_bit_atomic
+#define ext4_clear_bit                  ext2_clear_bit
+#define ext4_clear_bit_atomic           ext2_clear_bit_atomic
+#define ext4_test_bit                   ext2_test_bit
+#define ext4_find_first_zero_bit        ext2_find_first_zero_bit
+#define ext4_find_next_zero_bit         ext2_find_next_zero_bit
+
+/*
+ * Maximal mount counts between two filesystem checks
+ */
+#define EXT4_DFL_MAX_MNT_COUNT          20      /* Allow 20 mounts */
+#define EXT4_DFL_CHECKINTERVAL          0       /* Don't use interval check */
+
+/*
+ * Behaviour when detecting errors
+ */
+#define EXT4_ERRORS_CONTINUE            1       /* Continue execution */
+#define EXT4_ERRORS_RO                  2       /* Remount fs read-only */
+#define EXT4_ERRORS_PANIC               3       /* Panic */
+#define EXT4_ERRORS_DEFAULT             EXT4_ERRORS_CONTINUE
+
+/*
+ * Structure of the super block
+ */
+struct ext4_super_block {
+/*00*/  __le32  s_inodes_count;         /* Inodes count */
+        __le32  s_blocks_count;         /* Blocks count */
+        __le32  s_r_blocks_count;       /* Reserved blocks count */
+        __le32  s_free_blocks_count;    /* Free blocks count */
+/*10*/  __le32  s_free_inodes_count;    /* Free inodes count */
+        __le32  s_first_data_block;     /* First Data Block */
+        __le32  s_log_block_size;       /* Block size */
+        __le32  s_log_frag_size;        /* Fragment size */
+/*20*/  __le32  s_blocks_per_group;     /* # Blocks per group */
+        __le32  s_frags_per_group;      /* # Fragments per group */
+        __le32  s_inodes_per_group;     /* # Inodes per group */
+        __le32  s_mtime;                /* Mount time */
+/*30*/  __le32  s_wtime;                /* Write time */
+        __le16  s_mnt_count;            /* Mount count */
+        __le16  s_max_mnt_count;        /* Maximal mount count */
+        __le16  s_magic;                /* Magic signature */
+        __le16  s_state;                /* File system state */
+        __le16  s_errors;               /* Behaviour when detecting errors */
+        __le16  s_minor_rev_level;      /* minor revision level */
+/*40*/  __le32  s_lastcheck;            /* time of last check */
+        __le32  s_checkinterval;        /* max. time between checks */
+        __le32  s_creator_os;           /* OS */
+        __le32  s_rev_level;            /* Revision level */
+/*50*/  __le16  s_def_resuid;           /* Default uid for reserved blocks */
+        __le16  s_def_resgid;           /* Default gid for reserved blocks */
+        /*
+         * These fields are for EXT4_DYNAMIC_REV superblocks only.
+         *
+         * Note: the difference between the compatible feature set and
+         * the incompatible feature set is that if there is a bit set
+         * in the incompatible feature set that the kernel doesn't
+         * know about, it should refuse to mount the filesystem.
+         *
+         * e2fsck's requirements are more strict; if it doesn't know
+         * about a feature in either the compatible or incompatible
+         * feature set, it must abort and not try to meddle with
+         * things it doesn't understand...
+         */
+        __le32  s_first_ino;            /* First non-reserved inode */
+        __le16  s_inode_size;           /* size of inode structure */
+        __le16  s_block_group_nr;       /* block group # of this superblock */
+        __le32  s_feature_compat;       /* compatible feature set */
+/*60*/  __le32  s_feature_incompat;     /* incompatible feature set */
+        __le32  s_feature_ro_compat;    /* readonly-compatible feature set */
+/*68*/  __u8    s_uuid[16];             /* 128-bit uuid for volume */
+/*78*/  char    s_volume_name[16];      /* volume name */
+/*88*/  char    s_last_mounted[64];     /* directory where last mounted */
+/*C8*/  __le32  s_algorithm_usage_bitmap; /* For compression */
+        /*
+         * Performance hints.  Directory preallocation should only
+         * happen if the EXT4_FEATURE_COMPAT_DIR_PREALLOC flag is on.
+         */
+        __u8    s_prealloc_blocks;      /* Nr of blocks to try to preallocate*/
+        __u8    s_prealloc_dir_blocks;  /* Nr to preallocate for dirs */
+        __le16  s_reserved_gdt_blocks;  /* Per group desc for online growth */
+        /*
+         * Journaling support valid if EXT4_FEATURE_COMPAT_HAS_JOURNAL set.
+         */
+/*D0*/  __u8    s_journal_uuid[16];     /* uuid of journal superblock */
+/*E0*/  __le32  s_journal_inum;         /* inode number of journal file */
+        __le32  s_journal_dev;          /* device number of journal file */
+        __le32  s_last_orphan;          /* start of list of inodes to delete */
+        __le32  s_hash_seed[4];         /* HTREE hash seed */
+        __u8    s_def_hash_version;     /* Default hash version to use */
+        __u8    s_reserved_char_pad;
+        __le16  s_desc_size;            /* size of group descriptor */
+/*100*/ __le32  s_default_mount_opts;
+        __le32  s_first_meta_bg;        /* First metablock block group */
+        __le32  s_mkfs_time;            /* When the filesystem was created */
+        __le32  s_jnl_blocks[17];       /* Backup of the journal inode */
+        /* 64bit support valid if EXT4_FEATURE_COMPAT_64BIT */
+/*150*/ __le32  s_blocks_count_hi;      /* Blocks count */
+        __le32  s_r_blocks_count_hi;    /* Reserved blocks count */
+        __le32  s_free_blocks_count_hi; /* Free blocks count */
+        __u32   s_reserved[169];        /* Padding to the end of the block */
+};
+
+#ifdef __KERNEL__
+static inline struct ext4_sb_info * EXT4_SB(struct super_block *sb)
+{
+        return sb->s_fs_info;
+}
+static inline struct ext4_inode_info *EXT4_I(struct inode *inode)
+{
+        return container_of(inode, struct ext4_inode_info, vfs_inode);
+}
+
+static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino)
+{
+        return ino == EXT4_ROOT_INO ||
+                ino == EXT4_JOURNAL_INO ||
+                ino == EXT4_RESIZE_INO ||
+                (ino >= EXT4_FIRST_INO(sb) &&
+                 ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count));
+}
+#else
+/* Assume that user mode programs are passing in an ext4fs superblock, not
+ * a kernel struct super_block.  This will allow us to call the feature-test
+ * macros from user land. */
+#define EXT4_SB(sb)     (sb)
+#endif
+
+#define NEXT_ORPHAN(inode) EXT4_I(inode)->i_dtime
+
+/*
+ * Codes for operating systems
+ */
+#define EXT4_OS_LINUX           0
+#define EXT4_OS_HURD            1
+#define EXT4_OS_MASIX           2
+#define EXT4_OS_FREEBSD         3
+#define EXT4_OS_LITES           4
+
+/*
+ * Revision levels
+ */
+#define EXT4_GOOD_OLD_REV       0       /* The good old (original) format */
+#define EXT4_DYNAMIC_REV        1       /* V2 format w/ dynamic inode sizes */
+
+#define EXT4_CURRENT_REV        EXT4_GOOD_OLD_REV
+#define EXT4_MAX_SUPP_REV       EXT4_DYNAMIC_REV
+
+#define EXT4_GOOD_OLD_INODE_SIZE 128
+
+/*
+ * Feature set definitions
+ */
+
+#define EXT4_HAS_COMPAT_FEATURE(sb,mask)                        \
+        ( EXT4_SB(sb)->s_es->s_feature_compat & cpu_to_le32(mask) )
+#define EXT4_HAS_RO_COMPAT_FEATURE(sb,mask)                     \
+        ( EXT4_SB(sb)->s_es->s_feature_ro_compat & cpu_to_le32(mask) )
+#define EXT4_HAS_INCOMPAT_FEATURE(sb,mask)                      \
+        ( EXT4_SB(sb)->s_es->s_feature_incompat & cpu_to_le32(mask) )
+#define EXT4_SET_COMPAT_FEATURE(sb,mask)                        \
+        EXT4_SB(sb)->s_es->s_feature_compat |= cpu_to_le32(mask)
+#define EXT4_SET_RO_COMPAT_FEATURE(sb,mask)                     \
+        EXT4_SB(sb)->s_es->s_feature_ro_compat |= cpu_to_le32(mask)
+#define EXT4_SET_INCOMPAT_FEATURE(sb,mask)                      \
+        EXT4_SB(sb)->s_es->s_feature_incompat |= cpu_to_le32(mask)
+#define EXT4_CLEAR_COMPAT_FEATURE(sb,mask)                      \
+        EXT4_SB(sb)->s_es->s_feature_compat &= ~cpu_to_le32(mask)
+#define EXT4_CLEAR_RO_COMPAT_FEATURE(sb,mask)                   \
+        EXT4_SB(sb)->s_es->s_feature_ro_compat &= ~cpu_to_le32(mask)
+#define EXT4_CLEAR_INCOMPAT_FEATURE(sb,mask)                    \
+        EXT4_SB(sb)->s_es->s_feature_incompat &= ~cpu_to_le32(mask)
+
+#define EXT4_FEATURE_COMPAT_DIR_PREALLOC        0x0001
+#define EXT4_FEATURE_COMPAT_IMAGIC_INODES       0x0002
+#define EXT4_FEATURE_COMPAT_HAS_JOURNAL         0x0004
+#define EXT4_FEATURE_COMPAT_EXT_ATTR            0x0008
+#define EXT4_FEATURE_COMPAT_RESIZE_INODE        0x0010
+#define EXT4_FEATURE_COMPAT_DIR_INDEX           0x0020
+
+#define EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER     0x0001
+#define EXT4_FEATURE_RO_COMPAT_LARGE_FILE       0x0002
+#define EXT4_FEATURE_RO_COMPAT_BTREE_DIR        0x0004
+
+#define EXT4_FEATURE_INCOMPAT_COMPRESSION       0x0001
+#define EXT4_FEATURE_INCOMPAT_FILETYPE          0x0002
+#define EXT4_FEATURE_INCOMPAT_RECOVER           0x0004 /* Needs recovery */
+#define EXT4_FEATURE_INCOMPAT_JOURNAL_DEV       0x0008 /* Journal device */
+#define EXT4_FEATURE_INCOMPAT_META_BG           0x0010
+#define EXT4_FEATURE_INCOMPAT_EXTENTS           0x0040 /* extents support */
+#define EXT4_FEATURE_INCOMPAT_64BIT             0x0080
+
+#define EXT4_FEATURE_COMPAT_SUPP        EXT2_FEATURE_COMPAT_EXT_ATTR
+#define EXT4_FEATURE_INCOMPAT_SUPP      (EXT4_FEATURE_INCOMPAT_FILETYPE| \
+                                         EXT4_FEATURE_INCOMPAT_RECOVER| \
+                                         EXT4_FEATURE_INCOMPAT_META_BG| \
+                                         EXT4_FEATURE_INCOMPAT_EXTENTS| \
+                                         EXT4_FEATURE_INCOMPAT_64BIT)
+#define EXT4_FEATURE_RO_COMPAT_SUPP     (EXT4_FEATURE_RO_COMPAT_SPARSE_SUPER| \
+                                         EXT4_FEATURE_RO_COMPAT_LARGE_FILE| \
+                                         EXT4_FEATURE_RO_COMPAT_BTREE_DIR)
+
+/*
+ * Default values for user and/or group using reserved blocks
+ */
+#define EXT4_DEF_RESUID         0
+#define EXT4_DEF_RESGID         0
+
+/*
+ * Default mount options
+ */
+#define EXT4_DEFM_DEBUG         0x0001
+#define EXT4_DEFM_BSDGROUPS     0x0002
+#define EXT4_DEFM_XATTR_USER    0x0004
+#define EXT4_DEFM_ACL           0x0008
+#define EXT4_DEFM_UID16         0x0010
+#define EXT4_DEFM_JMODE         0x0060
+#define EXT4_DEFM_JMODE_DATA    0x0020
+#define EXT4_DEFM_JMODE_ORDERED 0x0040
+#define EXT4_DEFM_JMODE_WBACK   0x0060
+
+/*
+ * Structure of a directory entry
+ */
+#define EXT4_NAME_LEN 255
+
+struct ext4_dir_entry {
+        __le32  inode;                  /* Inode number */
+        __le16  rec_len;                /* Directory entry length */
+        __le16  name_len;               /* Name length */
+        char    name[EXT4_NAME_LEN];    /* File name */
+};
+
+/*
+ * The new version of the directory entry.  Since EXT4 structures are
+ * stored in intel byte order, and the name_len field could never be
+ * bigger than 255 chars, it's safe to reclaim the extra byte for the
+ * file_type field.
+ */
+struct ext4_dir_entry_2 {
+        __le32  inode;                  /* Inode number */
+        __le16  rec_len;                /* Directory entry length */
+        __u8    name_len;               /* Name length */
+        __u8    file_type;
+        char    name[EXT4_NAME_LEN];    /* File name */
+};
+
+/*
+ * Ext4 directory file types.  Only the low 3 bits are used.  The
+ * other bits are reserved for now.
+ */
+#define EXT4_FT_UNKNOWN         0
+#define EXT4_FT_REG_FILE        1
+#define EXT4_FT_DIR             2
+#define EXT4_FT_CHRDEV          3
+#define EXT4_FT_BLKDEV          4
+#define EXT4_FT_FIFO            5
+#define EXT4_FT_SOCK            6
+#define EXT4_FT_SYMLINK         7
+
+#define EXT4_FT_MAX             8
+
+/*
+ * EXT4_DIR_PAD defines the directory entries boundaries
+ *
+ * NOTE: It must be a multiple of 4
+ */
+#define EXT4_DIR_PAD                    4
+#define EXT4_DIR_ROUND                  (EXT4_DIR_PAD - 1)
+#define EXT4_DIR_REC_LEN(name_len)      (((name_len) + 8 + EXT4_DIR_ROUND) & \
+                                         ~EXT4_DIR_ROUND)
+/*
+ * Hash Tree Directory indexing
+ * (c) Daniel Phillips, 2001
+ */
+
+#ifdef CONFIG_EXT4_INDEX
+  #define is_dx(dir) (EXT4_HAS_COMPAT_FEATURE(dir->i_sb, \
+                                              EXT4_FEATURE_COMPAT_DIR_INDEX) && \
+                      (EXT4_I(dir)->i_flags & EXT4_INDEX_FL))
+#define EXT4_DIR_LINK_MAX(dir) (!is_dx(dir) && (dir)->i_nlink >= EXT4_LINK_MAX)
+#define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2 || (dir)->i_nlink == 1)
+#else
+  #define is_dx(dir) 0
+#define EXT4_DIR_LINK_MAX(dir) ((dir)->i_nlink >= EXT4_LINK_MAX)
+#define EXT4_DIR_LINK_EMPTY(dir) ((dir)->i_nlink == 2)
+#endif
+
+/* Legal values for the dx_root hash_version field: */
+
+#define DX_HASH_LEGACY          0
+#define DX_HASH_HALF_MD4        1
+#define DX_HASH_TEA             2
+
+#ifdef __KERNEL__
+
+/* hash info structure used by the directory hash */
+struct dx_hash_info
+{
+        u32             hash;
+        u32             minor_hash;
+        int             hash_version;
+        u32             *seed;
+};
+
+#define EXT4_HTREE_EOF  0x7fffffff
+
+/*
+ * Control parameters used by ext4_htree_next_block
+ */
+#define HASH_NB_ALWAYS          1
+
+
+/*
+ * Describe an inode's exact location on disk and in memory
+ */
+struct ext4_iloc
+{
+        struct buffer_head *bh;
+        unsigned long offset;
+        unsigned long block_group;
+};
+
+static inline struct ext4_inode *ext4_raw_inode(struct ext4_iloc *iloc)
+{
+        return (struct ext4_inode *) (iloc->bh->b_data + iloc->offset);
+}
+
+/*
+ * This structure is stuffed into the struct file's private_data field
+ * for directories.  It is where we put information so that we can do
+ * readdir operations in hash tree order.
+ */
+struct dir_private_info {
+        struct rb_root  root;
+        struct rb_node  *curr_node;
+        struct fname    *extra_fname;
+        loff_t          last_pos;
+        __u32           curr_hash;
+        __u32           curr_minor_hash;
+        __u32           next_hash;
+};
+
+/* calculate the first block number of the group */
+static inline ext4_fsblk_t
+ext4_group_first_block_no(struct super_block *sb, unsigned long group_no)
+{
+        return group_no * (ext4_fsblk_t)EXT4_BLOCKS_PER_GROUP(sb) +
+                le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block);
+}
+
+/*
+ * Special error return code only used by dx_probe() and its callers.
+ */
+#define ERR_BAD_DX_DIR  -75000
+
+void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
+                        unsigned long *blockgrpp, ext4_grpblk_t *offsetp);
+
+/*
+ * Function prototypes
+ */
+
+/*
+ * Ok, these declarations are also in <linux/kernel.h> but none of the
+ * ext4 source programs needs to include it so they are duplicated here.
+ */
+# define NORET_TYPE    /**/
+# define ATTRIB_NORET  __attribute__((noreturn))
+# define NORET_AND     noreturn,
+
+/* balloc.c */
+extern unsigned int ext4_block_group(struct super_block *sb,
+                        ext4_fsblk_t blocknr);
+extern ext4_grpblk_t ext4_block_group_offset(struct super_block *sb,
+                        ext4_fsblk_t blocknr);
+extern int ext4_bg_has_super(struct super_block *sb, int group);
+extern unsigned long ext4_bg_num_gdb(struct super_block *sb, int group);
+extern ext4_fsblk_t ext4_new_block (handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t goal, int *errp);
+extern ext4_fsblk_t ext4_new_blocks (handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t goal, unsigned long *count, int *errp);
+extern void ext4_free_blocks (handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t block, unsigned long count);
+extern void ext4_free_blocks_sb (handle_t *handle, struct super_block *sb,
+                                 ext4_fsblk_t block, unsigned long count,
+                                unsigned long *pdquot_freed_blocks);
+extern ext4_fsblk_t ext4_count_free_blocks (struct super_block *);
+extern void ext4_check_blocks_bitmap (struct super_block *);
+extern struct ext4_group_desc * ext4_get_group_desc(struct super_block * sb,
+                                                    unsigned int block_group,
+                                                    struct buffer_head ** bh);
+extern int ext4_should_retry_alloc(struct super_block *sb, int *retries);
+extern void ext4_init_block_alloc_info(struct inode *);
+extern void ext4_rsv_window_add(struct super_block *sb, struct ext4_reserve_window_node *rsv);
+
+/* dir.c */
+extern int ext4_check_dir_entry(const char *, struct inode *,
+                                struct ext4_dir_entry_2 *,
+                                struct buffer_head *, unsigned long);
+extern int ext4_htree_store_dirent(struct file *dir_file, __u32 hash,
+                                    __u32 minor_hash,
+                                    struct ext4_dir_entry_2 *dirent);
+extern void ext4_htree_free_dir_info(struct dir_private_info *p);
+
+/* fsync.c */
+extern int ext4_sync_file (struct file *, struct dentry *, int);
+
+/* hash.c */
+extern int ext4fs_dirhash(const char *name, int len, struct
+                          dx_hash_info *hinfo);
+
+/* ialloc.c */
+extern struct inode * ext4_new_inode (handle_t *, struct inode *, int);
+extern void ext4_free_inode (handle_t *, struct inode *);
+extern struct inode * ext4_orphan_get (struct super_block *, unsigned long);
+extern unsigned long ext4_count_free_inodes (struct super_block *);
+extern unsigned long ext4_count_dirs (struct super_block *);
+extern void ext4_check_inodes_bitmap (struct super_block *);
+extern unsigned long ext4_count_free (struct buffer_head *, unsigned);
+
+
+/* inode.c */
+int ext4_forget(handle_t *handle, int is_metadata, struct inode *inode,
+                struct buffer_head *bh, ext4_fsblk_t blocknr);
+struct buffer_head * ext4_getblk (handle_t *, struct inode *, long, int, int *);
+struct buffer_head * ext4_bread (handle_t *, struct inode *, int, int, int *);
+int ext4_get_blocks_handle(handle_t *handle, struct inode *inode,
+        sector_t iblock, unsigned long maxblocks, struct buffer_head *bh_result,
+        int create, int extend_disksize);
+
+extern void ext4_read_inode (struct inode *);
+extern int  ext4_write_inode (struct inode *, int);
+extern int  ext4_setattr (struct dentry *, struct iattr *);
+extern void ext4_delete_inode (struct inode *);
+extern int  ext4_sync_inode (handle_t *, struct inode *);
+extern void ext4_discard_reservation (struct inode *);
+extern void ext4_dirty_inode(struct inode *);
+extern int ext4_change_inode_journal_flag(struct inode *, int);
+extern int ext4_get_inode_loc(struct inode *, struct ext4_iloc *);
+extern void ext4_truncate (struct inode *);
+extern void ext4_set_inode_flags(struct inode *);
+extern void ext4_set_aops(struct inode *inode);
+extern int ext4_writepage_trans_blocks(struct inode *);
+extern int ext4_block_truncate_page(handle_t *handle, struct page *page,
+                struct address_space *mapping, loff_t from);
+
+/* ioctl.c */
+extern int ext4_ioctl (struct inode *, struct file *, unsigned int,
+                       unsigned long);
+extern long ext4_compat_ioctl (struct file *, unsigned int, unsigned long);
+
+/* namei.c */
+extern int ext4_orphan_add(handle_t *, struct inode *);
+extern int ext4_orphan_del(handle_t *, struct inode *);
+extern int ext4_htree_fill_tree(struct file *dir_file, __u32 start_hash,
+                                __u32 start_minor_hash, __u32 *next_hash);
+
+/* resize.c */
+extern int ext4_group_add(struct super_block *sb,
+                                struct ext4_new_group_data *input);
+extern int ext4_group_extend(struct super_block *sb,
+                                struct ext4_super_block *es,
+                                ext4_fsblk_t n_blocks_count);
+
+/* super.c */
+extern void ext4_error (struct super_block *, const char *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+extern void __ext4_std_error (struct super_block *, const char *, int);
+extern void ext4_abort (struct super_block *, const char *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+extern void ext4_warning (struct super_block *, const char *, const char *, ...)
+        __attribute__ ((format (printf, 3, 4)));
+extern void ext4_update_dynamic_rev (struct super_block *sb);
+extern ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
+                                      struct ext4_group_desc *bg);
+extern ext4_fsblk_t ext4_inode_bitmap(struct super_block *sb,
+                                      struct ext4_group_desc *bg);
+extern ext4_fsblk_t ext4_inode_table(struct super_block *sb,
+                                     struct ext4_group_desc *bg);
+extern void ext4_block_bitmap_set(struct super_block *sb,
+                                  struct ext4_group_desc *bg, ext4_fsblk_t blk);
+extern void ext4_inode_bitmap_set(struct super_block *sb,
+                                  struct ext4_group_desc *bg, ext4_fsblk_t blk);
+extern void ext4_inode_table_set(struct super_block *sb,
+                                 struct ext4_group_desc *bg, ext4_fsblk_t blk);
+
+static inline ext4_fsblk_t ext4_blocks_count(struct ext4_super_block *es)
+{
+        return ((ext4_fsblk_t)le32_to_cpu(es->s_blocks_count_hi) << 32) |
+                le32_to_cpu(es->s_blocks_count);
+}
+
+static inline ext4_fsblk_t ext4_r_blocks_count(struct ext4_super_block *es)
+{
+        return ((ext4_fsblk_t)le32_to_cpu(es->s_r_blocks_count_hi) << 32) |
+                le32_to_cpu(es->s_r_blocks_count);
+}
+
+static inline ext4_fsblk_t ext4_free_blocks_count(struct ext4_super_block *es)
+{
+        return ((ext4_fsblk_t)le32_to_cpu(es->s_free_blocks_count_hi) << 32) |
+                le32_to_cpu(es->s_free_blocks_count);
+}
+
+static inline void ext4_blocks_count_set(struct ext4_super_block *es,
+                                         ext4_fsblk_t blk)
+{
+        es->s_blocks_count = cpu_to_le32((u32)blk);
+        es->s_blocks_count_hi = cpu_to_le32(blk >> 32);
+}
+
+static inline void ext4_free_blocks_count_set(struct ext4_super_block *es,
+                                              ext4_fsblk_t blk)
+{
+        es->s_free_blocks_count = cpu_to_le32((u32)blk);
+        es->s_free_blocks_count_hi = cpu_to_le32(blk >> 32);
+}
+
+static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
+                                           ext4_fsblk_t blk)
+{
+        es->s_r_blocks_count = cpu_to_le32((u32)blk);
+        es->s_r_blocks_count_hi = cpu_to_le32(blk >> 32);
+}
+
+
+
+#define ext4_std_error(sb, errno)                               \
+do {                                                            \
+        if ((errno))                                            \
+                __ext4_std_error((sb), __FUNCTION__, (errno));  \
+} while (0)
+
+/*
+ * Inodes and files operations
+ */
+
+/* dir.c */
+extern const struct file_operations ext4_dir_operations;
+
+/* file.c */
+extern struct inode_operations ext4_file_inode_operations;
+extern const struct file_operations ext4_file_operations;
+
+/* namei.c */
+extern struct inode_operations ext4_dir_inode_operations;
+extern struct inode_operations ext4_special_inode_operations;
+
+/* symlink.c */
+extern struct inode_operations ext4_symlink_inode_operations;
+extern struct inode_operations ext4_fast_symlink_inode_operations;
+
+/* extents.c */
+extern int ext4_ext_tree_init(handle_t *handle, struct inode *);
+extern int ext4_ext_writepage_trans_blocks(struct inode *, int);
+extern int ext4_ext_get_blocks(handle_t *handle, struct inode *inode,
+                        ext4_fsblk_t iblock,
+                        unsigned long max_blocks, struct buffer_head *bh_result,
+                        int create, int extend_disksize);
+extern void ext4_ext_truncate(struct inode *, struct page *);
+extern void ext4_ext_init(struct super_block *);
+extern void ext4_ext_release(struct super_block *);
+static inline int
+ext4_get_blocks_wrap(handle_t *handle, struct inode *inode, sector_t block,
+                        unsigned long max_blocks, struct buffer_head *bh,
+                        int create, int extend_disksize)
+{
+        if (EXT4_I(inode)->i_flags & EXT4_EXTENTS_FL)
+                return ext4_ext_get_blocks(handle, inode, block, max_blocks,
+                                        bh, create, extend_disksize);
+        return ext4_get_blocks_handle(handle, inode, block, max_blocks, bh,
+                                        create, extend_disksize);
+}
+
+
+#endif  /* __KERNEL__ */
+
+#endif  /* _LINUX_EXT4_FS_H */
diff --git a/include/linux/ext4_fs_extents.h b/include/linux/ext4_fs_extents.h
new file mode 100644
index 000000000000..a41cc24568ca
--- /dev/null
+++ b/include/linux/ext4_fs_extents.h
@@ -0,0 +1,198 @@
+/*
+ * Copyright (c) 2003-2006, Cluster File Systems, Inc, info@clusterfs.com
+ * Written by Alex Tomas <alex@clusterfs.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public Licens
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-
+ */
+
+#ifndef _LINUX_EXT4_EXTENTS
+#define _LINUX_EXT4_EXTENTS
+
+#include <linux/ext4_fs.h>
+
+/*
+ * With AGRESSIVE_TEST defined, the capacity of index/leaf blocks
+ * becomes very small, so index split, in-depth growing and
+ * other hard changes happen much more often.
+ * This is for debug purposes only.
+ */
+#define AGRESSIVE_TEST_
+
+/*
+ * With EXTENTS_STATS defined, the number of blocks and extents
+ * are collected in the truncate path. They'll be shown at
+ * umount time.
+ */
+#define EXTENTS_STATS__
+
+/*
+ * If CHECK_BINSEARCH is defined, then the results of the binary search
+ * will also be checked by linear search.
+ */
+#define CHECK_BINSEARCH__
+
+/*
+ * If EXT_DEBUG is defined you can use the 'extdebug' mount option
+ * to get lots of info about what's going on.
+ */
+#define EXT_DEBUG__
+#ifdef EXT_DEBUG
+#define ext_debug(a...)         printk(a)
+#else
+#define ext_debug(a...)
+#endif
+
+/*
+ * If EXT_STATS is defined then stats numbers are collected.
+ * These number will be displayed at umount time.
+ */
+#define EXT_STATS_
+
+
+/*
+ * ext4_inode has i_block array (60 bytes total).
+ * The first 12 bytes store ext4_extent_header;
+ * the remainder stores an array of ext4_extent.
+ */
+
+/*
+ * This is the extent on-disk structure.
+ * It's used at the bottom of the tree.
+ */
+struct ext4_extent {
+        __le32  ee_block;       /* first logical block extent covers */
+        __le16  ee_len;         /* number of blocks covered by extent */
+        __le16  ee_start_hi;    /* high 16 bits of physical block */
+        __le32  ee_start;       /* low 32 bits of physical block */
+};
+
+/*
+ * This is index on-disk structure.
+ * It's used at all the levels except the bottom.
+ */
+struct ext4_extent_idx {
+        __le32  ei_block;       /* index covers logical blocks from 'block' */
+        __le32  ei_leaf;        /* pointer to the physical block of the next *
+                                 * level. leaf or next index could be there */
+        __le16  ei_leaf_hi;     /* high 16 bits of physical block */
+        __u16   ei_unused;
+};
+
+/*
+ * Each block (leaves and indexes), even inode-stored has header.
+ */
+struct ext4_extent_header {
+        __le16  eh_magic;       /* probably will support different formats */
+        __le16  eh_entries;     /* number of valid entries */
+        __le16  eh_max;         /* capacity of store in entries */
+        __le16  eh_depth;       /* has tree real underlying blocks? */
+        __le32  eh_generation;  /* generation of the tree */
+};
+
+#define EXT4_EXT_MAGIC          cpu_to_le16(0xf30a)
+
+/*
+ * Array of ext4_ext_path contains path to some extent.
+ * Creation/lookup routines use it for traversal/splitting/etc.
+ * Truncate uses it to simulate recursive walking.
+ */
+struct ext4_ext_path {
+        ext4_fsblk_t                    p_block;
+        __u16                           p_depth;
+        struct ext4_extent              *p_ext;
+        struct ext4_extent_idx          *p_idx;
+        struct ext4_extent_header       *p_hdr;
+        struct buffer_head              *p_bh;
+};
+
+/*
+ * structure for external API
+ */
+
+#define EXT4_EXT_CACHE_NO       0
+#define EXT4_EXT_CACHE_GAP      1
+#define EXT4_EXT_CACHE_EXTENT   2
+
+/*
+ * to be called by ext4_ext_walk_space()
+ * negative retcode - error
+ * positive retcode - signal for ext4_ext_walk_space(), see below
+ * callback must return valid extent (passed or newly created)
+ */
+typedef int (*ext_prepare_callback)(struct inode *, struct ext4_ext_path *,
+                                        struct ext4_ext_cache *,
+                                        void *);
+
+#define EXT_CONTINUE    0
+#define EXT_BREAK       1
+#define EXT_REPEAT      2
+
+
+#define EXT_MAX_BLOCK   0xffffffff
+
+#define EXT_MAX_LEN     ((1UL << 15) - 1)
+
+
+#define EXT_FIRST_EXTENT(__hdr__) \
+        ((struct ext4_extent *) (((char *) (__hdr__)) +         \
+                                 sizeof(struct ext4_extent_header)))
+#define EXT_FIRST_INDEX(__hdr__) \
+        ((struct ext4_extent_idx *) (((char *) (__hdr__)) +     \
+                                     sizeof(struct ext4_extent_header)))
+#define EXT_HAS_FREE_INDEX(__path__) \
+        (le16_to_cpu((__path__)->p_hdr->eh_entries) \
+                                     < le16_to_cpu((__path__)->p_hdr->eh_max))
+#define EXT_LAST_EXTENT(__hdr__) \
+        (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
+#define EXT_LAST_INDEX(__hdr__) \
+        (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_entries) - 1)
+#define EXT_MAX_EXTENT(__hdr__) \
+        (EXT_FIRST_EXTENT((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
+#define EXT_MAX_INDEX(__hdr__) \
+        (EXT_FIRST_INDEX((__hdr__)) + le16_to_cpu((__hdr__)->eh_max) - 1)
+
+static inline struct ext4_extent_header *ext_inode_hdr(struct inode *inode)
+{
+        return (struct ext4_extent_header *) EXT4_I(inode)->i_data;
+}
+
+static inline struct ext4_extent_header *ext_block_hdr(struct buffer_head *bh)
+{
+        return (struct ext4_extent_header *) bh->b_data;
+}
+
+static inline unsigned short ext_depth(struct inode *inode)
+{
+        return le16_to_cpu(ext_inode_hdr(inode)->eh_depth);
+}
+
+static inline void ext4_ext_tree_changed(struct inode *inode)
+{
+        EXT4_I(inode)->i_ext_generation++;
+}
+
+static inline void
+ext4_ext_invalidate_cache(struct inode *inode)
+{
+        EXT4_I(inode)->i_cached_extent.ec_type = EXT4_EXT_CACHE_NO;
+}
+
+extern int ext4_extent_tree_init(handle_t *, struct inode *);
+extern int ext4_ext_calc_credits_for_insert(struct inode *, struct ext4_ext_path *);
+extern int ext4_ext_insert_extent(handle_t *, struct inode *, struct ext4_ext_path *, struct ext4_extent *);
+extern int ext4_ext_walk_space(struct inode *, unsigned long, unsigned long, ext_prepare_callback, void *);
+extern struct ext4_ext_path * ext4_ext_find_extent(struct inode *, int, struct ext4_ext_path *);
+
+#endif /* _LINUX_EXT4_EXTENTS */
+
diff --git a/include/linux/ext4_fs_i.h b/include/linux/ext4_fs_i.h
new file mode 100644
index 000000000000..bb42379cb7fd
--- /dev/null
+++ b/include/linux/ext4_fs_i.h
@@ -0,0 +1,158 @@
+/*
+ *  linux/include/linux/ext4_fs_i.h
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/include/linux/minix_fs_i.h
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+#ifndef _LINUX_EXT4_FS_I
+#define _LINUX_EXT4_FS_I
+
+#include <linux/rwsem.h>
+#include <linux/rbtree.h>
+#include <linux/seqlock.h>
+#include <linux/mutex.h>
+
+/* data type for block offset of block group */
+typedef int ext4_grpblk_t;
+
+/* data type for filesystem-wide blocks number */
+typedef unsigned long long ext4_fsblk_t;
+
+struct ext4_reserve_window {
+        ext4_fsblk_t    _rsv_start;     /* First byte reserved */
+        ext4_fsblk_t    _rsv_end;       /* Last byte reserved or 0 */
+};
+
+struct ext4_reserve_window_node {
+        struct rb_node          rsv_node;
+        __u32                   rsv_goal_size;
+        __u32                   rsv_alloc_hit;
+        struct ext4_reserve_window      rsv_window;
+};
+
+struct ext4_block_alloc_info {
+        /* information about reservation window */
+        struct ext4_reserve_window_node rsv_window_node;
+        /*
+         * was i_next_alloc_block in ext4_inode_info
+         * is the logical (file-relative) number of the
+         * most-recently-allocated block in this file.
+         * We use this for detecting linearly ascending allocation requests.
+         */
+        __u32                   last_alloc_logical_block;
+        /*
+         * Was i_next_alloc_goal in ext4_inode_info
+         * is the *physical* companion to i_next_alloc_block.
+         * it the the physical block number of the block which was most-recentl
+         * allocated to this file.  This give us the goal (target) for the next
+         * allocation when we detect linearly ascending requests.
+         */
+        ext4_fsblk_t            last_alloc_physical_block;
+};
+
+#define rsv_start rsv_window._rsv_start
+#define rsv_end rsv_window._rsv_end
+
+/*
+ * storage for cached extent
+ */
+struct ext4_ext_cache {
+        ext4_fsblk_t    ec_start;
+        __u32           ec_block;
+        __u32           ec_len; /* must be 32bit to return holes */
+        __u32           ec_type;
+};
+
+/*
+ * third extended file system inode data in memory
+ */
+struct ext4_inode_info {
+        __le32  i_data[15];     /* unconverted */
+        __u32   i_flags;
+#ifdef EXT4_FRAGMENTS
+        __u32   i_faddr;
+        __u8    i_frag_no;
+        __u8    i_frag_size;
+#endif
+        ext4_fsblk_t    i_file_acl;
+        __u32   i_dir_acl;
+        __u32   i_dtime;
+
+        /*
+         * i_block_group is the number of the block group which contains
+         * this file's inode.  Constant across the lifetime of the inode,
+         * it is ued for making block allocation decisions - we try to
+         * place a file's data blocks near its inode block, and new inodes
+         * near to their parent directory's inode.
+         */
+        __u32   i_block_group;
+        __u32   i_state;                /* Dynamic state flags for ext4 */
+
+        /* block reservation info */
+        struct ext4_block_alloc_info *i_block_alloc_info;
+
+        __u32   i_dir_start_lookup;
+#ifdef CONFIG_EXT4DEV_FS_XATTR
+        /*
+         * Extended attributes can be read independently of the main file
+         * data. Taking i_mutex even when reading would cause contention
+         * between readers of EAs and writers of regular file data, so
+         * instead we synchronize on xattr_sem when reading or changing
+         * EAs.
+         */
+        struct rw_semaphore xattr_sem;
+#endif
+#ifdef CONFIG_EXT4DEV_FS_POSIX_ACL
+        struct posix_acl        *i_acl;
+        struct posix_acl        *i_default_acl;
+#endif
+
+        struct list_head i_orphan;      /* unlinked but open inodes */
+
+        /*
+         * i_disksize keeps track of what the inode size is ON DISK, not
+         * in memory.  During truncate, i_size is set to the new size by
+         * the VFS prior to calling ext4_truncate(), but the filesystem won't
+         * set i_disksize to 0 until the truncate is actually under way.
+         *
+         * The intent is that i_disksize always represents the blocks which
+         * are used by this file.  This allows recovery to restart truncate
+         * on orphans if we crash during truncate.  We actually write i_disksize
+         * into the on-disk inode when writing inodes out, instead of i_size.
+         *
+         * The only time when i_disksize and i_size may be different is when
+         * a truncate is in progress.  The only things which change i_disksize
+         * are ext4_get_block (growth) and ext4_truncate (shrinkth).
+         */
+        loff_t  i_disksize;
+
+        /* on-disk additional length */
+        __u16 i_extra_isize;
+
+        /*
+         * truncate_mutex is for serialising ext4_truncate() against
+         * ext4_getblock().  In the 2.4 ext2 design, great chunks of inode's
+         * data tree are chopped off during truncate. We can't do that in
+         * ext4 because whenever we perform intermediate commits during
+         * truncate, the inode and all the metadata blocks *must* be in a
+         * consistent state which allows truncation of the orphans to restart
+         * during recovery.  Hence we must fix the get_block-vs-truncate race
+         * by other means, so we have truncate_mutex.
+         */
+        struct mutex truncate_mutex;
+        struct inode vfs_inode;
+
+        unsigned long i_ext_generation;
+        struct ext4_ext_cache i_cached_extent;
+};
+
+#endif  /* _LINUX_EXT4_FS_I */
diff --git a/include/linux/ext4_fs_sb.h b/include/linux/ext4_fs_sb.h
new file mode 100644
index 000000000000..691a713139ce
--- /dev/null
+++ b/include/linux/ext4_fs_sb.h
@@ -0,0 +1,94 @@
+/*
+ *  linux/include/linux/ext4_fs_sb.h
+ *
+ * Copyright (C) 1992, 1993, 1994, 1995
+ * Remy Card (card@masi.ibp.fr)
+ * Laboratoire MASI - Institut Blaise Pascal
+ * Universite Pierre et Marie Curie (Paris VI)
+ *
+ *  from
+ *
+ *  linux/include/linux/minix_fs_sb.h
+ *
+ *  Copyright (C) 1991, 1992  Linus Torvalds
+ */
+
+#ifndef _LINUX_EXT4_FS_SB
+#define _LINUX_EXT4_FS_SB
+
+#ifdef __KERNEL__
+#include <linux/timer.h>
+#include <linux/wait.h>
+#include <linux/blockgroup_lock.h>
+#include <linux/percpu_counter.h>
+#endif
+#include <linux/rbtree.h>
+
+/*
+ * third extended-fs super-block data in memory
+ */
+struct ext4_sb_info {
+        unsigned long s_frag_size;      /* Size of a fragment in bytes */
+        unsigned long s_desc_size;      /* Size of a group descriptor in bytes */
+        unsigned long s_frags_per_block;/* Number of fragments per block */
+        unsigned long s_inodes_per_block;/* Number of inodes per block */
+        unsigned long s_frags_per_group;/* Number of fragments in a group */
+        unsigned long s_blocks_per_group;/* Number of blocks in a group */
+        unsigned long s_inodes_per_group;/* Number of inodes in a group */
+        unsigned long s_itb_per_group;  /* Number of inode table blocks per group */
+        unsigned long s_gdb_count;      /* Number of group descriptor blocks */
+        unsigned long s_desc_per_block; /* Number of group descriptors per block */
+        unsigned long s_groups_count;   /* Number of groups in the fs */
+        struct buffer_head * s_sbh;     /* Buffer containing the super block */
+        struct ext4_super_block * s_es; /* Pointer to the super block in the buffer */
+        struct buffer_head ** s_group_desc;
+        unsigned long  s_mount_opt;
+        uid_t s_resuid;
+        gid_t s_resgid;
+        unsigned short s_mount_state;
+        unsigned short s_pad;
+        int s_addr_per_block_bits;
+        int s_desc_per_block_bits;
+        int s_inode_size;
+        int s_first_ino;
+        spinlock_t s_next_gen_lock;
+        u32 s_next_generation;
+        u32 s_hash_seed[4];
+        int s_def_hash_version;
+        struct percpu_counter s_freeblocks_counter;
+        struct percpu_counter s_freeinodes_counter;
+        struct percpu_counter s_dirs_counter;
+        struct blockgroup_lock s_blockgroup_lock;
+
+        /* root of the per fs reservation window tree */
+        spinlock_t s_rsv_window_lock;
+        struct rb_root s_rsv_window_root;
+        struct ext4_reserve_window_node s_rsv_window_head;
+
+        /* Journaling */
+        struct inode * s_journal_inode;
+        struct journal_s * s_journal;
+        struct list_head s_orphan;
+        unsigned long s_commit_interval;
+        struct block_device *journal_bdev;
+#ifdef CONFIG_JBD_DEBUG
+        struct timer_list turn_ro_timer;        /* For turning read-only (crash simulation) */
+        wait_queue_head_t ro_wait_queue;        /* For people waiting for the fs to go read-only */
+#endif
+#ifdef CONFIG_QUOTA
+        char *s_qf_names[MAXQUOTAS];            /* Names of quota files with journalled quota */
+        int s_jquota_fmt;                       /* Format of quota to use */
+#endif
+
+#ifdef EXTENTS_STATS
+        /* ext4 extents stats */
+        unsigned long s_ext_min;
+        unsigned long s_ext_max;
+        unsigned long s_depth_max;
+        spinlock_t s_ext_stats_lock;
+        unsigned long s_ext_blocks;
+        unsigned long s_ext_extents;
+#endif
+};
+
+#endif  /* _LINUX_EXT4_FS_SB */
diff --git a/include/linux/ext4_jbd2.h b/include/linux/ext4_jbd2.h
new file mode 100644
index 000000000000..72dd631912e4
--- /dev/null
+++ b/include/linux/ext4_jbd2.h
@@ -0,0 +1,273 @@
+/*
+ * linux/include/linux/ext4_jbd2.h
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>, 1999
+ *
+ * Copyright 1998--1999 Red Hat corp --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Ext4-specific journaling extensions.
+ */
+
+#ifndef _LINUX_EXT4_JBD_H
+#define _LINUX_EXT4_JBD_H
+
+#include <linux/fs.h>
+#include <linux/jbd2.h>
+#include <linux/ext4_fs.h>
+
+#define EXT4_JOURNAL(inode)     (EXT4_SB((inode)->i_sb)->s_journal)
+
+/* Define the number of blocks we need to account to a transaction to
+ * modify one block of data.
+ *
+ * We may have to touch one inode, one bitmap buffer, up to three
+ * indirection blocks, the group and superblock summaries, and the data
+ * block to complete the transaction.
+ *
+ * For extents-enabled fs we may have to allocate and modify up to
+ * 5 levels of tree + root which are stored in the inode. */
+
+#define EXT4_SINGLEDATA_TRANS_BLOCKS(sb)                                \
+        (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS)   \
+                || test_opt(sb, EXTENTS) ? 27U : 8U)
+
+/* Extended attribute operations touch at most two data buffers,
+ * two bitmap buffers, and two group summaries, in addition to the inode
+ * and the superblock, which are already accounted for. */
+
+#define EXT4_XATTR_TRANS_BLOCKS         6U
+
+/* Define the minimum size for a transaction which modifies data.  This
+ * needs to take into account the fact that we may end up modifying two
+ * quota files too (one for the group, one for the user quota).  The
+ * superblock only gets updated once, of course, so don't bother
+ * counting that again for the quota updates. */
+
+#define EXT4_DATA_TRANS_BLOCKS(sb)      (EXT4_SINGLEDATA_TRANS_BLOCKS(sb) + \
+                                         EXT4_XATTR_TRANS_BLOCKS - 2 + \
+                                         2*EXT4_QUOTA_TRANS_BLOCKS(sb))
+
+/* Delete operations potentially hit one directory's namespace plus an
+ * entire inode, plus arbitrary amounts of bitmap/indirection data.  Be
+ * generous.  We can grow the delete transaction later if necessary. */
+
+#define EXT4_DELETE_TRANS_BLOCKS(sb)    (2 * EXT4_DATA_TRANS_BLOCKS(sb) + 64)
+
+/* Define an arbitrary limit for the amount of data we will anticipate
+ * writing to any given transaction.  For unbounded transactions such as
+ * write(2) and truncate(2) we can write more than this, but we always
+ * start off at the maximum transaction size and grow the transaction
+ * optimistically as we go. */
+
+#define EXT4_MAX_TRANS_DATA             64U
+
+/* We break up a large truncate or write transaction once the handle's
+ * buffer credits gets this low, we need either to extend the
+ * transaction or to start a new one.  Reserve enough space here for
+ * inode, bitmap, superblock, group and indirection updates for at least
+ * one block, plus two quota updates.  Quota allocations are not
+ * needed. */
+
+#define EXT4_RESERVE_TRANS_BLOCKS       12U
+
+#define EXT4_INDEX_EXTRA_TRANS_BLOCKS   8
+
+#ifdef CONFIG_QUOTA
+/* Amount of blocks needed for quota update - we know that the structure was
+ * allocated so we need to update only inode+data */
+#define EXT4_QUOTA_TRANS_BLOCKS(sb) (test_opt(sb, QUOTA) ? 2 : 0)
+/* Amount of blocks needed for quota insert/delete - we do some block writes
+ * but inode, sb and group updates are done only once */
+#define EXT4_QUOTA_INIT_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_INIT_ALLOC*\
+                (EXT4_SINGLEDATA_TRANS_BLOCKS(sb)-3)+3+DQUOT_INIT_REWRITE) : 0)
+#define EXT4_QUOTA_DEL_BLOCKS(sb) (test_opt(sb, QUOTA) ? (DQUOT_DEL_ALLOC*\
+                (EXT4_SINGLEDATA_TRANS_BLOCKS(sb)-3)+3+DQUOT_DEL_REWRITE) : 0)
+#else
+#define EXT4_QUOTA_TRANS_BLOCKS(sb) 0
+#define EXT4_QUOTA_INIT_BLOCKS(sb) 0
+#define EXT4_QUOTA_DEL_BLOCKS(sb) 0
+#endif
+
+int
+ext4_mark_iloc_dirty(handle_t *handle,
+                     struct inode *inode,
+                     struct ext4_iloc *iloc);
+
+/*
+ * On success, We end up with an outstanding reference count against
+ * iloc->bh.  This _must_ be cleaned up later.
+ */
+
+int ext4_reserve_inode_write(handle_t *handle, struct inode *inode,
+                        struct ext4_iloc *iloc);
+
+int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode);
+
+/*
+ * Wrapper functions with which ext4 calls into JBD.  The intent here is
+ * to allow these to be turned into appropriate stubs so ext4 can control
+ * ext2 filesystems, so ext2+ext4 systems only nee one fs.  This work hasn't
+ * been done yet.
+ */
+
+void ext4_journal_abort_handle(const char *caller, const char *err_fn,
+                struct buffer_head *bh, handle_t *handle, int err);
+
+static inline int
+__ext4_journal_get_undo_access(const char *where, handle_t *handle,
+                                struct buffer_head *bh)
+{
+        int err = jbd2_journal_get_undo_access(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+static inline int
+__ext4_journal_get_write_access(const char *where, handle_t *handle,
+                                struct buffer_head *bh)
+{
+        int err = jbd2_journal_get_write_access(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+static inline void
+ext4_journal_release_buffer(handle_t *handle, struct buffer_head *bh)
+{
+        jbd2_journal_release_buffer(handle, bh);
+}
+
+static inline int
+__ext4_journal_forget(const char *where, handle_t *handle, struct buffer_head *bh)
+{
+        int err = jbd2_journal_forget(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+static inline int
+__ext4_journal_revoke(const char *where, handle_t *handle,
+                      ext4_fsblk_t blocknr, struct buffer_head *bh)
+{
+        int err = jbd2_journal_revoke(handle, blocknr, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+static inline int
+__ext4_journal_get_create_access(const char *where,
+                                 handle_t *handle, struct buffer_head *bh)
+{
+        int err = jbd2_journal_get_create_access(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+static inline int
+__ext4_journal_dirty_metadata(const char *where,
+                              handle_t *handle, struct buffer_head *bh)
+{
+        int err = jbd2_journal_dirty_metadata(handle, bh);
+        if (err)
+                ext4_journal_abort_handle(where, __FUNCTION__, bh, handle,err);
+        return err;
+}
+
+
+#define ext4_journal_get_undo_access(handle, bh) \
+        __ext4_journal_get_undo_access(__FUNCTION__, (handle), (bh))
+#define ext4_journal_get_write_access(handle, bh) \
+        __ext4_journal_get_write_access(__FUNCTION__, (handle), (bh))
+#define ext4_journal_revoke(handle, blocknr, bh) \
+        __ext4_journal_revoke(__FUNCTION__, (handle), (blocknr), (bh))
+#define ext4_journal_get_create_access(handle, bh) \
+        __ext4_journal_get_create_access(__FUNCTION__, (handle), (bh))
+#define ext4_journal_dirty_metadata(handle, bh) \
+        __ext4_journal_dirty_metadata(__FUNCTION__, (handle), (bh))
+#define ext4_journal_forget(handle, bh) \
+        __ext4_journal_forget(__FUNCTION__, (handle), (bh))
+
+int ext4_journal_dirty_data(handle_t *handle, struct buffer_head *bh);
+
+handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks);
+int __ext4_journal_stop(const char *where, handle_t *handle);
+
+static inline handle_t *ext4_journal_start(struct inode *inode, int nblocks)
+{
+        return ext4_journal_start_sb(inode->i_sb, nblocks);
+}
+
+#define ext4_journal_stop(handle) \
+        __ext4_journal_stop(__FUNCTION__, (handle))
+
+static inline handle_t *ext4_journal_current_handle(void)
+{
+        return journal_current_handle();
+}
+
+static inline int ext4_journal_extend(handle_t *handle, int nblocks)
+{
+        return jbd2_journal_extend(handle, nblocks);
+}
+
+static inline int ext4_journal_restart(handle_t *handle, int nblocks)
+{
+        return jbd2_journal_restart(handle, nblocks);
+}
+
+static inline int ext4_journal_blocks_per_page(struct inode *inode)
+{
+        return jbd2_journal_blocks_per_page(inode);
+}
+
+static inline int ext4_journal_force_commit(journal_t *journal)
+{
+        return jbd2_journal_force_commit(journal);
+}
+
+/* super.c */
+int ext4_force_commit(struct super_block *sb);
+
+static inline int ext4_should_journal_data(struct inode *inode)
+{
+        if (!S_ISREG(inode->i_mode))
+                return 1;
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA)
+                return 1;
+        if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
+                return 1;
+        return 0;
+}
+
+static inline int ext4_should_order_data(struct inode *inode)
+{
+        if (!S_ISREG(inode->i_mode))
+                return 0;
+        if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
+                return 0;
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_ORDERED_DATA)
+                return 1;
+        return 0;
+}
+
+static inline int ext4_should_writeback_data(struct inode *inode)
+{
+        if (!S_ISREG(inode->i_mode))
+                return 0;
+        if (EXT4_I(inode)->i_flags & EXT4_JOURNAL_DATA_FL)
+                return 0;
+        if (test_opt(inode->i_sb, DATA_FLAGS) == EXT4_MOUNT_WRITEBACK_DATA)
+                return 1;
+        return 0;
+}
+
+#endif  /* _LINUX_EXT4_JBD_H */
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 34406ed467c3..2fe6e3f900ba 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -623,6 +623,9 @@ enum inode_i_mutex_lock_class
         I_MUTEX_QUOTA
 };
 
+extern void inode_double_lock(struct inode *inode1, struct inode *inode2);
+extern void inode_double_unlock(struct inode *inode1, struct inode *inode2);
+
 /*
  * NOTE: in a 32bit arch with a preemptable kernel and
  * an UP compile the i_size_read/write must be atomic
@@ -656,7 +659,11 @@ static inline loff_t i_size_read(struct inode *inode)
 #endif
 }
 
-
+/*
+ * NOTE: unlike i_size_read(), i_size_write() does need locking around it
+ * (normally i_mutex), otherwise on 32bit/SMP an update of i_size_seqcount
+ * can be lost, resulting in subsequent i_size_read() calls spinning forever.
+ */
 static inline void i_size_write(struct inode *inode, loff_t i_size)
 {
 #if BITS_PER_LONG==32 && defined(CONFIG_SMP)
@@ -1705,6 +1712,8 @@ extern void __iget(struct inode * inode);
 extern void clear_inode(struct inode *);
 extern void destroy_inode(struct inode *);
 extern struct inode *new_inode(struct super_block *);
+extern int __remove_suid(struct dentry *, int);
+extern int should_remove_suid(struct dentry *);
 extern int remove_suid(struct dentry *);
 extern void remove_dquot_ref(struct super_block *, int, struct list_head *);
 
@@ -1751,6 +1760,8 @@ extern ssize_t generic_file_splice_read(struct file *, loff_t *,
                 struct pipe_inode_info *, size_t, unsigned int);
 extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
                 struct file *, loff_t *, size_t, unsigned int);
+extern ssize_t generic_file_splice_write_nolock(struct pipe_inode_info *,
+                struct file *, loff_t *, size_t, unsigned int);
 extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
                 struct file *out, loff_t *, size_t len, unsigned int flags);
 extern long do_splice_direct(struct file *in, loff_t *ppos, struct file *out,
diff --git a/include/linux/htirq.h b/include/linux/htirq.h
index 1f15ce279a23..c96ea46737d0 100644
--- a/include/linux/htirq.h
+++ b/include/linux/htirq.h
@@ -1,15 +1,23 @@
 #ifndef LINUX_HTIRQ_H
 #define LINUX_HTIRQ_H
 
+struct ht_irq_msg {
+        u32     address_lo;     /* low 32 bits of the ht irq message */
+        u32     address_hi;     /* high 32 bits of the it irq message */
+};
+
 /* Helper functions.. */
-void write_ht_irq_low(unsigned int irq, u32 data);
-void write_ht_irq_high(unsigned int irq, u32 data);
-u32  read_ht_irq_low(unsigned int irq);
-u32  read_ht_irq_high(unsigned int irq);
+void fetch_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg);
+void write_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg);
 void mask_ht_irq(unsigned int irq);
 void unmask_ht_irq(unsigned int irq);
 
 /* The arch hook for getting things started */
 int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev);
 
+/* For drivers of buggy hardware */
+typedef void (ht_irq_update_t)(struct pci_dev *dev, int irq,
+                               struct ht_irq_msg *msg);
+int __ht_create_irq(struct pci_dev *dev, int idx, ht_irq_update_t *update);
+
 #endif /* LINUX_HTIRQ_H */
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index c25a38d8f600..ace64e57e17f 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -17,6 +17,7 @@ int hugetlb_sysctl_handler(struct ctl_table *, int, struct file *, void __user *
 int copy_hugetlb_page_range(struct mm_struct *, struct mm_struct *, struct vm_area_struct *);
 int follow_hugetlb_page(struct mm_struct *, struct vm_area_struct *, struct page **, struct vm_area_struct **, unsigned long *, int *, int);
 void unmap_hugepage_range(struct vm_area_struct *, unsigned long, unsigned long);
+void __unmap_hugepage_range(struct vm_area_struct *, unsigned long, unsigned long);
 int hugetlb_prefault(struct address_space *, struct vm_area_struct *);
 int hugetlb_report_meminfo(char *);
 int hugetlb_report_node_meminfo(int, char *);
@@ -59,8 +60,11 @@ void hugetlb_free_pgd_range(struct mmu_gather **tlb, unsigned long addr,
  * If the arch doesn't supply something else, assume that hugepage
  * size aligned regions are ok without further preparation.
  */
-static inline int prepare_hugepage_range(unsigned long addr, unsigned long len)
+static inline int prepare_hugepage_range(unsigned long addr, unsigned long len,
+                                                pgoff_t pgoff)
 {
+        if (pgoff & (~HPAGE_MASK >> PAGE_SHIFT))
+                return -EINVAL;
         if (len & ~HPAGE_MASK)
                 return -EINVAL;
         if (addr & ~HPAGE_MASK)
@@ -68,7 +72,8 @@ static inline int prepare_hugepage_range(unsigned long addr, unsigned long len)
         return 0;
 }
 #else
-int prepare_hugepage_range(unsigned long addr, unsigned long len);
+int prepare_hugepage_range(unsigned long addr, unsigned long len,
+                                                pgoff_t pgoff);
 #endif
 
 #ifndef ARCH_HAS_SETCLEAR_HUGE_PTE
@@ -106,7 +111,7 @@ static inline unsigned long hugetlb_total_pages(void)
 #define hugetlb_report_meminfo(buf)             0
 #define hugetlb_report_node_meminfo(n, buf)     0
 #define follow_huge_pmd(mm, addr, pmd, write)   NULL
-#define prepare_hugepage_range(addr, len)       (-EINVAL)
+#define prepare_hugepage_range(addr,len,pgoff)  (-EINVAL)
 #define pmd_huge(x)     0
 #define is_hugepage_only_range(mm, addr, len)   0
 #define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) ({BUG(); 0; })
diff --git a/include/linux/igmp.h b/include/linux/igmp.h
index 03f43e2893a4..21dd56905271 100644
--- a/include/linux/igmp.h
+++ b/include/linux/igmp.h
@@ -191,7 +191,7 @@ struct ip_mc_list
 #define IGMPV3_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
 #define IGMPV3_EXP(thresh, nbmant, nbexp, value) \
         ((value) < (thresh) ? (value) : \
-        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant+nbexp))) << \
+        ((IGMPV3_MASK(value, nbmant) | (1<<(nbmant))) << \
          (IGMPV3_MASK((value) >> (nbmant), nbexp) + (nbexp))))
 
 #define IGMPV3_QQIC(value) IGMPV3_EXP(0x80, 4, 3, value)
diff --git a/include/linux/in6.h b/include/linux/in6.h
index 9be6a4756f0b..f28621f638e0 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -225,7 +225,7 @@ struct in6_flowlabel_req
 #endif
 
 /*
- * Netfilter
+ * Netfilter (1)
  *
  * Following socket options are used in ip6_tables;
  * see include/linux/netfilter_ipv6/ip6_tables.h.
@@ -240,4 +240,14 @@ struct in6_flowlabel_req
 #define IPV6_RECVTCLASS         66
 #define IPV6_TCLASS             67
 
+/*
+ * Netfilter (2)
+ *
+ * Following socket options are used in ip6_tables;
+ * see include/linux/netfilter_ipv6/ip6_tables.h.
+ *
+ * IP6T_SO_GET_REVISION_MATCH   68
+ * IP6T_SO_GET_REVISION_TARGET  69
+ */
+
 #endif
diff --git a/include/linux/init.h b/include/linux/init.h
index e92b1455d7af..5eb5d24b7680 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -84,19 +84,37 @@ extern void setup_arch(char **);
  * by link order. 
  * For backwards compatibility, initcall() puts the call in 
  * the device init subsection.
+ *
+ * The `id' arg to __define_initcall() is needed so that multiple initcalls
+ * can point at the same handler without causing duplicate-symbol build errors.
  */
 
-#define __define_initcall(level,fn) \
-        static initcall_t __initcall_##fn __attribute_used__ \
+#define __define_initcall(level,fn,id) \
+        static initcall_t __initcall_##fn##id __attribute_used__ \
         __attribute__((__section__(".initcall" level ".init"))) = fn
 
-#define core_initcall(fn)               __define_initcall("1",fn)
-#define postcore_initcall(fn)           __define_initcall("2",fn)
-#define arch_initcall(fn)               __define_initcall("3",fn)
-#define subsys_initcall(fn)             __define_initcall("4",fn)
-#define fs_initcall(fn)                 __define_initcall("5",fn)
-#define device_initcall(fn)             __define_initcall("6",fn)
-#define late_initcall(fn)               __define_initcall("7",fn)
+/*
+ * A "pure" initcall has no dependencies on anything else, and purely
+ * initializes variables that couldn't be statically initialized.
+ *
+ * This only exists for built-in code, not for modules.
+ */
+#define pure_initcall(fn)               __define_initcall("0",fn,1)
+
+#define core_initcall(fn)               __define_initcall("1",fn,1)
+#define core_initcall_sync(fn)          __define_initcall("1s",fn,1s)
+#define postcore_initcall(fn)           __define_initcall("2",fn,2)
+#define postcore_initcall_sync(fn)      __define_initcall("2s",fn,2s)
+#define arch_initcall(fn)               __define_initcall("3",fn,3)
+#define arch_initcall_sync(fn)          __define_initcall("3s",fn,3s)
+#define subsys_initcall(fn)             __define_initcall("4",fn,4)
+#define subsys_initcall_sync(fn)        __define_initcall("4s",fn,4s)
+#define fs_initcall(fn)                 __define_initcall("5",fn,5)
+#define fs_initcall_sync(fn)            __define_initcall("5s",fn,5s)
+#define device_initcall(fn)             __define_initcall("6",fn,6)
+#define device_initcall_sync(fn)        __define_initcall("6s",fn,6s)
+#define late_initcall(fn)               __define_initcall("7",fn,7)
+#define late_initcall_sync(fn)          __define_initcall("7s",fn,7s)
 
 #define __initcall(fn) device_initcall(fn)
 
diff --git a/include/linux/io.h b/include/linux/io.h
index 2ad96c3f0e4e..81877ea39309 100644
--- a/include/linux/io.h
+++ b/include/linux/io.h
@@ -28,4 +28,31 @@ void __iowrite64_copy(void __iomem *to, const void *from, size_t count);
 int ioremap_page_range(unsigned long addr, unsigned long end,
                        unsigned long phys_addr, pgprot_t prot);
 
+/**
+ *      check_signature         -       find BIOS signatures
+ *      @io_addr: mmio address to check
+ *      @signature:  signature block
+ *      @length: length of signature
+ *
+ *      Perform a signature comparison with the mmio address io_addr. This
+ *      address should have been obtained by ioremap.
+ *      Returns 1 on a match.
+ */
+
+static inline int check_signature(const volatile void __iomem *io_addr,
+        const unsigned char *signature, int length)
+{
+        int retval = 0;
+        do {
+                if (readb(io_addr) != *signature)
+                        goto out;
+                io_addr++;
+                signature++;
+                length--;
+        } while (length);
+        retval = 1;
+out:
+        return retval;
+}
+
 #endif /* _LINUX_IO_H */
diff --git a/include/linux/ipmi_msgdefs.h b/include/linux/ipmi_msgdefs.h
index 22f5e2afda4f..4d04d8b58a0a 100644
--- a/include/linux/ipmi_msgdefs.h
+++ b/include/linux/ipmi_msgdefs.h
@@ -75,6 +75,8 @@
 #define IPMI_INVALID_COMMAND_ERR        0xc1
 #define IPMI_ERR_MSG_TRUNCATED          0xc6
 #define IPMI_LOST_ARBITRATION_ERR       0x81
+#define IPMI_BUS_ERR                    0x82
+#define IPMI_NAK_ON_WRITE_ERR           0x83
 #define IPMI_ERR_UNSPECIFIED            0xff
 
 #define IPMI_CHANNEL_PROTOCOL_IPMB      1
diff --git a/include/linux/ipx.h b/include/linux/ipx.h
index 4f29c60964c4..eb19b4ea84f4 100644
--- a/include/linux/ipx.h
+++ b/include/linux/ipx.h
@@ -7,8 +7,8 @@
 
 struct sockaddr_ipx {
         sa_family_t     sipx_family;
-        __u16           sipx_port;
-        __u32           sipx_network;
+        __be16          sipx_port;
+        __be32          sipx_network;
         unsigned char   sipx_node[IPX_NODE_LEN];
         __u8            sipx_type;
         unsigned char   sipx_zero;      /* 16 byte fill */
@@ -23,13 +23,13 @@ struct sockaddr_ipx {
 #define IPX_CRTITF      1
 
 struct ipx_route_definition {
-        __u32         ipx_network;
-        __u32         ipx_router_network;
+        __be32        ipx_network;
+        __be32        ipx_router_network;
         unsigned char ipx_router_node[IPX_NODE_LEN];
 };
 
 struct ipx_interface_definition {
-        __u32         ipx_network;
+        __be32        ipx_network;
         unsigned char ipx_device[16];
         unsigned char ipx_dlink_type;
 #define IPX_FRAME_NONE          0
@@ -55,8 +55,8 @@ struct ipx_config_data {
  */
 
 struct ipx_route_def {
-        __u32           ipx_network;
-        __u32           ipx_router_network;
+        __be32          ipx_network;
+        __be32          ipx_router_network;
 #define IPX_ROUTE_NO_ROUTER     0
         unsigned char   ipx_router_node[IPX_NODE_LEN];
         unsigned char   ipx_device[16];
diff --git a/include/linux/irq.h b/include/linux/irq.h
index c64f3cc7e870..52fc4052a0ae 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -141,6 +141,7 @@ struct irq_chip {
  * @pending_mask:       pending rebalanced interrupts
  * @dir:                /proc/irq/ procfs entry
  * @affinity_entry:     /proc/irq/smp_affinity procfs entry on SMP
+ * @name:               flow handler name for /proc/interrupts output
  *
  * Pad this out to 32 bytes for cache and indexing reasons.
  */
@@ -165,8 +166,9 @@ struct irq_desc {
         cpumask_t               pending_mask;
 #endif
 #ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *dir;
+        struct proc_dir_entry   *dir;
 #endif
+        const char              *name;
 } ____cacheline_aligned;
 
 extern struct irq_desc irq_desc[NR_IRQS];
@@ -272,12 +274,6 @@ extern void fastcall handle_percpu_irq(unsigned int irq, struct irq_desc *desc);
 extern void fastcall handle_bad_irq(unsigned int irq, struct irq_desc *desc);
 
 /*
- * Get a descriptive string for the highlevel handler, for
- * /proc/interrupts output:
- */
-extern const char *handle_irq_name(irq_flow_handler_t handle);
-
-/*
  * Monolithic do_IRQ implementation.
  * (is an explicit fastcall, because i386 4KSTACKS calls it from assembly)
  */
@@ -329,7 +325,12 @@ extern void
 set_irq_chip_and_handler(unsigned int irq, struct irq_chip *chip,
                          irq_flow_handler_t handle);
 extern void
-__set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained);
+set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
+                              irq_flow_handler_t handle, const char *name);
+
+extern void
+__set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
+                  const char *name);
 
 /*
  * Set a highlevel flow handler for a given IRQ:
@@ -337,7 +338,7 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained);
 static inline void
 set_irq_handler(unsigned int irq, irq_flow_handler_t handle)
 {
-        __set_irq_handler(irq, handle, 0);
+        __set_irq_handler(irq, handle, 0, NULL);
 }
 
 /*
@@ -349,7 +350,7 @@ static inline void
 set_irq_chained_handler(unsigned int irq,
                         irq_flow_handler_t handle)
 {
-        __set_irq_handler(irq, handle, 1);
+        __set_irq_handler(irq, handle, 1, NULL);
 }
 
 /* Handle dynamic irq creation and destruction */
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
new file mode 100644
index 000000000000..ddb128795781
--- /dev/null
+++ b/include/linux/jbd2.h
@@ -0,0 +1,1107 @@
+/*
+ * linux/include/linux/jbd2.h
+ *
+ * Written by Stephen C. Tweedie <sct@redhat.com>
+ *
+ * Copyright 1998-2000 Red Hat, Inc --- All Rights Reserved
+ *
+ * This file is part of the Linux kernel and is made available under
+ * the terms of the GNU General Public License, version 2, or at your
+ * option, any later version, incorporated herein by reference.
+ *
+ * Definitions for transaction data structures for the buffer cache
+ * filesystem journaling support.
+ */
+
+#ifndef _LINUX_JBD_H
+#define _LINUX_JBD_H
+
+/* Allow this file to be included directly into e2fsprogs */
+#ifndef __KERNEL__
+#include "jfs_compat.h"
+#define JBD2_DEBUG
+#define jfs_debug jbd_debug
+#else
+
+#include <linux/types.h>
+#include <linux/buffer_head.h>
+#include <linux/journal-head.h>
+#include <linux/stddef.h>
+#include <linux/bit_spinlock.h>
+#include <linux/mutex.h>
+#include <linux/timer.h>
+
+#include <asm/semaphore.h>
+#endif
+
+#define journal_oom_retry 1
+
+/*
+ * Define JBD_PARANIOD_IOFAIL to cause a kernel BUG() if ext3 finds
+ * certain classes of error which can occur due to failed IOs.  Under
+ * normal use we want ext3 to continue after such errors, because
+ * hardware _can_ fail, but for debugging purposes when running tests on
+ * known-good hardware we may want to trap these errors.
+ */
+#undef JBD_PARANOID_IOFAIL
+
+/*
+ * The default maximum commit age, in seconds.
+ */
+#define JBD_DEFAULT_MAX_COMMIT_AGE 5
+
+#ifdef CONFIG_JBD_DEBUG
+/*
+ * Define JBD_EXPENSIVE_CHECKING to enable more expensive internal
+ * consistency checks.  By default we don't do this unless
+ * CONFIG_JBD_DEBUG is on.
+ */
+#define JBD_EXPENSIVE_CHECKING
+extern int jbd2_journal_enable_debug;
+
+#define jbd_debug(n, f, a...)                                           \
+        do {                                                            \
+                if ((n) <= jbd2_journal_enable_debug) {                 \
+                        printk (KERN_DEBUG "(%s, %d): %s: ",            \
+                                __FILE__, __LINE__, __FUNCTION__);      \
+                        printk (f, ## a);                               \
+                }                                                       \
+        } while (0)
+#else
+#define jbd_debug(f, a...)      /**/
+#endif
+
+extern void * __jbd2_kmalloc (const char *where, size_t size, gfp_t flags, int retry);
+extern void * jbd2_slab_alloc(size_t size, gfp_t flags);
+extern void jbd2_slab_free(void *ptr, size_t size);
+
+#define jbd_kmalloc(size, flags) \
+        __jbd2_kmalloc(__FUNCTION__, (size), (flags), journal_oom_retry)
+#define jbd_rep_kmalloc(size, flags) \
+        __jbd2_kmalloc(__FUNCTION__, (size), (flags), 1)
+
+#define JBD2_MIN_JOURNAL_BLOCKS 1024
+
+#ifdef __KERNEL__
+
+/**
+ * typedef handle_t - The handle_t type represents a single atomic update being performed by some process.
+ *
+ * All filesystem modifications made by the process go
+ * through this handle.  Recursive operations (such as quota operations)
+ * are gathered into a single update.
+ *
+ * The buffer credits field is used to account for journaled buffers
+ * being modified by the running process.  To ensure that there is
+ * enough log space for all outstanding operations, we need to limit the
+ * number of outstanding buffers possible at any time.  When the
+ * operation completes, any buffer credits not used are credited back to
+ * the transaction, so that at all times we know how many buffers the
+ * outstanding updates on a transaction might possibly touch.
+ *
+ * This is an opaque datatype.
+ **/
+typedef struct handle_s         handle_t;       /* Atomic operation type */
+
+
+/**
+ * typedef journal_t - The journal_t maintains all of the journaling state information for a single filesystem.
+ *
+ * journal_t is linked to from the fs superblock structure.
+ *
+ * We use the journal_t to keep track of all outstanding transaction
+ * activity on the filesystem, and to manage the state of the log
+ * writing process.
+ *
+ * This is an opaque datatype.
+ **/
+typedef struct journal_s        journal_t;      /* Journal control structure */
+#endif
+
+/*
+ * Internal structures used by the logging mechanism:
+ */
+
+#define JBD2_MAGIC_NUMBER 0xc03b3998U /* The first 4 bytes of /dev/random! */
+
+/*
+ * On-disk structures
+ */
+
+/*
+ * Descriptor block types:
+ */
+
+#define JBD2_DESCRIPTOR_BLOCK   1
+#define JBD2_COMMIT_BLOCK       2
+#define JBD2_SUPERBLOCK_V1      3
+#define JBD2_SUPERBLOCK_V2      4
+#define JBD2_REVOKE_BLOCK       5
+
+/*
+ * Standard header for all descriptor blocks:
+ */
+typedef struct journal_header_s
+{
+        __be32          h_magic;
+        __be32          h_blocktype;
+        __be32          h_sequence;
+} journal_header_t;
+
+
+/*
+ * The block tag: used to describe a single buffer in the journal.
+ * t_blocknr_high is only used if INCOMPAT_64BIT is set, so this
+ * raw struct shouldn't be used for pointer math or sizeof() - use
+ * journal_tag_bytes(journal) instead to compute this.
+ */
+typedef struct journal_block_tag_s
+{
+        __be32          t_blocknr;      /* The on-disk block number */
+        __be32          t_flags;        /* See below */
+        __be32          t_blocknr_high; /* most-significant high 32bits. */
+} journal_block_tag_t;
+
+#define JBD_TAG_SIZE32 (offsetof(journal_block_tag_t, t_blocknr_high))
+#define JBD_TAG_SIZE64 (sizeof(journal_block_tag_t))
+
+/*
+ * The revoke descriptor: used on disk to describe a series of blocks to
+ * be revoked from the log
+ */
+typedef struct jbd2_journal_revoke_header_s
+{
+        journal_header_t r_header;
+        __be32           r_count;       /* Count of bytes used in the block */
+} jbd2_journal_revoke_header_t;
+
+
+/* Definitions for the journal tag flags word: */
+#define JBD2_FLAG_ESCAPE                1       /* on-disk block is escaped */
+#define JBD2_FLAG_SAME_UUID     2       /* block has same uuid as previous */
+#define JBD2_FLAG_DELETED       4       /* block deleted by this transaction */
+#define JBD2_FLAG_LAST_TAG      8       /* last tag in this descriptor block */
+
+
+/*
+ * The journal superblock.  All fields are in big-endian byte order.
+ */
+typedef struct journal_superblock_s
+{
+/* 0x0000 */
+        journal_header_t s_header;
+
+/* 0x000C */
+        /* Static information describing the journal */
+        __be32  s_blocksize;            /* journal device blocksize */
+        __be32  s_maxlen;               /* total blocks in journal file */
+        __be32  s_first;                /* first block of log information */
+
+/* 0x0018 */
+        /* Dynamic information describing the current state of the log */
+        __be32  s_sequence;             /* first commit ID expected in log */
+        __be32  s_start;                /* blocknr of start of log */
+
+/* 0x0020 */
+        /* Error value, as set by jbd2_journal_abort(). */
+        __be32  s_errno;
+
+/* 0x0024 */
+        /* Remaining fields are only valid in a version-2 superblock */
+        __be32  s_feature_compat;       /* compatible feature set */
+        __be32  s_feature_incompat;     /* incompatible feature set */
+        __be32  s_feature_ro_compat;    /* readonly-compatible feature set */
+/* 0x0030 */
+        __u8    s_uuid[16];             /* 128-bit uuid for journal */
+
+/* 0x0040 */
+        __be32  s_nr_users;             /* Nr of filesystems sharing log */
+
+        __be32  s_dynsuper;             /* Blocknr of dynamic superblock copy*/
+
+/* 0x0048 */
+        __be32  s_max_transaction;      /* Limit of journal blocks per trans.*/
+        __be32  s_max_trans_data;       /* Limit of data blocks per trans. */
+
+/* 0x0050 */
+        __u32   s_padding[44];
+
+/* 0x0100 */
+        __u8    s_users[16*48];         /* ids of all fs'es sharing the log */
+/* 0x0400 */
+} journal_superblock_t;
+
+#define JBD2_HAS_COMPAT_FEATURE(j,mask)                                 \
+        ((j)->j_format_version >= 2 &&                                  \
+         ((j)->j_superblock->s_feature_compat & cpu_to_be32((mask))))
+#define JBD2_HAS_RO_COMPAT_FEATURE(j,mask)                              \
+        ((j)->j_format_version >= 2 &&                                  \
+         ((j)->j_superblock->s_feature_ro_compat & cpu_to_be32((mask))))
+#define JBD2_HAS_INCOMPAT_FEATURE(j,mask)                               \
+        ((j)->j_format_version >= 2 &&                                  \
+         ((j)->j_superblock->s_feature_incompat & cpu_to_be32((mask))))
+
+#define JBD2_FEATURE_INCOMPAT_REVOKE    0x00000001
+#define JBD2_FEATURE_INCOMPAT_64BIT     0x00000002
+
+/* Features known to this kernel version: */
+#define JBD2_KNOWN_COMPAT_FEATURES      0
+#define JBD2_KNOWN_ROCOMPAT_FEATURES    0
+#define JBD2_KNOWN_INCOMPAT_FEATURES    (JBD2_FEATURE_INCOMPAT_REVOKE | \
+                                         JBD2_FEATURE_INCOMPAT_64BIT)
+
+#ifdef __KERNEL__
+
+#include <linux/fs.h>
+#include <linux/sched.h>
+
+#define JBD_ASSERTIONS
+#ifdef JBD_ASSERTIONS
+#define J_ASSERT(assert)                                                \
+do {                                                                    \
+        if (!(assert)) {                                                \
+                printk (KERN_EMERG                                      \
+                        "Assertion failure in %s() at %s:%d: \"%s\"\n", \
+                        __FUNCTION__, __FILE__, __LINE__, # assert);    \
+                BUG();                                                  \
+        }                                                               \
+} while (0)
+
+#if defined(CONFIG_BUFFER_DEBUG)
+void buffer_assertion_failure(struct buffer_head *bh);
+#define J_ASSERT_BH(bh, expr)                                           \
+        do {                                                            \
+                if (!(expr))                                            \
+                        buffer_assertion_failure(bh);                   \
+                J_ASSERT(expr);                                         \
+        } while (0)
+#define J_ASSERT_JH(jh, expr)   J_ASSERT_BH(jh2bh(jh), expr)
+#else
+#define J_ASSERT_BH(bh, expr)   J_ASSERT(expr)
+#define J_ASSERT_JH(jh, expr)   J_ASSERT(expr)
+#endif
+
+#else
+#define J_ASSERT(assert)        do { } while (0)
+#endif          /* JBD_ASSERTIONS */
+
+#if defined(JBD_PARANOID_IOFAIL)
+#define J_EXPECT(expr, why...)          J_ASSERT(expr)
+#define J_EXPECT_BH(bh, expr, why...)   J_ASSERT_BH(bh, expr)
+#define J_EXPECT_JH(jh, expr, why...)   J_ASSERT_JH(jh, expr)
+#else
+#define __journal_expect(expr, why...)                                       \
+        ({                                                                   \
+                int val = (expr);                                            \
+                if (!val) {                                                  \
+                        printk(KERN_ERR                                      \
+                                "EXT3-fs unexpected failure: %s;\n",# expr); \
+                        printk(KERN_ERR why "\n");                           \
+                }                                                            \
+                val;                                                         \
+        })
+#define J_EXPECT(expr, why...)          __journal_expect(expr, ## why)
+#define J_EXPECT_BH(bh, expr, why...)   __journal_expect(expr, ## why)
+#define J_EXPECT_JH(jh, expr, why...)   __journal_expect(expr, ## why)
+#endif
+
+enum jbd_state_bits {
+        BH_JBD                  /* Has an attached ext3 journal_head */
+          = BH_PrivateStart,
+        BH_JWrite,              /* Being written to log (@@@ DEBUGGING) */
+        BH_Freed,               /* Has been freed (truncated) */
+        BH_Revoked,             /* Has been revoked from the log */
+        BH_RevokeValid,         /* Revoked flag is valid */
+        BH_JBDDirty,            /* Is dirty but journaled */
+        BH_State,               /* Pins most journal_head state */
+        BH_JournalHead,         /* Pins bh->b_private and jh->b_bh */
+        BH_Unshadow,            /* Dummy bit, for BJ_Shadow wakeup filtering */
+};
+
+BUFFER_FNS(JBD, jbd)
+BUFFER_FNS(JWrite, jwrite)
+BUFFER_FNS(JBDDirty, jbddirty)
+TAS_BUFFER_FNS(JBDDirty, jbddirty)
+BUFFER_FNS(Revoked, revoked)
+TAS_BUFFER_FNS(Revoked, revoked)
+BUFFER_FNS(RevokeValid, revokevalid)
+TAS_BUFFER_FNS(RevokeValid, revokevalid)
+BUFFER_FNS(Freed, freed)
+
+static inline struct buffer_head *jh2bh(struct journal_head *jh)
+{
+        return jh->b_bh;
+}
+
+static inline struct journal_head *bh2jh(struct buffer_head *bh)
+{
+        return bh->b_private;
+}
+
+static inline void jbd_lock_bh_state(struct buffer_head *bh)
+{
+        bit_spin_lock(BH_State, &bh->b_state);
+}
+
+static inline int jbd_trylock_bh_state(struct buffer_head *bh)
+{
+        return bit_spin_trylock(BH_State, &bh->b_state);
+}
+
+static inline int jbd_is_locked_bh_state(struct buffer_head *bh)
+{
+        return bit_spin_is_locked(BH_State, &bh->b_state);
+}
+
+static inline void jbd_unlock_bh_state(struct buffer_head *bh)
+{
+        bit_spin_unlock(BH_State, &bh->b_state);
+}
+
+static inline void jbd_lock_bh_journal_head(struct buffer_head *bh)
+{
+        bit_spin_lock(BH_JournalHead, &bh->b_state);
+}
+
+static inline void jbd_unlock_bh_journal_head(struct buffer_head *bh)
+{
+        bit_spin_unlock(BH_JournalHead, &bh->b_state);
+}
+
+struct jbd2_revoke_table_s;
+
+/**
+ * struct handle_s - The handle_s type is the concrete type associated with
+ *     handle_t.
+ * @h_transaction: Which compound transaction is this update a part of?
+ * @h_buffer_credits: Number of remaining buffers we are allowed to dirty.
+ * @h_ref: Reference count on this handle
+ * @h_err: Field for caller's use to track errors through large fs operations
+ * @h_sync: flag for sync-on-close
+ * @h_jdata: flag to force data journaling
+ * @h_aborted: flag indicating fatal error on handle
+ **/
+
+/* Docbook can't yet cope with the bit fields, but will leave the documentation
+ * in so it can be fixed later.
+ */
+
+struct handle_s
+{
+        /* Which compound transaction is this update a part of? */
+        transaction_t           *h_transaction;
+
+        /* Number of remaining buffers we are allowed to dirty: */
+        int                     h_buffer_credits;
+
+        /* Reference count on this handle */
+        int                     h_ref;
+
+        /* Field for caller's use to track errors through large fs */
+        /* operations */
+        int                     h_err;
+
+        /* Flags [no locking] */
+        unsigned int    h_sync:         1;      /* sync-on-close */
+        unsigned int    h_jdata:        1;      /* force data journaling */
+        unsigned int    h_aborted:      1;      /* fatal error on handle */
+};
+
+
+/* The transaction_t type is the guts of the journaling mechanism.  It
+ * tracks a compound transaction through its various states:
+ *
+ * RUNNING:     accepting new updates
+ * LOCKED:      Updates still running but we don't accept new ones
+ * RUNDOWN:     Updates are tidying up but have finished requesting
+ *              new buffers to modify (state not used for now)
+ * FLUSH:       All updates complete, but we are still writing to disk
+ * COMMIT:      All data on disk, writing commit record
+ * FINISHED:    We still have to keep the transaction for checkpointing.
+ *
+ * The transaction keeps track of all of the buffers modified by a
+ * running transaction, and all of the buffers committed but not yet
+ * flushed to home for finished transactions.
+ */
+
+/*
+ * Lock ranking:
+ *
+ *    j_list_lock
+ *      ->jbd_lock_bh_journal_head()    (This is "innermost")
+ *
+ *    j_state_lock
+ *    ->jbd_lock_bh_state()
+ *
+ *    jbd_lock_bh_state()
+ *    ->j_list_lock
+ *
+ *    j_state_lock
+ *    ->t_handle_lock
+ *
+ *    j_state_lock
+ *    ->j_list_lock                     (journal_unmap_buffer)
+ *
+ */
+
+struct transaction_s
+{
+        /* Pointer to the journal for this transaction. [no locking] */
+        journal_t               *t_journal;
+
+        /* Sequence number for this transaction [no locking] */
+        tid_t                   t_tid;
+
+        /*
+         * Transaction's current state
+         * [no locking - only kjournald2 alters this]
+         * FIXME: needs barriers
+         * KLUDGE: [use j_state_lock]
+         */
+        enum {
+                T_RUNNING,
+                T_LOCKED,
+                T_RUNDOWN,
+                T_FLUSH,
+                T_COMMIT,
+                T_FINISHED
+        }                       t_state;
+
+        /*
+         * Where in the log does this transaction's commit start? [no locking]
+         */
+        unsigned long           t_log_start;
+
+        /* Number of buffers on the t_buffers list [j_list_lock] */
+        int                     t_nr_buffers;
+
+        /*
+         * Doubly-linked circular list of all buffers reserved but not yet
+         * modified by this transaction [j_list_lock]
+         */
+        struct journal_head     *t_reserved_list;
+
+        /*
+         * Doubly-linked circular list of all buffers under writeout during
+         * commit [j_list_lock]
+         */
+        struct journal_head     *t_locked_list;
+
+        /*
+         * Doubly-linked circular list of all metadata buffers owned by this
+         * transaction [j_list_lock]
+         */
+        struct journal_head     *t_buffers;
+
+        /*
+         * Doubly-linked circular list of all data buffers still to be
+         * flushed before this transaction can be committed [j_list_lock]
+         */
+        struct journal_head     *t_sync_datalist;
+
+        /*
+         * Doubly-linked circular list of all forget buffers (superseded
+         * buffers which we can un-checkpoint once this transaction commits)
+         * [j_list_lock]
+         */
+        struct journal_head     *t_forget;
+
+        /*
+         * Doubly-linked circular list of all buffers still to be flushed before
+         * this transaction can be checkpointed. [j_list_lock]
+         */
+        struct journal_head     *t_checkpoint_list;
+
+        /*
+         * Doubly-linked circular list of all buffers submitted for IO while
+         * checkpointing. [j_list_lock]
+         */
+        struct journal_head     *t_checkpoint_io_list;
+
+        /*
+         * Doubly-linked circular list of temporary buffers currently undergoing
+         * IO in the log [j_list_lock]
+         */
+        struct journal_head     *t_iobuf_list;
+
+        /*
+         * Doubly-linked circular list of metadata buffers being shadowed by log
+         * IO.  The IO buffers on the iobuf list and the shadow buffers on this
+         * list match each other one for one at all times. [j_list_lock]
+         */
+        struct journal_head     *t_shadow_list;
+
+        /*
+         * Doubly-linked circular list of control buffers being written to the
+         * log. [j_list_lock]
+         */
+        struct journal_head     *t_log_list;
+
+        /*
+         * Protects info related to handles
+         */
+        spinlock_t              t_handle_lock;
+
+        /*
+         * Number of outstanding updates running on this transaction
+         * [t_handle_lock]
+         */
+        int                     t_updates;
+
+        /*
+         * Number of buffers reserved for use by all handles in this transaction
+         * handle but not yet modified. [t_handle_lock]
+         */
+        int                     t_outstanding_credits;
+
+        /*
+         * Forward and backward links for the circular list of all transactions
+         * awaiting checkpoint. [j_list_lock]
+         */
+        transaction_t           *t_cpnext, *t_cpprev;
+
+        /*
+         * When will the transaction expire (become due for commit), in jiffies?
+         * [no locking]
+         */
+        unsigned long           t_expires;
+
+        /*
+         * How many handles used this transaction? [t_handle_lock]
+         */
+        int t_handle_count;
+
+};
+
+/**
+ * struct journal_s - The journal_s type is the concrete type associated with
+ *     journal_t.
+ * @j_flags:  General journaling state flags
+ * @j_errno:  Is there an outstanding uncleared error on the journal (from a
+ *     prior abort)?
+ * @j_sb_buffer: First part of superblock buffer
+ * @j_superblock: Second part of superblock buffer
+ * @j_format_version: Version of the superblock format
+ * @j_state_lock: Protect the various scalars in the journal
+ * @j_barrier_count:  Number of processes waiting to create a barrier lock
+ * @j_barrier: The barrier lock itself
+ * @j_running_transaction: The current running transaction..
+ * @j_committing_transaction: the transaction we are pushing to disk
+ * @j_checkpoint_transactions: a linked circular list of all transactions
+ *  waiting for checkpointing
+ * @j_wait_transaction_locked: Wait queue for waiting for a locked transaction
+ *  to start committing, or for a barrier lock to be released
+ * @j_wait_logspace: Wait queue for waiting for checkpointing to complete
+ * @j_wait_done_commit: Wait queue for waiting for commit to complete
+ * @j_wait_checkpoint:  Wait queue to trigger checkpointing
+ * @j_wait_commit: Wait queue to trigger commit
+ * @j_wait_updates: Wait queue to wait for updates to complete
+ * @j_checkpoint_mutex: Mutex for locking against concurrent checkpoints
+ * @j_head: Journal head - identifies the first unused block in the journal
+ * @j_tail: Journal tail - identifies the oldest still-used block in the
+ *  journal.
+ * @j_free: Journal free - how many free blocks are there in the journal?
+ * @j_first: The block number of the first usable block
+ * @j_last: The block number one beyond the last usable block
+ * @j_dev: Device where we store the journal
+ * @j_blocksize: blocksize for the location where we store the journal.
+ * @j_blk_offset: starting block offset for into the device where we store the
+ *     journal
+ * @j_fs_dev: Device which holds the client fs.  For internal journal this will
+ *     be equal to j_dev
+ * @j_maxlen: Total maximum capacity of the journal region on disk.
+ * @j_list_lock: Protects the buffer lists and internal buffer state.
+ * @j_inode: Optional inode where we store the journal.  If present, all journal
+ *     block numbers are mapped into this inode via bmap().
+ * @j_tail_sequence:  Sequence number of the oldest transaction in the log
+ * @j_transaction_sequence: Sequence number of the next transaction to grant
+ * @j_commit_sequence: Sequence number of the most recently committed
+ *  transaction
+ * @j_commit_request: Sequence number of the most recent transaction wanting
+ *     commit
+ * @j_uuid: Uuid of client object.
+ * @j_task: Pointer to the current commit thread for this journal
+ * @j_max_transaction_buffers:  Maximum number of metadata buffers to allow in a
+ *     single compound commit transaction
+ * @j_commit_interval: What is the maximum transaction lifetime before we begin
+ *  a commit?
+ * @j_commit_timer:  The timer used to wakeup the commit thread
+ * @j_revoke_lock: Protect the revoke table
+ * @j_revoke: The revoke table - maintains the list of revoked blocks in the
+ *     current transaction.
+ * @j_revoke_table: alternate revoke tables for j_revoke
+ * @j_wbuf: array of buffer_heads for jbd2_journal_commit_transaction
+ * @j_wbufsize: maximum number of buffer_heads allowed in j_wbuf, the
+ *      number that will fit in j_blocksize
+ * @j_last_sync_writer: most recent pid which did a synchronous write
+ * @j_private: An opaque pointer to fs-private information.
+ */
+
+struct journal_s
+{
+        /* General journaling state flags [j_state_lock] */
+        unsigned long           j_flags;
+
+        /*
+         * Is there an outstanding uncleared error on the journal (from a prior
+         * abort)? [j_state_lock]
+         */
+        int                     j_errno;
+
+        /* The superblock buffer */
+        struct buffer_head      *j_sb_buffer;
+        journal_superblock_t    *j_superblock;
+
+        /* Version of the superblock format */
+        int                     j_format_version;
+
+        /*
+         * Protect the various scalars in the journal
+         */
+        spinlock_t              j_state_lock;
+
+        /*
+         * Number of processes waiting to create a barrier lock [j_state_lock]
+         */
+        int                     j_barrier_count;
+
+        /* The barrier lock itself */
+        struct mutex            j_barrier;
+
+        /*
+         * Transactions: The current running transaction...
+         * [j_state_lock] [caller holding open handle]
+         */
+        transaction_t           *j_running_transaction;
+
+        /*
+         * the transaction we are pushing to disk
+         * [j_state_lock] [caller holding open handle]
+         */
+        transaction_t           *j_committing_transaction;
+
+        /*
+         * ... and a linked circular list of all transactions waiting for
+         * checkpointing. [j_list_lock]
+         */
+        transaction_t           *j_checkpoint_transactions;
+
+        /*
+         * Wait queue for waiting for a locked transaction to start committing,
+         * or for a barrier lock to be released
+         */
+        wait_queue_head_t       j_wait_transaction_locked;
+
+        /* Wait queue for waiting for checkpointing to complete */
+        wait_queue_head_t       j_wait_logspace;
+
+        /* Wait queue for waiting for commit to complete */
+        wait_queue_head_t       j_wait_done_commit;
+
+        /* Wait queue to trigger checkpointing */
+        wait_queue_head_t       j_wait_checkpoint;
+
+        /* Wait queue to trigger commit */
+        wait_queue_head_t       j_wait_commit;
+
+        /* Wait queue to wait for updates to complete */
+        wait_queue_head_t       j_wait_updates;
+
+        /* Semaphore for locking against concurrent checkpoints */
+        struct mutex            j_checkpoint_mutex;
+
+        /*
+         * Journal head: identifies the first unused block in the journal.
+         * [j_state_lock]
+         */
+        unsigned long           j_head;
+
+        /*
+         * Journal tail: identifies the oldest still-used block in the journal.
+         * [j_state_lock]
+         */
+        unsigned long           j_tail;
+
+        /*
+         * Journal free: how many free blocks are there in the journal?
+         * [j_state_lock]
+         */
+        unsigned long           j_free;
+
+        /*
+         * Journal start and end: the block numbers of the first usable block
+         * and one beyond the last usable block in the journal. [j_state_lock]
+         */
+        unsigned long           j_first;
+        unsigned long           j_last;
+
+        /*
+         * Device, blocksize and starting block offset for the location where we
+         * store the journal.
+         */
+        struct block_device     *j_dev;
+        int                     j_blocksize;
+        unsigned long long              j_blk_offset;
+
+        /*
+         * Device which holds the client fs.  For internal journal this will be
+         * equal to j_dev.
+         */
+        struct block_device     *j_fs_dev;
+
+        /* Total maximum capacity of the journal region on disk. */
+        unsigned int            j_maxlen;
+
+        /*
+         * Protects the buffer lists and internal buffer state.
+         */
+        spinlock_t              j_list_lock;
+
+        /* Optional inode where we store the journal.  If present, all */
+        /* journal block numbers are mapped into this inode via */
+        /* bmap(). */
+        struct inode            *j_inode;
+
+        /*
+         * Sequence number of the oldest transaction in the log [j_state_lock]
+         */
+        tid_t                   j_tail_sequence;
+
+        /*
+         * Sequence number of the next transaction to grant [j_state_lock]
+         */
+        tid_t                   j_transaction_sequence;
+
+        /*
+         * Sequence number of the most recently committed transaction
+         * [j_state_lock].
+         */
+        tid_t                   j_commit_sequence;
+
+        /*
+         * Sequence number of the most recent transaction wanting commit
+         * [j_state_lock]
+         */
+        tid_t                   j_commit_request;
+
+        /*
+         * Journal uuid: identifies the object (filesystem, LVM volume etc)
+         * backed by this journal.  This will eventually be replaced by an array
+         * of uuids, allowing us to index multiple devices within a single
+         * journal and to perform atomic updates across them.
+         */
+        __u8                    j_uuid[16];
+
+        /* Pointer to the current commit thread for this journal */
+        struct task_struct      *j_task;
+
+        /*
+         * Maximum number of metadata buffers to allow in a single compound
+         * commit transaction
+         */
+        int                     j_max_transaction_buffers;
+
+        /*
+         * What is the maximum transaction lifetime before we begin a commit?
+         */
+        unsigned long           j_commit_interval;
+
+        /* The timer used to wakeup the commit thread: */
+        struct timer_list       j_commit_timer;
+
+        /*
+         * The revoke table: maintains the list of revoked blocks in the
+         * current transaction.  [j_revoke_lock]
+         */
+        spinlock_t              j_revoke_lock;
+        struct jbd2_revoke_table_s *j_revoke;
+        struct jbd2_revoke_table_s *j_revoke_table[2];
+
+        /*
+         * array of bhs for jbd2_journal_commit_transaction
+         */
+        struct buffer_head      **j_wbuf;
+        int                     j_wbufsize;
+
+        pid_t                   j_last_sync_writer;
+
+        /*
+         * An opaque pointer to fs-private information.  ext3 puts its
+         * superblock pointer here
+         */
+        void *j_private;
+};
+
+/*
+ * Journal flag definitions
+ */
+#define JBD2_UNMOUNT    0x001   /* Journal thread is being destroyed */
+#define JBD2_ABORT      0x002   /* Journaling has been aborted for errors. */
+#define JBD2_ACK_ERR    0x004   /* The errno in the sb has been acked */
+#define JBD2_FLUSHED    0x008   /* The journal superblock has been flushed */
+#define JBD2_LOADED     0x010   /* The journal superblock has been loaded */
+#define JBD2_BARRIER    0x020   /* Use IDE barriers */
+
+/*
+ * Function declarations for the journaling transaction and buffer
+ * management
+ */
+
+/* Filing buffers */
+extern void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh);
+extern void jbd2_journal_unfile_buffer(journal_t *, struct journal_head *);
+extern void __jbd2_journal_unfile_buffer(struct journal_head *);
+extern void __jbd2_journal_refile_buffer(struct journal_head *);
+extern void jbd2_journal_refile_buffer(journal_t *, struct journal_head *);
+extern void __jbd2_journal_file_buffer(struct journal_head *, transaction_t *, int);
+extern void __journal_free_buffer(struct journal_head *bh);
+extern void jbd2_journal_file_buffer(struct journal_head *, transaction_t *, int);
+extern void __journal_clean_data_list(transaction_t *transaction);
+
+/* Log buffer allocation */
+extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *);
+int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
+
+/* Commit management */
+extern void jbd2_journal_commit_transaction(journal_t *);
+
+/* Checkpoint list management */
+int __jbd2_journal_clean_checkpoint_list(journal_t *journal);
+int __jbd2_journal_remove_checkpoint(struct journal_head *);
+void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);
+
+/* Buffer IO */
+extern int
+jbd2_journal_write_metadata_buffer(transaction_t          *transaction,
+                              struct journal_head  *jh_in,
+                              struct journal_head **jh_out,
+                              unsigned long long   blocknr);
+
+/* Transaction locking */
+extern void             __wait_on_journal (journal_t *);
+
+/*
+ * Journal locking.
+ *
+ * We need to lock the journal during transaction state changes so that nobody
+ * ever tries to take a handle on the running transaction while we are in the
+ * middle of moving it to the commit phase.  j_state_lock does this.
+ *
+ * Note that the locking is completely interrupt unsafe.  We never touch
+ * journal structures from interrupts.
+ */
+
+static inline handle_t *journal_current_handle(void)
+{
+        return current->journal_info;
+}
+
+/* The journaling code user interface:
+ *
+ * Create and destroy handles
+ * Register buffer modifications against the current transaction.
+ */
+
+extern handle_t *jbd2_journal_start(journal_t *, int nblocks);
+extern int       jbd2_journal_restart (handle_t *, int nblocks);
+extern int       jbd2_journal_extend (handle_t *, int nblocks);
+extern int       jbd2_journal_get_write_access(handle_t *, struct buffer_head *);
+extern int       jbd2_journal_get_create_access (handle_t *, struct buffer_head *);
+extern int       jbd2_journal_get_undo_access(handle_t *, struct buffer_head *);
+extern int       jbd2_journal_dirty_data (handle_t *, struct buffer_head *);
+extern int       jbd2_journal_dirty_metadata (handle_t *, struct buffer_head *);
+extern void      jbd2_journal_release_buffer (handle_t *, struct buffer_head *);
+extern int       jbd2_journal_forget (handle_t *, struct buffer_head *);
+extern void      journal_sync_buffer (struct buffer_head *);
+extern void      jbd2_journal_invalidatepage(journal_t *,
+                                struct page *, unsigned long);
+extern int       jbd2_journal_try_to_free_buffers(journal_t *, struct page *, gfp_t);
+extern int       jbd2_journal_stop(handle_t *);
+extern int       jbd2_journal_flush (journal_t *);
+extern void      jbd2_journal_lock_updates (journal_t *);
+extern void      jbd2_journal_unlock_updates (journal_t *);
+
+extern journal_t * jbd2_journal_init_dev(struct block_device *bdev,
+                                struct block_device *fs_dev,
+                                unsigned long long start, int len, int bsize);
+extern journal_t * jbd2_journal_init_inode (struct inode *);
+extern int         jbd2_journal_update_format (journal_t *);
+extern int         jbd2_journal_check_used_features
+                   (journal_t *, unsigned long, unsigned long, unsigned long);
+extern int         jbd2_journal_check_available_features
+                   (journal_t *, unsigned long, unsigned long, unsigned long);
+extern int         jbd2_journal_set_features
+                   (journal_t *, unsigned long, unsigned long, unsigned long);
+extern int         jbd2_journal_create     (journal_t *);
+extern int         jbd2_journal_load       (journal_t *journal);
+extern void        jbd2_journal_destroy    (journal_t *);
+extern int         jbd2_journal_recover    (journal_t *journal);
+extern int         jbd2_journal_wipe       (journal_t *, int);
+extern int         jbd2_journal_skip_recovery   (journal_t *);
+extern void        jbd2_journal_update_superblock       (journal_t *, int);
+extern void        __jbd2_journal_abort_hard    (journal_t *);
+extern void        jbd2_journal_abort      (journal_t *, int);
+extern int         jbd2_journal_errno      (journal_t *);
+extern void        jbd2_journal_ack_err    (journal_t *);
+extern int         jbd2_journal_clear_err  (journal_t *);
+extern int         jbd2_journal_bmap(journal_t *, unsigned long, unsigned long long *);
+extern int         jbd2_journal_force_commit(journal_t *);
+
+/*
+ * journal_head management
+ */
+struct journal_head *jbd2_journal_add_journal_head(struct buffer_head *bh);
+struct journal_head *jbd2_journal_grab_journal_head(struct buffer_head *bh);
+void jbd2_journal_remove_journal_head(struct buffer_head *bh);
+void jbd2_journal_put_journal_head(struct journal_head *jh);
+
+/*
+ * handle management
+ */
+extern kmem_cache_t *jbd2_handle_cache;
+
+static inline handle_t *jbd_alloc_handle(gfp_t gfp_flags)
+{
+        return kmem_cache_alloc(jbd2_handle_cache, gfp_flags);
+}
+
+static inline void jbd_free_handle(handle_t *handle)
+{
+        kmem_cache_free(jbd2_handle_cache, handle);
+}
+
+/* Primary revoke support */
+#define JOURNAL_REVOKE_DEFAULT_HASH 256
+extern int         jbd2_journal_init_revoke(journal_t *, int);
+extern void        jbd2_journal_destroy_revoke_caches(void);
+extern int         jbd2_journal_init_revoke_caches(void);
+
+extern void        jbd2_journal_destroy_revoke(journal_t *);
+extern int         jbd2_journal_revoke (handle_t *, unsigned long long, struct buffer_head *);
+extern int         jbd2_journal_cancel_revoke(handle_t *, struct journal_head *);
+extern void        jbd2_journal_write_revoke_records(journal_t *, transaction_t *);
+
+/* Recovery revoke support */
+extern int      jbd2_journal_set_revoke(journal_t *, unsigned long long, tid_t);
+extern int      jbd2_journal_test_revoke(journal_t *, unsigned long long, tid_t);
+extern void     jbd2_journal_clear_revoke(journal_t *);
+extern void     jbd2_journal_switch_revoke_table(journal_t *journal);
+
+/*
+ * The log thread user interface:
+ *
+ * Request space in the current transaction, and force transaction commit
+ * transitions on demand.
+ */
+
+int __jbd2_log_space_left(journal_t *); /* Called with journal locked */
+int jbd2_log_start_commit(journal_t *journal, tid_t tid);
+int __jbd2_log_start_commit(journal_t *journal, tid_t tid);
+int jbd2_journal_start_commit(journal_t *journal, tid_t *tid);
+int jbd2_journal_force_commit_nested(journal_t *journal);
+int jbd2_log_wait_commit(journal_t *journal, tid_t tid);
+int jbd2_log_do_checkpoint(journal_t *journal);
+
+void __jbd2_log_wait_for_space(journal_t *journal);
+extern void     __jbd2_journal_drop_transaction(journal_t *, transaction_t *);
+extern int      jbd2_cleanup_journal_tail(journal_t *);
+
+/* Debugging code only: */
+
+#define jbd_ENOSYS() \
+do {                                                                       \
+        printk (KERN_ERR "JBD unimplemented function %s\n", __FUNCTION__); \
+        current->state = TASK_UNINTERRUPTIBLE;                             \
+        schedule();                                                        \
+} while (1)
+
+/*
+ * is_journal_abort
+ *
+ * Simple test wrapper function to test the JBD2_ABORT state flag.  This
+ * bit, when set, indicates that we have had a fatal error somewhere,
+ * either inside the journaling layer or indicated to us by the client
+ * (eg. ext3), and that we and should not commit any further
+ * transactions.
+ */
+
+static inline int is_journal_aborted(journal_t *journal)
+{
+        return journal->j_flags & JBD2_ABORT;
+}
+
+static inline int is_handle_aborted(handle_t *handle)
+{
+        if (handle->h_aborted)
+                return 1;
+        return is_journal_aborted(handle->h_transaction->t_journal);
+}
+
+static inline void jbd2_journal_abort_handle(handle_t *handle)
+{
+        handle->h_aborted = 1;
+}
+
+#endif /* __KERNEL__   */
+
+/* Comparison functions for transaction IDs: perform comparisons using
+ * modulo arithmetic so that they work over sequence number wraps. */
+
+static inline int tid_gt(tid_t x, tid_t y)
+{
+        int difference = (x - y);
+        return (difference > 0);
+}
+
+static inline int tid_geq(tid_t x, tid_t y)
+{
+        int difference = (x - y);
+        return (difference >= 0);
+}
+
+extern int jbd2_journal_blocks_per_page(struct inode *inode);
+extern size_t journal_tag_bytes(journal_t *journal);
+
+/*
+ * Return the minimum number of blocks which must be free in the journal
+ * before a new transaction may be started.  Must be called under j_state_lock.
+ */
+static inline int jbd_space_needed(journal_t *journal)
+{
+        int nblocks = journal->j_max_transaction_buffers;
+        if (journal->j_committing_transaction)
+                nblocks += journal->j_committing_transaction->
+                                        t_outstanding_credits;
+        return nblocks;
+}
+
+/*
+ * Definitions which augment the buffer_head layer
+ */
+
+/* journaling buffer types */
+#define BJ_None         0       /* Not journaled */
+#define BJ_SyncData     1       /* Normal data: flush before commit */
+#define BJ_Metadata     2       /* Normal journaled metadata */
+#define BJ_Forget       3       /* Buffer superseded by this transaction */
+#define BJ_IO           4       /* Buffer is for temporary IO use */
+#define BJ_Shadow       5       /* Buffer contents being shadowed to the log */
+#define BJ_LogCtl       6       /* Buffer contains log descriptors */
+#define BJ_Reserved     7       /* Buffer is reserved for access by journal */
+#define BJ_Locked       8       /* Locked for I/O during commit */
+#define BJ_Types        9
+
+extern int jbd_blocks_per_page(struct inode *inode);
+
+#ifdef __KERNEL__
+
+#define buffer_trace_init(bh)   do {} while (0)
+#define print_buffer_fields(bh) do {} while (0)
+#define print_buffer_trace(bh)  do {} while (0)
+#define BUFFER_TRACE(bh, info)  do {} while (0)
+#define BUFFER_TRACE2(bh, bh2, info)    do {} while (0)
+#define JBUFFER_TRACE(jh, info) do {} while (0)
+
+#endif  /* __KERNEL__ */
+
+#endif  /* _LINUX_JBD_H */
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 80f39cab470a..24b611147adb 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -171,6 +171,8 @@ __attribute_const__ roundup_pow_of_two(unsigned long x)
 
 extern int printk_ratelimit(void);
 extern int __printk_ratelimit(int ratelimit_jiffies, int ratelimit_burst);
+extern bool printk_timed_ratelimit(unsigned long *caller_jiffies,
+                                unsigned int interval_msec);
 
 static inline void console_silent(void)
 {
diff --git a/include/linux/libata.h b/include/linux/libata.h
index d0a7ad5ed518..abd2debebca2 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -143,7 +143,7 @@ enum {
         ATA_DFLAG_CFG_MASK      = (1 << 8) - 1,
 
         ATA_DFLAG_PIO           = (1 << 8), /* device limited to PIO mode */
-        ATA_DFLAG_NCQ_OFF       = (1 << 9), /* devied limited to non-NCQ mode */
+        ATA_DFLAG_NCQ_OFF       = (1 << 9), /* device limited to non-NCQ mode */
         ATA_DFLAG_SUSPENDED     = (1 << 10), /* device suspended */
         ATA_DFLAG_INIT_MASK     = (1 << 16) - 1,
 
@@ -702,7 +702,6 @@ extern int ata_std_prereset(struct ata_port *ap);
 extern int ata_std_softreset(struct ata_port *ap, unsigned int *classes);
 extern int sata_std_hardreset(struct ata_port *ap, unsigned int *class);
 extern void ata_std_postreset(struct ata_port *ap, unsigned int *classes);
-extern int ata_dev_revalidate(struct ata_device *dev, int post_reset);
 extern void ata_port_disable(struct ata_port *);
 extern void ata_std_ports(struct ata_ioports *ioaddr);
 #ifdef CONFIG_PCI
diff --git a/include/linux/lockd/bind.h b/include/linux/lockd/bind.h
index 81e3a185f951..aa50d89eacd7 100644
--- a/include/linux/lockd/bind.h
+++ b/include/linux/lockd/bind.h
@@ -10,6 +10,11 @@
 #define LINUX_LOCKD_BIND_H
 
 #include <linux/lockd/nlm.h>
+/* need xdr-encoded error codes too, so... */
+#include <linux/lockd/xdr.h>
+#ifdef CONFIG_LOCKD_V4
+#include <linux/lockd/xdr4.h>
+#endif
 
 /* Dummy declarations */
 struct svc_rqst;
diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h
index 2909619c0295..862d9730a60d 100644
--- a/include/linux/lockd/lockd.h
+++ b/include/linux/lockd/lockd.h
@@ -154,7 +154,7 @@ int		  nlm_async_reply(struct nlm_rqst *, u32, const struct rpc_call_ops *);
 struct nlm_wait * nlmclnt_prepare_block(struct nlm_host *host, struct file_lock *fl);
 void              nlmclnt_finish_block(struct nlm_wait *block);
 int               nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout);
-u32               nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *);
+__be32            nlmclnt_grant(const struct sockaddr_in *addr, const struct nlm_lock *);
 void              nlmclnt_recovery(struct nlm_host *);
 int               nlmclnt_reclaim(struct nlm_host *, struct file_lock *);
 void              nlmclnt_next_cookie(struct nlm_cookie *);
@@ -184,12 +184,12 @@ typedef int	  (*nlm_host_match_fn_t)(struct nlm_host *cur, struct nlm_host *ref)
 /*
  * Server-side lock handling
  */
-u32               nlmsvc_lock(struct svc_rqst *, struct nlm_file *,
+__be32            nlmsvc_lock(struct svc_rqst *, struct nlm_file *,
                                         struct nlm_lock *, int, struct nlm_cookie *);
-u32               nlmsvc_unlock(struct nlm_file *, struct nlm_lock *);
-u32               nlmsvc_testlock(struct nlm_file *, struct nlm_lock *,
+__be32            nlmsvc_unlock(struct nlm_file *, struct nlm_lock *);
+__be32            nlmsvc_testlock(struct nlm_file *, struct nlm_lock *,
                                         struct nlm_lock *);
-u32               nlmsvc_cancel_blocked(struct nlm_file *, struct nlm_lock *);
+__be32            nlmsvc_cancel_blocked(struct nlm_file *, struct nlm_lock *);
 unsigned long     nlmsvc_retry_blocked(void);
 void              nlmsvc_traverse_blocks(struct nlm_host *, struct nlm_file *,
                                         nlm_host_match_fn_t match);
@@ -198,7 +198,7 @@ void		  nlmsvc_grant_reply(struct nlm_cookie *, u32);
 /*
  * File handling for the server personality
  */
-u32               nlm_lookup_file(struct svc_rqst *, struct nlm_file **,
+__be32            nlm_lookup_file(struct svc_rqst *, struct nlm_file **,
                                         struct nfs_fh *);
 void              nlm_release_file(struct nlm_file *);
 void              nlmsvc_mark_resources(void);
diff --git a/include/linux/lockd/share.h b/include/linux/lockd/share.h
index cd7816e74c05..630c5bf69b07 100644
--- a/include/linux/lockd/share.h
+++ b/include/linux/lockd/share.h
@@ -21,9 +21,9 @@ struct nlm_share {
         u32                     s_mode;         /* deny mode */
 };
 
-u32     nlmsvc_share_file(struct nlm_host *, struct nlm_file *,
+__be32  nlmsvc_share_file(struct nlm_host *, struct nlm_file *,
                                                struct nlm_args *);
-u32     nlmsvc_unshare_file(struct nlm_host *, struct nlm_file *,
+__be32  nlmsvc_unshare_file(struct nlm_host *, struct nlm_file *,
                                                struct nlm_args *);
 void    nlmsvc_traverse_shares(struct nlm_host *, struct nlm_file *,
                                                nlm_host_match_fn_t);
diff --git a/include/linux/lockd/xdr.h b/include/linux/lockd/xdr.h
index bb0a0f1caa91..29e7d9fc9dad 100644
--- a/include/linux/lockd/xdr.h
+++ b/include/linux/lockd/xdr.h
@@ -13,6 +13,8 @@
 #include <linux/nfs.h>
 #include <linux/sunrpc/xdr.h>
 
+struct svc_rqst;
+
 #define NLM_MAXCOOKIELEN        32
 #define NLM_MAXSTRLEN           1024
 
@@ -22,6 +24,8 @@
 #define nlm_lck_blocked         __constant_htonl(NLM_LCK_BLOCKED)
 #define nlm_lck_denied_grace_period     __constant_htonl(NLM_LCK_DENIED_GRACE_PERIOD)
 
+#define nlm_drop_reply          __constant_htonl(30000)
+
 /* Lock info passed via NLM */
 struct nlm_lock {
         char *                  caller;
@@ -86,19 +90,19 @@ struct nlm_reboot {
  */
 #define NLMSVC_XDRSIZE          sizeof(struct nlm_args)
 
-int     nlmsvc_decode_testargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_encode_testres(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlmsvc_decode_lockargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_decode_cancargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_decode_unlockargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_encode_res(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlmsvc_decode_res(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlmsvc_encode_void(struct svc_rqst *, u32 *, void *);
-int     nlmsvc_decode_void(struct svc_rqst *, u32 *, void *);
-int     nlmsvc_decode_shareargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_encode_shareres(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlmsvc_decode_notify(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlmsvc_decode_reboot(struct svc_rqst *, u32 *, struct nlm_reboot *);
+int     nlmsvc_decode_testargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_encode_testres(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlmsvc_decode_lockargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_decode_cancargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_decode_unlockargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_encode_res(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlmsvc_decode_res(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlmsvc_encode_void(struct svc_rqst *, __be32 *, void *);
+int     nlmsvc_decode_void(struct svc_rqst *, __be32 *, void *);
+int     nlmsvc_decode_shareargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_encode_shareres(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlmsvc_decode_notify(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlmsvc_decode_reboot(struct svc_rqst *, __be32 *, struct nlm_reboot *);
 /*
 int     nlmclt_encode_testargs(struct rpc_rqst *, u32 *, struct nlm_args *);
 int     nlmclt_encode_lockargs(struct rpc_rqst *, u32 *, struct nlm_args *);
diff --git a/include/linux/lockd/xdr4.h b/include/linux/lockd/xdr4.h
index 3cc1ae25009b..dd12b4c9e613 100644
--- a/include/linux/lockd/xdr4.h
+++ b/include/linux/lockd/xdr4.h
@@ -23,19 +23,19 @@
 
 
 
-int     nlm4svc_decode_testargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_encode_testres(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlm4svc_decode_lockargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_decode_cancargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_decode_unlockargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_encode_res(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlm4svc_decode_res(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlm4svc_encode_void(struct svc_rqst *, u32 *, void *);
-int     nlm4svc_decode_void(struct svc_rqst *, u32 *, void *);
-int     nlm4svc_decode_shareargs(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_encode_shareres(struct svc_rqst *, u32 *, struct nlm_res *);
-int     nlm4svc_decode_notify(struct svc_rqst *, u32 *, struct nlm_args *);
-int     nlm4svc_decode_reboot(struct svc_rqst *, u32 *, struct nlm_reboot *);
+int     nlm4svc_decode_testargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_encode_testres(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlm4svc_decode_lockargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_decode_cancargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_decode_unlockargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_encode_res(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlm4svc_decode_res(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlm4svc_encode_void(struct svc_rqst *, __be32 *, void *);
+int     nlm4svc_decode_void(struct svc_rqst *, __be32 *, void *);
+int     nlm4svc_decode_shareargs(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_encode_shareres(struct svc_rqst *, __be32 *, struct nlm_res *);
+int     nlm4svc_decode_notify(struct svc_rqst *, __be32 *, struct nlm_args *);
+int     nlm4svc_decode_reboot(struct svc_rqst *, __be32 *, struct nlm_reboot *);
 /*
 int     nlmclt_encode_testargs(struct rpc_rqst *, u32 *, struct nlm_args *);
 int     nlmclt_encode_lockargs(struct rpc_rqst *, u32 *, struct nlm_args *);
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 1314ca0f29be..819f08f1310d 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -202,7 +202,7 @@ extern int lockdep_internal(void);
  */
 
 extern void lockdep_init_map(struct lockdep_map *lock, const char *name,
-                             struct lock_class_key *key);
+                             struct lock_class_key *key, int subclass);
 
 /*
  * Reinitialize a lock key - for cases where there is special locking or
@@ -211,9 +211,14 @@ extern void lockdep_init_map(struct lockdep_map *lock, const char *name,
  * or they are too narrow (they suffer from a false class-split):
  */
 #define lockdep_set_class(lock, key) \
-                lockdep_init_map(&(lock)->dep_map, #key, key)
+                lockdep_init_map(&(lock)->dep_map, #key, key, 0)
 #define lockdep_set_class_and_name(lock, key, name) \
-                lockdep_init_map(&(lock)->dep_map, name, key)
+                lockdep_init_map(&(lock)->dep_map, name, key, 0)
+#define lockdep_set_class_and_subclass(lock, key, sub) \
+                lockdep_init_map(&(lock)->dep_map, #key, key, sub)
+#define lockdep_set_subclass(lock, sub) \
+                lockdep_init_map(&(lock)->dep_map, #lock, \
+                                 (lock)->dep_map.key, sub)
 
 /*
  * Acquire a lock.
@@ -257,10 +262,14 @@ static inline int lockdep_internal(void)
 # define lock_release(l, n, i)                  do { } while (0)
 # define lockdep_init()                         do { } while (0)
 # define lockdep_info()                         do { } while (0)
-# define lockdep_init_map(lock, name, key)      do { (void)(key); } while (0)
+# define lockdep_init_map(lock, name, key, sub) do { (void)(key); } while (0)
 # define lockdep_set_class(lock, key)           do { (void)(key); } while (0)
 # define lockdep_set_class_and_name(lock, key, name) \
                 do { (void)(key); } while (0)
+#define lockdep_set_class_and_subclass(lock, key, sub) \
+                do { (void)(key); } while (0)
+#define lockdep_set_subclass(lock, sub)         do { } while (0)
+
 # define INIT_LOCKDEP
 # define lockdep_reset()                do { debug_locks = 1; } while (0)
 # define lockdep_free_key_range(start, size)    do { } while (0)
diff --git a/include/linux/magic.h b/include/linux/magic.h
index 22036dd2ba36..156c40fc664e 100644
--- a/include/linux/magic.h
+++ b/include/linux/magic.h
@@ -8,6 +8,7 @@
 #define EFS_SUPER_MAGIC         0x414A53
 #define EXT2_SUPER_MAGIC        0xEF53
 #define EXT3_SUPER_MAGIC        0xEF53
+#define EXT4_SUPER_MAGIC        0xEF53
 #define HPFS_SUPER_MAGIC        0xf995e849
 #define ISOFS_SUPER_MAGIC       0x9660
 #define JFFS2_SUPER_MAGIC       0x72b6
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 09f0f575ddff..daabb3aa1ec6 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -150,7 +150,7 @@ extern void mpol_rebind_mm(struct mm_struct *mm, nodemask_t *new);
 extern void mpol_fix_fork_child_flag(struct task_struct *p);
 #define set_cpuset_being_rebound(x) (cpuset_being_rebound = (x))
 
-#ifdef CONFIG_CPUSET
+#ifdef CONFIG_CPUSETS
 #define current_cpuset_is_being_rebound() \
                                 (cpuset_being_rebound == current->cpuset)
 #else
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 26146623be2f..d538de901965 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1103,12 +1103,7 @@ static inline void vm_stat_account(struct mm_struct *mm,
 
 #ifndef CONFIG_DEBUG_PAGEALLOC
 static inline void
-kernel_map_pages(struct page *page, int numpages, int enable)
-{
-        if (!PageHighMem(page) && !enable)
-                debug_check_no_locks_freed(page_address(page),
-                                           numpages * PAGE_SIZE);
-}
+kernel_map_pages(struct page *page, int numpages, int enable) {}
 #endif
 
 extern struct vm_area_struct *get_gate_vma(struct task_struct *tsk);
@@ -1120,9 +1115,6 @@ int in_gate_area_no_task(unsigned long addr);
 #define in_gate_area(task, addr) ({(void)task; in_gate_area_no_task(addr);})
 #endif  /* __HAVE_ARCH_GATE_AREA */
 
-/* /proc/<pid>/oom_adj set to -17 protects from the oom-killer */
-#define OOM_DISABLE -17
-
 int drop_caches_sysctl_handler(struct ctl_table *, int, struct file *,
                                         void __user *, size_t *, loff_t *);
 unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask,
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 59855b8718a0..e06683e2bea3 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -218,13 +218,9 @@ struct zone {
          * under - it drives the swappiness decision: whether to unmap mapped
          * pages.
          *
-         * temp_priority is used to remember the scanning priority at which
-         * this zone was successfully refilled to free_pages == pages_high.
-         *
-         * Access to both these fields is quite racy even on uniprocessor.  But
+         * Access to both this field is quite racy even on uniprocessor.  But
          * it is expected to average out OK.
          */
-        int temp_priority;
         int prev_priority;
 
 
@@ -674,6 +670,12 @@ void sparse_init(void);
 #define sparse_index_init(_sec, _nid)  do {} while (0)
 #endif /* CONFIG_SPARSEMEM */
 
+#ifdef CONFIG_NODES_SPAN_OTHER_NODES
+#define early_pfn_in_nid(pfn, nid)      (early_pfn_to_nid(pfn) == (nid))
+#else
+#define early_pfn_in_nid(pfn, nid)      (1)
+#endif
+
 #ifndef early_pfn_valid
 #define early_pfn_valid(pfn)    (1)
 #endif
diff --git a/include/linux/module.h b/include/linux/module.h
index 4b2d8091a410..d1d00ce8f4ed 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -317,9 +317,6 @@ struct module
         /* Am I unsafe to unload? */
         int unsafe;
 
-        /* Am I GPL-compatible */
-        int license_gplok;
-
         unsigned int taints;    /* same bits as kernel:tainted */
 
 #ifdef CONFIG_MODULE_UNLOAD
diff --git a/include/linux/msdos_fs.h b/include/linux/msdos_fs.h
index ce6c85815cbd..24a9ef1506b6 100644
--- a/include/linux/msdos_fs.h
+++ b/include/linux/msdos_fs.h
@@ -402,6 +402,8 @@ extern const struct file_operations fat_file_operations;
 extern struct inode_operations fat_file_inode_operations;
 extern int fat_notify_change(struct dentry * dentry, struct iattr * attr);
 extern void fat_truncate(struct inode *inode);
+extern int fat_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                       struct kstat *stat);
 
 /* fat/inode.c */
 extern void fat_attach(struct inode *inode, loff_t i_pos);
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 70420bbae82b..8b3ef4187219 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -355,7 +355,7 @@ struct nand_buffers {
  * @priv:               [OPTIONAL] pointer to private chip date
  * @errstat:            [OPTIONAL] hardware specific function to perform additional error status checks
  *                      (determine if errors are correctable)
- * @write_page          [REPLACEABLE] High-level page write function
+ * @write_page:         [REPLACEABLE] High-level page write function
  */
 
 struct nand_chip {
diff --git a/include/linux/nbd.h b/include/linux/nbd.h
index e712e7d47cc2..d6b6dc09ad97 100644
--- a/include/linux/nbd.h
+++ b/include/linux/nbd.h
@@ -15,6 +15,8 @@
 #ifndef LINUX_NBD_H
 #define LINUX_NBD_H
 
+#include <linux/types.h>
+
 #define NBD_SET_SOCK    _IO( 0xab, 0 )
 #define NBD_SET_BLKSIZE _IO( 0xab, 1 )
 #define NBD_SET_SIZE    _IO( 0xab, 2 )
diff --git a/include/linux/net.h b/include/linux/net.h
index c257f716e00f..15c733b816f0 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -19,6 +19,7 @@
 #define _LINUX_NET_H
 
 #include <linux/wait.h>
+#include <linux/random.h>
 #include <asm/socket.h>
 
 struct poll_table_struct;
@@ -193,9 +194,9 @@ extern int 	     sock_map_fd(struct socket *sock);
 extern struct socket *sockfd_lookup(int fd, int *err);
 #define              sockfd_put(sock) fput(sock->file)
 extern int           net_ratelimit(void);
-extern unsigned long net_random(void);
-extern void          net_srandom(unsigned long);
-extern void          net_random_init(void);
+
+#define net_random()            random32()
+#define net_srandom(seed)       srandom32(seed)
 
 extern int           kernel_sendmsg(struct socket *sock, struct msghdr *msg,
                                     struct kvec *vec, size_t num, size_t len);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 04319a76103a..022edfa97ed9 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -96,22 +96,6 @@ struct _xt_align
 /* Error verdict. */
 #define XT_ERROR_TARGET "ERROR"
 
-/*
- * New IP firewall options for [gs]etsockopt at the RAW IP level.
- * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define XT_BASE_CTL             64      /* base for firewall socket options */
-
-#define XT_SO_SET_REPLACE       (XT_BASE_CTL)
-#define XT_SO_SET_ADD_COUNTERS  (XT_BASE_CTL + 1)
-#define XT_SO_SET_MAX           XT_SO_SET_ADD_COUNTERS
-
-#define XT_SO_GET_INFO                  (XT_BASE_CTL)
-#define XT_SO_GET_ENTRIES               (XT_BASE_CTL + 1)
-#define XT_SO_GET_REVISION_MATCH        (XT_BASE_CTL + 2)
-#define XT_SO_GET_REVISION_TARGET       (XT_BASE_CTL + 3)
-#define XT_SO_GET_MAX                   XT_SO_GET_REVISION_TARGET
-
 #define SET_COUNTER(c,b,p) do { (c).bcnt = (b); (c).pcnt = (p); } while(0)
 #define ADD_COUNTER(c,b,p) do { (c).bcnt += (b); (c).pcnt += (p); } while(0)
 
diff --git a/include/linux/netfilter_arp/arp_tables.h b/include/linux/netfilter_arp/arp_tables.h
index 44e39b61d9e7..0be235418a2f 100644
--- a/include/linux/netfilter_arp/arp_tables.h
+++ b/include/linux/netfilter_arp/arp_tables.h
@@ -112,19 +112,20 @@ struct arpt_entry
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
  * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
  */
-#define ARPT_CTL_OFFSET         32
-#define ARPT_BASE_CTL           (XT_BASE_CTL+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_SET_REPLACE             (XT_SO_SET_REPLACE+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_ADD_COUNTERS        (XT_SO_SET_ADD_COUNTERS+ARPT_CTL_OFFSET)
-#define ARPT_SO_SET_MAX                 (XT_SO_SET_MAX+ARPT_CTL_OFFSET)
-
-#define ARPT_SO_GET_INFO                (XT_SO_GET_INFO+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_ENTRIES             (XT_SO_GET_ENTRIES+ARPT_CTL_OFFSET)
-/* #define ARPT_SO_GET_REVISION_MATCH   XT_SO_GET_REVISION_MATCH  */
-#define ARPT_SO_GET_REVISION_TARGET     (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
-#define ARPT_SO_GET_MAX                 (XT_SO_GET_REVISION_TARGET+ARPT_CTL_OFFSET)
+#define ARPT_BASE_CTL           96
+
+#define ARPT_SO_SET_REPLACE             (ARPT_BASE_CTL)
+#define ARPT_SO_SET_ADD_COUNTERS        (ARPT_BASE_CTL + 1)
+#define ARPT_SO_SET_MAX                 ARPT_SO_SET_ADD_COUNTERS
+
+#define ARPT_SO_GET_INFO                (ARPT_BASE_CTL)
+#define ARPT_SO_GET_ENTRIES             (ARPT_BASE_CTL + 1)
+/* #define ARPT_SO_GET_REVISION_MATCH   (APRT_BASE_CTL + 2) */
+#define ARPT_SO_GET_REVISION_TARGET     (ARPT_BASE_CTL + 3)
+#define ARPT_SO_GET_MAX                 (ARPT_SO_GET_REVISION_TARGET)
 
 /* CONTINUE verdict for targets */
 #define ARPT_CONTINUE XT_CONTINUE
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index a536bbdef145..4f06dad0bde9 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -101,18 +101,21 @@ struct ipt_entry
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use a raw
- * socket for this. Instead we check rights in the calls. */
-#define IPT_BASE_CTL            XT_BASE_CTL
-
-#define IPT_SO_SET_REPLACE      XT_SO_SET_REPLACE
-#define IPT_SO_SET_ADD_COUNTERS XT_SO_SET_ADD_COUNTERS
-#define IPT_SO_SET_MAX          XT_SO_SET_MAX
-
-#define IPT_SO_GET_INFO                 XT_SO_GET_INFO
-#define IPT_SO_GET_ENTRIES              XT_SO_GET_ENTRIES
-#define IPT_SO_GET_REVISION_MATCH       XT_SO_GET_REVISION_MATCH
-#define IPT_SO_GET_REVISION_TARGET      XT_SO_GET_REVISION_TARGET
-#define IPT_SO_GET_MAX                  XT_SO_GET_REVISION_TARGET
+ * socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in.h before adding new number here.
+ */
+#define IPT_BASE_CTL            64
+
+#define IPT_SO_SET_REPLACE      (IPT_BASE_CTL)
+#define IPT_SO_SET_ADD_COUNTERS (IPT_BASE_CTL + 1)
+#define IPT_SO_SET_MAX          IPT_SO_SET_ADD_COUNTERS
+
+#define IPT_SO_GET_INFO                 (IPT_BASE_CTL)
+#define IPT_SO_GET_ENTRIES              (IPT_BASE_CTL + 1)
+#define IPT_SO_GET_REVISION_MATCH       (IPT_BASE_CTL + 2)
+#define IPT_SO_GET_REVISION_TARGET      (IPT_BASE_CTL + 3)
+#define IPT_SO_GET_MAX                  IPT_SO_GET_REVISION_TARGET
 
 #define IPT_CONTINUE XT_CONTINUE
 #define IPT_RETURN XT_RETURN
diff --git a/include/linux/netfilter_ipv6/ip6_tables.h b/include/linux/netfilter_ipv6/ip6_tables.h
index d7a8e9c0dad0..4aed340401db 100644
--- a/include/linux/netfilter_ipv6/ip6_tables.h
+++ b/include/linux/netfilter_ipv6/ip6_tables.h
@@ -107,18 +107,21 @@ struct ip6t_entry
 /*
  * New IP firewall options for [gs]etsockopt at the RAW IP level.
  * Unlike BSD Linux inherits IP options so you don't have to use
- * a raw socket for this. Instead we check rights in the calls. */
-#define IP6T_BASE_CTL                   XT_BASE_CTL
-
-#define IP6T_SO_SET_REPLACE             XT_SO_SET_REPLACE
-#define IP6T_SO_SET_ADD_COUNTERS        XT_SO_SET_ADD_COUNTERS
-#define IP6T_SO_SET_MAX                 XT_SO_SET_MAX
-
-#define IP6T_SO_GET_INFO                XT_SO_GET_INFO
-#define IP6T_SO_GET_ENTRIES             XT_SO_GET_ENTRIES
-#define IP6T_SO_GET_REVISION_MATCH      XT_SO_GET_REVISION_MATCH
-#define IP6T_SO_GET_REVISION_TARGET     XT_SO_GET_REVISION_TARGET
-#define IP6T_SO_GET_MAX                 XT_SO_GET_REVISION_TARGET
+ * a raw socket for this. Instead we check rights in the calls.
+ *
+ * ATTENTION: check linux/in6.h before adding new number here.
+ */
+#define IP6T_BASE_CTL                   64
+
+#define IP6T_SO_SET_REPLACE             (IP6T_BASE_CTL)
+#define IP6T_SO_SET_ADD_COUNTERS        (IP6T_BASE_CTL + 1)
+#define IP6T_SO_SET_MAX                 IP6T_SO_SET_ADD_COUNTERS
+
+#define IP6T_SO_GET_INFO                (IP6T_BASE_CTL)
+#define IP6T_SO_GET_ENTRIES             (IP6T_BASE_CTL + 1)
+#define IP6T_SO_GET_REVISION_MATCH      (IP6T_BASE_CTL + 4)
+#define IP6T_SO_GET_REVISION_TARGET     (IP6T_BASE_CTL + 5)
+#define IP6T_SO_GET_MAX                 IP6T_SO_GET_REVISION_TARGET
 
 /* CONTINUE verdict for targets */
 #define IP6T_CONTINUE XT_CONTINUE
diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
index 76ff54846ada..45228c1a1195 100644
--- a/include/linux/nfs_fs.h
+++ b/include/linux/nfs_fs.h
@@ -157,7 +157,7 @@ struct nfs_inode {
          * This is the cookie verifier used for NFSv3 readdir
          * operations
          */
-        __u32                   cookieverf[2];
+        __be32                  cookieverf[2];
 
         /*
          * This is the list of dirty unwritten pages.
@@ -290,6 +290,7 @@ static inline int nfs_verify_change_attribute(struct inode *inode, unsigned long
  * linux/fs/nfs/inode.c
  */
 extern int nfs_sync_mapping(struct address_space *mapping);
+extern void nfs_zap_mapping(struct inode *inode, struct address_space *mapping);
 extern void nfs_zap_caches(struct inode *);
 extern struct inode *nfs_fhget(struct super_block *, struct nfs_fh *,
                                 struct nfs_fattr *);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index dc5397d9d23c..768c1ad5ff6f 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -266,7 +266,7 @@ struct nfs_writeargs {
 
 struct nfs_writeverf {
         enum nfs3_stable_how    committed;
-        __u32                   verifier[2];
+        __be32                  verifier[2];
 };
 
 struct nfs_writeres {
@@ -420,7 +420,7 @@ struct nfs3_createargs {
         unsigned int            len;
         struct iattr *          sattr;
         enum nfs3_createmode    createmode;
-        __u32                   verifier[2];
+        __be32                  verifier[2];
 };
 
 struct nfs3_mkdirargs {
@@ -467,7 +467,7 @@ struct nfs3_linkargs {
 struct nfs3_readdirargs {
         struct nfs_fh *         fh;
         __u64                   cookie;
-        __u32                   verf[2];
+        __be32                  verf[2];
         int                     plus;
         unsigned int            count;
         struct page **          pages;
@@ -503,7 +503,7 @@ struct nfs3_linkres {
 
 struct nfs3_readdirres {
         struct nfs_fattr *      dir_attr;
-        __u32 *                 verf;
+        __be32 *                verf;
         int                     plus;
 };
 
@@ -811,7 +811,7 @@ struct nfs_rpc_ops {
         int     (*pathconf) (struct nfs_server *, struct nfs_fh *,
                              struct nfs_pathconf *);
         int     (*set_capabilities)(struct nfs_server *, struct nfs_fh *);
-        u32 *   (*decode_dirent)(u32 *, struct nfs_entry *, int plus);
+        __be32 *(*decode_dirent)(__be32 *, struct nfs_entry *, int plus);
         void    (*read_setup)   (struct nfs_read_data *);
         int     (*read_done)  (struct rpc_task *, struct nfs_read_data *);
         void    (*write_setup)  (struct nfs_write_data *, int how);
diff --git a/include/linux/nfsd/cache.h b/include/linux/nfsd/cache.h
index c3a3557c2a5b..007480cd6a60 100644
--- a/include/linux/nfsd/cache.h
+++ b/include/linux/nfsd/cache.h
@@ -26,14 +26,14 @@ struct svc_cacherep {
                                 c_type,         /* status, buffer */
                                 c_secure : 1;   /* req came from port < 1024 */
         struct sockaddr_in      c_addr;
-        u32                     c_xid;
+        __be32                  c_xid;
         u32                     c_prot;
         u32                     c_proc;
         u32                     c_vers;
         unsigned long           c_timestamp;
         union {
                 struct kvec     u_vec;
-                u32             u_status;
+                __be32          u_status;
         }                       c_u;
 };
 
@@ -75,7 +75,7 @@ enum {
 void    nfsd_cache_init(void);
 void    nfsd_cache_shutdown(void);
 int     nfsd_cache_lookup(struct svc_rqst *, int);
-void    nfsd_cache_update(struct svc_rqst *, int, u32 *);
+void    nfsd_cache_update(struct svc_rqst *, int, __be32 *);
 
 #endif /* __KERNEL__ */
 #endif /* NFSCACHE_H */
diff --git a/include/linux/nfsd/export.h b/include/linux/nfsd/export.h
index 6e78ea969f49..045e38cdbe64 100644
--- a/include/linux/nfsd/export.h
+++ b/include/linux/nfsd/export.h
@@ -117,8 +117,8 @@ struct svc_export *	exp_parent(struct auth_domain *clp,
                                    struct cache_req *reqp);
 int                     exp_rootfh(struct auth_domain *, 
                                         char *path, struct knfsd_fh *, int maxsize);
-int                     exp_pseudoroot(struct auth_domain *, struct svc_fh *fhp, struct cache_req *creq);
-int                     nfserrno(int errno);
+__be32                  exp_pseudoroot(struct auth_domain *, struct svc_fh *fhp, struct cache_req *creq);
+__be32                  nfserrno(int errno);
 
 extern struct cache_detail svc_export_cache;
 
diff --git a/include/linux/nfsd/nfsd.h b/include/linux/nfsd/nfsd.h
index d0d4aae7085f..edb54c3171b3 100644
--- a/include/linux/nfsd/nfsd.h
+++ b/include/linux/nfsd/nfsd.h
@@ -50,7 +50,7 @@
  * Callback function for readdir
  */
 struct readdir_cd {
-        int                     err;    /* 0, nfserr, or nfserr_eof */
+        __be32                  err;    /* 0, nfserr, or nfserr_eof */
 };
 typedef int             (*encode_dent_fn)(struct readdir_cd *, const char *,
                                                 int, loff_t, ino_t, unsigned int);
@@ -64,7 +64,7 @@ extern struct svc_serv		*nfsd_serv;
  * Function prototypes.
  */
 int             nfsd_svc(unsigned short port, int nrservs);
-int             nfsd_dispatch(struct svc_rqst *rqstp, u32 *statp);
+int             nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp);
 
 /* nfsd/vfs.c */
 int             fh_lock_parent(struct svc_fh *, struct dentry *);
@@ -72,57 +72,57 @@ int		nfsd_racache_init(int);
 void            nfsd_racache_shutdown(void);
 int             nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
                                 struct svc_export **expp);
-int             nfsd_lookup(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_lookup(struct svc_rqst *, struct svc_fh *,
                                 const char *, int, struct svc_fh *);
-int             nfsd_setattr(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_setattr(struct svc_rqst *, struct svc_fh *,
                                 struct iattr *, int, time_t);
 #ifdef CONFIG_NFSD_V4
-int             nfsd4_set_nfs4_acl(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd4_set_nfs4_acl(struct svc_rqst *, struct svc_fh *,
                     struct nfs4_acl *);
 int             nfsd4_get_nfs4_acl(struct svc_rqst *, struct dentry *, struct nfs4_acl **);
 #endif /* CONFIG_NFSD_V4 */
-int             nfsd_create(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_create(struct svc_rqst *, struct svc_fh *,
                                 char *name, int len, struct iattr *attrs,
                                 int type, dev_t rdev, struct svc_fh *res);
 #ifdef CONFIG_NFSD_V3
-int             nfsd_access(struct svc_rqst *, struct svc_fh *, u32 *, u32 *);
-int             nfsd_create_v3(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_access(struct svc_rqst *, struct svc_fh *, u32 *, u32 *);
+__be32          nfsd_create_v3(struct svc_rqst *, struct svc_fh *,
                                 char *name, int len, struct iattr *attrs,
                                 struct svc_fh *res, int createmode,
-                                u32 *verifier, int *truncp);
-int             nfsd_commit(struct svc_rqst *, struct svc_fh *,
+                                u32 *verifier, int *truncp, int *created);
+__be32          nfsd_commit(struct svc_rqst *, struct svc_fh *,
                                 loff_t, unsigned long);
 #endif /* CONFIG_NFSD_V3 */
-int             nfsd_open(struct svc_rqst *, struct svc_fh *, int,
+__be32          nfsd_open(struct svc_rqst *, struct svc_fh *, int,
                                 int, struct file **);
 void            nfsd_close(struct file *);
-int             nfsd_read(struct svc_rqst *, struct svc_fh *, struct file *,
+__be32          nfsd_read(struct svc_rqst *, struct svc_fh *, struct file *,
                                 loff_t, struct kvec *, int, unsigned long *);
-int             nfsd_write(struct svc_rqst *, struct svc_fh *,struct file *,
+__be32          nfsd_write(struct svc_rqst *, struct svc_fh *,struct file *,
                                 loff_t, struct kvec *,int, unsigned long, int *);
-int             nfsd_readlink(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_readlink(struct svc_rqst *, struct svc_fh *,
                                 char *, int *);
-int             nfsd_symlink(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_symlink(struct svc_rqst *, struct svc_fh *,
                                 char *name, int len, char *path, int plen,
                                 struct svc_fh *res, struct iattr *);
-int             nfsd_link(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_link(struct svc_rqst *, struct svc_fh *,
                                 char *, int, struct svc_fh *);
-int             nfsd_rename(struct svc_rqst *,
+__be32          nfsd_rename(struct svc_rqst *,
                                 struct svc_fh *, char *, int,
                                 struct svc_fh *, char *, int);
-int             nfsd_remove(struct svc_rqst *,
+__be32          nfsd_remove(struct svc_rqst *,
                                 struct svc_fh *, char *, int);
-int             nfsd_unlink(struct svc_rqst *, struct svc_fh *, int type,
+__be32          nfsd_unlink(struct svc_rqst *, struct svc_fh *, int type,
                                 char *name, int len);
 int             nfsd_truncate(struct svc_rqst *, struct svc_fh *,
                                 unsigned long size);
-int             nfsd_readdir(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_readdir(struct svc_rqst *, struct svc_fh *,
                              loff_t *, struct readdir_cd *, encode_dent_fn);
-int             nfsd_statfs(struct svc_rqst *, struct svc_fh *,
+__be32          nfsd_statfs(struct svc_rqst *, struct svc_fh *,
                                 struct kstatfs *);
 
 int             nfsd_notify_change(struct inode *, struct iattr *);
-int             nfsd_permission(struct svc_export *, struct dentry *, int);
+__be32          nfsd_permission(struct svc_export *, struct dentry *, int);
 int             nfsd_sync_dir(struct dentry *dp);
 
 #if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
@@ -238,6 +238,7 @@ void		nfsd_lockd_shutdown(void);
 #define nfserr_badname          __constant_htonl(NFSERR_BADNAME)
 #define nfserr_cb_path_down     __constant_htonl(NFSERR_CB_PATH_DOWN)
 #define nfserr_locked           __constant_htonl(NFSERR_LOCKED)
+#define nfserr_replay_me        __constant_htonl(NFSERR_REPLAY_ME)
 
 /* error codes for internal use */
 /* if a request fails due to kmalloc failure, it gets dropped.
diff --git a/include/linux/nfsd/nfsfh.h b/include/linux/nfsd/nfsfh.h
index 069257ea99a0..f3b51d62ec7d 100644
--- a/include/linux/nfsd/nfsfh.h
+++ b/include/linux/nfsd/nfsfh.h
@@ -157,7 +157,7 @@ typedef struct svc_fh {
         __u64                   fh_post_size;   /* i_size */
         unsigned long           fh_post_blocks; /* i_blocks */
         unsigned long           fh_post_blksize;/* i_blksize */
-        __u32                   fh_post_rdev[2];/* i_rdev */
+        __be32                  fh_post_rdev[2];/* i_rdev */
         struct timespec         fh_post_atime;  /* i_atime */
         struct timespec         fh_post_mtime;  /* i_mtime */
         struct timespec         fh_post_ctime;  /* i_ctime */
@@ -209,9 +209,9 @@ extern char * SVCFH_fmt(struct svc_fh *fhp);
 /*
  * Function prototypes
  */
-u32     fh_verify(struct svc_rqst *, struct svc_fh *, int, int);
-int     fh_compose(struct svc_fh *, struct svc_export *, struct dentry *, struct svc_fh *);
-int     fh_update(struct svc_fh *);
+__be32  fh_verify(struct svc_rqst *, struct svc_fh *, int, int);
+__be32  fh_compose(struct svc_fh *, struct svc_export *, struct dentry *, struct svc_fh *);
+__be32  fh_update(struct svc_fh *);
 void    fh_put(struct svc_fh *);
 
 static __inline__ struct svc_fh *
diff --git a/include/linux/nfsd/state.h b/include/linux/nfsd/state.h
index 8bf23cf8b603..c3673f487e84 100644
--- a/include/linux/nfsd/state.h
+++ b/include/linux/nfsd/state.h
@@ -125,7 +125,7 @@ struct nfs4_client {
         char                    cl_recdir[HEXDIR_LEN]; /* recovery dir */
         nfs4_verifier           cl_verifier;    /* generated by client */
         time_t                  cl_time;        /* time of last lease renewal */
-        u32                     cl_addr;        /* client ipaddress */
+        __be32                  cl_addr;        /* client ipaddress */
         struct svc_cred         cl_cred;        /* setclientid principal */
         clientid_t              cl_clientid;    /* generated by server */
         nfs4_verifier           cl_confirm;     /* generated by server */
@@ -164,7 +164,7 @@ update_stateid(stateid_t *stateid)
  * is cached. 
  */
 struct nfs4_replay {
-        u32                     rp_status;
+        __be32                  rp_status;
         unsigned int            rp_buflen;
         char                    *rp_buf;
         unsigned                intrp_allocated;
@@ -273,19 +273,19 @@ struct nfs4_stateid {
         ((err) != nfserr_stale_stateid) &&      \
         ((err) != nfserr_bad_stateid))
 
-extern int nfsd4_renew(clientid_t *clid);
-extern int nfs4_preprocess_stateid_op(struct svc_fh *current_fh, 
+extern __be32 nfsd4_renew(clientid_t *clid);
+extern __be32 nfs4_preprocess_stateid_op(struct svc_fh *current_fh,
                 stateid_t *stateid, int flags, struct file **filp);
 extern void nfs4_lock_state(void);
 extern void nfs4_unlock_state(void);
 extern int nfs4_in_grace(void);
-extern int nfs4_check_open_reclaim(clientid_t *clid);
+extern __be32 nfs4_check_open_reclaim(clientid_t *clid);
 extern void put_nfs4_client(struct nfs4_client *clp);
 extern void nfs4_free_stateowner(struct kref *kref);
 extern void nfsd4_probe_callback(struct nfs4_client *clp);
 extern void nfsd4_cb_recall(struct nfs4_delegation *dp);
 extern void nfs4_put_delegation(struct nfs4_delegation *dp);
-extern int nfs4_make_rec_clidname(char *clidname, struct xdr_netobj *clname);
+extern __be32 nfs4_make_rec_clidname(char *clidname, struct xdr_netobj *clname);
 extern void nfsd4_init_recdir(char *recdir_name);
 extern int nfsd4_recdir_load(void);
 extern void nfsd4_shutdown_recdir(void);
diff --git a/include/linux/nfsd/xdr.h b/include/linux/nfsd/xdr.h
index 0e53de87d886..877192d3ae79 100644
--- a/include/linux/nfsd/xdr.h
+++ b/include/linux/nfsd/xdr.h
@@ -81,7 +81,7 @@ struct nfsd_readdirargs {
         struct svc_fh           fh;
         __u32                   cookie;
         __u32                   count;
-        u32 *                   buffer;
+        __be32 *                buffer;
 };
 
 struct nfsd_attrstat {
@@ -108,9 +108,9 @@ struct nfsd_readdirres {
         int                     count;
 
         struct readdir_cd       common;
-        u32 *                   buffer;
+        __be32 *                buffer;
         int                     buflen;
-        u32 *                   offset;
+        __be32 *                offset;
 };
 
 struct nfsd_statfsres {
@@ -135,43 +135,43 @@ union nfsd_xdrstore {
 #define NFS2_SVC_XDRSIZE        sizeof(union nfsd_xdrstore)
 
 
-int nfssvc_decode_void(struct svc_rqst *, u32 *, void *);
-int nfssvc_decode_fhandle(struct svc_rqst *, u32 *, struct nfsd_fhandle *);
-int nfssvc_decode_sattrargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_void(struct svc_rqst *, __be32 *, void *);
+int nfssvc_decode_fhandle(struct svc_rqst *, __be32 *, struct nfsd_fhandle *);
+int nfssvc_decode_sattrargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_sattrargs *);
-int nfssvc_decode_diropargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_diropargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_diropargs *);
-int nfssvc_decode_readargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_readargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_readargs *);
-int nfssvc_decode_writeargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_writeargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_writeargs *);
-int nfssvc_decode_createargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_createargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_createargs *);
-int nfssvc_decode_renameargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_renameargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_renameargs *);
-int nfssvc_decode_readlinkargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_readlinkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_readlinkargs *);
-int nfssvc_decode_linkargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_linkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_linkargs *);
-int nfssvc_decode_symlinkargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_symlinkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_symlinkargs *);
-int nfssvc_decode_readdirargs(struct svc_rqst *, u32 *,
+int nfssvc_decode_readdirargs(struct svc_rqst *, __be32 *,
                                 struct nfsd_readdirargs *);
-int nfssvc_encode_void(struct svc_rqst *, u32 *, void *);
-int nfssvc_encode_attrstat(struct svc_rqst *, u32 *, struct nfsd_attrstat *);
-int nfssvc_encode_diropres(struct svc_rqst *, u32 *, struct nfsd_diropres *);
-int nfssvc_encode_readlinkres(struct svc_rqst *, u32 *, struct nfsd_readlinkres *);
-int nfssvc_encode_readres(struct svc_rqst *, u32 *, struct nfsd_readres *);
-int nfssvc_encode_statfsres(struct svc_rqst *, u32 *, struct nfsd_statfsres *);
-int nfssvc_encode_readdirres(struct svc_rqst *, u32 *, struct nfsd_readdirres *);
+int nfssvc_encode_void(struct svc_rqst *, __be32 *, void *);
+int nfssvc_encode_attrstat(struct svc_rqst *, __be32 *, struct nfsd_attrstat *);
+int nfssvc_encode_diropres(struct svc_rqst *, __be32 *, struct nfsd_diropres *);
+int nfssvc_encode_readlinkres(struct svc_rqst *, __be32 *, struct nfsd_readlinkres *);
+int nfssvc_encode_readres(struct svc_rqst *, __be32 *, struct nfsd_readres *);
+int nfssvc_encode_statfsres(struct svc_rqst *, __be32 *, struct nfsd_statfsres *);
+int nfssvc_encode_readdirres(struct svc_rqst *, __be32 *, struct nfsd_readdirres *);
 
 int nfssvc_encode_entry(struct readdir_cd *, const char *name,
                                 int namlen, loff_t offset, ino_t ino, unsigned int);
 
-int nfssvc_release_fhandle(struct svc_rqst *, u32 *, struct nfsd_fhandle *);
+int nfssvc_release_fhandle(struct svc_rqst *, __be32 *, struct nfsd_fhandle *);
 
 /* Helper functions for NFSv2 ACL code */
-u32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, u32 *p, struct svc_fh *fhp);
-u32 *nfs2svc_decode_fh(u32 *p, struct svc_fh *fhp);
+__be32 *nfs2svc_encode_fattr(struct svc_rqst *rqstp, __be32 *p, struct svc_fh *fhp);
+__be32 *nfs2svc_decode_fh(__be32 *p, struct svc_fh *fhp);
 
 #endif /* LINUX_NFSD_H */
diff --git a/include/linux/nfsd/xdr3.h b/include/linux/nfsd/xdr3.h
index 474d882dc2f3..79963867b0d7 100644
--- a/include/linux/nfsd/xdr3.h
+++ b/include/linux/nfsd/xdr3.h
@@ -51,7 +51,7 @@ struct nfsd3_createargs {
         int                     len;
         int                     createmode;
         struct iattr            attrs;
-        __u32 *                 verf;
+        __be32 *                verf;
 };
 
 struct nfsd3_mknodargs {
@@ -98,8 +98,8 @@ struct nfsd3_readdirargs {
         __u64                   cookie;
         __u32                   dircount;
         __u32                   count;
-        __u32 *                 verf;
-        u32 *                   buffer;
+        __be32 *                verf;
+        __be32 *                buffer;
 };
 
 struct nfsd3_commitargs {
@@ -122,79 +122,79 @@ struct nfsd3_setaclargs {
 };
 
 struct nfsd3_attrstat {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         struct kstat            stat;
 };
 
 /* LOOKUP, CREATE, MKDIR, SYMLINK, MKNOD */
 struct nfsd3_diropres  {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           dirfh;
         struct svc_fh           fh;
 };
 
 struct nfsd3_accessres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         __u32                   access;
 };
 
 struct nfsd3_readlinkres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         __u32                   len;
 };
 
 struct nfsd3_readres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         unsigned long           count;
         int                     eof;
 };
 
 struct nfsd3_writeres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         unsigned long           count;
         int                     committed;
 };
 
 struct nfsd3_renameres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           ffh;
         struct svc_fh           tfh;
 };
 
 struct nfsd3_linkres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           tfh;
         struct svc_fh           fh;
 };
 
 struct nfsd3_readdirres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         int                     count;
-        __u32                   verf[2];
+        __be32                  verf[2];
 
         struct readdir_cd       common;
-        u32 *                   buffer;
+        __be32 *                buffer;
         int                     buflen;
-        u32 *                   offset;
-        u32 *                   offset1;
+        __be32 *                offset;
+        __be32 *                offset1;
         struct svc_rqst *       rqstp;
 
 };
 
 struct nfsd3_fsstatres {
-        __u32                   status;
+        __be32                  status;
         struct kstatfs          stats;
         __u32                   invarsec;
 };
 
 struct nfsd3_fsinfores {
-        __u32                   status;
+        __be32                  status;
         __u32                   f_rtmax;
         __u32                   f_rtpref;
         __u32                   f_rtmult;
@@ -207,7 +207,7 @@ struct nfsd3_fsinfores {
 };
 
 struct nfsd3_pathconfres {
-        __u32                   status;
+        __be32                  status;
         __u32                   p_link_max;
         __u32                   p_name_max;
         __u32                   p_no_trunc;
@@ -217,12 +217,12 @@ struct nfsd3_pathconfres {
 };
 
 struct nfsd3_commitres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
 };
 
 struct nfsd3_getaclres {
-        __u32                   status;
+        __be32                  status;
         struct svc_fh           fh;
         int                     mask;
         struct posix_acl        *acl_access;
@@ -266,70 +266,70 @@ union nfsd3_xdrstore {
 
 #define NFS3_SVC_XDRSIZE                sizeof(union nfsd3_xdrstore)
 
-int nfs3svc_decode_fhandle(struct svc_rqst *, u32 *, struct nfsd_fhandle *);
-int nfs3svc_decode_sattrargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_fhandle(struct svc_rqst *, __be32 *, struct nfsd_fhandle *);
+int nfs3svc_decode_sattrargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_sattrargs *);
-int nfs3svc_decode_diropargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_diropargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_diropargs *);
-int nfs3svc_decode_accessargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_accessargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_accessargs *);
-int nfs3svc_decode_readargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_readargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readargs *);
-int nfs3svc_decode_writeargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_writeargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_writeargs *);
-int nfs3svc_decode_createargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_createargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_createargs *);
-int nfs3svc_decode_mkdirargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_mkdirargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_createargs *);
-int nfs3svc_decode_mknodargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_mknodargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_mknodargs *);
-int nfs3svc_decode_renameargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_renameargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_renameargs *);
-int nfs3svc_decode_readlinkargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_readlinkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readlinkargs *);
-int nfs3svc_decode_linkargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_linkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_linkargs *);
-int nfs3svc_decode_symlinkargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_symlinkargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_symlinkargs *);
-int nfs3svc_decode_readdirargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_readdirargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readdirargs *);
-int nfs3svc_decode_readdirplusargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_readdirplusargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readdirargs *);
-int nfs3svc_decode_commitargs(struct svc_rqst *, u32 *,
+int nfs3svc_decode_commitargs(struct svc_rqst *, __be32 *,
                                 struct nfsd3_commitargs *);
-int nfs3svc_encode_voidres(struct svc_rqst *, u32 *, void *);
-int nfs3svc_encode_attrstat(struct svc_rqst *, u32 *,
+int nfs3svc_encode_voidres(struct svc_rqst *, __be32 *, void *);
+int nfs3svc_encode_attrstat(struct svc_rqst *, __be32 *,
                                 struct nfsd3_attrstat *);
-int nfs3svc_encode_wccstat(struct svc_rqst *, u32 *,
+int nfs3svc_encode_wccstat(struct svc_rqst *, __be32 *,
                                 struct nfsd3_attrstat *);
-int nfs3svc_encode_diropres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_diropres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_diropres *);
-int nfs3svc_encode_accessres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_accessres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_accessres *);
-int nfs3svc_encode_readlinkres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_readlinkres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readlinkres *);
-int nfs3svc_encode_readres(struct svc_rqst *, u32 *, struct nfsd3_readres *);
-int nfs3svc_encode_writeres(struct svc_rqst *, u32 *, struct nfsd3_writeres *);
-int nfs3svc_encode_createres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_readres(struct svc_rqst *, __be32 *, struct nfsd3_readres *);
+int nfs3svc_encode_writeres(struct svc_rqst *, __be32 *, struct nfsd3_writeres *);
+int nfs3svc_encode_createres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_diropres *);
-int nfs3svc_encode_renameres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_renameres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_renameres *);
-int nfs3svc_encode_linkres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_linkres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_linkres *);
-int nfs3svc_encode_readdirres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_readdirres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_readdirres *);
-int nfs3svc_encode_fsstatres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_fsstatres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_fsstatres *);
-int nfs3svc_encode_fsinfores(struct svc_rqst *, u32 *,
+int nfs3svc_encode_fsinfores(struct svc_rqst *, __be32 *,
                                 struct nfsd3_fsinfores *);
-int nfs3svc_encode_pathconfres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_pathconfres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_pathconfres *);
-int nfs3svc_encode_commitres(struct svc_rqst *, u32 *,
+int nfs3svc_encode_commitres(struct svc_rqst *, __be32 *,
                                 struct nfsd3_commitres *);
 
-int nfs3svc_release_fhandle(struct svc_rqst *, u32 *,
+int nfs3svc_release_fhandle(struct svc_rqst *, __be32 *,
                                 struct nfsd3_attrstat *);
-int nfs3svc_release_fhandle2(struct svc_rqst *, u32 *,
+int nfs3svc_release_fhandle2(struct svc_rqst *, __be32 *,
                                 struct nfsd3_fhandle_pair *);
 int nfs3svc_encode_entry(struct readdir_cd *, const char *name,
                                 int namlen, loff_t offset, ino_t ino,
@@ -338,9 +338,9 @@ int nfs3svc_encode_entry_plus(struct readdir_cd *, const char *name,
                                 int namlen, loff_t offset, ino_t ino,
                                 unsigned int);
 /* Helper functions for NFSv3 ACL code */
-u32 *nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, u32 *p,
+__be32 *nfs3svc_encode_post_op_attr(struct svc_rqst *rqstp, __be32 *p,
                                 struct svc_fh *fhp);
-u32 *nfs3svc_decode_fh(u32 *p, struct svc_fh *fhp);
+__be32 *nfs3svc_decode_fh(__be32 *p, struct svc_fh *fhp);
 
 
 #endif /* _LINUX_NFSD_XDR3_H */
diff --git a/include/linux/nfsd/xdr4.h b/include/linux/nfsd/xdr4.h
index 66e642762a07..45ca01b5f844 100644
--- a/include/linux/nfsd/xdr4.h
+++ b/include/linux/nfsd/xdr4.h
@@ -258,9 +258,9 @@ struct nfsd4_readdir {
         struct svc_fh * rd_fhp;             /* response */
 
         struct readdir_cd       common;
-        u32 *                   buffer;
+        __be32 *                buffer;
         int                     buflen;
-        u32 *                   offset;
+        __be32 *                offset;
 };
 
 struct nfsd4_release_lockowner {
@@ -334,7 +334,7 @@ struct nfsd4_write {
 
 struct nfsd4_op {
         int                                     opnum;
-        int                                     status;
+        __be32                                  status;
         union {
                 struct nfsd4_access             access;
                 struct nfsd4_close              close;
@@ -371,12 +371,12 @@ struct nfsd4_op {
 
 struct nfsd4_compoundargs {
         /* scratch variables for XDR decode */
-        u32 *                           p;
-        u32 *                           end;
+        __be32 *                        p;
+        __be32 *                        end;
         struct page **                  pagelist;
         int                             pagelen;
-        u32                             tmp[8];
-        u32 *                           tmpp;
+        __be32                          tmp[8];
+        __be32 *                        tmpp;
         struct tmpbuf {
                 struct tmpbuf *next;
                 void (*release)(const void *);
@@ -395,15 +395,15 @@ struct nfsd4_compoundargs {
 
 struct nfsd4_compoundres {
         /* scratch variables for XDR encode */
-        u32 *                           p;
-        u32 *                           end;
+        __be32 *                        p;
+        __be32 *                        end;
         struct xdr_buf *                xbuf;
         struct svc_rqst *               rqstp;
 
         u32                             taglen;
         char *                          tag;
         u32                             opcnt;
-        u32 *                           tagp; /* where to encode tag and  opcount */
+        __be32 *                        tagp; /* where to encode tag and  opcount */
 };
 
 #define NFS4_SVC_XDRSIZE                sizeof(struct nfsd4_compoundargs)
@@ -419,45 +419,45 @@ set_change_info(struct nfsd4_change_info *cinfo, struct svc_fh *fhp)
         cinfo->after_ctime_nsec = fhp->fh_post_ctime.tv_nsec;
 }
 
-int nfs4svc_encode_voidres(struct svc_rqst *, u32 *, void *);
-int nfs4svc_decode_compoundargs(struct svc_rqst *, u32 *, 
+int nfs4svc_encode_voidres(struct svc_rqst *, __be32 *, void *);
+int nfs4svc_decode_compoundargs(struct svc_rqst *, __be32 *,
                 struct nfsd4_compoundargs *);
-int nfs4svc_encode_compoundres(struct svc_rqst *, u32 *, 
+int nfs4svc_encode_compoundres(struct svc_rqst *, __be32 *,
                 struct nfsd4_compoundres *);
 void nfsd4_encode_operation(struct nfsd4_compoundres *, struct nfsd4_op *);
 void nfsd4_encode_replay(struct nfsd4_compoundres *resp, struct nfsd4_op *op);
-int nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
-                       struct dentry *dentry, u32 *buffer, int *countp, 
+__be32 nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
+                       struct dentry *dentry, __be32 *buffer, int *countp,
                        u32 *bmval, struct svc_rqst *);
-extern int nfsd4_setclientid(struct svc_rqst *rqstp, 
+extern __be32 nfsd4_setclientid(struct svc_rqst *rqstp,
                 struct nfsd4_setclientid *setclid);
-extern int nfsd4_setclientid_confirm(struct svc_rqst *rqstp, 
+extern __be32 nfsd4_setclientid_confirm(struct svc_rqst *rqstp,
                 struct nfsd4_setclientid_confirm *setclientid_confirm);
-extern int nfsd4_process_open1(struct nfsd4_open *open);
-extern int nfsd4_process_open2(struct svc_rqst *rqstp, 
+extern __be32 nfsd4_process_open1(struct nfsd4_open *open);
+extern __be32 nfsd4_process_open2(struct svc_rqst *rqstp,
                 struct svc_fh *current_fh, struct nfsd4_open *open);
-extern int nfsd4_open_confirm(struct svc_rqst *rqstp, 
+extern __be32 nfsd4_open_confirm(struct svc_rqst *rqstp,
                 struct svc_fh *current_fh, struct nfsd4_open_confirm *oc,
                 struct nfs4_stateowner **);
-extern  int nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
+extern __be32 nfsd4_close(struct svc_rqst *rqstp, struct svc_fh *current_fh,
                 struct nfsd4_close *close,
                 struct nfs4_stateowner **replay_owner);
-extern int nfsd4_open_downgrade(struct svc_rqst *rqstp, 
+extern __be32 nfsd4_open_downgrade(struct svc_rqst *rqstp,
                 struct svc_fh *current_fh, struct nfsd4_open_downgrade *od,
                 struct nfs4_stateowner **replay_owner);
-extern int nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
+extern __be32 nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh,
                 struct nfsd4_lock *lock,
                 struct nfs4_stateowner **replay_owner);
-extern int nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
+extern __be32 nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh,
                 struct nfsd4_lockt *lockt);
-extern int nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, 
+extern __be32 nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh,
                 struct nfsd4_locku *locku,
                 struct nfs4_stateowner **replay_owner);
-extern int
+extern __be32
 nfsd4_release_lockowner(struct svc_rqst *rqstp,
                 struct nfsd4_release_lockowner *rlockowner);
 extern void nfsd4_release_compoundargs(struct nfsd4_compoundargs *);
-extern int nfsd4_delegreturn(struct svc_rqst *rqstp,
+extern __be32 nfsd4_delegreturn(struct svc_rqst *rqstp,
                 struct svc_fh *current_fh, struct nfsd4_delegreturn *dr);
 #endif
 
diff --git a/include/linux/nodemask.h b/include/linux/nodemask.h
index 5dce5c21822c..b1063e9cdb1b 100644
--- a/include/linux/nodemask.h
+++ b/include/linux/nodemask.h
@@ -8,8 +8,8 @@
  * See detailed comments in the file linux/bitmap.h describing the
  * data type on which these nodemasks are based.
  *
- * For details of nodemask_scnprintf() and nodemask_parse(),
- * see bitmap_scnprintf() and bitmap_parse() in lib/bitmap.c.
+ * For details of nodemask_scnprintf() and nodemask_parse_user(),
+ * see bitmap_scnprintf() and bitmap_parse_user() in lib/bitmap.c.
  * For details of nodelist_scnprintf() and nodelist_parse(), see
  * bitmap_scnlistprintf() and bitmap_parselist(), also in bitmap.c.
  * For details of node_remap(), see bitmap_bitremap in lib/bitmap.c.
@@ -51,7 +51,7 @@
  * unsigned long *nodes_addr(mask)      Array of unsigned long's in mask
  *
  * int nodemask_scnprintf(buf, len, mask) Format nodemask for printing
- * int nodemask_parse(ubuf, ulen, mask) Parse ascii string as nodemask
+ * int nodemask_parse_user(ubuf, ulen, mask)    Parse ascii string as nodemask
  * int nodelist_scnprintf(buf, len, mask) Format nodemask as list for printing
  * int nodelist_parse(buf, map)         Parse ascii string as nodelist
  * int node_remap(oldbit, old, new)     newbit = map(old, new)(oldbit)
@@ -288,12 +288,12 @@ static inline int __nodemask_scnprintf(char *buf, int len,
         return bitmap_scnprintf(buf, len, srcp->bits, nbits);
 }
 
-#define nodemask_parse(ubuf, ulen, dst) \
-                        __nodemask_parse((ubuf), (ulen), &(dst), MAX_NUMNODES)
-static inline int __nodemask_parse(const char __user *buf, int len,
+#define nodemask_parse_user(ubuf, ulen, dst) \
+                __nodemask_parse_user((ubuf), (ulen), &(dst), MAX_NUMNODES)
+static inline int __nodemask_parse_user(const char __user *buf, int len,
                                         nodemask_t *dstp, int nbits)
 {
-        return bitmap_parse(buf, len, dstp->bits, nbits);
+        return bitmap_parse_user(buf, len, dstp->bits, nbits);
 }
 
 #define nodelist_scnprintf(buf, len, src) \
diff --git a/include/linux/oom.h b/include/linux/oom.h
new file mode 100644
index 000000000000..ad76463629a0
--- /dev/null
+++ b/include/linux/oom.h
@@ -0,0 +1,10 @@
+#ifndef __INCLUDE_LINUX_OOM_H
+#define __INCLUDE_LINUX_OOM_H
+
+/* /proc/<pid>/oom_adj set to -17 protects from the oom-killer */
+#define OOM_DISABLE (-17)
+/* inclusive */
+#define OOM_ADJUST_MIN (-16)
+#define OOM_ADJUST_MAX 15
+
+#endif
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 64f950925151..c3e255bf8594 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -52,19 +52,23 @@ static inline void mapping_set_gfp_mask(struct address_space *m, gfp_t mask)
 void release_pages(struct page **pages, int nr, int cold);
 
 #ifdef CONFIG_NUMA
-extern struct page *page_cache_alloc(struct address_space *x);
-extern struct page *page_cache_alloc_cold(struct address_space *x);
+extern struct page *__page_cache_alloc(gfp_t gfp);
 #else
+static inline struct page *__page_cache_alloc(gfp_t gfp)
+{
+        return alloc_pages(gfp, 0);
+}
+#endif
+
 static inline struct page *page_cache_alloc(struct address_space *x)
 {
-        return alloc_pages(mapping_gfp_mask(x), 0);
+        return __page_cache_alloc(mapping_gfp_mask(x));
 }
 
 static inline struct page *page_cache_alloc_cold(struct address_space *x)
 {
-        return alloc_pages(mapping_gfp_mask(x)|__GFP_COLD, 0);
+        return __page_cache_alloc(mapping_gfp_mask(x)|__GFP_COLD);
 }
-#endif
 
 typedef int filler_t(void *, struct page *);
 
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 5c604f5fad67..09be0f81b27b 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -443,6 +443,7 @@ extern void pci_remove_bus(struct pci_bus *b);
 extern void pci_remove_bus_device(struct pci_dev *dev);
 extern void pci_stop_bus_device(struct pci_dev *dev);
 void pci_setup_cardbus(struct pci_bus *bus);
+extern void pci_sort_breadthfirst(void);
 
 /* Generic PCI functions exported to card drivers */
 
@@ -452,13 +453,18 @@ struct pci_dev *pci_find_slot (unsigned int bus, unsigned int devfn);
 int pci_find_capability (struct pci_dev *dev, int cap);
 int pci_find_next_capability (struct pci_dev *dev, u8 pos, int cap);
 int pci_find_ext_capability (struct pci_dev *dev, int cap);
-struct pci_bus * pci_find_next_bus(const struct pci_bus *from);
+struct pci_bus *pci_find_next_bus(const struct pci_bus *from);
+
+struct pci_dev *pci_get_device(unsigned int vendor, unsigned int device,
+                                struct pci_dev *from);
+struct pci_dev *pci_get_device_reverse(unsigned int vendor, unsigned int device,
+                                struct pci_dev *from);
 
-struct pci_dev *pci_get_device (unsigned int vendor, unsigned int device, struct pci_dev *from);
 struct pci_dev *pci_get_subsys (unsigned int vendor, unsigned int device,
                                 unsigned int ss_vendor, unsigned int ss_device,
                                 struct pci_dev *from);
 struct pci_dev *pci_get_slot (struct pci_bus *bus, unsigned int devfn);
+struct pci_dev *pci_get_bus_and_slot (unsigned int bus, unsigned int devfn);
 struct pci_dev *pci_get_class (unsigned int class, struct pci_dev *from);
 int pci_dev_present(const struct pci_device_id *ids);
 
@@ -658,7 +664,12 @@ static inline struct pci_dev *pci_find_device(unsigned int vendor, unsigned int
 static inline struct pci_dev *pci_find_slot(unsigned int bus, unsigned int devfn)
 { return NULL; }
 
-static inline struct pci_dev *pci_get_device (unsigned int vendor, unsigned int device, struct pci_dev *from)
+static inline struct pci_dev *pci_get_device(unsigned int vendor,
+                                unsigned int device, struct pci_dev *from)
+{ return NULL; }
+
+static inline struct pci_dev *pci_get_device_reverse(unsigned int vendor,
+                                unsigned int device, struct pci_dev *from)
 { return NULL; }
 
 static inline struct pci_dev *pci_get_subsys (unsigned int vendor, unsigned int device,
diff --git a/drivers/pci/hotplug/pci_hotplug.h b/include/linux/pci_hotplug.h
index 772523dc3860..a675a05c4091 100644
--- a/drivers/pci/hotplug/pci_hotplug.h
+++ b/include/linux/pci_hotplug.h
@@ -22,7 +22,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- * Send feedback to <greg@kroah.com>
+ * Send feedback to <kristen.c.accardi@intel.com>
  *
  */
 #ifndef _PCI_HOTPLUG_H
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index f069df245469..fa4e1d799782 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1213,6 +1213,7 @@
 #define PCI_DEVICE_ID_NVIDIA_NVENET_21              0x0451
 #define PCI_DEVICE_ID_NVIDIA_NVENET_22              0x0452
 #define PCI_DEVICE_ID_NVIDIA_NVENET_23              0x0453
+#define PCI_DEVICE_ID_NVIDIA_NFORCE_MCP67_IDE       0x0560
 
 #define PCI_VENDOR_ID_IMS               0x10e0
 #define PCI_DEVICE_ID_IMS_TT128         0x9128
@@ -2351,3 +2352,5 @@
 #define PCI_DEVICE_ID_RME_DIGI32_PRO    0x9897
 #define PCI_DEVICE_ID_RME_DIGI32_8      0x9898
 
+#define PCI_VENDOR_ID_QUICKNET          0x15E2
+#define PCI_DEVICE_ID_QUICKNET_XJ       0x0500
diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
index c312a12ad2d6..c321316f1bc7 100644
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -371,6 +371,7 @@
 #define  PCI_EXP_DEVSTA_TRPND   0x20    /* Transactions Pending */
 #define PCI_EXP_LNKCAP          12      /* Link Capabilities */
 #define PCI_EXP_LNKCTL          16      /* Link Control */
+#define  PCI_EXP_LNKCTL_CLKREQ_EN 0x100 /* Enable clkreq */
 #define PCI_EXP_LNKSTA          18      /* Link Status */
 #define PCI_EXP_SLTCAP          20      /* Slot Capabilities */
 #define PCI_EXP_SLTCTL          24      /* Slot Control */
diff --git a/include/linux/personality.h b/include/linux/personality.h
index 80d780e5a8f5..012cd558189b 100644
--- a/include/linux/personality.h
+++ b/include/linux/personality.h
@@ -1,6 +1,8 @@
 #ifndef _LINUX_PERSONALITY_H
 #define _LINUX_PERSONALITY_H
 
+#ifdef __KERNEL__
+
 /*
  * Handling of different ABIs (personalities).
  */
@@ -12,6 +14,8 @@ extern int		register_exec_domain(struct exec_domain *);
 extern int              unregister_exec_domain(struct exec_domain *);
 extern int              __set_personality(unsigned long);
 
+#endif /* __KERNEL__ */
+
 /*
  * Flags for bug emulation.
  *
@@ -71,6 +75,7 @@ enum {
         PER_MASK =              0x00ff,
 };
 
+#ifdef __KERNEL__
 
 /*
  * Description of an execution domain.
@@ -109,6 +114,8 @@ struct exec_domain {
  * Change personality of the currently running process.
  */
 #define set_personality(pers) \
-        ((current->personality == pers) ? 0 : __set_personality(pers))
+        ((current->personality == (pers)) ? 0 : __set_personality(pers))
+
+#endif /* __KERNEL__ */
 
 #endif /* _LINUX_PERSONALITY_H */
diff --git a/include/linux/pm.h b/include/linux/pm.h
index 6b27e07aef19..070394e846d0 100644
--- a/include/linux/pm.h
+++ b/include/linux/pm.h
@@ -116,7 +116,9 @@ typedef int __bitwise suspend_disk_method_t;
 #define PM_DISK_PLATFORM        ((__force suspend_disk_method_t) 2)
 #define PM_DISK_SHUTDOWN        ((__force suspend_disk_method_t) 3)
 #define PM_DISK_REBOOT          ((__force suspend_disk_method_t) 4)
-#define PM_DISK_MAX             ((__force suspend_disk_method_t) 5)
+#define PM_DISK_TEST            ((__force suspend_disk_method_t) 5)
+#define PM_DISK_TESTPROC        ((__force suspend_disk_method_t) 6)
+#define PM_DISK_MAX             ((__force suspend_disk_method_t) 7)
 
 struct pm_ops {
         suspend_disk_method_t pm_disk_mode;
diff --git a/include/linux/raid/bitmap.h b/include/linux/raid/bitmap.h
index 84d887751855..ebd42a3710b4 100644
--- a/include/linux/raid/bitmap.h
+++ b/include/linux/raid/bitmap.h
@@ -146,16 +146,16 @@ enum bitmap_state {
 
 /* the superblock at the front of the bitmap file -- little endian */
 typedef struct bitmap_super_s {
-        __u32 magic;        /*  0  BITMAP_MAGIC */
-        __u32 version;      /*  4  the bitmap major for now, could change... */
-        __u8  uuid[16];     /*  8  128 bit uuid - must match md device uuid */
-        __u64 events;       /* 24  event counter for the bitmap (1)*/
-        __u64 events_cleared;/*32  event counter when last bit cleared (2) */
-        __u64 sync_size;    /* 40  the size of the md device's sync range(3) */
-        __u32 state;        /* 48  bitmap state information */
-        __u32 chunksize;    /* 52  the bitmap chunk size in bytes */
-        __u32 daemon_sleep; /* 56  seconds between disk flushes */
-        __u32 write_behind; /* 60  number of outstanding write-behind writes */
+        __le32 magic;        /*  0  BITMAP_MAGIC */
+        __le32 version;      /*  4  the bitmap major for now, could change... */
+        __u8  uuid[16];      /*  8  128 bit uuid - must match md device uuid */
+        __le64 events;       /* 24  event counter for the bitmap (1)*/
+        __le64 events_cleared;/*32  event counter when last bit cleared (2) */
+        __le64 sync_size;    /* 40  the size of the md device's sync range(3) */
+        __le32 state;        /* 48  bitmap state information */
+        __le32 chunksize;    /* 52  the bitmap chunk size in bytes */
+        __le32 daemon_sleep; /* 56  seconds between disk flushes */
+        __le32 write_behind; /* 60  number of outstanding write-behind writes */
 
         __u8  pad[256 - 64]; /* set to zero */
 } bitmap_super_t;
diff --git a/include/linux/raid/md_p.h b/include/linux/raid/md_p.h
index b6ebc69bae54..3f2cd98c508b 100644
--- a/include/linux/raid/md_p.h
+++ b/include/linux/raid/md_p.h
@@ -206,52 +206,52 @@ static inline __u64 md_event(mdp_super_t *sb) {
  */
 struct mdp_superblock_1 {
         /* constant array information - 128 bytes */
-        __u32   magic;          /* MD_SB_MAGIC: 0xa92b4efc - little endian */
-        __u32   major_version;  /* 1 */
-        __u32   feature_map;    /* bit 0 set if 'bitmap_offset' is meaningful */
-        __u32   pad0;           /* always set to 0 when writing */
+        __le32  magic;          /* MD_SB_MAGIC: 0xa92b4efc - little endian */
+        __le32  major_version;  /* 1 */
+        __le32  feature_map;    /* bit 0 set if 'bitmap_offset' is meaningful */
+        __le32  pad0;           /* always set to 0 when writing */
 
         __u8    set_uuid[16];   /* user-space generated. */
         char    set_name[32];   /* set and interpreted by user-space */
 
-        __u64   ctime;          /* lo 40 bits are seconds, top 24 are microseconds or 0*/
-        __u32   level;          /* -4 (multipath), -1 (linear), 0,1,4,5 */
-        __u32   layout;         /* only for raid5 and raid10 currently */
-        __u64   size;           /* used size of component devices, in 512byte sectors */
+        __le64  ctime;          /* lo 40 bits are seconds, top 24 are microseconds or 0*/
+        __le32  level;          /* -4 (multipath), -1 (linear), 0,1,4,5 */
+        __le32  layout;         /* only for raid5 and raid10 currently */
+        __le64  size;           /* used size of component devices, in 512byte sectors */
 
-        __u32   chunksize;      /* in 512byte sectors */
-        __u32   raid_disks;
-        __u32   bitmap_offset;  /* sectors after start of superblock that bitmap starts
+        __le32  chunksize;      /* in 512byte sectors */
+        __le32  raid_disks;
+        __le32  bitmap_offset;  /* sectors after start of superblock that bitmap starts
                                  * NOTE: signed, so bitmap can be before superblock
                                  * only meaningful of feature_map[0] is set.
                                  */
 
         /* These are only valid with feature bit '4' */
-        __u32   new_level;      /* new level we are reshaping to                */
-        __u64   reshape_position;       /* next address in array-space for reshape */
-        __u32   delta_disks;    /* change in number of raid_disks               */
-        __u32   new_layout;     /* new layout                                   */
-        __u32   new_chunk;      /* new chunk size (bytes)                       */
+        __le32  new_level;      /* new level we are reshaping to                */
+        __le64  reshape_position;       /* next address in array-space for reshape */
+        __le32  delta_disks;    /* change in number of raid_disks               */
+        __le32  new_layout;     /* new layout                                   */
+        __le32  new_chunk;      /* new chunk size (bytes)                       */
         __u8    pad1[128-124];  /* set to 0 when written */
 
         /* constant this-device information - 64 bytes */
-        __u64   data_offset;    /* sector start of data, often 0 */
-        __u64   data_size;      /* sectors in this device that can be used for data */
-        __u64   super_offset;   /* sector start of this superblock */
-        __u64   recovery_offset;/* sectors before this offset (from data_offset) have been recovered */
-        __u32   dev_number;     /* permanent identifier of this  device - not role in raid */
-        __u32   cnt_corrected_read; /* number of read errors that were corrected by re-writing */
+        __le64  data_offset;    /* sector start of data, often 0 */
+        __le64  data_size;      /* sectors in this device that can be used for data */
+        __le64  super_offset;   /* sector start of this superblock */
+        __le64  recovery_offset;/* sectors before this offset (from data_offset) have been recovered */
+        __le32  dev_number;     /* permanent identifier of this  device - not role in raid */
+        __le32  cnt_corrected_read; /* number of read errors that were corrected by re-writing */
         __u8    device_uuid[16]; /* user-space setable, ignored by kernel */
         __u8    devflags;       /* per-device flags.  Only one defined...*/
 #define WriteMostly1    1       /* mask for writemostly flag in above */
         __u8    pad2[64-57];    /* set to 0 when writing */
 
         /* array state information - 64 bytes */
-        __u64   utime;          /* 40 bits second, 24 btes microseconds */
-        __u64   events;         /* incremented when superblock updated */
-        __u64   resync_offset;  /* data before this offset (from data_offset) known to be in sync */
-        __u32   sb_csum;        /* checksum upto devs[max_dev] */
-        __u32   max_dev;        /* size of devs[] array to consider */
+        __le64  utime;          /* 40 bits second, 24 btes microseconds */
+        __le64  events;         /* incremented when superblock updated */
+        __le64  resync_offset;  /* data before this offset (from data_offset) known to be in sync */
+        __le32  sb_csum;        /* checksum upto devs[max_dev] */
+        __le32  max_dev;        /* size of devs[] array to consider */
         __u8    pad3[64-32];    /* set to 0 when writing */
 
         /* device state information. Indexed by dev_number.
@@ -260,7 +260,7 @@ struct mdp_superblock_1 {
          * into the 'roles' value.  If a device is spare or faulty, then it doesn't
          * have a meaningful role.
          */
-        __u16   dev_roles[0];   /* role in array, or 0xffff for a spare, or 0xfffe for faulty */
+        __le16  dev_roles[0];   /* role in array, or 0xffff for a spare, or 0xfffe for faulty */
 };
 
 /* feature_map bits */
diff --git a/include/linux/random.h b/include/linux/random.h
index 5d6456bcdeba..0248b30e306d 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -69,6 +69,9 @@ extern struct file_operations random_fops, urandom_fops;
 unsigned int get_random_int(void);
 unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len);
 
+u32 random32(void);
+void srandom32(u32 seed);
+
 #endif /* __KERNEL___ */
 
 #endif /* _LINUX_RANDOM_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6735c1cf334c..eafe4a7b8237 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -466,7 +466,6 @@ struct signal_struct {
         struct pacct_struct pacct;      /* per-process accounting information */
 #endif
 #ifdef CONFIG_TASKSTATS
-        spinlock_t stats_lock;
         struct taskstats *stats;
 #endif
 };
diff --git a/include/linux/security.h b/include/linux/security.h
index 9b5fea81f55e..b200b9856f32 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -882,7 +882,8 @@ struct request_sock;
  *      Check permission when a flow selects a xfrm_policy for processing
  *      XFRMs on a packet.  The hook is called when selecting either a
  *      per-socket policy or a generic xfrm policy.
- *      Return 0 if permission is granted.
+ *      Return 0 if permission is granted, -ESRCH otherwise, or -errno
+ *      on other errors.
  * @xfrm_state_pol_flow_match:
  *      @x contains the state to match.
  *      @xp contains the policy to check for a match.
@@ -891,6 +892,7 @@ struct request_sock;
  * @xfrm_flow_state_match:
  *      @fl contains the flow key to match.
  *      @xfrm points to the xfrm_state to match.
+ *      @xp points to the xfrm_policy to match.
  *      Return 1 if there is a match.
  * @xfrm_decode_session:
  *      @skb points to skb to decode.
@@ -1388,7 +1390,8 @@ struct security_operations {
         int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
         int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
                         struct xfrm_policy *xp, struct flowi *fl);
-        int (*xfrm_flow_state_match)(struct flowi *fl, struct xfrm_state *xfrm);
+        int (*xfrm_flow_state_match)(struct flowi *fl, struct xfrm_state *xfrm,
+                        struct xfrm_policy *xp);
         int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 
@@ -3120,11 +3123,6 @@ static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm
         return security_ops->xfrm_policy_alloc_security(xp, sec_ctx, NULL);
 }
 
-static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
-{
-        return security_ops->xfrm_policy_alloc_security(xp, NULL, sk);
-}
-
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
 {
         return security_ops->xfrm_policy_clone_security(old, new);
@@ -3175,9 +3173,10 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
         return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
 }
 
-static inline int security_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm)
+static inline int security_xfrm_flow_state_match(struct flowi *fl,
+                        struct xfrm_state *xfrm, struct xfrm_policy *xp)
 {
-        return security_ops->xfrm_flow_state_match(fl, xfrm);
+        return security_ops->xfrm_flow_state_match(fl, xfrm, xp);
 }
 
 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
@@ -3197,11 +3196,6 @@ static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm
         return 0;
 }
 
-static inline int security_xfrm_sock_policy_alloc(struct xfrm_policy *xp, struct sock *sk)
-{
-        return 0;
-}
-
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
 {
         return 0;
@@ -3249,7 +3243,7 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
 }
 
 static inline int security_xfrm_flow_state_match(struct flowi *fl,
-                                struct xfrm_state *xfrm)
+                        struct xfrm_state *xfrm, struct xfrm_policy *xp)
 {
         return 1;
 }
diff --git a/include/linux/serio.h b/include/linux/serio.h
index 3a697cc6ecae..b99c5ca9708d 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -41,6 +41,7 @@ struct serio {
         void (*stop)(struct serio *);
 
         struct serio *parent, *child;
+        unsigned int depth;             /* level of nesting in serio hierarchy */
 
         struct serio_driver *drv;       /* accessed from interrupt, must be protected by serio->lock and serio->sem */
         struct mutex drv_mutex;         /* protects serio->drv so attributes can pin driver */
diff --git a/include/linux/sunrpc/msg_prot.h b/include/linux/sunrpc/msg_prot.h
index 1e65f2dd80e5..606cb2165232 100644
--- a/include/linux/sunrpc/msg_prot.h
+++ b/include/linux/sunrpc/msg_prot.h
@@ -56,7 +56,9 @@ enum rpc_accept_stat {
         RPC_PROG_MISMATCH = 2,
         RPC_PROC_UNAVAIL = 3,
         RPC_GARBAGE_ARGS = 4,
-        RPC_SYSTEM_ERR = 5
+        RPC_SYSTEM_ERR = 5,
+        /* internal use only */
+        RPC_DROP_REPLY = 60000,
 };
 
 enum rpc_reject_stat {
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 9c9a8ad92477..965d6c20086e 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -335,7 +335,7 @@ struct svc_version {
 /*
  * RPC procedure info
  */
-typedef int     (*svc_procfunc)(struct svc_rqst *, void *argp, void *resp);
+typedef __be32  (*svc_procfunc)(struct svc_rqst *, void *argp, void *resp);
 struct svc_procedure {
         svc_procfunc            pc_func;        /* process the request */
         kxdrproc_t              pc_decode;      /* XDR decode args */
diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h
index 953723b09bc6..ac69e5511606 100644
--- a/include/linux/sunrpc/xdr.h
+++ b/include/linux/sunrpc/xdr.h
@@ -74,6 +74,7 @@ struct xdr_buf {
 #define rpc_proc_unavail        __constant_htonl(RPC_PROC_UNAVAIL)
 #define rpc_garbage_args        __constant_htonl(RPC_GARBAGE_ARGS)
 #define rpc_system_err          __constant_htonl(RPC_SYSTEM_ERR)
+#define rpc_drop_reply          __constant_htonl(RPC_DROP_REPLY)
 
 #define rpc_auth_ok             __constant_htonl(RPC_AUTH_OK)
 #define rpc_autherr_badcred     __constant_htonl(RPC_AUTH_BADCRED)
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index b0ace3fd7eb9..1912c6cbef55 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -431,6 +431,10 @@ asmlinkage long sys_epoll_ctl(int epfd, int op, int fd,
                                 struct epoll_event __user *event);
 asmlinkage long sys_epoll_wait(int epfd, struct epoll_event __user *events,
                                 int maxevents, int timeout);
+asmlinkage long sys_epoll_pwait(int epfd, struct epoll_event __user *events,
+                                int maxevents, int timeout,
+                                const sigset_t __user *sigmask,
+                                size_t sigsetsize);
 asmlinkage long sys_gethostname(char __user *name, int len);
 asmlinkage long sys_sethostname(char __user *name, int len);
 asmlinkage long sys_setdomainname(char __user *name, int len);
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 1b24bd45e080..d98562f1df76 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -6,10 +6,17 @@
  ****************************************************************
  ****************************************************************
  **
+ **  WARNING:
  **  The values in this file are exported to user space via 
- **  the sysctl() binary interface.  However this interface
- **  is unstable and deprecated and will be removed in the future. 
- **  For a stable interface use /proc/sys.
+ **  the sysctl() binary interface.  Do *NOT* change the
+ **  numbering of any existing values here, and do not change
+ **  any numbers within any one set of values.  If you have to
+ **  have to redefine an existing interface, use a new number for it.
+ **  The kernel will then return -ENOTDIR to any application using
+ **  the old binary interface.
+ **
+ **  For new interfaces unless you really need a binary number
+ **  please use CTL_UNNUMBERED.
  **
  ****************************************************************
  ****************************************************************
@@ -48,6 +55,7 @@ struct __sysctl_args {
 #ifdef __KERNEL__
 #define CTL_ANY         -1      /* Matches any name */
 #define CTL_NONE        0
+#define CTL_UNNUMBERED  CTL_NONE        /* sysctl without a binary number */
 #endif
 
 enum
@@ -961,8 +969,8 @@ extern ctl_handler sysctl_ms_jiffies;
 /*
  * Register a set of sysctl names by calling register_sysctl_table
  * with an initialised array of ctl_table's.  An entry with zero
- * ctl_name terminates the table.  table->de will be set up by the
- * registration and need not be initialised in advance.
+ * ctl_name and NULL procname terminates the table.  table->de will be
+ * set up by the registration and need not be initialised in advance.
  *
  * sysctl names can be mirrored automatically under /proc/sys.  The
  * procname supplied controls /proc naming.
@@ -973,7 +981,10 @@ extern ctl_handler sysctl_ms_jiffies;
  * Leaf nodes in the sysctl tree will be represented by a single file
  * under /proc; non-leaf nodes will be represented by directories.  A
  * null procname disables /proc mirroring at this node.
- * 
+ *
+ * sysctl entries with a zero ctl_name will not be available through
+ * the binary sysctl interface.
+ *
  * sysctl(2) can automatically manage read and write requests through
  * the sysctl table.  The data and maxlen fields of the ctl_table
  * struct enable minimal validation of the values being written to be
diff --git a/include/linux/taskstats_kern.h b/include/linux/taskstats_kern.h
index 16894b7edcc8..6562a2050a25 100644
--- a/include/linux/taskstats_kern.h
+++ b/include/linux/taskstats_kern.h
@@ -23,25 +23,26 @@ static inline void taskstats_exit_free(struct taskstats *tidstats)
 
 static inline void taskstats_tgid_init(struct signal_struct *sig)
 {
-        spin_lock_init(&sig->stats_lock);
         sig->stats = NULL;
 }
 
-static inline void taskstats_tgid_alloc(struct signal_struct *sig)
+static inline void taskstats_tgid_alloc(struct task_struct *tsk)
 {
+        struct signal_struct *sig = tsk->signal;
         struct taskstats *stats;
-        unsigned long flags;
 
-        stats = kmem_cache_zalloc(taskstats_cache, SLAB_KERNEL);
-        if (!stats)
+        if (sig->stats != NULL)
                 return;
 
-        spin_lock_irqsave(&sig->stats_lock, flags);
+        /* No problem if kmem_cache_zalloc() fails */
+        stats = kmem_cache_zalloc(taskstats_cache, SLAB_KERNEL);
+
+        spin_lock_irq(&tsk->sighand->siglock);
         if (!sig->stats) {
                 sig->stats = stats;
                 stats = NULL;
         }
-        spin_unlock_irqrestore(&sig->stats_lock, flags);
+        spin_unlock_irq(&tsk->sighand->siglock);
 
         if (stats)
                 kmem_cache_free(taskstats_cache, stats);
@@ -49,23 +50,13 @@ static inline void taskstats_tgid_alloc(struct signal_struct *sig)
 
 static inline void taskstats_tgid_free(struct signal_struct *sig)
 {
-        struct taskstats *stats = NULL;
-        unsigned long flags;
-
-        spin_lock_irqsave(&sig->stats_lock, flags);
-        if (sig->stats) {
-                stats = sig->stats;
-                sig->stats = NULL;
-        }
-        spin_unlock_irqrestore(&sig->stats_lock, flags);
-        if (stats)
-                kmem_cache_free(taskstats_cache, stats);
+        if (sig->stats)
+                kmem_cache_free(taskstats_cache, sig->stats);
 }
 
 extern void taskstats_exit_alloc(struct taskstats **, unsigned int *);
 extern void taskstats_exit_send(struct task_struct *, struct taskstats *, int, unsigned int);
 extern void taskstats_init_early(void);
-extern void taskstats_tgid_alloc(struct signal_struct *);
 #else
 static inline void taskstats_exit_alloc(struct taskstats **ptidstats, unsigned int *mycpu)
 {}
@@ -77,7 +68,7 @@ static inline void taskstats_exit_send(struct task_struct *tsk,
 {}
 static inline void taskstats_tgid_init(struct signal_struct *sig)
 {}
-static inline void taskstats_tgid_alloc(struct signal_struct *sig)
+static inline void taskstats_tgid_alloc(struct task_struct *tsk)
 {}
 static inline void taskstats_tgid_free(struct signal_struct *sig)
 {}
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 0e058a2d1c6d..2d36f6db3706 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -342,6 +342,8 @@ struct tcp_sock {
 
         unsigned long last_synq_overflow; 
 
+        __u32   tso_deferred;
+
 /* Receiver side RTT estimation */
         struct {
                 __u32   rtt;
diff --git a/include/linux/tipc.h b/include/linux/tipc.h
index 243a15f54002..bea469455a0c 100644
--- a/include/linux/tipc.h
+++ b/include/linux/tipc.h
@@ -129,6 +129,7 @@ static inline unsigned int tipc_node(__u32 addr)
 
 #define TIPC_SUB_PORTS          0x01    /* filter for port availability */
 #define TIPC_SUB_SERVICE        0x02    /* filter for service availability */
+#define TIPC_SUB_CANCEL         0x04    /* cancel a subscription */
 #if 0
 /* The following filter options are not currently implemented */
 #define TIPC_SUB_NO_BIND_EVTS   0x04    /* filter out "publish" events */
diff --git a/include/linux/ufs_fs.h b/include/linux/ufs_fs.h
index 61eef508b041..28967eda9d7b 100644
--- a/include/linux/ufs_fs.h
+++ b/include/linux/ufs_fs.h
@@ -908,7 +908,7 @@ struct ufs_super_block_third {
                         __fs64   fs_csaddr;     /* blk addr of cyl grp summary area */
                         __fs64    fs_pendingblocks;/* blocks in process of being freed */
                         __fs32    fs_pendinginodes;/*inodes in process of being freed */
-                } fs_u2;
+                } __attribute__ ((packed)) fs_u2;
         } fs_un1;
         union {
                 struct {
diff --git a/include/linux/unwind.h b/include/linux/unwind.h
index 73e1751d03dd..749928c161fb 100644
--- a/include/linux/unwind.h
+++ b/include/linux/unwind.h
@@ -26,6 +26,7 @@ struct module;
  * Initialize unwind support.
  */
 extern void unwind_init(void);
+extern void unwind_setup(void);
 
 #ifdef CONFIG_MODULES
 
@@ -73,6 +74,7 @@ extern int unwind_to_user(struct unwind_frame_info *);
 struct unwind_frame_info {};
 
 static inline void unwind_init(void) {}
+static inline void unwind_setup(void) {}
 
 #ifdef CONFIG_MODULES
 
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index c5fdf6259548..df5c4654360d 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -243,7 +243,7 @@ struct v4l2_pix_format
 #define V4L2_PIX_FMT_YUV420  v4l2_fourcc('Y','U','1','2') /* 12  YUV 4:2:0     */
 #define V4L2_PIX_FMT_YYUV    v4l2_fourcc('Y','Y','U','V') /* 16  YUV 4:2:2     */
 #define V4L2_PIX_FMT_HI240   v4l2_fourcc('H','I','2','4') /*  8  8-bit color   */
-#define V4L2_PIX_FMT_HM12    v4l2_fourcc('H','M','1','2') /*  8  YUV 4:1:1 16x16 macroblocks */
+#define V4L2_PIX_FMT_HM12    v4l2_fourcc('H','M','1','2') /*  8  YUV 4:2:0 16x16 macroblocks */
 
 /* see http://www.siliconimaging.com/RGB%20Bayer.htm */
 #define V4L2_PIX_FMT_SBGGR8  v4l2_fourcc('B','A','8','1') /*  8  BGBG.. GRGR.. */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
index ce5f1482e6be..924e502905d4 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
@@ -23,13 +23,14 @@ struct vm_area_struct;
 #endif
 
 struct vm_struct {
+        /* keep next,addr,size together to speedup lookups */
+        struct vm_struct        *next;
         void                    *addr;
         unsigned long           size;
         unsigned long           flags;
         struct page             **pages;
         unsigned int            nr_pages;
         unsigned long           phys_addr;
-        struct vm_struct        *next;
 };
 
 /*
@@ -60,7 +61,8 @@ extern struct vm_struct *get_vm_area(unsigned long size, unsigned long flags);
 extern struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
                                         unsigned long start, unsigned long end);
 extern struct vm_struct *get_vm_area_node(unsigned long size,
-                                        unsigned long flags, int node);
+                                          unsigned long flags, int node,
+                                          gfp_t gfp_mask);
 extern struct vm_struct *remove_vm_area(void *addr);
 extern int map_vm_area(struct vm_struct *area, pgprot_t prot,
                         struct page ***pages);
diff --git a/include/linux/wait.h b/include/linux/wait.h
index b3b9048421d8..e820d00e1383 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -79,6 +79,15 @@ struct task_struct;
 
 extern void init_waitqueue_head(wait_queue_head_t *q);
 
+#ifdef CONFIG_LOCKDEP
+# define __WAIT_QUEUE_HEAD_INIT_ONSTACK(name) \
+        ({ init_waitqueue_head(&name); name; })
+# define DECLARE_WAIT_QUEUE_HEAD_ONSTACK(name) \
+        wait_queue_head_t name = __WAIT_QUEUE_HEAD_INIT_ONSTACK(name)
+#else
+# define DECLARE_WAIT_QUEUE_HEAD_ONSTACK(name) DECLARE_WAIT_QUEUE_HEAD(name)
+#endif
+
 static inline void init_waitqueue_entry(wait_queue_t *q, struct task_struct *p)
 {
         q->flags = 0;
diff --git a/include/linux/writeback.h b/include/linux/writeback.h
index a341c8032866..fc35e6bdfb93 100644
--- a/include/linux/writeback.h
+++ b/include/linux/writeback.h
@@ -85,7 +85,6 @@ int wakeup_pdflush(long nr_pages);
 void laptop_io_completion(void);
 void laptop_sync_completion(void);
 void throttle_vm_writeout(void);
-void writeback_congestion_end(void);
 
 /* These are exported to sysctl. */
 extern int dirty_background_ratio;
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index df22efcfcc0b..c0fc39620f36 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -153,6 +153,7 @@ struct hci_conn {
         __u8             mode;
         __u8             type;
         __u8             out;
+        __u8             attempt;
         __u8             dev_class[3];
         __u8             features[8];
         __u16            interval;
@@ -289,6 +290,22 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev,
         return NULL;
 }
 
+static inline struct hci_conn *hci_conn_hash_lookup_state(struct hci_dev *hdev,
+                                        __u8 type, __u16 state)
+{
+        struct hci_conn_hash *h = &hdev->conn_hash;
+        struct list_head *p;
+        struct hci_conn  *c;
+
+        list_for_each(p, &h->list) {
+                c = list_entry(p, struct hci_conn, list);
+                if (c->type == type && c->state == state)
+                        return c;
+        }
+        return NULL;
+}
+
+void hci_acl_connect(struct hci_conn *conn);
 void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
 void hci_add_sco(struct hci_conn *conn, __u16 handle);
 
diff --git a/include/net/dn.h b/include/net/dn.h
index 465b78302782..ac4ce9091747 100644
--- a/include/net/dn.h
+++ b/include/net/dn.h
@@ -199,11 +199,6 @@ static inline void dn_sk_ports_copy(struct flowi *fl, struct dn_scp *scp)
 {
         fl->uli_u.dnports.sport = scp->addrloc;
         fl->uli_u.dnports.dport = scp->addrrem;
-        fl->uli_u.dnports.objnum = scp->addr.sdn_objnum;
-        if (fl->uli_u.dnports.objnum == 0) {
-                fl->uli_u.dnports.objnamel = (__u8)dn_ntohs(scp->addr.sdn_objnamel);
-                memcpy(fl->uli_u.dnports.objname, scp->addr.sdn_objname, 16);
-        }
 }
 
 extern unsigned dn_mss_from_pmtu(struct net_device *dev, int mtu);
diff --git a/include/net/flow.h b/include/net/flow.h
index ddf5f3ca1720..5cda27cd9deb 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -68,9 +68,6 @@ struct flowi {
                 struct {
                         __le16  sport;
                         __le16  dport;
-                        __u8    objnum;
-                        __u8    objnamel; /* Not 16 bits since max val is 16 */
-                        __u8    objname[16]; /* Not zero terminated */
                 } dnports;
 
                 __be32          spi;
@@ -97,7 +94,7 @@ struct flowi {
 #define FLOW_DIR_FWD    2
 
 struct sock;
-typedef void (*flow_resolve_t)(struct flowi *key, u16 family, u8 dir,
+typedef int (*flow_resolve_t)(struct flowi *key, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp);
 
 extern void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
diff --git a/include/net/ieee80211softmac.h b/include/net/ieee80211softmac.h
index 425b3a57ac74..617b672b1132 100644
--- a/include/net/ieee80211softmac.h
+++ b/include/net/ieee80211softmac.h
@@ -63,13 +63,11 @@ struct ieee80211softmac_wpa {
 
 /*
  * Information about association
- *
- * Do we need a lock for this?
- * We only ever use this structure inlined
- * into our global struct. I've used its lock,
- * but maybe we need a local one here?
  */
 struct ieee80211softmac_assoc_info {
+
+        struct mutex mutex;
+
         /*
          * This is the requested ESSID. It is written
          * only by the WX handlers.
@@ -99,12 +97,13 @@ struct ieee80211softmac_assoc_info {
          *
          * bssfixed is used for SIOCSIWAP.
          */
-        u8 static_essid:1,
-           short_preamble_available:1,
-           associating:1,
-           assoc_wait:1,
-           bssvalid:1,
-           bssfixed:1;
+        u8 static_essid;
+        u8 short_preamble_available;
+        u8 associating;
+        u8 associated;
+        u8 assoc_wait;
+        u8 bssvalid;
+        u8 bssfixed;
 
         /* Scan retries remaining */
         int scan_retry;
@@ -229,12 +228,10 @@ struct ieee80211softmac_device {
         /* private stuff follows */
         /* this lock protects this structure */
         spinlock_t lock;
-        
-        /* couple of flags */
-        u8 scanning:1, /* protects scanning from being done multiple times at once */
-           associated:1,
-           running:1;
-        
+
+        u8 running; /* SoftMAC started? */
+        u8 scanning;
+
         struct ieee80211softmac_scaninfo *scaninfo;
         struct ieee80211softmac_assoc_info associnfo;
         struct ieee80211softmac_bss_info bssinfo;
@@ -250,7 +247,7 @@ struct ieee80211softmac_device {
 
         /* we need to keep a list of network structs we copied */
         struct list_head network_list;
-        
+
         /* This must be the last item so that it points to the data
          * allocated beyond this structure by alloc_ieee80211 */
         u8 priv[0];
@@ -295,7 +292,7 @@ static inline u8 ieee80211softmac_suggest_txrate(struct ieee80211softmac_device
 {
         struct ieee80211softmac_txrates *txrates = &mac->txrates;
 
-        if (!mac->associated)
+        if (!mac->associnfo.associated)
                 return txrates->mgt_mcast_rate;
 
         /* We are associated, sending unicast frame */
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index d599c6bfbb86..7849844a4911 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -48,7 +48,7 @@ static inline __u8 INET_ECN_encapsulate(__u8 outer, __u8 inner)
 
 #define IP6_ECN_flow_xmit(sk, label) do {                               \
         if (INET_ECN_is_capable(inet_sk(sk)->tos))                      \
-                (label) |= __constant_htons(INET_ECN_ECT_0 << 4);       \
+                (label) |= htonl(INET_ECN_ECT_0 << 20);                 \
     } while (0)
 
 static inline int IP_ECN_set_ce(struct iphdr *iph)
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 6d14c22a00c5..5f48748fe017 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -196,6 +196,7 @@ static inline void inet_twsk_put(struct inet_timewait_sock *tw)
 {
         if (atomic_dec_and_test(&tw->tw_refcnt)) {
                 struct module *owner = tw->tw_prot->owner;
+                twsk_destructor((struct sock *)tw);
 #ifdef SOCK_REFCNT_DEBUG
                 printk(KERN_DEBUG "%s timewait_sock %p released\n",
                        tw->tw_prot->name, tw);
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 925573fd2aed..aa10a8178e70 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -17,14 +17,15 @@
 
 struct inet_peer
 {
+        /* group together avl_left,avl_right,v4daddr to speedup lookups */
         struct inet_peer        *avl_left, *avl_right;
-        struct inet_peer        *unused_next, **unused_prevp;
-        unsigned long           dtime;          /* the time of last use of not
-                                                 * referenced entries */
-        atomic_t                refcnt;
         __be32                  v4daddr;        /* peer's address */
         __u16                   avl_height;
         __u16                   ip_id_count;    /* IP ID for the next packet */
+        struct inet_peer        *unused_next, **unused_prevp;
+        __u32                   dtime;          /* the time of last use of not
+                                                 * referenced entries */
+        atomic_t                refcnt;
         atomic_t                rid;            /* Frag reception counter */
         __u32                   tcp_ts;
         unsigned long           tcp_ts_stamp;
@@ -35,21 +36,8 @@ void			inet_initpeers(void) __init;
 /* can be called with or without local BH being disabled */
 struct inet_peer        *inet_getpeer(__be32 daddr, int create);
 
-extern spinlock_t inet_peer_unused_lock;
-extern struct inet_peer **inet_peer_unused_tailp;
 /* can be called from BH context or outside */
-static inline void      inet_putpeer(struct inet_peer *p)
-{
-        spin_lock_bh(&inet_peer_unused_lock);
-        if (atomic_dec_and_test(&p->refcnt)) {
-                p->unused_prevp = inet_peer_unused_tailp;
-                p->unused_next = NULL;
-                *inet_peer_unused_tailp = p;
-                inet_peer_unused_tailp = &p->unused_next;
-                p->dtime = jiffies;
-        }
-        spin_unlock_bh(&inet_peer_unused_lock);
-}
+extern void inet_putpeer(struct inet_peer *p);
 
 extern spinlock_t inet_peer_idlock;
 /* can be called with or without local BH being disabled */
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index 6ca6b71dfe0f..c14b70ed4c57 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -36,13 +36,6 @@ struct route_info {
 #define RT6_LOOKUP_F_REACHABLE  0x2
 #define RT6_LOOKUP_F_HAS_SADDR  0x4
 
-struct pol_chain {
-        int                     type;
-        int                     priority;
-        struct fib6_node        *rules;
-        struct pol_chain        *next;
-};
-
 extern struct rt6_info  ip6_null_entry;
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 82229146bac7..949b932d2f08 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -21,17 +21,14 @@
 #include <net/fib_rules.h>
 
 struct fib_config {
-        u8                      fc_family;
         u8                      fc_dst_len;
-        u8                      fc_src_len;
         u8                      fc_tos;
         u8                      fc_protocol;
         u8                      fc_scope;
         u8                      fc_type;
-        /* 1 byte unused */
+        /* 3 bytes unused */
         u32                     fc_table;
         __be32                  fc_dst;
-        __be32                  fc_src;
         __be32                  fc_gw;
         int                     fc_oif;
         u32                     fc_flags;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 49c717e3b040..903108e583f8 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -7,6 +7,7 @@
 #define _IP_VS_H
 
 #include <asm/types.h>          /* For __uXX types */
+#include <linux/types.h>        /* For __beXX types in userland */
 
 #define IP_VS_VERSION_CODE      0x010201
 #define NVERSION(version)                       \
diff --git a/include/net/ipx.h b/include/net/ipx.h
index 5c0cf33826c5..c6b2ee610866 100644
--- a/include/net/ipx.h
+++ b/include/net/ipx.h
@@ -15,9 +15,9 @@
 #include <linux/list.h>
 
 struct ipx_address {
-        __u32   net;
+        __be32  net;
         __u8    node[IPX_NODE_LEN]; 
-        __u16   sock;
+        __be16  sock;
 };
 
 #define ipx_broadcast_node      "\377\377\377\377\377\377"
@@ -26,9 +26,9 @@ struct ipx_address {
 #define IPX_MAX_PPROP_HOPS 8
 
 struct ipxhdr {
-        __u16                   ipx_checksum __attribute__ ((packed));
-#define IPX_NO_CHECKSUM 0xFFFF
-        __u16                   ipx_pktsize __attribute__ ((packed));
+        __be16                  ipx_checksum __attribute__ ((packed));
+#define IPX_NO_CHECKSUM __constant_htons(0xFFFF)
+        __be16                  ipx_pktsize __attribute__ ((packed));
         __u8                    ipx_tctrl;
         __u8                    ipx_type;
 #define IPX_TYPE_UNKNOWN        0x00
@@ -48,14 +48,14 @@ static __inline__ struct ipxhdr *ipx_hdr(struct sk_buff *skb)
 
 struct ipx_interface {
         /* IPX address */
-        __u32                   if_netnum;
+        __be32                  if_netnum;
         unsigned char           if_node[IPX_NODE_LEN];
         atomic_t                refcnt;
 
         /* physical device info */
         struct net_device       *if_dev;
         struct datalink_proto   *if_dlink;
-        unsigned short          if_dlink_type;
+        __be16                  if_dlink_type;
 
         /* socket support */
         unsigned short          if_sknum;
@@ -71,7 +71,7 @@ struct ipx_interface {
 };
 
 struct ipx_route {
-        __u32                   ir_net;
+        __be32                  ir_net;
         struct ipx_interface    *ir_intrfc;
         unsigned char           ir_routed;
         unsigned char           ir_router_node[IPX_NODE_LEN];
@@ -82,10 +82,10 @@ struct ipx_route {
 #ifdef __KERNEL__
 struct ipx_cb {
         u8      ipx_tctrl;
-        u32     ipx_dest_net;
-        u32     ipx_source_net;
+        __be32  ipx_dest_net;
+        __be32  ipx_source_net;
         struct {
-                u32 netnum;
+                __be32 netnum;
                 int index;
         } last_hop;
 };
@@ -97,7 +97,7 @@ struct ipx_sock {
         struct sock             sk;
         struct ipx_address      dest_addr;
         struct ipx_interface    *intrfc;
-        unsigned short          port;
+        __be16                  port;
 #ifdef CONFIG_IPX_INTERN
         unsigned char           node[IPX_NODE_LEN];
 #endif
@@ -132,7 +132,7 @@ extern struct ipx_interface *ipx_primary_net;
 extern int ipx_proc_init(void);
 extern void ipx_proc_exit(void);
 
-extern const char *ipx_frame_name(unsigned short);
+extern const char *ipx_frame_name(__be16);
 extern const char *ipx_device_name(struct ipx_interface *intrfc);
 
 static __inline__ void ipxitf_hold(struct ipx_interface *intrfc)
diff --git a/include/net/netlabel.h b/include/net/netlabel.h
index c63a58058e21..12c214b9eadf 100644
--- a/include/net/netlabel.h
+++ b/include/net/netlabel.h
@@ -34,6 +34,7 @@
 #include <linux/net.h>
 #include <linux/skbuff.h>
 #include <net/netlink.h>
+#include <asm/atomic.h>
 
 /*
  * NetLabel - A management interface for maintaining network packet label
@@ -106,6 +107,7 @@ int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info);
 
 /* LSM security attributes */
 struct netlbl_lsm_cache {
+        atomic_t refcount;
         void (*free) (const void *data);
         void *data;
 };
@@ -117,7 +119,7 @@ struct netlbl_lsm_secattr {
         unsigned char *mls_cat;
         size_t mls_cat_len;
 
-        struct netlbl_lsm_cache cache;
+        struct netlbl_lsm_cache *cache;
 };
 
 /*
@@ -126,6 +128,43 @@ struct netlbl_lsm_secattr {
 
 
 /**
+ * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache
+ * @flags: the memory allocation flags
+ *
+ * Description:
+ * Allocate and initialize a netlbl_lsm_cache structure.  Returns a pointer
+ * on success, NULL on failure.
+ *
+ */
+static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc(gfp_t flags)
+{
+        struct netlbl_lsm_cache *cache;
+
+        cache = kzalloc(sizeof(*cache), flags);
+        if (cache)
+                atomic_set(&cache->refcount, 1);
+        return cache;
+}
+
+/**
+ * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct
+ * @cache: the struct to free
+ *
+ * Description:
+ * Frees @secattr including all of the internal buffers.
+ *
+ */
+static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
+{
+        if (!atomic_dec_and_test(&cache->refcount))
+                return;
+
+        if (cache->free)
+                cache->free(cache->data);
+        kfree(cache);
+}
+
+/**
  * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct
  * @secattr: the struct to initialize
  *
@@ -143,20 +182,16 @@ static inline int netlbl_secattr_init(struct netlbl_lsm_secattr *secattr)
 /**
  * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct
  * @secattr: the struct to clear
- * @clear_cache: cache clear flag
  *
  * Description:
  * Destroys the @secattr struct, including freeing all of the internal buffers.
- * If @clear_cache is true then free the cache fields, otherwise leave them
- * intact.  The struct must be reset with a call to netlbl_secattr_init()
- * before reuse.
+ * The struct must be reset with a call to netlbl_secattr_init() before reuse.
  *
  */
-static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr,
-                                          u32 clear_cache)
+static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr)
 {
-        if (clear_cache && secattr->cache.data != NULL && secattr->cache.free)
-                secattr->cache.free(secattr->cache.data);
+        if (secattr->cache)
+                netlbl_secattr_cache_free(secattr->cache);
         kfree(secattr->domain);
         kfree(secattr->mls_cat);
 }
@@ -178,17 +213,14 @@ static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc(int flags)
 /**
  * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct
  * @secattr: the struct to free
- * @clear_cache: cache clear flag
  *
  * Description:
- * Frees @secattr including all of the internal buffers.  If @clear_cache is
- * true then free the cache fields, otherwise leave them intact.
+ * Frees @secattr including all of the internal buffers.
  *
  */
-static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr,
-                                       u32 clear_cache)
+static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
 {
-        netlbl_secattr_destroy(secattr, clear_cache);
+        netlbl_secattr_destroy(secattr);
         kfree(secattr);
 }
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index ee68a3124076..764e3af5be93 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -139,6 +139,7 @@ int sctp_inet_listen(struct socket *sock, int backlog);
 void sctp_write_space(struct sock *sk);
 unsigned int sctp_poll(struct file *file, struct socket *sock,
                 poll_table *wait);
+void sctp_sock_rfree(struct sk_buff *skb);
 
 /*
  * sctp/primitive.c
@@ -444,6 +445,19 @@ static inline struct list_head *sctp_list_dequeue(struct list_head *list)
         return result;
 }
 
+/* SCTP version of skb_set_owner_r.  We need this one because
+ * of the way we have to do receive buffer accounting on bundled
+ * chunks.
+ */
+static inline void sctp_skb_set_owner_r(struct sk_buff *skb, struct sock *sk)
+{
+        struct sctp_ulpevent *event = sctp_skb2event(skb);
+
+        skb->sk = sk;
+        skb->destructor = sctp_sock_rfree;
+        atomic_add(event->rmem_len, &sk->sk_rmem_alloc);
+}
+
 /* Tests if the list has one and only one entry. */
 static inline int sctp_list_single_entry(struct list_head *head)
 {
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 6c40cfc4832d..1a4ddc1ec7d2 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -63,6 +63,7 @@ struct sctp_ulpevent {
         __u32 cumtsn;
         int msg_flags;
         int iif;
+        unsigned int rmem_len;
 };
 
 /* Retrieve the skb this event sits inside of. */
diff --git a/include/net/sock.h b/include/net/sock.h
index 40bb90ebb2d1..ac286a353032 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -884,8 +884,7 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 
 /**
  *      sk_filter_release: Release a socket filter
- *      @sk: socket
- *      @fp: filter to remove
+ *      @rcu: rcu_head that contains the sk_filter info to remove
  *
  *      Remove a filter from a socket and release its resources.
  */
diff --git a/include/net/timewait_sock.h b/include/net/timewait_sock.h
index 2544281e1d5e..be293d795e38 100644
--- a/include/net/timewait_sock.h
+++ b/include/net/timewait_sock.h
@@ -19,6 +19,7 @@ struct timewait_sock_ops {
         unsigned int    twsk_obj_size;
         int             (*twsk_unique)(struct sock *sk,
                                        struct sock *sktw, void *twp);
+        void            (*twsk_destructor)(struct sock *sk);
 };
 
 static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
@@ -28,4 +29,10 @@ static inline int twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
         return 0;
 }
 
+static inline void twsk_destructor(struct sock *sk)
+{
+        if (sk->sk_prot->twsk_prot->twsk_destructor != NULL)
+                sk->sk_prot->twsk_prot->twsk_destructor(sk);
+}
+
 #endif /* _TIMEWAIT_SOCK_H */
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 1e2a4ddec96e..737fdb2ee8a4 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -995,7 +995,8 @@ struct xfrm_state * xfrm_find_acq(u8 mode, u32 reqid, u8 proto,
                                   int create, unsigned short family);
 extern void xfrm_policy_flush(u8 type);
 extern int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol);
-extern int xfrm_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl, int family, int strict);
+extern int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *xdst,
+                          struct flowi *fl, int family, int strict);
 extern void xfrm_init_pmtu(struct dst_entry *dst);
 
 extern wait_queue_head_t km_waitq;
diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
index 81b62307621d..c094e5012862 100644
--- a/include/rdma/ib_addr.h
+++ b/include/rdma/ib_addr.h
@@ -36,6 +36,22 @@
 #include <linux/socket.h>
 #include <rdma/ib_verbs.h>
 
+struct rdma_addr_client {
+        atomic_t refcount;
+        struct completion comp;
+};
+
+/**
+ * rdma_addr_register_client - Register an address client.
+ */
+void rdma_addr_register_client(struct rdma_addr_client *client);
+
+/**
+ * rdma_addr_unregister_client - Deregister an address client.
+ * @client: Client object to deregister.
+ */
+void rdma_addr_unregister_client(struct rdma_addr_client *client);
+
 struct rdma_dev_addr {
         unsigned char src_dev_addr[MAX_ADDR_LEN];
         unsigned char dst_dev_addr[MAX_ADDR_LEN];
@@ -52,6 +68,7 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr);
 /**
  * rdma_resolve_ip - Resolve source and destination IP addresses to
  *   RDMA hardware addresses.
+ * @client: Address client associated with request.
  * @src_addr: An optional source address to use in the resolution.  If a
  *   source address is not provided, a usable address will be returned via
  *   the callback.
@@ -64,7 +81,8 @@ int rdma_translate_ip(struct sockaddr *addr, struct rdma_dev_addr *dev_addr);
  *   or been canceled.  A status of 0 indicates success.
  * @context: User-specified context associated with the call.
  */
-int rdma_resolve_ip(struct sockaddr *src_addr, struct sockaddr *dst_addr,
+int rdma_resolve_ip(struct rdma_addr_client *client,
+                    struct sockaddr *src_addr, struct sockaddr *dst_addr,
                     struct rdma_dev_addr *addr, int timeout_ms,
                     void (*callback)(int status, struct sockaddr *src_addr,
                                      struct rdma_dev_addr *addr, void *context),
diff --git a/include/rdma/ib_user_verbs.h b/include/rdma/ib_user_verbs.h
index db1b814b62cc..64a721fcbc1c 100644
--- a/include/rdma/ib_user_verbs.h
+++ b/include/rdma/ib_user_verbs.h
@@ -458,7 +458,7 @@ struct ib_uverbs_query_qp_resp {
         __u8  cur_qp_state;
         __u8  path_mtu;
         __u8  path_mig_state;
-        __u8  en_sqd_async_notify;
+        __u8  sq_draining;
         __u8  max_rd_atomic;
         __u8  max_dest_rd_atomic;
         __u8  min_rnr_timer;
diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
index 401192e56e50..61eebec00a7b 100644
--- a/include/scsi/libiscsi.h
+++ b/include/scsi/libiscsi.h
@@ -136,7 +136,6 @@ struct iscsi_conn {
 
         /* control data */
         int                     id;             /* CID */
-        struct list_head        item;           /* maintains list of conns */
         int                     c_stage;        /* connection state */
         /*
          * Preallocated buffer for pdus that have data but do not
@@ -235,10 +234,8 @@ struct iscsi_session {
                                                  * - mgmtpool,             *
                                                  * - r2tpool               */
         int                     state;          /* session state           */
-        struct list_head        item;
         int                     age;            /* counts session re-opens */
 
-        struct list_head        connections;    /* list of connections */
         int                     cmds_max;       /* size of cmds array */
         struct iscsi_cmd_task   **cmds;         /* Original Cmds arr */
         struct iscsi_queue      cmdpool;        /* PDU's pool */
diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h
index 84a6d5fe0920..5c0e9791441c 100644
--- a/include/scsi/scsi.h
+++ b/include/scsi/scsi.h
@@ -97,6 +97,7 @@ extern const unsigned char scsi_command_size[8];
 #define PERSISTENT_RESERVE_IN 0x5e
 #define PERSISTENT_RESERVE_OUT 0x5f
 #define REPORT_LUNS           0xa0
+#define MAINTENANCE_IN        0xa3
 #define MOVE_MEDIUM           0xa5
 #define EXCHANGE_MEDIUM       0xa6
 #define READ_12               0xa8
@@ -114,6 +115,8 @@ extern const unsigned char scsi_command_size[8];
 #define SERVICE_ACTION_IN     0x9e
 /* values for service action in */
 #define SAI_READ_CAPACITY_16  0x10
+/* values for maintenance in */
+#define MI_REPORT_TARGET_PGS  0x0a
 
 /* Values for T10/04-262r7 */
 #define ATA_16                0x85      /* 16-byte pass-thru */
@@ -430,7 +433,7 @@ struct scsi_lun {
 #define SCSI_IOCTL_GET_PCI              0x5387
 
 /* Pull a u32 out of a SCSI message (using BE SCSI conventions) */
-static inline u32 scsi_to_u32(u8 *ptr)
+static inline __u32 scsi_to_u32(__u8 *ptr)
 {
         return (ptr[0]<<24) + (ptr[1]<<16) + (ptr[2]<<8) + ptr[3];
 }
diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h
index 39e833260bd0..4b95c89c95c9 100644
--- a/include/scsi/scsi_transport_iscsi.h
+++ b/include/scsi/scsi_transport_iscsi.h
@@ -29,7 +29,6 @@
 struct scsi_transport_template;
 struct iscsi_transport;
 struct Scsi_Host;
-struct mempool_zone;
 struct iscsi_cls_conn;
 struct iscsi_conn;
 struct iscsi_cmd_task;
@@ -157,9 +156,6 @@ struct iscsi_cls_conn {
 
         int active;                     /* must be accessed with the connlock */
         struct device dev;              /* sysfs transport/container device */
-        struct mempool_zone *z_error;
-        struct mempool_zone *z_pdu;
-        struct list_head freequeue;
 };
 
 #define iscsi_dev_to_conn(_dev) \
diff --git a/include/sound/version.h b/include/sound/version.h
index 4ad86eb6440b..52fd6879b86e 100644
--- a/include/sound/version.h
+++ b/include/sound/version.h
@@ -1,3 +1,3 @@
 /* include/version.h.  Generated by alsa/ksync script.  */
 #define CONFIG_SND_VERSION "1.0.13"
-#define CONFIG_SND_DATE " (Fri Oct 06 18:28:19 2006 UTC)"
+#define CONFIG_SND_DATE " (Sun Oct 22 08:56:16 2006 UTC)"
diff --git a/init/Kconfig b/init/Kconfig
index 10382931eead..176f7e5136c7 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1,5 +1,6 @@
 config DEFCONFIG_LIST
         string
+        depends on !UML
         option defconfig_list
         default "/lib/modules/$UNAME_RELEASE/.config"
         default "/etc/kernel-config"
@@ -303,20 +304,19 @@ config UID16
 
 config SYSCTL_SYSCALL
         bool "Sysctl syscall support" if EMBEDDED
-        default n
+        default y
         select SYSCTL
         ---help---
-          Enable the deprecated sysctl system call.  sys_sysctl uses
-          binary paths that have been found to be a major pain to maintain
-          and use.  The interface in /proc/sys is now the primary and what
-          everyone uses.
+          sys_sysctl uses binary paths that have been found challenging
+          to properly maintain and use.  The interface in /proc/sys
+          using paths with ascii names is now the primary path to this
+          information.
 
-          Nothing has been using the binary sysctl interface for some
-          time now so nothing should break if you disable sysctl syscall
-          support, and your kernel will get marginally smaller.
+          Almost nothing using the binary sysctl interface so if you are
+          trying to save some space it is probably safe to disable this,
+          making your kernel marginally smaller.
 
-          Unless you have an application that uses the sys_sysctl interface
-          you should probably say N here.
+          If unsure say Y here.
 
 config KALLSYMS
          bool "Load all symbols for debugging/kksymoops" if EMBEDDED
diff --git a/init/main.c b/init/main.c
index ee123243fb53..36f608a7cfba 100644
--- a/init/main.c
+++ b/init/main.c
@@ -503,6 +503,7 @@ asmlinkage void __init start_kernel(void)
         printk(KERN_NOTICE);
         printk(linux_banner);
         setup_arch(&command_line);
+        unwind_setup();
         setup_per_cpu_areas();
         smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */
 
diff --git a/ipc/msg.c b/ipc/msg.c
index 5b213d952545..1266b1d0c8e3 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -52,7 +52,7 @@ struct msg_receiver {
         long                    r_msgtype;
         long                    r_maxsize;
 
-        volatile struct msg_msg *r_msg;
+        struct msg_msg          *volatile r_msg;
 };
 
 /* one msg_sender for each sleeping sender */
@@ -124,6 +124,7 @@ void msg_exit_ns(struct ipc_namespace *ns)
         }
         mutex_unlock(&msg_ids(ns).mutex);
 
+        ipc_fini_ids(ns->ids[IPC_MSG_IDS]);
         kfree(ns->ids[IPC_MSG_IDS]);
         ns->ids[IPC_MSG_IDS] = NULL;
 }
diff --git a/ipc/sem.c b/ipc/sem.c
index 0dafcc455f92..21b3289d640c 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -161,6 +161,7 @@ void sem_exit_ns(struct ipc_namespace *ns)
         }
         mutex_unlock(&sem_ids(ns).mutex);
 
+        ipc_fini_ids(ns->ids[IPC_SEM_IDS]);
         kfree(ns->ids[IPC_SEM_IDS]);
         ns->ids[IPC_SEM_IDS] = NULL;
 }
diff --git a/ipc/shm.c b/ipc/shm.c
index bfbd317ec11c..d1198dd07a1a 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -116,6 +116,7 @@ void shm_exit_ns(struct ipc_namespace *ns)
         }
         mutex_unlock(&shm_ids(ns).mutex);
 
+        ipc_fini_ids(ns->ids[IPC_SHM_IDS]);
         kfree(ns->ids[IPC_SHM_IDS]);
         ns->ids[IPC_SHM_IDS] = NULL;
 }
diff --git a/ipc/util.c b/ipc/util.c
index 42479e4eec59..cd8bb14a431f 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -301,7 +301,7 @@ static int grow_ary(struct ipc_ids* ids, int newsize)
          */
         rcu_assign_pointer(ids->entries, new);
 
-        ipc_rcu_putref(old);
+        __ipc_fini_ids(ids, old);
         return newsize;
 }
 
diff --git a/ipc/util.h b/ipc/util.h
index c8fd6b9d77b5..e3aa2c5c97dc 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -83,6 +83,18 @@ void* ipc_rcu_alloc(int size);
 void ipc_rcu_getref(void *ptr);
 void ipc_rcu_putref(void *ptr);
 
+static inline void __ipc_fini_ids(struct ipc_ids *ids,
+                struct ipc_id_ary *entries)
+{
+        if (entries != &ids->nullentry)
+                ipc_rcu_putref(entries);
+}
+
+static inline void ipc_fini_ids(struct ipc_ids *ids)
+{
+        __ipc_fini_ids(ids, ids->entries);
+}
+
 struct kern_ipc_perm* ipc_get(struct ipc_ids* ids, int id);
 struct kern_ipc_perm* ipc_lock(struct ipc_ids* ids, int id);
 void ipc_lock_by_ptr(struct kern_ipc_perm *ipcp);
diff --git a/kernel/compat.c b/kernel/compat.c
index 75573e5d27b0..6952dd057300 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -678,7 +678,7 @@ int get_compat_sigevent(struct sigevent *event,
                 ? -EFAULT : 0;
 }
 
-long compat_get_bitmap(unsigned long *mask, compat_ulong_t __user *umask,
+long compat_get_bitmap(unsigned long *mask, const compat_ulong_t __user *umask,
                        unsigned long bitmap_size)
 {
         int i, j;
@@ -982,4 +982,37 @@ asmlinkage long compat_sys_move_pages(pid_t pid, unsigned long nr_pages,
         }
         return sys_move_pages(pid, nr_pages, pages, nodes, status, flags);
 }
+
+asmlinkage long compat_sys_migrate_pages(compat_pid_t pid,
+                        compat_ulong_t maxnode,
+                        const compat_ulong_t __user *old_nodes,
+                        const compat_ulong_t __user *new_nodes)
+{
+        unsigned long __user *old = NULL;
+        unsigned long __user *new = NULL;
+        nodemask_t tmp_mask;
+        unsigned long nr_bits;
+        unsigned long size;
+
+        nr_bits = min_t(unsigned long, maxnode - 1, MAX_NUMNODES);
+        size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
+        if (old_nodes) {
+                if (compat_get_bitmap(nodes_addr(tmp_mask), old_nodes, nr_bits))
+                        return -EFAULT;
+                old = compat_alloc_user_space(new_nodes ? size * 2 : size);
+                if (new_nodes)
+                        new = old + size / sizeof(unsigned long);
+                if (copy_to_user(old, nodes_addr(tmp_mask), size))
+                        return -EFAULT;
+        }
+        if (new_nodes) {
+                if (compat_get_bitmap(nodes_addr(tmp_mask), new_nodes, nr_bits))
+                        return -EFAULT;
+                if (new == NULL)
+                        new = compat_alloc_user_space(size);
+                if (copy_to_user(new, nodes_addr(tmp_mask), size))
+                        return -EFAULT;
+        }
+        return sys_migrate_pages(pid, nr_bits + 1, old, new);
+}
 #endif
diff --git a/kernel/cpu.c b/kernel/cpu.c
index 32c96628463e..272254f20d97 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -19,7 +19,7 @@
 static DEFINE_MUTEX(cpu_add_remove_lock);
 static DEFINE_MUTEX(cpu_bitmask_lock);
 
-static __cpuinitdata BLOCKING_NOTIFIER_HEAD(cpu_chain);
+static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
 
 /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
  * Should always be manipulated under cpu_add_remove_lock
@@ -58,8 +58,8 @@ void unlock_cpu_hotplug(void)
                 recursive_depth--;
                 return;
         }
-        mutex_unlock(&cpu_bitmask_lock);
         recursive = NULL;
+        mutex_unlock(&cpu_bitmask_lock);
 }
 EXPORT_SYMBOL_GPL(unlock_cpu_hotplug);
 
@@ -68,7 +68,11 @@ EXPORT_SYMBOL_GPL(unlock_cpu_hotplug);
 /* Need to know about CPUs going up/down? */
 int __cpuinit register_cpu_notifier(struct notifier_block *nb)
 {
-        return blocking_notifier_chain_register(&cpu_chain, nb);
+        int ret;
+        mutex_lock(&cpu_add_remove_lock);
+        ret = raw_notifier_chain_register(&cpu_chain, nb);
+        mutex_unlock(&cpu_add_remove_lock);
+        return ret;
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -77,7 +81,9 @@ EXPORT_SYMBOL(register_cpu_notifier);
 
 void unregister_cpu_notifier(struct notifier_block *nb)
 {
-        blocking_notifier_chain_unregister(&cpu_chain, nb);
+        mutex_lock(&cpu_add_remove_lock);
+        raw_notifier_chain_unregister(&cpu_chain, nb);
+        mutex_unlock(&cpu_add_remove_lock);
 }
 EXPORT_SYMBOL(unregister_cpu_notifier);
 
@@ -126,7 +132,7 @@ static int _cpu_down(unsigned int cpu)
         if (!cpu_online(cpu))
                 return -EINVAL;
 
-        err = blocking_notifier_call_chain(&cpu_chain, CPU_DOWN_PREPARE,
+        err = raw_notifier_call_chain(&cpu_chain, CPU_DOWN_PREPARE,
                                                 (void *)(long)cpu);
         if (err == NOTIFY_BAD) {
                 printk("%s: attempt to take down CPU %u failed\n",
@@ -144,18 +150,18 @@ static int _cpu_down(unsigned int cpu)
         p = __stop_machine_run(take_cpu_down, NULL, cpu);
         mutex_unlock(&cpu_bitmask_lock);
 
-        if (IS_ERR(p)) {
+        if (IS_ERR(p) || cpu_online(cpu)) {
                 /* CPU didn't die: tell everyone.  Can't complain. */
-                if (blocking_notifier_call_chain(&cpu_chain, CPU_DOWN_FAILED,
+                if (raw_notifier_call_chain(&cpu_chain, CPU_DOWN_FAILED,
                                 (void *)(long)cpu) == NOTIFY_BAD)
                         BUG();
 
-                err = PTR_ERR(p);
-                goto out_allowed;
-        }
-
-        if (cpu_online(cpu))
+                if (IS_ERR(p)) {
+                        err = PTR_ERR(p);
+                        goto out_allowed;
+                }
                 goto out_thread;
+        }
 
         /* Wait for it to sleep (leaving idle task). */
         while (!idle_cpu(cpu))
@@ -169,7 +175,7 @@ static int _cpu_down(unsigned int cpu)
         put_cpu();
 
         /* CPU is completely dead: tell everyone.  Too late to complain. */
-        if (blocking_notifier_call_chain(&cpu_chain, CPU_DEAD,
+        if (raw_notifier_call_chain(&cpu_chain, CPU_DEAD,
                         (void *)(long)cpu) == NOTIFY_BAD)
                 BUG();
 
@@ -206,7 +212,7 @@ static int __devinit _cpu_up(unsigned int cpu)
         if (cpu_online(cpu) || !cpu_present(cpu))
                 return -EINVAL;
 
-        ret = blocking_notifier_call_chain(&cpu_chain, CPU_UP_PREPARE, hcpu);
+        ret = raw_notifier_call_chain(&cpu_chain, CPU_UP_PREPARE, hcpu);
         if (ret == NOTIFY_BAD) {
                 printk("%s: attempt to bring up CPU %u failed\n",
                                 __FUNCTION__, cpu);
@@ -223,11 +229,11 @@ static int __devinit _cpu_up(unsigned int cpu)
         BUG_ON(!cpu_online(cpu));
 
         /* Now call notifier in preparation. */
-        blocking_notifier_call_chain(&cpu_chain, CPU_ONLINE, hcpu);
+        raw_notifier_call_chain(&cpu_chain, CPU_ONLINE, hcpu);
 
 out_notify:
         if (ret != 0)
-                blocking_notifier_call_chain(&cpu_chain,
+                raw_notifier_call_chain(&cpu_chain,
                                 CPU_UP_CANCELED, hcpu);
 
         return ret;
diff --git a/kernel/delayacct.c b/kernel/delayacct.c
index 36752f124c6a..66a0ea48751d 100644
--- a/kernel/delayacct.c
+++ b/kernel/delayacct.c
@@ -66,6 +66,7 @@ static void delayacct_end(struct timespec *start, struct timespec *end,
 {
         struct timespec ts;
         s64 ns;
+        unsigned long flags;
 
         do_posix_clock_monotonic_gettime(end);
         ts = timespec_sub(*end, *start);
@@ -73,10 +74,10 @@ static void delayacct_end(struct timespec *start, struct timespec *end,
         if (ns < 0)
                 return;
 
-        spin_lock(&current->delays->lock);
+        spin_lock_irqsave(&current->delays->lock, flags);
         *total += ns;
         (*count)++;
-        spin_unlock(&current->delays->lock);
+        spin_unlock_irqrestore(&current->delays->lock, flags);
 }
 
 void __delayacct_blkio_start(void)
@@ -104,6 +105,7 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk)
         s64 tmp;
         struct timespec ts;
         unsigned long t1,t2,t3;
+        unsigned long flags;
 
         /* Though tsk->delays accessed later, early exit avoids
          * unnecessary returning of other data
@@ -136,14 +138,14 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk)
 
         /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */
 
-        spin_lock(&tsk->delays->lock);
+        spin_lock_irqsave(&tsk->delays->lock, flags);
         tmp = d->blkio_delay_total + tsk->delays->blkio_delay;
         d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp;
         tmp = d->swapin_delay_total + tsk->delays->swapin_delay;
         d->swapin_delay_total = (tmp < d->swapin_delay_total) ? 0 : tmp;
         d->blkio_count += tsk->delays->blkio_count;
         d->swapin_count += tsk->delays->swapin_count;
-        spin_unlock(&tsk->delays->lock);
+        spin_unlock_irqrestore(&tsk->delays->lock, flags);
 
 done:
         return 0;
@@ -152,11 +154,12 @@ done:
 __u64 __delayacct_blkio_ticks(struct task_struct *tsk)
 {
         __u64 ret;
+        unsigned long flags;
 
-        spin_lock(&tsk->delays->lock);
+        spin_lock_irqsave(&tsk->delays->lock, flags);
         ret = nsec_to_clock_t(tsk->delays->blkio_delay +
                                 tsk->delays->swapin_delay);
-        spin_unlock(&tsk->delays->lock);
+        spin_unlock_irqrestore(&tsk->delays->lock, flags);
         return ret;
 }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index f250a5e3e281..06de6c4e8ca3 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -128,6 +128,7 @@ static void __exit_signal(struct task_struct *tsk)
         flush_sigqueue(&tsk->pending);
         if (sig) {
                 flush_sigqueue(&sig->shared_pending);
+                taskstats_tgid_free(sig);
                 __cleanup_signal(sig);
         }
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 7dc6140baac6..3da978eec791 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -830,7 +830,7 @@ static inline int copy_signal(unsigned long clone_flags, struct task_struct * ts
         if (clone_flags & CLONE_THREAD) {
                 atomic_inc(&current->signal->count);
                 atomic_inc(&current->signal->live);
-                taskstats_tgid_alloc(current->signal);
+                taskstats_tgid_alloc(current);
                 return 0;
         }
         sig = kmem_cache_alloc(signal_cachep, GFP_KERNEL);
@@ -897,7 +897,6 @@ static inline int copy_signal(unsigned long clone_flags, struct task_struct * ts
 void __cleanup_signal(struct signal_struct *sig)
 {
         exit_thread_group_keys(sig);
-        taskstats_tgid_free(sig);
         kmem_cache_free(signal_cachep, sig);
 }
 
@@ -984,6 +983,8 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         if (!p)
                 goto fork_out;
 
+        rt_mutex_init_task(p);
+
 #ifdef CONFIG_TRACE_IRQFLAGS
         DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
         DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
@@ -1088,8 +1089,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->lockdep_recursion = 0;
 #endif
 
-        rt_mutex_init_task(p);
-
 #ifdef CONFIG_DEBUG_MUTEXES
         p->blocked_on = NULL; /* not blocked yet */
 #endif
diff --git a/kernel/futex.c b/kernel/futex.c
index b364e0026191..93ef30ba209f 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1507,6 +1507,13 @@ static int futex_fd(u32 __user *uaddr, int signal)
         struct futex_q *q;
         struct file *filp;
         int ret, err;
+        static unsigned long printk_interval;
+
+        if (printk_timed_ratelimit(&printk_interval, 60 * 60 * 1000)) {
+                printk(KERN_WARNING "Process `%s' used FUTEX_FD, which "
+                        "will be removed from the kernel in June 2007\n",
+                        current->comm);
+        }
 
         ret = -EINVAL;
         if (!valid_signal(signal))
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 11c99697acfe..ebfd24a41858 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -233,6 +233,8 @@ void irq_chip_set_defaults(struct irq_chip *chip)
                 chip->shutdown = chip->disable;
         if (!chip->name)
                 chip->name = chip->typename;
+        if (!chip->end)
+                chip->end = dummy_irq_chip.end;
 }
 
 static inline void mask_ack_irq(struct irq_desc *desc, int irq)
@@ -499,7 +501,8 @@ handle_percpu_irq(unsigned int irq, struct irq_desc *desc)
 #endif /* CONFIG_SMP */
 
 void
-__set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained)
+__set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
+                  const char *name)
 {
         struct irq_desc *desc;
         unsigned long flags;
@@ -540,6 +543,7 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained)
                 desc->depth = 1;
         }
         desc->handle_irq = handle;
+        desc->name = name;
 
         if (handle != handle_bad_irq && is_chained) {
                 desc->status &= ~IRQ_DISABLED;
@@ -555,30 +559,13 @@ set_irq_chip_and_handler(unsigned int irq, struct irq_chip *chip,
                          irq_flow_handler_t handle)
 {
         set_irq_chip(irq, chip);
-        __set_irq_handler(irq, handle, 0);
+        __set_irq_handler(irq, handle, 0, NULL);
 }
 
-/*
- * Get a descriptive string for the highlevel handler, for
- * /proc/interrupts output:
- */
-const char *
-handle_irq_name(irq_flow_handler_t handle)
+void
+set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
+                              irq_flow_handler_t handle, const char *name)
 {
-        if (handle == handle_level_irq)
-                return "level  ";
-        if (handle == handle_fasteoi_irq)
-                return "fasteoi";
-        if (handle == handle_edge_irq)
-                return "edge   ";
-        if (handle == handle_simple_irq)
-                return "simple ";
-#ifdef CONFIG_SMP
-        if (handle == handle_percpu_irq)
-                return "percpu ";
-#endif
-        if (handle == handle_bad_irq)
-                return "bad    ";
-
-        return NULL;
+        set_irq_chip(irq, chip);
+        __set_irq_handler(irq, handle, 0, name);
 }
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 6879202afe9a..b385878c6e80 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -216,6 +216,7 @@ int setup_irq(unsigned int irq, struct irqaction *new)
 {
         struct irq_desc *desc = irq_desc + irq;
         struct irqaction *old, **p;
+        const char *old_name = NULL;
         unsigned long flags;
         int shared = 0;
 
@@ -255,8 +256,10 @@ int setup_irq(unsigned int irq, struct irqaction *new)
                  * set the trigger type must match.
                  */
                 if (!((old->flags & new->flags) & IRQF_SHARED) ||
-                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK))
+                    ((old->flags ^ new->flags) & IRQF_TRIGGER_MASK)) {
+                        old_name = old->name;
                         goto mismatch;
+                }
 
 #if defined(CONFIG_IRQ_PER_CPU)
                 /* All handlers must agree on per-cpuness */
@@ -322,11 +325,13 @@ int setup_irq(unsigned int irq, struct irqaction *new)
         return 0;
 
 mismatch:
-        spin_unlock_irqrestore(&desc->lock, flags);
         if (!(new->flags & IRQF_PROBE_SHARED)) {
                 printk(KERN_ERR "IRQ handler type mismatch for IRQ %d\n", irq);
+                if (old_name)
+                        printk(KERN_ERR "current handler: %s\n", old_name);
                 dump_stack();
         }
+        spin_unlock_irqrestore(&desc->lock, flags);
         return -EBUSY;
 }
 
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index 607c7809ad01..9a352667007c 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -57,7 +57,7 @@ static int irq_affinity_write_proc(struct file *file, const char __user *buffer,
         if (!irq_desc[irq].chip->set_affinity || no_irq_affinity)
                 return -EIO;
 
-        err = cpumask_parse(buffer, count, new_value);
+        err = cpumask_parse_user(buffer, count, new_value);
         if (err)
                 return err;
 
diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
index 543ea2e5ad93..9c7e2e4c1fe7 100644
--- a/kernel/irq/spurious.c
+++ b/kernel/irq/spurious.c
@@ -147,7 +147,11 @@ void note_interrupt(unsigned int irq, struct irq_desc *desc,
         if (unlikely(irqfixup)) {
                 /* Don't punish working computers */
                 if ((irqfixup == 2 && irq == 0) || action_ret == IRQ_NONE) {
-                        int ok = misrouted_irq(irq);
+                        int ok;
+
+                        spin_unlock(&desc->lock);
+                        ok = misrouted_irq(irq);
+                        spin_lock(&desc->lock);
                         if (action_ret == IRQ_NONE)
                                 desc->irqs_unhandled -= ok;
                 }
diff --git a/kernel/lockdep.c b/kernel/lockdep.c
index 4c0553461000..c9fefdb1a7db 100644
--- a/kernel/lockdep.c
+++ b/kernel/lockdep.c
@@ -575,6 +575,8 @@ static noinline int print_circular_bug_tail(void)
         return 0;
 }
 
+#define RECURSION_LIMIT 40
+
 static int noinline print_infinite_recursion_bug(void)
 {
         __raw_spin_unlock(&hash_lock);
@@ -595,7 +597,7 @@ check_noncircular(struct lock_class *source, unsigned int depth)
         debug_atomic_inc(&nr_cyclic_check_recursions);
         if (depth > max_recursion_depth)
                 max_recursion_depth = depth;
-        if (depth >= 20)
+        if (depth >= RECURSION_LIMIT)
                 return print_infinite_recursion_bug();
         /*
          * Check this lock's dependency list:
@@ -645,7 +647,7 @@ find_usage_forwards(struct lock_class *source, unsigned int depth)
 
         if (depth > max_recursion_depth)
                 max_recursion_depth = depth;
-        if (depth >= 20)
+        if (depth >= RECURSION_LIMIT)
                 return print_infinite_recursion_bug();
 
         debug_atomic_inc(&nr_find_usage_forwards_checks);
@@ -684,7 +686,7 @@ find_usage_backwards(struct lock_class *source, unsigned int depth)
 
         if (depth > max_recursion_depth)
                 max_recursion_depth = depth;
-        if (depth >= 20)
+        if (depth >= RECURSION_LIMIT)
                 return print_infinite_recursion_bug();
 
         debug_atomic_inc(&nr_find_usage_backwards_checks);
@@ -1079,7 +1081,8 @@ static int static_obj(void *obj)
          */
         for_each_possible_cpu(i) {
                 start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-                end   = (unsigned long) &__per_cpu_end   + per_cpu_offset(i);
+                end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
+                                        + per_cpu_offset(i);
 
                 if ((addr >= start) && (addr < end))
                         return 1;
@@ -1114,8 +1117,6 @@ static int count_matching_names(struct lock_class *new_class)
         return count + 1;
 }
 
-extern void __error_too_big_MAX_LOCKDEP_SUBCLASSES(void);
-
 /*
  * Register a lock's class in the hash-table, if the class is not present
  * yet. Otherwise we look it up. We cache the result in the lock object
@@ -1153,8 +1154,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
          * (or spin_lock_init()) call - which acts as the key. For static
          * locks we use the lock object itself as the key.
          */
-        if (sizeof(struct lock_class_key) > sizeof(struct lock_class))
-                __error_too_big_MAX_LOCKDEP_SUBCLASSES();
+        BUILD_BUG_ON(sizeof(struct lock_class_key) > sizeof(struct lock_class));
 
         key = lock->key->subkeys + subclass;
 
@@ -1177,7 +1177,7 @@ look_up_lock_class(struct lockdep_map *lock, unsigned int subclass)
  * itself, so actual lookup of the hash should be once per lock object.
  */
 static inline struct lock_class *
-register_lock_class(struct lockdep_map *lock, unsigned int subclass)
+register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force)
 {
         struct lockdep_subclass_key *key;
         struct list_head *hash_head;
@@ -1249,7 +1249,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass)
 out_unlock_set:
         __raw_spin_unlock(&hash_lock);
 
-        if (!subclass)
+        if (!subclass || force)
                 lock->class_cache = class;
 
         DEBUG_LOCKS_WARN_ON(class->subclass != subclass);
@@ -1937,7 +1937,7 @@ void trace_softirqs_off(unsigned long ip)
  * Initialize a lock instance's lock-class mapping info:
  */
 void lockdep_init_map(struct lockdep_map *lock, const char *name,
-                      struct lock_class_key *key)
+                      struct lock_class_key *key, int subclass)
 {
         if (unlikely(!debug_locks))
                 return;
@@ -1957,6 +1957,8 @@ void lockdep_init_map(struct lockdep_map *lock, const char *name,
         lock->name = name;
         lock->key = key;
         lock->class_cache = NULL;
+        if (subclass)
+                register_lock_class(lock, subclass, 1);
 }
 
 EXPORT_SYMBOL_GPL(lockdep_init_map);
@@ -1995,7 +1997,7 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass,
          * Not cached yet or subclass?
          */
         if (unlikely(!class)) {
-                class = register_lock_class(lock, subclass);
+                class = register_lock_class(lock, subclass, 0);
                 if (!class)
                         return 0;
         }
diff --git a/kernel/module.c b/kernel/module.c
index 7f60e782de1e..f0166563c602 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -87,6 +87,12 @@ static inline int strong_try_module_get(struct module *mod)
         return try_module_get(mod);
 }
 
+static inline void add_taint_module(struct module *mod, unsigned flag)
+{
+        add_taint(flag);
+        mod->taints |= flag;
+}
+
 /* A thread that wants to hold a reference to a module only while it
  * is running can call ths to safely exit.
  * nfsd and lockd use this.
@@ -847,12 +853,10 @@ static int check_version(Elf_Shdr *sechdrs,
                 return 0;
         }
         /* Not in module's version table.  OK, but that taints the kernel. */
-        if (!(tainted & TAINT_FORCED_MODULE)) {
+        if (!(tainted & TAINT_FORCED_MODULE))
                 printk("%s: no version for \"%s\" found: kernel tainted.\n",
                        mod->name, symname);
-                add_taint(TAINT_FORCED_MODULE);
-                mod->taints |= TAINT_FORCED_MODULE;
-        }
+        add_taint_module(mod, TAINT_FORCED_MODULE);
         return 1;
 }
 
@@ -910,7 +914,8 @@ static unsigned long resolve_symbol(Elf_Shdr *sechdrs,
         unsigned long ret;
         const unsigned long *crc;
 
-        ret = __find_symbol(name, &owner, &crc, mod->license_gplok);
+        ret = __find_symbol(name, &owner, &crc,
+                        !(mod->taints & TAINT_PROPRIETARY_MODULE));
         if (ret) {
                 /* use_module can fail due to OOM, or module unloading */
                 if (!check_version(sechdrs, versindex, name, mod, crc) ||
@@ -1335,12 +1340,11 @@ static void set_license(struct module *mod, const char *license)
         if (!license)
                 license = "unspecified";
 
-        mod->license_gplok = license_is_gpl_compatible(license);
-        if (!mod->license_gplok && !(tainted & TAINT_PROPRIETARY_MODULE)) {
-                printk(KERN_WARNING "%s: module license '%s' taints kernel.\n",
-                       mod->name, license);
-                add_taint(TAINT_PROPRIETARY_MODULE);
-                mod->taints |= TAINT_PROPRIETARY_MODULE;
+        if (!license_is_gpl_compatible(license)) {
+                if (!(tainted & TAINT_PROPRIETARY_MODULE))
+                        printk(KERN_WARNING "%s: module license '%s' taints "
+                                "kernel.\n", mod->name, license);
+                add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
         }
 }
 
@@ -1619,8 +1623,7 @@ static struct module *load_module(void __user *umod,
         modmagic = get_modinfo(sechdrs, infoindex, "vermagic");
         /* This is allowed: modprobe --force will invalidate it. */
         if (!modmagic) {
-                add_taint(TAINT_FORCED_MODULE);
-                mod->taints |= TAINT_FORCED_MODULE;
+                add_taint_module(mod, TAINT_FORCED_MODULE);
                 printk(KERN_WARNING "%s: no version magic, tainting kernel.\n",
                        mod->name);
         } else if (!same_magic(modmagic, vermagic)) {
@@ -1714,14 +1717,10 @@ static struct module *load_module(void __user *umod,
         /* Set up license info based on the info section */
         set_license(mod, get_modinfo(sechdrs, infoindex, "license"));
 
-        if (strcmp(mod->name, "ndiswrapper") == 0) {
-                add_taint(TAINT_PROPRIETARY_MODULE);
-                mod->taints |= TAINT_PROPRIETARY_MODULE;
-        }
-        if (strcmp(mod->name, "driverloader") == 0) {
+        if (strcmp(mod->name, "ndiswrapper") == 0)
                 add_taint(TAINT_PROPRIETARY_MODULE);
-                mod->taints |= TAINT_PROPRIETARY_MODULE;
-        }
+        if (strcmp(mod->name, "driverloader") == 0)
+                add_taint_module(mod, TAINT_PROPRIETARY_MODULE);
 
         /* Set up MODINFO_ATTR fields */
         setup_modinfo(mod, sechdrs, infoindex);
@@ -1766,8 +1765,7 @@ static struct module *load_module(void __user *umod,
             (mod->num_unused_gpl_syms && !unusedgplcrcindex)) {
                 printk(KERN_WARNING "%s: No versions for exported symbols."
                        " Tainting kernel.\n", mod->name);
-                add_taint(TAINT_FORCED_MODULE);
-                mod->taints |= TAINT_FORCED_MODULE;
+                add_taint_module(mod, TAINT_FORCED_MODULE);
         }
 #endif
 
@@ -2132,9 +2130,33 @@ static void m_stop(struct seq_file *m, void *p)
         mutex_unlock(&module_mutex);
 }
 
+static char *taint_flags(unsigned int taints, char *buf)
+{
+        int bx = 0;
+
+        if (taints) {
+                buf[bx++] = '(';
+                if (taints & TAINT_PROPRIETARY_MODULE)
+                        buf[bx++] = 'P';
+                if (taints & TAINT_FORCED_MODULE)
+                        buf[bx++] = 'F';
+                /*
+                 * TAINT_FORCED_RMMOD: could be added.
+                 * TAINT_UNSAFE_SMP, TAINT_MACHINE_CHECK, TAINT_BAD_PAGE don't
+                 * apply to modules.
+                 */
+                buf[bx++] = ')';
+        }
+        buf[bx] = '\0';
+
+        return buf;
+}
+
 static int m_show(struct seq_file *m, void *p)
 {
         struct module *mod = list_entry(p, struct module, list);
+        char buf[8];
+
         seq_printf(m, "%s %lu",
                    mod->name, mod->init_size + mod->core_size);
         print_unload_info(m, mod);
@@ -2147,6 +2169,10 @@ static int m_show(struct seq_file *m, void *p)
         /* Used by oprofile and other similar tools. */
         seq_printf(m, " 0x%p", mod->module_core);
 
+        /* Taints info */
+        if (mod->taints)
+                seq_printf(m, " %s", taint_flags(mod->taints, buf));
+
         seq_printf(m, "\n");
         return 0;
 }
@@ -2235,28 +2261,6 @@ struct module *module_text_address(unsigned long addr)
         return mod;
 }
 
-static char *taint_flags(unsigned int taints, char *buf)
-{
-        *buf = '\0';
-        if (taints) {
-                int bx;
-
-                buf[0] = '(';
-                bx = 1;
-                if (taints & TAINT_PROPRIETARY_MODULE)
-                        buf[bx++] = 'P';
-                if (taints & TAINT_FORCED_MODULE)
-                        buf[bx++] = 'F';
-                /*
-                 * TAINT_FORCED_RMMOD: could be added.
-                 * TAINT_UNSAFE_SMP, TAINT_MACHINE_CHECK, TAINT_BAD_PAGE don't
-                 * apply to modules.
-                 */
-                buf[bx] = ')';
-        }
-        return buf;
-}
-
 /* Don't grab lock, we're oopsing. */
 void print_modules(void)
 {
diff --git a/kernel/mutex-debug.c b/kernel/mutex-debug.c
index e3203c654dda..18651641a7b5 100644
--- a/kernel/mutex-debug.c
+++ b/kernel/mutex-debug.c
@@ -91,7 +91,7 @@ void debug_mutex_init(struct mutex *lock, const char *name,
          * Make sure we are not reinitializing a held lock:
          */
         debug_check_no_locks_freed((void *)lock, sizeof(*lock));
-        lockdep_init_map(&lock->dep_map, name, key);
+        lockdep_init_map(&lock->dep_map, name, key, 0);
 #endif
         lock->owner = NULL;
         lock->magic = lock;
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 6ebdb82a0ce4..674aceb7335a 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -44,11 +44,9 @@ static inline struct nsproxy *clone_namespaces(struct nsproxy *orig)
 {
         struct nsproxy *ns;
 
-        ns = kmalloc(sizeof(struct nsproxy), GFP_KERNEL);
-        if (ns) {
-                memcpy(ns, orig, sizeof(struct nsproxy));
+        ns = kmemdup(orig, sizeof(struct nsproxy), GFP_KERNEL);
+        if (ns)
                 atomic_set(&ns->count, 1);
-        }
         return ns;
 }
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 479b16b44f79..7c3e1e6dfb5b 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -88,6 +88,19 @@ static inline union cpu_time_count cpu_time_sub(const clockid_t which_clock,
 }
 
 /*
+ * Divide and limit the result to res >= 1
+ *
+ * This is necessary to prevent signal delivery starvation, when the result of
+ * the division would be rounded down to 0.
+ */
+static inline cputime_t cputime_div_non_zero(cputime_t time, unsigned long div)
+{
+        cputime_t res = cputime_div(time, div);
+
+        return max_t(cputime_t, res, 1);
+}
+
+/*
  * Update expiry time from increment, and increase overrun count,
  * given the current clock sample.
  */
@@ -483,8 +496,8 @@ static void process_timer_rebalance(struct task_struct *p,
                 BUG();
                 break;
         case CPUCLOCK_PROF:
-                left = cputime_div(cputime_sub(expires.cpu, val.cpu),
-                                   nthreads);
+                left = cputime_div_non_zero(cputime_sub(expires.cpu, val.cpu),
+                                       nthreads);
                 do {
                         if (likely(!(t->flags & PF_EXITING))) {
                                 ticks = cputime_add(prof_ticks(t), left);
@@ -498,8 +511,8 @@ static void process_timer_rebalance(struct task_struct *p,
                 } while (t != p);
                 break;
         case CPUCLOCK_VIRT:
-                left = cputime_div(cputime_sub(expires.cpu, val.cpu),
-                                   nthreads);
+                left = cputime_div_non_zero(cputime_sub(expires.cpu, val.cpu),
+                                       nthreads);
                 do {
                         if (likely(!(t->flags & PF_EXITING))) {
                                 ticks = cputime_add(virt_ticks(t), left);
@@ -515,6 +528,7 @@ static void process_timer_rebalance(struct task_struct *p,
         case CPUCLOCK_SCHED:
                 nsleft = expires.sched - val.sched;
                 do_div(nsleft, nthreads);
+                nsleft = max_t(unsigned long long, nsleft, 1);
                 do {
                         if (likely(!(t->flags & PF_EXITING))) {
                                 ns = t->sched_time + nsleft;
@@ -1159,12 +1173,13 @@ static void check_process_timers(struct task_struct *tsk,
 
                 prof_left = cputime_sub(prof_expires, utime);
                 prof_left = cputime_sub(prof_left, stime);
-                prof_left = cputime_div(prof_left, nthreads);
+                prof_left = cputime_div_non_zero(prof_left, nthreads);
                 virt_left = cputime_sub(virt_expires, utime);
-                virt_left = cputime_div(virt_left, nthreads);
+                virt_left = cputime_div_non_zero(virt_left, nthreads);
                 if (sched_expires) {
                         sched_left = sched_expires - sched_time;
                         do_div(sched_left, nthreads);
+                        sched_left = max_t(unsigned long long, sched_left, 1);
                 } else {
                         sched_left = 0;
                 }
diff --git a/kernel/power/disk.c b/kernel/power/disk.c
index d72234942798..b1fb7866b0b3 100644
--- a/kernel/power/disk.c
+++ b/kernel/power/disk.c
@@ -18,6 +18,7 @@
 #include <linux/fs.h>
 #include <linux/mount.h>
 #include <linux/pm.h>
+#include <linux/console.h>
 #include <linux/cpu.h>
 
 #include "power.h"
@@ -70,7 +71,7 @@ static inline void platform_finish(void)
 
 static int prepare_processes(void)
 {
-        int error;
+        int error = 0;
 
         pm_prepare_console();
 
@@ -83,6 +84,12 @@ static int prepare_processes(void)
                 goto thaw;
         }
 
+        if (pm_disk_mode == PM_DISK_TESTPROC) {
+                printk("swsusp debug: Waiting for 5 seconds.\n");
+                mdelay(5000);
+                goto thaw;
+        }
+
         /* Free memory before shutting down devices. */
         if (!(error = swsusp_shrink_memory()))
                 return 0;
@@ -119,11 +126,21 @@ int pm_suspend_disk(void)
         if (error)
                 return error;
 
+        if (pm_disk_mode == PM_DISK_TESTPROC)
+                goto Thaw;
+
+        suspend_console();
         error = device_suspend(PMSG_FREEZE);
         if (error) {
+                resume_console();
                 printk("Some devices failed to suspend\n");
-                unprepare_processes();
-                return error;
+                goto Thaw;
+        }
+
+        if (pm_disk_mode == PM_DISK_TEST) {
+                printk("swsusp debug: Waiting for 5 seconds.\n");
+                mdelay(5000);
+                goto Done;
         }
 
         pr_debug("PM: snapshotting memory.\n");
@@ -133,21 +150,24 @@ int pm_suspend_disk(void)
 
         if (in_suspend) {
                 device_resume();
+                resume_console();
                 pr_debug("PM: writing image.\n");
                 error = swsusp_write();
                 if (!error)
                         power_down(pm_disk_mode);
                 else {
                         swsusp_free();
-                        unprepare_processes();
-                        return error;
+                        goto Thaw;
                 }
-        } else
+        } else {
                 pr_debug("PM: Image restored successfully.\n");
+        }
 
         swsusp_free();
  Done:
         device_resume();
+        resume_console();
+ Thaw:
         unprepare_processes();
         return error;
 }
@@ -212,7 +232,9 @@ static int software_resume(void)
 
         pr_debug("PM: Preparing devices for restore.\n");
 
+        suspend_console();
         if ((error = device_suspend(PMSG_PRETHAW))) {
+                resume_console();
                 printk("Some devices failed to suspend\n");
                 swsusp_free();
                 goto Thaw;
@@ -224,6 +246,7 @@ static int software_resume(void)
         swsusp_resume();
         pr_debug("PM: Restore failed, recovering.n");
         device_resume();
+        resume_console();
  Thaw:
         unprepare_processes();
  Done:
@@ -241,6 +264,8 @@ static const char * const pm_disk_modes[] = {
         [PM_DISK_PLATFORM]      = "platform",
         [PM_DISK_SHUTDOWN]      = "shutdown",
         [PM_DISK_REBOOT]        = "reboot",
+        [PM_DISK_TEST]          = "test",
+        [PM_DISK_TESTPROC]      = "testproc",
 };
 
 /**
@@ -295,17 +320,19 @@ static ssize_t disk_store(struct subsystem * s, const char * buf, size_t n)
                 }
         }
         if (mode) {
-                if (mode == PM_DISK_SHUTDOWN || mode == PM_DISK_REBOOT)
+                if (mode == PM_DISK_SHUTDOWN || mode == PM_DISK_REBOOT ||
+                     mode == PM_DISK_TEST || mode == PM_DISK_TESTPROC) {
                         pm_disk_mode = mode;
-                else {
+                } else {
                         if (pm_ops && pm_ops->enter &&
                             (mode == pm_ops->pm_disk_mode))
                                 pm_disk_mode = mode;
                         else
                                 error = -EINVAL;
                 }
-        } else
+        } else {
                 error = -EINVAL;
+        }
 
         pr_debug("PM: suspend-to-disk mode set to '%s'\n",
                  pm_disk_modes[mode]);
diff --git a/kernel/power/swap.c b/kernel/power/swap.c
index 9b2ee5344dee..1a3b0dd2c3fc 100644
--- a/kernel/power/swap.c
+++ b/kernel/power/swap.c
@@ -425,7 +425,8 @@ static int submit(int rw, pgoff_t page_off, struct page *page,
                         bio_set_pages_dirty(bio);
                 bio_put(bio);
         } else {
-                get_page(page);
+                if (rw == READ)
+                        get_page(page); /* These pages are freed later */
                 bio->bi_private = *bio_chain;
                 *bio_chain = bio;
                 submit_bio(rw | (1 << BIO_RW_SYNC), bio);
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 93b5dd283dea..d991d3b0e5a4 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -19,6 +19,7 @@
 #include <linux/swapops.h>
 #include <linux/pm.h>
 #include <linux/fs.h>
+#include <linux/console.h>
 #include <linux/cpu.h>
 
 #include <asm/uaccess.h>
@@ -173,12 +174,14 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 /* Free memory before shutting down devices. */
                 error = swsusp_shrink_memory();
                 if (!error) {
+                        suspend_console();
                         error = device_suspend(PMSG_FREEZE);
                         if (!error) {
                                 in_suspend = 1;
                                 error = swsusp_suspend();
                                 device_resume();
                         }
+                        resume_console();
                 }
                 up(&pm_sem);
                 if (!error)
@@ -196,11 +199,13 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 snapshot_free_unused_memory(&data->handle);
                 down(&pm_sem);
                 pm_prepare_console();
+                suspend_console();
                 error = device_suspend(PMSG_PRETHAW);
                 if (!error) {
                         error = swsusp_resume();
                         device_resume();
                 }
+                resume_console();
                 pm_restore_console();
                 up(&pm_sem);
                 break;
@@ -289,6 +294,7 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                 }
 
                 /* Put devices to sleep */
+                suspend_console();
                 error = device_suspend(PMSG_SUSPEND);
                 if (error) {
                         printk(KERN_ERR "Failed to suspend some devices.\n");
@@ -299,7 +305,7 @@ static int snapshot_ioctl(struct inode *inode, struct file *filp,
                         /* Wake up devices */
                         device_resume();
                 }
-
+                resume_console();
                 if (pm_ops->finish)
                         pm_ops->finish(PM_SUSPEND_MEM);
 
diff --git a/kernel/printk.c b/kernel/printk.c
index 771f5e861bcd..66426552fbfe 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -31,6 +31,7 @@
 #include <linux/security.h>
 #include <linux/bootmem.h>
 #include <linux/syscalls.h>
+#include <linux/jiffies.h>
 
 #include <asm/uaccess.h>
 
@@ -820,15 +821,8 @@ void release_console_sem(void)
         console_locked = 0;
         up(&console_sem);
         spin_unlock_irqrestore(&logbuf_lock, flags);
-        if (wake_klogd && !oops_in_progress && waitqueue_active(&log_wait)) {
-                /*
-                 * If we printk from within the lock dependency code,
-                 * from within the scheduler code, then do not lock
-                 * up due to self-recursion:
-                 */
-                if (!lockdep_internal())
-                        wake_up_interruptible(&log_wait);
-        }
+        if (wake_klogd && !oops_in_progress && waitqueue_active(&log_wait))
+                wake_up_interruptible(&log_wait);
 }
 EXPORT_SYMBOL(release_console_sem);
 
@@ -1108,3 +1102,23 @@ int printk_ratelimit(void)
                                 printk_ratelimit_burst);
 }
 EXPORT_SYMBOL(printk_ratelimit);
+
+/**
+ * printk_timed_ratelimit - caller-controlled printk ratelimiting
+ * @caller_jiffies: pointer to caller's state
+ * @interval_msecs: minimum interval between prints
+ *
+ * printk_timed_ratelimit() returns true if more than @interval_msecs
+ * milliseconds have elapsed since the last time printk_timed_ratelimit()
+ * returned true.
+ */
+bool printk_timed_ratelimit(unsigned long *caller_jiffies,
+                        unsigned int interval_msecs)
+{
+        if (*caller_jiffies == 0 || time_after(jiffies, *caller_jiffies)) {
+                *caller_jiffies = jiffies + msecs_to_jiffies(interval_msecs);
+                return true;
+        }
+        return false;
+}
+EXPORT_SYMBOL(printk_timed_ratelimit);
diff --git a/kernel/profile.c b/kernel/profile.c
index 857300a2afec..f940b462eec9 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -399,7 +399,7 @@ static int prof_cpu_mask_write_proc (struct file *file, const char __user *buffe
         unsigned long full_count = count, err;
         cpumask_t new_value;
 
-        err = cpumask_parse(buffer, count, new_value);
+        err = cpumask_parse_user(buffer, count, new_value);
         if (err)
                 return err;
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 53608a59d6e3..3399701c680e 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -160,15 +160,6 @@
 #define TASK_PREEMPTS_CURR(p, rq) \
         ((p)->prio < (rq)->curr->prio)
 
-/*
- * task_timeslice() scales user-nice values [ -20 ... 0 ... 19 ]
- * to time slice values: [800ms ... 100ms ... 5ms]
- *
- * The higher a thread's priority, the bigger timeslices
- * it gets during one round of execution. But even the lowest
- * priority thread gets MIN_TIMESLICE worth of execution time.
- */
-
 #define SCALE_PRIO(x, prio) \
         max(x * (MAX_PRIO - prio) / (MAX_USER_PRIO / 2), MIN_TIMESLICE)
 
@@ -180,6 +171,15 @@ static unsigned int static_prio_timeslice(int static_prio)
                 return SCALE_PRIO(DEF_TIMESLICE, static_prio);
 }
 
+/*
+ * task_timeslice() scales user-nice values [ -20 ... 0 ... 19 ]
+ * to time slice values: [800ms ... 100ms ... 5ms]
+ *
+ * The higher a thread's priority, the bigger timeslices
+ * it gets during one round of execution. But even the lowest
+ * priority thread gets MIN_TIMESLICE worth of execution time.
+ */
+
 static inline unsigned int task_timeslice(struct task_struct *p)
 {
         return static_prio_timeslice(p->static_prio);
@@ -1822,14 +1822,14 @@ context_switch(struct rq *rq, struct task_struct *prev,
         struct mm_struct *mm = next->mm;
         struct mm_struct *oldmm = prev->active_mm;
 
-        if (unlikely(!mm)) {
+        if (!mm) {
                 next->active_mm = oldmm;
                 atomic_inc(&oldmm->mm_count);
                 enter_lazy_tlb(oldmm, next);
         } else
                 switch_mm(oldmm, mm, next);
 
-        if (unlikely(!prev->mm)) {
+        if (!prev->mm) {
                 prev->active_mm = NULL;
                 WARN_ON(rq->prev_mm);
                 rq->prev_mm = oldmm;
@@ -3491,7 +3491,7 @@ asmlinkage void __sched preempt_schedule(void)
          * If there is a non-zero preempt_count or interrupts are disabled,
          * we do not want to preempt the current task.  Just return..
          */
-        if (unlikely(ti->preempt_count || irqs_disabled()))
+        if (likely(ti->preempt_count || irqs_disabled()))
                 return;
 
 need_resched:
diff --git a/kernel/signal.c b/kernel/signal.c
index 7ed8d5304bec..df18c167a2a7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -267,18 +267,25 @@ static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
                                          int override_rlimit)
 {
         struct sigqueue *q = NULL;
+        struct user_struct *user;
 
-        atomic_inc(&t->user->sigpending);
+        /*
+         * In order to avoid problems with "switch_user()", we want to make
+         * sure that the compiler doesn't re-load "t->user"
+         */
+        user = t->user;
+        barrier();
+        atomic_inc(&user->sigpending);
         if (override_rlimit ||
-            atomic_read(&t->user->sigpending) <=
+            atomic_read(&user->sigpending) <=
                         t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
                 q = kmem_cache_alloc(sigqueue_cachep, flags);
         if (unlikely(q == NULL)) {
-                atomic_dec(&t->user->sigpending);
+                atomic_dec(&user->sigpending);
         } else {
                 INIT_LIST_HEAD(&q->list);
                 q->flags = 0;
-                q->user = get_uid(t->user);
+                q->user = get_uid(user);
         }
         return(q);
 }
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index 7a3b2e75f040..d7306d0f3dfc 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -49,6 +49,7 @@ cond_syscall(compat_sys_get_robust_list);
 cond_syscall(sys_epoll_create);
 cond_syscall(sys_epoll_ctl);
 cond_syscall(sys_epoll_wait);
+cond_syscall(sys_epoll_pwait);
 cond_syscall(sys_semget);
 cond_syscall(sys_semop);
 cond_syscall(sys_semtimedop);
@@ -134,6 +135,7 @@ cond_syscall(sys_madvise);
 cond_syscall(sys_mremap);
 cond_syscall(sys_remap_file_pages);
 cond_syscall(compat_sys_move_pages);
+cond_syscall(compat_sys_migrate_pages);
 
 /* block-layer dependent */
 cond_syscall(sys_bdflush);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8020fb273c4f..09e569f4792b 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -136,8 +136,10 @@ static int parse_table(int __user *, int, void __user *, size_t __user *,
 static int proc_do_uts_string(ctl_table *table, int write, struct file *filp,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
 
+#ifdef CONFIG_PROC_SYSCTL
 static int proc_do_cad_pid(ctl_table *table, int write, struct file *filp,
                   void __user *buffer, size_t *lenp, loff_t *ppos);
+#endif
 
 static ctl_table root_table[];
 static struct ctl_table_header root_table_header =
@@ -542,6 +544,7 @@ static ctl_table kern_table[] = {
                 .proc_handler   = &proc_dointvec,
         },
 #endif
+#ifdef CONFIG_PROC_SYSCTL
         {
                 .ctl_name       = KERN_CADPID,
                 .procname       = "cad_pid",
@@ -550,6 +553,7 @@ static ctl_table kern_table[] = {
                 .mode           = 0600,
                 .proc_handler   = &proc_do_cad_pid,
         },
+#endif
         {
                 .ctl_name       = KERN_MAX_THREADS,
                 .procname       = "threads-max",
@@ -1311,7 +1315,9 @@ repeat:
                 return -ENOTDIR;
         if (get_user(n, name))
                 return -EFAULT;
-        for ( ; table->ctl_name; table++) {
+        for ( ; table->ctl_name || table->procname; table++) {
+                if (!table->ctl_name)
+                        continue;
                 if (n == table->ctl_name || table->ctl_name == CTL_ANY) {
                         int error;
                         if (table->child) {
@@ -1528,7 +1534,7 @@ static void register_proc_table(ctl_table * table, struct proc_dir_entry *root,
         int len;
         mode_t mode;
         
-        for (; table->ctl_name; table++) {
+        for (; table->ctl_name || table->procname; table++) {
                 /* Can't do anything without a proc name. */
                 if (!table->procname)
                         continue;
@@ -1575,7 +1581,7 @@ static void register_proc_table(ctl_table * table, struct proc_dir_entry *root,
 static void unregister_proc_table(ctl_table * table, struct proc_dir_entry *root)
 {
         struct proc_dir_entry *de;
-        for (; table->ctl_name; table++) {
+        for (; table->ctl_name || table->procname; table++) {
                 if (!(de = table->de))
                         continue;
                 if (de->mode & S_IFDIR) {
@@ -2676,13 +2682,33 @@ int sysctl_ms_jiffies(ctl_table *table, int __user *name, int nlen,
 asmlinkage long sys_sysctl(struct __sysctl_args __user *args)
 {
         static int msg_count;
+        struct __sysctl_args tmp;
+        int name[CTL_MAXNAME];
+        int i;
+
+        /* Read in the sysctl name for better debug message logging */
+        if (copy_from_user(&tmp, args, sizeof(tmp)))
+                return -EFAULT;
+        if (tmp.nlen <= 0 || tmp.nlen >= CTL_MAXNAME)
+                return -ENOTDIR;
+        for (i = 0; i < tmp.nlen; i++)
+                if (get_user(name[i], tmp.name + i))
+                        return -EFAULT;
+
+        /* Ignore accesses to kernel.version */
+        if ((tmp.nlen == 2) && (name[0] == CTL_KERN) && (name[1] == KERN_VERSION))
+                goto out;
 
         if (msg_count < 5) {
                 msg_count++;
                 printk(KERN_INFO
                         "warning: process `%s' used the removed sysctl "
-                        "system call\n", current->comm);
+                        "system call with ", current->comm);
+                for (i = 0; i < tmp.nlen; i++)
+                        printk("%d.", name[i]);
+                printk("\n");
         }
+out:
         return -ENOSYS;
 }
 
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 5d6a8c54ee85..f45c5e70773c 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -77,7 +77,8 @@ static int prepare_reply(struct genl_info *info, u8 cmd, struct sk_buff **skbp,
         /*
          * If new attributes are added, please revisit this allocation
          */
-        skb = nlmsg_new(genlmsg_total_size(size), GFP_KERNEL);
+        size = nlmsg_total_size(genlmsg_total_size(size));
+        skb = nlmsg_new(size, GFP_KERNEL);
         if (!skb)
                 return -ENOMEM;
 
@@ -174,21 +175,19 @@ static void send_cpu_listeners(struct sk_buff *skb, unsigned int cpu)
         up_write(&listeners->sem);
 }
 
-static int fill_pid(pid_t pid, struct task_struct *pidtsk,
+static int fill_pid(pid_t pid, struct task_struct *tsk,
                 struct taskstats *stats)
 {
         int rc = 0;
-        struct task_struct *tsk = pidtsk;
 
-        if (!pidtsk) {
-                read_lock(&tasklist_lock);
+        if (!tsk) {
+                rcu_read_lock();
                 tsk = find_task_by_pid(pid);
-                if (!tsk) {
-                        read_unlock(&tasklist_lock);
+                if (tsk)
+                        get_task_struct(tsk);
+                rcu_read_unlock();
+                if (!tsk)
                         return -ESRCH;
-                }
-                get_task_struct(tsk);
-                read_unlock(&tasklist_lock);
         } else
                 get_task_struct(tsk);
 
@@ -214,39 +213,30 @@ static int fill_pid(pid_t pid, struct task_struct *pidtsk,
 
 }
 
-static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
+static int fill_tgid(pid_t tgid, struct task_struct *first,
                 struct taskstats *stats)
 {
-        struct task_struct *tsk, *first;
+        struct task_struct *tsk;
         unsigned long flags;
+        int rc = -ESRCH;
 
         /*
          * Add additional stats from live tasks except zombie thread group
          * leaders who are already counted with the dead tasks
          */
-        first = tgidtsk;
-        if (!first) {
-                read_lock(&tasklist_lock);
+        rcu_read_lock();
+        if (!first)
                 first = find_task_by_pid(tgid);
-                if (!first) {
-                        read_unlock(&tasklist_lock);
-                        return -ESRCH;
-                }
-                get_task_struct(first);
-                read_unlock(&tasklist_lock);
-        } else
-                get_task_struct(first);
 
-        /* Start with stats from dead tasks */
-        spin_lock_irqsave(&first->signal->stats_lock, flags);
+        if (!first || !lock_task_sighand(first, &flags))
+                goto out;
+
         if (first->signal->stats)
                 memcpy(stats, first->signal->stats, sizeof(*stats));
-        spin_unlock_irqrestore(&first->signal->stats_lock, flags);
 
         tsk = first;
-        read_lock(&tasklist_lock);
         do {
-                if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
+                if (tsk->exit_state)
                         continue;
                 /*
                  * Accounting subsystem can call its functions here to
@@ -257,15 +247,18 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
                 delayacct_add_tsk(stats, tsk);
 
         } while_each_thread(first, tsk);
-        read_unlock(&tasklist_lock);
-        stats->version = TASKSTATS_VERSION;
 
+        unlock_task_sighand(first, &flags);
+        rc = 0;
+out:
+        rcu_read_unlock();
+
+        stats->version = TASKSTATS_VERSION;
         /*
          * Accounting subsytems can also add calls here to modify
          * fields of taskstats.
          */
-
-        return 0;
+        return rc;
 }
 
 
@@ -273,7 +266,7 @@ static void fill_tgid_exit(struct task_struct *tsk)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&tsk->signal->stats_lock, flags);
+        spin_lock_irqsave(&tsk->sighand->siglock, flags);
         if (!tsk->signal->stats)
                 goto ret;
 
@@ -285,7 +278,7 @@ static void fill_tgid_exit(struct task_struct *tsk)
          */
         delayacct_add_tsk(tsk->signal->stats, tsk);
 ret:
-        spin_unlock_irqrestore(&tsk->signal->stats_lock, flags);
+        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
         return;
 }
 
@@ -419,7 +412,7 @@ static int taskstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
         return send_reply(rep_skb, info->snd_pid);
 
 nla_put_failure:
-        return genlmsg_cancel(rep_skb, reply);
+        rc = genlmsg_cancel(rep_skb, reply);
 err:
         nlmsg_free(rep_skb);
         return rc;
@@ -461,24 +454,26 @@ void taskstats_exit_send(struct task_struct *tsk, struct taskstats *tidstats,
         size_t size;
         int is_thread_group;
         struct nlattr *na;
-        unsigned long flags;
 
-        if (!family_registered || !tidstats)
+        if (!family_registered)
                 return;
 
-        spin_lock_irqsave(&tsk->signal->stats_lock, flags);
-        is_thread_group = tsk->signal->stats ? 1 : 0;
-        spin_unlock_irqrestore(&tsk->signal->stats_lock, flags);
-
-        rc = 0;
         /*
          * Size includes space for nested attributes
          */
         size = nla_total_size(sizeof(u32)) +
                 nla_total_size(sizeof(struct taskstats)) + nla_total_size(0);
 
-        if (is_thread_group)
-                size = 2 * size;        /* PID + STATS + TGID + STATS */
+        is_thread_group = (tsk->signal->stats != NULL);
+        if (is_thread_group) {
+                /* PID + STATS + TGID + STATS */
+                size = 2 * size;
+                /* fill the tsk->signal->stats structure */
+                fill_tgid_exit(tsk);
+        }
+
+        if (!tidstats)
+                return;
 
         rc = prepare_reply(NULL, TASKSTATS_CMD_NEW, &rep_skb, &reply, size);
         if (rc < 0)
@@ -498,11 +493,8 @@ void taskstats_exit_send(struct task_struct *tsk, struct taskstats *tidstats,
                 goto send;
 
         /*
-         * tsk has/had a thread group so fill the tsk->signal->stats structure
          * Doesn't matter if tsk is the leader or the last group member leaving
          */
-
-        fill_tgid_exit(tsk);
         if (!group_dead)
                 goto send;
 
@@ -519,7 +511,6 @@ send:
 
 nla_put_failure:
         genlmsg_cancel(rep_skb, reply);
-        goto ret;
 err_skb:
         nlmsg_free(rep_skb);
 ret:
diff --git a/kernel/time/jiffies.c b/kernel/time/jiffies.c
index 126bb30c4afe..a99b2a6e6a07 100644
--- a/kernel/time/jiffies.c
+++ b/kernel/time/jiffies.c
@@ -57,7 +57,7 @@ static cycle_t jiffies_read(void)
 
 struct clocksource clocksource_jiffies = {
         .name           = "jiffies",
-        .rating         = 0, /* lowest rating*/
+        .rating         = 1, /* lowest valid rating*/
         .read           = jiffies_read,
         .mask           = 0xffffffff, /*32bits*/
         .mult           = NSEC_PER_JIFFY << JIFFIES_SHIFT, /* details above */
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 47195fa0ec4f..3afeaa3a73f9 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -161,9 +161,9 @@ void second_overflow(void)
                         time_adjust += MAX_TICKADJ;
                         tick_length -= MAX_TICKADJ_SCALED;
                 } else {
-                        time_adjust = 0;
                         tick_length += (s64)(time_adjust * NSEC_PER_USEC /
                                              HZ) << TICK_LENGTH_SHIFT;
+                        time_adjust = 0;
                 }
         }
 }
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index db443221ba5b..96f77013d3f0 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -36,7 +36,7 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
 
         /* calculate task elapsed time in timespec */
         do_posix_clock_monotonic_gettime(&uptime);
-        ts = timespec_sub(uptime, current->group_leader->start_time);
+        ts = timespec_sub(uptime, tsk->start_time);
         /* rebase elapsed time to usec */
         ac_etime = timespec_to_ns(&ts);
         do_div(ac_etime, NSEC_PER_USEC);
@@ -58,7 +58,10 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
         stats->ac_uid    = tsk->uid;
         stats->ac_gid    = tsk->gid;
         stats->ac_pid    = tsk->pid;
-        stats->ac_ppid   = (tsk->parent) ? tsk->parent->pid : 0;
+        rcu_read_lock();
+        stats->ac_ppid   = pid_alive(tsk) ?
+                                rcu_dereference(tsk->real_parent)->tgid : 0;
+        rcu_read_unlock();
         stats->ac_utime  = cputime_to_msecs(tsk->utime) * USEC_PER_MSEC;
         stats->ac_stime  = cputime_to_msecs(tsk->stime) * USEC_PER_MSEC;
         stats->ac_minflt = tsk->min_flt;
@@ -77,13 +80,17 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
  */
 void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
 {
+        struct mm_struct *mm;
+
         /* convert pages-jiffies to Mbyte-usec */
         stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
         stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
-        if (p->mm) {
+        mm = get_task_mm(p);
+        if (mm) {
                 /* adjust to KB unit */
-                stats->hiwater_rss   = p->mm->hiwater_rss * PAGE_SIZE / KB;
-                stats->hiwater_vm    = p->mm->hiwater_vm * PAGE_SIZE / KB;
+                stats->hiwater_rss   = mm->hiwater_rss * PAGE_SIZE / KB;
+                stats->hiwater_vm    = mm->hiwater_vm * PAGE_SIZE / KB;
+                mmput(mm);
         }
         stats->read_char        = p->rchar;
         stats->write_char       = p->wchar;
diff --git a/kernel/unwind.c b/kernel/unwind.c
index 2e2368607aab..f7e50d16dbf6 100644
--- a/kernel/unwind.c
+++ b/kernel/unwind.c
@@ -11,13 +11,15 @@
 
 #include <linux/unwind.h>
 #include <linux/module.h>
-#include <linux/delay.h>
+#include <linux/bootmem.h>
+#include <linux/sort.h>
 #include <linux/stop_machine.h>
 #include <asm/sections.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 
 extern char __start_unwind[], __end_unwind[];
+extern const u8 __start_unwind_hdr[], __end_unwind_hdr[];
 
 #define MAX_STACK_DEPTH 8
 
@@ -100,6 +102,8 @@ static struct unwind_table {
         } core, init;
         const void *address;
         unsigned long size;
+        const unsigned char *header;
+        unsigned long hdrsz;
         struct unwind_table *link;
         const char *name;
 } root_table;
@@ -145,6 +149,10 @@ static struct unwind_table *find_table(unsigned long pc)
         return table;
 }
 
+static unsigned long read_pointer(const u8 **pLoc,
+                                  const void *end,
+                                  signed ptrType);
+
 static void init_unwind_table(struct unwind_table *table,
                               const char *name,
                               const void *core_start,
@@ -152,14 +160,30 @@ static void init_unwind_table(struct unwind_table *table,
                               const void *init_start,
                               unsigned long init_size,
                               const void *table_start,
-                              unsigned long table_size)
+                              unsigned long table_size,
+                              const u8 *header_start,
+                              unsigned long header_size)
 {
+        const u8 *ptr = header_start + 4;
+        const u8 *end = header_start + header_size;
+
         table->core.pc = (unsigned long)core_start;
         table->core.range = core_size;
         table->init.pc = (unsigned long)init_start;
         table->init.range = init_size;
         table->address = table_start;
         table->size = table_size;
+        /* See if the linker provided table looks valid. */
+        if (header_size <= 4
+            || header_start[0] != 1
+            || (void *)read_pointer(&ptr, end, header_start[1]) != table_start
+            || header_start[2] == DW_EH_PE_omit
+            || read_pointer(&ptr, end, header_start[2]) <= 0
+            || header_start[3] == DW_EH_PE_omit)
+                header_start = NULL;
+        table->hdrsz = header_size;
+        smp_wmb();
+        table->header = header_start;
         table->link = NULL;
         table->name = name;
 }
@@ -169,7 +193,143 @@ void __init unwind_init(void)
         init_unwind_table(&root_table, "kernel",
                           _text, _end - _text,
                           NULL, 0,
-                          __start_unwind, __end_unwind - __start_unwind);
+                          __start_unwind, __end_unwind - __start_unwind,
+                          __start_unwind_hdr, __end_unwind_hdr - __start_unwind_hdr);
+}
+
+static const u32 bad_cie, not_fde;
+static const u32 *cie_for_fde(const u32 *fde, const struct unwind_table *);
+static signed fde_pointer_type(const u32 *cie);
+
+struct eh_frame_hdr_table_entry {
+        unsigned long start, fde;
+};
+
+static int cmp_eh_frame_hdr_table_entries(const void *p1, const void *p2)
+{
+        const struct eh_frame_hdr_table_entry *e1 = p1;
+        const struct eh_frame_hdr_table_entry *e2 = p2;
+
+        return (e1->start > e2->start) - (e1->start < e2->start);
+}
+
+static void swap_eh_frame_hdr_table_entries(void *p1, void *p2, int size)
+{
+        struct eh_frame_hdr_table_entry *e1 = p1;
+        struct eh_frame_hdr_table_entry *e2 = p2;
+        unsigned long v;
+
+        v = e1->start;
+        e1->start = e2->start;
+        e2->start = v;
+        v = e1->fde;
+        e1->fde = e2->fde;
+        e2->fde = v;
+}
+
+static void __init setup_unwind_table(struct unwind_table *table,
+                                        void *(*alloc)(unsigned long))
+{
+        const u8 *ptr;
+        unsigned long tableSize = table->size, hdrSize;
+        unsigned n;
+        const u32 *fde;
+        struct {
+                u8 version;
+                u8 eh_frame_ptr_enc;
+                u8 fde_count_enc;
+                u8 table_enc;
+                unsigned long eh_frame_ptr;
+                unsigned int fde_count;
+                struct eh_frame_hdr_table_entry table[];
+        } __attribute__((__packed__)) *header;
+
+        if (table->header)
+                return;
+
+        if (table->hdrsz)
+                printk(KERN_WARNING ".eh_frame_hdr for '%s' present but unusable\n",
+                       table->name);
+
+        if (tableSize & (sizeof(*fde) - 1))
+                return;
+
+        for (fde = table->address, n = 0;
+             tableSize > sizeof(*fde) && tableSize - sizeof(*fde) >= *fde;
+             tableSize -= sizeof(*fde) + *fde, fde += 1 + *fde / sizeof(*fde)) {
+                const u32 *cie = cie_for_fde(fde, table);
+                signed ptrType;
+
+                if (cie == &not_fde)
+                        continue;
+                if (cie == NULL
+                    || cie == &bad_cie
+                    || (ptrType = fde_pointer_type(cie)) < 0)
+                        return;
+                ptr = (const u8 *)(fde + 2);
+                if (!read_pointer(&ptr,
+                                  (const u8 *)(fde + 1) + *fde,
+                                  ptrType))
+                        return;
+                ++n;
+        }
+
+        if (tableSize || !n)
+                return;
+
+        hdrSize = 4 + sizeof(unsigned long) + sizeof(unsigned int)
+                + 2 * n * sizeof(unsigned long);
+        header = alloc(hdrSize);
+        if (!header)
+                return;
+        header->version          = 1;
+        header->eh_frame_ptr_enc = DW_EH_PE_abs|DW_EH_PE_native;
+        header->fde_count_enc    = DW_EH_PE_abs|DW_EH_PE_data4;
+        header->table_enc        = DW_EH_PE_abs|DW_EH_PE_native;
+        put_unaligned((unsigned long)table->address, &header->eh_frame_ptr);
+        BUILD_BUG_ON(offsetof(typeof(*header), fde_count)
+                     % __alignof(typeof(header->fde_count)));
+        header->fde_count        = n;
+
+        BUILD_BUG_ON(offsetof(typeof(*header), table)
+                     % __alignof(typeof(*header->table)));
+        for (fde = table->address, tableSize = table->size, n = 0;
+             tableSize;
+             tableSize -= sizeof(*fde) + *fde, fde += 1 + *fde / sizeof(*fde)) {
+                const u32 *cie = fde + 1 - fde[1] / sizeof(*fde);
+
+                if (!fde[1])
+                        continue; /* this is a CIE */
+                ptr = (const u8 *)(fde + 2);
+                header->table[n].start = read_pointer(&ptr,
+                                                      (const u8 *)(fde + 1) + *fde,
+                                                      fde_pointer_type(cie));
+                header->table[n].fde = (unsigned long)fde;
+                ++n;
+        }
+        WARN_ON(n != header->fde_count);
+
+        sort(header->table,
+             n,
+             sizeof(*header->table),
+             cmp_eh_frame_hdr_table_entries,
+             swap_eh_frame_hdr_table_entries);
+
+        table->hdrsz = hdrSize;
+        smp_wmb();
+        table->header = (const void *)header;
+}
+
+static void *__init balloc(unsigned long sz)
+{
+        return __alloc_bootmem_nopanic(sz,
+                                       sizeof(unsigned int),
+                                       __pa(MAX_DMA_ADDRESS));
+}
+
+void __init unwind_setup(void)
+{
+        setup_unwind_table(&root_table, balloc);
 }
 
 #ifdef CONFIG_MODULES
@@ -193,7 +353,8 @@ void *unwind_add_table(struct module *module,
         init_unwind_table(table, module->name,
                           module->module_core, module->core_size,
                           module->module_init, module->init_size,
-                          table_start, table_size);
+                          table_start, table_size,
+                          NULL, 0);
 
         if (last_table)
                 last_table->link = table;
@@ -303,6 +464,26 @@ static sleb128_t get_sleb128(const u8 **pcur, const u8 *end)
         return value;
 }
 
+static const u32 *cie_for_fde(const u32 *fde, const struct unwind_table *table)
+{
+        const u32 *cie;
+
+        if (!*fde || (*fde & (sizeof(*fde) - 1)))
+                return &bad_cie;
+        if (!fde[1])
+                return &not_fde; /* this is a CIE */
+        if ((fde[1] & (sizeof(*fde) - 1))
+            || fde[1] > (unsigned long)(fde + 1) - (unsigned long)table->address)
+                return NULL; /* this is not a valid FDE */
+        cie = fde + 1 - fde[1] / sizeof(*fde);
+        if (*cie <= sizeof(*cie) + 4
+            || *cie >= fde[1] - sizeof(*fde)
+            || (*cie & (sizeof(*cie) - 1))
+            || cie[1])
+                return NULL; /* this is not a (valid) CIE */
+        return cie;
+}
+
 static unsigned long read_pointer(const u8 **pLoc,
                                   const void *end,
                                   signed ptrType)
@@ -610,49 +791,108 @@ int unwind(struct unwind_frame_info *frame)
         unsigned i;
         signed ptrType = -1;
         uleb128_t retAddrReg = 0;
-        struct unwind_table *table;
+        const struct unwind_table *table;
         struct unwind_state state;
 
         if (UNW_PC(frame) == 0)
                 return -EINVAL;
         if ((table = find_table(pc)) != NULL
             && !(table->size & (sizeof(*fde) - 1))) {
-                unsigned long tableSize = table->size;
-
-                for (fde = table->address;
-                     tableSize > sizeof(*fde) && tableSize - sizeof(*fde) >= *fde;
-                     tableSize -= sizeof(*fde) + *fde,
-                     fde += 1 + *fde / sizeof(*fde)) {
-                        if (!*fde || (*fde & (sizeof(*fde) - 1)))
-                                break;
-                        if (!fde[1])
-                                continue; /* this is a CIE */
-                        if ((fde[1] & (sizeof(*fde) - 1))
-                            || fde[1] > (unsigned long)(fde + 1)
-                                        - (unsigned long)table->address)
-                                continue; /* this is not a valid FDE */
-                        cie = fde + 1 - fde[1] / sizeof(*fde);
-                        if (*cie <= sizeof(*cie) + 4
-                            || *cie >= fde[1] - sizeof(*fde)
-                            || (*cie & (sizeof(*cie) - 1))
-                            || cie[1]
-                            || (ptrType = fde_pointer_type(cie)) < 0) {
-                                cie = NULL; /* this is not a (valid) CIE */
-                                continue;
+                const u8 *hdr = table->header;
+                unsigned long tableSize;
+
+                smp_rmb();
+                if (hdr && hdr[0] == 1) {
+                        switch(hdr[3] & DW_EH_PE_FORM) {
+                        case DW_EH_PE_native: tableSize = sizeof(unsigned long); break;
+                        case DW_EH_PE_data2: tableSize = 2; break;
+                        case DW_EH_PE_data4: tableSize = 4; break;
+                        case DW_EH_PE_data8: tableSize = 8; break;
+                        default: tableSize = 0; break;
+                        }
+                        ptr = hdr + 4;
+                        end = hdr + table->hdrsz;
+                        if (tableSize
+                            && read_pointer(&ptr, end, hdr[1])
+                               == (unsigned long)table->address
+                            && (i = read_pointer(&ptr, end, hdr[2])) > 0
+                            && i == (end - ptr) / (2 * tableSize)
+                            && !((end - ptr) % (2 * tableSize))) {
+                                do {
+                                        const u8 *cur = ptr + (i / 2) * (2 * tableSize);
+
+                                        startLoc = read_pointer(&cur,
+                                                                cur + tableSize,
+                                                                hdr[3]);
+                                        if (pc < startLoc)
+                                                i /= 2;
+                                        else {
+                                                ptr = cur - tableSize;
+                                                i = (i + 1) / 2;
+                                        }
+                                } while (startLoc && i > 1);
+                                if (i == 1
+                                    && (startLoc = read_pointer(&ptr,
+                                                                ptr + tableSize,
+                                                                hdr[3])) != 0
+                                    && pc >= startLoc)
+                                        fde = (void *)read_pointer(&ptr,
+                                                                   ptr + tableSize,
+                                                                   hdr[3]);
                         }
+                }
+
+                if (fde != NULL) {
+                        cie = cie_for_fde(fde, table);
                         ptr = (const u8 *)(fde + 2);
-                        startLoc = read_pointer(&ptr,
-                                                (const u8 *)(fde + 1) + *fde,
-                                                ptrType);
-                        endLoc = startLoc
-                                 + read_pointer(&ptr,
-                                                (const u8 *)(fde + 1) + *fde,
-                                                ptrType & DW_EH_PE_indirect
-                                                ? ptrType
-                                                : ptrType & (DW_EH_PE_FORM|DW_EH_PE_signed));
-                        if (pc >= startLoc && pc < endLoc)
-                                break;
-                        cie = NULL;
+                        if(cie != NULL
+                           && cie != &bad_cie
+                           && cie != &not_fde
+                           && (ptrType = fde_pointer_type(cie)) >= 0
+                           && read_pointer(&ptr,
+                                           (const u8 *)(fde + 1) + *fde,
+                                           ptrType) == startLoc) {
+                                if (!(ptrType & DW_EH_PE_indirect))
+                                        ptrType &= DW_EH_PE_FORM|DW_EH_PE_signed;
+                                endLoc = startLoc
+                                         + read_pointer(&ptr,
+                                                        (const u8 *)(fde + 1) + *fde,
+                                                        ptrType);
+                                if(pc >= endLoc)
+                                        fde = NULL;
+                        } else
+                                fde = NULL;
+                }
+                if (fde == NULL) {
+                        for (fde = table->address, tableSize = table->size;
+                             cie = NULL, tableSize > sizeof(*fde)
+                             && tableSize - sizeof(*fde) >= *fde;
+                             tableSize -= sizeof(*fde) + *fde,
+                             fde += 1 + *fde / sizeof(*fde)) {
+                                cie = cie_for_fde(fde, table);
+                                if (cie == &bad_cie) {
+                                        cie = NULL;
+                                        break;
+                                }
+                                if (cie == NULL
+                                    || cie == &not_fde
+                                    || (ptrType = fde_pointer_type(cie)) < 0)
+                                        continue;
+                                ptr = (const u8 *)(fde + 2);
+                                startLoc = read_pointer(&ptr,
+                                                        (const u8 *)(fde + 1) + *fde,
+                                                        ptrType);
+                                if (!startLoc)
+                                        continue;
+                                if (!(ptrType & DW_EH_PE_indirect))
+                                        ptrType &= DW_EH_PE_FORM|DW_EH_PE_signed;
+                                endLoc = startLoc
+                                         + read_pointer(&ptr,
+                                                        (const u8 *)(fde + 1) + *fde,
+                                                        ptrType);
+                                if (pc >= startLoc && pc < endLoc)
+                                        break;
+                        }
                 }
         }
         if (cie != NULL) {
diff --git a/kernel/user.c b/kernel/user.c
index 6408c0424291..220e586127a0 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -187,6 +187,17 @@ void switch_uid(struct user_struct *new_user)
         atomic_dec(&old_user->processes);
         switch_uid_keyring(new_user);
         current->user = new_user;
+
+        /*
+         * We need to synchronize with __sigqueue_alloc()
+         * doing a get_uid(p->user).. If that saw the old
+         * user value, we need to wait until it has exited
+         * its critical region before we can free the old
+         * structure.
+         */
+        smp_mb();
+        spin_unlock_wait(&current->sighand->siglock);
+
         free_uid(old_user);
         suid_keys(current);
 }
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index cfc737bffe6d..17c2f03d2c27 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -28,6 +28,7 @@
 #include <linux/notifier.h>
 #include <linux/kthread.h>
 #include <linux/hardirq.h>
+#include <linux/mempolicy.h>
 
 /*
  * The per-CPU workqueue (if single thread, we always use the first
@@ -98,7 +99,7 @@ static void __queue_work(struct cpu_workqueue_struct *cwq,
  * @wq: workqueue to use
  * @work: work to queue
  *
- * Returns non-zero if it was successfully added.
+ * Returns 0 if @work was already on a queue, non-zero otherwise.
  *
  * We queue the work to the CPU it was submitted, but there is no
  * guarantee that it will be processed by that CPU.
@@ -137,7 +138,7 @@ static void delayed_work_timer_fn(unsigned long __data)
  * @work: work to queue
  * @delay: number of jiffies to wait before queueing
  *
- * Returns non-zero if it was successfully added.
+ * Returns 0 if @work was already on a queue, non-zero otherwise.
  */
 int fastcall queue_delayed_work(struct workqueue_struct *wq,
                         struct work_struct *work, unsigned long delay)
@@ -168,7 +169,7 @@ EXPORT_SYMBOL_GPL(queue_delayed_work);
  * @work: work to queue
  * @delay: number of jiffies to wait before queueing
  *
- * Returns non-zero if it was successfully added.
+ * Returns 0 if @work was already on a queue, non-zero otherwise.
  */
 int queue_delayed_work_on(int cpu, struct workqueue_struct *wq,
                         struct work_struct *work, unsigned long delay)
@@ -245,6 +246,12 @@ static int worker_thread(void *__cwq)
         sigprocmask(SIG_BLOCK, &blocked, NULL);
         flush_signals(current);
 
+        /*
+         * We inherited MPOL_INTERLEAVE from the booting kernel.
+         * Set MPOL_DEFAULT to insure node local allocations.
+         */
+        numa_default_policy();
+
         /* SIG_IGN makes children autoreap: see do_notify_parent(). */
         sa.sa.sa_handler = SIG_IGN;
         sa.sa.sa_flags = 0;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 756a908c441d..d3679103a8e4 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -71,7 +71,7 @@ config LOG_BUF_SHIFT
 
 config DETECT_SOFTLOCKUP
         bool "Detect Soft Lockups"
-        depends on DEBUG_KERNEL
+        depends on DEBUG_KERNEL && !S390
         default y
         help
           Say Y here to enable the kernel to detect "soft lockups",
@@ -341,7 +341,7 @@ config FRAME_POINTER
 
 config UNWIND_INFO
         bool "Compile the kernel with frame unwind information"
-        depends on !IA64 && !PARISC
+        depends on !IA64 && !PARISC && !ARM
         depends on !MODULES || !(MIPS || PPC || SUPERH || V850)
         help
           If you say Y here the resulting kernel image will be slightly larger
@@ -371,6 +371,20 @@ config FORCED_INLINING
           become the default in the future, until then this option is there to
           test gcc for this.
 
+config HEADERS_CHECK
+        bool "Run 'make headers_check' when building vmlinux"
+        depends on !UML
+        help
+          This option will extract the user-visible kernel headers whenever
+          building the kernel, and will run basic sanity checks on them to
+          ensure that exported files do not attempt to include files which
+          were not exported, etc.
+
+          If you're making modifications to header files which are
+          relevant for userspace, say 'Y', and check the headers
+          exported to $(INSTALL_HDR_PATH) (usually 'usr/include' in
+          your build tree), to make sure they're suitable.
+
 config RCU_TORTURE_TEST
         tristate "torture tests for RCU"
         depends on DEBUG_KERNEL
diff --git a/lib/Makefile b/lib/Makefile
index 8e6662bb9c37..cf98fabaa549 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -12,7 +12,7 @@ lib-$(CONFIG_SMP) += cpumask.o
 
 lib-y   += kobject.o kref.o kobject_uevent.o klist.o
 
-obj-y += sort.o parser.o halfmd4.o iomap_copy.o debug_locks.o
+obj-y += sort.o parser.o halfmd4.o iomap_copy.o debug_locks.o random32.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/bitmap.c b/lib/bitmap.c
index d71e38c54ea5..037fa9aa2ed7 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -316,10 +316,11 @@ int bitmap_scnprintf(char *buf, unsigned int buflen,
 EXPORT_SYMBOL(bitmap_scnprintf);
 
 /**
- * bitmap_parse - convert an ASCII hex string into a bitmap.
- * @ubuf: pointer to buffer in user space containing string.
- * @ubuflen: buffer size in bytes.  If string is smaller than this
+ * __bitmap_parse - convert an ASCII hex string into a bitmap.
+ * @buf: pointer to buffer containing string.
+ * @buflen: buffer size in bytes.  If string is smaller than this
  *    then it must be terminated with a \0.
+ * @is_user: location of buffer, 0 indicates kernel space
  * @maskp: pointer to bitmap array that will contain result.
  * @nmaskbits: size of bitmap, in bits.
  *
@@ -330,11 +331,13 @@ EXPORT_SYMBOL(bitmap_scnprintf);
  * characters and for grouping errors such as "1,,5", ",44", "," and "".
  * Leading and trailing whitespace accepted, but not embedded whitespace.
  */
-int bitmap_parse(const char __user *ubuf, unsigned int ubuflen,
-        unsigned long *maskp, int nmaskbits)
+int __bitmap_parse(const char *buf, unsigned int buflen,
+                int is_user, unsigned long *maskp,
+                int nmaskbits)
 {
         int c, old_c, totaldigits, ndigits, nchunks, nbits;
         u32 chunk;
+        const char __user *ubuf = buf;
 
         bitmap_zero(maskp, nmaskbits);
 
@@ -343,11 +346,15 @@ int bitmap_parse(const char __user *ubuf, unsigned int ubuflen,
                 chunk = ndigits = 0;
 
                 /* Get the next chunk of the bitmap */
-                while (ubuflen) {
+                while (buflen) {
                         old_c = c;
-                        if (get_user(c, ubuf++))
-                                return -EFAULT;
-                        ubuflen--;
+                        if (is_user) {
+                                if (__get_user(c, ubuf++))
+                                        return -EFAULT;
+                        }
+                        else
+                                c = *buf++;
+                        buflen--;
                         if (isspace(c))
                                 continue;
 
@@ -388,11 +395,36 @@ int bitmap_parse(const char __user *ubuf, unsigned int ubuflen,
                 nbits += (nchunks == 1) ? nbits_to_hold_value(chunk) : CHUNKSZ;
                 if (nbits > nmaskbits)
                         return -EOVERFLOW;
-        } while (ubuflen && c == ',');
+        } while (buflen && c == ',');
 
         return 0;
 }
-EXPORT_SYMBOL(bitmap_parse);
+EXPORT_SYMBOL(__bitmap_parse);
+
+/**
+ * bitmap_parse_user()
+ *
+ * @ubuf: pointer to user buffer containing string.
+ * @ulen: buffer size in bytes.  If string is smaller than this
+ *    then it must be terminated with a \0.
+ * @maskp: pointer to bitmap array that will contain result.
+ * @nmaskbits: size of bitmap, in bits.
+ *
+ * Wrapper for __bitmap_parse(), providing it with user buffer.
+ *
+ * We cannot have this as an inline function in bitmap.h because it needs
+ * linux/uaccess.h to get the access_ok() declaration and this causes
+ * cyclic dependencies.
+ */
+int bitmap_parse_user(const char __user *ubuf,
+                        unsigned int ulen, unsigned long *maskp,
+                        int nmaskbits)
+{
+        if (!access_ok(VERIFY_READ, ubuf, ulen))
+                return -EFAULT;
+        return __bitmap_parse((const char *)ubuf, ulen, 1, maskp, nmaskbits);
+}
+EXPORT_SYMBOL(bitmap_parse_user);
 
 /*
  * bscnl_emit(buf, buflen, rbot, rtop, bp)
diff --git a/lib/cpumask.c b/lib/cpumask.c
index 7a2a73f88d59..3a67dc5ada7d 100644
--- a/lib/cpumask.c
+++ b/lib/cpumask.c
@@ -43,19 +43,3 @@ int __any_online_cpu(const cpumask_t *mask)
         return cpu;
 }
 EXPORT_SYMBOL(__any_online_cpu);
-
-#if MAX_NUMNODES > 1
-/*
- * Find the highest possible node id.
- */
-int highest_possible_node_id(void)
-{
-        unsigned int node;
-        unsigned int highest = 0;
-
-        for_each_node_mask(node, node_possible_map)
-                highest = node;
-        return highest;
-}
-EXPORT_SYMBOL(highest_possible_node_id);
-#endif
diff --git a/lib/kobject.c b/lib/kobject.c
index 1699eb9161f3..7dd5c0e9d996 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -119,6 +119,7 @@ char *kobject_get_path(struct kobject *kobj, gfp_t gfp_mask)
 
         return path;
 }
+EXPORT_SYMBOL_GPL(kobject_get_path);
 
 /**
  *      kobject_init - initialize object.
diff --git a/lib/random32.c b/lib/random32.c
new file mode 100644
index 000000000000..4a15ce51cea7
--- /dev/null
+++ b/lib/random32.c
@@ -0,0 +1,142 @@
+/*
+  This is a maximally equidistributed combined Tausworthe generator
+  based on code from GNU Scientific Library 1.5 (30 Jun 2004)
+
+   x_n = (s1_n ^ s2_n ^ s3_n)
+
+   s1_{n+1} = (((s1_n & 4294967294) <<12) ^ (((s1_n <<13) ^ s1_n) >>19))
+   s2_{n+1} = (((s2_n & 4294967288) << 4) ^ (((s2_n << 2) ^ s2_n) >>25))
+   s3_{n+1} = (((s3_n & 4294967280) <<17) ^ (((s3_n << 3) ^ s3_n) >>11))
+
+   The period of this generator is about 2^88.
+
+   From: P. L'Ecuyer, "Maximally Equidistributed Combined Tausworthe
+   Generators", Mathematics of Computation, 65, 213 (1996), 203--213.
+
+   This is available on the net from L'Ecuyer's home page,
+
+   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps
+   ftp://ftp.iro.umontreal.ca/pub/simulation/lecuyer/papers/tausme.ps
+
+   There is an erratum in the paper "Tables of Maximally
+   Equidistributed Combined LFSR Generators", Mathematics of
+   Computation, 68, 225 (1999), 261--269:
+   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps
+
+        ... the k_j most significant bits of z_j must be non-
+        zero, for each j. (Note: this restriction also applies to the
+        computer code given in [4], but was mistakenly not mentioned in
+        that paper.)
+
+   This affects the seeding procedure by imposing the requirement
+   s1 > 1, s2 > 7, s3 > 15.
+
+*/
+
+#include <linux/types.h>
+#include <linux/percpu.h>
+#include <linux/module.h>
+#include <linux/random.h>
+
+struct rnd_state {
+        u32 s1, s2, s3;
+};
+
+static DEFINE_PER_CPU(struct rnd_state, net_rand_state);
+
+static u32 __random32(struct rnd_state *state)
+{
+#define TAUSWORTHE(s,a,b,c,d) ((s&c)<<d) ^ (((s <<a) ^ s)>>b)
+
+        state->s1 = TAUSWORTHE(state->s1, 13, 19, 4294967294UL, 12);
+        state->s2 = TAUSWORTHE(state->s2, 2, 25, 4294967288UL, 4);
+        state->s3 = TAUSWORTHE(state->s3, 3, 11, 4294967280UL, 17);
+
+        return (state->s1 ^ state->s2 ^ state->s3);
+}
+
+static void __set_random32(struct rnd_state *state, unsigned long s)
+{
+        if (s == 0)
+                s = 1;      /* default seed is 1 */
+
+#define LCG(n) (69069 * n)
+        state->s1 = LCG(s);
+        state->s2 = LCG(state->s1);
+        state->s3 = LCG(state->s2);
+
+        /* "warm it up" */
+        __random32(state);
+        __random32(state);
+        __random32(state);
+        __random32(state);
+        __random32(state);
+        __random32(state);
+}
+
+/**
+ *      random32 - pseudo random number generator
+ *
+ *      A 32 bit pseudo-random number is generated using a fast
+ *      algorithm suitable for simulation. This algorithm is NOT
+ *      considered safe for cryptographic use.
+ */
+u32 random32(void)
+{
+        unsigned long r;
+        struct rnd_state *state = &get_cpu_var(net_rand_state);
+        r = __random32(state);
+        put_cpu_var(state);
+        return r;
+}
+EXPORT_SYMBOL(random32);
+
+/**
+ *      srandom32 - add entropy to pseudo random number generator
+ *      @seed: seed value
+ *
+ *      Add some additional seeding to the random32() pool.
+ *      Note: this pool is per cpu so it only affects current CPU.
+ */
+void srandom32(u32 entropy)
+{
+        struct rnd_state *state = &get_cpu_var(net_rand_state);
+        __set_random32(state, state->s1 ^ entropy);
+        put_cpu_var(state);
+}
+EXPORT_SYMBOL(srandom32);
+
+/*
+ *      Generate some initially weak seeding values to allow
+ *      to start the random32() engine.
+ */
+static int __init random32_init(void)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                struct rnd_state *state = &per_cpu(net_rand_state,i);
+                __set_random32(state, i + jiffies);
+        }
+        return 0;
+}
+core_initcall(random32_init);
+
+/*
+ *      Generate better values after random number generator
+ *      is fully initalized.
+ */
+static int __init random32_reseed(void)
+{
+        int i;
+        unsigned long seed;
+
+        for_each_possible_cpu(i) {
+                struct rnd_state *state = &per_cpu(net_rand_state,i);
+
+                get_random_bytes(&seed, sizeof(seed));
+                __set_random32(state, seed);
+        }
+        return 0;
+}
+late_initcall(random32_reseed);
diff --git a/lib/rwsem-spinlock.c b/lib/rwsem-spinlock.c
index db4fed74b940..c4cfd6c0342f 100644
--- a/lib/rwsem-spinlock.c
+++ b/lib/rwsem-spinlock.c
@@ -28,7 +28,7 @@ void __init_rwsem(struct rw_semaphore *sem, const char *name,
          * Make sure we are not reinitializing a held semaphore:
          */
         debug_check_no_locks_freed((void *)sem, sizeof(*sem));
-        lockdep_init_map(&sem->dep_map, name, key);
+        lockdep_init_map(&sem->dep_map, name, key, 0);
 #endif
         sem->activity = 0;
         spin_lock_init(&sem->wait_lock);
diff --git a/lib/rwsem.c b/lib/rwsem.c
index 901d0e7da892..cdb4e3d05607 100644
--- a/lib/rwsem.c
+++ b/lib/rwsem.c
@@ -19,7 +19,7 @@ void __init_rwsem(struct rw_semaphore *sem, const char *name,
          * Make sure we are not reinitializing a held semaphore:
          */
         debug_check_no_locks_freed((void *)sem, sizeof(*sem));
-        lockdep_init_map(&sem->dep_map, name, key);
+        lockdep_init_map(&sem->dep_map, name, key, 0);
 #endif
         sem->count = RWSEM_UNLOCKED_VALUE;
         spin_lock_init(&sem->wait_lock);
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index dafaf1de2491..b6c4f898197c 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -20,7 +20,7 @@ void __spin_lock_init(spinlock_t *lock, const char *name,
          * Make sure we are not reinitializing a held lock:
          */
         debug_check_no_locks_freed((void *)lock, sizeof(*lock));
-        lockdep_init_map(&lock->dep_map, name, key);
+        lockdep_init_map(&lock->dep_map, name, key, 0);
 #endif
         lock->raw_lock = (raw_spinlock_t)__RAW_SPIN_LOCK_UNLOCKED;
         lock->magic = SPINLOCK_MAGIC;
@@ -38,7 +38,7 @@ void __rwlock_init(rwlock_t *lock, const char *name,
          * Make sure we are not reinitializing a held lock:
          */
         debug_check_no_locks_freed((void *)lock, sizeof(*lock));
-        lockdep_init_map(&lock->dep_map, name, key);
+        lockdep_init_map(&lock->dep_map, name, key, 0);
 #endif
         lock->raw_lock = (raw_rwlock_t) __RAW_RW_LOCK_UNLOCKED;
         lock->magic = RWLOCK_MAGIC;
diff --git a/lib/string.c b/lib/string.c
index 63077267367e..a485d75962af 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -320,7 +320,7 @@ char *strstrip(char *s)
                 return s;
 
         end = s + size - 1;
-        while (end != s && isspace(*end))
+        while (end >= s && isspace(*end))
                 end--;
         *(end + 1) = '\0';
 
diff --git a/mm/Makefile b/mm/Makefile
index 12b3a4eee88d..f3c077eb0b8e 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -10,7 +10,8 @@ mmu-$(CONFIG_MMU)	:= fremap.o highmem.o madvise.o memory.o mincore.o \
 obj-y                   := bootmem.o filemap.o mempool.o oom_kill.o fadvise.o \
                            page_alloc.o page-writeback.o pdflush.o \
                            readahead.o swap.o truncate.o vmscan.o \
-                           prio_tree.o util.o mmzone.o vmstat.o $(mmu-y)
+                           prio_tree.o util.o mmzone.o vmstat.o backing-dev.o \
+                           $(mmu-y)
 
 ifeq ($(CONFIG_MMU)$(CONFIG_BLOCK),yy)
 obj-y                   += bounce.o
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
new file mode 100644
index 000000000000..f50a2811f9dc
--- /dev/null
+++ b/mm/backing-dev.c
@@ -0,0 +1,69 @@
+
+#include <linux/wait.h>
+#include <linux/backing-dev.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+
+static wait_queue_head_t congestion_wqh[2] = {
+                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[0]),
+                __WAIT_QUEUE_HEAD_INITIALIZER(congestion_wqh[1])
+        };
+
+
+void clear_bdi_congested(struct backing_dev_info *bdi, int rw)
+{
+        enum bdi_state bit;
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
+        clear_bit(bit, &bdi->state);
+        smp_mb__after_clear_bit();
+        if (waitqueue_active(wqh))
+                wake_up(wqh);
+}
+EXPORT_SYMBOL(clear_bdi_congested);
+
+void set_bdi_congested(struct backing_dev_info *bdi, int rw)
+{
+        enum bdi_state bit;
+
+        bit = (rw == WRITE) ? BDI_write_congested : BDI_read_congested;
+        set_bit(bit, &bdi->state);
+}
+EXPORT_SYMBOL(set_bdi_congested);
+
+/**
+ * congestion_wait - wait for a backing_dev to become uncongested
+ * @rw: READ or WRITE
+ * @timeout: timeout in jiffies
+ *
+ * Waits for up to @timeout jiffies for a backing_dev (any backing_dev) to exit
+ * write congestion.  If no backing_devs are congested then just wait for the
+ * next write to be completed.
+ */
+long congestion_wait(int rw, long timeout)
+{
+        long ret;
+        DEFINE_WAIT(wait);
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        prepare_to_wait(wqh, &wait, TASK_UNINTERRUPTIBLE);
+        ret = io_schedule_timeout(timeout);
+        finish_wait(wqh, &wait);
+        return ret;
+}
+EXPORT_SYMBOL(congestion_wait);
+
+/**
+ * congestion_end - wake up sleepers on a congested backing_dev_info
+ * @rw: READ or WRITE
+ */
+void congestion_end(int rw)
+{
+        wait_queue_head_t *wqh = &congestion_wqh[rw];
+
+        if (waitqueue_active(wqh))
+                wake_up(wqh);
+}
+EXPORT_SYMBOL(congestion_end);
diff --git a/mm/filemap.c b/mm/filemap.c
index 3464b681f844..7b84dc814347 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -75,8 +75,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
  *  ->mmap_sem
  *    ->lock_page               (access_process_vm)
  *
- *  ->mmap_sem
- *    ->i_mutex                 (msync)
+ *  ->i_mutex                   (generic_file_buffered_write)
+ *    ->mmap_sem                (fault_in_pages_readable->do_page_fault)
  *
  *  ->i_mutex
  *    ->i_alloc_sem             (various)
@@ -467,25 +467,15 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping,
 }
 
 #ifdef CONFIG_NUMA
-struct page *page_cache_alloc(struct address_space *x)
+struct page *__page_cache_alloc(gfp_t gfp)
 {
         if (cpuset_do_page_mem_spread()) {
                 int n = cpuset_mem_spread_node();
-                return alloc_pages_node(n, mapping_gfp_mask(x), 0);
+                return alloc_pages_node(n, gfp, 0);
         }
-        return alloc_pages(mapping_gfp_mask(x), 0);
+        return alloc_pages(gfp, 0);
 }
-EXPORT_SYMBOL(page_cache_alloc);
-
-struct page *page_cache_alloc_cold(struct address_space *x)
-{
-        if (cpuset_do_page_mem_spread()) {
-                int n = cpuset_mem_spread_node();
-                return alloc_pages_node(n, mapping_gfp_mask(x)|__GFP_COLD, 0);
-        }
-        return alloc_pages(mapping_gfp_mask(x)|__GFP_COLD, 0);
-}
-EXPORT_SYMBOL(page_cache_alloc_cold);
+EXPORT_SYMBOL(__page_cache_alloc);
 #endif
 
 static int __sleep_on_page_lock(void *word)
@@ -826,7 +816,6 @@ struct page *
 grab_cache_page_nowait(struct address_space *mapping, unsigned long index)
 {
         struct page *page = find_get_page(mapping, index);
-        gfp_t gfp_mask;
 
         if (page) {
                 if (!TestSetPageLocked(page))
@@ -834,9 +823,8 @@ grab_cache_page_nowait(struct address_space *mapping, unsigned long index)
                 page_cache_release(page);
                 return NULL;
         }
-        gfp_mask = mapping_gfp_mask(mapping) & ~__GFP_FS;
-        page = alloc_pages(gfp_mask, 0);
-        if (page && add_to_page_cache_lru(page, mapping, index, gfp_mask)) {
+        page = __page_cache_alloc(mapping_gfp_mask(mapping) & ~__GFP_FS);
+        if (page && add_to_page_cache_lru(page, mapping, index, GFP_KERNEL)) {
                 page_cache_release(page);
                 page = NULL;
         }
@@ -1884,11 +1872,10 @@ repeat:
  *      if suid or (sgid and xgrp)
  *              remove privs
  */
-int remove_suid(struct dentry *dentry)
+int should_remove_suid(struct dentry *dentry)
 {
         mode_t mode = dentry->d_inode->i_mode;
         int kill = 0;
-        int result = 0;
 
         /* suid always must be killed */
         if (unlikely(mode & S_ISUID))
@@ -1901,13 +1888,28 @@ int remove_suid(struct dentry *dentry)
         if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
                 kill |= ATTR_KILL_SGID;
 
-        if (unlikely(kill && !capable(CAP_FSETID))) {
-                struct iattr newattrs;
+        if (unlikely(kill && !capable(CAP_FSETID)))
+                return kill;
 
-                newattrs.ia_valid = ATTR_FORCE | kill;
-                result = notify_change(dentry, &newattrs);
-        }
-        return result;
+        return 0;
+}
+
+int __remove_suid(struct dentry *dentry, int kill)
+{
+        struct iattr newattrs;
+
+        newattrs.ia_valid = ATTR_FORCE | kill;
+        return notify_change(dentry, &newattrs);
+}
+
+int remove_suid(struct dentry *dentry)
+{
+        int kill = should_remove_suid(dentry);
+
+        if (unlikely(kill))
+                return __remove_suid(dentry, kill);
+
+        return 0;
 }
 EXPORT_SYMBOL(remove_suid);
 
@@ -2222,7 +2224,7 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
                                 unsigned long nr_segs, loff_t *ppos)
 {
         struct file *file = iocb->ki_filp;
-        const struct address_space * mapping = file->f_mapping;
+        struct address_space * mapping = file->f_mapping;
         size_t ocount;          /* original count */
         size_t count;           /* after file limit checks */
         struct inode    *inode = mapping->host;
@@ -2275,8 +2277,11 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
 
         /* coalesce the iovecs and go direct-to-BIO for O_DIRECT */
         if (unlikely(file->f_flags & O_DIRECT)) {
-                written = generic_file_direct_write(iocb, iov,
-                                &nr_segs, pos, ppos, count, ocount);
+                loff_t endbyte;
+                ssize_t written_buffered;
+
+                written = generic_file_direct_write(iocb, iov, &nr_segs, pos,
+                                                        ppos, count, ocount);
                 if (written < 0 || written == count)
                         goto out;
                 /*
@@ -2285,10 +2290,46 @@ __generic_file_aio_write_nolock(struct kiocb *iocb, const struct iovec *iov,
                  */
                 pos += written;
                 count -= written;
-        }
+                written_buffered = generic_file_buffered_write(iocb, iov,
+                                                nr_segs, pos, ppos, count,
+                                                written);
+                /*
+                 * If generic_file_buffered_write() retuned a synchronous error
+                 * then we want to return the number of bytes which were
+                 * direct-written, or the error code if that was zero.  Note
+                 * that this differs from normal direct-io semantics, which
+                 * will return -EFOO even if some bytes were written.
+                 */
+                if (written_buffered < 0) {
+                        err = written_buffered;
+                        goto out;
+                }
 
-        written = generic_file_buffered_write(iocb, iov, nr_segs,
-                        pos, ppos, count, written);
+                /*
+                 * We need to ensure that the page cache pages are written to
+                 * disk and invalidated to preserve the expected O_DIRECT
+                 * semantics.
+                 */
+                endbyte = pos + written_buffered - written - 1;
+                err = do_sync_file_range(file, pos, endbyte,
+                                         SYNC_FILE_RANGE_WAIT_BEFORE|
+                                         SYNC_FILE_RANGE_WRITE|
+                                         SYNC_FILE_RANGE_WAIT_AFTER);
+                if (err == 0) {
+                        written = written_buffered;
+                        invalidate_mapping_pages(mapping,
+                                                 pos >> PAGE_CACHE_SHIFT,
+                                                 endbyte >> PAGE_CACHE_SHIFT);
+                } else {
+                        /*
+                         * We don't know how much we wrote, so just return
+                         * the number of bytes which were direct-written
+                         */
+                }
+        } else {
+                written = generic_file_buffered_write(iocb, iov, nr_segs,
+                                pos, ppos, count, written);
+        }
 out:
         current->backing_dev_info = NULL;
         return written ? written : err;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 1d709ff528e1..a088f593a807 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -356,8 +356,8 @@ nomem:
         return -ENOMEM;
 }
 
-void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
-                          unsigned long end)
+void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
+                            unsigned long end)
 {
         struct mm_struct *mm = vma->vm_mm;
         unsigned long address;
@@ -398,6 +398,24 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
         }
 }
 
+void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
+                          unsigned long end)
+{
+        /*
+         * It is undesirable to test vma->vm_file as it should be non-null
+         * for valid hugetlb area. However, vm_file will be NULL in the error
+         * cleanup path of do_mmap_pgoff. When hugetlbfs ->mmap method fails,
+         * do_mmap_pgoff() nullifies vma->vm_file before calling this function
+         * to clean up. Since no pte has actually been setup, it is safe to
+         * do nothing in this case.
+         */
+        if (vma->vm_file) {
+                spin_lock(&vma->vm_file->f_mapping->i_mmap_lock);
+                __unmap_hugepage_range(vma, start, end);
+                spin_unlock(&vma->vm_file->f_mapping->i_mmap_lock);
+        }
+}
+
 static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
                         unsigned long address, pte_t *ptep, pte_t pte)
 {
@@ -460,6 +478,9 @@ int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 retry:
         page = find_lock_page(mapping, idx);
         if (!page) {
+                size = i_size_read(mapping->host) >> HPAGE_SHIFT;
+                if (idx >= size)
+                        goto out;
                 if (hugetlb_get_quota(mapping))
                         goto out;
                 page = alloc_huge_page(vma, address);
diff --git a/mm/memory.c b/mm/memory.c
index b5a4aadd961a..156861fcac43 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1452,6 +1452,7 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
                 if (__copy_from_user_inatomic(kaddr, uaddr, PAGE_SIZE))
                         memset(kaddr, 0, PAGE_SIZE);
                 kunmap_atomic(kaddr, KM_USER0);
+                flush_dcache_page(dst);
                 return;
                 
         }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 25788b1b7fcf..617fb31086ee 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -727,7 +727,7 @@ int do_migrate_pages(struct mm_struct *mm,
         return -ENOSYS;
 }
 
-static struct page *new_vma_page(struct page *page, unsigned long private)
+static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
 {
         return NULL;
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index ba2453f9483d..b4979d423d2b 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -952,7 +952,8 @@ asmlinkage long sys_move_pages(pid_t pid, unsigned long nr_pages,
                                 goto out;
 
                         pm[i].node = node;
-                }
+                } else
+                        pm[i].node = 0; /* anything to not match MAX_NUMNODES */
         }
         /* End marker */
         pm[nr_pages].node = MAX_NUMNODES;
diff --git a/mm/mmap.c b/mm/mmap.c
index eea8eefd51a8..7b40abd7cba2 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -900,17 +900,6 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
         int accountable = 1;
         unsigned long charged = 0, reqprot = prot;
 
-        if (file) {
-                if (is_file_hugepages(file))
-                        accountable = 0;
-
-                if (!file->f_op || !file->f_op->mmap)
-                        return -ENODEV;
-
-                if ((prot & PROT_EXEC) &&
-                    (file->f_vfsmnt->mnt_flags & MNT_NOEXEC))
-                        return -EPERM;
-        }
         /*
          * Does the application expect PROT_READ to imply PROT_EXEC?
          *
@@ -1000,6 +989,16 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
                 case MAP_PRIVATE:
                         if (!(file->f_mode & FMODE_READ))
                                 return -EACCES;
+                        if (file->f_vfsmnt->mnt_flags & MNT_NOEXEC) {
+                                if (vm_flags & VM_EXEC)
+                                        return -EPERM;
+                                vm_flags &= ~VM_MAYEXEC;
+                        }
+                        if (is_file_hugepages(file))
+                                accountable = 0;
+
+                        if (!file->f_op || !file->f_op->mmap)
+                                return -ENODEV;
                         break;
 
                 default:
@@ -1380,7 +1379,7 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
                  * Check if the given range is hugepage aligned, and
                  * can be made suitable for hugepages.
                  */
-                ret = prepare_hugepage_range(addr, len);
+                ret = prepare_hugepage_range(addr, len, pgoff);
         } else {
                 /*
                  * Ensure that a normal request is not falling in a
@@ -1881,6 +1880,9 @@ unsigned long do_brk(unsigned long addr, unsigned long len)
         if ((addr + len) > TASK_SIZE || (addr + len) < addr)
                 return -EINVAL;
 
+        if (is_hugepage_only_range(mm, addr, len))
+                return -EINVAL;
+
         flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
 
         error = arch_mmap_check(addr, len, flags);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 20f41b082e16..2e3ce3a928b9 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -15,6 +15,7 @@
  *  kernel subsystems and hints as to where to find out what things do.
  */
 
+#include <linux/oom.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
 #include <linux/swap.h>
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index a0f339057449..8d9b19f239c3 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -222,7 +222,7 @@ static void balance_dirty_pages(struct address_space *mapping)
                         if (pages_written >= write_chunk)
                                 break;          /* We've done our duty */
                 }
-                blk_congestion_wait(WRITE, HZ/10);
+                congestion_wait(WRITE, HZ/10);
         }
 
         if (nr_reclaimable + global_page_state(NR_WRITEBACK)
@@ -314,7 +314,7 @@ void throttle_vm_writeout(void)
                 if (global_page_state(NR_UNSTABLE_NFS) +
                         global_page_state(NR_WRITEBACK) <= dirty_thresh)
                                 break;
-                blk_congestion_wait(WRITE, HZ/10);
+                congestion_wait(WRITE, HZ/10);
         }
 }
 
@@ -351,7 +351,7 @@ static void background_writeout(unsigned long _min_pages)
                 min_pages -= MAX_WRITEBACK_PAGES - wbc.nr_to_write;
                 if (wbc.nr_to_write > 0 || wbc.pages_skipped > 0) {
                         /* Wrote less than expected */
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
                         if (!wbc.encountered_congestion)
                                 break;
                 }
@@ -422,7 +422,7 @@ static void wb_kupdate(unsigned long arg)
                 writeback_inodes(&wbc);
                 if (wbc.nr_to_write > 0) {
                         if (wbc.encountered_congestion)
-                                blk_congestion_wait(WRITE, HZ/10);
+                                congestion_wait(WRITE, HZ/10);
                         else
                                 break;  /* All the old data is written */
                 }
@@ -956,15 +956,6 @@ int test_set_page_writeback(struct page *page)
 EXPORT_SYMBOL(test_set_page_writeback);
 
 /*
- * Wakes up tasks that are being throttled due to writeback congestion
- */
-void writeback_congestion_end(void)
-{
-        blk_congestion_end(WRITE);
-}
-EXPORT_SYMBOL(writeback_congestion_end);
-
-/*
  * Return true if any of the pages in the mapping are marged with the
  * passed tag.
  */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a8c003e7b3d5..bf2f6cff1d6a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -39,6 +39,7 @@
 #include <linux/stop_machine.h>
 #include <linux/sort.h>
 #include <linux/pfn.h>
+#include <linux/backing-dev.h>
 
 #include <asm/tlbflush.h>
 #include <asm/div64.h>
@@ -495,17 +496,16 @@ static void __free_pages_ok(struct page *page, unsigned int order)
         int i;
         int reserved = 0;
 
-        arch_free_page(page, order);
-        if (!PageHighMem(page))
-                debug_check_no_locks_freed(page_address(page),
-                                           PAGE_SIZE<<order);
-
         for (i = 0 ; i < (1 << order) ; ++i)
                 reserved += free_pages_check(page + i);
         if (reserved)
                 return;
 
+        if (!PageHighMem(page))
+                debug_check_no_locks_freed(page_address(page),PAGE_SIZE<<order);
+        arch_free_page(page, order);
         kernel_map_pages(page, 1 << order, 0);
+
         local_irq_save(flags);
         __count_vm_events(PGFREE, 1 << order);
         free_one_page(page_zone(page), page, order);
@@ -781,13 +781,14 @@ static void fastcall free_hot_cold_page(struct page *page, int cold)
         struct per_cpu_pages *pcp;
         unsigned long flags;
 
-        arch_free_page(page, 0);
-
         if (PageAnon(page))
                 page->mapping = NULL;
         if (free_pages_check(page))
                 return;
 
+        if (!PageHighMem(page))
+                debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
+        arch_free_page(page, 0);
         kernel_map_pages(page, 1, 0);
 
         pcp = &zone_pcp(zone, get_cpu())->pcp[cold];
@@ -852,7 +853,7 @@ again:
                 pcp = &zone_pcp(zone, cpu)->pcp[cold];
                 local_irq_save(flags);
                 if (!pcp->count) {
-                        pcp->count += rmqueue_bulk(zone, 0,
+                        pcp->count = rmqueue_bulk(zone, 0,
                                                 pcp->batch, &pcp->list);
                         if (unlikely(!pcp->count))
                                 goto failed;
@@ -1050,7 +1051,7 @@ nofail_alloc:
                         if (page)
                                 goto got_pg;
                         if (gfp_mask & __GFP_NOFAIL) {
-                                blk_congestion_wait(WRITE, HZ/50);
+                                congestion_wait(WRITE, HZ/50);
                                 goto nofail_alloc;
                         }
                 }
@@ -1113,7 +1114,7 @@ rebalance:
                         do_retry = 1;
         }
         if (do_retry) {
-                blk_congestion_wait(WRITE, HZ/50);
+                congestion_wait(WRITE, HZ/50);
                 goto rebalance;
         }
 
@@ -1688,6 +1689,8 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
         for (pfn = start_pfn; pfn < end_pfn; pfn++) {
                 if (!early_pfn_valid(pfn))
                         continue;
+                if (!early_pfn_in_nid(pfn, nid))
+                        continue;
                 page = pfn_to_page(pfn);
                 set_page_links(page, zone, nid, pfn);
                 init_page_count(page);
@@ -2258,7 +2261,7 @@ unsigned long __init __absent_pages_in_range(int nid,
 
         /* Account for ranges past physical memory on this node */
         if (range_end_pfn > prev_end_pfn)
-                hole_pages = range_end_pfn -
+                hole_pages += range_end_pfn -
                                 max(range_start_pfn, prev_end_pfn);
 
         return hole_pages;
@@ -2294,19 +2297,6 @@ unsigned long __init zone_absent_pages_in_node(int nid,
         return __absent_pages_in_range(nid, zone_start_pfn, zone_end_pfn);
 }
 
-/* Return the zone index a PFN is in */
-int memmap_zone_idx(struct page *lmem_map)
-{
-        int i;
-        unsigned long phys_addr = virt_to_phys(lmem_map);
-        unsigned long pfn = phys_addr >> PAGE_SHIFT;
-
-        for (i = 0; i < MAX_NR_ZONES; i++)
-                if (pfn < arch_zone_highest_possible_pfn[i])
-                        break;
-
-        return i;
-}
 #else
 static inline unsigned long zone_spanned_pages_in_node(int nid,
                                         unsigned long zone_type,
@@ -2325,10 +2315,6 @@ static inline unsigned long zone_absent_pages_in_node(int nid,
         return zholes_size[zone_type];
 }
 
-static inline int memmap_zone_idx(struct page *lmem_map)
-{
-        return MAX_NR_ZONES;
-}
 #endif
 
 static void __init calculate_node_totalpages(struct pglist_data *pgdat,
@@ -2421,7 +2407,7 @@ static void __meminit free_area_init_core(struct pglist_data *pgdat,
                 zone->zone_pgdat = pgdat;
                 zone->free_pages = 0;
 
-                zone->temp_priority = zone->prev_priority = DEF_PRIORITY;
+                zone->prev_priority = DEF_PRIORITY;
 
                 zone_pcp_init(zone);
                 INIT_LIST_HEAD(&zone->active_list);
@@ -3136,3 +3122,19 @@ unsigned long page_to_pfn(struct page *page)
 EXPORT_SYMBOL(pfn_to_page);
 EXPORT_SYMBOL(page_to_pfn);
 #endif /* CONFIG_OUT_OF_LINE_PFN_TO_PAGE */
+
+#if MAX_NUMNODES > 1
+/*
+ * Find the highest possible node id.
+ */
+int highest_possible_node_id(void)
+{
+        unsigned int node;
+        unsigned int highest = 0;
+
+        for_each_node_mask(node, node_possible_map)
+                highest = node;
+        return highest;
+}
+EXPORT_SYMBOL(highest_possible_node_id);
+#endif
diff --git a/mm/readahead.c b/mm/readahead.c
index 1ba736ac0367..23cb61a01c6e 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -173,6 +173,8 @@ static int read_pages(struct address_space *mapping, struct file *filp,
 
         if (mapping->a_ops->readpages) {
                 ret = mapping->a_ops->readpages(filp, mapping, pages, nr_pages);
+                /* Clean up the remaining pages */
+                put_pages_list(pages);
                 goto out;
         }
 
diff --git a/mm/rmap.c b/mm/rmap.c
index e2155d791d99..d8a842a586db 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -21,27 +21,21 @@
  * Lock ordering in mm:
  *
  * inode->i_mutex       (while writing or truncating, not reading or faulting)
- *   inode->i_alloc_sem
- *
- * When a page fault occurs in writing from user to file, down_read
- * of mmap_sem nests within i_mutex; in sys_msync, i_mutex nests within
- * down_read of mmap_sem; i_mutex and down_write of mmap_sem are never
- * taken together; in truncation, i_mutex is taken outermost.
- *
- * mm->mmap_sem
- *   page->flags PG_locked (lock_page)
- *     mapping->i_mmap_lock
- *       anon_vma->lock
- *         mm->page_table_lock or pte_lock
- *           zone->lru_lock (in mark_page_accessed, isolate_lru_page)
- *           swap_lock (in swap_duplicate, swap_info_get)
- *             mmlist_lock (in mmput, drain_mmlist and others)
- *             mapping->private_lock (in __set_page_dirty_buffers)
- *             inode_lock (in set_page_dirty's __mark_inode_dirty)
- *               sb_lock (within inode_lock in fs/fs-writeback.c)
- *               mapping->tree_lock (widely used, in set_page_dirty,
- *                         in arch-dependent flush_dcache_mmap_lock,
- *                         within inode_lock in __sync_single_inode)
+ *   inode->i_alloc_sem (vmtruncate_range)
+ *   mm->mmap_sem
+ *     page->flags PG_locked (lock_page)
+ *       mapping->i_mmap_lock
+ *         anon_vma->lock
+ *           mm->page_table_lock or pte_lock
+ *             zone->lru_lock (in mark_page_accessed, isolate_lru_page)
+ *             swap_lock (in swap_duplicate, swap_info_get)
+ *               mmlist_lock (in mmput, drain_mmlist and others)
+ *               mapping->private_lock (in __set_page_dirty_buffers)
+ *               inode_lock (in set_page_dirty's __mark_inode_dirty)
+ *                 sb_lock (within inode_lock in fs/fs-writeback.c)
+ *                 mapping->tree_lock (widely used, in set_page_dirty,
+ *                           in arch-dependent flush_dcache_mmap_lock,
+ *                           within inode_lock in __sync_single_inode)
  */
 
 #include <linux/mm.h>
@@ -576,15 +570,14 @@ void page_add_file_rmap(struct page *page)
 void page_remove_rmap(struct page *page)
 {
         if (atomic_add_negative(-1, &page->_mapcount)) {
-#ifdef CONFIG_DEBUG_VM
                 if (unlikely(page_mapcount(page) < 0)) {
                         printk (KERN_EMERG "Eeek! page_mapcount(page) went negative! (%d)\n", page_mapcount(page));
                         printk (KERN_EMERG "  page->flags = %lx\n", page->flags);
                         printk (KERN_EMERG "  page->count = %x\n", page_count(page));
                         printk (KERN_EMERG "  page->mapping = %p\n", page->mapping);
+                        BUG();
                 }
-#endif
-                BUG_ON(page_mapcount(page) < 0);
+
                 /*
                  * It would be tidy to reset the PageAnon mapping here,
                  * but that might overwrite a racing page_add_anon_rmap
diff --git a/mm/shmem.c b/mm/shmem.c
index bb8ca7ef7094..4959535fc14c 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -48,6 +48,7 @@
 #include <linux/ctype.h>
 #include <linux/migrate.h>
 #include <linux/highmem.h>
+#include <linux/backing-dev.h>
 
 #include <asm/uaccess.h>
 #include <asm/div64.h>
@@ -1131,7 +1132,7 @@ repeat:
                         page_cache_release(swappage);
                         if (error == -ENOMEM) {
                                 /* let kswapd refresh zone for GFP_ATOMICs */
-                                blk_congestion_wait(WRITE, HZ/50);
+                                congestion_wait(WRITE, HZ/50);
                         }
                         goto repeat;
                 }
@@ -1362,6 +1363,7 @@ shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
                 inode->i_mapping->a_ops = &shmem_aops;
                 inode->i_mapping->backing_dev_info = &shmem_backing_dev_info;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+                inode->i_generation = get_seconds();
                 info = SHMEM_I(inode);
                 memset(info, 0, (char *)inode - (char *)info);
                 spin_lock_init(&info->lock);
@@ -1956,6 +1958,85 @@ static struct xattr_handler *shmem_xattr_handlers[] = {
 };
 #endif
 
+static struct dentry *shmem_get_parent(struct dentry *child)
+{
+        return ERR_PTR(-ESTALE);
+}
+
+static int shmem_match(struct inode *ino, void *vfh)
+{
+        __u32 *fh = vfh;
+        __u64 inum = fh[2];
+        inum = (inum << 32) | fh[1];
+        return ino->i_ino == inum && fh[0] == ino->i_generation;
+}
+
+static struct dentry *shmem_get_dentry(struct super_block *sb, void *vfh)
+{
+        struct dentry *de = NULL;
+        struct inode *inode;
+        __u32 *fh = vfh;
+        __u64 inum = fh[2];
+        inum = (inum << 32) | fh[1];
+
+        inode = ilookup5(sb, (unsigned long)(inum+fh[0]), shmem_match, vfh);
+        if (inode) {
+                de = d_find_alias(inode);
+                iput(inode);
+        }
+
+        return de? de: ERR_PTR(-ESTALE);
+}
+
+static struct dentry *shmem_decode_fh(struct super_block *sb, __u32 *fh,
+                int len, int type,
+                int (*acceptable)(void *context, struct dentry *de),
+                void *context)
+{
+        if (len < 3)
+                return ERR_PTR(-ESTALE);
+
+        return sb->s_export_op->find_exported_dentry(sb, fh, NULL, acceptable,
+                                                        context);
+}
+
+static int shmem_encode_fh(struct dentry *dentry, __u32 *fh, int *len,
+                                int connectable)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (*len < 3)
+                return 255;
+
+        if (hlist_unhashed(&inode->i_hash)) {
+                /* Unfortunately insert_inode_hash is not idempotent,
+                 * so as we hash inodes here rather than at creation
+                 * time, we need a lock to ensure we only try
+                 * to do it once
+                 */
+                static DEFINE_SPINLOCK(lock);
+                spin_lock(&lock);
+                if (hlist_unhashed(&inode->i_hash))
+                        __insert_inode_hash(inode,
+                                            inode->i_ino + inode->i_generation);
+                spin_unlock(&lock);
+        }
+
+        fh[0] = inode->i_generation;
+        fh[1] = inode->i_ino;
+        fh[2] = ((__u64)inode->i_ino) >> 32;
+
+        *len = 3;
+        return 1;
+}
+
+static struct export_operations shmem_export_ops = {
+        .get_parent     = shmem_get_parent,
+        .get_dentry     = shmem_get_dentry,
+        .encode_fh      = shmem_encode_fh,
+        .decode_fh      = shmem_decode_fh,
+};
+
 static int shmem_parse_options(char *options, int *mode, uid_t *uid,
         gid_t *gid, unsigned long *blocks, unsigned long *inodes,
         int *policy, nodemask_t *policy_nodes)
@@ -2128,6 +2209,7 @@ static int shmem_fill_super(struct super_block *sb,
                                         &inodes, &policy, &policy_nodes))
                         return -EINVAL;
         }
+        sb->s_export_op = &shmem_export_ops;
 #else
         sb->s_flags |= MS_NOUSER;
 #endif
diff --git a/mm/shmem_acl.c b/mm/shmem_acl.c
index c946bf468718..f5664c5b9eb1 100644
--- a/mm/shmem_acl.c
+++ b/mm/shmem_acl.c
@@ -35,7 +35,7 @@ shmem_get_acl(struct inode *inode, int type)
 }
 
 /**
- * shmem_get_acl  -   generic_acl_operations->setacl() operation
+ * shmem_set_acl  -   generic_acl_operations->setacl() operation
  */
 static void
 shmem_set_acl(struct inode *inode, int type, struct posix_acl *acl)
diff --git a/mm/slab.c b/mm/slab.c
index 266449d604bd..3c4a7e34eddc 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -883,7 +883,7 @@ static void init_reap_node(int cpu)
         if (node == MAX_NUMNODES)
                 node = first_node(node_online_map);
 
-        __get_cpu_var(reap_node) = node;
+        per_cpu(reap_node, cpu) = node;
 }
 
 static void next_reap_node(void)
@@ -3152,12 +3152,15 @@ void *fallback_alloc(struct kmem_cache *cache, gfp_t flags)
         struct zone **z;
         void *obj = NULL;
 
-        for (z = zonelist->zones; *z && !obj; z++)
+        for (z = zonelist->zones; *z && !obj; z++) {
+                int nid = zone_to_nid(*z);
+
                 if (zone_idx(*z) <= ZONE_NORMAL &&
-                                cpuset_zone_allowed(*z, flags))
+                                cpuset_zone_allowed(*z, flags) &&
+                                cache->nodelists[nid])
                         obj = __cache_alloc_node(cache,
-                                        flags | __GFP_THISNODE,
-                                        zone_to_nid(*z));
+                                        flags | __GFP_THISNODE, nid);
+        }
         return obj;
 }
 
diff --git a/mm/sparse.c b/mm/sparse.c
index 86c52ab80878..b3c82ba30012 100644
--- a/mm/sparse.c
+++ b/mm/sparse.c
@@ -211,7 +211,7 @@ static struct page *__kmalloc_section_memmap(unsigned long nr_pages)
         struct page *page, *ret;
         unsigned long memmap_size = sizeof(struct page) * nr_pages;
 
-        page = alloc_pages(GFP_KERNEL, get_order(memmap_size));
+        page = alloc_pages(GFP_KERNEL|__GFP_NOWARN, get_order(memmap_size));
         if (page)
                 goto got_map_page;
 
diff --git a/mm/truncate.c b/mm/truncate.c
index f4edbc179d14..e07b1e682c38 100644
--- a/mm/truncate.c
+++ b/mm/truncate.c
@@ -96,7 +96,6 @@ invalidate_complete_page(struct address_space *mapping, struct page *page)
                 return 0;
 
         ret = remove_mapping(mapping, page);
-        ClearPageUptodate(page);
 
         return ret;
 }
@@ -302,7 +301,7 @@ invalidate_complete_page2(struct address_space *mapping, struct page *page)
         if (page->mapping != mapping)
                 return 0;
 
-        if (PagePrivate(page) && !try_to_release_page(page, 0))
+        if (PagePrivate(page) && !try_to_release_page(page, GFP_KERNEL))
                 return 0;
 
         write_lock_irq(&mapping->tree_lock);
@@ -396,6 +395,7 @@ int invalidate_inode_pages2_range(struct address_space *mapping,
                 pagevec_release(&pvec);
                 cond_resched();
         }
+        WARN_ON_ONCE(ret);
         return ret;
 }
 EXPORT_SYMBOL_GPL(invalidate_inode_pages2_range);
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 750ab6ed13fc..86897ee792d6 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -160,13 +160,15 @@ int map_vm_area(struct vm_struct *area, pgprot_t prot, struct page ***pages)
         return err;
 }
 
-struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long flags,
-                                unsigned long start, unsigned long end, int node)
+static struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long flags,
+                                            unsigned long start, unsigned long end,
+                                            int node, gfp_t gfp_mask)
 {
         struct vm_struct **p, *tmp, *area;
         unsigned long align = 1;
         unsigned long addr;
 
+        BUG_ON(in_interrupt());
         if (flags & VM_IOREMAP) {
                 int bit = fls(size);
 
@@ -179,16 +181,13 @@ struct vm_struct *__get_vm_area_node(unsigned long size, unsigned long flags,
         }
         addr = ALIGN(start, align);
         size = PAGE_ALIGN(size);
+        if (unlikely(!size))
+                return NULL;
 
-        area = kmalloc_node(sizeof(*area), GFP_KERNEL, node);
+        area = kmalloc_node(sizeof(*area), gfp_mask & GFP_LEVEL_MASK, node);
         if (unlikely(!area))
                 return NULL;
 
-        if (unlikely(!size)) {
-                kfree (area);
-                return NULL;
-        }
-
         /*
          * We always allocate a guard page.
          */
@@ -236,7 +235,7 @@ out:
 struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
                                 unsigned long start, unsigned long end)
 {
-        return __get_vm_area_node(size, flags, start, end, -1);
+        return __get_vm_area_node(size, flags, start, end, -1, GFP_KERNEL);
 }
 
 /**
@@ -253,9 +252,11 @@ struct vm_struct *get_vm_area(unsigned long size, unsigned long flags)
         return __get_vm_area(size, flags, VMALLOC_START, VMALLOC_END);
 }
 
-struct vm_struct *get_vm_area_node(unsigned long size, unsigned long flags, int node)
+struct vm_struct *get_vm_area_node(unsigned long size, unsigned long flags,
+                                   int node, gfp_t gfp_mask)
 {
-        return __get_vm_area_node(size, flags, VMALLOC_START, VMALLOC_END, node);
+        return __get_vm_area_node(size, flags, VMALLOC_START, VMALLOC_END, node,
+                                  gfp_mask);
 }
 
 /* Caller must hold vmlist_lock */
@@ -428,8 +429,11 @@ void *__vmalloc_area_node(struct vm_struct *area, gfp_t gfp_mask,
         if (array_size > PAGE_SIZE) {
                 pages = __vmalloc_node(array_size, gfp_mask, PAGE_KERNEL, node);
                 area->flags |= VM_VPAGES;
-        } else
-                pages = kmalloc_node(array_size, (gfp_mask & ~__GFP_HIGHMEM), node);
+        } else {
+                pages = kmalloc_node(array_size,
+                                (gfp_mask & ~(__GFP_HIGHMEM | __GFP_ZERO)),
+                                node);
+        }
         area->pages = pages;
         if (!area->pages) {
                 remove_vm_area(area->addr);
@@ -484,7 +488,7 @@ static void *__vmalloc_node(unsigned long size, gfp_t gfp_mask, pgprot_t prot,
         if (!size || (size >> PAGE_SHIFT) > num_physpages)
                 return NULL;
 
-        area = get_vm_area_node(size, VM_ALLOC, node);
+        area = get_vm_area_node(size, VM_ALLOC, node, gfp_mask);
         if (!area)
                 return NULL;
 
@@ -525,11 +529,12 @@ void *vmalloc_user(unsigned long size)
         void *ret;
 
         ret = __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
-        area = __find_vm_area(ret);
-        area->flags |= VM_USERMAP;
-        write_unlock(&vmlist_lock);
-
+        if (ret) {
+                write_lock(&vmlist_lock);
+                area = __find_vm_area(ret);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
         return ret;
 }
 EXPORT_SYMBOL(vmalloc_user);
@@ -598,11 +603,12 @@ void *vmalloc_32_user(unsigned long size)
         void *ret;
 
         ret = __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
-        write_lock(&vmlist_lock);
-        area = __find_vm_area(ret);
-        area->flags |= VM_USERMAP;
-        write_unlock(&vmlist_lock);
-
+        if (ret) {
+                write_lock(&vmlist_lock);
+                area = __find_vm_area(ret);
+                area->flags |= VM_USERMAP;
+                write_unlock(&vmlist_lock);
+        }
         return ret;
 }
 EXPORT_SYMBOL(vmalloc_32_user);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index eca70310adb2..518540a4a2a6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -378,6 +378,12 @@ static pageout_t pageout(struct page *page, struct address_space *mapping)
         return PAGE_CLEAN;
 }
 
+/*
+ * Attempt to detach a locked page from its ->mapping.  If it is dirty or if
+ * someone else has a ref on the page, abort and return 0.  If it was
+ * successfully detached, return 1.  Assumes the caller has a single ref on
+ * this page.
+ */
 int remove_mapping(struct address_space *mapping, struct page *page)
 {
         BUG_ON(!PageLocked(page));
@@ -717,6 +723,20 @@ done:
         return nr_reclaimed;
 }
 
+/*
+ * We are about to scan this zone at a certain priority level.  If that priority
+ * level is smaller (ie: more urgent) than the previous priority, then note
+ * that priority level within the zone.  This is done so that when the next
+ * process comes in to scan this zone, it will immediately start out at this
+ * priority level rather than having to build up its own scanning priority.
+ * Here, this priority affects only the reclaim-mapped threshold.
+ */
+static inline void note_zone_scanning_priority(struct zone *zone, int priority)
+{
+        if (priority < zone->prev_priority)
+                zone->prev_priority = priority;
+}
+
 static inline int zone_is_near_oom(struct zone *zone)
 {
         return zone->pages_scanned >= (zone->nr_active + zone->nr_inactive)*3;
@@ -740,7 +760,7 @@ static inline int zone_is_near_oom(struct zone *zone)
  * But we had to alter page->flags anyway.
  */
 static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
-                                struct scan_control *sc)
+                                struct scan_control *sc, int priority)
 {
         unsigned long pgmoved;
         int pgdeactivate = 0;
@@ -764,7 +784,7 @@ static void shrink_active_list(unsigned long nr_pages, struct zone *zone,
                  * `distress' is a measure of how much trouble we're having
                  * reclaiming pages.  0 -> no problems.  100 -> great trouble.
                  */
-                distress = 100 >> zone->prev_priority;
+                distress = 100 >> min(zone->prev_priority, priority);
 
                 /*
                  * The point of this algorithm is to decide when to start
@@ -916,7 +936,7 @@ static unsigned long shrink_zone(int priority, struct zone *zone,
                         nr_to_scan = min(nr_active,
                                         (unsigned long)sc->swap_cluster_max);
                         nr_active -= nr_to_scan;
-                        shrink_active_list(nr_to_scan, zone, sc);
+                        shrink_active_list(nr_to_scan, zone, sc, priority);
                 }
 
                 if (nr_inactive) {
@@ -966,9 +986,7 @@ static unsigned long shrink_zones(int priority, struct zone **zones,
                 if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
                         continue;
 
-                zone->temp_priority = priority;
-                if (zone->prev_priority > priority)
-                        zone->prev_priority = priority;
+                note_zone_scanning_priority(zone, priority);
 
                 if (zone->all_unreclaimable && priority != DEF_PRIORITY)
                         continue;       /* Let kswapd poll it */
@@ -1018,7 +1036,6 @@ unsigned long try_to_free_pages(struct zone **zones, gfp_t gfp_mask)
                 if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
                         continue;
 
-                zone->temp_priority = DEF_PRIORITY;
                 lru_pages += zone->nr_active + zone->nr_inactive;
         }
 
@@ -1053,19 +1070,28 @@ unsigned long try_to_free_pages(struct zone **zones, gfp_t gfp_mask)
 
                 /* Take a nap, wait for some writeback to complete */
                 if (sc.nr_scanned && priority < DEF_PRIORITY - 2)
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
         }
         /* top priority shrink_caches still had more to do? don't OOM, then */
         if (!sc.all_unreclaimable)
                 ret = 1;
 out:
+        /*
+         * Now that we've scanned all the zones at this priority level, note
+         * that level within the zone so that the next thread which performs
+         * scanning of this zone will immediately start out at this priority
+         * level.  This affects only the decision whether or not to bring
+         * mapped pages onto the inactive list.
+         */
+        if (priority < 0)
+                priority = 0;
         for (i = 0; zones[i] != 0; i++) {
                 struct zone *zone = zones[i];
 
                 if (!cpuset_zone_allowed(zone, __GFP_HARDWALL))
                         continue;
 
-                zone->prev_priority = zone->temp_priority;
+                zone->prev_priority = priority;
         }
         return ret;
 }
@@ -1105,6 +1131,11 @@ static unsigned long balance_pgdat(pg_data_t *pgdat, int order)
                 .swap_cluster_max = SWAP_CLUSTER_MAX,
                 .swappiness = vm_swappiness,
         };
+        /*
+         * temp_priority is used to remember the scanning priority at which
+         * this zone was successfully refilled to free_pages == pages_high.
+         */
+        int temp_priority[MAX_NR_ZONES];
 
 loop_again:
         total_scanned = 0;
@@ -1112,11 +1143,8 @@ loop_again:
         sc.may_writepage = !laptop_mode;
         count_vm_event(PAGEOUTRUN);
 
-        for (i = 0; i < pgdat->nr_zones; i++) {
-                struct zone *zone = pgdat->node_zones + i;
-
-                zone->temp_priority = DEF_PRIORITY;
-        }
+        for (i = 0; i < pgdat->nr_zones; i++)
+                temp_priority[i] = DEF_PRIORITY;
 
         for (priority = DEF_PRIORITY; priority >= 0; priority--) {
                 int end_zone = 0;       /* Inclusive.  0 = ZONE_DMA */
@@ -1177,10 +1205,9 @@ scan:
                         if (!zone_watermark_ok(zone, order, zone->pages_high,
                                                end_zone, 0))
                                 all_zones_ok = 0;
-                        zone->temp_priority = priority;
-                        if (zone->prev_priority > priority)
-                                zone->prev_priority = priority;
+                        temp_priority[i] = priority;
                         sc.nr_scanned = 0;
+                        note_zone_scanning_priority(zone, priority);
                         nr_reclaimed += shrink_zone(priority, zone, &sc);
                         reclaim_state->reclaimed_slab = 0;
                         nr_slab = shrink_slab(sc.nr_scanned, GFP_KERNEL,
@@ -1208,7 +1235,7 @@ scan:
                  * another pass across the zones.
                  */
                 if (total_scanned && priority < DEF_PRIORITY - 2)
-                        blk_congestion_wait(WRITE, HZ/10);
+                        congestion_wait(WRITE, HZ/10);
 
                 /*
                  * We do this so kswapd doesn't build up large priorities for
@@ -1220,10 +1247,15 @@ scan:
                         break;
         }
 out:
+        /*
+         * Note within each zone the priority level at which this zone was
+         * brought into a happy state.  So that the next thread which scans this
+         * zone will start out at that priority level.
+         */
         for (i = 0; i < pgdat->nr_zones; i++) {
                 struct zone *zone = pgdat->node_zones + i;
 
-                zone->prev_priority = zone->temp_priority;
+                zone->prev_priority = temp_priority[i];
         }
         if (!all_zones_ok) {
                 cond_resched();
@@ -1352,7 +1384,7 @@ static unsigned long shrink_all_zones(unsigned long nr_pages, int pass,
                         if (zone->nr_scan_active >= nr_pages || pass > 3) {
                                 zone->nr_scan_active = 0;
                                 nr_to_scan = min(nr_pages, zone->nr_active);
-                                shrink_active_list(nr_to_scan, zone, sc);
+                                shrink_active_list(nr_to_scan, zone, sc, prio);
                         }
                 }
 
@@ -1452,7 +1484,7 @@ unsigned long shrink_all_memory(unsigned long nr_pages)
                                 goto out;
 
                         if (sc.nr_scanned && prio < DEF_PRIORITY - 2)
-                                blk_congestion_wait(WRITE, HZ / 10);
+                                congestion_wait(WRITE, HZ / 10);
                 }
 
                 lru_pages = 0;
@@ -1608,6 +1640,7 @@ static int __zone_reclaim(struct zone *zone, gfp_t gfp_mask, unsigned int order)
                  */
                 priority = ZONE_RECLAIM_PRIORITY;
                 do {
+                        note_zone_scanning_priority(zone, priority);
                         nr_reclaimed += shrink_zone(priority, zone, &sc);
                         priority--;
                 } while (priority >= 0 && nr_reclaimed < nr_pages);
diff --git a/mm/vmstat.c b/mm/vmstat.c
index 45b124e012f5..8614e8f6743b 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -587,11 +587,9 @@ static int zoneinfo_show(struct seq_file *m, void *arg)
                 seq_printf(m,
                            "\n  all_unreclaimable: %u"
                            "\n  prev_priority:     %i"
-                           "\n  temp_priority:     %i"
                            "\n  start_pfn:         %lu",
                            zone->all_unreclaimable,
                            zone->prev_priority,
-                           zone->temp_priority,
                            zone->zone_start_pfn);
                 spin_unlock_irqrestore(&zone->lock, flags);
                 seq_putc(m, '\n');
diff --git a/net/Kconfig b/net/Kconfig
index a81aca43932f..67e39ad8b8b6 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -63,6 +63,7 @@ config INET
 if INET
 source "net/ipv4/Kconfig"
 source "net/ipv6/Kconfig"
+source "net/netlabel/Kconfig"
 
 endif # if INET
 
@@ -249,8 +250,6 @@ source "net/ieee80211/Kconfig"
 config WIRELESS_EXT
         bool
 
-source "net/netlabel/Kconfig"
-
 config FIB_RULES
         bool
 
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 708e2e0371af..485e35c3b28b 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1584,7 +1584,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
 
         if (usat->sat_addr.s_net || usat->sat_addr.s_node == ATADDR_ANYNODE) {
                 rt = atrtr_find(&usat->sat_addr);
-                dev = rt->dev;
         } else {
                 struct atalk_addr at_hint;
 
@@ -1592,7 +1591,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                 at_hint.s_net  = at->src_net;
 
                 rt = atrtr_find(&at_hint);
-                dev = rt->dev;
         }
         if (!rt)
                 return -ENETUNREACH;
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index c0a4ae28fcfa..62f6ed1f2f98 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -141,7 +141,7 @@ static struct class atm_class = {
 int atm_register_sysfs(struct atm_dev *adev)
 {
         struct class_device *cdev = &adev->class_dev;
-        int i, err;
+        int i, j, err;
 
         cdev->class = &atm_class;
         class_set_devdata(cdev, adev);
@@ -151,10 +151,19 @@ int atm_register_sysfs(struct atm_dev *adev)
         if (err < 0)
                 return err;
 
-        for (i = 0; atm_attrs[i]; i++)
-                class_device_create_file(cdev, atm_attrs[i]);
+        for (i = 0; atm_attrs[i]; i++) {
+                err = class_device_create_file(cdev, atm_attrs[i]);
+                if (err)
+                        goto err_out;
+        }
 
         return 0;
+
+err_out:
+        for (j = 0; j < i; j++)
+                class_device_remove_file(cdev, atm_attrs[j]);
+        class_device_del(cdev);
+        return err;
 }
 
 void atm_unregister_sysfs(struct atm_dev *adev)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 305a099b7477..67df99e2e5c8 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -48,41 +48,56 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "2.10"
+#define VERSION "2.11"
 
 /* Bluetooth sockets */
 #define BT_MAX_PROTO    8
 static struct net_proto_family *bt_proto[BT_MAX_PROTO];
+static DEFINE_RWLOCK(bt_proto_lock);
 
 int bt_sock_register(int proto, struct net_proto_family *ops)
 {
+        int err = 0;
+
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
 
+        write_lock(&bt_proto_lock);
+
         if (bt_proto[proto])
-                return -EEXIST;
+                err = -EEXIST;
+        else
+                bt_proto[proto] = ops;
 
-        bt_proto[proto] = ops;
-        return 0;
+        write_unlock(&bt_proto_lock);
+
+        return err;
 }
 EXPORT_SYMBOL(bt_sock_register);
 
 int bt_sock_unregister(int proto)
 {
+        int err = 0;
+
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
 
+        write_lock(&bt_proto_lock);
+
         if (!bt_proto[proto])
-                return -ENOENT;
+                err = -ENOENT;
+        else
+                bt_proto[proto] = NULL;
 
-        bt_proto[proto] = NULL;
-        return 0;
+        write_unlock(&bt_proto_lock);
+
+        return err;
 }
 EXPORT_SYMBOL(bt_sock_unregister);
 
 static int bt_sock_create(struct socket *sock, int proto)
 {
-        int err = 0;
+        int err;
 
         if (proto < 0 || proto >= BT_MAX_PROTO)
                 return -EINVAL;
@@ -92,11 +107,18 @@ static int bt_sock_create(struct socket *sock, int proto)
                 request_module("bt-proto-%d", proto);
         }
 #endif
+
         err = -EPROTONOSUPPORT;
+
+        read_lock(&bt_proto_lock);
+
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                 err = bt_proto[proto]->create(sock, proto);
                 module_put(bt_proto[proto]->owner);
         }
+
+        read_unlock(&bt_proto_lock);
+
         return err; 
 }
 
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 2312d050eeed..4d3424c2421c 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -528,12 +528,10 @@ static struct device *bnep_get_device(struct bnep_session *session)
                 return NULL;
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
-        if (!conn)
-                return NULL;
 
         hci_dev_put(hdev);
 
-        return &conn->dev;
+        return conn ? &conn->dev : NULL;
 }
 
 int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 28c55835422a..5563db1bf526 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -43,6 +43,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -146,24 +147,56 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return 0;
 }
 
+#ifdef CONFIG_COMPAT
+static int bnep_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == BNEPGETCONNLIST) {
+                struct bnep_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+        
+                err = bnep_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        }
+
+        return bnep_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops bnep_sock_ops = {
-        .family     = PF_BLUETOOTH,
-        .owner      = THIS_MODULE,
-        .release    = bnep_sock_release,
-        .ioctl      = bnep_sock_ioctl,
-        .bind       = sock_no_bind,
-        .getname    = sock_no_getname,
-        .sendmsg    = sock_no_sendmsg,
-        .recvmsg    = sock_no_recvmsg,
-        .poll       = sock_no_poll,
-        .listen     = sock_no_listen,
-        .shutdown   = sock_no_shutdown,
-        .setsockopt = sock_no_setsockopt,
-        .getsockopt = sock_no_getsockopt,
-        .connect    = sock_no_connect,
-        .socketpair = sock_no_socketpair,
-        .accept     = sock_no_accept,
-        .mmap       = sock_no_mmap
+        .family         = PF_BLUETOOTH,
+        .owner          = THIS_MODULE,
+        .release        = bnep_sock_release,
+        .ioctl          = bnep_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = bnep_sock_compat_ioctl,
+#endif
+        .bind           = sock_no_bind,
+        .getname        = sock_no_getname,
+        .sendmsg        = sock_no_sendmsg,
+        .recvmsg        = sock_no_recvmsg,
+        .poll           = sock_no_poll,
+        .listen         = sock_no_listen,
+        .shutdown       = sock_no_shutdown,
+        .setsockopt     = sock_no_setsockopt,
+        .getsockopt     = sock_no_getsockopt,
+        .connect        = sock_no_connect,
+        .socketpair     = sock_no_socketpair,
+        .accept         = sock_no_accept,
+        .mmap           = sock_no_mmap
 };
 
 static struct proto bnep_proto = {
@@ -181,7 +214,7 @@ static int bnep_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &bnep_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &bnep_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 10ad7fd91d83..53295d33dc5c 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -34,6 +34,7 @@
 #include <linux/socket.h>
 #include <linux/ioctl.h>
 #include <linux/file.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include <linux/isdn/capilli.h>
@@ -137,11 +138,43 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+static int cmtp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == CMTPGETCONNLIST) {
+                struct cmtp_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+        
+                err = cmtp_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        }
+
+        return cmtp_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops cmtp_sock_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .release        = cmtp_sock_release,
         .ioctl          = cmtp_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = cmtp_sock_compat_ioctl,
+#endif
         .bind           = sock_no_bind,
         .getname        = sock_no_getname,
         .sendmsg        = sock_no_sendmsg,
@@ -172,7 +205,7 @@ static int cmtp_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &cmtp_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &cmtp_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 90e3a285a17e..6cd5711fa28a 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -51,7 +51,7 @@
 #define BT_DBG(D...)
 #endif
 
-static void hci_acl_connect(struct hci_conn *conn)
+void hci_acl_connect(struct hci_conn *conn)
 {
         struct hci_dev *hdev = conn->hdev;
         struct inquiry_entry *ie;
@@ -63,6 +63,8 @@ static void hci_acl_connect(struct hci_conn *conn)
         conn->out   = 1;
         conn->link_mode = HCI_LM_MASTER;
 
+        conn->attempt++;
+
         memset(&cp, 0, sizeof(cp));
         bacpy(&cp.bdaddr, &conn->dst);
         cp.pscan_rep_mode = 0x02;
@@ -80,7 +82,7 @@ static void hci_acl_connect(struct hci_conn *conn)
                 cp.role_switch  = 0x01;
         else
                 cp.role_switch  = 0x00;
-                
+
         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, sizeof(cp), &cp);
 }
 
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d43d0c890975..bb94e6da223c 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -57,6 +57,7 @@
 static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
 {
         __u8 status;
+        struct hci_conn *pend;
 
         BT_DBG("%s ocf 0x%x", hdev->name, ocf);
 
@@ -71,6 +72,15 @@ static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb
                         clear_bit(HCI_INQUIRY, &hdev->flags);
                         hci_req_complete(hdev, status);
                 }
+
+                hci_dev_lock(hdev);
+
+                pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+                if (pend)
+                        hci_acl_connect(pend);
+
+                hci_dev_unlock(hdev);
+
                 break;
 
         default:
@@ -414,9 +424,12 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 
         if (status) {
                 if (conn && conn->state == BT_CONNECT) {
-                        conn->state = BT_CLOSED;
-                        hci_proto_connect_cfm(conn, status);
-                        hci_conn_del(conn);
+                        if (status != 0x0c || conn->attempt > 2) {
+                                conn->state = BT_CLOSED;
+                                hci_proto_connect_cfm(conn, status);
+                                hci_conn_del(conn);
+                        } else
+                                conn->state = BT_CONNECT2;
                 }
         } else {
                 if (!conn) {
@@ -562,11 +575,20 @@ static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
+        struct hci_conn *pend;
 
         BT_DBG("%s status %d", hdev->name, status);
 
         clear_bit(HCI_INQUIRY, &hdev->flags);
         hci_req_complete(hdev, status);
+
+        hci_dev_lock(hdev);
+
+        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (pend)
+                hci_acl_connect(pend);
+
+        hci_dev_unlock(hdev);
 }
 
 /* Inquiry Result */
@@ -728,7 +750,7 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_complete *ev = (struct hci_ev_conn_complete *) skb->data;
-        struct hci_conn *conn;
+        struct hci_conn *conn, *pend;
 
         BT_DBG("%s", hdev->name);
 
@@ -801,6 +823,10 @@ static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (ev->status)
                 hci_conn_del(conn);
 
+        pend = hci_conn_hash_lookup_state(hdev, ACL_LINK, BT_CONNECT2);
+        if (pend)
+                hci_acl_connect(pend);
+
         hci_dev_unlock(hdev);
 }
 
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 1a35d343e08a..711a085eca5b 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -120,10 +120,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
                         if (!hci_test_bit(evt, &flt->event_mask))
                                 continue;
 
-                        if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
-                                        flt->opcode != *(__u16 *)(skb->data + 3)) ||
-                                        (evt == HCI_EV_CMD_STATUS && 
-                                        flt->opcode != *(__u16 *)(skb->data + 4))))
+                        if (flt->opcode &&
+                            ((evt == HCI_EV_CMD_COMPLETE &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 3))) ||
+                             (evt == HCI_EV_CMD_STATUS &&
+                              flt->opcode !=
+                              get_unaligned((__u16 *)(skb->data + 4)))))
                                 continue;
                 }
 
@@ -618,7 +621,7 @@ static int hci_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &hci_sock_ops;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 989b22d9042e..3eeeb7a86e75 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -242,10 +242,14 @@ static void add_conn(void *data)
         struct hci_conn *conn = data;
         int i;
 
-        device_register(&conn->dev);
+        if (device_register(&conn->dev) < 0) {
+                BT_ERR("Failed to register connection device");
+                return;
+        }
 
         for (i = 0; conn_attrs[i]; i++)
-                device_create_file(&conn->dev, conn_attrs[i]);
+                if (device_create_file(&conn->dev, conn_attrs[i]) < 0)
+                        BT_ERR("Failed to create connection attribute");
 }
 
 void hci_conn_add_sysfs(struct hci_conn *conn)
@@ -255,7 +259,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         BT_DBG("conn %p", conn);
 
-        conn->dev.parent  = &hdev->dev;
+        conn->dev.bus = &bt_bus;
+        conn->dev.parent = &hdev->dev;
+
         conn->dev.release = bt_release;
 
         snprintf(conn->dev.bus_id, BUS_ID_SIZE,
@@ -295,11 +301,7 @@ int hci_register_sysfs(struct hci_dev *hdev)
         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 
         dev->class = bt_class;
-
-        if (hdev->parent)
-                dev->parent = hdev->parent;
-        else
-                dev->parent = &bt_platform->dev;
+        dev->parent = hdev->parent;
 
         strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
 
@@ -312,7 +314,8 @@ int hci_register_sysfs(struct hci_dev *hdev)
                 return err;
 
         for (i = 0; bt_attrs[i]; i++)
-                device_create_file(dev, bt_attrs[i]);
+                if (device_create_file(dev, bt_attrs[i]) < 0)
+                        BT_ERR("Failed to create device attribute");
 
         return 0;
 }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 03b5dadb4951..66782010f82c 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -507,14 +507,12 @@ static int hidp_session(void *arg)
 
         hidp_del_timer(session);
 
-        if (intr_sk->sk_state != BT_CONNECTED)
-                wait_event_timeout(*(ctrl_sk->sk_sleep), (ctrl_sk->sk_state == BT_CLOSED), HZ);
-
-        fput(session->ctrl_sock->file);
+        fput(session->intr_sock->file);
 
-        wait_event_timeout(*(intr_sk->sk_sleep), (intr_sk->sk_state == BT_CLOSED), HZ);
+        wait_event_timeout(*(ctrl_sk->sk_sleep),
+                (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 
-        fput(session->intr_sock->file);
+        fput(session->ctrl_sock->file);
 
         __hidp_unlink_session(session);
 
@@ -541,12 +539,10 @@ static struct device *hidp_get_device(struct hidp_session *session)
                 return NULL;
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
-        if (!conn)
-                return NULL;
 
         hci_dev_put(hdev);
 
-        return &conn->dev;
+        return conn ? &conn->dev : NULL;
 }
 
 static inline void hidp_setup_input(struct hidp_session *session, struct hidp_connadd_req *req)
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 099646e4e2ef..407fba43c1b9 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -35,6 +35,7 @@
 #include <linux/ioctl.h>
 #include <linux/file.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <net/sock.h>
 
 #include "hidp.h"
@@ -143,11 +144,88 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
         return -EINVAL;
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_hidp_connadd_req {
+        int   ctrl_sock;        // Connected control socket
+        int   intr_sock;        // Connteted interrupt socket
+        __u16 parser;
+        __u16 rd_size;
+        compat_uptr_t rd_data;
+        __u8  country;
+        __u8  subclass;
+        __u16 vendor;
+        __u16 product;
+        __u16 version;
+        __u32 flags;
+        __u32 idle_to;
+        char  name[128];
+};
+
+static int hidp_sock_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+{
+        if (cmd == HIDPGETCONNLIST) {
+                struct hidp_connlist_req cl;
+                uint32_t uci;
+                int err;
+
+                if (get_user(cl.cnum, (uint32_t __user *) arg) ||
+                                get_user(uci, (u32 __user *) (arg + 4)))
+                        return -EFAULT;
+
+                cl.ci = compat_ptr(uci);
+
+                if (cl.cnum <= 0)
+                        return -EINVAL;
+
+                err = hidp_get_connlist(&cl);
+
+                if (!err && put_user(cl.cnum, (uint32_t __user *) arg))
+                        err = -EFAULT;
+
+                return err;
+        } else if (cmd == HIDPCONNADD) {
+                struct compat_hidp_connadd_req ca;
+                struct hidp_connadd_req __user *uca;
+
+                uca = compat_alloc_user_space(sizeof(*uca));
+
+                if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
+                        return -EFAULT;
+
+                if (put_user(ca.ctrl_sock, &uca->ctrl_sock) ||
+                                put_user(ca.intr_sock, &uca->intr_sock) ||
+                                put_user(ca.parser, &uca->parser) ||
+                                put_user(ca.rd_size, &uca->parser) ||
+                                put_user(compat_ptr(ca.rd_data), &uca->rd_data) ||
+                                put_user(ca.country, &uca->country) ||
+                                put_user(ca.subclass, &uca->subclass) ||
+                                put_user(ca.vendor, &uca->vendor) ||
+                                put_user(ca.product, &uca->product) ||
+                                put_user(ca.version, &uca->version) ||
+                                put_user(ca.flags, &uca->flags) ||
+                                put_user(ca.idle_to, &uca->idle_to) ||
+                                copy_to_user(&uca->name[0], &ca.name[0], 128))
+                        return -EFAULT;
+                
+                arg = (unsigned long) uca;
+
+                /* Fall through. We don't actually write back any _changes_
+                   to the structure anyway, so there's no need to copy back
+                   into the original compat version */
+        }
+
+        return hidp_sock_ioctl(sock, cmd, arg);
+}
+#endif
+
 static const struct proto_ops hidp_sock_ops = {
         .family         = PF_BLUETOOTH,
         .owner          = THIS_MODULE,
         .release        = hidp_sock_release,
         .ioctl          = hidp_sock_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = hidp_sock_compat_ioctl,
+#endif
         .bind           = sock_no_bind,
         .getname        = sock_no_getname,
         .sendmsg        = sock_no_sendmsg,
@@ -178,7 +256,7 @@ static int hidp_sock_create(struct socket *sock, int protocol)
         if (sock->type != SOCK_RAW)
                 return -ESOCKTNOSUPPORT;
 
-        sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hidp_proto, 1);
+        sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hidp_proto, 1);
         if (!sk)
                 return -ENOMEM;
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index d56f60b392ac..bbf78e6a7bc3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -559,7 +559,7 @@ static int l2cap_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &l2cap_sock_ops;
 
-        sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL);
+        sk = l2cap_sock_alloc(sock, protocol, GFP_ATOMIC);
         if (!sk)
                 return -ENOMEM;
 
@@ -1353,12 +1353,12 @@ static inline int l2cap_conf_output(struct sock *sk, void **ptr)
 
         /* Configure output options and let the other side know
          * which ones we don't like. */
-        if (pi->conf_mtu < pi->omtu) {
-                l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+        if (pi->conf_mtu < pi->omtu)
                 result = L2CAP_CONF_UNACCEPT;
-        } else {
+        else
                 pi->omtu = pi->conf_mtu;
-        }
+
+        l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
 
         BT_DBG("sk %p result %d", sk, result);
         return result;
@@ -1533,6 +1533,9 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
                 return -ENOENT;
 
+        if (sk->sk_state == BT_DISCONN)
+                goto unlock;
+
         l2cap_parse_conf_req(sk, req->data, cmd->len - sizeof(*req));
 
         if (flags & 0x0001) {
@@ -2216,7 +2219,8 @@ static int __init l2cap_init(void)
                 goto error;
         }
 
-        class_create_file(bt_class, &class_attr_l2cap);
+        if (class_create_file(bt_class, &class_attr_l2cap) < 0)
+                BT_ERR("Failed to create L2CAP info file");
 
         BT_INFO("L2CAP ver %s", VERSION);
         BT_INFO("L2CAP socket layer initialized");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 468df3b953f6..ddc4e9d5963e 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2058,7 +2058,8 @@ static int __init rfcomm_init(void)
 
         kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
 
-        class_create_file(bt_class, &class_attr_rfcomm_dlc);
+        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
+                BT_ERR("Failed to create RFCOMM info file");
 
         rfcomm_init_sockets();
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 220fee04e7f2..544d65b7baa7 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -336,7 +336,8 @@ static int rfcomm_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &rfcomm_sock_ops;
 
-        if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
+        sk = rfcomm_sock_alloc(sock, protocol, GFP_ATOMIC);
+        if (!sk)
                 return -ENOMEM;
 
         rfcomm_sock_init(sk, NULL);
@@ -944,7 +945,8 @@ int __init rfcomm_init_sockets(void)
         if (err < 0)
                 goto error;
 
-        class_create_file(bt_class, &class_attr_rfcomm);
+        if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
+                BT_ERR("Failed to create RFCOMM info file");
 
         BT_INFO("RFCOMM socket layer initialized");
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 1958ad1b8541..1fb5d42f37ae 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -172,12 +172,10 @@ static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
                 return NULL;
 
         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
-        if (!conn)
-                return NULL;
 
         hci_dev_put(hdev);
 
-        return &conn->dev;
+        return conn ? &conn->dev : NULL;
 }
 
 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
@@ -767,6 +765,9 @@ static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
 
         BT_DBG("tty %p termios %p", tty, old);
 
+        if (!dev || !dev->dlc || !dev->dlc->session)
+                return;
+
         /* Handle turning off CRTSCTS */
         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 
                 BT_DBG("Turning off CRTSCTS unsupported");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 7714a2ec3854..5d13d4f31753 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -452,7 +452,8 @@ static int sco_sock_create(struct socket *sock, int protocol)
 
         sock->ops = &sco_sock_ops;
 
-        if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL)))
+        sk = sco_sock_alloc(sock, protocol, GFP_ATOMIC);
+        if (!sk)
                 return -ENOMEM;
 
         sco_sock_init(sk, NULL);
@@ -967,7 +968,8 @@ static int __init sco_init(void)
                 goto error;
         }
 
-        class_create_file(bt_class, &class_attr_sco);
+        if (class_create_file(bt_class, &class_attr_sco) < 0)
+                BT_ERR("Failed to create SCO info file");
 
         BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 3a73b8c94271..d9f04864d15d 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -128,7 +128,10 @@ void br_fdb_cleanup(unsigned long _data)
         mod_timer(&br->gc_timer, jiffies + HZ/10);
 }
 
-void br_fdb_delete_by_port(struct net_bridge *br, struct net_bridge_port *p)
+
+void br_fdb_delete_by_port(struct net_bridge *br,
+                           const struct net_bridge_port *p,
+                           int do_all)
 {
         int i;
 
@@ -142,6 +145,8 @@ void br_fdb_delete_by_port(struct net_bridge *br, struct net_bridge_port *p)
                         if (f->dst != p) 
                                 continue;
 
+                        if (f->is_static && !do_all)
+                                continue;
                         /*
                          * if multiple ports all have the same device address
                          * then when one port is deleted, assign
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b1211d5342f6..f753c40c11d2 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -163,7 +163,7 @@ static void del_nbp(struct net_bridge_port *p)
         br_stp_disable_port(p);
         spin_unlock_bh(&br->lock);
 
-        br_fdb_delete_by_port(br, p);
+        br_fdb_delete_by_port(br, p, 1);
 
         list_del_rcu(&p->list);
 
@@ -448,7 +448,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         return 0;
 err2:
-        br_fdb_delete_by_port(br, p);
+        br_fdb_delete_by_port(br, p, 1);
 err1:
         kobject_del(&p->kobj);
 err0:
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index c491fb2f280e..74258d86f256 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -143,7 +143,7 @@ extern void br_fdb_changeaddr(struct net_bridge_port *p,
                               const unsigned char *newaddr);
 extern void br_fdb_cleanup(unsigned long arg);
 extern void br_fdb_delete_by_port(struct net_bridge *br,
-                           struct net_bridge_port *p);
+                                  const struct net_bridge_port *p, int do_all);
 extern struct net_bridge_fdb_entry *__br_fdb_get(struct net_bridge *br,
                                                  const unsigned char *addr);
 extern struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 14cd025079af..d294224592db 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -113,6 +113,8 @@ void br_stp_disable_port(struct net_bridge_port *p)
         del_timer(&p->forward_delay_timer);
         del_timer(&p->hold_timer);
 
+        br_fdb_delete_by_port(br, p, 0);
+
         br_configuration_update(br);
 
         br_port_state_selection(br);
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index 96bcb2ff59ab..de9d1a9473f2 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -376,7 +376,7 @@ int br_sysfs_addbr(struct net_device *dev)
 
         err = sysfs_create_bin_file(brobj, &bridge_forward);
         if (err) {
-                pr_info("%s: can't create attribue file %s/%s\n",
+                pr_info("%s: can't create attribute file %s/%s\n",
                         __FUNCTION__, dev->name, bridge_forward.attr.name);
                 goto out2;
         }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 3df55b2bd91d..9f85666f29f7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -86,7 +86,7 @@ static inline int ebt_do_match (struct ebt_entry_match *m,
 static inline int ebt_dev_check(char *entry, const struct net_device *device)
 {
         int i = 0;
-        char *devname = device->name;
+        const char *devname = device->name;
 
         if (*entry == '\0')
                 return 0;
diff --git a/net/compat.c b/net/compat.c
index d5d69fa15d07..52d32f1bc728 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -285,8 +285,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
 
         if (i > 0) {
                 int cmlen = CMSG_COMPAT_LEN(i * sizeof(int));
-                if (!err)
-                        err = put_user(SOL_SOCKET, &cm->cmsg_level);
+                err = put_user(SOL_SOCKET, &cm->cmsg_level);
                 if (!err)
                         err = put_user(SCM_RIGHTS, &cm->cmsg_type);
                 if (!err)
diff --git a/net/core/dev.c b/net/core/dev.c
index 4d891beab138..81c426adcd1e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3502,8 +3502,6 @@ static int __init net_dev_init(void)
 
         BUG_ON(!dev_boot_phase);
 
-        net_random_init();
-
         if (dev_proc_init())
                 goto out;
 
diff --git a/net/core/flow.c b/net/core/flow.c
index f23e7e386543..b16d31ae5e54 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -85,6 +85,14 @@ static void flow_cache_new_hashrnd(unsigned long arg)
         add_timer(&flow_hash_rnd_timer);
 }
 
+static void flow_entry_kill(int cpu, struct flow_cache_entry *fle)
+{
+        if (fle->object)
+                atomic_dec(fle->object_ref);
+        kmem_cache_free(flow_cachep, fle);
+        flow_count(cpu)--;
+}
+
 static void __flow_cache_shrink(int cpu, int shrink_to)
 {
         struct flow_cache_entry *fle, **flp;
@@ -100,10 +108,7 @@ static void __flow_cache_shrink(int cpu, int shrink_to)
                 }
                 while ((fle = *flp) != NULL) {
                         *flp = fle->next;
-                        if (fle->object)
-                                atomic_dec(fle->object_ref);
-                        kmem_cache_free(flow_cachep, fle);
-                        flow_count(cpu)--;
+                        flow_entry_kill(cpu, fle);
                 }
         }
 }
@@ -220,24 +225,33 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
 
 nocache:
         {
+                int err;
                 void *obj;
                 atomic_t *obj_ref;
 
-                resolver(key, family, dir, &obj, &obj_ref);
+                err = resolver(key, family, dir, &obj, &obj_ref);
 
                 if (fle) {
-                        fle->genid = atomic_read(&flow_cache_genid);
-
-                        if (fle->object)
-                                atomic_dec(fle->object_ref);
-
-                        fle->object = obj;
-                        fle->object_ref = obj_ref;
-                        if (obj)
-                                atomic_inc(fle->object_ref);
+                        if (err) {
+                                /* Force security policy check on next lookup */
+                                *head = fle->next;
+                                flow_entry_kill(cpu, fle);
+                        } else {
+                                fle->genid = atomic_read(&flow_cache_genid);
+
+                                if (fle->object)
+                                        atomic_dec(fle->object_ref);
+
+                                fle->object = obj;
+                                fle->object_ref = obj_ref;
+                                if (obj)
+                                        atomic_inc(fle->object_ref);
+                        }
                 }
                 local_bh_enable();
 
+                if (err)
+                        obj = ERR_PTR(err);
                 return obj;
         }
 }
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index ead5920c26d6..6589adb14cbf 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -335,13 +335,19 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         memcpy(skb->data, msg, len);
         skb->len += len;
 
-        udph = (struct udphdr *) skb_push(skb, sizeof(*udph));
+        skb->h.uh = udph = (struct udphdr *) skb_push(skb, sizeof(*udph));
         udph->source = htons(np->local_port);
         udph->dest = htons(np->remote_port);
         udph->len = htons(udp_len);
         udph->check = 0;
+        udph->check = csum_tcpudp_magic(htonl(np->local_ip),
+                                        htonl(np->remote_ip),
+                                        udp_len, IPPROTO_UDP,
+                                        csum_partial((unsigned char *)udph, udp_len, 0));
+        if (udph->check == 0)
+                udph->check = -1;
 
-        iph = (struct iphdr *)skb_push(skb, sizeof(*iph));
+        skb->nh.iph = iph = (struct iphdr *)skb_push(skb, sizeof(*iph));
 
         /* iph->version = 4; iph->ihl = 5; */
         put_unaligned(0x45, (unsigned char *)iph);
@@ -357,8 +363,8 @@ void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
         iph->check    = ip_fast_csum((unsigned char *)iph, iph->ihl);
 
         eth = (struct ethhdr *) skb_push(skb, ETH_HLEN);
-
-        eth->h_proto = htons(ETH_P_IP);
+        skb->mac.raw = skb->data;
+        skb->protocol = eth->h_proto = htons(ETH_P_IP);
         memcpy(eth->h_source, np->local_mac, 6);
         memcpy(eth->h_dest, np->remote_mac, 6);
 
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index dd023fd28304..733d86d0a4fb 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2304,6 +2304,12 @@ static void mpls_push(__be32 *mpls, struct pktgen_dev *pkt_dev)
         *mpls |= MPLS_STACK_BOTTOM;
 }
 
+static inline __be16 build_tci(unsigned int id, unsigned int cfi,
+                               unsigned int prio)
+{
+        return htons(id | (cfi << 12) | (prio << 13));
+}
+
 static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
                                         struct pktgen_dev *pkt_dev)
 {
@@ -2353,16 +2359,16 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         if (pkt_dev->vlan_id != 0xffff) {
                 if(pkt_dev->svlan_id != 0xffff) {
                         svlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
-                        *svlan_tci = htons(pkt_dev->svlan_id);
-                        *svlan_tci |= pkt_dev->svlan_p << 5;
-                        *svlan_tci |= pkt_dev->svlan_cfi << 4;
+                        *svlan_tci = build_tci(pkt_dev->svlan_id,
+                                               pkt_dev->svlan_cfi,
+                                               pkt_dev->svlan_p);
                         svlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
                         *svlan_encapsulated_proto = __constant_htons(ETH_P_8021Q);
                 }
                 vlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
-                *vlan_tci = htons(pkt_dev->vlan_id);
-                *vlan_tci |= pkt_dev->vlan_p << 5;
-                *vlan_tci |= pkt_dev->vlan_cfi << 4;
+                *vlan_tci = build_tci(pkt_dev->vlan_id,
+                                      pkt_dev->vlan_cfi,
+                                      pkt_dev->vlan_p);
                 vlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
                 *vlan_encapsulated_proto = __constant_htons(ETH_P_IP);
         }
@@ -2689,16 +2695,16 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         if (pkt_dev->vlan_id != 0xffff) {
                 if(pkt_dev->svlan_id != 0xffff) {
                         svlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
-                        *svlan_tci = htons(pkt_dev->svlan_id);
-                        *svlan_tci |= pkt_dev->svlan_p << 5;
-                        *svlan_tci |= pkt_dev->svlan_cfi << 4;
+                        *svlan_tci = build_tci(pkt_dev->svlan_id,
+                                               pkt_dev->svlan_cfi,
+                                               pkt_dev->svlan_p);
                         svlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
                         *svlan_encapsulated_proto = __constant_htons(ETH_P_8021Q);
                 }
                 vlan_tci = (__be16 *)skb_put(skb, sizeof(__be16));
-                *vlan_tci = htons(pkt_dev->vlan_id);
-                *vlan_tci |= pkt_dev->vlan_p << 5;
-                *vlan_tci |= pkt_dev->vlan_cfi << 4;
+                *vlan_tci = build_tci(pkt_dev->vlan_id,
+                                      pkt_dev->vlan_cfi,
+                                      pkt_dev->vlan_p);
                 vlan_encapsulated_proto = (__be16 *)skb_put(skb, sizeof(__be16));
                 *vlan_encapsulated_proto = __constant_htons(ETH_P_IPV6);
         }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 221e4038216b..02f3c7947898 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -602,7 +602,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 goto errout;
         }
 
-        err = rtnl_unicast(skb, NETLINK_CB(skb).pid);
+        err = rtnl_unicast(nskb, NETLINK_CB(skb).pid);
 errout:
         kfree(iw_buf);
         dev_put(dev);
diff --git a/net/core/scm.c b/net/core/scm.c
index 649d01ef35b6..271cf060ef8c 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -245,8 +245,7 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
         if (i > 0)
         {
                 int cmlen = CMSG_LEN(i*sizeof(int));
-                if (!err)
-                        err = put_user(SOL_SOCKET, &cm->cmsg_level);
+                err = put_user(SOL_SOCKET, &cm->cmsg_level);
                 if (!err)
                         err = put_user(SCM_RIGHTS, &cm->cmsg_type);
                 if (!err)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3c23760c5827..b8b106358040 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -639,6 +639,7 @@ struct sk_buff *pskb_copy(struct sk_buff *skb, gfp_t gfp_mask)
         n->csum      = skb->csum;
         n->ip_summed = skb->ip_summed;
 
+        n->truesize += skb->data_len;
         n->data_len  = skb->data_len;
         n->len       = skb->len;
 
@@ -1946,7 +1947,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
         do {
                 struct sk_buff *nskb;
                 skb_frag_t *frag;
-                int hsize, nsize;
+                int hsize;
                 int k;
                 int size;
 
@@ -1957,11 +1958,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 hsize = skb_headlen(skb) - offset;
                 if (hsize < 0)
                         hsize = 0;
-                nsize = hsize + doffset;
-                if (nsize > len + doffset || !sg)
-                        nsize = len + doffset;
+                if (hsize > len || !sg)
+                        hsize = len;
 
-                nskb = alloc_skb(nsize + headroom, GFP_ATOMIC);
+                nskb = alloc_skb(hsize + doffset + headroom, GFP_ATOMIC);
                 if (unlikely(!nskb))
                         goto err;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index b77e155cbe6c..ee6cd2541d35 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -823,7 +823,7 @@ static void inline sock_lock_init(struct sock *sk)
                                    af_family_slock_key_strings[sk->sk_family]);
         lockdep_init_map(&sk->sk_lock.dep_map,
                          af_family_key_strings[sk->sk_family],
-                         af_family_keys + sk->sk_family);
+                         af_family_keys + sk->sk_family, 0);
 }
 
 /**
@@ -1160,7 +1160,7 @@ static struct sk_buff *sock_alloc_send_pskb(struct sock *sk,
                         goto failure;
 
                 if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
-                        skb = alloc_skb(header_len, sk->sk_allocation);
+                        skb = alloc_skb(header_len, gfp_mask);
                         if (skb) {
                                 int npages;
                                 int i;
diff --git a/net/core/utils.c b/net/core/utils.c
index 94c5d761c830..d93fe64f6693 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -30,119 +30,6 @@
 #include <asm/system.h>
 #include <asm/uaccess.h>
 
-/*
-  This is a maximally equidistributed combined Tausworthe generator
-  based on code from GNU Scientific Library 1.5 (30 Jun 2004)
-
-   x_n = (s1_n ^ s2_n ^ s3_n) 
-
-   s1_{n+1} = (((s1_n & 4294967294) <<12) ^ (((s1_n <<13) ^ s1_n) >>19))
-   s2_{n+1} = (((s2_n & 4294967288) << 4) ^ (((s2_n << 2) ^ s2_n) >>25))
-   s3_{n+1} = (((s3_n & 4294967280) <<17) ^ (((s3_n << 3) ^ s3_n) >>11))
-
-   The period of this generator is about 2^88.
-
-   From: P. L'Ecuyer, "Maximally Equidistributed Combined Tausworthe
-   Generators", Mathematics of Computation, 65, 213 (1996), 203--213.
-
-   This is available on the net from L'Ecuyer's home page,
-
-   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme.ps
-   ftp://ftp.iro.umontreal.ca/pub/simulation/lecuyer/papers/tausme.ps 
-
-   There is an erratum in the paper "Tables of Maximally
-   Equidistributed Combined LFSR Generators", Mathematics of
-   Computation, 68, 225 (1999), 261--269:
-   http://www.iro.umontreal.ca/~lecuyer/myftp/papers/tausme2.ps
-
-        ... the k_j most significant bits of z_j must be non-
-        zero, for each j. (Note: this restriction also applies to the 
-        computer code given in [4], but was mistakenly not mentioned in
-        that paper.)
-   
-   This affects the seeding procedure by imposing the requirement
-   s1 > 1, s2 > 7, s3 > 15.
-
-*/
-struct nrnd_state {
-        u32 s1, s2, s3;
-};
-
-static DEFINE_PER_CPU(struct nrnd_state, net_rand_state);
-
-static u32 __net_random(struct nrnd_state *state)
-{
-#define TAUSWORTHE(s,a,b,c,d) ((s&c)<<d) ^ (((s <<a) ^ s)>>b)
-
-        state->s1 = TAUSWORTHE(state->s1, 13, 19, 4294967294UL, 12);
-        state->s2 = TAUSWORTHE(state->s2, 2, 25, 4294967288UL, 4);
-        state->s3 = TAUSWORTHE(state->s3, 3, 11, 4294967280UL, 17);
-
-        return (state->s1 ^ state->s2 ^ state->s3);
-}
-
-static void __net_srandom(struct nrnd_state *state, unsigned long s)
-{
-        if (s == 0)
-                s = 1;      /* default seed is 1 */
-
-#define LCG(n) (69069 * n)
-        state->s1 = LCG(s);
-        state->s2 = LCG(state->s1);
-        state->s3 = LCG(state->s2);
-
-        /* "warm it up" */
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-        __net_random(state);
-}
-
-
-unsigned long net_random(void)
-{
-        unsigned long r;
-        struct nrnd_state *state = &get_cpu_var(net_rand_state);
-        r = __net_random(state);
-        put_cpu_var(state);
-        return r;
-}
-
-
-void net_srandom(unsigned long entropy)
-{
-        struct nrnd_state *state = &get_cpu_var(net_rand_state);
-        __net_srandom(state, state->s1^entropy);
-        put_cpu_var(state);
-}
-
-void __init net_random_init(void)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                struct nrnd_state *state = &per_cpu(net_rand_state,i);
-                __net_srandom(state, i+jiffies);
-        }
-}
-
-static int net_random_reseed(void)
-{
-        int i;
-        unsigned long seed;
-
-        for_each_possible_cpu(i) {
-                struct nrnd_state *state = &per_cpu(net_rand_state,i);
-
-                get_random_bytes(&seed, sizeof(seed));
-                __net_srandom(state, seed);
-        }
-        return 0;
-}
-late_initcall(net_random_reseed);
-
 int net_msg_cost = 5*HZ;
 int net_msg_burst = 10;
 
@@ -153,10 +40,7 @@ int net_ratelimit(void)
 {
         return __printk_ratelimit(net_msg_cost, net_msg_burst);
 }
-
-EXPORT_SYMBOL(net_random);
 EXPORT_SYMBOL(net_ratelimit);
-EXPORT_SYMBOL(net_srandom);
 
 /*
  * Convert an ASCII string to binary IP.
diff --git a/net/core/wireless.c b/net/core/wireless.c
index ffff0da46c6e..cb1b8728d7ee 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -748,11 +748,39 @@ static int ioctl_standard_call(struct net_device *	dev,
                 int     extra_size;
                 int     user_length = 0;
                 int     err;
+                int     essid_compat = 0;
 
                 /* Calculate space needed by arguments. Always allocate
                  * for max space. Easier, and won't last long... */
                 extra_size = descr->max_tokens * descr->token_size;
 
+                /* Check need for ESSID compatibility for WE < 21 */
+                switch (cmd) {
+                case SIOCSIWESSID:
+                case SIOCGIWESSID:
+                case SIOCSIWNICKN:
+                case SIOCGIWNICKN:
+                        if (iwr->u.data.length == descr->max_tokens + 1)
+                                essid_compat = 1;
+                        else if (IW_IS_SET(cmd) && (iwr->u.data.length != 0)) {
+                                char essid[IW_ESSID_MAX_SIZE + 1];
+
+                                err = copy_from_user(essid, iwr->u.data.pointer,
+                                                     iwr->u.data.length *
+                                                     descr->token_size);
+                                if (err)
+                                        return -EFAULT;
+
+                                if (essid[iwr->u.data.length - 1] == '\0')
+                                        essid_compat = 1;
+                        }
+                        break;
+                default:
+                        break;
+                }
+
+                iwr->u.data.length -= essid_compat;
+
                 /* Check what user space is giving us */
                 if(IW_IS_SET(cmd)) {
                         /* Check NULL pointer */
@@ -795,7 +823,8 @@ static int ioctl_standard_call(struct net_device *	dev,
 #endif  /* WE_IOCTL_DEBUG */
 
                 /* Create the kernel buffer */
-                extra = kmalloc(extra_size, GFP_KERNEL);
+                /*    kzalloc ensures NULL-termination for essid_compat */
+                extra = kzalloc(extra_size, GFP_KERNEL);
                 if (extra == NULL) {
                         return -ENOMEM;
                 }
@@ -819,6 +848,8 @@ static int ioctl_standard_call(struct net_device *	dev,
                 /* Call the handler */
                 ret = handler(dev, &info, &(iwr->u), extra);
 
+                iwr->u.data.length += essid_compat;
+
                 /* If we have something to return to the user */
                 if (!ret && IW_IS_GET(cmd)) {
                         /* Check if there is enough buffer up there */
diff --git a/net/dccp/Kconfig b/net/dccp/Kconfig
index e2a095d0fd80..ef8919cca74b 100644
--- a/net/dccp/Kconfig
+++ b/net/dccp/Kconfig
@@ -4,15 +4,15 @@ menu "DCCP Configuration (EXPERIMENTAL)"
 config IP_DCCP
         tristate "The DCCP Protocol (EXPERIMENTAL)"
         ---help---
-          Datagram Congestion Control Protocol
+          Datagram Congestion Control Protocol (RFC 4340)
 
-          From draft-ietf-dccp-spec-11 <http://www.icir.org/kohler/dcp/draft-ietf-dccp-spec-11.txt>.
+          From http://www.ietf.org/rfc/rfc4340.txt:
 
           The Datagram Congestion Control Protocol (DCCP) is a transport
           protocol that implements bidirectional, unicast connections of
           congestion-controlled, unreliable datagrams. It should be suitable
           for use by applications such as streaming media, Internet telephony,
-          and on-line games
+          and on-line games.
 
           To compile this protocol support as a module, choose M here: the
           module will be called dccp.
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index 4d176d33983f..f8208874ac7d 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -113,7 +113,7 @@ int dccp_insert_option_ackvec(struct sock *sk, struct sk_buff *skb)
 
         memcpy(to, from, len);
         /*
-         *      From draft-ietf-dccp-spec-11.txt:
+         *      From RFC 4340, A.2:
          *
          *      For each acknowledgement it sends, the HC-Receiver will add an
          *      acknowledgement record.  ack_seqno will equal the HC-Receiver
@@ -224,7 +224,7 @@ static inline int dccp_ackvec_set_buf_head_state(struct dccp_ackvec *av,
 }
 
 /*
- * Implements the draft-ietf-dccp-spec-11.txt Appendix A
+ * Implements the RFC 4340, Appendix A
  */
 int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
                     const u64 ackno, const u8 state)
@@ -237,7 +237,7 @@ int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
          * We may well decide to do buffer compression, etc, but for now lets
          * just drop.
          *
-         * From Appendix A:
+         * From Appendix A.1.1 (`New Packets'):
          *
          *      Of course, the circular buffer may overflow, either when the
          *      HC-Sender is sending data at a very high rate, when the
@@ -274,9 +274,9 @@ int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
                 /*
                  * A.1.2.  Old Packets
                  *
-                 *      When a packet with Sequence Number S arrives, and
-                 *      S <= buf_ackno, the HC-Receiver will scan the table
-                 *      for the byte corresponding to S. (Indexing structures
+                 *      When a packet with Sequence Number S <= buf_ackno
+                 *      arrives, the HC-Receiver will scan the table for
+                 *      the byte corresponding to S. (Indexing structures
                  *      could reduce the complexity of this scan.)
                  */
                 u64 delta = dccp_delta_seqno(ackno, av->dccpav_buf_ackno);
diff --git a/net/dccp/ackvec.h b/net/dccp/ackvec.h
index 2424effac7f6..cf8f20ce23a9 100644
--- a/net/dccp/ackvec.h
+++ b/net/dccp/ackvec.h
@@ -28,8 +28,7 @@
 
 /** struct dccp_ackvec - ack vector
  *
- * This data structure is the one defined in the DCCP draft
- * Appendix A.
+ * This data structure is the one defined in RFC 4340, Appendix A.
  *
  * @dccpav_buf_head - circular buffer head
  * @dccpav_buf_tail - circular buffer tail
diff --git a/net/dccp/ccids/Kconfig b/net/dccp/ccids/Kconfig
index 32752f750447..8533dabfb9f8 100644
--- a/net/dccp/ccids/Kconfig
+++ b/net/dccp/ccids/Kconfig
@@ -22,11 +22,11 @@ config IP_DCCP_CCID2
           for lost packets, would prefer CCID 2 to CCID 3.  On-line games may
           also prefer CCID 2.
 
-          CCID 2 is further described in:
-          http://www.icir.org/kohler/dccp/draft-ietf-dccp-ccid2-10.txt
+          CCID 2 is further described in RFC 4341,
+          http://www.ietf.org/rfc/rfc4341.txt
 
-          This text was extracted from:
-          http://www.icir.org/kohler/dccp/draft-ietf-dccp-spec-13.txt
+          This text was extracted from RFC 4340 (sec. 10.1),
+          http://www.ietf.org/rfc/rfc4340.txt
 
           If in doubt, say M.
 
@@ -53,15 +53,14 @@ config IP_DCCP_CCID3
           suitable than CCID 2 for applications such streaming media where a
           relatively smooth sending rate is of importance.
 
-          CCID 3 is further described in:
-
-          http://www.icir.org/kohler/dccp/draft-ietf-dccp-ccid3-11.txt.
+          CCID 3 is further described in RFC 4342,
+          http://www.ietf.org/rfc/rfc4342.txt
 
           The TFRC congestion control algorithms were initially described in
           RFC 3448.
 
-          This text was extracted from:
-          http://www.icir.org/kohler/dccp/draft-ietf-dccp-spec-13.txt
+          This text was extracted from RFC 4340 (sec. 10.2),
+          http://www.ietf.org/rfc/rfc4340.txt
           
           If in doubt, say M.
 
diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 2efb505aeb35..162032baeac0 100644
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -23,7 +23,7 @@
  */
 
 /*
- * This implementation should follow: draft-ietf-dccp-ccid2-10.txt
+ * This implementation should follow RFC 4341
  *
  * BUGS:
  * - sequence number wrapping
@@ -352,14 +352,14 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, int len)
 
 #ifdef CONFIG_IP_DCCP_CCID2_DEBUG
         ccid2_pr_debug("pipe=%d\n", hctx->ccid2hctx_pipe);
-        ccid2_pr_debug("Sent: seq=%llu\n", seq);
+        ccid2_pr_debug("Sent: seq=%llu\n", (unsigned long long)seq);
         do {
                 struct ccid2_seq *seqp = hctx->ccid2hctx_seqt;
 
                 while (seqp != hctx->ccid2hctx_seqh) {
                         ccid2_pr_debug("out seq=%llu acked=%d time=%lu\n",
-                                       seqp->ccid2s_seq, seqp->ccid2s_acked,
-                                       seqp->ccid2s_sent);
+                                       (unsigned long long)seqp->ccid2s_seq,
+                                       seqp->ccid2s_acked, seqp->ccid2s_sent);
                         seqp = seqp->ccid2s_next;
                 }
         } while (0);
@@ -480,7 +480,8 @@ static inline void ccid2_new_ack(struct sock *sk,
                 /* first measurement */
                 if (hctx->ccid2hctx_srtt == -1) {
                         ccid2_pr_debug("R: %lu Time=%lu seq=%llu\n",
-                                       r, jiffies, seqp->ccid2s_seq);
+                                       r, jiffies,
+                                       (unsigned long long)seqp->ccid2s_seq);
                         ccid2_change_srtt(hctx, r);
                         hctx->ccid2hctx_rttvar = r >> 1;
                 } else {
@@ -636,8 +637,9 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                         u64 ackno_end_rl;
 
                         dccp_set_seqno(&ackno_end_rl, ackno - rl);
-                        ccid2_pr_debug("ackvec start:%llu end:%llu\n", ackno,
-                                       ackno_end_rl);
+                        ccid2_pr_debug("ackvec start:%llu end:%llu\n",
+                                       (unsigned long long)ackno,
+                                       (unsigned long long)ackno_end_rl);
                         /* if the seqno we are analyzing is larger than the
                          * current ackno, then move towards the tail of our
                          * seqnos.
@@ -672,7 +674,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
 
                                         seqp->ccid2s_acked = 1;
                                         ccid2_pr_debug("Got ack for %llu\n",
-                                                       seqp->ccid2s_seq);
+                                                       (unsigned long long)seqp->ccid2s_seq);
                                         ccid2_hc_tx_dec_pipe(sk);
                                 }
                                 if (seqp == hctx->ccid2hctx_seqt) {
@@ -718,7 +720,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                 while (1) {
                         if (!seqp->ccid2s_acked) {
                                 ccid2_pr_debug("Packet lost: %llu\n",
-                                               seqp->ccid2s_seq);
+                                               (unsigned long long)seqp->ccid2s_seq);
                                 /* XXX need to traverse from tail -> head in
                                  * order to detect multiple congestion events in
                                  * one ack vector.
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 67d2dc0e7c67..cec23ad286de 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -379,8 +379,7 @@ static void ccid3_hc_tx_packet_sent(struct sock *sk, int more, int len)
                 packet->dccphtx_seqno  = dp->dccps_gss;
                 /*
                  * Check if win_count have changed
-                 * Algorithm in "8.1. Window Counter Valuer" in
-                 * draft-ietf-dccp-ccid3-11.txt
+                 * Algorithm in "8.1. Window Counter Value" in RFC 4342.
                  */
                 quarter_rtt = timeval_delta(&now, &hctx->ccid3hctx_t_last_win_count);
                 if (likely(hctx->ccid3hctx_rtt > 8))
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index 0a21be437ed3..272e8584564e 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -50,7 +50,7 @@ extern void dccp_time_wait(struct sock *sk, int state, int timeo);
 #define DCCP_TIMEWAIT_LEN (60 * HZ) /* how long to wait to destroy TIME-WAIT
                                      * state, about 60 seconds */
 
-/* draft-ietf-dccp-spec-11.txt initial RTO value */
+/* RFC 1122, 4.2.3.1 initial RTO value */
 #define DCCP_TIMEOUT_INIT ((unsigned)(3 * HZ))
 
 /* Maximal interval between probes for local resources.  */
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 7f9dc6ac58c9..1d24881ac0ab 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -216,11 +216,11 @@ send_sync:
                 dccp_send_sync(sk, DCCP_SKB_CB(skb)->dccpd_seq,
                                DCCP_PKT_SYNCACK);
                 /*
-                 * From the draft:
+                 * From RFC 4340, sec. 5.7
                  *
                  * As with DCCP-Ack packets, DCCP-Sync and DCCP-SyncAck packets
                  * MAY have non-zero-length application data areas, whose
-                 * contents * receivers MUST ignore.
+                 * contents receivers MUST ignore.
                  */
                 goto discard;
         }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index bf692c1c116f..e08e7688a263 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -183,7 +183,7 @@ static inline void dccp_do_pmtu_discovery(struct sock *sk,
                 dccp_sync_mss(sk, mtu);
 
                 /*
-                 * From: draft-ietf-dccp-spec-11.txt
+                 * From RFC 4340, sec. 14.1:
                  *
                  *      DCCP-Sync packets are the best choice for upward
                  *      probing, since DCCP-Sync probes do not risk application
@@ -311,7 +311,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
         }
 
         if (sk->sk_state == DCCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -449,6 +449,8 @@ static inline u64 dccp_v4_init_sequence(const struct sock *sk,
                                            dccp_hdr(skb)->dccph_sport);
 }
 
+static struct request_sock_ops dccp_request_sock_ops;
+
 int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
         struct inet_request_sock *ireq;
@@ -489,7 +491,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(sk->sk_prot->rsk_prot);
+        req = reqsk_alloc(&dccp_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -614,7 +616,7 @@ static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -731,7 +733,7 @@ static void dccp_v4_ctl_send_reset(struct sk_buff *rxskb)
         dccp_hdr_reset(skb)->dccph_reset_code =
                                 DCCP_SKB_CB(rxskb)->dccpd_reset_code;
 
-        /* See "8.3.1. Abnormal Termination" in draft-ietf-dccp-spec-11 */
+        /* See "8.3.1. Abnormal Termination" in RFC 4340 */
         seqno = 0;
         if (DCCP_SKB_CB(rxskb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                 dccp_set_seqno(&seqno, DCCP_SKB_CB(rxskb)->dccpd_ack_seq + 1);
@@ -980,7 +982,7 @@ discard_and_relse:
         goto discard_it;
 
 do_time_wait:
-        inet_twsk_put((struct inet_timewait_sock *)sk);
+        inet_twsk_put(inet_twsk(sk));
         goto no_dccp_socket;
 }
 
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 7a47399cf31f..fc4242c0767c 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -277,7 +277,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         __u64 seq;
 
         sk = inet6_lookup(&dccp_hashinfo, &hdr->daddr, dh->dccph_dport,
-                          &hdr->saddr, dh->dccph_sport, skb->dev->ifindex);
+                          &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
 
         if (sk == NULL) {
                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
@@ -285,7 +285,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (sk->sk_state == DCCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -550,7 +550,7 @@ static void dccp_v6_ctl_send_reset(struct sk_buff *rxskb)
         dccp_hdr_reset(skb)->dccph_reset_code =
                                 DCCP_SKB_CB(rxskb)->dccpd_reset_code;
 
-        /* See "8.3.1. Abnormal Termination" in draft-ietf-dccp-spec-11 */
+        /* See "8.3.1. Abnormal Termination" in RFC 4340 */
         seqno = 0;
         if (DCCP_SKB_CB(rxskb)->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
                 dccp_set_seqno(&seqno, DCCP_SKB_CB(rxskb)->dccpd_ack_seq + 1);
@@ -663,7 +663,7 @@ static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -672,7 +672,6 @@ static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 
 static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
-        struct inet_request_sock *ireq;
         struct dccp_sock dp;
         struct request_sock *req;
         struct dccp_request_sock *dreq;
@@ -701,7 +700,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = inet6_reqsk_alloc(sk->sk_prot->rsk_prot);
+        req = inet6_reqsk_alloc(&dccp6_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -713,7 +712,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         ireq6 = inet6_rsk(req);
-        ireq = inet_rsk(req);
         ipv6_addr_copy(&ireq6->rmt_addr, &skb->nh.ipv6h->saddr);
         ipv6_addr_copy(&ireq6->loc_addr, &skb->nh.ipv6h->daddr);
         req->rcv_wnd    = dccp_feat_default_sequence_window;
@@ -997,6 +995,10 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (sk->sk_state == DCCP_OPEN) { /* Fast path */
                 if (dccp_rcv_established(sk, skb, dccp_hdr(skb), skb->len))
                         goto reset;
+                if (opt_skb) {
+                        /* This is where we would goto ipv6_pktoptions. */
+                        __kfree_skb(opt_skb);
+                }
                 return 0;
         }
 
@@ -1021,6 +1023,10 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
 
         if (dccp_rcv_state_process(sk, skb, dccp_hdr(skb), skb->len))
                 goto reset;
+        if (opt_skb) {
+                /* This is where we would goto ipv6_pktoptions. */
+                __kfree_skb(opt_skb);
+        }
         return 0;
 
 reset:
@@ -1109,7 +1115,7 @@ discard_and_relse:
         goto discard_it;
 
 do_time_wait:
-        inet_twsk_put((struct inet_timewait_sock *)sk);
+        inet_twsk_put(inet_twsk(sk));
         goto no_dccp_socket;
 }
 
diff --git a/net/dccp/options.c b/net/dccp/options.c
index 07a34696ac97..fb0db1f7cd7b 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -215,7 +215,7 @@ int dccp_parse_options(struct sock *sk, struct sk_buff *skb)
                                       elapsed_time);
                         break;
                         /*
-                         * From draft-ietf-dccp-spec-11.txt:
+                         * From RFC 4340, sec. 10.3:
                          *
                          *      Option numbers 128 through 191 are for
                          *      options sent from the HC-Sender to the
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 70e027375682..21f20f21dd32 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -166,7 +166,7 @@ static struct hlist_head *dn_find_list(struct sock *sk)
         if (scp->addr.sdn_flags & SDF_WILD)
                 return hlist_empty(&dn_wild_sk) ? &dn_wild_sk : NULL;
 
-        return &dn_sk_hash[scp->addrloc & DN_SK_HASH_MASK];
+        return &dn_sk_hash[dn_ntohs(scp->addrloc) & DN_SK_HASH_MASK];
 }
 
 /* 
@@ -180,7 +180,7 @@ static int check_port(__le16 port)
         if (port == 0)
                 return -1;
 
-        sk_for_each(sk, node, &dn_sk_hash[port & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, node, &dn_sk_hash[dn_ntohs(port) & DN_SK_HASH_MASK]) {
                 struct dn_scp *scp = DN_SK(sk);
                 if (scp->addrloc == port)
                         return -1;
@@ -194,12 +194,12 @@ static unsigned short port_alloc(struct sock *sk)
 static unsigned short port = 0x2000;
         unsigned short i_port = port;
 
-        while(check_port(++port) != 0) {
+        while(check_port(dn_htons(++port)) != 0) {
                 if (port == i_port)
                         return 0;
         }
 
-        scp->addrloc = port;
+        scp->addrloc = dn_htons(port);
 
         return 1;
 }
@@ -418,7 +418,7 @@ struct sock *dn_find_by_skb(struct sk_buff *skb)
         struct dn_scp *scp;
 
         read_lock(&dn_hash_lock);
-        sk_for_each(sk, node, &dn_sk_hash[cb->dst_port & DN_SK_HASH_MASK]) {
+        sk_for_each(sk, node, &dn_sk_hash[dn_ntohs(cb->dst_port) & DN_SK_HASH_MASK]) {
                 scp = DN_SK(sk);
                 if (cb->src != dn_saddr2dn(&scp->peer))
                         continue;
@@ -1016,13 +1016,14 @@ static void dn_access_copy(struct sk_buff *skb, struct accessdata_dn *acc)
 
 static void dn_user_copy(struct sk_buff *skb, struct optdata_dn *opt)
 {
-        unsigned char *ptr = skb->data;
-        
-        opt->opt_optl   = *ptr++;
-        opt->opt_status = 0;
-        memcpy(opt->opt_data, ptr, opt->opt_optl);
-        skb_pull(skb, dn_ntohs(opt->opt_optl) + 1);
-
+        unsigned char *ptr = skb->data;
+        u16 len = *ptr++; /* yes, it's 8bit on the wire */
+
+        BUG_ON(len > 16); /* we've checked the contents earlier */
+        opt->opt_optl   = dn_htons(len);
+        opt->opt_status = 0;
+        memcpy(opt->opt_data, ptr, len);
+        skb_pull(skb, len + 1);
 }
 
 static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
@@ -1178,8 +1179,10 @@ static int dn_getname(struct socket *sock, struct sockaddr *uaddr,int *uaddr_len
         if (peer) {
                 if ((sock->state != SS_CONNECTED && 
                      sock->state != SS_CONNECTING) && 
-                    scp->accept_mode == ACC_IMMED)
+                    scp->accept_mode == ACC_IMMED) {
+                        release_sock(sk);
                         return -ENOTCONN;
+                }
 
                 memcpy(sa, &scp->peer, sizeof(struct sockaddr_dn));
         } else {
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 72ecc6e62ec4..7683d4f754d2 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -360,9 +360,9 @@ static void dn_nsp_conn_conf(struct sock *sk, struct sk_buff *skb)
                         scp->max_window = decnet_no_fc_max_cwnd;
 
                 if (skb->len > 0) {
-                        unsigned char dlen = *skb->data;
+                        u16 dlen = *skb->data;
                         if ((dlen <= 16) && (dlen <= skb->len)) {
-                                scp->conndata_in.opt_optl = dn_htons((__u16)dlen);
+                                scp->conndata_in.opt_optl = dn_htons(dlen);
                                 memcpy(scp->conndata_in.opt_data, skb->data + 1, dlen);
                         }
                 }
@@ -404,9 +404,9 @@ static void dn_nsp_disc_init(struct sock *sk, struct sk_buff *skb)
         memset(scp->discdata_in.opt_data, 0, 16);
 
         if (skb->len > 0) {
-                unsigned char dlen = *skb->data;
+                u16 dlen = *skb->data;
                 if ((dlen <= 16) && (dlen <= skb->len)) {
-                        scp->discdata_in.opt_optl = dn_htons((__u16)dlen);
+                        scp->discdata_in.opt_optl = dn_htons(dlen);
                         memcpy(scp->discdata_in.opt_data, skb->data + 1, dlen);
                 }
         }
diff --git a/net/decnet/dn_nsp_out.c b/net/decnet/dn_nsp_out.c
index c2e21cd89b3c..b342e4e8f5f8 100644
--- a/net/decnet/dn_nsp_out.c
+++ b/net/decnet/dn_nsp_out.c
@@ -526,7 +526,7 @@ void dn_send_conn_conf(struct sock *sk, gfp_t gfp)
         struct nsp_conn_init_msg *msg;
         __u8 len = (__u8)dn_ntohs(scp->conndata_out.opt_optl);
 
-        if ((skb = dn_alloc_skb(sk, 50 + dn_ntohs(scp->conndata_out.opt_optl), gfp)) == NULL)
+        if ((skb = dn_alloc_skb(sk, 50 + len, gfp)) == NULL)
                 return;
 
         msg = (struct nsp_conn_init_msg *)skb_put(skb, sizeof(*msg));
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index dd0761e3d280..23489f7232d2 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -267,9 +267,14 @@ static void dn_dst_link_failure(struct sk_buff *skb)
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return memcmp(&fl1->nl_u.dn_u, &fl2->nl_u.dn_u, sizeof(fl1->nl_u.dn_u)) == 0 &&
-                fl1->oif == fl2->oif &&
-                fl1->iif == fl2->iif;
+        return ((fl1->nl_u.dn_u.daddr ^ fl2->nl_u.dn_u.daddr) |
+                (fl1->nl_u.dn_u.saddr ^ fl2->nl_u.dn_u.saddr) |
+#ifdef CONFIG_DECNET_ROUTE_FWMARK
+                (fl1->nl_u.dn_u.fwmark ^ fl2->nl_u.dn_u.fwmark) |
+#endif
+                (fl1->nl_u.dn_u.scope ^ fl2->nl_u.dn_u.scope) |
+                (fl1->oif ^ fl2->oif) |
+                (fl1->iif ^ fl2->iif)) == 0;
 }
 
 static int dn_insert_route(struct dn_route *rt, unsigned hash, struct dn_route **rp)
@@ -1270,7 +1275,6 @@ static int dn_route_input_slow(struct sk_buff *skb)
                         goto e_inval;
 
                 res.type = RTN_LOCAL;
-                flags |= RTCF_DIRECTSRC;
         } else {
                 __le16 src_map = fl.fld_src;
                 free_res = 1;
@@ -1341,7 +1345,7 @@ static int dn_route_input_slow(struct sk_buff *skb)
                         goto make_route;
 
                 /* Packet was intra-ethernet, so we know its on-link */
-                if (cb->rt_flags | DN_RT_F_IE) {
+                if (cb->rt_flags & DN_RT_F_IE) {
                         gateway = cb->src;
                         flags |= RTCF_DIRECTSRC;
                         goto make_route;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index 3e0c882c90bf..590e0a72495c 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -124,8 +124,8 @@ static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
-        u16 daddr = fl->fld_dst;
-        u16 saddr = fl->fld_src;
+        __le16 daddr = fl->fld_dst;
+        __le16 saddr = fl->fld_src;
 
         if (((saddr ^ r->src) & r->srcmask) ||
             ((daddr ^ r->dst) & r->dstmask))
diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index f7e84e9d13ad..a64be6cdf078 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -32,6 +32,7 @@ config IEEE80211_CRYPT_WEP
         depends on IEEE80211
         select CRYPTO
         select CRYPTO_ARC4
+        select CRYPTO_ECB
         select CRC32
         ---help---
         Include software based cipher suites in support of IEEE
@@ -58,6 +59,7 @@ config IEEE80211_CRYPT_TKIP
         depends on IEEE80211 && NET_RADIO
         select CRYPTO
         select CRYPTO_MICHAEL_MIC
+        select CRYPTO_ECB
         select CRC32
         ---help---
         Include software based cipher suites in support of IEEE 802.11i
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 770704183a1b..2759312a4204 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -1078,12 +1078,12 @@ static int ieee80211_parse_info_param(struct ieee80211_info_element
 
         while (length >= sizeof(*info_element)) {
                 if (sizeof(*info_element) + info_element->len > length) {
-                        IEEE80211_ERROR("Info elem: parse failed: "
-                                        "info_element->len + 2 > left : "
-                                        "info_element->len+2=%zd left=%d, id=%d.\n",
-                                        info_element->len +
-                                        sizeof(*info_element),
-                                        length, info_element->id);
+                        IEEE80211_DEBUG_MGMT("Info elem: parse failed: "
+                                             "info_element->len + 2 > left : "
+                                             "info_element->len+2=%zd left=%d, id=%d.\n",
+                                             info_element->len +
+                                             sizeof(*info_element),
+                                             length, info_element->id);
                         /* We stop processing but don't return an error here
                          * because some misbehaviour APs break this rule. ie.
                          * Orinoco AP1000. */
diff --git a/net/ieee80211/softmac/ieee80211softmac_assoc.c b/net/ieee80211/softmac/ieee80211softmac_assoc.c
index 589f6d2c548a..cf51c87a971d 100644
--- a/net/ieee80211/softmac/ieee80211softmac_assoc.c
+++ b/net/ieee80211/softmac/ieee80211softmac_assoc.c
@@ -48,7 +48,7 @@ ieee80211softmac_assoc(struct ieee80211softmac_device *mac, struct ieee80211soft
         dprintk(KERN_INFO PFX "sent association request!\n");
 
         spin_lock_irqsave(&mac->lock, flags);
-        mac->associated = 0; /* just to make sure */
+        mac->associnfo.associated = 0; /* just to make sure */
 
         /* Set a timer for timeout */
         /* FIXME: make timeout configurable */
@@ -62,24 +62,22 @@ ieee80211softmac_assoc_timeout(void *d)
 {
         struct ieee80211softmac_device *mac = (struct ieee80211softmac_device *)d;
         struct ieee80211softmac_network *n;
-        unsigned long flags;
 
-        spin_lock_irqsave(&mac->lock, flags);
+        mutex_lock(&mac->associnfo.mutex);
         /* we might race against ieee80211softmac_handle_assoc_response,
          * so make sure only one of us does something */
-        if (!mac->associnfo.associating) {
-                spin_unlock_irqrestore(&mac->lock, flags);
-                return;
-        }
+        if (!mac->associnfo.associating)
+                goto out;
         mac->associnfo.associating = 0;
         mac->associnfo.bssvalid = 0;
-        mac->associated = 0;
+        mac->associnfo.associated = 0;
 
         n = ieee80211softmac_get_network_by_bssid_locked(mac, mac->associnfo.bssid);
-        spin_unlock_irqrestore(&mac->lock, flags);
 
         dprintk(KERN_INFO PFX "assoc request timed out!\n");
         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_TIMEOUT, n);
+out:
+        mutex_unlock(&mac->associnfo.mutex);
 }
 
 void
@@ -93,7 +91,7 @@ ieee80211softmac_disassoc(struct ieee80211softmac_device *mac)
 
         netif_carrier_off(mac->dev);
 
-        mac->associated = 0;
+        mac->associnfo.associated = 0;
         mac->associnfo.bssvalid = 0;
         mac->associnfo.associating = 0;
         ieee80211softmac_init_bss(mac);
@@ -107,7 +105,7 @@ ieee80211softmac_send_disassoc_req(struct ieee80211softmac_device *mac, u16 reas
 {
         struct ieee80211softmac_network *found;
 
-        if (mac->associnfo.bssvalid && mac->associated) {
+        if (mac->associnfo.bssvalid && mac->associnfo.associated) {
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);
                 if (found)
                         ieee80211softmac_send_mgt_frame(mac, found, IEEE80211_STYPE_DISASSOC, reason);
@@ -196,17 +194,18 @@ ieee80211softmac_assoc_work(void *d)
         int bssvalid;
         unsigned long flags;
 
+        mutex_lock(&mac->associnfo.mutex);
+
+        if (!mac->associnfo.associating)
+                goto out;
+
         /* ieee80211_disassoc might clear this */
         bssvalid = mac->associnfo.bssvalid;
 
         /* meh */
-        if (mac->associated)
+        if (mac->associnfo.associated)
                 ieee80211softmac_send_disassoc_req(mac, WLAN_REASON_DISASSOC_STA_HAS_LEFT);
 
-        spin_lock_irqsave(&mac->lock, flags);
-        mac->associnfo.associating = 1;
-        spin_unlock_irqrestore(&mac->lock, flags);
-
         /* try to find the requested network in our list, if we found one already */
         if (bssvalid || mac->associnfo.bssfixed)
                 found = ieee80211softmac_get_network_by_bssid(mac, mac->associnfo.bssid);       
@@ -260,10 +259,8 @@ ieee80211softmac_assoc_work(void *d)
 
         if (!found) {
                 if (mac->associnfo.scan_retry > 0) {
-                        spin_lock_irqsave(&mac->lock, flags);
                         mac->associnfo.scan_retry--;
-                        spin_unlock_irqrestore(&mac->lock, flags);
-                
+
                         /* We know of no such network. Let's scan. 
                          * NB: this also happens if we had no memory to copy the network info...
                          * Maybe we can hope to have more memory after scanning finishes ;)
@@ -272,19 +269,17 @@ ieee80211softmac_assoc_work(void *d)
                         ieee80211softmac_notify(mac->dev, IEEE80211SOFTMAC_EVENT_SCAN_FINISHED, ieee80211softmac_assoc_notify_scan, NULL);
                         if (ieee80211softmac_start_scan(mac))
                                 dprintk(KERN_INFO PFX "Associate: failed to initiate scan. Is device up?\n");
-                        return;
+                        goto out;
                 } else {
-                        spin_lock_irqsave(&mac->lock, flags);
                         mac->associnfo.associating = 0;
-                        mac->associated = 0;
-                        spin_unlock_irqrestore(&mac->lock, flags);
+                        mac->associnfo.associated = 0;
 
                         dprintk(KERN_INFO PFX "Unable to find matching network after scan!\n");
                         /* reset the retry counter for the next user request since we
                          * break out and don't reschedule ourselves after this point. */
                         mac->associnfo.scan_retry = IEEE80211SOFTMAC_ASSOC_SCAN_RETRY_LIMIT;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_NET_NOT_FOUND, NULL);
-                        return;
+                        goto out;
                 }
         }
 
@@ -297,7 +292,7 @@ ieee80211softmac_assoc_work(void *d)
         /* copy the ESSID for displaying it */
         mac->associnfo.associate_essid.len = found->essid.len;
         memcpy(mac->associnfo.associate_essid.data, found->essid.data, IW_ESSID_MAX_SIZE + 1);
-        
+
         /* we found a network! authenticate (if necessary) and associate to it. */
         if (found->authenticating) {
                 dprintk(KERN_INFO PFX "Already requested authentication, waiting...\n");
@@ -305,7 +300,7 @@ ieee80211softmac_assoc_work(void *d)
                         mac->associnfo.assoc_wait = 1;
                         ieee80211softmac_notify_internal(mac, IEEE80211SOFTMAC_EVENT_ANY, found, ieee80211softmac_assoc_notify_auth, NULL, GFP_KERNEL);
                 }
-                return;
+                goto out;
         }
         if (!found->authenticated && !found->authenticating) {
                 /* This relies on the fact that _auth_req only queues the work,
@@ -321,11 +316,14 @@ ieee80211softmac_assoc_work(void *d)
                         mac->associnfo.assoc_wait = 0;
                         ieee80211softmac_call_events(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, found);
                 }
-                return;
+                goto out;
         }
         /* finally! now we can start associating */
         mac->associnfo.assoc_wait = 0;
         ieee80211softmac_assoc(mac, found);
+
+out:
+        mutex_unlock(&mac->associnfo.mutex);
 }
 
 /* call this to do whatever is necessary when we're associated */
@@ -341,7 +339,7 @@ ieee80211softmac_associated(struct ieee80211softmac_device *mac,
         mac->bssinfo.supported_rates = net->supported_rates;
         ieee80211softmac_recalc_txrates(mac);
 
-        mac->associated = 1;
+        mac->associnfo.associated = 1;
 
         mac->associnfo.short_preamble_available =
                 (cap & WLAN_CAPABILITY_SHORT_PREAMBLE) != 0;
@@ -421,7 +419,7 @@ ieee80211softmac_handle_assoc_response(struct net_device * dev,
                         dprintk(KERN_INFO PFX "associating failed (reason: 0x%x)!\n", status);
                         mac->associnfo.associating = 0;
                         mac->associnfo.bssvalid = 0;
-                        mac->associated = 0;
+                        mac->associnfo.associated = 0;
                         ieee80211softmac_call_events_locked(mac, IEEE80211SOFTMAC_EVENT_ASSOCIATE_FAILED, network);
         }
         
diff --git a/net/ieee80211/softmac/ieee80211softmac_io.c b/net/ieee80211/softmac/ieee80211softmac_io.c
index 82bfddbf33a2..b96931001b43 100644
--- a/net/ieee80211/softmac/ieee80211softmac_io.c
+++ b/net/ieee80211/softmac/ieee80211softmac_io.c
@@ -304,7 +304,7 @@ ieee80211softmac_auth(struct ieee80211_auth **pkt,
                 2 +             /* Auth Transaction Seq */
                 2 +             /* Status Code */
                  /* Challenge Text IE */
-                is_shared_response ? 0 : 1 + 1 + net->challenge_len
+                (is_shared_response ? 1 + 1 + net->challenge_len : 0)
         );
         if (unlikely((*pkt) == NULL))
                 return 0;
@@ -475,8 +475,13 @@ int ieee80211softmac_handle_beacon(struct net_device *dev,
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(dev);
 
-        if (mac->associated && memcmp(network->bssid, mac->associnfo.bssid, ETH_ALEN) == 0)
-                ieee80211softmac_process_erp(mac, network->erp_value);
+        /* This might race, but we don't really care and it's not worth
+         * adding heavyweight locking in this fastpath.
+         */
+        if (mac->associnfo.associated) {
+                if (memcmp(network->bssid, mac->associnfo.bssid, ETH_ALEN) == 0)
+                        ieee80211softmac_process_erp(mac, network->erp_value);
+        }
 
         return 0;
 }
diff --git a/net/ieee80211/softmac/ieee80211softmac_module.c b/net/ieee80211/softmac/ieee80211softmac_module.c
index addea1cf73ae..33aff4f4a471 100644
--- a/net/ieee80211/softmac/ieee80211softmac_module.c
+++ b/net/ieee80211/softmac/ieee80211softmac_module.c
@@ -57,6 +57,7 @@ struct net_device *alloc_ieee80211softmac(int sizeof_priv)
         INIT_LIST_HEAD(&softmac->network_list);
         INIT_LIST_HEAD(&softmac->events);
 
+        mutex_init(&softmac->associnfo.mutex);
         INIT_WORK(&softmac->associnfo.work, ieee80211softmac_assoc_work, softmac);
         INIT_WORK(&softmac->associnfo.timeout, ieee80211softmac_assoc_timeout, softmac);
         softmac->start_scan = ieee80211softmac_start_scan_implementation;
diff --git a/net/ieee80211/softmac/ieee80211softmac_wx.c b/net/ieee80211/softmac/ieee80211softmac_wx.c
index 2aa779d18f38..23068a830f7d 100644
--- a/net/ieee80211/softmac/ieee80211softmac_wx.c
+++ b/net/ieee80211/softmac/ieee80211softmac_wx.c
@@ -73,13 +73,14 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
         struct ieee80211softmac_network *n;
         struct ieee80211softmac_auth_queue_item *authptr;
         int length = 0;
-        unsigned long flags;
+
+        mutex_lock(&sm->associnfo.mutex);
 
         /* Check if we're already associating to this or another network
          * If it's another network, cancel and start over with our new network
          * If it's our network, ignore the change, we're already doing it!
          */
-        if((sm->associnfo.associating || sm->associated) &&
+        if((sm->associnfo.associating || sm->associnfo.associated) &&
            (data->essid.flags && data->essid.length)) {
                 /* Get the associating network */
                 n = ieee80211softmac_get_network_by_bssid(sm, sm->associnfo.bssid);
@@ -87,10 +88,9 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                    !memcmp(n->essid.data, extra, n->essid.len)) {
                         dprintk(KERN_INFO PFX "Already associating or associated to "MAC_FMT"\n",
                                 MAC_ARG(sm->associnfo.bssid));
-                        return 0;
+                        goto out;
                 } else {
                         dprintk(KERN_INFO PFX "Canceling existing associate request!\n");
-                        spin_lock_irqsave(&sm->lock,flags);
                         /* Cancel assoc work */
                         cancel_delayed_work(&sm->associnfo.work);
                         /* We don't have to do this, but it's a little cleaner */
@@ -98,14 +98,13 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
                                 cancel_delayed_work(&authptr->work);
                         sm->associnfo.bssvalid = 0;
                         sm->associnfo.bssfixed = 0;
-                        spin_unlock_irqrestore(&sm->lock,flags);
                         flush_scheduled_work();
+                        sm->associnfo.associating = 0;
+                        sm->associnfo.associated = 0;
                 }
         }
 
 
-        spin_lock_irqsave(&sm->lock, flags);
-
         sm->associnfo.static_essid = 0;
         sm->associnfo.assoc_wait = 0;
 
@@ -121,10 +120,12 @@ ieee80211softmac_wx_set_essid(struct net_device *net_dev,
          * If applicable, we have already copied the data in */
         sm->associnfo.req_essid.len = length;
 
+        sm->associnfo.associating = 1;
         /* queue lower level code to do work (if necessary) */
         schedule_work(&sm->associnfo.work);
+out:
+        mutex_unlock(&sm->associnfo.mutex);
 
-        spin_unlock_irqrestore(&sm->lock, flags);
         return 0;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_set_essid);
@@ -136,10 +137,8 @@ ieee80211softmac_wx_get_essid(struct net_device *net_dev,
                               char *extra)
 {
         struct ieee80211softmac_device *sm = ieee80211_priv(net_dev);
-        unsigned long flags;
 
-        /* avoid getting inconsistent information */
-        spin_lock_irqsave(&sm->lock, flags);
+        mutex_lock(&sm->associnfo.mutex);
         /* If all fails, return ANY (empty) */
         data->essid.length = 0;
         data->essid.flags = 0;  /* active */
@@ -152,12 +151,13 @@ ieee80211softmac_wx_get_essid(struct net_device *net_dev,
         }
         
         /* If we're associating/associated, return that */
-        if (sm->associated || sm->associnfo.associating) {
+        if (sm->associnfo.associated || sm->associnfo.associating) {
                 data->essid.length = sm->associnfo.associate_essid.len;
                 data->essid.flags = 1;  /* active */
                 memcpy(extra, sm->associnfo.associate_essid.data, sm->associnfo.associate_essid.len);
         }
-        spin_unlock_irqrestore(&sm->lock, flags);
+        mutex_unlock(&sm->associnfo.mutex);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_essid);
@@ -322,15 +322,15 @@ ieee80211softmac_wx_get_wap(struct net_device *net_dev,
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
         int err = 0;
-        unsigned long flags;
 
-        spin_lock_irqsave(&mac->lock, flags);
+        mutex_lock(&mac->associnfo.mutex);
         if (mac->associnfo.bssvalid)
                 memcpy(data->ap_addr.sa_data, mac->associnfo.bssid, ETH_ALEN);
         else
                 memset(data->ap_addr.sa_data, 0xff, ETH_ALEN);
         data->ap_addr.sa_family = ARPHRD_ETHER;
-        spin_unlock_irqrestore(&mac->lock, flags);
+        mutex_unlock(&mac->associnfo.mutex);
+
         return err;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_wap);
@@ -342,28 +342,27 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
                             char *extra)
 {
         struct ieee80211softmac_device *mac = ieee80211_priv(net_dev);
-        unsigned long flags;
 
         /* sanity check */
         if (data->ap_addr.sa_family != ARPHRD_ETHER) {
                 return -EINVAL;
         }
 
-        spin_lock_irqsave(&mac->lock, flags);
+        mutex_lock(&mac->associnfo.mutex);
         if (is_broadcast_ether_addr(data->ap_addr.sa_data)) {
                 /* the bssid we have is not to be fixed any longer,
                  * and we should reassociate to the best AP. */
                 mac->associnfo.bssfixed = 0;
                 /* force reassociation */
                 mac->associnfo.bssvalid = 0;
-                if (mac->associated)
+                if (mac->associnfo.associated)
                         schedule_work(&mac->associnfo.work);
         } else if (is_zero_ether_addr(data->ap_addr.sa_data)) {
                 /* the bssid we have is no longer fixed */
                 mac->associnfo.bssfixed = 0;
         } else {
                 if (!memcmp(mac->associnfo.bssid, data->ap_addr.sa_data, ETH_ALEN)) {
-                        if (mac->associnfo.associating || mac->associated) {
+                        if (mac->associnfo.associating || mac->associnfo.associated) {
                         /* bssid unchanged and associated or associating - just return */
                                 goto out;
                         }
@@ -378,7 +377,8 @@ ieee80211softmac_wx_set_wap(struct net_device *net_dev,
         }
 
  out:
-        spin_unlock_irqrestore(&mac->lock, flags);
+        mutex_unlock(&mac->associnfo.mutex);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_set_wap);
@@ -394,7 +394,8 @@ ieee80211softmac_wx_set_genie(struct net_device *dev,
         int err = 0;
         char *buf;
         int i;
-        
+
+        mutex_lock(&mac->associnfo.mutex);
         spin_lock_irqsave(&mac->lock, flags);
         /* bleh. shouldn't be locked for that kmalloc... */
 
@@ -432,6 +433,8 @@ ieee80211softmac_wx_set_genie(struct net_device *dev,
 
  out:   
         spin_unlock_irqrestore(&mac->lock, flags);
+        mutex_unlock(&mac->associnfo.mutex);
+
         return err;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_set_genie);
@@ -446,7 +449,8 @@ ieee80211softmac_wx_get_genie(struct net_device *dev,
         unsigned long flags;
         int err = 0;
         int space = wrqu->data.length;
-        
+
+        mutex_lock(&mac->associnfo.mutex);
         spin_lock_irqsave(&mac->lock, flags);
         
         wrqu->data.length = 0;
@@ -459,6 +463,8 @@ ieee80211softmac_wx_get_genie(struct net_device *dev,
                         err = -E2BIG;
         }
         spin_unlock_irqrestore(&mac->lock, flags);
+        mutex_lock(&mac->associnfo.mutex);
+
         return err;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_get_genie);
@@ -473,10 +479,13 @@ ieee80211softmac_wx_set_mlme(struct net_device *dev,
         struct iw_mlme *mlme = (struct iw_mlme *)extra;
         u16 reason = cpu_to_le16(mlme->reason_code);
         struct ieee80211softmac_network *net;
+        int err = -EINVAL;
+
+        mutex_lock(&mac->associnfo.mutex);
 
         if (memcmp(mac->associnfo.bssid, mlme->addr.sa_data, ETH_ALEN)) {
                 printk(KERN_DEBUG PFX "wx_set_mlme: requested operation on net we don't use\n");
-                return -EINVAL;
+                goto out;
         }
 
         switch (mlme->cmd) {
@@ -484,14 +493,22 @@ ieee80211softmac_wx_set_mlme(struct net_device *dev,
                 net = ieee80211softmac_get_network_by_bssid_locked(mac, mlme->addr.sa_data);
                 if (!net) {
                         printk(KERN_DEBUG PFX "wx_set_mlme: we should know the net here...\n");
-                        return -EINVAL;
+                        goto out;
                 }
                 return ieee80211softmac_deauth_req(mac, net, reason);
         case IW_MLME_DISASSOC:
                 ieee80211softmac_send_disassoc_req(mac, reason);
-                return 0;
+                mac->associnfo.associated = 0;
+                mac->associnfo.associating = 0;
+                err = 0;
+                goto out;
         default:
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
         }
+
+out:
+        mutex_unlock(&mac->associnfo.mutex);
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(ieee80211softmac_wx_set_mlme);
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index a8e2e879a647..6460233407c7 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -43,6 +43,7 @@
 #include <net/tcp.h>
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
+#include <asm/atomic.h>
 #include <asm/bug.h>
 
 struct cipso_v4_domhsh_entry {
@@ -79,7 +80,7 @@ struct cipso_v4_map_cache_entry {
         unsigned char *key;
         size_t key_len;
 
-        struct netlbl_lsm_cache lsm_data;
+        struct netlbl_lsm_cache *lsm_data;
 
         u32 activity;
         struct list_head list;
@@ -188,13 +189,14 @@ static void cipso_v4_doi_domhsh_free(struct rcu_head *entry)
  * @entry: the entry to free
  *
  * Description:
- * This function frees the memory associated with a cache entry.
+ * This function frees the memory associated with a cache entry including the
+ * LSM cache data if there are no longer any users, i.e. reference count == 0.
  *
  */
 static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
 {
-        if (entry->lsm_data.free)
-                entry->lsm_data.free(entry->lsm_data.data);
+        if (entry->lsm_data)
+                netlbl_secattr_cache_free(entry->lsm_data);
         kfree(entry->key);
         kfree(entry);
 }
@@ -315,8 +317,8 @@ static int cipso_v4_cache_check(const unsigned char *key,
                     entry->key_len == key_len &&
                     memcmp(entry->key, key, key_len) == 0) {
                         entry->activity += 1;
-                        secattr->cache.free = entry->lsm_data.free;
-                        secattr->cache.data = entry->lsm_data.data;
+                        atomic_inc(&entry->lsm_data->refcount);
+                        secattr->cache = entry->lsm_data;
                         if (prev_entry == NULL) {
                                 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
                                 return 0;
@@ -383,8 +385,8 @@ int cipso_v4_cache_add(const struct sk_buff *skb,
         memcpy(entry->key, cipso_ptr, cipso_ptr_len);
         entry->key_len = cipso_ptr_len;
         entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
-        entry->lsm_data.free = secattr->cache.free;
-        entry->lsm_data.data = secattr->cache.data;
+        atomic_inc(&secattr->cache->refcount);
+        entry->lsm_data = secattr->cache;
 
         bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
         spin_lock_bh(&cipso_v4_cache[bkt].lock);
@@ -771,13 +773,15 @@ static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 {
         int cat = -1;
         u32 bitmap_len_bits = bitmap_len * 8;
-        u32 cipso_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *cipso_array = doi_def->map.std->cat.cipso;
+        u32 cipso_cat_size;
+        u32 *cipso_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
                 return 0;
         case CIPSO_V4_MAP_STD:
+                cipso_cat_size = doi_def->map.std->cat.cipso_size;
+                cipso_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         cat = cipso_v4_bitmap_walk(bitmap,
                                                    bitmap_len_bits,
@@ -823,19 +827,21 @@ static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
         u32 net_spot_max = 0;
         u32 host_clen_bits = host_cat_len * 8;
         u32 net_clen_bits = net_cat_len * 8;
-        u32 host_cat_size = doi_def->map.std->cat.local_size;
-        u32 *host_cat_array = doi_def->map.std->cat.local;
+        u32 host_cat_size;
+        u32 *host_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
-                net_spot_max = host_cat_len - 1;
-                while (net_spot_max > 0 && host_cat[net_spot_max] == 0)
+                net_spot_max = host_cat_len;
+                while (net_spot_max > 0 && host_cat[net_spot_max - 1] == 0)
                         net_spot_max--;
                 if (net_spot_max > net_cat_len)
                         return -EINVAL;
                 memcpy(net_cat, host_cat, net_spot_max);
                 return net_spot_max;
         case CIPSO_V4_MAP_STD:
+                host_cat_size = doi_def->map.std->cat.local_size;
+                host_cat_array = doi_def->map.std->cat.local;
                 for (;;) {
                         host_spot = cipso_v4_bitmap_walk(host_cat,
                                                          host_clen_bits,
@@ -891,8 +897,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
         int net_spot = -1;
         u32 net_clen_bits = net_cat_len * 8;
         u32 host_clen_bits = host_cat_len * 8;
-        u32 net_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *net_cat_array = doi_def->map.std->cat.cipso;
+        u32 net_cat_size;
+        u32 *net_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
@@ -901,6 +907,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
                 memcpy(host_cat, net_cat, net_cat_len);
                 return net_cat_len;
         case CIPSO_V4_MAP_STD:
+                net_cat_size = doi_def->map.std->cat.cipso_size;
+                net_cat_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         net_spot = cipso_v4_bitmap_walk(net_cat,
                                                         net_clen_bits,
@@ -1299,7 +1307,8 @@ int cipso_v4_socket_setattr(const struct socket *sock,
 
         /* We can't use ip_options_get() directly because it makes a call to
          * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
-         * we can't block here. */
+         * we won't always have CAP_NET_RAW even though we _always_ want to
+         * set the IPOPT_CIPSO option. */
         opt_len = (buf_len + 3) & ~3;
         opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
         if (opt == NULL) {
@@ -1309,11 +1318,9 @@ int cipso_v4_socket_setattr(const struct socket *sock,
         memcpy(opt->__data, buf, buf_len);
         opt->optlen = opt_len;
         opt->is_data = 1;
+        opt->cipso = sizeof(struct iphdr);
         kfree(buf);
         buf = NULL;
-        ret_val = ip_options_compile(opt, NULL);
-        if (ret_val != 0)
-                goto socket_setattr_failure;
 
         sk_inet = inet_sk(sk);
         if (sk_inet->is_icsk) {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 9c399a70dd5d..af0190d8b6c0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -482,9 +482,7 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         memset(cfg, 0, sizeof(*cfg));
 
         rtm = nlmsg_data(nlh);
-        cfg->fc_family = rtm->rtm_family;
         cfg->fc_dst_len = rtm->rtm_dst_len;
-        cfg->fc_src_len = rtm->rtm_src_len;
         cfg->fc_tos = rtm->rtm_tos;
         cfg->fc_table = rtm->rtm_table;
         cfg->fc_protocol = rtm->rtm_protocol;
@@ -501,9 +499,6 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
                 case RTA_DST:
                         cfg->fc_dst = nla_get_be32(attr);
                         break;
-                case RTA_SRC:
-                        cfg->fc_src = nla_get_be32(attr);
-                        break;
                 case RTA_OIF:
                         cfg->fc_oif = nla_get_u32(attr);
                         break;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 2b1a54b59c48..f072f3875af8 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -94,10 +94,8 @@ int inet_peer_minttl = 120 * HZ;	/* TTL under high load: 120 sec */
 int inet_peer_maxttl = 10 * 60 * HZ;    /* usual time to live: 10 min */
 
 static struct inet_peer *inet_peer_unused_head;
-/* Exported for inet_putpeer inline function.  */
-struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
-DEFINE_SPINLOCK(inet_peer_unused_lock);
-#define PEER_MAX_CLEANUP_WORK 30
+static struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
+static DEFINE_SPINLOCK(inet_peer_unused_lock);
 
 static void peer_check_expire(unsigned long dummy);
 static DEFINE_TIMER(peer_periodic_timer, peer_check_expire, 0, 0);
@@ -340,7 +338,8 @@ static int cleanup_once(unsigned long ttl)
         spin_lock_bh(&inet_peer_unused_lock);
         p = inet_peer_unused_head;
         if (p != NULL) {
-                if (time_after(p->dtime + ttl, jiffies)) {
+                __u32 delta = (__u32)jiffies - p->dtime;
+                if (delta < ttl) {
                         /* Do not prune fresh entries. */
                         spin_unlock_bh(&inet_peer_unused_lock);
                         return -1;
@@ -432,7 +431,7 @@ out_free:
 /* Called with local BH disabled. */
 static void peer_check_expire(unsigned long dummy)
 {
-        int i;
+        unsigned long now = jiffies;
         int ttl;
 
         if (peer_total >= inet_peer_threshold)
@@ -441,7 +440,10 @@ static void peer_check_expire(unsigned long dummy)
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
                                         peer_total / inet_peer_threshold * HZ;
-        for (i = 0; i < PEER_MAX_CLEANUP_WORK && !cleanup_once(ttl); i++);
+        while (!cleanup_once(ttl)) {
+                if (jiffies != now)
+                        break;
+        }
 
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
@@ -455,3 +457,16 @@ static void peer_check_expire(unsigned long dummy)
                                 peer_total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
+
+void inet_putpeer(struct inet_peer *p)
+{
+        spin_lock_bh(&inet_peer_unused_lock);
+        if (atomic_dec_and_test(&p->refcnt)) {
+                p->unused_prevp = inet_peer_unused_tailp;
+                p->unused_next = NULL;
+                *inet_peer_unused_tailp = p;
+                inet_peer_unused_tailp = &p->unused_next;
+                p->dtime = (__u32)jiffies;
+        }
+        spin_unlock_bh(&inet_peer_unused_lock);
+}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f5fba051df3d..d5b5dec075b8 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -611,8 +611,8 @@ static int ipgre_rcv(struct sk_buff *skb)
                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
                  */
                 if (flags == 0 &&
-                    skb->protocol == __constant_htons(ETH_P_WCCP)) {
-                        skb->protocol = __constant_htons(ETH_P_IP);
+                    skb->protocol == htons(ETH_P_WCCP)) {
+                        skb->protocol = htons(ETH_P_IP);
                         if ((*(h + offset) & 0xF0) != 0x40) 
                                 offset += 4;
                 }
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 8dabbfc31267..9f02917d6f45 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -443,7 +443,7 @@ int ip_options_compile(struct ip_options * opt, struct sk_buff * skb)
                                 opt->router_alert = optptr - iph;
                         break;
                       case IPOPT_CIPSO:
-                        if (opt->cipso) {
+                        if ((!skb && !capable(CAP_NET_RAW)) || opt->cipso) {
                                 pp_ptr = optptr;
                                 goto error;
                         }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f8ce84759159..955a07abb91d 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -420,7 +420,7 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 {
         struct arphdr *rarp;
         unsigned char *rarp_ptr;
-        unsigned long sip, tip;
+        u32 sip, tip;
         unsigned char *sha, *tha;               /* s for "source", t for "target" */
         struct ic_device *d;
 
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index 6d398f10aa91..687c1de1146f 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -200,7 +200,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 from = n_cp->vaddr;
                 port = n_cp->vport;
                 sprintf(buf,"%d,%d,%d,%d,%d,%d", NIPQUAD(from),
-                        ntohs(port)&255, (ntohs(port)>>8)&255);
+                        (ntohs(port)>>8)&255, ntohs(port)&255);
                 buf_len = strlen(buf);
 
                 /*
diff --git a/net/ipv4/ipvs/ip_vs_proto_tcp.c b/net/ipv4/ipvs/ip_vs_proto_tcp.c
index bfe779e74590..6ff05c3a32e6 100644
--- a/net/ipv4/ipvs/ip_vs_proto_tcp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_tcp.c
@@ -117,7 +117,7 @@ tcp_fast_csum_update(struct tcphdr *tcph, __be32 oldip, __be32 newip,
 {
         tcph->check =
                 ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                   newport, tcph->check));
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_proto_udp.c b/net/ipv4/ipvs/ip_vs_proto_udp.c
index 54aa7603591f..691c8b637b29 100644
--- a/net/ipv4/ipvs/ip_vs_proto_udp.c
+++ b/net/ipv4/ipvs/ip_vs_proto_udp.c
@@ -122,10 +122,10 @@ udp_fast_csum_update(struct udphdr *uhdr, __be32 oldip, __be32 newip,
 {
         uhdr->check =
                 ip_vs_check_diff(~oldip, newip,
-                                 ip_vs_check_diff(oldport ^ htonl(0xFFFF),
+                                 ip_vs_check_diff(oldport ^ htons(0xFFFF),
                                                   newport, uhdr->check));
         if (!uhdr->check)
-                uhdr->check = htonl(0xFFFF);
+                uhdr->check = -1;
 }
 
 static int
@@ -173,7 +173,7 @@ udp_snat_handler(struct sk_buff **pskb,
                                                 cp->protocol,
                                                 (*pskb)->csum);
                 if (udph->check == 0)
-                        udph->check = htonl(0xFFFF);
+                        udph->check = -1;
                 IP_VS_DBG(11, "O-pkt: %s O-csum=%d (+%zd)\n",
                           pp->name, udph->check,
                           (char*)&(udph->check) - (char*)udph);
@@ -228,7 +228,7 @@ udp_dnat_handler(struct sk_buff **pskb,
                                                 cp->protocol,
                                                 (*pskb)->csum);
                 if (udph->check == 0)
-                        udph->check = 0xFFFF;
+                        udph->check = -1;
                 (*pskb)->ip_summed = CHECKSUM_UNNECESSARY;
         }
         return 1;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 17e1a687ab45..413c2d0a1f3d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -466,7 +466,13 @@ static inline int check_entry(struct arpt_entry *e, const char *name, unsigned i
                 return -EINVAL;
         }
 
+        if (e->target_offset + sizeof(struct arpt_entry_target) > e->next_offset)
+                return -EINVAL;
+
         t = arpt_get_target(e);
+        if (e->target_offset + t->u.target_size > e->next_offset)
+                return -EINVAL;
+
         target = try_then_request_module(xt_find_target(NF_ARP, t->u.user.name,
                                                         t->u.user.revision),
                                          "arpt_%s", t->u.user.name);
@@ -621,20 +627,18 @@ static int translate_table(const char *name,
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
-                duprintf("Looping hook\n");
-                return -ELOOP;
-        }
-
         /* Finally, each sanity check must pass */
         i = 0;
         ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
                                  check_entry, name, size, &i);
 
-        if (ret != 0) {
-                ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                   cleanup_entry, &i);
-                return ret;
+        if (ret != 0)
+                goto cleanup;
+
+        ret = -ELOOP;
+        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
+                duprintf("Looping hook\n");
+                goto cleanup;
         }
 
         /* And one copy for every other CPU */
@@ -643,6 +647,9 @@ static int translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
+        return 0;
+cleanup:
+        ARPT_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
@@ -1196,6 +1203,8 @@ err1:
 static void __exit arp_tables_fini(void)
 {
         nf_unregister_sockopt(&arpt_sockopts);
+        xt_unregister_target(&arpt_error_target);
+        xt_unregister_target(&arpt_standard_target);
         xt_proto_fini(NF_ARP);
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 53b6dffea6c2..262d0d44ec1b 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -44,13 +44,6 @@ MODULE_LICENSE("GPL");
 
 static char __initdata version[] = "0.90";
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
                             const struct ip_conntrack_tuple *tuple,
@@ -398,7 +391,6 @@ nfattr_failure:
 
 static int ctnetlink_done(struct netlink_callback *cb)
 {
-        DEBUGP("entered %s\n", __FUNCTION__);
         if (cb->args[1])
                 ip_conntrack_put((struct ip_conntrack *)cb->args[1]);
         return 0;
@@ -411,9 +403,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct ip_conntrack_tuple_hash *h;
         struct list_head *i;
 
-        DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-                        cb->args[0], *id);
-
         read_lock_bh(&ip_conntrack_lock);
         last = (struct ip_conntrack *)cb->args[1];
         for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++) {
@@ -452,7 +441,6 @@ out:
         if (last)
                 ip_conntrack_put(last);
 
-        DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
         return skb->len;
 }
 
@@ -466,8 +454,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
 {
         struct nfattr *tb[CTA_IP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_IP_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
@@ -481,8 +467,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
                 return -EINVAL;
         tuple->dst.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
 
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -503,8 +487,6 @@ ctnetlink_parse_tuple_proto(struct nfattr *attr,
         struct ip_conntrack_protocol *proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
@@ -531,8 +513,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         struct nfattr *tb[CTA_TUPLE_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(tuple, 0, sizeof(*tuple));
 
         nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
@@ -557,10 +537,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         else
                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-        DUMP_TUPLE(tuple);
-
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -577,8 +553,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         struct nfattr *tb[CTA_PROTONAT_MAX];
         struct ip_nat_protocol *npt;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
@@ -597,7 +571,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
 
         ip_nat_proto_put(npt);
 
-        DEBUGP("leaving\n");
         return 0;
 }
 
@@ -613,8 +586,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         struct nfattr *tb[CTA_NAT_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(range, 0, sizeof(*range));
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
@@ -640,7 +611,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         if (err < 0)
                 return err;
 
-        DEBUGP("leaving\n");
         return 0;
 }
 #endif
@@ -650,8 +620,6 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 {
         struct nfattr *tb[CTA_HELP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
 
         if (!tb[CTA_HELP_NAME-1])
@@ -679,8 +647,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -698,10 +664,8 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash\n");
+        if (!h)
                 return -ENOENT;
-        }
 
         ct = tuplehash_to_ctrack(h);
         
@@ -716,7 +680,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 ct->timeout.function((unsigned long)ct);
 
         ip_conntrack_put(ct);
-        DEBUGP("leaving\n");
 
         return 0;
 }
@@ -731,8 +694,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2 = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct nfgenmsg *msg = NLMSG_DATA(nlh);
                 u32 rlen;
@@ -770,11 +731,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash");
+        if (!h)
                 return -ENOENT;
-        }
-        DEBUGP("tuple found\n");
+
         ct = tuplehash_to_ctrack(h);
 
         err = -ENOMEM;
@@ -795,7 +754,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 goto out;
 
-        DEBUGP("leaving\n");
         return 0;
 
 free:
@@ -866,8 +824,6 @@ ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
         char *helpname;
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* don't change helper of sibling connections */
         if (ct->master)
                 return -EINVAL;
@@ -938,8 +894,6 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 {
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (cda[CTA_HELP-1]) {
                 err = ctnetlink_change_helper(ct, cda);
                 if (err < 0)
@@ -969,7 +923,6 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
                 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
-        DEBUGP("all done\n");
         return 0;
 }
 
@@ -981,8 +934,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct ip_conntrack *ct;
         int err = -EINVAL;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         ct = ip_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM; 
@@ -1017,7 +968,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (ct->helper)
                 ip_conntrack_helper_put(ct->helper);
 
-        DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
 err:    
@@ -1033,8 +983,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_tuple_hash *h = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -1058,7 +1006,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         if (h == NULL) {
                 write_unlock_bh(&ip_conntrack_lock);
-                DEBUGP("no such conntrack, create new\n");
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
@@ -1074,7 +1021,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
-        DEBUGP("conntrack found\n");
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
@@ -1249,8 +1195,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct list_head *i;
         u_int32_t *id = (u_int32_t *) &cb->args[0];
 
-        DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
         read_lock_bh(&ip_conntrack_lock);
         list_for_each_prev(i, &ip_conntrack_expect_list) {
                 exp = (struct ip_conntrack_expect *) i;
@@ -1266,8 +1210,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 out:    
         read_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving, last id=%llu\n", *id);
-
         return skb->len;
 }
 
@@ -1285,8 +1227,6 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1437,8 +1377,6 @@ ctnetlink_create_expect(struct nfattr *cda[])
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* caller guarantees that those three CTA_EXPECT_* exist */
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
         if (err < 0)
@@ -1490,8 +1428,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_expect *exp;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);   
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1520,8 +1456,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_change_expect(exp, cda);
         write_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving\n");
-        
         return err;
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 7edad790478a..97556cc2e4e0 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -351,9 +351,10 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (v->data_len < sizeof(*user_iph))
                 return 0;
         diff = v->data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, v->data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, v->data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 78a44b01c035..8a455439b128 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -547,12 +547,18 @@ check_entry(struct ipt_entry *e, const char *name, unsigned int size,
                 return -EINVAL;
         }
 
+        if (e->target_offset + sizeof(struct ipt_entry_target) > e->next_offset)
+                return -EINVAL;
+
         j = 0;
         ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip, e->comefrom, &j);
         if (ret != 0)
                 goto cleanup_matches;
 
         t = ipt_get_target(e);
+        ret = -EINVAL;
+        if (e->target_offset + t->u.target_size > e->next_offset)
+                        goto cleanup_matches;
         target = try_then_request_module(xt_find_target(AF_INET,
                                                      t->u.user.name,
                                                      t->u.user.revision),
@@ -712,19 +718,17 @@ translate_table(const char *name,
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
-                return -ELOOP;
-
         /* Finally, each sanity check must pass */
         i = 0;
         ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
                                 check_entry, name, size, &i);
 
-        if (ret != 0) {
-                IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                  cleanup_entry, &i);
-                return ret;
-        }
+        if (ret != 0)
+                goto cleanup;
+
+        ret = -ELOOP;
+        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+                goto cleanup;
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i) {
@@ -732,6 +736,9 @@ translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
+        return 0;
+cleanup:
+        IPT_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
@@ -1463,6 +1470,10 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
                 return -EINVAL;
         }
 
+        if (e->target_offset + sizeof(struct compat_xt_entry_target) >
+                                                                e->next_offset)
+                return -EINVAL;
+
         off = 0;
         entry_offset = (void *)e - (void *)base;
         j = 0;
@@ -1472,6 +1483,9 @@ check_compat_entry_size_and_hooks(struct ipt_entry *e,
                 goto cleanup_matches;
 
         t = ipt_get_target(e);
+        ret = -EINVAL;
+        if (e->target_offset + t->u.target_size > e->next_offset)
+                        goto cleanup_matches;
         target = try_then_request_module(xt_find_target(AF_INET,
                                                      t->u.user.name,
                                                      t->u.user.revision),
@@ -1513,7 +1527,7 @@ cleanup_matches:
 
 static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
         void **dstptr, compat_uint_t *size, const char *name,
-        const struct ipt_ip *ip, unsigned int hookmask, int *i)
+        const struct ipt_ip *ip, unsigned int hookmask)
 {
         struct ipt_entry_match *dm;
         struct ipt_match *match;
@@ -1526,22 +1540,13 @@ static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
         ret = xt_check_match(match, AF_INET, dm->u.match_size - sizeof(*dm),
                              name, hookmask, ip->proto,
                              ip->invflags & IPT_INV_PROTO);
-        if (ret)
-                goto err;
-
-        if (m->u.kernel.match->checkentry
+        if (!ret && m->u.kernel.match->checkentry
             && !m->u.kernel.match->checkentry(name, ip, match, dm->data,
                                               hookmask)) {
                 duprintf("ip_tables: check failed for `%s'.\n",
                          m->u.kernel.match->name);
                 ret = -EINVAL;
-                goto err;
         }
-        (*i)++;
-        return 0;
-
-err:
-        module_put(m->u.kernel.match->me);
         return ret;
 }
 
@@ -1553,19 +1558,18 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
         struct ipt_target *target;
         struct ipt_entry *de;
         unsigned int origsize;
-        int ret, h, j;
+        int ret, h;
 
         ret = 0;
         origsize = *size;
         de = (struct ipt_entry *)*dstptr;
         memcpy(de, e, sizeof(struct ipt_entry));
 
-        j = 0;
         *dstptr += sizeof(struct compat_ipt_entry);
         ret = IPT_MATCH_ITERATE(e, compat_copy_match_from_user, dstptr, size,
-                        name, &de->ip, de->comefrom, &j);
+                        name, &de->ip, de->comefrom);
         if (ret)
-                goto cleanup_matches;
+                goto err;
         de->target_offset = e->target_offset - (origsize - *size);
         t = ipt_get_target(e);
         target = t->u.kernel.target;
@@ -1599,12 +1603,7 @@ static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
                 goto err;
         }
         ret = 0;
-        return ret;
-
 err:
-        module_put(t->u.kernel.target->me);
-cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
         return ret;
 }
 
@@ -1618,7 +1617,7 @@ translate_compat_table(const char *name,
                 unsigned int *hook_entries,
                 unsigned int *underflows)
 {
-        unsigned int i;
+        unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
         unsigned int size;
@@ -1636,21 +1635,21 @@ translate_compat_table(const char *name,
         }
 
         duprintf("translate_compat_table: size %u\n", info->size);
-        i = 0;
+        j = 0;
         xt_compat_lock(AF_INET);
         /* Walk through entries, checking offsets. */
         ret = IPT_ENTRY_ITERATE(entry0, total_size,
                                 check_compat_entry_size_and_hooks,
                                 info, &size, entry0,
                                 entry0 + total_size,
-                                hook_entries, underflows, &i, name);
+                                hook_entries, underflows, &j, name);
         if (ret != 0)
                 goto out_unlock;
 
         ret = -EINVAL;
-        if (i != number) {
+        if (j != number) {
                 duprintf("translate_compat_table: %u not %u entries\n",
-                         i, number);
+                         j, number);
                 goto out_unlock;
         }
 
@@ -1709,8 +1708,10 @@ translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
+        IPT_ENTRY_ITERATE(entry0, total_size, cleanup_entry, &j);
         return ret;
 out_unlock:
+        compat_flush_offsets();
         xt_compat_unlock(AF_INET);
         goto out;
 }
@@ -1932,6 +1933,9 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         switch (cmd) {
         case IPT_SO_GET_INFO:
                 ret = get_info(user, len, 1);
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 12a818a2462f..1aa4517fbcdb 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -28,7 +28,7 @@ static inline int
 set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 {
         struct iphdr *iph = (*pskb)->nh.iph;
-        __be16 oldtos;
+        u_int16_t oldtos;
 
         if ((iph->tos & IPT_ECN_IP_MASK) != (einfo->ip_ect & IPT_ECN_IP_MASK)) {
                 if (!skb_make_writable(pskb, sizeof(struct iphdr)))
@@ -37,8 +37,8 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
                 oldtos = iph->tos;
                 iph->tos &= ~IPT_ECN_IP_MASK;
                 iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
-                iph->check = nf_csum_update(oldtos ^ htons(0xFFFF), iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         } 
         return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_TOS.c b/net/ipv4/netfilter/ipt_TOS.c
index 6b8b14ccc3d3..83b80b3a5d2f 100644
--- a/net/ipv4/netfilter/ipt_TOS.c
+++ b/net/ipv4/netfilter/ipt_TOS.c
@@ -30,7 +30,7 @@ target(struct sk_buff **pskb,
 {
         const struct ipt_tos_target_info *tosinfo = targinfo;
         struct iphdr *iph = (*pskb)->nh.iph;
-        __be16 oldtos;
+        u_int16_t oldtos;
 
         if ((iph->tos & IPTOS_TOS_MASK) != tosinfo->tos) {
                 if (!skb_make_writable(pskb, sizeof(struct iphdr)))
@@ -38,8 +38,8 @@ target(struct sk_buff **pskb,
                 iph = (*pskb)->nh.iph;
                 oldtos = iph->tos;
                 iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;
-                iph->check = nf_csum_update(oldtos ^ htons(0xFFFF), iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         }
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index b430cf2a4f66..5c31dead2bdc 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -329,7 +329,7 @@ error:
         return err; 
 }
 
-static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
+static int raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 {
         struct iovec *iov;
         u8 __user *type = NULL;
@@ -338,7 +338,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
         unsigned int i;
 
         if (!msg->msg_iov)
-                return;
+                return 0;
 
         for (i = 0; i < msg->msg_iovlen; i++) {
                 iov = &msg->msg_iov[i];
@@ -360,8 +360,9 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                 code = iov->iov_base;
 
                         if (type && code) {
-                                get_user(fl->fl_icmp_type, type);
-                                get_user(fl->fl_icmp_code, code);
+                                if (get_user(fl->fl_icmp_type, type) ||
+                                    get_user(fl->fl_icmp_code, code))
+                                        return -EFAULT;
                                 probed = 1;
                         }
                         break;
@@ -372,6 +373,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                 if (probed)
                         break;
         }
+        return 0;
 }
 
 static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
@@ -480,8 +482,11 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .proto = inet->hdrincl ? IPPROTO_RAW :
                                                              sk->sk_protocol,
                                   };
-                if (!inet->hdrincl)
-                        raw_probe_proto_opt(&fl, msg);
+                if (!inet->hdrincl) {
+                        err = raw_probe_proto_opt(&fl, msg);
+                        if (err)
+                                goto done;
+                }
 
                 security_sk_classify_flow(sk, &fl);
                 err = ip_route_output_flow(&rt, &fl, sk, !(msg->msg_flags&MSG_DONTWAIT));
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c41ddba02e9d..925ee4dfc32c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -566,9 +566,15 @@ static inline u32 rt_score(struct rtable *rt)
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return memcmp(&fl1->nl_u.ip4_u, &fl2->nl_u.ip4_u, sizeof(fl1->nl_u.ip4_u)) == 0 &&
-               fl1->oif     == fl2->oif &&
-               fl1->iif     == fl2->iif;
+        return ((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
+                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |
+#ifdef CONFIG_IP_ROUTE_FWMARK
+                (fl1->nl_u.ip4_u.fwmark ^ fl2->nl_u.ip4_u.fwmark) |
+#endif
+                (*(u16 *)&fl1->nl_u.ip4_u.tos ^
+                 *(u16 *)&fl2->nl_u.ip4_u.tos) |
+                (fl1->oif ^ fl2->oif) |
+                (fl1->iif ^ fl2->iif)) == 0;
 }
 
 #ifdef CONFIG_IP_ROUTE_MULTIPATH_CACHED
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e82a5be894b5..15061b314411 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -129,13 +129,6 @@ static int sysctl_tcp_congestion_control(ctl_table *table, int __user *name,
         return ret;
 }
 
-static int __init tcp_congestion_default(void)
-{
-        return tcp_set_default_congestion_control(CONFIG_DEFAULT_TCP_CONG);
-}
-
-late_initcall(tcp_congestion_default);
-
 ctl_table ipv4_table[] = {
         {
                 .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 66e9a729f6df..c05e8edaf544 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2270,7 +2270,7 @@ void __init tcp_init(void)
                                         thash_entries,
                                         (num_physpages >= 128 * 1024) ?
                                         13 : 15,
-                                        HASH_HIGHMEM,
+                                        0,
                                         &tcp_hashinfo.ehash_size,
                                         NULL,
                                         0);
@@ -2286,7 +2286,7 @@ void __init tcp_init(void)
                                         tcp_hashinfo.ehash_size,
                                         (num_physpages >= 128 * 1024) ?
                                         13 : 15,
-                                        HASH_HIGHMEM,
+                                        0,
                                         &tcp_hashinfo.bhash_size,
                                         NULL,
                                         64 * 1024);
@@ -2316,9 +2316,10 @@ void __init tcp_init(void)
                 sysctl_max_syn_backlog = 128;
         }
 
-        sysctl_tcp_mem[0] =  768 << order;
-        sysctl_tcp_mem[1] = 1024 << order;
-        sysctl_tcp_mem[2] = 1536 << order;
+        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
+        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
+        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
 
         limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
         max_share = min(4UL*1024*1024, limit);
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index af0aca1e6be6..1e2982f4acd4 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -131,6 +131,14 @@ int tcp_set_default_congestion_control(const char *name)
         return ret;
 }
 
+/* Set default value from kernel configuration at bootup */
+static int __init tcp_congestion_default(void)
+{
+        return tcp_set_default_congestion_control(CONFIG_DEFAULT_TCP_CONG);
+}
+late_initcall(tcp_congestion_default);
+
+
 /* Get current default congestion control */
 void tcp_get_default_congestion_control(char *name)
 {
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index a60ef38d75c6..6ad184802266 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -190,7 +190,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
          */
 
         /* change the unit from HZ to bictcp_HZ */
-        t = ((tcp_time_stamp + ca->delay_min - ca->epoch_start)
+        t = ((tcp_time_stamp + (ca->delay_min>>3) - ca->epoch_start)
              << BICTCP_HZ) / HZ;
 
         if (t < ca->bic_K)              /* t - K */
@@ -259,7 +259,7 @@ static inline void measure_delay(struct sock *sk)
             (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
                 return;
 
-        delay = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
+        delay = (tcp_time_stamp - tp->rx_opt.rcv_tsecr)<<3;
         if (delay == 0)
                 delay = 1;
 
@@ -366,7 +366,7 @@ static int __init cubictcp_register(void)
 
         beta_scale = 8*(BICTCP_BETA_SCALE+beta)/ 3 / (BICTCP_BETA_SCALE - beta);
 
-        cube_rtt_scale = (bic_scale << 3) / 10; /* 1024*c/rtt */
+        cube_rtt_scale = (bic_scale * 10);      /* 1024*c/rtt */
 
         /* calculate the "K" for (wmax-cwnd) = c/rtt * K^3
          *  so K = cubic_root( (wmax-cwnd)*rtt/c )
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index 682e7d5b6f2f..283be3cb4667 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -23,7 +23,7 @@ module_param(use_bandwidth_switch, int, 0644);
 MODULE_PARM_DESC(use_bandwidth_switch, "turn on/off bandwidth switcher");
 
 struct htcp {
-        u16     alpha;          /* Fixed point arith, << 7 */
+        u32     alpha;          /* Fixed point arith, << 7 */
         u8      beta;           /* Fixed point arith, << 7 */
         u8      modeswitch;     /* Delay modeswitch until we had at least one congestion event */
         u32     last_cong;      /* Time since last congestion event end */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c83938b8fcb1..22ef8bd26620 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -355,7 +355,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 return;
         }
         if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -373,7 +373,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
             !between(seq, tp->snd_una, tp->snd_nxt)) {
-                NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
+                NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
 
@@ -578,7 +578,7 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
         struct tcphdr *th = skb->h.th;
         struct {
                 struct tcphdr th;
-                u32 tsopt[3];
+                u32 tsopt[TCPOLEN_TSTAMP_ALIGNED >> 2];
         } rep;
         struct ip_reply_arg arg;
 
@@ -960,7 +960,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1154,26 +1154,24 @@ discard_and_relse:
 
 do_time_wait:
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                inet_twsk_put((struct inet_timewait_sock *) sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
         if (skb->len < (th->doff << 2) || tcp_checksum_complete(skb)) {
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
-                inet_twsk_put((struct inet_timewait_sock *) sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
-        switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-                                           skb, th)) {
+        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN: {
                 struct sock *sk2 = inet_lookup_listener(&tcp_hashinfo,
                                                         skb->nh.iph->daddr,
                                                         th->dest,
                                                         inet_iif(skb));
                 if (sk2) {
-                        inet_twsk_deschedule((struct inet_timewait_sock *)sk,
-                                             &tcp_death_row);
-                        inet_twsk_put((struct inet_timewait_sock *)sk);
+                        inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row);
+                        inet_twsk_put(inet_twsk(sk));
                         sk = sk2;
                         goto process;
                 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 9a253faefc81..ca406157724c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -273,10 +273,10 @@ static void tcp_build_and_update_options(__be32 *ptr, struct tcp_sock *tp,
                                          __u32 tstamp)
 {
         if (tp->rx_opt.tstamp_ok) {
-                *ptr++ = __constant_htonl((TCPOPT_NOP << 24) |
-                                          (TCPOPT_NOP << 16) |
-                                          (TCPOPT_TIMESTAMP << 8) |
-                                          TCPOLEN_TIMESTAMP);
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_TIMESTAMP << 8) |
+                               TCPOLEN_TIMESTAMP);
                 *ptr++ = htonl(tstamp);
                 *ptr++ = htonl(tp->rx_opt.ts_recent);
         }
@@ -325,18 +325,27 @@ static void tcp_syn_build_options(__be32 *ptr, int mss, int ts, int sack,
         *ptr++ = htonl((TCPOPT_MSS << 24) | (TCPOLEN_MSS << 16) | mss);
         if (ts) {
                 if(sack)
-                        *ptr++ = __constant_htonl((TCPOPT_SACK_PERM << 24) | (TCPOLEN_SACK_PERM << 16) |
-                                                  (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+                        *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
+                                       (TCPOLEN_SACK_PERM << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
                 else
-                        *ptr++ = __constant_htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
-                                                  (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_TIMESTAMP << 8) |
+                                       TCPOLEN_TIMESTAMP);
                 *ptr++ = htonl(tstamp);         /* TSVAL */
                 *ptr++ = htonl(ts_recent);      /* TSECR */
         } else if(sack)
-                *ptr++ = __constant_htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
-                                          (TCPOPT_SACK_PERM << 8) | TCPOLEN_SACK_PERM);
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_SACK_PERM << 8) |
+                               TCPOLEN_SACK_PERM);
         if (offer_wscale)
-                *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_WINDOW << 16) | (TCPOLEN_WINDOW << 8) | (wscale));
+                *ptr++ = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_WINDOW << 16) |
+                               (TCPOLEN_WINDOW << 8) |
+                               (wscale));
 }
 
 /* This routine actually transmits TCP packets queued in by
@@ -1087,10 +1096,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
         u32 send_win, cong_win, limit, in_flight;
 
         if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
-                return 0;
+                goto send_now;
 
         if (icsk->icsk_ca_state != TCP_CA_Open)
-                return 0;
+                goto send_now;
+
+        /* Defer for less than two clock ticks. */
+        if (!tp->tso_deferred && ((jiffies<<1)>>1) - (tp->tso_deferred>>1) > 1)
+                goto send_now;
 
         in_flight = tcp_packets_in_flight(tp);
 
@@ -1106,7 +1119,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         /* If a full-sized TSO skb can be sent, do it. */
         if (limit >= 65536)
-                return 0;
+                goto send_now;
 
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
@@ -1116,7 +1129,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  */
                 chunk /= sysctl_tcp_tso_win_divisor;
                 if (limit >= chunk)
-                        return 0;
+                        goto send_now;
         } else {
                 /* Different approach, try not to defer past a single
                  * ACK.  Receiver should ACK every other full sized
@@ -1124,11 +1137,17 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  * then send now.
                  */
                 if (limit > tcp_max_burst(tp) * tp->mss_cache)
-                        return 0;
+                        goto send_now;
         }
 
         /* Ok, it looks like it is advisable to defer.  */
+        tp->tso_deferred = 1 | (jiffies<<1);
+
         return 1;
+
+send_now:
+        tp->tso_deferred = 0;
+        return 0;
 }
 
 /* Create a new MTU probe if we are ready.
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 7a7a00147e55..1bed0cdf53e3 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -52,7 +52,7 @@ __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
                     xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET, 0)) {
+                    xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
                         dst_clone(dst);
                         break;
                 }
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index a460e8132b4d..6e48f52e197c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -153,6 +153,19 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
         ---help---
           Support for MIPv6 route optimization mode.
 
+config IPV6_SIT
+        tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
+        depends on IPV6
+        default y
+        ---help---
+          Tunneling means encapsulating data of one protocol type within
+          another protocol and sending it over a channel that understands the
+          encapsulating protocol. This driver implements encapsulation of IPv6
+          into IPv4 packets. This is useful if you want to connect two IPv6
+          networks over an IPv4-only path.
+
+          Saying M here will produce a module called sit.ko. If unsure, say Y.
+
 config IPV6_TUNNEL
         tristate "IPv6: IPv6-in-IPv6 tunnel"
         select INET6_TUNNEL
@@ -162,9 +175,16 @@ config IPV6_TUNNEL
 
           If unsure, say N.
 
+config IPV6_MULTIPLE_TABLES
+        bool "IPv6: Multiple Routing Tables"
+        depends on IPV6 && EXPERIMENTAL
+        select FIB_RULES
+        ---help---
+          Support multiple routing tables.
+
 config IPV6_SUBTREES
         bool "IPv6: source address based routing"
-        depends on IPV6 && EXPERIMENTAL
+        depends on IPV6_MULTIPLE_TABLES
         ---help---
           Enable routing by source address or prefix.
 
@@ -176,13 +196,6 @@ config IPV6_SUBTREES
 
           If unsure, say N.
 
-config IPV6_MULTIPLE_TABLES
-        bool "IPv6: Multiple Routing Tables"
-        depends on IPV6 && EXPERIMENTAL
-        select FIB_RULES
-        ---help---
-          Support multiple routing tables.
-
 config IPV6_ROUTE_FWMARK
         bool "IPv6: use netfilter MARK value as routing key"
         depends on IPV6_MULTIPLE_TABLES && NETFILTER
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 87274e47fe32..addcc011bc01 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_IPV6) += ipv6.o
 
-ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o sit.o \
+ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
                 protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
@@ -29,6 +29,7 @@ obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o
 obj-$(CONFIG_INET6_XFRM_MODE_BEET) += xfrm6_mode_beet.o
 obj-$(CONFIG_NETFILTER) += netfilter/
 
+obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
 
 obj-y += exthdrs_core.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e03c33b2465b..b312a5f7a759 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -396,8 +396,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         ndev->regen_timer.data = (unsigned long) ndev;
         if ((dev->flags&IFF_LOOPBACK) ||
             dev->type == ARPHRD_TUNNEL ||
-            dev->type == ARPHRD_NONE ||
-            dev->type == ARPHRD_SIT) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
+            dev->type == ARPHRD_SIT ||
+#endif
+            dev->type == ARPHRD_NONE) {
                 printk(KERN_INFO
                        "%s: Disabled Privacy Extensions\n",
                        dev->name);
@@ -1546,8 +1548,10 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
            This thing is done here expecting that the whole
            class of non-broadcast devices need not cloning.
          */
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
                 cfg.fc_flags |= RTF_NONEXTHOP;
+#endif
 
         ip6_route_add(&cfg);
 }
@@ -1569,6 +1573,7 @@ static void addrconf_add_mroute(struct net_device *dev)
         ip6_route_add(&cfg);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_route_add(struct net_device *dev)
 {
         struct fib6_config cfg = {
@@ -1582,6 +1587,7 @@ static void sit_route_add(struct net_device *dev)
         /* prefix length - 96 bits "::d.d.d.d" */
         ip6_route_add(&cfg);
 }
+#endif
 
 static void addrconf_add_lroute(struct net_device *dev)
 {
@@ -1852,6 +1858,7 @@ int addrconf_set_dstaddr(void __user *arg)
         if (dev == NULL)
                 goto err_exit;
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
                 struct ifreq ifr;
                 mm_segment_t    oldfs;
@@ -1881,6 +1888,7 @@ int addrconf_set_dstaddr(void __user *arg)
                         err = dev_open(dev);
                 }
         }
+#endif
 
 err_exit:
         rtnl_unlock();
@@ -2010,6 +2018,7 @@ int addrconf_del_ifaddr(void __user *arg)
         return err;
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_add_v4_addrs(struct inet6_dev *idev)
 {
         struct inet6_ifaddr * ifp;
@@ -2078,6 +2087,7 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
                 }
         }
 }
+#endif
 
 static void init_loopback(struct net_device *dev)
 {
@@ -2141,6 +2151,7 @@ static void addrconf_dev_config(struct net_device *dev)
                 addrconf_add_linklocal(idev, &addr);
 }
 
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void addrconf_sit_config(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2166,6 +2177,7 @@ static void addrconf_sit_config(struct net_device *dev)
         } else
                 sit_route_add(dev);
 }
+#endif
 
 static inline int
 ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
@@ -2260,9 +2272,11 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 }
 
                 switch(dev->type) {
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
                 case ARPHRD_SIT:
                         addrconf_sit_config(dev);
                         break;
+#endif
                 case ARPHRD_TUNNEL6:
                         addrconf_ip6_tnl_config(dev);
                         break;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e94eccb99707..858cae29581c 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -850,7 +850,6 @@ static int __init inet6_init(void)
         err = addrconf_init();
         if (err)
                 goto addrconf_fail;
-        sit_init();
 
         /* Init v6 extension headers. */
         ipv6_rthdr_init();
@@ -927,7 +926,6 @@ static void __exit inet6_exit(void)
         mip6_fini();
 #endif
         /* Cleanup code parts. */
-        sit_cleanup();
         ip6_flowlabel_cleanup();
         addrconf_cleanup();
         ip6_route_cleanup();
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index d8c1057e8b00..1896ecb52899 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -117,12 +117,15 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
         struct fib6_rule *r = (struct fib6_rule *) rule;
 
-        if (!ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
+        if (r->dst.plen &&
+            !ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
                 return 0;
 
-        if ((flags & RT6_LOOKUP_F_HAS_SADDR) &&
-            !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
-                return 0;
+        if (r->src.plen) {
+                if (!(flags & RT6_LOOKUP_F_HAS_SADDR) ||
+                    !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
+                        return 0;
+        }
 
         if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
                 return 0;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 8fcae7a6510b..f98ca30d7c1f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -169,7 +169,6 @@ static __inline__ void rt6_release(struct rt6_info *rt)
 
 static struct fib6_table fib6_main_tbl = {
         .tb6_id         = RT6_TABLE_MAIN,
-        .tb6_lock       = RW_LOCK_UNLOCKED,
         .tb6_root       = {
                 .leaf           = &ip6_null_entry,
                 .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
@@ -187,6 +186,12 @@ static void fib6_link_table(struct fib6_table *tb)
 {
         unsigned int h;
 
+        /*
+         * Initialize table lock at a single place to give lockdep a key,
+         * tables aren't visible prior to being linked to the list.
+         */
+        rwlock_init(&tb->tb6_lock);
+
         h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
 
         /*
@@ -199,7 +204,6 @@ static void fib6_link_table(struct fib6_table *tb)
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 static struct fib6_table fib6_local_tbl = {
         .tb6_id         = RT6_TABLE_LOCAL,
-        .tb6_lock       = RW_LOCK_UNLOCKED,
         .tb6_root       = {
                 .leaf           = &ip6_null_entry,
                 .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
@@ -213,7 +217,6 @@ static struct fib6_table *fib6_alloc_table(u32 id)
         table = kzalloc(sizeof(*table), GFP_ATOMIC);
         if (table != NULL) {
                 table->tb6_id = id;
-                table->tb6_lock = RW_LOCK_UNLOCKED;
                 table->tb6_root.leaf = &ip6_null_entry;
                 table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
         }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1d672b0547f2..6d4533b58dca 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -330,8 +330,10 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
         fl->share = freq->flr_share;
         addr_type = ipv6_addr_type(&freq->flr_dst);
         if ((addr_type&IPV6_ADDR_MAPPED)
-            || addr_type == IPV6_ADDR_ANY)
+            || addr_type == IPV6_ADDR_ANY) {
+                err = -EINVAL;
                 goto done;
+        }
         ipv6_addr_copy(&fl->dst, &freq->flr_dst);
         atomic_set(&fl->users, 1);
         switch (fl->share) {
@@ -587,6 +589,8 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
         while (!fl) {
                 if (++state->bucket <= FL_HASH_MASK)
                         fl = fl_ht[state->bucket];
+                else
+                        break;
         }
         return fl;
 }
@@ -623,9 +627,13 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
         read_unlock_bh(&ip6_fl_lock);
 }
 
-static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
+static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
-        while(fl) {
+        if (v == SEQ_START_TOKEN)
+                seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
+                           "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
+        else {
+                struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
                            "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
                            (unsigned)ntohl(fl->label),
@@ -636,17 +644,7 @@ static void ip6fl_fl_seq_show(struct seq_file *seq, struct ip6_flowlabel *fl)
                            (long)(fl->expires - jiffies)/HZ,
                            NIP6(fl->dst),
                            fl->opt ? fl->opt->opt_nflen : 0);
-                fl = fl->next;
         }
-}
-
-static int ip6fl_seq_show(struct seq_file *seq, void *v)
-{
-        if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
-                           "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
-        else
-                ip6fl_fl_seq_show(seq, v);
         return 0;
 }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 84d7ebdb9d21..b9f40290d12a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -542,6 +542,7 @@ ip6ip6_rcv(struct sk_buff *skb)
                 skb->dev = t->dev;
                 dst_release(skb->dst);
                 skb->dst = NULL;
+                nf_reset(skb);
                 if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
                         ipv6_copy_dscp(ipv6h, skb->nh.ipv6h);
                 ip6ip6_ecn_decapsulate(ipv6h, skb);
@@ -1149,6 +1150,20 @@ fail:
         return err;
 }
 
+static void __exit ip6ip6_destroy_tunnels(void)
+{
+        int h;
+        struct ip6_tnl *t;
+
+        for (h = 0; h < HASH_SIZE; h++) {
+                while ((t = tnls_r_l[h]) != NULL)
+                        unregister_netdevice(t->dev);
+        }
+
+        t = tnls_wc[0];
+        unregister_netdevice(t->dev);
+}
+
 /**
  * ip6_tunnel_cleanup - free resources and unregister protocol
  **/
@@ -1158,7 +1173,9 @@ static void __exit ip6_tunnel_cleanup(void)
         if (xfrm6_tunnel_deregister(&ip6ip6_handler))
                 printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
 
-        unregister_netdev(ip6ip6_fb_tnl_dev);
+        rtnl_lock();
+        ip6ip6_destroy_tunnels();
+        rtnl_unlock();
 }
 
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 0304b5fe8d6a..73eb8c33e9f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -967,8 +967,6 @@ static void ndisc_recv_na(struct sk_buff *skb)
                     ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
                     pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
                         /* XXX: idev->cnf.prixy_ndp */
-                        WARN_ON(skb->dst != NULL &&
-                                ((struct rt6_info *)skb->dst)->rt6i_idev);
                         goto out;
                 }
 
@@ -1744,6 +1742,7 @@ int __init ndisc_init(struct net_proto_family *ops)
 
 void ndisc_cleanup(void)
 {
+        unregister_netdevice_notifier(&ndisc_netdev_notifier);
 #ifdef CONFIG_SYSCTL
         neigh_sysctl_unregister(&nd_tbl.parms);
 #endif
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 4bc4e5b33794..d7c45a9c15fe 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -40,7 +40,7 @@ config IP6_NF_QUEUE
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP6_NF_IPTABLES
-        tristate "IP6 tables support (required for filtering/masq/NAT)"
+        tristate "IP6 tables support (required for filtering)"
         depends on NETFILTER_XTABLES
         help
           ip6tables is a general, extensible packet identification framework.
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9510c24ca8d2..9fec832ee08b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -349,9 +349,10 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
         if (v->data_len < sizeof(*user_iph))
                 return 0;
         diff = v->data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, v->data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, v->data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (v->data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 4ab368fa0b8f..204e02162d49 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -111,7 +111,7 @@ ip6_packet_match(const struct sk_buff *skb,
                  const char *outdev,
                  const struct ip6t_ip6 *ip6info,
                  unsigned int *protoff,
-                 int *fragoff)
+                 int *fragoff, int *hotdrop)
 {
         size_t i;
         unsigned long ret;
@@ -169,9 +169,11 @@ ip6_packet_match(const struct sk_buff *skb,
                 unsigned short _frag_off;
 
                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
-                if (protohdr < 0)
+                if (protohdr < 0) {
+                        if (_frag_off == 0)
+                                *hotdrop = 1;
                         return 0;
-
+                }
                 *fragoff = _frag_off;
 
                 dprintf("Packet protocol %hi ?= %s%hi.\n",
@@ -290,7 +292,7 @@ ip6t_do_table(struct sk_buff **pskb,
                 IP_NF_ASSERT(e);
                 IP_NF_ASSERT(back);
                 if (ip6_packet_match(*pskb, indev, outdev, &e->ipv6,
-                        &protoff, &offset)) {
+                        &protoff, &offset, &hotdrop)) {
                         struct ip6t_entry_target *t;
 
                         if (IP6T_MATCH_ITERATE(e, do_match,
@@ -584,12 +586,19 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
                 return -EINVAL;
         }
 
+        if (e->target_offset + sizeof(struct ip6t_entry_target) >
+                                                                e->next_offset)
+                return -EINVAL;
+
         j = 0;
         ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6, e->comefrom, &j);
         if (ret != 0)
                 goto cleanup_matches;
 
         t = ip6t_get_target(e);
+        ret = -EINVAL;
+        if (e->target_offset + t->u.target_size > e->next_offset)
+                        goto cleanup_matches;
         target = try_then_request_module(xt_find_target(AF_INET6,
                                                         t->u.user.name,
                                                         t->u.user.revision),
@@ -749,19 +758,17 @@ translate_table(const char *name,
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
-                return -ELOOP;
-
         /* Finally, each sanity check must pass */
         i = 0;
         ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
                                 check_entry, name, size, &i);
 
-        if (ret != 0) {
-                IP6T_ENTRY_ITERATE(entry0, newinfo->size,
-                                  cleanup_entry, &i);
-                return ret;
-        }
+        if (ret != 0)
+                goto cleanup;
+
+        ret = -ELOOP;
+        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+                goto cleanup;
 
         /* And one copy for every other CPU */
         for_each_possible_cpu(i) {
@@ -769,6 +776,9 @@ translate_table(const char *name,
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
 
+        return 0;
+cleanup:
+        IP6T_ENTRY_ITERATE(entry0, newinfo->size, cleanup_entry, &i);
         return ret;
 }
 
@@ -1438,6 +1448,9 @@ static void __exit ip6_tables_fini(void)
  * If target header is found, its offset is set in *offset and return protocol
  * number. Otherwise, return -1.
  *
+ * If the first fragment doesn't contain the final protocol header or
+ * NEXTHDR_NONE it is considered invalid.
+ *
  * Note that non-1st fragment is special case that "the protocol number
  * of last header" is "next header" field in Fragment header. In this case,
  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
@@ -1461,12 +1474,12 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
                         if (target < 0)
                                 break;
-                        return -1;
+                        return -ENOENT;
                 }
 
                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
                 if (hp == NULL)
-                        return -1;
+                        return -EBADMSG;
                 if (nexthdr == NEXTHDR_FRAGMENT) {
                         unsigned short _frag_off, *fp;
                         fp = skb_header_pointer(skb,
@@ -1475,18 +1488,18 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                                                 sizeof(_frag_off),
                                                 &_frag_off);
                         if (fp == NULL)
-                                return -1;
+                                return -EBADMSG;
 
                         _frag_off = ntohs(*fp) & ~0x7;
                         if (_frag_off) {
                                 if (target < 0 &&
                                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
-                                     nexthdr == NEXTHDR_NONE)) {
+                                     hp->nexthdr == NEXTHDR_NONE)) {
                                         if (fragoff)
                                                 *fragoff = _frag_off;
                                         return hp->nexthdr;
                                 }
-                                return -1;
+                                return -ENOENT;
                         }
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index ec1b1608156c..46486645eb75 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -54,9 +54,14 @@ match(const struct sk_buff *skb,
         const struct ip6t_ah *ahinfo = matchinfo;
         unsigned int ptr;
         unsigned int hdrlen = 0;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
         if (ah == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 78d9c8b9e28a..cd22eaaccdca 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -52,9 +52,14 @@ match(const struct sk_buff *skb,
         struct frag_hdr _frag, *fh;
         const struct ip6t_frag *fraginfo = matchinfo;
         unsigned int ptr;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
         if (fh == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index d32a205e3af2..3f25babe0440 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -65,9 +65,14 @@ match(const struct sk_buff *skb,
         u8 _opttype, *tp = NULL;
         u8 _optlen, *lp = NULL;
         unsigned int optlen;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, match->data, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
         if (oh == NULL) {
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index bcb2e168a5bc..54d7d14134fd 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -58,9 +58,14 @@ match(const struct sk_buff *skb,
         unsigned int hdrlen = 0;
         unsigned int ret = 0;
         struct in6_addr *ap, _addr;
+        int err;
 
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL) < 0)
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
+        if (err < 0) {
+                if (err != -ENOENT)
+                        *hotdrop = 1;
                 return 0;
+        }
 
         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
         if (rh == NULL) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d09329ca3267..d6dedc4aec77 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -604,7 +604,7 @@ error:
         return err; 
 }
 
-static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
+static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
 {
         struct iovec *iov;
         u8 __user *type = NULL;
@@ -616,7 +616,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
         int i;
 
         if (!msg->msg_iov)
-                return;
+                return 0;
 
         for (i = 0; i < msg->msg_iovlen; i++) {
                 iov = &msg->msg_iov[i];
@@ -638,8 +638,9 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                 code = iov->iov_base;
 
                         if (type && code) {
-                                get_user(fl->fl_icmp_type, type);
-                                get_user(fl->fl_icmp_code, code);
+                                if (get_user(fl->fl_icmp_type, type) ||
+                                    get_user(fl->fl_icmp_code, code))
+                                        return -EFAULT;
                                 probed = 1;
                         }
                         break;
@@ -650,7 +651,8 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                         /* check if type field is readable or not. */
                         if (iov->iov_len > 2 - len) {
                                 u8 __user *p = iov->iov_base;
-                                get_user(fl->fl_mh_type, &p[2 - len]);
+                                if (get_user(fl->fl_mh_type, &p[2 - len]))
+                                        return -EFAULT;
                                 probed = 1;
                         } else
                                 len += iov->iov_len;
@@ -664,6 +666,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                 if (probed)
                         break;
         }
+        return 0;
 }
 
 static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
@@ -787,7 +790,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         opt = ipv6_fixup_options(&opt_space, opt);
 
         fl.proto = proto;
-        rawv6_probe_proto_opt(&fl, msg);
+        err = rawv6_probe_proto_opt(&fl, msg);
+        if (err)
+                goto out;
  
         ipv6_addr_copy(&fl.fl6_dst, daddr);
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6b4b4f48d18..b39ae99122d5 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -141,6 +141,10 @@ struct rt6_info ip6_null_entry = {
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
+static int ip6_pkt_prohibit(struct sk_buff *skb);
+static int ip6_pkt_prohibit_out(struct sk_buff *skb);
+static int ip6_pkt_blk_hole(struct sk_buff *skb);
+
 struct rt6_info ip6_prohibit_entry = {
         .u = {
                 .dst = {
@@ -150,8 +154,8 @@ struct rt6_info ip6_prohibit_entry = {
                         .obsolete       = -1,
                         .error          = -EACCES,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_prohibit,
+                        .output         = ip6_pkt_prohibit_out,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_prohibit_entry,
                 }
@@ -170,8 +174,8 @@ struct rt6_info ip6_blk_hole_entry = {
                         .obsolete       = -1,
                         .error          = -EINVAL,
                         .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
-                        .input          = ip6_pkt_discard,
-                        .output         = ip6_pkt_discard_out,
+                        .input          = ip6_pkt_blk_hole,
+                        .output         = ip6_pkt_blk_hole,
                         .ops            = &ip6_dst_ops,
                         .path           = (struct dst_entry*)&ip6_blk_hole_entry,
                 }
@@ -326,6 +330,8 @@ static int inline rt6_check_neigh(struct rt6_info *rt)
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID)
                         m = 2;
+                else if (!(neigh->nud_state & NUD_FAILED))
+                        m = 1;
                 read_unlock_bh(&neigh->lock);
         }
         return m;
@@ -343,9 +349,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
         n = rt6_check_neigh(rt);
-        if (n > 1)
-                m |= 16;
-        else if (!n && strict & RT6_LOOKUP_F_REACHABLE)
+        if (!n && (strict & RT6_LOOKUP_F_REACHABLE))
                 return -1;
         return m;
 }
@@ -376,10 +380,11 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
                         continue;
 
                 if (m > mpri) {
-                        rt6_probe(match);
+                        if (strict & RT6_LOOKUP_F_REACHABLE)
+                                rt6_probe(match);
                         match = rt;
                         mpri = m;
-                } else {
+                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
                         rt6_probe(rt);
                 }
         }
@@ -484,7 +489,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 do { \
         if (rt == &ip6_null_entry) { \
                 struct fib6_node *pn; \
-                while (fn) { \
+                while (1) { \
                         if (fn->fn_flags & RTN_TL_ROOT) \
                                 goto out; \
                         pn = fn->parent; \
@@ -529,13 +534,17 @@ struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
                 .nl_u = {
                         .ip6_u = {
                                 .daddr = *daddr,
-                                /* TODO: saddr */
                         },
                 },
         };
         struct dst_entry *dst;
         int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
 
+        if (saddr) {
+                memcpy(&fl.fl6_src, saddr, sizeof(*saddr));
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+        }
+
         dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_lookup);
         if (dst->error == 0)
                 return (struct rt6_info *) dst;
@@ -614,8 +623,6 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
                 ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
-                if (rt->rt6i_flags & RTF_REJECT)
-                        rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.flags |= DST_HOST;
                 rt->rt6i_nexthop = neigh_clone(ort->rt6i_nexthop);
         }
@@ -630,7 +637,7 @@ static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -697,6 +704,7 @@ out2:
 void ip6_route_input(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = skb->nh.ipv6h;
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct flowi fl = {
                 .iif = skb->dev->ifindex,
                 .nl_u = {
@@ -711,7 +719,9 @@ void ip6_route_input(struct sk_buff *skb)
                 },
                 .proto = iph->nexthdr,
         };
-        int flags = rt6_need_strict(&iph->daddr) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(&iph->daddr))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         skb->dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_input);
 }
@@ -724,7 +734,7 @@ static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = RT6_LOOKUP_F_REACHABLE;
+        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -794,6 +804,9 @@ struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
         if (rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
+        if (!ipv6_addr_any(&fl->fl6_src))
+                flags |= RT6_LOOKUP_F_HAS_SADDR;
+
         return fib6_rule_lookup(fl, flags, ip6_pol_route_output);
 }
 
@@ -1345,6 +1358,7 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                            struct in6_addr *gateway,
                                            struct net_device *dev)
 {
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
         struct ip6rd_flowi rdfl = {
                 .fl = {
                         .oif = dev->ifindex,
@@ -1357,7 +1371,9 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                 },
                 .gateway = *gateway,
         };
-        int flags = rt6_need_strict(dest) ? RT6_LOOKUP_F_IFACE : 0;
+
+        if (rt6_need_strict(dest))
+                flags |= RT6_LOOKUP_F_IFACE;
 
         return (struct rt6_info *)fib6_rule_lookup((struct flowi *)&rdfl, flags, __ip6_route_redirect);
 }
@@ -1527,6 +1543,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
                 rt->u.dst.output = ort->u.dst.output;
 
                 memcpy(rt->u.dst.metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                rt->u.dst.error = ort->u.dst.error;
                 rt->u.dst.dev = ort->u.dst.dev;
                 if (rt->u.dst.dev)
                         dev_hold(rt->u.dst.dev);
@@ -1730,24 +1747,50 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *      Drop the packet on the floor
  */
 
-static int ip6_pkt_discard(struct sk_buff *skb)
+static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 {
         int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
         if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
                 IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
 
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
 }
 
+static int ip6_pkt_discard(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE);
+}
+
 static int ip6_pkt_discard_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
         return ip6_pkt_discard(skb);
 }
 
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+
+static int ip6_pkt_prohibit(struct sk_buff *skb)
+{
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED);
+}
+
+static int ip6_pkt_prohibit_out(struct sk_buff *skb)
+{
+        skb->dev = skb->dst->dev;
+        return ip6_pkt_prohibit(skb);
+}
+
+static int ip6_pkt_blk_hole(struct sk_buff *skb)
+{
+        kfree_skb(skb);
+        return 0;
+}
+
+#endif
+
 /*
  *      Allocate a dst for local (unicast / anycast) address.
  */
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 836eecd7e62b..be699f85b2c7 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -850,3 +850,8 @@ int __init sit_init(void)
         inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
         goto out;
 }
+
+module_init(sit_init);
+module_exit(sit_cleanup);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("sit0");
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3b6575478fcc..4c2a7c0cafef 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -329,7 +329,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         if (sk->sk_state == TCP_TIME_WAIT) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 return;
         }
 
@@ -653,7 +653,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         int tot_len = sizeof(struct tcphdr);
 
         if (ts)
-                tot_len += 3*4;
+                tot_len += TCPOLEN_TSTAMP_ALIGNED;
 
         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
@@ -749,7 +749,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                         bh_lock_sock(nsk);
                         return nsk;
                 }
-                inet_twsk_put((struct inet_timewait_sock *)nsk);
+                inet_twsk_put(inet_twsk(nsk));
                 return NULL;
         }
 
@@ -1283,18 +1283,17 @@ discard_and_relse:
 
 do_time_wait:
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
-                inet_twsk_put((struct inet_timewait_sock *)sk);
+                inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
 
-        switch (tcp_timewait_state_process((struct inet_timewait_sock *)sk,
-                                           skb, th)) {
+        switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN:
         {
                 struct sock *sk2;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e0c3934a7e4b..c83f23e51c46 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -242,14 +242,13 @@ static void udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
-        struct net_device *dev = skb->dev;
         struct in6_addr *saddr = &hdr->saddr;
         struct in6_addr *daddr = &hdr->daddr;
         struct udphdr *uh = (struct udphdr*)(skb->data+offset);
         struct sock *sk;
         int err;
 
-        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, dev->ifindex);
+        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, inet6_iif(skb));
    
         if (sk == NULL)
                 return;
@@ -348,7 +347,7 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
 
         read_lock(&udp_hash_lock);
         sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
-        dif = skb->dev->ifindex;
+        dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
                 kfree_skb(skb);
@@ -429,7 +428,7 @@ static int udpv6_rcv(struct sk_buff **pskb)
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, dev->ifindex);
+        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, inet6_iif(skb));
 
         if (sk == NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6a252e2134d1..d400f8fae129 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -25,12 +25,14 @@
 static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
-static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
+static int xfrm6_dst_lookup(struct xfrm_dst **xdst, struct flowi *fl)
 {
-        int err = 0;
-        *dst = (struct xfrm_dst*)ip6_route_output(NULL, fl);
-        if (!*dst)
-                err = -ENETUNREACH;
+        struct dst_entry *dst = ip6_route_output(NULL, fl);
+        int err = dst->error;
+        if (!err)
+                *xdst = (struct xfrm_dst *) dst;
+        else
+                dst_release(dst);
         return err;
 }
 
@@ -73,7 +75,7 @@ __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                                  xdst->u.rt6.rt6i_src.plen);
                 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
                     ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET6,
+                    xfrm_bundle_ok(policy, xdst, fl, AF_INET6,
                                    (xdst->u.rt6.rt6i_dst.plen != 128 ||
                                     xdst->u.rt6.rt6i_src.plen != 128))) {
                         dst_clone(dst);
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 7af227bb1551..7931e4f898d4 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -135,7 +135,7 @@ u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         x6spi = __xfrm6_tunnel_spi_lookup(saddr);
         spi = x6spi ? x6spi->spi : 0;
         read_unlock_bh(&xfrm6_tunnel_spi_lock);
-        return spi;
+        return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_spi_lookup);
@@ -210,7 +210,7 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
                 spi = __xfrm6_tunnel_alloc_spi(saddr);
         write_unlock_bh(&xfrm6_tunnel_spi_lock);
 
-        return spi;
+        return htonl(spi);
 }
 
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index bef3f61569f7..76c661566dfd 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -83,13 +83,13 @@ DEFINE_SPINLOCK(ipx_interfaces_lock);
 struct ipx_interface *ipx_primary_net;
 struct ipx_interface *ipx_internal_net;
 
-extern int ipxrtr_add_route(__u32 network, struct ipx_interface *intrfc,
+extern int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
                             unsigned char *node);
 extern void ipxrtr_del_routes(struct ipx_interface *intrfc);
 extern int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
                                struct iovec *iov, int len, int noblock);
 extern int ipxrtr_route_skb(struct sk_buff *skb);
-extern struct ipx_route *ipxrtr_lookup(__u32 net);
+extern struct ipx_route *ipxrtr_lookup(__be32 net);
 extern int ipxrtr_ioctl(unsigned int cmd, void __user *arg);
 
 #undef IPX_REFCNT_DEBUG
@@ -177,7 +177,7 @@ static void ipxitf_clear_primary_net(void)
 }
 
 static struct ipx_interface *__ipxitf_find_using_phys(struct net_device *dev,
-                                                      unsigned short datalink)
+                                                      __be16 datalink)
 {
         struct ipx_interface *i;
 
@@ -190,7 +190,7 @@ out:
 }
 
 static struct ipx_interface *ipxitf_find_using_phys(struct net_device *dev,
-                                                    unsigned short datalink)
+                                                    __be16 datalink)
 {
         struct ipx_interface *i;
 
@@ -202,7 +202,7 @@ static struct ipx_interface *ipxitf_find_using_phys(struct net_device *dev,
         return i;
 }
 
-struct ipx_interface *ipxitf_find_using_net(__u32 net)
+struct ipx_interface *ipxitf_find_using_net(__be32 net)
 {
         struct ipx_interface *i;
 
@@ -237,7 +237,7 @@ static void ipxitf_insert_socket(struct ipx_interface *intrfc, struct sock *sk)
 
 /* caller must hold intrfc->if_sklist_lock */
 static struct sock *__ipxitf_find_socket(struct ipx_interface *intrfc,
-                                         unsigned short port)
+                                         __be16 port)
 {
         struct sock *s;
         struct hlist_node *node;
@@ -252,7 +252,7 @@ found:
 
 /* caller must hold a reference to intrfc */
 static struct sock *ipxitf_find_socket(struct ipx_interface *intrfc,
-                                        unsigned short port)
+                                        __be16 port)
 {
         struct sock *s;
 
@@ -268,7 +268,7 @@ static struct sock *ipxitf_find_socket(struct ipx_interface *intrfc,
 #ifdef CONFIG_IPX_INTERN
 static struct sock *ipxitf_find_internal_socket(struct ipx_interface *intrfc,
                                                 unsigned char *ipx_node,
-                                                unsigned short port)
+                                                __be16 port)
 {
         struct sock *s;
         struct hlist_node *node;
@@ -600,10 +600,10 @@ int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb, char *node)
 
         /* see if we need to include the netnum in the route list */
         if (IPX_SKB_CB(skb)->last_hop.index >= 0) {
-                u32 *last_hop = (u32 *)(((u8 *) skb->data) +
+                __be32 *last_hop = (__be32 *)(((u8 *) skb->data) +
                                 sizeof(struct ipxhdr) +
                                 IPX_SKB_CB(skb)->last_hop.index *
-                                sizeof(u32));
+                                sizeof(__be32));
                 *last_hop = IPX_SKB_CB(skb)->last_hop.netnum;
                 IPX_SKB_CB(skb)->last_hop.index = -1;
         }
@@ -772,7 +772,7 @@ static void ipxitf_discover_netnum(struct ipx_interface *intrfc,
                 } else {
                         printk(KERN_WARNING "IPX: Network number collision "
                                 "%lx\n        %s %s and %s %s\n",
-                                (unsigned long) htonl(cb->ipx_source_net),
+                                (unsigned long) ntohl(cb->ipx_source_net),
                                 ipx_device_name(i),
                                 ipx_frame_name(i->if_dlink_type),
                                 ipx_device_name(intrfc),
@@ -812,7 +812,7 @@ static int ipxitf_pprop(struct ipx_interface *intrfc, struct sk_buff *skb)
         int i, rc = -EINVAL;
         struct ipx_interface *ifcs;
         char *c;
-        u32 *l;
+        __be32 *l;
 
         /* Illegal packet - too many hops or too short */
         /* We decide to throw it away: no broadcasting, no local processing.
@@ -833,7 +833,7 @@ static int ipxitf_pprop(struct ipx_interface *intrfc, struct sk_buff *skb)
                 goto out;
         
         c = ((u8 *) ipx) + sizeof(struct ipxhdr);
-        l = (u32 *) c;
+        l = (__be32 *) c;
 
         /* Don't broadcast packet if already seen this net */
         for (i = 0; i < IPX_SKB_CB(skb)->ipx_tctrl; i++)
@@ -855,7 +855,7 @@ static int ipxitf_pprop(struct ipx_interface *intrfc, struct sk_buff *skb)
                 /* That aren't in the list */
                 if (ifcs == intrfc)
                         continue;
-                l = (__u32 *) c;
+                l = (__be32 *) c;
                 /* don't consider the last entry in the packet list,
                  * it is our netnum, and it is not there yet */
                 for (i = 0; i < IPX_SKB_CB(skb)->ipx_tctrl; i++)
@@ -885,8 +885,8 @@ static void ipxitf_insert(struct ipx_interface *intrfc)
                 ipx_primary_net = intrfc;
 }
 
-static struct ipx_interface *ipxitf_alloc(struct net_device *dev, __u32 netnum,
-                                          unsigned short dlink_type,
+static struct ipx_interface *ipxitf_alloc(struct net_device *dev, __be32 netnum,
+                                          __be16 dlink_type,
                                           struct datalink_proto *dlink,
                                           unsigned char internal,
                                           int ipx_offset)
@@ -960,7 +960,7 @@ static __be16 ipx_map_frame_type(unsigned char type)
 static int ipxitf_create(struct ipx_interface_definition *idef)
 {
         struct net_device *dev;
-        unsigned short dlink_type = 0;
+        __be16 dlink_type = 0;
         struct datalink_proto *datalink = NULL;
         struct ipx_interface *intrfc;
         int rc;
@@ -1073,7 +1073,7 @@ out:
 static int ipxitf_delete(struct ipx_interface_definition *idef)
 {
         struct net_device *dev = NULL;
-        unsigned short dlink_type = 0;
+        __be16 dlink_type = 0;
         struct ipx_interface *intrfc;
         int rc = 0;
 
@@ -1110,7 +1110,7 @@ out:
 }
 
 static struct ipx_interface *ipxitf_auto_create(struct net_device *dev,
-                                                unsigned short dlink_type)
+                                                __be16 dlink_type)
 {
         struct ipx_interface *intrfc = NULL;
         struct datalink_proto *datalink;
@@ -1122,7 +1122,7 @@ static struct ipx_interface *ipxitf_auto_create(struct net_device *dev,
         if (dev->addr_len > IPX_NODE_LEN)
                 goto out;
 
-        switch (htons(dlink_type)) {
+        switch (ntohs(dlink_type)) {
         case ETH_P_IPX:         datalink = pEII_datalink;       break;
         case ETH_P_802_2:       datalink = p8022_datalink;      break;
         case ETH_P_SNAP:        datalink = pSNAP_datalink;      break;
@@ -1234,27 +1234,27 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg)
 /* Note: We assume ipx_tctrl==0 and htons(length)==ipx_pktsize */
 /* This functions should *not* mess with packet contents */
 
-__u16 ipx_cksum(struct ipxhdr *packet, int length) 
+__be16 ipx_cksum(struct ipxhdr *packet, int length)
 {
         /* 
          *      NOTE: sum is a net byte order quantity, which optimizes the 
          *      loop. This only works on big and little endian machines. (I
          *      don't know of a machine that isn't.)
          */
-        /* start at ipx_dest - We skip the checksum field and start with
-         * ipx_type before the loop, not considering ipx_tctrl in the calc */
-        __u16 *p = (__u16 *)&packet->ipx_dest;
-        __u32 i = (length >> 1) - 1; /* Number of complete words */
-        __u32 sum = packet->ipx_type << sizeof(packet->ipx_tctrl); 
-
-        /* Loop through all complete words except the checksum field,
-         * ipx_type (accounted above) and ipx_tctrl (not used in the cksum) */
-        while (--i)
+        /* handle the first 3 words separately; checksum should be skipped
+         * and ipx_tctrl masked out */
+        __u16 *p = (__u16 *)packet;
+        __u32 sum = p[1] + (p[2] & (__force u16)htons(0x00ff));
+        __u32 i = (length >> 1) - 3; /* Number of remaining complete words */
+
+        /* Loop through them */
+        p += 3;
+        while (i--)
                 sum += *p++;
 
         /* Add on the last part word if it exists */
         if (packet->ipx_pktsize & htons(1))
-                sum += ntohs(0xff00) & *p;
+                sum += (__force u16)htons(0xff00) & *p;
 
         /* Do final fixup */
         sum = (sum & 0xffff) + (sum >> 16);
@@ -1263,10 +1263,17 @@ __u16 ipx_cksum(struct ipxhdr *packet, int length)
         if (sum >= 0x10000)
                 sum++;
 
-        return ~sum;
+        /*
+         * Leave 0 alone; we don't want 0xffff here.  Note that we can't get
+         * here with 0x10000, so this check is the same as ((__u16)sum)
+         */
+        if (sum)
+                sum = ~sum;
+
+        return (__force __be16)sum;
 }
 
-const char *ipx_frame_name(unsigned short frame)
+const char *ipx_frame_name(__be16 frame)
 {
         char* rc = "None";
 
@@ -1401,7 +1408,7 @@ out:
 
 /* caller must hold a reference to intrfc */
 
-static unsigned short ipx_first_free_socketnum(struct ipx_interface *intrfc)
+static __be16 ipx_first_free_socketnum(struct ipx_interface *intrfc)
 {
         unsigned short socketNum = intrfc->if_sknum;
 
@@ -1410,7 +1417,7 @@ static unsigned short ipx_first_free_socketnum(struct ipx_interface *intrfc)
         if (socketNum < IPX_MIN_EPHEMERAL_SOCKET)
                 socketNum = IPX_MIN_EPHEMERAL_SOCKET;
 
-        while (__ipxitf_find_socket(intrfc, ntohs(socketNum)))
+        while (__ipxitf_find_socket(intrfc, htons(socketNum)))
                 if (socketNum > IPX_MAX_EPHEMERAL_SOCKET)
                         socketNum = IPX_MIN_EPHEMERAL_SOCKET;
                 else
@@ -1419,7 +1426,7 @@ static unsigned short ipx_first_free_socketnum(struct ipx_interface *intrfc)
         spin_unlock_bh(&intrfc->if_sklist_lock);
         intrfc->if_sknum = socketNum;
 
-        return ntohs(socketNum);
+        return htons(socketNum);
 }
 
 static int ipx_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
@@ -1473,7 +1480,7 @@ static int ipx_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                                 ipxs->port)) {
                         SOCK_DEBUG(sk,
                                 "IPX: bind failed because port %X in use.\n",
-                                ntohs((int)addr->sipx_port));
+                                ntohs(addr->sipx_port));
                         goto out_put;
                 }
         } else {
@@ -1488,7 +1495,7 @@ static int ipx_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 if (ipxitf_find_socket(intrfc, addr->sipx_port)) {
                         SOCK_DEBUG(sk,
                                 "IPX: bind failed because port %X in use.\n",
-                                ntohs((int)addr->sipx_port));
+                                ntohs(addr->sipx_port));
                         goto out_put;
                 }
         }
@@ -1665,7 +1672,7 @@ static int ipx_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty
         intrfc = ipxitf_find_using_phys(dev, pt->type);
         if (!intrfc) {
                 if (ipxcfg_auto_create_interfaces &&
-                   ntohl(IPX_SKB_CB(skb)->ipx_dest_net)) {
+                   IPX_SKB_CB(skb)->ipx_dest_net) {
                         intrfc = ipxitf_auto_create(dev, pt->type);
                         if (intrfc)
                                 ipxitf_hold(intrfc);
diff --git a/net/ipx/ipx_proc.c b/net/ipx/ipx_proc.c
index 4c0c71206e54..b7463dfca63e 100644
--- a/net/ipx/ipx_proc.c
+++ b/net/ipx/ipx_proc.c
@@ -260,22 +260,22 @@ static int ipx_seq_socket_show(struct seq_file *seq, void *v)
         ipxs = ipx_sk(s);
 #ifdef CONFIG_IPX_INTERN
         seq_printf(seq, "%08lX:%02X%02X%02X%02X%02X%02X:%04X  ",
-                   (unsigned long)htonl(ipxs->intrfc->if_netnum),
+                   (unsigned long)ntohl(ipxs->intrfc->if_netnum),
                    ipxs->node[0], ipxs->node[1], ipxs->node[2], ipxs->node[3],
-                   ipxs->node[4], ipxs->node[5], htons(ipxs->port));
+                   ipxs->node[4], ipxs->node[5], ntohs(ipxs->port));
 #else
-        seq_printf(seq, "%08lX:%04X  ", (unsigned long) htonl(ipxs->intrfc->if_netnum),
-                   htons(ipxs->port));
+        seq_printf(seq, "%08lX:%04X  ", (unsigned long) ntohl(ipxs->intrfc->if_netnum),
+                   ntohs(ipxs->port));
 #endif  /* CONFIG_IPX_INTERN */
         if (s->sk_state != TCP_ESTABLISHED)
                 seq_printf(seq, "%-28s", "Not_Connected");
         else {
                 seq_printf(seq, "%08lX:%02X%02X%02X%02X%02X%02X:%04X  ",
-                           (unsigned long)htonl(ipxs->dest_addr.net),
+                           (unsigned long)ntohl(ipxs->dest_addr.net),
                            ipxs->dest_addr.node[0], ipxs->dest_addr.node[1],
                            ipxs->dest_addr.node[2], ipxs->dest_addr.node[3],
                            ipxs->dest_addr.node[4], ipxs->dest_addr.node[5],
-                           htons(ipxs->dest_addr.sock));
+                           ntohs(ipxs->dest_addr.sock));
         }
 
         seq_printf(seq, "%08X  %08X  %02X     %03d\n",
diff --git a/net/ipx/ipx_route.c b/net/ipx/ipx_route.c
index a30dbb1e08fb..68560ee0d797 100644
--- a/net/ipx/ipx_route.c
+++ b/net/ipx/ipx_route.c
@@ -19,17 +19,17 @@ DEFINE_RWLOCK(ipx_routes_lock);
 
 extern struct ipx_interface *ipx_internal_net;
 
-extern __u16 ipx_cksum(struct ipxhdr *packet, int length);
-extern struct ipx_interface *ipxitf_find_using_net(__u32 net);
+extern __be16 ipx_cksum(struct ipxhdr *packet, int length);
+extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                                struct sk_buff *skb, int copy);
 extern int ipxitf_demux_socket(struct ipx_interface *intrfc,
                                struct sk_buff *skb, int copy);
 extern int ipxitf_send(struct ipx_interface *intrfc, struct sk_buff *skb,
                        char *node);
-extern struct ipx_interface *ipxitf_find_using_net(__u32 net);
+extern struct ipx_interface *ipxitf_find_using_net(__be32 net);
 
-struct ipx_route *ipxrtr_lookup(__u32 net)
+struct ipx_route *ipxrtr_lookup(__be32 net)
 {
         struct ipx_route *r;
 
@@ -48,7 +48,7 @@ unlock:
 /*
  * Caller must hold a reference to intrfc
  */
-int ipxrtr_add_route(__u32 network, struct ipx_interface *intrfc,
+int ipxrtr_add_route(__be32 network, struct ipx_interface *intrfc,
                      unsigned char *node)
 {
         struct ipx_route *rt;
@@ -118,7 +118,7 @@ out:
         return rc;
 }
 
-static int ipxrtr_delete(__u32 net)
+static int ipxrtr_delete(__be32 net)
 {
         struct ipx_route *r, *tmp;
         int rc;
@@ -238,7 +238,7 @@ int ipxrtr_route_packet(struct sock *sk, struct sockaddr_ipx *usipx,
 
         /* Apply checksum. Not allowed on 802.3 links. */
         if (sk->sk_no_check || intrfc->if_dlink_type == htons(IPX_FRAME_8023))
-                ipx->ipx_checksum = 0xFFFF;
+                ipx->ipx_checksum = htons(0xFFFF);
         else
                 ipx->ipx_checksum = ipx_cksum(ipx, len + sizeof(struct ipxhdr));
 
diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 5073261b9d0c..fede83763095 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -1678,7 +1678,8 @@ static int irlmp_slsap_inuse(__u8 slsap_sel)
          *  every IrLAP connection and check every LSAP associated with each
          *  the connection.
          */
-        spin_lock_irqsave(&irlmp->links->hb_spinlock, flags);
+        spin_lock_irqsave_nested(&irlmp->links->hb_spinlock, flags,
+                        SINGLE_DEPTH_NESTING);
         lap = (struct lap_cb *) hashbin_get_first(irlmp->links);
         while (lap != NULL) {
                 IRDA_ASSERT(lap->magic == LMP_LAP_MAGIC, goto errlap;);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index ff98e70b0931..20ff7cca1d07 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2928,11 +2928,6 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 if (*dir)
                         goto out;
         }
-        else {
-                *dir = security_xfrm_sock_policy_alloc(xp, sk);
-                if (*dir)
-                        goto out;
-        }
 
         *dir = pol->sadb_x_policy_dir-1;
         return xp;
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index ce94732b8e23..f619c6527266 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -209,7 +209,9 @@ config NETFILTER_XT_TARGET_SECMARK
 
 config NETFILTER_XT_TARGET_CONNSECMARK
         tristate '"CONNSECMARK" target support'
-        depends on NETFILTER_XTABLES && (NF_CONNTRACK_SECMARK || IP_NF_CONNTRACK_SECMARK)
+        depends on NETFILTER_XTABLES && \
+                   ((NF_CONNTRACK && NF_CONNTRACK_SECMARK) || \
+                    (IP_NF_CONNTRACK && IP_NF_CONNTRACK_SECMARK))
         help
           The CONNSECMARK target copies security markings from packets
           to connections, and restores security markings from connections
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 093b3ddc513c..836541e509fe 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1520,9 +1520,10 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
                 if (iter(ct, data))
                         goto found;
         }
+        write_unlock_bh(&nf_conntrack_lock);
         return NULL;
 found:
-        atomic_inc(&nf_ct_tuplehash_to_ctrack(h)->ct_general.use);
+        atomic_inc(&ct->ct_general.use);
         write_unlock_bh(&nf_conntrack_lock);
         return ct;
 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 1721f7c78c77..bd0156a28ecd 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -47,13 +47,6 @@ MODULE_LICENSE("GPL");
 
 static char __initdata version[] = "0.93";
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
                             const struct nf_conntrack_tuple *tuple,
@@ -410,7 +403,6 @@ static int ctnetlink_done(struct netlink_callback *cb)
 {
         if (cb->args[1])
                 nf_ct_put((struct nf_conn *)cb->args[1]);
-        DEBUGP("entered %s\n", __FUNCTION__);
         return 0;
 }
 
@@ -425,9 +417,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-                        cb->args[0], *id);
-
         read_lock_bh(&nf_conntrack_lock);
         last = (struct nf_conn *)cb->args[1];
         for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
@@ -471,7 +460,6 @@ out:
         if (last)
                 nf_ct_put(last);
 
-        DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
         return skb->len;
 }
 
@@ -482,8 +470,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
         struct nf_conntrack_l3proto *l3proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_IP_MAX, attr);
 
         l3proto = nf_ct_l3proto_find_get(tuple->src.l3num);
@@ -493,8 +479,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct nf_conntrack_tuple *tuple)
 
         nf_ct_l3proto_put(l3proto);
 
-        DEBUGP("leaving\n");
-
         return ret;
 }
 
@@ -510,8 +494,6 @@ ctnetlink_parse_tuple_proto(struct nfattr *attr,
         struct nf_conntrack_protocol *proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
@@ -538,8 +520,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
         struct nfattr *tb[CTA_TUPLE_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(tuple, 0, sizeof(*tuple));
 
         nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
@@ -566,10 +546,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct nf_conntrack_tuple *tuple,
         else
                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-        NF_CT_DUMP_TUPLE(tuple);
-
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -586,8 +562,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         struct nfattr *tb[CTA_PROTONAT_MAX];
         struct ip_nat_protocol *npt;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
@@ -606,7 +580,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
 
         ip_nat_proto_put(npt);
 
-        DEBUGP("leaving\n");
         return 0;
 }
 
@@ -622,8 +595,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         struct nfattr *tb[CTA_NAT_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(range, 0, sizeof(*range));
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
@@ -649,7 +620,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         if (err < 0)
                 return err;
 
-        DEBUGP("leaving\n");
         return 0;
 }
 #endif
@@ -659,8 +629,6 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 {
         struct nfattr *tb[CTA_HELP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
 
         if (!tb[CTA_HELP_NAME-1])
@@ -690,8 +658,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -709,10 +675,8 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = nf_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash\n");
+        if (!h)
                 return -ENOENT;
-        }
 
         ct = nf_ct_tuplehash_to_ctrack(h);
         
@@ -727,7 +691,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 ct->timeout.function((unsigned long)ct);
 
         nf_ct_put(ct);
-        DEBUGP("leaving\n");
 
         return 0;
 }
@@ -744,8 +707,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 u32 rlen;
 
@@ -779,11 +740,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = nf_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash");
+        if (!h)
                 return -ENOENT;
-        }
-        DEBUGP("tuple found\n");
+
         ct = nf_ct_tuplehash_to_ctrack(h);
 
         err = -ENOMEM;
@@ -804,7 +763,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 goto out;
 
-        DEBUGP("leaving\n");
         return 0;
 
 free:
@@ -876,8 +834,6 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
         char *helpname;
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (!help) {
                 /* FIXME: we need to reallocate and rehash */
                 return -EBUSY;
@@ -954,8 +910,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
 {
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (cda[CTA_HELP-1]) {
                 err = ctnetlink_change_helper(ct, cda);
                 if (err < 0)
@@ -985,7 +939,6 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
                 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
-        DEBUGP("all done\n");
         return 0;
 }
 
@@ -997,8 +950,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct nf_conn *ct;
         int err = -EINVAL;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         ct = nf_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM; 
@@ -1028,7 +979,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         add_timer(&ct->timeout);
         nf_conntrack_hash_insert(ct);
 
-        DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
 err:    
@@ -1046,8 +996,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -1071,7 +1019,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         if (h == NULL) {
                 write_unlock_bh(&nf_conntrack_lock);
-                DEBUGP("no such conntrack, create new\n");
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
@@ -1087,7 +1034,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
-        DEBUGP("conntrack found\n");
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_conntrack(nf_ct_tuplehash_to_ctrack(h), cda);
@@ -1268,8 +1214,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
         read_lock_bh(&nf_conntrack_lock);
         list_for_each_prev(i, &nf_conntrack_expect_list) {
                 exp = (struct nf_conntrack_expect *) i;
@@ -1287,8 +1231,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 out:    
         read_unlock_bh(&nf_conntrack_lock);
 
-        DEBUGP("leaving, last id=%llu\n", *id);
-
         return skb->len;
 }
 
@@ -1308,8 +1250,6 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1460,8 +1400,6 @@ ctnetlink_create_expect(struct nfattr *cda[], u_int8_t u3)
         struct nf_conn_help *help;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* caller guarantees that those three CTA_EXPECT_* exist */
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE, u3);
         if (err < 0)
@@ -1516,8 +1454,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         u_int8_t u3 = nfmsg->nfgen_family;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);   
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1546,8 +1482,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_change_expect(exp, cda);
         write_unlock_bh(&nf_conntrack_lock);
 
-        DEBUGP("leaving\n");
-        
         return err;
 }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index b59d3b2bde21..1e5207b80fe5 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -427,7 +427,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         nfmsg->version = NFNETLINK_V0;
         nfmsg->res_id = htons(inst->group_num);
 
-        pmsg.hw_protocol        = htons(skb->protocol);
+        pmsg.hw_protocol        = skb->protocol;
         pmsg.hook               = hooknum;
 
         NFA_PUT(inst->skb, NFULA_PACKET_HDR, sizeof(pmsg), &pmsg);
@@ -544,7 +544,7 @@ __build_packet_message(struct nfulnl_instance *inst,
         }
         /* global sequence number */
         if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL) {
-                tmp_uint = atomic_inc_return(&global_seq);
+                tmp_uint = htonl(atomic_inc_return(&global_seq));
                 NFA_PUT(inst->skb, NFULA_SEQ_GLOBAL, sizeof(tmp_uint), &tmp_uint);
         }
 
@@ -878,7 +878,7 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
                 params = NFA_DATA(nfula[NFULA_CFG_MODE-1]);
 
                 nfulnl_set_mode(inst, params->copy_mode,
-                                ntohs(params->copy_range));
+                                ntohl(params->copy_range));
         }
 
         if (nfula[NFULA_CFG_TIMEOUT-1]) {
@@ -896,8 +896,8 @@ nfulnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
         }
 
         if (nfula[NFULA_CFG_QTHRESH-1]) {
-                u_int32_t qthresh = 
-                        *(u_int16_t *)NFA_DATA(nfula[NFULA_CFG_QTHRESH-1]);
+                __be32 qthresh =
+                        *(__be32 *)NFA_DATA(nfula[NFULA_CFG_QTHRESH-1]);
 
                 nfulnl_set_qthresh(inst, ntohl(qthresh));
         }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 8eb2473d83e1..e815a9aa6e95 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -414,7 +414,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
         nfmsg->res_id = htons(queue->queue_num);
 
         pmsg.packet_id          = htonl(entry->id);
-        pmsg.hw_protocol        = htons(entskb->protocol);
+        pmsg.hw_protocol        = entskb->protocol;
         pmsg.hook               = entinf->hook;
 
         NFA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);
@@ -622,9 +622,10 @@ nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
         int diff;
 
         diff = data_len - e->skb->len;
-        if (diff < 0)
-                skb_trim(e->skb, data_len);
-        else if (diff > 0) {
+        if (diff < 0) {
+                if (pskb_trim(e->skb, data_len))
+                        return -ENOMEM;
+        } else if (diff > 0) {
                 if (data_len > 0xFFFF)
                         return -EINVAL;
                 if (diff > skb_tailroom(e->skb)) {
diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index db9b896e57c8..39e117502bd7 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -68,7 +68,7 @@ static int __init xt_nfqueue_init(void)
 
 static void __exit xt_nfqueue_fini(void)
 {
-        xt_register_targets(xt_nfqueue_target, ARRAY_SIZE(xt_nfqueue_target));
+        xt_unregister_targets(xt_nfqueue_target, ARRAY_SIZE(xt_nfqueue_target));
 }
 
 module_init(xt_nfqueue_init);
diff --git a/net/netfilter/xt_connmark.c b/net/netfilter/xt_connmark.c
index 92a5726ef237..a8f03057dbde 100644
--- a/net/netfilter/xt_connmark.c
+++ b/net/netfilter/xt_connmark.c
@@ -147,7 +147,7 @@ static int __init xt_connmark_init(void)
 
 static void __exit xt_connmark_fini(void)
 {
-        xt_register_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
+        xt_unregister_matches(xt_connmark_match, ARRAY_SIZE(xt_connmark_match));
 }
 
 module_init(xt_connmark_init);
diff --git a/net/netlabel/Kconfig b/net/netlabel/Kconfig
index 9f7121ae13e9..56958c85f2b4 100644
--- a/net/netlabel/Kconfig
+++ b/net/netlabel/Kconfig
@@ -4,7 +4,7 @@
 
 config NETLABEL
         bool "NetLabel subsystem support"
-        depends on NET && SECURITY
+        depends on SECURITY
         default n
         ---help---
           NetLabel provides support for explicit network packet labeling
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 54fb7de3c2b1..ff971103fd0c 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -200,7 +200,7 @@ void netlbl_cache_invalidate(void)
 int netlbl_cache_add(const struct sk_buff *skb,
                      const struct netlbl_lsm_secattr *secattr)
 {
-        if (secattr->cache.data == NULL)
+        if (secattr->cache == NULL)
                 return -ENOMSG;
 
         if (CIPSO_V4_OPTEXIST(skb))
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index d56e0d21f919..d527c8977b1f 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1075,8 +1075,9 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
                         return -EINVAL;
                 len = sizeof(int);
                 val = nlk->flags & NETLINK_RECV_PKTINFO ? 1 : 0;
-                put_user(len, optlen);
-                put_user(val, optval);
+                if (put_user(len, optlen) ||
+                    put_user(val, optval))
+                        return -EFAULT;
                 err = 0;
                 break;
         default:
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index bb3ddd4784b1..4b52fa78935a 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -786,11 +786,10 @@ static long htb_do_events(struct htb_sched *q, int level)
         for (i = 0; i < 500; i++) {
                 struct htb_class *cl;
                 long diff;
-                struct rb_node *p = q->wait_pq[level].rb_node;
+                struct rb_node *p = rb_first(&q->wait_pq[level]);
+
                 if (!p)
                         return 0;
-                while (p->rb_left)
-                        p = p->rb_left;
 
                 cl = rb_entry(p, struct htb_class, pq_node);
                 if (time_after(cl->pq_key, q->jiffies)) {
@@ -1285,8 +1284,7 @@ static void htb_destroy_class(struct Qdisc *sch, struct htb_class *cl)
                                                   struct htb_class, sibling));
 
         /* note: this delete may happen twice (see htb_delete) */
-        if (!hlist_unhashed(&cl->hlist))
-                hlist_del(&cl->hlist);
+        hlist_del_init(&cl->hlist);
         list_del(&cl->sibling);
 
         if (cl->prio_activity)
@@ -1334,8 +1332,7 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
         sch_tree_lock(sch);
 
         /* delete from hash and active; remainder in destroy_class */
-        if (!hlist_unhashed(&cl->hlist))
-                hlist_del(&cl->hlist);
+        hlist_del_init(&cl->hlist);
 
         if (cl->prio_activity)
                 htb_deactivate(q, cl);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 45939bafbdf8..0441876aa1e7 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -4,7 +4,7 @@
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
  *              as published by the Free Software Foundation; either version
- *              2 of the License, or (at your option) any later version.
+ *              2 of the License.
  *
  *              Many of the algorithms and ideas for this came from
  *              NIST Net which is not copyrighted. 
@@ -170,6 +170,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return NET_XMIT_BYPASS;
         }
 
+        skb_orphan(skb);
+
         /*
          * If we need to duplicate packet, then re-insert at top of the
          * qdisc tree, since parent queuer expects that only one
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 27329ce9c311..ed0445fe85e7 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -346,11 +346,18 @@ void sctp_association_free(struct sctp_association *asoc)
         struct list_head *pos, *temp;
         int i;
 
-        list_del(&asoc->asocs);
+        /* Only real associations count against the endpoint, so
+         * don't bother for if this is a temporary association.
+         */
+        if (!asoc->temp) {
+                list_del(&asoc->asocs);
 
-        /* Decrement the backlog value for a TCP-style listening socket. */
-        if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
-                sk->sk_ack_backlog--;
+                /* Decrement the backlog value for a TCP-style listening
+                 * socket.
+                 */
+                if (sctp_style(sk, TCP) && sctp_sstate(sk, LISTENING))
+                        sk->sk_ack_backlog--;
+        }
 
         /* Mark as dead, so other users can know this structure is
          * going away.
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 35c49ff2d062..9b6b394b66f6 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -144,6 +144,13 @@ void sctp_endpoint_add_asoc(struct sctp_endpoint *ep,
 {
         struct sock *sk = ep->base.sk;
 
+        /* If this is a temporary association, don't bother
+         * since we'll be removing it shortly and don't
+         * want anyone to find it anyway.
+         */
+        if (asoc->temp)
+                return;
+
         /* Now just add it to our list of asocs */
         list_add_tail(&asoc->asocs, &ep->asocs);
 
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 64f630102532..6d82f400d13c 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -135,6 +135,9 @@ int sctp_rcv(struct sk_buff *skb)
 
         SCTP_INC_STATS_BH(SCTP_MIB_INSCTPPACKS);
 
+        if (skb_linearize(skb))
+                goto discard_it;
+
         sh = (struct sctphdr *) skb->h.raw;
 
         /* Pull up the IP and SCTP headers. */
@@ -768,6 +771,9 @@ static void __sctp_hash_established(struct sctp_association *asoc)
 /* Add an association to the hash. Local BH-safe. */
 void sctp_hash_established(struct sctp_association *asoc)
 {
+        if (asoc->temp)
+                return;
+
         sctp_local_bh_disable();
         __sctp_hash_established(asoc);
         sctp_local_bh_enable();
@@ -801,6 +807,9 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
 /* Remove association from the hash table.  Local BH-safe. */
 void sctp_unhash_established(struct sctp_association *asoc)
 {
+        if (asoc->temp)
+                return;
+
         sctp_local_bh_disable();
         __sctp_unhash_established(asoc);
         sctp_local_bh_enable();
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 249e5033c1a8..78071c6e6cf1 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -215,17 +215,17 @@ static struct dst_entry *sctp_v6_get_dst(struct sctp_association *asoc,
         }
 
         dst = ip6_route_output(NULL, &fl);
-        if (dst) {
+        if (!dst->error) {
                 struct rt6_info *rt;
                 rt = (struct rt6_info *)dst;
                 SCTP_DEBUG_PRINTK(
                         "rt6_dst:" NIP6_FMT " rt6_src:" NIP6_FMT "\n",
                         NIP6(rt->rt6i_dst.addr), NIP6(rt->rt6i_src.addr));
-        } else {
-                SCTP_DEBUG_PRINTK("NO ROUTE\n");
+                return dst;
         }
-
-        return dst;
+        SCTP_DEBUG_PRINTK("NO ROUTE\n");
+        dst_release(dst);
+        return NULL;
 }
 
 /* Returns the number of consecutive initial bits that match in the 2 ipv6
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index a356d8d310a9..7f49e769080e 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -344,7 +344,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
                            assoc, sk, sctp_sk(sk)->type, sk->sk_state,
                            assoc->state, hash, assoc->assoc_id,
                            assoc->sndbuf_used,
-                           (sk->sk_rcvbuf - assoc->rwnd),
+                           atomic_read(&assoc->rmem_alloc),
                            sock_i_uid(sk), sock_i_ino(sk),
                            epb->bind_addr.port,
                            assoc->peer.port);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index fac7674438a4..5b4f82fd98f8 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -591,7 +591,7 @@ static struct sock *sctp_v4_create_accept_sk(struct sock *sk,
         newinet->dport = htons(asoc->peer.port);
         newinet->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
         newinet->pmtudisc = inet->pmtudisc;
-        newinet->id = 0;
+        newinet->id = asoc->next_tsn ^ jiffies;
 
         newinet->uc_ttl = -1;
         newinet->mc_loop = 1;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 3fe906d65069..935bc9187fd8 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -821,7 +821,7 @@ out:
  * addrs is a pointer to an array of one or more socket addresses. Each
  * address is contained in its appropriate structure (i.e. struct
  * sockaddr_in or struct sockaddr_in6) the family of the address type
- * must be used to distengish the address length (note that this
+ * must be used to distinguish the address length (note that this
  * representation is termed a "packed array" of addresses). The caller
  * specifies the number of addresses in the array with addrcnt.
  *
@@ -3372,6 +3372,7 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
 {
         struct sock *sk = asoc->base.sk;
         struct socket *sock;
+        struct inet_sock *inetsk;
         int err = 0;
 
         /* An association cannot be branched off from an already peeled-off
@@ -3389,6 +3390,14 @@ SCTP_STATIC int sctp_do_peeloff(struct sctp_association *asoc,
          * asoc to the newsk.
          */
         sctp_sock_migrate(sk, sock->sk, asoc, SCTP_SOCKET_UDP_HIGH_BANDWIDTH);
+
+        /* Make peeled-off sockets more like 1-1 accepted sockets.
+         * Set the daddr and initialize id to something more random
+         */
+        inetsk = inet_sk(sock->sk);
+        inetsk->daddr = asoc->peer.primary_addr.v4.sin_addr.s_addr;
+        inetsk->id = asoc->next_tsn ^ jiffies;
+
         *sockp = sock;
 
         return err;
@@ -5362,6 +5371,20 @@ static void sctp_wfree(struct sk_buff *skb)
         sctp_association_put(asoc);
 }
 
+/* Do accounting for the receive space on the socket.
+ * Accounting for the association is done in ulpevent.c
+ * We set this as a destructor for the cloned data skbs so that
+ * accounting is done at the correct time.
+ */
+void sctp_sock_rfree(struct sk_buff *skb)
+{
+        struct sock *sk = skb->sk;
+        struct sctp_ulpevent *event = sctp_skb2event(skb);
+
+        atomic_sub(event->rmem_len, &sk->sk_rmem_alloc);
+}
+
+
 /* Helper function to wait for space in the sndbuf.  */
 static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
                                 size_t msg_len)
@@ -5634,10 +5657,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
         sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
                 event = sctp_skb2event(skb);
                 if (event->asoc == assoc) {
-                        sock_rfree(skb);
+                        sctp_sock_rfree(skb);
                         __skb_unlink(skb, &oldsk->sk_receive_queue);
                         __skb_queue_tail(&newsk->sk_receive_queue, skb);
-                        skb_set_owner_r(skb, newsk);
+                        sctp_skb_set_owner_r(skb, newsk);
                 }
         }
 
@@ -5665,10 +5688,10 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
                 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
                         event = sctp_skb2event(skb);
                         if (event->asoc == assoc) {
-                                sock_rfree(skb);
+                                sctp_sock_rfree(skb);
                                 __skb_unlink(skb, &oldsp->pd_lobby);
                                 __skb_queue_tail(queue, skb);
-                                skb_set_owner_r(skb, newsk);
+                                sctp_skb_set_owner_r(skb, newsk);
                         }
                 }
 
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index ee236784a6bb..a015283a9087 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -55,10 +55,13 @@ static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event);
 
 
 /* Initialize an ULP event from an given skb.  */
-SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event, int msg_flags)
+SCTP_STATIC void sctp_ulpevent_init(struct sctp_ulpevent *event,
+                                    int msg_flags,
+                                    unsigned int len)
 {
         memset(event, 0, sizeof(struct sctp_ulpevent));
         event->msg_flags = msg_flags;
+        event->rmem_len = len;
 }
 
 /* Create a new sctp_ulpevent.  */
@@ -73,7 +76,7 @@ SCTP_STATIC struct sctp_ulpevent *sctp_ulpevent_new(int size, int msg_flags,
                 goto fail;
 
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, msg_flags);
+        sctp_ulpevent_init(event, msg_flags, skb->truesize);
 
         return event;
 
@@ -101,17 +104,16 @@ static inline void sctp_ulpevent_set_owner(struct sctp_ulpevent *event,
         sctp_association_hold((struct sctp_association *)asoc);
         skb = sctp_event2skb(event);
         event->asoc = (struct sctp_association *)asoc;
-        atomic_add(skb->truesize, &event->asoc->rmem_alloc);
-        skb_set_owner_r(skb, asoc->base.sk);
+        atomic_add(event->rmem_len, &event->asoc->rmem_alloc);
+        sctp_skb_set_owner_r(skb, asoc->base.sk);
 }
 
 /* A simple destructor to give up the reference to the association. */
 static inline void sctp_ulpevent_release_owner(struct sctp_ulpevent *event)
 {
         struct sctp_association *asoc = event->asoc;
-        struct sk_buff *skb = sctp_event2skb(event);
 
-        atomic_sub(skb->truesize, &asoc->rmem_alloc);
+        atomic_sub(event->rmem_len, &asoc->rmem_alloc);
         sctp_association_put(asoc);
 }
 
@@ -372,7 +374,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         sre = (struct sctp_remote_error *)
                 skb_push(skb, sizeof(struct sctp_remote_error));
@@ -464,7 +466,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
 
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
-        sctp_ulpevent_init(event, MSG_NOTIFICATION);
+        sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
 
         ssf = (struct sctp_send_failed *)
                 skb_push(skb, sizeof(struct sctp_send_failed));
@@ -682,8 +684,11 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
         /* Embed the event fields inside the cloned skb.  */
         event = sctp_skb2event(skb);
 
-        /* Initialize event with flags 0.  */
-        sctp_ulpevent_init(event, 0);
+        /* Initialize event with flags 0  and correct length
+         * Since this is a clone of the original skb, only account for
+         * the data of this chunk as other chunks will be accounted separately.
+         */
+        sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
 
         sctp_ulpevent_receive_data(event, asoc);
 
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index 575e556aeb3e..e1d144275f97 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -309,7 +309,7 @@ static struct sctp_ulpevent *sctp_make_reassembled_event(struct sk_buff_head *qu
                         if (!new)
                                 return NULL;    /* try again later */
 
-                        new->sk = f_frag->sk;
+                        sctp_skb_set_owner_r(new, f_frag->sk);
 
                         skb_shinfo(new)->frag_list = pos;
                 } else
diff --git a/net/sunrpc/pmap_clnt.c b/net/sunrpc/pmap_clnt.c
index 919d5ba7ca0a..e52afab413de 100644
--- a/net/sunrpc/pmap_clnt.c
+++ b/net/sunrpc/pmap_clnt.c
@@ -101,11 +101,13 @@ void rpc_getport(struct rpc_task *task)
         /* Autobind on cloned rpc clients is discouraged */
         BUG_ON(clnt->cl_parent != clnt);
 
-        if (xprt_test_and_set_binding(xprt)) {
-                task->tk_status = -EACCES;      /* tell caller to check again */
-                rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-                return;
-        }
+        /* Put self on queue before sending rpcbind request, in case
+         * pmap_getport_done completes before we return from rpc_run_task */
+        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
+
+        status = -EACCES;               /* tell caller to check again */
+        if (xprt_test_and_set_binding(xprt))
+                goto bailout_nofree;
 
         /* Someone else may have bound if we slept */
         status = 0;
@@ -134,8 +136,6 @@ void rpc_getport(struct rpc_task *task)
                 goto bailout;
         rpc_release_task(child);
 
-        rpc_sleep_on(&xprt->binding, task, NULL, NULL);
-
         task->tk_xprt->stat.bind_count++;
         return;
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 2807fa0eab40..eb44ec929ca1 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -828,6 +828,11 @@ svc_process(struct svc_rqst *rqstp)
                 *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
 
                 /* Encode reply */
+                if (*statp == rpc_drop_reply) {
+                        if (procp->pc_release)
+                                procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+                        goto dropit;
+                }
                 if (*statp == rpc_success && (xdr = procp->pc_encode)
                  && !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
                         dprintk("svc: failed to encode reply\n");
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index 8f2320aded5c..ee9bb1522d5e 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -126,6 +126,7 @@ void auth_domain_put(struct auth_domain *dom)
         if (atomic_dec_and_lock(&dom->ref.refcount, &auth_domain_lock)) {
                 hlist_del(&dom->hash);
                 dom->flavour->domain_release(dom);
+                spin_unlock(&auth_domain_lock);
         }
 }
 
@@ -147,10 +148,8 @@ auth_domain_lookup(char *name, struct auth_domain *new)
                         return hp;
                 }
         }
-        if (new) {
+        if (new)
                 hlist_add_head(&new->hash, head);
-                kref_get(&new->ref);
-        }
         spin_unlock(&auth_domain_lock);
         return new;
 }
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 61e307cca13d..64ca1f61dd94 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -299,9 +299,15 @@ void svc_reserve(struct svc_rqst *rqstp, int space)
 static inline void
 svc_sock_put(struct svc_sock *svsk)
 {
-        if (atomic_dec_and_test(&svsk->sk_inuse) && test_bit(SK_DEAD, &svsk->sk_flags)) {
+        if (atomic_dec_and_test(&svsk->sk_inuse) &&
+                        test_bit(SK_DEAD, &svsk->sk_flags)) {
                 dprintk("svc: releasing dead socket\n");
-                sock_release(svsk->sk_sock);
+                if (svsk->sk_sock->file)
+                        sockfd_put(svsk->sk_sock);
+                else
+                        sock_release(svsk->sk_sock);
+                if (svsk->sk_info_authunix != NULL)
+                        svcauth_unix_info_release(svsk->sk_info_authunix);
                 kfree(svsk);
         }
 }
@@ -973,7 +979,7 @@ svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 return 0;
         }
 
-        if (test_bit(SK_CONN, &svsk->sk_flags)) {
+        if (svsk->sk_sk->sk_state == TCP_LISTEN) {
                 svc_tcp_accept(svsk);
                 svc_sock_received(svsk);
                 return 0;
@@ -1604,20 +1610,13 @@ svc_delete_socket(struct svc_sock *svsk)
                 if (test_bit(SK_TEMP, &svsk->sk_flags))
                         serv->sv_tmpcnt--;
 
-        if (!atomic_read(&svsk->sk_inuse)) {
-                spin_unlock_bh(&serv->sv_lock);
-                if (svsk->sk_sock->file)
-                        sockfd_put(svsk->sk_sock);
-                else
-                        sock_release(svsk->sk_sock);
-                if (svsk->sk_info_authunix != NULL)
-                        svcauth_unix_info_release(svsk->sk_info_authunix);
-                kfree(svsk);
-        } else {
-                spin_unlock_bh(&serv->sv_lock);
-                dprintk(KERN_NOTICE "svc: server socket destroy delayed\n");
-                /* svsk->sk_server = NULL; */
-        }
+        /* This atomic_inc should be needed - svc_delete_socket
+         * should have the semantic of dropping a reference.
+         * But it doesn't yet....
+         */
+        atomic_inc(&svsk->sk_inuse);
+        spin_unlock_bh(&serv->sv_lock);
+        svc_sock_put(svsk);
 }
 
 /*
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 28100e019225..757fc91ef25d 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1366,7 +1366,7 @@ int xs_setup_udp(struct rpc_xprt *xprt, struct rpc_timeout *to)
         if (xprt->slot == NULL)
                 return -ENOMEM;
 
-        if (ntohs(addr->sin_port != 0))
+        if (ntohs(addr->sin_port) != 0)
                 xprt_set_bound(xprt);
         xprt->port = xs_get_random_port();
 
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 75a5968c2139..39744a33bd36 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -2,7 +2,7 @@
  * net/tipc/bearer.c: TIPC bearer code
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -191,14 +191,14 @@ void tipc_media_addr_printf(struct print_buf *pb, struct tipc_media_addr *a)
         if ((i < media_count) && (m_ptr->addr2str != NULL)) {
                 char addr_str[MAX_ADDR_STR];
 
-                tipc_printf(pb, "%s(%s) ", m_ptr->name, 
+                tipc_printf(pb, "%s(%s)", m_ptr->name,
                             m_ptr->addr2str(a, addr_str, sizeof(addr_str)));
         } else {
                 unchar *addr = (unchar *)&a->dev_addr;
 
-                tipc_printf(pb, "UNKNOWN(%u):", media_type);
+                tipc_printf(pb, "UNKNOWN(%u)", media_type);
                 for (i = 0; i < (sizeof(*a) - sizeof(a->type)); i++) {
-                        tipc_printf(pb, "%02x ", addr[i]);
+                        tipc_printf(pb, "-%02x", addr[i]);
                 }
         }
 }
diff --git a/net/tipc/config.c b/net/tipc/config.c
index 285e1bc2d880..ed1351ed05e1 100644
--- a/net/tipc/config.c
+++ b/net/tipc/config.c
@@ -2,7 +2,7 @@
  * net/tipc/config.c: TIPC configuration management code
  * 
  * Copyright (c) 2002-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -613,7 +613,8 @@ struct sk_buff *tipc_cfg_do_cmd(u32 orig_node, u16 cmd, const void *request_area
                 rep_tlv_buf = tipc_cfg_reply_unsigned(tipc_net_id);
                 break;
         default:
-                rep_tlv_buf = NULL;
+                rep_tlv_buf = tipc_cfg_reply_error_string(TIPC_CFG_NOT_SUPPORTED
+                                                          " (unknown command)");
                 break;
         }
 
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 0539a8362858..6f5b7ee31180 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -57,7 +57,7 @@ void tipc_socket_stop(void);
 int  tipc_netlink_start(void);
 void tipc_netlink_stop(void);
 
-#define TIPC_MOD_VER "1.6.1"
+#define TIPC_MOD_VER "1.6.2"
 
 #ifndef CONFIG_TIPC_ZONES
 #define CONFIG_TIPC_ZONES 3
@@ -90,7 +90,7 @@ int tipc_random;
 atomic_t tipc_user_count = ATOMIC_INIT(0);
 
 const char tipc_alphabet[] = 
-        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.";
 
 /* configurable TIPC parameters */
 
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 762aac2572be..4638947c2326 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -65,7 +65,7 @@
 #define assert(i)  BUG_ON(!(i))
 
 struct tipc_msg;
-extern struct print_buf *TIPC_CONS, *TIPC_LOG;
+extern struct print_buf *TIPC_NULL, *TIPC_CONS, *TIPC_LOG;
 extern struct print_buf *TIPC_TEE(struct print_buf *, struct print_buf *);
 void tipc_msg_print(struct print_buf*,struct tipc_msg *,const char*);
 void tipc_printf(struct print_buf *, const char *fmt, ...);
@@ -83,9 +83,9 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define warn(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_WARNING "TIPC: " fmt, ## arg)
 #define info(fmt, arg...) tipc_printf(TIPC_OUTPUT, KERN_NOTICE "TIPC: " fmt, ## arg)
 
-#define dbg(fmt, arg...)  do {if (DBG_OUTPUT) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
-#define msg_dbg(msg, txt) do {if (DBG_OUTPUT) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
-#define dump(fmt, arg...) do {if (DBG_OUTPUT) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
+#define dbg(fmt, arg...)  do {if (DBG_OUTPUT != TIPC_NULL) tipc_printf(DBG_OUTPUT, fmt, ## arg);} while(0)
+#define msg_dbg(msg, txt) do {if (DBG_OUTPUT != TIPC_NULL) tipc_msg_print(DBG_OUTPUT, msg, txt);} while(0)
+#define dump(fmt, arg...) do {if (DBG_OUTPUT != TIPC_NULL) tipc_dump(DBG_OUTPUT, fmt, ##arg);} while(0)
 
 
 /*      
@@ -94,11 +94,11 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
  * here, or on a per .c file basis, by redefining these symbols.  The following
  * print buffer options are available:
  *
- * NULL                         : Output to null print buffer (i.e. print nowhere)
- * TIPC_CONS                    : Output to system console
- * TIPC_LOG                     : Output to TIPC log buffer 
- * &buf                         : Output to user-defined buffer (struct print_buf *)
- * TIPC_TEE(&buf_a,&buf_b)      : Output to two print buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG) )
+ * TIPC_NULL               : null buffer (i.e. print nowhere)
+ * TIPC_CONS               : system console
+ * TIPC_LOG                : TIPC log buffer
+ * &buf                    : user-defined buffer (struct print_buf *)
+ * TIPC_TEE(&buf_a,&buf_b) : list of buffers (eg. TIPC_TEE(TIPC_CONS,TIPC_LOG))
  */
 
 #ifndef TIPC_OUTPUT
@@ -106,7 +106,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #endif
 
 #ifndef DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 #endif
 
 #else
@@ -136,7 +136,7 @@ void tipc_dump(struct print_buf*,const char *fmt, ...);
 #define TIPC_OUTPUT TIPC_CONS
 
 #undef  DBG_OUTPUT
-#define DBG_OUTPUT NULL
+#define DBG_OUTPUT TIPC_NULL
 
 #endif                    
 
@@ -275,11 +275,15 @@ static inline void k_term_timer(struct timer_list *timer)
 /*
  * TIPC message buffer code
  *
- * TIPC message buffer headroom leaves room for 14 byte Ethernet header, 
+ * TIPC message buffer headroom reserves space for a link-level header
+ * (in case the message is sent off-node),
  * while ensuring TIPC header is word aligned for quicker access
+ *
+ * The largest header currently supported is 18 bytes, which is used when
+ * the standard 14 byte Ethernet header has 4 added bytes for VLAN info
  */
 
-#define BUF_HEADROOM 16u 
+#define BUF_HEADROOM 20u
 
 struct tipc_skb_cb {
         void *handle;
diff --git a/net/tipc/dbg.c b/net/tipc/dbg.c
index 55130655e1ed..d8af4c28695d 100644
--- a/net/tipc/dbg.c
+++ b/net/tipc/dbg.c
@@ -1,8 +1,8 @@
 /*
- * net/tipc/dbg.c: TIPC print buffer routines for debuggign
+ * net/tipc/dbg.c: TIPC print buffer routines for debugging
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -38,11 +38,12 @@
 #include "config.h"
 #include "dbg.h"
 
-#define MAX_STRING 512
-
-static char print_string[MAX_STRING];
+static char print_string[TIPC_PB_MAX_STR];
 static DEFINE_SPINLOCK(print_lock);
 
+static struct print_buf null_buf = { NULL, 0, NULL, NULL };
+struct print_buf *TIPC_NULL = &null_buf;
+
 static struct print_buf cons_buf = { NULL, 0, NULL, NULL };
 struct print_buf *TIPC_CONS = &cons_buf;
 
@@ -62,68 +63,83 @@ struct print_buf *TIPC_LOG = &log_buf;
 /*
  * Locking policy when using print buffers.
  *
- * 1) Routines of the form printbuf_XXX() rely on the caller to prevent
- *    simultaneous use of the print buffer(s) being manipulated.
- * 2) tipc_printf() uses 'print_lock' to prevent simultaneous use of
- *    'print_string' and to protect its print buffer(s).
- * 3) TIPC_TEE() uses 'print_lock' to protect its print buffer(s).
- * 4) Routines of the form log_XXX() uses 'print_lock' to protect TIPC_LOG.
+ * The following routines use 'print_lock' for protection:
+ * 1) tipc_printf()  - to protect its print buffer(s) and 'print_string'
+ * 2) TIPC_TEE()     - to protect its print buffer(s)
+ * 3) tipc_dump()    - to protect its print buffer(s) and 'print_string'
+ * 4) tipc_log_XXX() - to protect TIPC_LOG
+ *
+ * All routines of the form tipc_printbuf_XXX() rely on the caller to prevent
+ * simultaneous use of the print buffer(s) being manipulated.
  */
 
 /**
  * tipc_printbuf_init - initialize print buffer to empty
+ * @pb: pointer to print buffer structure
+ * @raw: pointer to character array used by print buffer
+ * @size: size of character array
+ *
+ * Makes the print buffer a null device that discards anything written to it
+ * if the character array is too small (or absent).
  */
 
-void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 sz)
+void tipc_printbuf_init(struct print_buf *pb, char *raw, u32 size)
 {
-        if (!pb || !raw || (sz < (MAX_STRING + 1)))
-                return;
-
-        pb->crs = pb->buf = raw;
-        pb->size = sz;
+        pb->buf = raw;
+        pb->crs = raw;
+        pb->size = size;
         pb->next = NULL;
-        pb->buf[0] = 0;
-        pb->buf[sz-1] = ~0;
+
+        if (size < TIPC_PB_MIN_SIZE) {
+                pb->buf = NULL;
+        } else if (raw) {
+                pb->buf[0] = 0;
+                pb->buf[size-1] = ~0;
+        }
 }
 
 /**
  * tipc_printbuf_reset - reinitialize print buffer to empty state
+ * @pb: pointer to print buffer structure
  */
 
 void tipc_printbuf_reset(struct print_buf *pb)
 {
-        if (pb && pb->buf)
-                tipc_printbuf_init(pb, pb->buf, pb->size);
+        tipc_printbuf_init(pb, pb->buf, pb->size);
 }
 
 /**
  * tipc_printbuf_empty - test if print buffer is in empty state
+ * @pb: pointer to print buffer structure
+ *
+ * Returns non-zero if print buffer is empty.
  */
 
 int tipc_printbuf_empty(struct print_buf *pb)
 {
-        return (!pb || !pb->buf || (pb->crs == pb->buf));
+        return (!pb->buf || (pb->crs == pb->buf));
 }
 
 /**
  * tipc_printbuf_validate - check for print buffer overflow
+ * @pb: pointer to print buffer structure
  * 
  * Verifies that a print buffer has captured all data written to it. 
  * If data has been lost, linearize buffer and prepend an error message
  * 
- * Returns length of print buffer data string (including trailing NULL)
+ * Returns length of print buffer data string (including trailing NUL)
  */
 
 int tipc_printbuf_validate(struct print_buf *pb)
 {
-        char *err = "             *** PRINT BUFFER WRAPPED AROUND ***\n";
+        char *err = "\n\n*** PRINT BUFFER OVERFLOW ***\n\n";
         char *cp_buf;
         struct print_buf cb;
 
-        if (!pb || !pb->buf)
+        if (!pb->buf)
                 return 0;
 
-        if (pb->buf[pb->size - 1] == '\0') {
+        if (pb->buf[pb->size - 1] == 0) {
                 cp_buf = kmalloc(pb->size, GFP_ATOMIC);
                 if (cp_buf != NULL){
                         tipc_printbuf_init(&cb, cp_buf, pb->size);
@@ -141,6 +157,8 @@ int tipc_printbuf_validate(struct print_buf *pb)
 
 /**
  * tipc_printbuf_move - move print buffer contents to another print buffer
+ * @pb_to: pointer to destination print buffer structure
+ * @pb_from: pointer to source print buffer structure
  * 
  * Current contents of destination print buffer (if any) are discarded.
  * Source print buffer becomes empty if a successful move occurs.
@@ -152,21 +170,22 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
         /* Handle the cases where contents can't be moved */
 
-        if (!pb_to || !pb_to->buf)
+        if (!pb_to->buf)
                 return;
 
-        if (!pb_from || !pb_from->buf) {
+        if (!pb_from->buf) {
                 tipc_printbuf_reset(pb_to);
                 return;
         }
 
         if (pb_to->size < pb_from->size) {
                 tipc_printbuf_reset(pb_to);
-                tipc_printf(pb_to, "*** PRINT BUFFER OVERFLOW ***");
+                tipc_printf(pb_to, "*** PRINT BUFFER MOVE ERROR ***");
                 return;
         }
 
         /* Copy data from char after cursor to end (if used) */
+
         len = pb_from->buf + pb_from->size - pb_from->crs - 2;
         if ((pb_from->buf[pb_from->size-1] == 0) && (len > 0)) {
                 strcpy(pb_to->buf, pb_from->crs + 1);
@@ -175,6 +194,7 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
                 pb_to->crs = pb_to->buf;
 
         /* Copy data from start to cursor (always) */
+
         len = pb_from->crs - pb_from->buf;
         strcpy(pb_to->crs, pb_from->buf);
         pb_to->crs += len;
@@ -184,6 +204,8 @@ void tipc_printbuf_move(struct print_buf *pb_to, struct print_buf *pb_from)
 
 /**
  * tipc_printf - append formatted output to print buffer chain
+ * @pb: pointer to chain of print buffers (may be NULL)
+ * @fmt: formatted info to be printed
  */
 
 void tipc_printf(struct print_buf *pb, const char *fmt, ...)
@@ -195,8 +217,8 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
         spin_lock_bh(&print_lock);
         FORMAT(print_string, chars_to_add, fmt);
-        if (chars_to_add >= MAX_STRING)
-                strcpy(print_string, "*** STRING TOO LONG ***");
+        if (chars_to_add >= TIPC_PB_MAX_STR)
+                strcpy(print_string, "*** PRINT BUFFER STRING TOO LONG ***");
 
         while (pb) {
                 if (pb == TIPC_CONS)
@@ -206,6 +228,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
                         if (chars_to_add <= chars_left) {
                                 strcpy(pb->crs, print_string);
                                 pb->crs += chars_to_add;
+                        } else if (chars_to_add >= (pb->size - 1)) {
+                                strcpy(pb->buf, print_string + chars_to_add + 1
+                                       - pb->size);
+                                pb->crs = pb->buf + pb->size - 1;
                         } else {
                                 strcpy(pb->buf, print_string + chars_left);
                                 save_char = print_string[chars_left];
@@ -224,6 +250,10 @@ void tipc_printf(struct print_buf *pb, const char *fmt, ...)
 
 /**
  * TIPC_TEE - perform next output operation on both print buffers  
+ * @b0: pointer to chain of print buffers (may be NULL)
+ * @b1: pointer to print buffer to add to chain
+ *
+ * Returns pointer to print buffer chain.
  */
 
 struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
@@ -232,8 +262,6 @@ struct print_buf *TIPC_TEE(struct print_buf *b0, struct print_buf *b1)
 
         if (!b0 || (b0 == b1))
                 return b1;
-        if (!b1)
-                return b0;
 
         spin_lock_bh(&print_lock);
         while (pb->next) {
@@ -256,7 +284,7 @@ static void print_to_console(char *crs, int len)
         int rest = len;
 
         while (rest > 0) {
-                int sz = rest < MAX_STRING ? rest : MAX_STRING;
+                int sz = rest < TIPC_PB_MAX_STR ? rest : TIPC_PB_MAX_STR;
                 char c = crs[sz];
 
                 crs[sz] = 0;
@@ -275,36 +303,48 @@ static void printbuf_dump(struct print_buf *pb)
 {
         int len;
 
+        if (!pb->buf) {
+                printk("*** PRINT BUFFER NOT ALLOCATED ***");
+                return;
+        }
+
         /* Dump print buffer from char after cursor to end (if used) */
+
         len = pb->buf + pb->size - pb->crs - 2;
         if ((pb->buf[pb->size - 1] == 0) && (len > 0))
                 print_to_console(pb->crs + 1, len);
 
         /* Dump print buffer from start to cursor (always) */
+
         len = pb->crs - pb->buf;
         print_to_console(pb->buf, len);
 }
 
 /**
  * tipc_dump - dump non-console print buffer(s) to console
+ * @pb: pointer to chain of print buffers
  */
 
 void tipc_dump(struct print_buf *pb, const char *fmt, ...)
 {
+        struct print_buf *pb_next;
         int len;
 
         spin_lock_bh(&print_lock);
-        FORMAT(TIPC_CONS->buf, len, fmt);
-        printk(TIPC_CONS->buf);
+        FORMAT(print_string, len, fmt);
+        printk(print_string);
 
         for (; pb; pb = pb->next) {
-                if (pb == TIPC_CONS)
-                        continue;
-                printk("\n---- Start of dump,%s log ----\n\n", 
-                       (pb == TIPC_LOG) ? "global" : "local");
-                printbuf_dump(pb);
-                tipc_printbuf_reset(pb);
-                printk("\n-------- End of dump --------\n");
+                if (pb != TIPC_CONS) {
+                        printk("\n---- Start of %s log dump ----\n\n",
+                               (pb == TIPC_LOG) ? "global" : "local");
+                        printbuf_dump(pb);
+                        tipc_printbuf_reset(pb);
+                        printk("\n---- End of dump ----\n");
+                }
+                pb_next = pb->next;
+                pb->next = NULL;
+                pb = pb_next;
         }
         spin_unlock_bh(&print_lock);
 }
@@ -324,7 +364,8 @@ void tipc_log_stop(void)
 }
 
 /**
- * tipc_log_reinit - set TIPC log print buffer to specified size
+ * tipc_log_reinit - (re)initialize TIPC log print buffer
+ * @log_size: print buffer size to use
  */
 
 void tipc_log_reinit(int log_size)
@@ -332,10 +373,11 @@ void tipc_log_reinit(int log_size)
         tipc_log_stop();
 
         if (log_size) {
-                if (log_size <= MAX_STRING)
-                        log_size = MAX_STRING + 1;
+                if (log_size < TIPC_PB_MIN_SIZE)
+                        log_size = TIPC_PB_MIN_SIZE;
                 spin_lock_bh(&print_lock);
-                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC), log_size);
+                tipc_printbuf_init(TIPC_LOG, kmalloc(log_size, GFP_ATOMIC),
+                                   log_size);
                 spin_unlock_bh(&print_lock);
         }
 }
diff --git a/net/tipc/dbg.h b/net/tipc/dbg.h
index 227f050d2a52..467c0bc78a79 100644
--- a/net/tipc/dbg.h
+++ b/net/tipc/dbg.h
@@ -2,7 +2,7 @@
  * net/tipc/dbg.h: Include file for TIPC print buffer routines
  * 
  * Copyright (c) 1997-2006, Ericsson AB
- * Copyright (c) 2005, Wind River Systems
+ * Copyright (c) 2005-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -37,6 +37,14 @@
 #ifndef _TIPC_DBG_H
 #define _TIPC_DBG_H
 
+/**
+ * struct print_buf - TIPC print buffer structure
+ * @buf: pointer to character array containing print buffer contents
+ * @size: size of character array
+ * @crs: pointer to first unused space in character array (i.e. final NUL)
+ * @next: used to link print buffers when printing to more than one at a time
+ */
+
 struct print_buf {
         char *buf;
         u32 size;
@@ -44,7 +52,10 @@ struct print_buf {
         struct print_buf *next;
 };
 
-void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 sz);
+#define TIPC_PB_MIN_SIZE 64     /* minimum size for a print buffer's array */
+#define TIPC_PB_MAX_STR 512     /* max printable string (with trailing NUL) */
+
+void tipc_printbuf_init(struct print_buf *pb, char *buf, u32 size);
 void tipc_printbuf_reset(struct print_buf *pb);
 int  tipc_printbuf_empty(struct print_buf *pb);
 int  tipc_printbuf_validate(struct print_buf *pb);
diff --git a/net/tipc/discover.c b/net/tipc/discover.c
index ee94de92ae99..3b0cd12f37da 100644
--- a/net/tipc/discover.c
+++ b/net/tipc/discover.c
@@ -132,6 +132,28 @@ static struct sk_buff *tipc_disc_init_msg(u32 type,
 }
 
 /**
+ * disc_dupl_alert - issue node address duplication alert
+ * @b_ptr: pointer to bearer detecting duplication
+ * @node_addr: duplicated node address
+ * @media_addr: media address advertised by duplicated node
+ */
+
+static void disc_dupl_alert(struct bearer *b_ptr, u32 node_addr,
+                            struct tipc_media_addr *media_addr)
+{
+        char node_addr_str[16];
+        char media_addr_str[64];
+        struct print_buf pb;
+
+        addr_string_fill(node_addr_str, node_addr);
+        tipc_printbuf_init(&pb, media_addr_str, sizeof(media_addr_str));
+        tipc_media_addr_printf(&pb, media_addr);
+        tipc_printbuf_validate(&pb);
+        warn("Duplicate %s using %s seen on <%s>\n",
+             node_addr_str, media_addr_str, b_ptr->publ.name);
+}
+
+/**
  * tipc_disc_recv_msg - handle incoming link setup message (request or response)
  * @buf: buffer containing message
  */
@@ -157,8 +179,11 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 return;
         if (!tipc_addr_node_valid(orig))
                 return;
-        if (orig == tipc_own_addr)
+        if (orig == tipc_own_addr) {
+                if (memcmp(&media_addr, &b_ptr->publ.addr, sizeof(media_addr)))
+                        disc_dupl_alert(b_ptr, tipc_own_addr, &media_addr);
                 return;
+        }
         if (!in_scope(dest, tipc_own_addr))
                 return;
         if (is_slave(tipc_own_addr) && is_slave(orig))
@@ -170,7 +195,8 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 struct sk_buff *rbuf;
                 struct tipc_media_addr *addr;
                 struct node *n_ptr = tipc_node_find(orig);
-                int link_up;
+                int link_fully_up;
+
                 dbg(" in own cluster\n");
                 if (n_ptr == NULL) {
                         n_ptr = tipc_node_create(orig);
@@ -190,14 +216,19 @@ void tipc_disc_recv_msg(struct sk_buff *buf)
                 }
                 addr = &link->media_addr;
                 if (memcmp(addr, &media_addr, sizeof(*addr))) {
+                        if (tipc_link_is_up(link) || (!link->started)) {
+                                disc_dupl_alert(b_ptr, orig, &media_addr);
+                                spin_unlock_bh(&n_ptr->lock);
+                                return;
+                        }
                         warn("Resetting link <%s>, peer interface address changed\n",
                              link->name);
                         memcpy(addr, &media_addr, sizeof(*addr));
                         tipc_link_reset(link);     
                 }
-                link_up = tipc_link_is_up(link);
+                link_fully_up = (link->state == WORKING_WORKING);
                 spin_unlock_bh(&n_ptr->lock);                
-                if ((type == DSC_RESP_MSG) || link_up)
+                if ((type == DSC_RESP_MSG) || link_fully_up)
                         return;
                 rbuf = tipc_disc_init_msg(DSC_RESP_MSG, 1, orig, b_ptr);
                 if (rbuf != NULL) {
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 53bc8cb5adbc..1bb983c8130b 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -132,7 +132,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * allow the output from multiple links to be intermixed.  For this reason
  * routines of the form "dbg_link_XXX()" have been created that will capture
  * debug info into a link's personal print buffer, which can then be dumped
- * into the TIPC system log (LOG) upon request.
+ * into the TIPC system log (TIPC_LOG) upon request.
  *
  * To enable per-link debugging, use LINK_LOG_BUF_SIZE to specify the size
  * of the print buffer used by each link.  If LINK_LOG_BUF_SIZE is set to 0,
@@ -141,7 +141,7 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
  * when there is only a single link in the system being debugged.
  *
  * Notes:
- * - When enabled, LINK_LOG_BUF_SIZE should be set to at least 1000 (bytes)
+ * - When enabled, LINK_LOG_BUF_SIZE should be set to at least TIPC_PB_MIN_SIZE
  * - "l_ptr" must be valid when using dbg_link_XXX() macros  
  */
 
@@ -159,13 +159,13 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
 
 static void dbg_print_link(struct link *l_ptr, const char *str)
 {
-        if (DBG_OUTPUT)
+        if (DBG_OUTPUT != TIPC_NULL)
                 link_print(l_ptr, DBG_OUTPUT, str);
 }
 
 static void dbg_print_buf_chain(struct sk_buff *root_buf)
 {
-        if (DBG_OUTPUT) {
+        if (DBG_OUTPUT != TIPC_NULL) {
                 struct sk_buff *buf = root_buf;
 
                 while (buf) {
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index f0b063bcc2a9..03bd659c43ca 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -122,7 +122,7 @@ void tipc_named_publish(struct publication *publ)
         struct sk_buff *buf;
         struct distr_item *item;
 
-        list_add(&publ->local_list, &publ_root);
+        list_add_tail(&publ->local_list, &publ_root);
         publ_cnt++;
 
         buf = named_prepare_buf(PUBLICATION, ITEM_SIZE, 0);
diff --git a/net/tipc/node.c b/net/tipc/node.c
index fc6d09630ccd..886bda5e88db 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -648,7 +648,7 @@ struct sk_buff *tipc_node_get_links(const void *req_tlv_area, int req_tlv_space)
                 return tipc_cfg_reply_error_string(TIPC_CFG_INVALID_VALUE
                                                    " (network address)");
 
-        if (!tipc_nodes)
+        if (tipc_mode != TIPC_NET_MODE)
                 return tipc_cfg_reply_none();
         
         /* Get space for all unicast links + multicast link */
diff --git a/net/tipc/port.c b/net/tipc/port.c
index b9c8c6b9e94f..b7f3199523ca 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -505,8 +505,13 @@ static void port_timeout(unsigned long ref)
         struct port *p_ptr = tipc_port_lock(ref);
         struct sk_buff *buf = NULL;
 
-        if (!p_ptr || !p_ptr->publ.connected)
+        if (!p_ptr)
+                return;
+
+        if (!p_ptr->publ.connected) {
+                tipc_port_unlock(p_ptr);
                 return;
+        }
 
         /* Last probe answered ? */
         if (p_ptr->probing_state == PROBING) {
@@ -1131,11 +1136,12 @@ int tipc_publish(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
         int res = -EINVAL;
 
         p_ptr = tipc_port_lock(ref);
+        if (!p_ptr)
+                return -EINVAL;
+
         dbg("tipc_publ %u, p_ptr = %x, conn = %x, scope = %x, "
             "lower = %u, upper = %u\n",
             ref, p_ptr, p_ptr->publ.connected, scope, seq->lower, seq->upper);
-        if (!p_ptr)
-                return -EINVAL;
         if (p_ptr->publ.connected)
                 goto exit;
         if (seq->lower > seq->upper)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index acfb852e7c98..2a6a5a6b4c12 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2,7 +2,7 @@
  * net/tipc/socket.c: TIPC socket API
  * 
  * Copyright (c) 2001-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -629,6 +629,9 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
                         return -ENOTCONN;
         }
 
+        if (unlikely(m->msg_name))
+                return -EISCONN;
+
         /* 
          * Send each iovec entry using one or more messages
          *
@@ -641,6 +644,8 @@ static int send_stream(struct kiocb *iocb, struct socket *sock,
         curr_iovlen = m->msg_iovlen;
         my_msg.msg_iov = &my_iov;
         my_msg.msg_iovlen = 1;
+        my_msg.msg_flags = m->msg_flags;
+        my_msg.msg_name = NULL;
         bytes_sent = 0;
 
         while (curr_iovlen--) {
@@ -1203,7 +1208,8 @@ static u32 dispatch(struct tipc_port *tport, struct sk_buff *buf)
         atomic_inc(&tipc_queue_size);
         skb_queue_tail(&sock->sk->sk_receive_queue, buf);
 
-        wake_up_interruptible(sock->sk->sk_sleep);
+        if (waitqueue_active(sock->sk->sk_sleep))
+                wake_up_interruptible(sock->sk->sk_sleep);
         return TIPC_OK;
 }
 
@@ -1218,7 +1224,8 @@ static void wakeupdispatch(struct tipc_port *tport)
 {
         struct tipc_sock *tsock = (struct tipc_sock *)tport->usr_handle;
 
-        wake_up_interruptible(tsock->sk.sk_sleep);
+        if (waitqueue_active(tsock->sk.sk_sleep))
+                wake_up_interruptible(tsock->sk.sk_sleep);
 }
 
 /**
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index c51600ba5f4a..7a918f12a5df 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -155,7 +155,7 @@ void tipc_subscr_report_overlap(struct subscription *sub,
             sub->seq.upper, found_lower, found_upper);
         if (!tipc_subscr_overlap(sub, found_lower, found_upper))
                 return;
-        if (!must && (sub->filter != TIPC_SUB_PORTS))
+        if (!must && !(sub->filter & TIPC_SUB_PORTS))
                 return;
         subscr_send_event(sub, found_lower, found_upper, event, port_ref, node);
 }
@@ -176,6 +176,13 @@ static void subscr_timeout(struct subscription *sub)
         if (subscriber == NULL)
                 return;
 
+        /* Validate timeout (in case subscription is being cancelled) */
+
+        if (sub->timeout == TIPC_WAIT_FOREVER) {
+                tipc_ref_unlock(subscriber_ref);
+                return;
+        }
+
         /* Unlink subscription from name table */
 
         tipc_nametbl_unsubscribe(sub);
@@ -199,6 +206,20 @@ static void subscr_timeout(struct subscription *sub)
 }
 
 /**
+ * subscr_del - delete a subscription within a subscription list
+ *
+ * Called with subscriber locked.
+ */
+
+static void subscr_del(struct subscription *sub)
+{
+        tipc_nametbl_unsubscribe(sub);
+        list_del(&sub->subscription_list);
+        kfree(sub);
+        atomic_dec(&topsrv.subscription_count);
+}
+
+/**
  * subscr_terminate - terminate communication with a subscriber
  * 
  * Called with subscriber locked.  Routine must temporarily release this lock
@@ -227,12 +248,9 @@ static void subscr_terminate(struct subscriber *subscriber)
                         k_cancel_timer(&sub->timer);
                         k_term_timer(&sub->timer);
                 }
-                tipc_nametbl_unsubscribe(sub);
-                list_del(&sub->subscription_list);
-                dbg("Term: Removed sub %u,%u,%u from subscriber %x list\n",
+                dbg("Term: Removing sub %u,%u,%u from subscriber %x list\n",
                     sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
-                kfree(sub);
-                atomic_dec(&topsrv.subscription_count);
+                subscr_del(sub);
         }
 
         /* Sever connection to subscriber */
@@ -253,6 +271,49 @@ static void subscr_terminate(struct subscriber *subscriber)
 }
 
 /**
+ * subscr_cancel - handle subscription cancellation request
+ *
+ * Called with subscriber locked.  Routine must temporarily release this lock
+ * to enable the subscription timeout routine to finish without deadlocking;
+ * the lock is then reclaimed to allow caller to release it upon return.
+ *
+ * Note that fields of 's' use subscriber's endianness!
+ */
+
+static void subscr_cancel(struct tipc_subscr *s,
+                          struct subscriber *subscriber)
+{
+        struct subscription *sub;
+        struct subscription *sub_temp;
+        int found = 0;
+
+        /* Find first matching subscription, exit if not found */
+
+        list_for_each_entry_safe(sub, sub_temp, &subscriber->subscription_list,
+                                 subscription_list) {
+                if (!memcmp(s, &sub->evt.s, sizeof(struct tipc_subscr))) {
+                        found = 1;
+                        break;
+                }
+        }
+        if (!found)
+                return;
+
+        /* Cancel subscription timer (if used), then delete subscription */
+
+        if (sub->timeout != TIPC_WAIT_FOREVER) {
+                sub->timeout = TIPC_WAIT_FOREVER;
+                spin_unlock_bh(subscriber->lock);
+                k_cancel_timer(&sub->timer);
+                k_term_timer(&sub->timer);
+                spin_lock_bh(subscriber->lock);
+        }
+        dbg("Cancel: removing sub %u,%u,%u from subscriber %x list\n",
+            sub->seq.type, sub->seq.lower, sub->seq.upper, subscriber);
+        subscr_del(sub);
+}
+
+/**
  * subscr_subscribe - create subscription for subscriber
  * 
  * Called with subscriber locked
@@ -263,6 +324,21 @@ static void subscr_subscribe(struct tipc_subscr *s,
 {
         struct subscription *sub;
 
+        /* Determine/update subscriber's endianness */
+
+        if (s->filter & (TIPC_SUB_PORTS | TIPC_SUB_SERVICE))
+                subscriber->swap = 0;
+        else
+                subscriber->swap = 1;
+
+        /* Detect & process a subscription cancellation request */
+
+        if (s->filter & htohl(TIPC_SUB_CANCEL, subscriber->swap)) {
+                s->filter &= ~htohl(TIPC_SUB_CANCEL, subscriber->swap);
+                subscr_cancel(s, subscriber);
+                return;
+        }
+
         /* Refuse subscription if global limit exceeded */
 
         if (atomic_read(&topsrv.subscription_count) >= tipc_max_subscriptions) {
@@ -281,13 +357,6 @@ static void subscr_subscribe(struct tipc_subscr *s,
                 return;
         }
 
-        /* Determine/update subscriber's endianness */
-
-        if ((s->filter == TIPC_SUB_PORTS) || (s->filter == TIPC_SUB_SERVICE))
-                subscriber->swap = 0;
-        else
-                subscriber->swap = 1;
-
         /* Initialize subscription object */
 
         memset(sub, 0, sizeof(*sub));
@@ -296,8 +365,8 @@ static void subscr_subscribe(struct tipc_subscr *s,
         sub->seq.upper = htohl(s->seq.upper, subscriber->swap);
         sub->timeout = htohl(s->timeout, subscriber->swap);
         sub->filter = htohl(s->filter, subscriber->swap);
-        if ((((sub->filter != TIPC_SUB_PORTS) 
-              && (sub->filter != TIPC_SUB_SERVICE)))
+        if ((!(sub->filter & TIPC_SUB_PORTS)
+             == !(sub->filter & TIPC_SUB_SERVICE))
             || (sub->seq.lower > sub->seq.upper)) {
                 warn("Subscription rejected, illegal request\n");
                 kfree(sub);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2a7861661f14..7736b23c3f03 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -883,30 +883,32 @@ out:
 }
 EXPORT_SYMBOL(xfrm_policy_walk);
 
-/* Find policy to apply to this flow. */
-
+/*
+ * Find policy to apply to this flow.
+ *
+ * Returns 0 if policy found, else an -errno.
+ */
 static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,
                              u8 type, u16 family, int dir)
 {
         struct xfrm_selector *sel = &pol->selector;
-        int match;
+        int match, ret = -ESRCH;
 
         if (pol->family != family ||
             pol->type != type)
-                return 0;
+                return ret;
 
         match = xfrm_selector_match(sel, fl, family);
-        if (match) {
-                if (!security_xfrm_policy_lookup(pol, fl->secid, dir))
-                        return 1;
-        }
+        if (match)
+                ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
 
-        return 0;
+        return ret;
 }
 
 static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
                                                      u16 family, u8 dir)
 {
+        int err;
         struct xfrm_policy *pol, *ret;
         xfrm_address_t *daddr, *saddr;
         struct hlist_node *entry;
@@ -922,7 +924,15 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         chain = policy_hash_direct(daddr, saddr, family, dir);
         ret = NULL;
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir)) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else {
                         ret = pol;
                         priority = ret->priority;
                         break;
@@ -930,36 +940,53 @@ static struct xfrm_policy *xfrm_policy_lookup_bytype(u8 type, struct flowi *fl,
         }
         chain = &xfrm_policy_inexact[dir];
         hlist_for_each_entry(pol, entry, chain, bydst) {
-                if (xfrm_policy_match(pol, fl, type, family, dir) &&
-                    pol->priority < priority) {
+                err = xfrm_policy_match(pol, fl, type, family, dir);
+                if (err) {
+                        if (err == -ESRCH)
+                                continue;
+                        else {
+                                ret = ERR_PTR(err);
+                                goto fail;
+                        }
+                } else if (pol->priority < priority) {
                         ret = pol;
                         break;
                 }
         }
         if (ret)
                 xfrm_pol_hold(ret);
+fail:
         read_unlock_bh(&xfrm_policy_lock);
 
         return ret;
 }
 
-static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
+static int xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp)
 {
         struct xfrm_policy *pol;
+        int err = 0;
 
 #ifdef CONFIG_XFRM_SUB_POLICY
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_SUB, fl, family, dir);
-        if (pol)
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
+        if (pol || err)
                 goto end;
 #endif
         pol = xfrm_policy_lookup_bytype(XFRM_POLICY_TYPE_MAIN, fl, family, dir);
-
+        if (IS_ERR(pol)) {
+                err = PTR_ERR(pol);
+                pol = NULL;
+        }
 #ifdef CONFIG_XFRM_SUB_POLICY
 end:
 #endif
         if ((*objp = (void *) pol) != NULL)
                 *obj_refp = &pol->refcnt;
+        return err;
 }
 
 static inline int policy_to_flow_dir(int dir)
@@ -989,12 +1016,16 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
                                                 sk->sk_family);
                 int err = 0;
 
-                if (match)
-                  err = security_xfrm_policy_lookup(pol, fl->secid, policy_to_flow_dir(dir));
-
-                if (match && !err)
-                        xfrm_pol_hold(pol);
-                else
+                if (match) {
+                        err = security_xfrm_policy_lookup(pol, fl->secid,
+                                        policy_to_flow_dir(dir));
+                        if (!err)
+                                xfrm_pol_hold(pol);
+                        else if (err == -ESRCH)
+                                pol = NULL;
+                        else
+                                pol = ERR_PTR(err);
+                } else
                         pol = NULL;
         }
         read_unlock_bh(&xfrm_policy_lock);
@@ -1286,8 +1317,11 @@ restart:
         pol_dead = 0;
         xfrm_nr = 0;
 
-        if (sk && sk->sk_policy[1])
+        if (sk && sk->sk_policy[1]) {
                 policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
+        }
 
         if (!policy) {
                 /* To accelerate a bit...  */
@@ -1297,6 +1331,8 @@ restart:
 
                 policy = flow_cache_lookup(fl, dst_orig->ops->family,
                                            dir, xfrm_policy_lookup);
+                if (IS_ERR(policy))
+                        return PTR_ERR(policy);
         }
 
         if (!policy)
@@ -1343,6 +1379,10 @@ restart:
                                                             fl, family,
                                                             XFRM_POLICY_OUT);
                         if (pols[1]) {
+                                if (IS_ERR(pols[1])) {
+                                        err = PTR_ERR(pols[1]);
+                                        goto error;
+                                }
                                 if (pols[1]->action == XFRM_POLICY_BLOCK) {
                                         err = -EPERM;
                                         goto error;
@@ -1574,13 +1614,19 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
         }
 
         pol = NULL;
-        if (sk && sk->sk_policy[dir])
+        if (sk && sk->sk_policy[dir]) {
                 pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                if (IS_ERR(pol))
+                        return 0;
+        }
 
         if (!pol)
                 pol = flow_cache_lookup(&fl, family, fl_dir,
                                         xfrm_policy_lookup);
 
+        if (IS_ERR(pol))
+                return 0;
+
         if (!pol) {
                 if (skb->sp && secpath_has_nontransport(skb->sp, 0, &xerr_idx)) {
                         xfrm_secpath_reject(xerr_idx, skb, &fl);
@@ -1599,6 +1645,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                                                     &fl, family,
                                                     XFRM_POLICY_IN);
                 if (pols[1]) {
+                        if (IS_ERR(pols[1]))
+                                return 0;
                         pols[1]->curlft.use_time = (unsigned long)xtime.tv_sec;
                         npols ++;
                 }
@@ -1706,7 +1754,7 @@ static struct dst_entry *xfrm_dst_check(struct dst_entry *dst, u32 cookie)
 
 static int stale_bundle(struct dst_entry *dst)
 {
-        return !xfrm_bundle_ok((struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
+        return !xfrm_bundle_ok(NULL, (struct xfrm_dst *)dst, NULL, AF_UNSPEC, 0);
 }
 
 void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
@@ -1828,7 +1876,8 @@ EXPORT_SYMBOL(xfrm_init_pmtu);
  * still valid.
  */
 
-int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int strict)
+int xfrm_bundle_ok(struct xfrm_policy *pol, struct xfrm_dst *first,
+                struct flowi *fl, int family, int strict)
 {
         struct dst_entry *dst = &first->u.dst;
         struct xfrm_dst *last;
@@ -1845,7 +1894,7 @@ int xfrm_bundle_ok(struct xfrm_dst *first, struct flowi *fl, int family, int str
 
                 if (fl && !xfrm_selector_match(&dst->xfrm->sel, fl, family))
                         return 0;
-                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm))
+                if (fl && !security_xfrm_flow_state_match(fl, dst->xfrm, pol))
                         return 0;
                 if (dst->xfrm->km.state != XFRM_STATE_VALID)
                         return 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 39b8bf3a9ded..899de9ed22a6 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -505,6 +505,14 @@ __xfrm_state_locate(struct xfrm_state *x, int use_spi, int family)
                                                   x->id.proto, family);
 }
 
+static void xfrm_hash_grow_check(int have_hash_collision)
+{
+        if (have_hash_collision &&
+            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
+            xfrm_state_num > xfrm_state_hmask)
+                schedule_work(&xfrm_hash_work);
+}
+
 struct xfrm_state *
 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr, 
                 struct flowi *fl, struct xfrm_tmpl *tmpl,
@@ -598,6 +606,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                         x->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
                         x->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
                         add_timer(&x->timer);
+                        xfrm_state_num++;
+                        xfrm_hash_grow_check(x->bydst.next != NULL);
                 } else {
                         x->km.state = XFRM_STATE_DEAD;
                         xfrm_state_put(x);
@@ -642,10 +652,7 @@ static void __xfrm_state_insert(struct xfrm_state *x)
 
         xfrm_state_num++;
 
-        if (x->bydst.next != NULL &&
-            (xfrm_state_hmask + 1) < xfrm_state_hashmax &&
-            xfrm_state_num > xfrm_state_hmask)
-                schedule_work(&xfrm_hash_work);
+        xfrm_hash_grow_check(x->bydst.next != NULL);
 }
 
 /* xfrm_state_lock is held */
@@ -753,6 +760,10 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                 h = xfrm_src_hash(daddr, saddr, family);
                 hlist_add_head(&x->bysrc, xfrm_state_bysrc+h);
                 wake_up(&km_waitq);
+
+                xfrm_state_num++;
+
+                xfrm_hash_grow_check(x->bydst.next != NULL);
         }
 
         return x;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d54b3a70d5df..c4cde57d9216 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -323,7 +323,7 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
         x->props.replay_window = p->replay_window;
         x->props.reqid = p->reqid;
         x->props.family = p->family;
-        x->props.saddr = p->saddr;
+        memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
         x->props.flags = p->flags;
 }
 
@@ -545,7 +545,7 @@ static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
         memcpy(&p->lft, &x->lft, sizeof(p->lft));
         memcpy(&p->curlft, &x->curlft, sizeof(p->curlft));
         memcpy(&p->stats, &x->stats, sizeof(p->stats));
-        p->saddr = x->props.saddr;
+        memcpy(&p->saddr, &x->props.saddr, sizeof(p->saddr));
         p->mode = x->props.mode;
         p->replay_window = x->props.replay_window;
         p->reqid = x->props.reqid;
@@ -1927,6 +1927,9 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -1992,15 +1995,6 @@ static struct xfrm_policy *xfrm_compile_policy(struct sock *sk, int opt,
         xp->type = XFRM_POLICY_TYPE_MAIN;
         copy_templates(xp, ut, nr);
 
-        if (!xp->security) {
-                int err = security_xfrm_sock_policy_alloc(xp, sk);
-                if (err) {
-                        kfree(xp);
-                        *dir = err;
-                        return NULL;
-                }
-        }
-
         *dir = p->dir;
 
         return xp;
@@ -2043,6 +2037,9 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
         len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -2069,6 +2066,9 @@ static int xfrm_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *
                 len += RTA_SPACE(headlen);
                 headlen = sizeof(*id);
         }
+#ifdef CONFIG_XFRM_SUB_POLICY
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
+#endif
         len += NLMSG_SPACE(headlen);
 
         skb = alloc_skb(len, GFP_ATOMIC);
@@ -2115,10 +2115,12 @@ static int xfrm_notify_policy_flush(struct km_event *c)
         struct nlmsghdr *nlh;
         struct sk_buff *skb;
         unsigned char *b;
+        int len = 0;
 #ifdef CONFIG_XFRM_SUB_POLICY
         struct xfrm_userpolicy_type upt;
+        len += RTA_SPACE(sizeof(struct xfrm_userpolicy_type));
 #endif
-        int len = NLMSG_LENGTH(0);
+        len += NLMSG_LENGTH(0);
 
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index 6a026f69b563..4241e0dfeeaf 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -168,7 +168,7 @@ $(objhdr-y) $(header-y) $(unifdef-y): $(KBUILDFILES)
         $(call cmd,gen)
 
 else
-$(objhdr-y) :           $(INSTALL_HDR_PATH)/$(_dst)/%.h: $(srctree)/$(obj)/%.h $(KBUILDFILES)
+$(objhdr-y) :           $(INSTALL_HDR_PATH)/$(_dst)/%.h: $(objtree)/$(obj)/%.h $(KBUILDFILES)
         $(call cmd,o_hdr_install)
 
 $(header-y) :           $(INSTALL_HDR_PATH)/$(_dst)/%.h: $(srctree)/$(obj)/%.h $(KBUILDFILES)
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index 6c5469b1473b..65e0a79c36cf 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -44,7 +44,7 @@ include scripts/Kbuild.include
 include scripts/Makefile.lib
 
 kernelsymfile := $(objtree)/Module.symvers
-modulesymfile := $(KBUILD_EXTMOD)/Module.symvers
+modulesymfile := $(firstword $(KBUILD_EXTMOD))/Module.symvers
 
 # Step 1), find all modules listed in $(MODVERDIR)/
 __modules := $(sort $(shell grep -h '\.ko' /dev/null $(wildcard $(MODVERDIR)/*.mod)))
diff --git a/scripts/basic/docproc.c b/scripts/basic/docproc.c
index 4ab6cbf09225..d6071cbf13d7 100644
--- a/scripts/basic/docproc.c
+++ b/scripts/basic/docproc.c
@@ -250,7 +250,7 @@ void intfunc(char * filename) {	docfunctions(filename, NOFUNCTION); }
 void extfunc(char * filename) { docfunctions(filename, FUNCTION);   }
 
 /*
- * Document spåecific function(s) in a file.
+ * Document specific function(s) in a file.
  * Call kernel-doc with the following parameters:
  * kernel-doc -docbook -function function1 [-function function2]
  */
diff --git a/scripts/kconfig/.gitignore b/scripts/kconfig/.gitignore
index e8ad1f6b3da4..b49584c932cc 100644
--- a/scripts/kconfig/.gitignore
+++ b/scripts/kconfig/.gitignore
@@ -6,6 +6,8 @@ lex.*.c
 *.tab.c
 *.tab.h
 zconf.hash.c
+*.moc
+lkc_defs.h
 
 #
 # configuration programs
diff --git a/scripts/kconfig/lxdialog/dialog.h b/scripts/kconfig/lxdialog/dialog.h
index 8dea47f9d3e4..fd695e1070f7 100644
--- a/scripts/kconfig/lxdialog/dialog.h
+++ b/scripts/kconfig/lxdialog/dialog.h
@@ -24,6 +24,7 @@
 #include <ctype.h>
 #include <stdlib.h>
 #include <string.h>
+#include <stdbool.h>
 
 #ifdef __sun__
 #define CURS_MACROS
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 00d1ad19b2cc..187f5de4612c 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1262,7 +1262,9 @@ sub output_intro_text(%) {
 }
 
 ##
-# generic output function for typedefs
+# generic output function for all types (function, struct/union, typedef, enum);
+# calls the generated, variable output_ function name based on
+# functype and output_mode
 sub output_declaration {
     no strict 'refs';
     my $name = shift;
@@ -1278,8 +1280,7 @@ sub output_declaration {
 }
 
 ##
-# generic output function - calls the right one based
-# on current output mode.
+# generic output function - calls the right one based on current output mode.
 sub output_intro {
     no strict 'refs';
     my $func = "output_intro_".$output_mode;
@@ -1518,6 +1519,9 @@ sub dump_function($$) {
     $prototype =~ s/^asmlinkage +//;
     $prototype =~ s/^inline +//;
     $prototype =~ s/^__inline__ +//;
+    $prototype =~ s/^__inline +//;
+    $prototype =~ s/^__always_inline +//;
+    $prototype =~ s/^noinline +//;
     $prototype =~ s/__devinit +//;
     $prototype =~ s/^#define +//; #ak added
     $prototype =~ s/__attribute__ \(\([a-z,]*\)\)//;
@@ -1778,8 +1782,9 @@ sub process_file($) {
                 $in_doc_sect = 1;
                 $contents = $newcontents;
                 if ($contents ne "") {
-                    if (substr($contents, 0, 1) eq " ") {
-                        $contents = substr($contents, 1);
+                    while ((substr($contents, 0, 1) eq " ") ||
+                        substr($contents, 0, 1) eq "\t") {
+                            $contents = substr($contents, 1);
                     }
                     $contents .= "\n";
                 }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 41277963f47a..2e1141623147 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -921,6 +921,8 @@ static int init_section_ref_ok(const char *name)
                 ".fixup",
                 ".smp_locks",
                 ".plt",  /* seen on ARCH=um build on x86_64. Harmless */
+                "__ftr_fixup",          /* powerpc cpu feature fixup */
+                "__fw_ftr_fixup",       /* powerpc firmware feature fixup */
                 NULL
         };
         /* Start of section names */
diff --git a/security/dummy.c b/security/dummy.c
index aeee70565509..43874c1e6e23 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -881,7 +881,8 @@ static int dummy_xfrm_state_pol_flow_match(struct xfrm_state *x,
         return 1;
 }
 
-static int dummy_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm)
+static int dummy_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
+                                struct xfrm_policy *xp)
 {
         return 1;
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e9969a2fc846..8ab5679a37a3 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3313,7 +3313,13 @@ static int selinux_socket_getpeername(struct socket *sock)
 
 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
 {
-        return socket_has_perm(current, sock, SOCKET__SETOPT);
+        int err;
+
+        err = socket_has_perm(current, sock, SOCKET__SETOPT);
+        if (err)
+                return err;
+
+        return selinux_netlbl_socket_setsockopt(sock, level, optname);
 }
 
 static int selinux_socket_getsockopt(struct socket *sock, int level,
diff --git a/security/selinux/include/selinux_netlabel.h b/security/selinux/include/selinux_netlabel.h
index ecab4bddaaf4..9de10cc2cef2 100644
--- a/security/selinux/include/selinux_netlabel.h
+++ b/security/selinux/include/selinux_netlabel.h
@@ -53,6 +53,9 @@ void selinux_netlbl_sk_security_init(struct sk_security_struct *ssec,
 void selinux_netlbl_sk_clone_security(struct sk_security_struct *ssec,
                                       struct sk_security_struct *newssec);
 int selinux_netlbl_inode_permission(struct inode *inode, int mask);
+int selinux_netlbl_socket_setsockopt(struct socket *sock,
+                                     int level,
+                                     int optname);
 #else
 static inline void selinux_netlbl_cache_invalidate(void)
 {
@@ -114,6 +117,13 @@ static inline int selinux_netlbl_inode_permission(struct inode *inode,
 {
         return 0;
 }
+
+static inline int selinux_netlbl_socket_setsockopt(struct socket *sock,
+                                                   int level,
+                                                   int optname)
+{
+        return 0;
+}
 #endif /* CONFIG_NETLABEL */
 
 #endif
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 81eb59890162..526b28019aca 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -19,7 +19,8 @@ int selinux_xfrm_state_delete(struct xfrm_state *x);
 int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
 int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
                         struct xfrm_policy *xp, struct flowi *fl);
-int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm);
+int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
+                        struct xfrm_policy *xp);
 
 
 /*
diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
index cfed1d30fa6a..d539346ab3a2 100644
--- a/security/selinux/ss/ebitmap.c
+++ b/security/selinux/ss/ebitmap.c
@@ -93,11 +93,15 @@ int ebitmap_export(const struct ebitmap *src,
         size_t bitmap_byte;
         unsigned char bitmask;
 
+        if (src->highbit == 0) {
+                *dst = NULL;
+                *dst_len = 0;
+                return 0;
+        }
+
         bitmap_len = src->highbit / 8;
         if (src->highbit % 7)
                 bitmap_len += 1;
-        if (bitmap_len == 0)
-                return -EINVAL;
 
         bitmap = kzalloc((bitmap_len & ~(sizeof(MAPTYPE) - 1)) +
                          sizeof(MAPTYPE),
diff --git a/security/selinux/ss/mls.c b/security/selinux/ss/mls.c
index c713af23250a..2cca8e251624 100644
--- a/security/selinux/ss/mls.c
+++ b/security/selinux/ss/mls.c
@@ -640,8 +640,13 @@ int mls_export_cat(const struct context *context,
 {
         int rc = -EPERM;
 
-        if (!selinux_mls_enabled)
+        if (!selinux_mls_enabled) {
+                *low = NULL;
+                *low_len = 0;
+                *high = NULL;
+                *high_len = 0;
                 return 0;
+        }
 
         if (low != NULL) {
                 rc = ebitmap_export(&context->range.level[0].cat,
@@ -661,10 +666,16 @@ int mls_export_cat(const struct context *context,
         return 0;
 
 export_cat_failure:
-        if (low != NULL)
+        if (low != NULL) {
                 kfree(*low);
-        if (high != NULL)
+                *low = NULL;
+                *low_len = 0;
+        }
+        if (high != NULL) {
                 kfree(*high);
+                *high = NULL;
+                *high_len = 0;
+        }
         return rc;
 }
 
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index b18895302555..ba48961f9d05 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -618,6 +618,7 @@ void policydb_destroy(struct policydb *p)
                         c = c->next;
                         ocontext_destroy(ctmp,i);
                 }
+                p->ocontexts[i] = NULL;
         }
 
         g = p->genfs;
@@ -633,6 +634,7 @@ void policydb_destroy(struct policydb *p)
                 g = g->next;
                 kfree(gtmp);
         }
+        p->genfs = NULL;
 
         cond_policydb_destroy(p);
 
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 0c219a1b3243..bfe122764c98 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -2172,7 +2172,12 @@ struct netlbl_cache {
  */
 static void selinux_netlbl_cache_free(const void *data)
 {
-        struct netlbl_cache *cache = NETLBL_CACHE(data);
+        struct netlbl_cache *cache;
+
+        if (data == NULL)
+                return;
+
+        cache = NETLBL_CACHE(data);
         switch (cache->type) {
         case NETLBL_CACHE_T_MLS:
                 ebitmap_destroy(&cache->data.mls_label.level[0].cat);
@@ -2197,17 +2202,20 @@ static void selinux_netlbl_cache_add(struct sk_buff *skb, struct context *ctx)
         struct netlbl_lsm_secattr secattr;
 
         netlbl_secattr_init(&secattr);
+        secattr.cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
+        if (secattr.cache == NULL)
+                goto netlbl_cache_add_return;
 
         cache = kzalloc(sizeof(*cache), GFP_ATOMIC);
         if (cache == NULL)
-                goto netlbl_cache_add_failure;
-        secattr.cache.free = selinux_netlbl_cache_free;
-        secattr.cache.data = (void *)cache;
+                goto netlbl_cache_add_return;
+        secattr.cache->free = selinux_netlbl_cache_free;
+        secattr.cache->data = (void *)cache;
 
         cache->type = NETLBL_CACHE_T_MLS;
         if (ebitmap_cpy(&cache->data.mls_label.level[0].cat,
                         &ctx->range.level[0].cat) != 0)
-                goto netlbl_cache_add_failure;
+                goto netlbl_cache_add_return;
         cache->data.mls_label.level[1].cat.highbit =
                 cache->data.mls_label.level[0].cat.highbit;
         cache->data.mls_label.level[1].cat.node =
@@ -2215,13 +2223,10 @@ static void selinux_netlbl_cache_add(struct sk_buff *skb, struct context *ctx)
         cache->data.mls_label.level[0].sens = ctx->range.level[0].sens;
         cache->data.mls_label.level[1].sens = ctx->range.level[0].sens;
 
-        if (netlbl_cache_add(skb, &secattr) != 0)
-                goto netlbl_cache_add_failure;
-
-        return;
+        netlbl_cache_add(skb, &secattr);
 
-netlbl_cache_add_failure:
-        netlbl_secattr_destroy(&secattr, 1);
+netlbl_cache_add_return:
+        netlbl_secattr_destroy(&secattr);
 }
 
 /**
@@ -2263,8 +2268,8 @@ static int selinux_netlbl_secattr_to_sid(struct sk_buff *skb,
 
         POLICY_RDLOCK;
 
-        if (secattr->cache.data) {
-                cache = NETLBL_CACHE(secattr->cache.data);
+        if (secattr->cache) {
+                cache = NETLBL_CACHE(secattr->cache->data);
                 switch (cache->type) {
                 case NETLBL_CACHE_T_SID:
                         *sid = cache->data.sid;
@@ -2331,7 +2336,7 @@ static int selinux_netlbl_secattr_to_sid(struct sk_buff *skb,
                         selinux_netlbl_cache_add(skb, &ctx_new);
                 ebitmap_destroy(&ctx_new.range.level[0].cat);
         } else {
-                *sid = SECINITSID_UNLABELED;
+                *sid = SECSID_NULL;
                 rc = 0;
         }
 
@@ -2369,7 +2374,7 @@ static int selinux_netlbl_skbuff_getsid(struct sk_buff *skb,
                                                    &secattr,
                                                    base_sid,
                                                    sid);
-        netlbl_secattr_destroy(&secattr, 0);
+        netlbl_secattr_destroy(&secattr);
 
         return rc;
 }
@@ -2394,31 +2399,33 @@ static int selinux_netlbl_socket_setsid(struct socket *sock, u32 sid)
         if (!ss_initialized)
                 return 0;
 
+        netlbl_secattr_init(&secattr);
+
         POLICY_RDLOCK;
 
         ctx = sidtab_search(&sidtab, sid);
         if (ctx == NULL)
                 goto netlbl_socket_setsid_return;
 
-        netlbl_secattr_init(&secattr);
         secattr.domain = kstrdup(policydb.p_type_val_to_name[ctx->type - 1],
                                  GFP_ATOMIC);
         mls_export_lvl(ctx, &secattr.mls_lvl, NULL);
         secattr.mls_lvl_vld = 1;
-        mls_export_cat(ctx,
-                       &secattr.mls_cat,
-                       &secattr.mls_cat_len,
-                       NULL,
-                       NULL);
+        rc = mls_export_cat(ctx,
+                            &secattr.mls_cat,
+                            &secattr.mls_cat_len,
+                            NULL,
+                            NULL);
+        if (rc != 0)
+                goto netlbl_socket_setsid_return;
 
         rc = netlbl_socket_setattr(sock, &secattr);
         if (rc == 0)
                 sksec->nlbl_state = NLBL_LABELED;
 
-        netlbl_secattr_destroy(&secattr, 0);
-
 netlbl_socket_setsid_return:
         POLICY_RDUNLOCK;
+        netlbl_secattr_destroy(&secattr);
         return rc;
 }
 
@@ -2514,10 +2521,10 @@ void selinux_netlbl_sock_graft(struct sock *sk, struct socket *sock)
         if (netlbl_sock_getattr(sk, &secattr) == 0 &&
             selinux_netlbl_secattr_to_sid(NULL,
                                           &secattr,
-                                          sksec->sid,
+                                          SECINITSID_UNLABELED,
                                           &nlbl_peer_sid) == 0)
                 sksec->peer_sid = nlbl_peer_sid;
-        netlbl_secattr_destroy(&secattr, 0);
+        netlbl_secattr_destroy(&secattr);
 
         sksec->nlbl_state = NLBL_REQUIRE;
 
@@ -2547,9 +2554,6 @@ u32 selinux_netlbl_inet_conn_request(struct sk_buff *skb, u32 sock_sid)
         if (rc != 0)
                 return SECSID_NULL;
 
-        if (peer_sid == SECINITSID_UNLABELED)
-                return SECSID_NULL;
-
         return peer_sid;
 }
 
@@ -2611,11 +2615,13 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
         u32 netlbl_sid;
         u32 recv_perm;
 
-        rc = selinux_netlbl_skbuff_getsid(skb, SECINITSID_NETMSG, &netlbl_sid);
+        rc = selinux_netlbl_skbuff_getsid(skb,
+                                          SECINITSID_UNLABELED,
+                                          &netlbl_sid);
         if (rc != 0)
                 return rc;
 
-        if (netlbl_sid == SECINITSID_UNLABELED)
+        if (netlbl_sid == SECSID_NULL)
                 return 0;
 
         switch (sksec->sclass) {
@@ -2653,10 +2659,6 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
 u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock)
 {
         struct sk_security_struct *sksec = sock->sk->sk_security;
-
-        if (sksec->peer_sid == SECINITSID_UNLABELED)
-                return SECSID_NULL;
-
         return sksec->peer_sid;
 }
 
@@ -2672,18 +2674,49 @@ u32 selinux_netlbl_socket_getpeersec_stream(struct socket *sock)
 u32 selinux_netlbl_socket_getpeersec_dgram(struct sk_buff *skb)
 {
         int peer_sid;
-        struct sock *sk = skb->sk;
-        struct inode_security_struct *isec;
 
-        if (sk == NULL || sk->sk_socket == NULL)
-                return SECSID_NULL;
-
-        isec = SOCK_INODE(sk->sk_socket)->i_security;
-        if (selinux_netlbl_skbuff_getsid(skb, isec->sid, &peer_sid) != 0)
-                return SECSID_NULL;
-        if (peer_sid == SECINITSID_UNLABELED)
+        if (selinux_netlbl_skbuff_getsid(skb,
+                                         SECINITSID_UNLABELED,
+                                         &peer_sid) != 0)
                 return SECSID_NULL;
 
         return peer_sid;
 }
+
+/**
+ * selinux_netlbl_socket_setsockopt - Do not allow users to remove a NetLabel
+ * @sock: the socket
+ * @level: the socket level or protocol
+ * @optname: the socket option name
+ *
+ * Description:
+ * Check the setsockopt() call and if the user is trying to replace the IP
+ * options on a socket and a NetLabel is in place for the socket deny the
+ * access; otherwise allow the access.  Returns zero when the access is
+ * allowed, -EACCES when denied, and other negative values on error.
+ *
+ */
+int selinux_netlbl_socket_setsockopt(struct socket *sock,
+                                     int level,
+                                     int optname)
+{
+        int rc = 0;
+        struct inode *inode = SOCK_INODE(sock);
+        struct sk_security_struct *sksec = sock->sk->sk_security;
+        struct inode_security_struct *isec = inode->i_security;
+        struct netlbl_lsm_secattr secattr;
+
+        mutex_lock(&isec->lock);
+        if (level == IPPROTO_IP && optname == IP_OPTIONS &&
+            sksec->nlbl_state == NLBL_LABELED) {
+                netlbl_secattr_init(&secattr);
+                rc = netlbl_socket_getattr(sock, &secattr);
+                if (rc == 0 && (secattr.cache || secattr.mls_lvl_vld))
+                        rc = -EACCES;
+                netlbl_secattr_destroy(&secattr);
+        }
+        mutex_unlock(&isec->lock);
+
+        return rc;
+}
 #endif /* CONFIG_NETLABEL */
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index 3e742b850af6..675b995a67c3 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -77,8 +77,8 @@ static inline int selinux_authorizable_xfrm(struct xfrm_state *x)
  */
 int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
 {
-        int rc = 0;
-        u32 sel_sid = SECINITSID_UNLABELED;
+        int rc;
+        u32 sel_sid;
         struct xfrm_sec_ctx *ctx;
 
         /* Context sid is either set to label or ANY_ASSOC */
@@ -88,11 +88,21 @@ int selinux_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
 
                 sel_sid = ctx->ctx_sid;
         }
+        else
+                /*
+                 * All flows should be treated as polmatch'ing an
+                 * otherwise applicable "non-labeled" policy. This
+                 * would prevent inadvertent "leaks".
+                 */
+                return 0;
 
         rc = avc_has_perm(fl_secid, sel_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__POLMATCH,
                           NULL);
 
+        if (rc == -EACCES)
+                rc = -ESRCH;
+
         return rc;
 }
 
@@ -108,15 +118,20 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
         u32 pol_sid;
         int err;
 
-        if (x->security)
-                state_sid = x->security->ctx_sid;
-        else
-                state_sid = SECINITSID_UNLABELED;
-
-        if (xp->security)
+        if (xp->security) {
+                if (!x->security)
+                        /* unlabeled SA and labeled policy can't match */
+                        return 0;
+                else
+                        state_sid = x->security->ctx_sid;
                 pol_sid = xp->security->ctx_sid;
-        else
-                pol_sid = SECINITSID_UNLABELED;
+        } else
+                if (x->security)
+                        /* unlabeled policy and labeled SA can't match */
+                        return 0;
+                else
+                        /* unlabeled policy and unlabeled SA match all flows */
+                        return 1;
 
         err = avc_has_perm(state_sid, pol_sid, SECCLASS_ASSOCIATION,
                           ASSOCIATION__POLMATCH,
@@ -125,7 +140,11 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
         if (err)
                 return 0;
 
-        return selinux_xfrm_flow_state_match(fl, x);
+        err = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
+                          ASSOCIATION__SENDTO,
+                          NULL)? 0:1;
+
+        return err;
 }
 
 /*
@@ -133,12 +152,22 @@ int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *
  * can use a given security association.
  */
 
-int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm)
+int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm,
+                                  struct xfrm_policy *xp)
 {
         int rc = 0;
         u32 sel_sid = SECINITSID_UNLABELED;
         struct xfrm_sec_ctx *ctx;
 
+        if (!xp->security)
+                if (!xfrm->security)
+                        return 1;
+                else
+                        return 0;
+        else
+                if (!xfrm->security)
+                        return 0;
+
         /* Context sid is either set to label or ANY_ASSOC */
         if ((ctx = xfrm->security)) {
                 if (!selinux_authorizable_ctx(ctx))
diff --git a/sound/core/control.c b/sound/core/control.c
index 6973a9686b67..48ef0a09a7a7 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1018,10 +1018,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
         }
         switch (info->type) {
         case SNDRV_CTL_ELEM_TYPE_BOOLEAN:
-                private_size = sizeof(char);
-                if (info->count > 128)
-                        return -EINVAL;
-                break;
         case SNDRV_CTL_ELEM_TYPE_INTEGER:
                 private_size = sizeof(long);
                 if (info->count > 128)
diff --git a/sound/core/info.c b/sound/core/info.c
index e43662b33f16..0b4aab3225e5 100644
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -120,7 +120,10 @@ int snd_iprintf(struct snd_info_buffer *buffer, char *fmt,...)
         len = buffer->len - buffer->size;
         va_start(args, fmt);
         for (;;) {
-                res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, args);
+                va_list ap;
+                va_copy(ap, args);
+                res = vsnprintf(buffer->buffer + buffer->curr, len, fmt, ap);
+                va_end(ap);
                 if (res < len)
                         break;
                 err = resize_info_buffer(buffer, buffer->len + PAGE_SIZE);
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index 557c4de22960..57371f1a441f 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -13,6 +13,7 @@ config SND_CS4231_LIB
 
 config SND_ADLIB
         tristate "AdLib FM card"
+        depends on SND
         select SND_OPL3_LIB
         help
           Say Y here to include support for AdLib FM cards.
diff --git a/sound/isa/ad1816a/ad1816a.c b/sound/isa/ad1816a/ad1816a.c
index b33a5fb59ec2..59034507175b 100644
--- a/sound/isa/ad1816a/ad1816a.c
+++ b/sound/isa/ad1816a/ad1816a.c
@@ -120,6 +120,8 @@ static int __devinit snd_card_ad1816a_pnp(int dev, struct snd_card_ad1816a *acar
         struct pnp_resource_table *cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
         int err;
 
+        if (!cfg)
+                return -ENOMEM;
         acard->dev = pnp_request_card_device(card, id->devs[0].id, NULL);
         if (acard->dev == NULL) {
                 kfree(cfg);
diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
index 3c1e9fd56fe0..d1f6dfcec46e 100644
--- a/sound/isa/cmi8330.c
+++ b/sound/isa/cmi8330.c
@@ -289,6 +289,8 @@ static int __devinit snd_cmi8330_pnp(int dev, struct snd_cmi8330 *acard,
         struct pnp_resource_table * cfg = kmalloc(sizeof(struct pnp_resource_table), GFP_KERNEL);
         int err;
 
+        if (!cfg)
+                return -ENOMEM;
         acard->cap = pnp_request_card_device(card, id->devs[0].id, NULL);
         if (acard->cap == NULL) {
                 kfree(cfg);
diff --git a/sound/isa/gus/interwave.c b/sound/isa/gus/interwave.c
index f12cd09d1fcc..4ec2d79431fc 100644
--- a/sound/isa/gus/interwave.c
+++ b/sound/isa/gus/interwave.c
@@ -564,6 +564,8 @@ static int __devinit snd_interwave_pnp(int dev, struct snd_interwave *iwcard,
         struct pnp_resource_table * cfg = kmalloc(sizeof(struct pnp_resource_table), GFP_KERNEL);
         int err;
 
+        if (!cfg)
+                return -ENOMEM;
         iwcard->dev = pnp_request_card_device(card, id->devs[0].id, NULL);
         if (iwcard->dev == NULL) {
                 kfree(cfg);
diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
index a1ad39a8cdce..df227377c333 100644
--- a/sound/isa/opti9xx/opti92x-ad1848.c
+++ b/sound/isa/opti9xx/opti92x-ad1848.c
@@ -1683,6 +1683,8 @@ static int __init snd_card_opti9xx_pnp(struct snd_opti9xx *chip, struct pnp_card
         struct pnp_resource_table *cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
         int err;
 
+        if (!cfg)
+                return -ENOMEM;
         chip->dev = pnp_request_card_device(card, pid->devs[0].id, NULL);
         if (chip->dev == NULL) {
                 kfree(cfg);
diff --git a/sound/oss/sh_dac_audio.c b/sound/oss/sh_dac_audio.c
index 3b3b4da8cfd3..51f554154c48 100644
--- a/sound/oss/sh_dac_audio.c
+++ b/sound/oss/sh_dac_audio.c
@@ -26,7 +26,7 @@
 #include <asm/cpu/dac.h>
 #include <asm/cpu/timer.h>
 #include <asm/machvec.h>
-#include <asm/hp6xx/hp6xx.h>
+#include <asm/hp6xx.h>
 #include <asm/hd64461.h>
 
 #define MODNAME "sh_dac_audio"
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index a79e91850ba3..6577b2325357 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -570,8 +570,7 @@ int snd_ac97_put_volsw(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value
                         ac97->power_up &= ~(1 << (reg>>1));
                 else
                         ac97->power_up |= 1 << (reg>>1);
-                if (power_save)
-                        update_power_regs(ac97);
+                update_power_regs(ac97);
         }
 #endif
         return err;
@@ -2337,10 +2336,7 @@ int snd_ac97_update_power(struct snd_ac97 *ac97, int reg, int powerup)
                 }
         }
 
-        if (! power_save)
-                return 0;
-
-        if (! powerup && ac97->power_workq)
+        if (power_save && !powerup && ac97->power_workq)
                 /* adjust power-down bits after two seconds delay
                  * (for avoiding loud click noises for many (OSS) apps
                  *  that open/close frequently)
diff --git a/sound/pci/ali5451/ali5451.c b/sound/pci/ali5451/ali5451.c
index 13a8cefa7749..a7edd56542d4 100644
--- a/sound/pci/ali5451/ali5451.c
+++ b/sound/pci/ali5451/ali5451.c
@@ -2032,8 +2032,10 @@ static int ali_suspend(struct pci_dev *pci, pm_message_t state)
         outl(0xffffffff, ALI_REG(chip, ALI_STOP));
 
         spin_unlock_irq(&chip->reg_lock);
+
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2048,8 +2050,15 @@ static int ali_resume(struct pci_dev *pci)
         if (! im)
                 return 0;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "ali5451: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
+        pci_set_master(pci);
 
         spin_lock_irq(&chip->reg_lock);
         
diff --git a/sound/pci/als300.c b/sound/pci/als300.c
index 9b16c299f0a9..95f70f3cc37e 100644
--- a/sound/pci/als300.c
+++ b/sound/pci/als300.c
@@ -768,9 +768,9 @@ static int snd_als300_suspend(struct pci_dev *pci, pm_message_t state)
         snd_pcm_suspend_all(chip->pcm);
         snd_ac97_suspend(chip->ac97);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -779,9 +779,14 @@ static int snd_als300_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct snd_als300 *chip = card->private_data;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "als300: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_als300_init(chip);
diff --git a/sound/pci/als4000.c b/sound/pci/als4000.c
index 15fc3929b5f7..8fb55d3b454b 100644
--- a/sound/pci/als4000.c
+++ b/sound/pci/als4000.c
@@ -804,9 +804,9 @@ static int snd_als4000_suspend(struct pci_dev *pci, pm_message_t state)
         snd_pcm_suspend_all(chip->pcm);
         snd_sbmixer_suspend(chip);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -816,9 +816,14 @@ static int snd_als4000_resume(struct pci_dev *pci)
         struct snd_card_als4000 *acard = card->private_data;
         struct snd_sb *chip = acard->chip;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "als4000: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_als4000_configure(chip);
diff --git a/sound/pci/atiixp.c b/sound/pci/atiixp.c
index 3e8fc5a0006a..e3e99f396711 100644
--- a/sound/pci/atiixp.c
+++ b/sound/pci/atiixp.c
@@ -1442,9 +1442,9 @@ static int snd_atiixp_suspend(struct pci_dev *pci, pm_message_t state)
         snd_atiixp_aclink_down(chip);
         snd_atiixp_chip_stop(chip);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1454,9 +1454,14 @@ static int snd_atiixp_resume(struct pci_dev *pci)
         struct atiixp *chip = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "atiixp: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_atiixp_aclink_reset(chip);
diff --git a/sound/pci/atiixp_modem.c b/sound/pci/atiixp_modem.c
index c5dda1bf3d46..dc54f2c68ed7 100644
--- a/sound/pci/atiixp_modem.c
+++ b/sound/pci/atiixp_modem.c
@@ -1128,9 +1128,9 @@ static int snd_atiixp_suspend(struct pci_dev *pci, pm_message_t state)
         snd_atiixp_aclink_down(chip);
         snd_atiixp_chip_stop(chip);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1140,9 +1140,14 @@ static int snd_atiixp_resume(struct pci_dev *pci)
         struct atiixp_modem *chip = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "atiixp-modem: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_atiixp_aclink_reset(chip);
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 692f203d65d8..2414ee630756 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -1903,9 +1903,9 @@ snd_azf3328_suspend(struct pci_dev *pci, pm_message_t state)
         for (reg = 0; reg < AZF_IO_SIZE_SYNTH_PM / 2; reg++)
                 chip->saved_regs_synth[reg] = inw(chip->synth_port + reg * 2);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1916,9 +1916,14 @@ snd_azf3328_resume(struct pci_dev *pci)
         struct snd_azf3328 *chip = card->private_data;
         int reg;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "azt3328: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         for (reg = 0; reg < AZF_IO_SIZE_IO2_PM / 2; reg++)
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
index 1f7e71083069..0093cd1f92db 100644
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -3122,9 +3122,9 @@ static int snd_cmipci_suspend(struct pci_dev *pci, pm_message_t state)
         /* disable ints */
         snd_cmipci_write(cm, CM_REG_INT_HLDCLR, 0);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -3134,9 +3134,14 @@ static int snd_cmipci_resume(struct pci_dev *pci)
         struct cmipci *cm = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "cmipci: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         /* reset / initialize to a sane state */
diff --git a/sound/pci/cs4281.c b/sound/pci/cs4281.c
index d54924e60bb1..0905fa88129d 100644
--- a/sound/pci/cs4281.c
+++ b/sound/pci/cs4281.c
@@ -2050,6 +2050,7 @@ static int cs4281_suspend(struct pci_dev *pci, pm_message_t state)
 
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2060,8 +2061,14 @@ static int cs4281_resume(struct pci_dev *pci)
         unsigned int i;
         u32 ulCLK;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "cs4281: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         ulCLK = snd_cs4281_peekBA0(chip, BA0_CLKCR1);
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 16d4ebf2a33f..2807b9756ef0 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -3687,8 +3687,10 @@ int snd_cs46xx_suspend(struct pci_dev *pci, pm_message_t state)
         /* disable CLKRUN */
         chip->active_ctrl(chip, -chip->amplifier);
         chip->amplifier = amp_saved; /* restore the status */
+
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -3698,9 +3700,16 @@ int snd_cs46xx_resume(struct pci_dev *pci)
         struct snd_cs46xx *chip = card->private_data;
         int amp_saved;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "cs46xx: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
+
         amp_saved = chip->amplifier;
         chip->amplifier = 0;
         chip->active_ctrl(chip, 1); /* force to on */
diff --git a/sound/pci/cs5535audio/cs5535audio_pm.c b/sound/pci/cs5535audio/cs5535audio_pm.c
index aad0e69db9c1..3e4d198a4502 100644
--- a/sound/pci/cs5535audio/cs5535audio_pm.c
+++ b/sound/pci/cs5535audio/cs5535audio_pm.c
@@ -73,9 +73,10 @@ int snd_cs5535audio_suspend(struct pci_dev *pci, pm_message_t state)
         snd_ac97_suspend(cs5535au->ac97);
         /* save important regs, then disable aclink in hw */
         snd_cs5535audio_stop_hardware(cs5535au);
+
         pci_disable_device(pci);
         pci_save_state(pci);
-
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -87,8 +88,14 @@ int snd_cs5535audio_resume(struct pci_dev *pci)
         int timeout;
         int i;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "cs5535audio: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         /* set LNK_WRM_RST to reset AC link */
diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
index 493ec0816bb3..55caf341933a 100644
--- a/sound/pci/emu10k1/emu10k1.c
+++ b/sound/pci/emu10k1/emu10k1.c
@@ -226,9 +226,9 @@ static int snd_emu10k1_suspend(struct pci_dev *pci, pm_message_t state)
 
         snd_emu10k1_done(emu);
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -237,11 +237,16 @@ static int snd_emu10k1_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct snd_emu10k1 *emu = card->private_data;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "emu10k1: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
-        
+
         snd_emu10k1_resume_init(emu);
         snd_emu10k1_efx_resume(emu);
         snd_ac97_resume(emu->ac97);
diff --git a/sound/pci/ens1370.c b/sound/pci/ens1370.c
index 8cb4fb2412db..d2a811f222c9 100644
--- a/sound/pci/ens1370.c
+++ b/sound/pci/ens1370.c
@@ -2072,9 +2072,10 @@ static int snd_ensoniq_suspend(struct pci_dev *pci, pm_message_t state)
         udelay(100);
         snd_ak4531_suspend(ensoniq->u.es1370.ak4531);
 #endif  
-        pci_set_power_state(pci, PCI_D3hot);
+
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2083,9 +2084,14 @@ static int snd_ensoniq_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct ensoniq *ensoniq = card->private_data;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR DRIVER_NAME ": pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_ensoniq_chip_init(ensoniq);
diff --git a/sound/pci/es1938.c b/sound/pci/es1938.c
index 2da988f78ba7..1a8d36df4b5d 100644
--- a/sound/pci/es1938.c
+++ b/sound/pci/es1938.c
@@ -1481,10 +1481,14 @@ static int es1938_suspend(struct pci_dev *pci, pm_message_t state)
                 *d = snd_es1938_reg_read(chip, *s);
 
         outb(0x00, SLIO_REG(chip, IRQCONTROL)); /* disable irqs */
-        if (chip->irq >= 0)
+        if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, chip);
+                chip->irq = -1;
+        }
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1494,10 +1498,22 @@ static int es1938_resume(struct pci_dev *pci)
         struct es1938 *chip = card->private_data;
         unsigned char *s, *d;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
-        request_irq(pci->irq, snd_es1938_interrupt,
-                    IRQF_DISABLED|IRQF_SHARED, "ES1938", chip);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "es1938: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
+
+        if (request_irq(pci->irq, snd_es1938_interrupt,
+                        IRQF_DISABLED|IRQF_SHARED, "ES1938", chip)) {
+                printk(KERN_ERR "es1938: unable to grab IRQ %d, "
+                       "disabling device\n", pci->irq);
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         chip->irq = pci->irq;
         snd_es1938_chip_init(chip);
 
@@ -1556,8 +1572,10 @@ static int snd_es1938_free(struct es1938 *chip)
 
         snd_es1938_free_gameport(chip);
 
-        if (chip->irq >= 0)
+        if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, chip);
+        }
         pci_release_regions(chip->pci);
         pci_disable_device(chip->pci);
         kfree(chip);
@@ -1602,6 +1620,7 @@ static int __devinit snd_es1938_create(struct snd_card *card,
         spin_lock_init(&chip->mixer_lock);
         chip->card = card;
         chip->pci = pci;
+        chip->irq = -1;
         if ((err = pci_request_regions(pci, "ESS Solo-1")) < 0) {
                 kfree(chip);
                 pci_disable_device(pci);
diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c
index b9d723c7e1db..092da53e1464 100644
--- a/sound/pci/es1968.c
+++ b/sound/pci/es1968.c
@@ -432,46 +432,6 @@ MODULE_PARM_DESC(joystick, "Enable joystick.");
 #define ESM_MODE_PLAY           0
 #define ESM_MODE_CAPTURE        1
 
-/* acpi states */
-enum {
-        ACPI_D0=0,
-        ACPI_D1,
-        ACPI_D2,
-        ACPI_D3
-};
-
-/* bits in the acpi masks */
-#define ACPI_12MHZ      ( 1 << 15)
-#define ACPI_24MHZ      ( 1 << 14)
-#define ACPI_978        ( 1 << 13)
-#define ACPI_SPDIF      ( 1 << 12)
-#define ACPI_GLUE       ( 1 << 11)
-#define ACPI__10        ( 1 << 10) /* reserved */
-#define ACPI_PCIINT     ( 1 << 9)
-#define ACPI_HV         ( 1 << 8) /* hardware volume */
-#define ACPI_GPIO       ( 1 << 7)
-#define ACPI_ASSP       ( 1 << 6)
-#define ACPI_SB         ( 1 << 5) /* sb emul */
-#define ACPI_FM         ( 1 << 4) /* fm emul */
-#define ACPI_RB         ( 1 << 3) /* ringbus / aclink */
-#define ACPI_MIDI       ( 1 << 2) 
-#define ACPI_GP         ( 1 << 1) /* game port */
-#define ACPI_WP         ( 1 << 0) /* wave processor */
-
-#define ACPI_ALL        (0xffff)
-#define ACPI_SLEEP      (~(ACPI_SPDIF|ACPI_ASSP|ACPI_SB|ACPI_FM| \
-                        ACPI_MIDI|ACPI_GP|ACPI_WP))
-#define ACPI_NONE       (ACPI__10)
-
-/* these masks indicate which units we care about at
-        which states */
-static u16 acpi_state_mask[] = {
-        [ACPI_D0] = ACPI_ALL,
-        [ACPI_D1] = ACPI_SLEEP,
-        [ACPI_D2] = ACPI_SLEEP,
-        [ACPI_D3] = ACPI_NONE
-};
-
 
 /* APU use in the driver */
 enum snd_enum_apu_type {
@@ -2160,21 +2120,6 @@ static void snd_es1968_reset(struct es1968 *chip)
 }
 
 /*
- * power management
- */
-static void snd_es1968_set_acpi(struct es1968 *chip, int state)
-{
-        u16 active_mask = acpi_state_mask[state];
-
-        pci_set_power_state(chip->pci, state);
-        /* make sure the units we care about are on 
-                XXX we might want to do this before state flipping? */
-        pci_write_config_word(chip->pci, 0x54, ~ active_mask);
-        pci_write_config_word(chip->pci, 0x56, ~ active_mask);
-}
-
-
-/*
  * initialize maestro chip
  */
 static void snd_es1968_chip_init(struct es1968 *chip)
@@ -2196,9 +2141,6 @@ static void snd_es1968_chip_init(struct es1968 *chip)
          * IRQs.
          */
         
-        /* do config work at full power */
-        snd_es1968_set_acpi(chip, ACPI_D0);
-
         /* Config Reg A */
         pci_read_config_word(pci, ESM_CONFIG_A, &w);
 
@@ -2397,9 +2339,10 @@ static int es1968_suspend(struct pci_dev *pci, pm_message_t state)
         snd_pcm_suspend_all(chip->pcm);
         snd_ac97_suspend(chip->ac97);
         snd_es1968_bob_stop(chip);
-        snd_es1968_set_acpi(chip, ACPI_D3);
+
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2413,9 +2356,16 @@ static int es1968_resume(struct pci_dev *pci)
                 return 0;
 
         /* restore all our config */
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "es1968: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
+
         snd_es1968_chip_init(chip);
 
         /* need to restore the base pointers.. */ 
@@ -2514,7 +2464,6 @@ static int snd_es1968_free(struct es1968 *chip)
         if (chip->irq >= 0)
                 free_irq(chip->irq, (void *)chip);
         snd_es1968_free_gameport(chip);
-        snd_es1968_set_acpi(chip, ACPI_D3);
         chip->master_switch = NULL;
         chip->master_volume = NULL;
         pci_release_regions(chip->pci);
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index 3ec7d7ee04dd..77e3d5c18302 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1531,9 +1531,9 @@ static int snd_fm801_suspend(struct pci_dev *pci, pm_message_t state)
                 chip->saved_regs[i] = inw(chip->port + saved_regs[i]);
         /* FIXME: tea575x suspend */
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1543,9 +1543,14 @@ static int snd_fm801_resume(struct pci_dev *pci)
         struct fm801 *chip = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "fm801: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_fm801_chip_init(chip, 1);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index feeed12920b4..e35cfd326df2 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -55,7 +55,7 @@ static char *model;
 static int position_fix;
 static int probe_mask = -1;
 static int single_cmd;
-static int disable_msi;
+static int enable_msi;
 
 module_param(index, int, 0444);
 MODULE_PARM_DESC(index, "Index value for Intel HD audio interface.");
@@ -69,8 +69,8 @@ module_param(probe_mask, int, 0444);
 MODULE_PARM_DESC(probe_mask, "Bitmask to probe codecs (default = -1).");
 module_param(single_cmd, bool, 0444);
 MODULE_PARM_DESC(single_cmd, "Use single command to communicate with codecs (for debugging only).");
-module_param(disable_msi, int, 0);
-MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
+module_param(enable_msi, int, 0);
+MODULE_PARM_DESC(enable_msi, "Enable Message Signaled Interrupt (MSI)");
 
 
 /* just for backward compatibility */
@@ -86,6 +86,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{ATI, SB450},"
                          "{ATI, SB600},"
                          "{ATI, RS600},"
+                         "{ATI, RS690},"
                          "{VIA, VT8251},"
                          "{VIA, VT8237A},"
                          "{SiS, SIS966},"
@@ -336,6 +337,7 @@ struct azx {
         unsigned int initialized :1;
         unsigned int single_cmd :1;
         unsigned int polling_mode :1;
+        unsigned int msi :1;
 };
 
 /* driver types */
@@ -396,6 +398,7 @@ static char *driver_short_names[] __devinitdata = {
  */
 #define upper_32bit(addr) (sizeof(addr) > 4 ? (u32)((addr) >> 32) : (u32)0)
 
+static int azx_acquire_irq(struct azx *chip, int do_disconnect);
 
 /*
  * Interface for HD codec
@@ -535,6 +538,18 @@ static unsigned int azx_rirb_get_response(struct hda_codec *codec)
                 schedule_timeout_interruptible(1);
         } while (time_after_eq(timeout, jiffies));
 
+        if (chip->msi) {
+                snd_printk(KERN_WARNING "hda_intel: No response from codec, "
+                           "disabling MSI...\n");
+                free_irq(chip->irq, chip);
+                chip->irq = -1;
+                pci_disable_msi(chip->pci);
+                chip->msi = 0;
+                if (azx_acquire_irq(chip, 1) < 0)
+                        return -1;
+                goto again;
+        }
+
         if (!chip->polling_mode) {
                 snd_printk(KERN_WARNING "hda_intel: azx_get_response timeout, "
                            "switching to polling mode...\n");
@@ -1363,6 +1378,20 @@ static int __devinit azx_init_stream(struct azx *chip)
         return 0;
 }
 
+static int azx_acquire_irq(struct azx *chip, int do_disconnect)
+{
+        if (request_irq(chip->pci->irq, azx_interrupt, IRQF_DISABLED|IRQF_SHARED,
+                        "HDA Intel", chip)) {
+                printk(KERN_ERR "hda-intel: unable to grab IRQ %d, "
+                       "disabling device\n", chip->pci->irq);
+                if (do_disconnect)
+                        snd_card_disconnect(chip->card);
+                return -1;
+        }
+        chip->irq = chip->pci->irq;
+        return 0;
+}
+
 
 #ifdef CONFIG_PM
 /*
@@ -1379,12 +1408,16 @@ static int azx_suspend(struct pci_dev *pci, pm_message_t state)
                 snd_pcm_suspend_all(chip->pcm[i]);
         snd_hda_suspend(chip->bus, state);
         azx_free_cmd_io(chip);
-        if (chip->irq >= 0)
+        if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, chip);
-        if (!disable_msi)
+                chip->irq = -1;
+        }
+        if (chip->msi)
                 pci_disable_msi(chip->pci);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1393,15 +1426,20 @@ static int azx_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct azx *chip = card->private_data;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
-        if (!disable_msi)
-                pci_enable_msi(pci);
-        /* FIXME: need proper error handling */
-        request_irq(pci->irq, azx_interrupt, IRQF_DISABLED|IRQF_SHARED,
-                    "HDA Intel", chip);
-        chip->irq = pci->irq;
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "hda-intel: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
+        if (chip->msi)
+                if (pci_enable_msi(pci) < 0)
+                        chip->msi = 0;
+        if (azx_acquire_irq(chip, 1) < 0)
+                return -EIO;
         azx_init_chip(chip);
         snd_hda_resume(chip->bus);
         snd_power_change_state(card, SNDRV_CTL_POWER_D0);
@@ -1431,15 +1469,14 @@ static int azx_free(struct azx *chip)
                 /* disable position buffer */
                 azx_writel(chip, DPLBASE, 0);
                 azx_writel(chip, DPUBASE, 0);
-
-                synchronize_irq(chip->irq);
         }
 
         if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, (void*)chip);
-                if (!disable_msi)
-                        pci_disable_msi(chip->pci);
         }
+        if (chip->msi)
+                pci_disable_msi(chip->pci);
         if (chip->remap_addr)
                 iounmap(chip->remap_addr);
 
@@ -1494,6 +1531,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
         chip->pci = pci;
         chip->irq = -1;
         chip->driver_type = driver_type;
+        chip->msi = enable_msi;
 
         chip->position_fix = position_fix;
         chip->single_cmd = single_cmd;
@@ -1523,16 +1561,14 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
                 goto errout;
         }
 
-        if (!disable_msi)
-                pci_enable_msi(pci);
+        if (chip->msi)
+                if (pci_enable_msi(pci) < 0)
+                        chip->msi = 0;
 
-        if (request_irq(pci->irq, azx_interrupt, IRQF_DISABLED|IRQF_SHARED,
-                        "HDA Intel", (void*)chip)) {
-                snd_printk(KERN_ERR SFX "unable to grab IRQ %d\n", pci->irq);
+        if (azx_acquire_irq(chip, 0) < 0) {
                 err = -EBUSY;
                 goto errout;
         }
-        chip->irq = pci->irq;
 
         pci_set_master(pci);
         synchronize_irq(chip->irq);
@@ -1677,6 +1713,7 @@ static struct pci_device_id azx_ids[] = {
         { 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB450 */
         { 0x1002, 0x4383, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB600 */
         { 0x1002, 0x793b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATIHDMI }, /* ATI RS600 HDMI */
+        { 0x1002, 0x7919, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATIHDMI }, /* ATI RS690 HDMI */
         { 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_VIA }, /* VIA VT8251/VT8237A */
         { 0x1039, 0x7502, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_SIS }, /* SIS966 */
         { 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ULI }, /* ULI M5461 */
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 511df07fa2a3..edd22dec8286 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -818,6 +818,8 @@ static struct hda_board_config ad1986a_cfg_tbl[] = {
           .config = AD1986A_LAPTOP_EAPD }, /* ASUS A6J */
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x11f7,
           .config = AD1986A_LAPTOP_EAPD }, /* ASUS U5A */
+        { .pci_subvendor = 0x1043, .pci_subdevice = 0x1263,
+          .config = AD1986A_LAPTOP_EAPD }, /* ASUS U5F */
         { .pci_subvendor = 0x1043, .pci_subdevice = 0x1297,
           .config = AD1986A_LAPTOP_EAPD }, /* ASUS Z62F */
         { .pci_subvendor = 0x103c, .pci_subdevice = 0x30af,
diff --git a/sound/pci/hda/patch_atihdmi.c b/sound/pci/hda/patch_atihdmi.c
index a27440ffd1c8..7333f275decd 100644
--- a/sound/pci/hda/patch_atihdmi.c
+++ b/sound/pci/hda/patch_atihdmi.c
@@ -161,5 +161,6 @@ static int patch_atihdmi(struct hda_codec *codec)
  */
 struct hda_codec_preset snd_hda_preset_atihdmi[] = {
         { .id = 0x1002793c, .name = "ATI RS600 HDMI", .patch = patch_atihdmi },
+        { .id = 0x1002791a, .name = "ATI RS690 HDMI", .patch = patch_atihdmi },
         {} /* terminator */
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 84a3eb8aacc2..0d728c6f697c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1799,7 +1799,7 @@ static int alc_build_pcms(struct hda_codec *codec)
         /* SPDIF for stream index #1 */
         if (spec->multiout.dig_out_nid || spec->dig_in_nid) {
                 codec->num_pcms = 2;
-                info++;
+                info = spec->pcm_rec + 1;
                 info->name = spec->stream_name_digital;
                 if (spec->multiout.dig_out_nid &&
                     spec->stream_digital_playback) {
@@ -1820,7 +1820,7 @@ static int alc_build_pcms(struct hda_codec *codec)
         if (spec->num_adc_nids > 1 && spec->stream_analog_capture &&
             spec->adc_nids) {
                 codec->num_pcms = 3;
-                info++;
+                info = spec->pcm_rec + 2;
                 info->name = spec->stream_name_analog;
                 /* No playback stream for second PCM */
                 info->stream[SNDRV_PCM_STREAM_PLAYBACK] = alc_pcm_null_playback;
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index f4319b8d4644..9c1bce7afa86 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -1962,6 +1962,12 @@ static struct ac97_quirk ac97_quirks[] __devinitdata = {
                 .type = AC97_TUNE_HP_ONLY
         },
         {
+                .subvendor = 0x10f7,
+                .subdevice = 0x834c,
+                .name = "Panasonic CF-R4",
+                .type = AC97_TUNE_HP_ONLY,
+        },
+        {
                 .subvendor = 0x110a,
                 .subdevice = 0x0056,
                 .name = "Fujitsu-Siemens Scenic",       /* AD1981? */
@@ -2476,10 +2482,14 @@ static int intel8x0_suspend(struct pci_dev *pci, pm_message_t state)
         if (chip->device_type == DEVICE_INTEL_ICH4)
                 chip->sdm_saved = igetbyte(chip, ICHREG(SDM));
 
-        if (chip->irq >= 0)
+        if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, chip);
+                chip->irq = -1;
+        }
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2489,11 +2499,22 @@ static int intel8x0_resume(struct pci_dev *pci)
         struct intel8x0 *chip = card->private_data;
         int i;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "intel8x0: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
-        request_irq(pci->irq, snd_intel8x0_interrupt, IRQF_DISABLED|IRQF_SHARED,
-                    card->shortname, chip);
+        if (request_irq(pci->irq, snd_intel8x0_interrupt,
+                        IRQF_DISABLED|IRQF_SHARED, card->shortname, chip)) {
+                printk(KERN_ERR "intel8x0: unable to grab IRQ %d, "
+                       "disabling device\n", pci->irq);
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         chip->irq = pci->irq;
         synchronize_irq(chip->irq);
         snd_intel8x0_chip_init(chip, 0);
diff --git a/sound/pci/intel8x0m.c b/sound/pci/intel8x0m.c
index 6703f5cb5569..bd467c501123 100644
--- a/sound/pci/intel8x0m.c
+++ b/sound/pci/intel8x0m.c
@@ -1045,10 +1045,14 @@ static int intel8x0m_suspend(struct pci_dev *pci, pm_message_t state)
         for (i = 0; i < chip->pcm_devs; i++)
                 snd_pcm_suspend_all(chip->pcm[i]);
         snd_ac97_suspend(chip->ac97);
-        if (chip->irq >= 0)
+        if (chip->irq >= 0) {
+                synchronize_irq(chip->irq);
                 free_irq(chip->irq, chip);
+                chip->irq = -1;
+        }
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1057,11 +1061,22 @@ static int intel8x0m_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct intel8x0m *chip = card->private_data;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "intel8x0m: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
-        request_irq(pci->irq, snd_intel8x0_interrupt, IRQF_DISABLED|IRQF_SHARED,
-                    card->shortname, chip);
+        if (request_irq(pci->irq, snd_intel8x0_interrupt,
+                        IRQF_DISABLED|IRQF_SHARED, card->shortname, chip)) {
+                printk(KERN_ERR "intel8x0m: unable to grab IRQ %d, "
+                       "disabling device\n", pci->irq);
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         chip->irq = pci->irq;
         snd_intel8x0_chip_init(chip, 0);
         snd_ac97_resume(chip->ac97);
diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
index 05605f474a72..8cab342bbaaf 100644
--- a/sound/pci/maestro3.c
+++ b/sound/pci/maestro3.c
@@ -2589,12 +2589,9 @@ static int m3_suspend(struct pci_dev *pci, pm_message_t state)
                 chip->suspend_mem[index++] = 
                         snd_m3_assp_read(chip, MEMTYPE_INTERNAL_DATA, i);
 
-        /* power down apci registers */
-        snd_m3_outw(chip, 0xffff, 0x54);
-        snd_m3_outw(chip, 0xffff, 0x56);
-
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2607,8 +2604,14 @@ static int m3_resume(struct pci_dev *pci)
         if (chip->suspend_mem == NULL)
                 return 0;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "maestor3: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         /* first lets just bring everything back. .*/
diff --git a/sound/pci/nm256/nm256.c b/sound/pci/nm256/nm256.c
index b1bbdb9e3b7b..945d21bf187e 100644
--- a/sound/pci/nm256/nm256.c
+++ b/sound/pci/nm256/nm256.c
@@ -1390,6 +1390,7 @@ static int nm256_suspend(struct pci_dev *pci, pm_message_t state)
         chip->coeffs_current = 0;
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1401,8 +1402,17 @@ static int nm256_resume(struct pci_dev *pci)
 
         /* Perform a full reset on the hardware */
         chip->in_resume = 1;
+
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "nm256: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
+        pci_set_master(pci);
+
         snd_nm256_init_chip(chip);
 
         /* restore ac97 */
diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
index ec4899147e1d..56e0c01123e7 100644
--- a/sound/pci/riptide/riptide.c
+++ b/sound/pci/riptide/riptide.c
@@ -1178,9 +1178,9 @@ static int riptide_suspend(struct pci_dev *pci, pm_message_t state)
         snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
         snd_pcm_suspend_all(chip->pcm);
         snd_ac97_suspend(chip->ac97);
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1189,9 +1189,14 @@ static int riptide_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct snd_riptide *chip = card->private_data;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "riptide: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
         snd_riptide_initialize(chip);
         snd_ac97_resume(chip->ac97);
diff --git a/sound/pci/trident/trident_main.c b/sound/pci/trident/trident_main.c
index 0d478871808d..1fbc4321122f 100644
--- a/sound/pci/trident/trident_main.c
+++ b/sound/pci/trident/trident_main.c
@@ -3966,15 +3966,9 @@ int snd_trident_suspend(struct pci_dev *pci, pm_message_t state)
         snd_ac97_suspend(trident->ac97);
         snd_ac97_suspend(trident->ac97_sec);
 
-        switch (trident->device) {
-        case TRIDENT_DEVICE_ID_DX:
-        case TRIDENT_DEVICE_ID_NX:
-                break;                  /* TODO */
-        case TRIDENT_DEVICE_ID_SI7018:
-                break;
-        }
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -3983,9 +3977,15 @@ int snd_trident_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct snd_trident *trident = card->private_data;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
-        pci_set_master(pci); /* to be sure */
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "trident: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
+        pci_set_master(pci);
 
         switch (trident->device) {
         case TRIDENT_DEVICE_ID_DX:
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index e6990e0bbf23..92b0736c0fdb 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -2185,9 +2185,9 @@ static int snd_via82xx_suspend(struct pci_dev *pci, pm_message_t state)
                 chip->capture_src_saved[1] = inb(chip->port + VIA_REG_CAPTURE_CHANNEL + 0x10);
         }
 
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2197,9 +2197,15 @@ static int snd_via82xx_resume(struct pci_dev *pci)
         struct via82xx *chip = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "via82xx: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
+        pci_set_master(pci);
 
         snd_via82xx_chip_init(chip);
 
diff --git a/sound/pci/via82xx_modem.c b/sound/pci/via82xx_modem.c
index 5ab1cf3d434b..feb27c966256 100644
--- a/sound/pci/via82xx_modem.c
+++ b/sound/pci/via82xx_modem.c
@@ -1032,9 +1032,10 @@ static int snd_via82xx_suspend(struct pci_dev *pci, pm_message_t state)
                 snd_via82xx_channel_reset(chip, &chip->devs[i]);
         synchronize_irq(chip->irq);
         snd_ac97_suspend(chip->ac97);
-        pci_set_power_state(pci, PCI_D3hot);
+
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -1044,9 +1045,14 @@ static int snd_via82xx_resume(struct pci_dev *pci)
         struct via82xx_modem *chip = card->private_data;
         int i;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "via82xx-modem: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
 
         snd_via82xx_chip_init(chip);
diff --git a/sound/pci/vx222/vx222.c b/sound/pci/vx222/vx222.c
index e7cd8acab59a..af49e8aabf55 100644
--- a/sound/pci/vx222/vx222.c
+++ b/sound/pci/vx222/vx222.c
@@ -266,9 +266,9 @@ static int snd_vx222_suspend(struct pci_dev *pci, pm_message_t state)
         int err;
 
         err = snd_vx_suspend(&vx->core, state);
-        pci_set_power_state(pci, PCI_D3hot);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return err;
 }
 
@@ -277,9 +277,14 @@ static int snd_vx222_resume(struct pci_dev *pci)
         struct snd_card *card = pci_get_drvdata(pci);
         struct snd_vx222 *vx = card->private_data;
 
-        pci_restore_state(pci);
-        pci_enable_device(pci);
         pci_set_power_state(pci, PCI_D0);
+        pci_restore_state(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "vx222: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
         return snd_vx_resume(&vx->core);
 }
diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c
index ebc6da89edf3..a40c1085fd20 100644
--- a/sound/pci/ymfpci/ymfpci_main.c
+++ b/sound/pci/ymfpci/ymfpci_main.c
@@ -2218,6 +2218,7 @@ int snd_ymfpci_suspend(struct pci_dev *pci, pm_message_t state)
         snd_ymfpci_disable_dsp(chip);
         pci_disable_device(pci);
         pci_save_state(pci);
+        pci_set_power_state(pci, pci_choose_state(pci, state));
         return 0;
 }
 
@@ -2227,8 +2228,14 @@ int snd_ymfpci_resume(struct pci_dev *pci)
         struct snd_ymfpci *chip = card->private_data;
         unsigned int i;
 
+        pci_set_power_state(pci, PCI_D0);
         pci_restore_state(pci);
-        pci_enable_device(pci);
+        if (pci_enable_device(pci) < 0) {
+                printk(KERN_ERR "ymfpci: pci_enable_device failed, "
+                       "disabling device\n");
+                snd_card_disconnect(card);
+                return -EIO;
+        }
         pci_set_master(pci);
         snd_ymfpci_aclink_reset(pci);
         snd_ymfpci_codec_ready(chip, 0);