Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git

french@hera:~/linux-2.6(0)$ cg-update
l
`/pub/scm/linux/kernel/git/torvalds/linux-2.6.git/refs/heads/master' ->
`.git/refs/heads/origin'
cp: cannot create link `.git/objects/info/packs': File exists
progress: 213 objects, 646653 bytes, 77% done
`/pub/scm/linux/kernel/git/torvalds/linux-2.6.git/objects/info/packs' ->
`.git/objects/info/packs'
progress: 983 objects, 2805763 bytes, 100% done
cg-pull: objects pull failed

203 files changed, 4364 insertions, 2413 deletions

diff --git a/CREDITS b/CREDITS
index d97e62524ddc..50121d432b62 100644
--- a/CREDITS
+++ b/CREDITS
@@ -2380,8 +2380,8 @@ E: tmolina@cablespeed.com
 D: bug fixes, documentation, minor hackery
 
 N: James Morris
-E: jmorris@redhat.com
-W: http://www.intercode.com.au/jmorris/
+E: jmorris@namei.org
+W: http://namei.org/
 D: Netfilter, Linux Security Modules (LSM), SELinux, IPSec,
 D: Crypto API, general networking, miscellaneous.
 S: PO Box 707
diff --git a/Documentation/dontdiff b/Documentation/dontdiff
index b974cf595d01..96bea278bbf6 100644
--- a/Documentation/dontdiff
+++ b/Documentation/dontdiff
@@ -104,6 +104,7 @@ logo_*.c
 logo_*_clut224.c
 logo_*_mono.c
 lxdialog
+mach-types
 mach-types.h
 make_times_h
 map
diff --git a/Documentation/kprobes.txt b/Documentation/kprobes.txt
new file mode 100644
index 000000000000..0541fe1de704
--- /dev/null
+++ b/Documentation/kprobes.txt
@@ -0,0 +1,588 @@
+Title   : Kernel Probes (Kprobes)
+Authors : Jim Keniston <jkenisto@us.ibm.com>
+        : Prasanna S Panchamukhi <prasanna@in.ibm.com>
+
+CONTENTS
+
+1. Concepts: Kprobes, Jprobes, Return Probes
+2. Architectures Supported
+3. Configuring Kprobes
+4. API Reference
+5. Kprobes Features and Limitations
+6. Probe Overhead
+7. TODO
+8. Kprobes Example
+9. Jprobes Example
+10. Kretprobes Example
+
+1. Concepts: Kprobes, Jprobes, Return Probes
+
+Kprobes enables you to dynamically break into any kernel routine and
+collect debugging and performance information non-disruptively. You
+can trap at almost any kernel code address, specifying a handler
+routine to be invoked when the breakpoint is hit.
+
+There are currently three types of probes: kprobes, jprobes, and
+kretprobes (also called return probes).  A kprobe can be inserted
+on virtually any instruction in the kernel.  A jprobe is inserted at
+the entry to a kernel function, and provides convenient access to the
+function's arguments.  A return probe fires when a specified function
+returns.
+
+In the typical case, Kprobes-based instrumentation is packaged as
+a kernel module.  The module's init function installs ("registers")
+one or more probes, and the exit function unregisters them.  A
+registration function such as register_kprobe() specifies where
+the probe is to be inserted and what handler is to be called when
+the probe is hit.
+
+The next three subsections explain how the different types of
+probes work.  They explain certain things that you'll need to
+know in order to make the best use of Kprobes -- e.g., the
+difference between a pre_handler and a post_handler, and how
+to use the maxactive and nmissed fields of a kretprobe.  But
+if you're in a hurry to start using Kprobes, you can skip ahead
+to section 2.
+
+1.1 How Does a Kprobe Work?
+
+When a kprobe is registered, Kprobes makes a copy of the probed
+instruction and replaces the first byte(s) of the probed instruction
+with a breakpoint instruction (e.g., int3 on i386 and x86_64).
+
+When a CPU hits the breakpoint instruction, a trap occurs, the CPU's
+registers are saved, and control passes to Kprobes via the
+notifier_call_chain mechanism.  Kprobes executes the "pre_handler"
+associated with the kprobe, passing the handler the addresses of the
+kprobe struct and the saved registers.
+
+Next, Kprobes single-steps its copy of the probed instruction.
+(It would be simpler to single-step the actual instruction in place,
+but then Kprobes would have to temporarily remove the breakpoint
+instruction.  This would open a small time window when another CPU
+could sail right past the probepoint.)
+
+After the instruction is single-stepped, Kprobes executes the
+"post_handler," if any, that is associated with the kprobe.
+Execution then continues with the instruction following the probepoint.
+
+1.2 How Does a Jprobe Work?
+
+A jprobe is implemented using a kprobe that is placed on a function's
+entry point.  It employs a simple mirroring principle to allow
+seamless access to the probed function's arguments.  The jprobe
+handler routine should have the same signature (arg list and return
+type) as the function being probed, and must always end by calling
+the Kprobes function jprobe_return().
+
+Here's how it works.  When the probe is hit, Kprobes makes a copy of
+the saved registers and a generous portion of the stack (see below).
+Kprobes then points the saved instruction pointer at the jprobe's
+handler routine, and returns from the trap.  As a result, control
+passes to the handler, which is presented with the same register and
+stack contents as the probed function.  When it is done, the handler
+calls jprobe_return(), which traps again to restore the original stack
+contents and processor state and switch to the probed function.
+
+By convention, the callee owns its arguments, so gcc may produce code
+that unexpectedly modifies that portion of the stack.  This is why
+Kprobes saves a copy of the stack and restores it after the jprobe
+handler has run.  Up to MAX_STACK_SIZE bytes are copied -- e.g.,
+64 bytes on i386.
+
+Note that the probed function's args may be passed on the stack
+or in registers (e.g., for x86_64 or for an i386 fastcall function).
+The jprobe will work in either case, so long as the handler's
+prototype matches that of the probed function.
+
+1.3 How Does a Return Probe Work?
+
+When you call register_kretprobe(), Kprobes establishes a kprobe at
+the entry to the function.  When the probed function is called and this
+probe is hit, Kprobes saves a copy of the return address, and replaces
+the return address with the address of a "trampoline."  The trampoline
+is an arbitrary piece of code -- typically just a nop instruction.
+At boot time, Kprobes registers a kprobe at the trampoline.
+
+When the probed function executes its return instruction, control
+passes to the trampoline and that probe is hit.  Kprobes' trampoline
+handler calls the user-specified handler associated with the kretprobe,
+then sets the saved instruction pointer to the saved return address,
+and that's where execution resumes upon return from the trap.
+
+While the probed function is executing, its return address is
+stored in an object of type kretprobe_instance.  Before calling
+register_kretprobe(), the user sets the maxactive field of the
+kretprobe struct to specify how many instances of the specified
+function can be probed simultaneously.  register_kretprobe()
+pre-allocates the indicated number of kretprobe_instance objects.
+
+For example, if the function is non-recursive and is called with a
+spinlock held, maxactive = 1 should be enough.  If the function is
+non-recursive and can never relinquish the CPU (e.g., via a semaphore
+or preemption), NR_CPUS should be enough.  If maxactive <= 0, it is
+set to a default value.  If CONFIG_PREEMPT is enabled, the default
+is max(10, 2*NR_CPUS).  Otherwise, the default is NR_CPUS.
+
+It's not a disaster if you set maxactive too low; you'll just miss
+some probes.  In the kretprobe struct, the nmissed field is set to
+zero when the return probe is registered, and is incremented every
+time the probed function is entered but there is no kretprobe_instance
+object available for establishing the return probe.
+
+2. Architectures Supported
+
+Kprobes, jprobes, and return probes are implemented on the following
+architectures:
+
+- i386
+- x86_64 (AMD-64, E64MT)
+- ppc64
+- ia64 (Support for probes on certain instruction types is still in progress.)
+- sparc64 (Return probes not yet implemented.)
+
+3. Configuring Kprobes
+
+When configuring the kernel using make menuconfig/xconfig/oldconfig,
+ensure that CONFIG_KPROBES is set to "y".  Under "Kernel hacking",
+look for "Kprobes".  You may have to enable "Kernel debugging"
+(CONFIG_DEBUG_KERNEL) before you can enable Kprobes.
+
+You may also want to ensure that CONFIG_KALLSYMS and perhaps even
+CONFIG_KALLSYMS_ALL are set to "y", since kallsyms_lookup_name()
+is a handy, version-independent way to find a function's address.
+
+If you need to insert a probe in the middle of a function, you may find
+it useful to "Compile the kernel with debug info" (CONFIG_DEBUG_INFO),
+so you can use "objdump -d -l vmlinux" to see the source-to-object
+code mapping.
+
+4. API Reference
+
+The Kprobes API includes a "register" function and an "unregister"
+function for each type of probe.  Here are terse, mini-man-page
+specifications for these functions and the associated probe handlers
+that you'll write.  See the latter half of this document for examples.
+
+4.1 register_kprobe
+
+#include <linux/kprobes.h>
+int register_kprobe(struct kprobe *kp);
+
+Sets a breakpoint at the address kp->addr.  When the breakpoint is
+hit, Kprobes calls kp->pre_handler.  After the probed instruction
+is single-stepped, Kprobe calls kp->post_handler.  If a fault
+occurs during execution of kp->pre_handler or kp->post_handler,
+or during single-stepping of the probed instruction, Kprobes calls
+kp->fault_handler.  Any or all handlers can be NULL.
+
+register_kprobe() returns 0 on success, or a negative errno otherwise.
+
+User's pre-handler (kp->pre_handler):
+#include <linux/kprobes.h>
+#include <linux/ptrace.h>
+int pre_handler(struct kprobe *p, struct pt_regs *regs);
+
+Called with p pointing to the kprobe associated with the breakpoint,
+and regs pointing to the struct containing the registers saved when
+the breakpoint was hit.  Return 0 here unless you're a Kprobes geek.
+
+User's post-handler (kp->post_handler):
+#include <linux/kprobes.h>
+#include <linux/ptrace.h>
+void post_handler(struct kprobe *p, struct pt_regs *regs,
+        unsigned long flags);
+
+p and regs are as described for the pre_handler.  flags always seems
+to be zero.
+
+User's fault-handler (kp->fault_handler):
+#include <linux/kprobes.h>
+#include <linux/ptrace.h>
+int fault_handler(struct kprobe *p, struct pt_regs *regs, int trapnr);
+
+p and regs are as described for the pre_handler.  trapnr is the
+architecture-specific trap number associated with the fault (e.g.,
+on i386, 13 for a general protection fault or 14 for a page fault).
+Returns 1 if it successfully handled the exception.
+
+4.2 register_jprobe
+
+#include <linux/kprobes.h>
+int register_jprobe(struct jprobe *jp)
+
+Sets a breakpoint at the address jp->kp.addr, which must be the address
+of the first instruction of a function.  When the breakpoint is hit,
+Kprobes runs the handler whose address is jp->entry.
+
+The handler should have the same arg list and return type as the probed
+function; and just before it returns, it must call jprobe_return().
+(The handler never actually returns, since jprobe_return() returns
+control to Kprobes.)  If the probed function is declared asmlinkage,
+fastcall, or anything else that affects how args are passed, the
+handler's declaration must match.
+
+register_jprobe() returns 0 on success, or a negative errno otherwise.
+
+4.3 register_kretprobe
+
+#include <linux/kprobes.h>
+int register_kretprobe(struct kretprobe *rp);
+
+Establishes a return probe for the function whose address is
+rp->kp.addr.  When that function returns, Kprobes calls rp->handler.
+You must set rp->maxactive appropriately before you call
+register_kretprobe(); see "How Does a Return Probe Work?" for details.
+
+register_kretprobe() returns 0 on success, or a negative errno
+otherwise.
+
+User's return-probe handler (rp->handler):
+#include <linux/kprobes.h>
+#include <linux/ptrace.h>
+int kretprobe_handler(struct kretprobe_instance *ri, struct pt_regs *regs);
+
+regs is as described for kprobe.pre_handler.  ri points to the
+kretprobe_instance object, of which the following fields may be
+of interest:
+- ret_addr: the return address
+- rp: points to the corresponding kretprobe object
+- task: points to the corresponding task struct
+The handler's return value is currently ignored.
+
+4.4 unregister_*probe
+
+#include <linux/kprobes.h>
+void unregister_kprobe(struct kprobe *kp);
+void unregister_jprobe(struct jprobe *jp);
+void unregister_kretprobe(struct kretprobe *rp);
+
+Removes the specified probe.  The unregister function can be called
+at any time after the probe has been registered.
+
+5. Kprobes Features and Limitations
+
+As of Linux v2.6.12, Kprobes allows multiple probes at the same
+address.  Currently, however, there cannot be multiple jprobes on
+the same function at the same time.
+
+In general, you can install a probe anywhere in the kernel.
+In particular, you can probe interrupt handlers.  Known exceptions
+are discussed in this section.
+
+For obvious reasons, it's a bad idea to install a probe in
+the code that implements Kprobes (mostly kernel/kprobes.c and
+arch/*/kernel/kprobes.c).  A patch in the v2.6.13 timeframe instructs
+Kprobes to reject such requests.
+
+If you install a probe in an inline-able function, Kprobes makes
+no attempt to chase down all inline instances of the function and
+install probes there.  gcc may inline a function without being asked,
+so keep this in mind if you're not seeing the probe hits you expect.
+
+A probe handler can modify the environment of the probed function
+-- e.g., by modifying kernel data structures, or by modifying the
+contents of the pt_regs struct (which are restored to the registers
+upon return from the breakpoint).  So Kprobes can be used, for example,
+to install a bug fix or to inject faults for testing.  Kprobes, of
+course, has no way to distinguish the deliberately injected faults
+from the accidental ones.  Don't drink and probe.
+
+Kprobes makes no attempt to prevent probe handlers from stepping on
+each other -- e.g., probing printk() and then calling printk() from a
+probe handler.  As of Linux v2.6.12, if a probe handler hits a probe,
+that second probe's handlers won't be run in that instance.
+
+In Linux v2.6.12 and previous versions, Kprobes' data structures are
+protected by a single lock that is held during probe registration and
+unregistration and while handlers are run.  Thus, no two handlers
+can run simultaneously.  To improve scalability on SMP systems,
+this restriction will probably be removed soon, in which case
+multiple handlers (or multiple instances of the same handler) may
+run concurrently on different CPUs.  Code your handlers accordingly.
+
+Kprobes does not use semaphores or allocate memory except during
+registration and unregistration.
+
+Probe handlers are run with preemption disabled.  Depending on the
+architecture, handlers may also run with interrupts disabled.  In any
+case, your handler should not yield the CPU (e.g., by attempting to
+acquire a semaphore).
+
+Since a return probe is implemented by replacing the return
+address with the trampoline's address, stack backtraces and calls
+to __builtin_return_address() will typically yield the trampoline's
+address instead of the real return address for kretprobed functions.
+(As far as we can tell, __builtin_return_address() is used only
+for instrumentation and error reporting.)
+
+If the number of times a function is called does not match the
+number of times it returns, registering a return probe on that
+function may produce undesirable results.  We have the do_exit()
+and do_execve() cases covered.  do_fork() is not an issue.  We're
+unaware of other specific cases where this could be a problem.
+
+6. Probe Overhead
+
+On a typical CPU in use in 2005, a kprobe hit takes 0.5 to 1.0
+microseconds to process.  Specifically, a benchmark that hits the same
+probepoint repeatedly, firing a simple handler each time, reports 1-2
+million hits per second, depending on the architecture.  A jprobe or
+return-probe hit typically takes 50-75% longer than a kprobe hit.
+When you have a return probe set on a function, adding a kprobe at
+the entry to that function adds essentially no overhead.
+
+Here are sample overhead figures (in usec) for different architectures.
+k = kprobe; j = jprobe; r = return probe; kr = kprobe + return probe
+on same function; jr = jprobe + return probe on same function
+
+i386: Intel Pentium M, 1495 MHz, 2957.31 bogomips
+k = 0.57 usec; j = 1.00; r = 0.92; kr = 0.99; jr = 1.40
+
+x86_64: AMD Opteron 246, 1994 MHz, 3971.48 bogomips
+k = 0.49 usec; j = 0.76; r = 0.80; kr = 0.82; jr = 1.07
+
+ppc64: POWER5 (gr), 1656 MHz (SMT disabled, 1 virtual CPU per physical CPU)
+k = 0.77 usec; j = 1.31; r = 1.26; kr = 1.45; jr = 1.99
+
+7. TODO
+
+a. SystemTap (http://sourceware.org/systemtap): Work in progress
+to provide a simplified programming interface for probe-based
+instrumentation.
+b. Improved SMP scalability: Currently, work is in progress to handle
+multiple kprobes in parallel.
+c. Kernel return probes for sparc64.
+d. Support for other architectures.
+e. User-space probes.
+
+8. Kprobes Example
+
+Here's a sample kernel module showing the use of kprobes to dump a
+stack trace and selected i386 registers when do_fork() is called.
+----- cut here -----
+/*kprobe_example.c*/
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/kprobes.h>
+#include <linux/kallsyms.h>
+#include <linux/sched.h>
+
+/*For each probe you need to allocate a kprobe structure*/
+static struct kprobe kp;
+
+/*kprobe pre_handler: called just before the probed instruction is executed*/
+int handler_pre(struct kprobe *p, struct pt_regs *regs)
+{
+        printk("pre_handler: p->addr=0x%p, eip=%lx, eflags=0x%lx\n",
+                p->addr, regs->eip, regs->eflags);
+        dump_stack();
+        return 0;
+}
+
+/*kprobe post_handler: called after the probed instruction is executed*/
+void handler_post(struct kprobe *p, struct pt_regs *regs, unsigned long flags)
+{
+        printk("post_handler: p->addr=0x%p, eflags=0x%lx\n",
+                p->addr, regs->eflags);
+}
+
+/* fault_handler: this is called if an exception is generated for any
+ * instruction within the pre- or post-handler, or when Kprobes
+ * single-steps the probed instruction.
+ */
+int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr)
+{
+        printk("fault_handler: p->addr=0x%p, trap #%dn",
+                p->addr, trapnr);
+        /* Return 0 because we don't handle the fault. */
+        return 0;
+}
+
+int init_module(void)
+{
+        int ret;
+        kp.pre_handler = handler_pre;
+        kp.post_handler = handler_post;
+        kp.fault_handler = handler_fault;
+        kp.addr = (kprobe_opcode_t*) kallsyms_lookup_name("do_fork");
+        /* register the kprobe now */
+        if (!kp.addr) {
+                printk("Couldn't find %s to plant kprobe\n", "do_fork");
+                return -1;
+        }
+        if ((ret = register_kprobe(&kp) < 0)) {
+                printk("register_kprobe failed, returned %d\n", ret);
+                return -1;
+        }
+        printk("kprobe registered\n");
+        return 0;
+}
+
+void cleanup_module(void)
+{
+        unregister_kprobe(&kp);
+        printk("kprobe unregistered\n");
+}
+
+MODULE_LICENSE("GPL");
+----- cut here -----
+
+You can build the kernel module, kprobe-example.ko, using the following
+Makefile:
+----- cut here -----
+obj-m := kprobe-example.o
+KDIR := /lib/modules/$(shell uname -r)/build
+PWD := $(shell pwd)
+default:
+        $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modules
+clean:
+        rm -f *.mod.c *.ko *.o
+----- cut here -----
+
+$ make
+$ su -
+...
+# insmod kprobe-example.ko
+
+You will see the trace data in /var/log/messages and on the console
+whenever do_fork() is invoked to create a new process.
+
+9. Jprobes Example
+
+Here's a sample kernel module showing the use of jprobes to dump
+the arguments of do_fork().
+----- cut here -----
+/*jprobe-example.c */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/uio.h>
+#include <linux/kprobes.h>
+#include <linux/kallsyms.h>
+
+/*
+ * Jumper probe for do_fork.
+ * Mirror principle enables access to arguments of the probed routine
+ * from the probe handler.
+ */
+
+/* Proxy routine having the same arguments as actual do_fork() routine */
+long jdo_fork(unsigned long clone_flags, unsigned long stack_start,
+              struct pt_regs *regs, unsigned long stack_size,
+              int __user * parent_tidptr, int __user * child_tidptr)
+{
+        printk("jprobe: clone_flags=0x%lx, stack_size=0x%lx, regs=0x%p\n",
+               clone_flags, stack_size, regs);
+        /* Always end with a call to jprobe_return(). */
+        jprobe_return();
+        /*NOTREACHED*/
+        return 0;
+}
+
+static struct jprobe my_jprobe = {
+        .entry = (kprobe_opcode_t *) jdo_fork
+};
+
+int init_module(void)
+{
+        int ret;
+        my_jprobe.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("do_fork");
+        if (!my_jprobe.kp.addr) {
+                printk("Couldn't find %s to plant jprobe\n", "do_fork");
+                return -1;
+        }
+
+        if ((ret = register_jprobe(&my_jprobe)) <0) {
+                printk("register_jprobe failed, returned %d\n", ret);
+                return -1;
+        }
+        printk("Planted jprobe at %p, handler addr %p\n",
+               my_jprobe.kp.addr, my_jprobe.entry);
+        return 0;
+}
+
+void cleanup_module(void)
+{
+        unregister_jprobe(&my_jprobe);
+        printk("jprobe unregistered\n");
+}
+
+MODULE_LICENSE("GPL");
+----- cut here -----
+
+Build and insert the kernel module as shown in the above kprobe
+example.  You will see the trace data in /var/log/messages and on
+the console whenever do_fork() is invoked to create a new process.
+(Some messages may be suppressed if syslogd is configured to
+eliminate duplicate messages.)
+
+10. Kretprobes Example
+
+Here's a sample kernel module showing the use of return probes to
+report failed calls to sys_open().
+----- cut here -----
+/*kretprobe-example.c*/
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/kprobes.h>
+#include <linux/kallsyms.h>
+
+static const char *probed_func = "sys_open";
+
+/* Return-probe handler: If the probed function fails, log the return value. */
+static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs)
+{
+        // Substitute the appropriate register name for your architecture --
+        // e.g., regs->rax for x86_64, regs->gpr[3] for ppc64.
+        int retval = (int) regs->eax;
+        if (retval < 0) {
+                printk("%s returns %d\n", probed_func, retval);
+        }
+        return 0;
+}
+
+static struct kretprobe my_kretprobe = {
+        .handler = ret_handler,
+        /* Probe up to 20 instances concurrently. */
+        .maxactive = 20
+};
+
+int init_module(void)
+{
+        int ret;
+        my_kretprobe.kp.addr =
+                (kprobe_opcode_t *) kallsyms_lookup_name(probed_func);
+        if (!my_kretprobe.kp.addr) {
+                printk("Couldn't find %s to plant return probe\n", probed_func);
+                return -1;
+        }
+        if ((ret = register_kretprobe(&my_kretprobe)) < 0) {
+                printk("register_kretprobe failed, returned %d\n", ret);
+                return -1;
+        }
+        printk("Planted return probe at %p\n", my_kretprobe.kp.addr);
+        return 0;
+}
+
+void cleanup_module(void)
+{
+        unregister_kretprobe(&my_kretprobe);
+        printk("kretprobe unregistered\n");
+        /* nmissed > 0 suggests that maxactive was set too low. */
+        printk("Missed probing %d instances of %s\n",
+                my_kretprobe.nmissed, probed_func);
+}
+
+MODULE_LICENSE("GPL");
+----- cut here -----
+
+Build and insert the kernel module as shown in the above kprobe
+example.  You will see the trace data in /var/log/messages and on the
+console whenever sys_open() returns a negative value.  (Some messages
+may be suppressed if syslogd is configured to eliminate duplicate
+messages.)
+
+For additional information on Kprobes, refer to the following URLs:
+http://www-106.ibm.com/developerworks/library/l-kprobes.html?ca=dgr-lnxw42Kprobe
+http://www.redhat.com/magazine/005mar05/features/kprobes/
diff --git a/Documentation/usb/usbmon.txt b/Documentation/usb/usbmon.txt
index f1896ee3bb2a..63cb7edd177e 100644
--- a/Documentation/usb/usbmon.txt
+++ b/Documentation/usb/usbmon.txt
@@ -102,7 +102,7 @@ Here is the list of words, from left to right:
 - URB Status. This field makes no sense for submissions, but is present
   to help scripts with parsing. In error case, it contains the error code.
   In case of a setup packet, it contains a Setup Tag. If scripts read a number
-  in this field, the proceed to read Data Length. Otherwise, they read
+  in this field, they proceed to read Data Length. Otherwise, they read
   the setup packet before reading the Data Length.
 - Setup packet, if present, consists of 5 words: one of each for bmRequestType,
   bRequest, wValue, wIndex, wLength, as specified by the USB Specification 2.0.
diff --git a/Documentation/video4linux/bttv/Insmod-options b/Documentation/video4linux/bttv/Insmod-options
index 7bb5a50b0779..fc94ff235ffa 100644
--- a/Documentation/video4linux/bttv/Insmod-options
+++ b/Documentation/video4linux/bttv/Insmod-options
@@ -44,6 +44,9 @@ bttv.o
                                 push used by bttv.  bttv will disable overlay
                                 by default on this hardware to avoid crashes.
                                 With this insmod option you can override this.
+                no_overlay=1    Disable overlay. It should be used by broken
+                                hardware that doesn't support PCI2PCI direct
+                                transfers.
                 automute=0/1    Automatically mutes the sound if there is
                                 no TV signal, on by default.  You might try
                                 to disable this if you have bad input signal
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 476c0c22fbb7..678e8f192db2 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -6,6 +6,11 @@ only the AMD64 specific ones are listed here.
 Machine check
 
    mce=off disable machine check
+   mce=bootlog Enable logging of machine checks left over from booting.
+               Disabled by default because some BIOS leave bogus ones.
+               If your BIOS doesn't do that it's a good idea to enable though
+               to make sure you log even machine check events that result
+               in a reboot.
 
    nomce (for compatibility with i386): same as mce=off
 
diff --git a/MAINTAINERS b/MAINTAINERS
index c31ddc4bcdd6..5fd00c075053 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1658,7 +1658,7 @@ M:	kuznet@ms2.inr.ac.ru
 P:      Pekka Savola (ipv6)
 M:      pekkas@netcore.fi
 P:      James Morris
-M:      jmorris@redhat.com
+M:      jmorris@namei.org
 P:      Hideaki YOSHIFUJI
 M:      yoshfuji@linux-ipv6.org
 P:      Patrick McHardy
@@ -2047,7 +2047,7 @@ SELINUX SECURITY MODULE
 P:      Stephen Smalley
 M:      sds@epoch.ncsc.mil
 P:      James Morris
-M:      jmorris@redhat.com
+M:      jmorris@namei.org
 L:      linux-kernel@vger.kernel.org (kernel issues)
 L:      selinux@tycho.nsa.gov (general discussion)
 W:      http://www.nsa.gov/selinux
diff --git a/Makefile b/Makefile
index 0196b209bb19..2c1486159d8d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 13
-EXTRAVERSION =-rc5
+EXTRAVERSION =-rc6
 NAME=Woozy Numbat
 
 # *DOCUMENTATION*
diff --git a/REPORTING-BUGS b/REPORTING-BUGS
index 2045eaea2d9e..224c34741d32 100644
--- a/REPORTING-BUGS
+++ b/REPORTING-BUGS
@@ -41,18 +41,19 @@ summary from [1.]>" for easy identification by the developers
 [2.] Full description of the problem/report:
 [3.] Keywords (i.e., modules, networking, kernel):
 [4.] Kernel version (from /proc/version):
-[5.] Output of Oops.. message (if applicable) with symbolic information 
+[5.] Most recent kernel version which did not have the bug:
+[6.] Output of Oops.. message (if applicable) with symbolic information
      resolved (see Documentation/oops-tracing.txt)
-[6.] A small shell script or example program which triggers the
+[7.] A small shell script or example program which triggers the
      problem (if possible)
-[7.] Environment
-[7.1.] Software (add the output of the ver_linux script here)
-[7.2.] Processor information (from /proc/cpuinfo):
-[7.3.] Module information (from /proc/modules):
-[7.4.] Loaded driver and hardware information (/proc/ioports, /proc/iomem)
-[7.5.] PCI information ('lspci -vvv' as root)
-[7.6.] SCSI information (from /proc/scsi/scsi)
-[7.7.] Other information that might be relevant to the problem
+[8.] Environment
+[8.1.] Software (add the output of the ver_linux script here)
+[8.2.] Processor information (from /proc/cpuinfo):
+[8.3.] Module information (from /proc/modules):
+[8.4.] Loaded driver and hardware information (/proc/ioports, /proc/iomem)
+[8.5.] PCI information ('lspci -vvv' as root)
+[8.6.] SCSI information (from /proc/scsi/scsi)
+[8.7.] Other information that might be relevant to the problem
        (please look in /proc and include all information that you
        think to be relevant):
 [X.] Other notes, patches, fixes, workarounds:
diff --git a/arch/alpha/kernel/pci.c b/arch/alpha/kernel/pci.c
index 1f36bbd0ed5d..2a8b364c822e 100644
--- a/arch/alpha/kernel/pci.c
+++ b/arch/alpha/kernel/pci.c
@@ -350,8 +350,24 @@ pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
         region->end = res->end - offset;
 }
 
+void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                             struct pci_bus_region *region)
+{
+        struct pci_controller *hose = (struct pci_controller *)dev->sysdata;
+        unsigned long offset = 0;
+
+        if (res->flags & IORESOURCE_IO)
+                offset = hose->io_space->start;
+        else if (res->flags & IORESOURCE_MEM)
+                offset = hose->mem_space->start;
+
+        res->start = region->start + offset;
+        res->end = region->end + offset;
+}
+
 #ifdef CONFIG_HOTPLUG
 EXPORT_SYMBOL(pcibios_resource_to_bus);
+EXPORT_SYMBOL(pcibios_bus_to_resource);
 #endif
 
 int
diff --git a/arch/arm/kernel/bios32.c b/arch/arm/kernel/bios32.c
index ad26e98f1e62..c4923fac8dff 100644
--- a/arch/arm/kernel/bios32.c
+++ b/arch/arm/kernel/bios32.c
@@ -447,9 +447,26 @@ pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
         region->end   = res->end - offset;
 }
 
+void __devinit
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region)
+{
+        struct pci_sys_data *root = dev->sysdata;
+        unsigned long offset = 0;
+
+        if (res->flags & IORESOURCE_IO)
+                offset = root->io_offset;
+        if (res->flags & IORESOURCE_MEM)
+                offset = root->mem_offset;
+
+        res->start = region->start + offset;
+        res->end   = region->end + offset;
+}
+
 #ifdef CONFIG_HOTPLUG
 EXPORT_SYMBOL(pcibios_fixup_bus);
 EXPORT_SYMBOL(pcibios_resource_to_bus);
+EXPORT_SYMBOL(pcibios_bus_to_resource);
 #endif
 
 /*
diff --git a/arch/arm/mach-ixp4xx/coyote-setup.c b/arch/arm/mach-ixp4xx/coyote-setup.c
index 4ff4393ef0ea..7f58afb27e71 100644
--- a/arch/arm/mach-ixp4xx/coyote-setup.c
+++ b/arch/arm/mach-ixp4xx/coyote-setup.c
@@ -61,7 +61,7 @@ static struct plat_serial8250_port coyote_uart_data[] = {
                 .mapbase        = IXP4XX_UART2_BASE_PHYS,
                 .membase        = (char *)IXP4XX_UART2_BASE_VIRT + REG_OFFSET,
                 .irq            = IRQ_IXP4XX_UART2,
-                .flags          = UPF_BOOT_AUTOCONF,
+                .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST,
                 .iotype         = UPIO_MEM,
                 .regshift       = 2,
                 .uartclk        = IXP4XX_UART_XTAL,
diff --git a/arch/arm/mach-ixp4xx/gtwx5715-setup.c b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
index 8ba1cd9406e7..65e356bd10d6 100644
--- a/arch/arm/mach-ixp4xx/gtwx5715-setup.c
+++ b/arch/arm/mach-ixp4xx/gtwx5715-setup.c
@@ -83,7 +83,7 @@ static struct plat_serial8250_port gtwx5715_uart_platform_data[] = {
         .mapbase        = IXP4XX_UART2_BASE_PHYS,
         .membase        = (char *)IXP4XX_UART2_BASE_VIRT + REG_OFFSET,
         .irq            = IRQ_IXP4XX_UART2,
-        .flags          = UPF_BOOT_AUTOCONF,
+        .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST,
         .iotype         = UPIO_MEM,
         .regshift       = 2,
         .uartclk        = IXP4XX_UART_XTAL,
diff --git a/arch/arm/mach-ixp4xx/ixdp425-setup.c b/arch/arm/mach-ixp4xx/ixdp425-setup.c
index c2ba759e9946..4633470a6a37 100644
--- a/arch/arm/mach-ixp4xx/ixdp425-setup.c
+++ b/arch/arm/mach-ixp4xx/ixdp425-setup.c
@@ -82,7 +82,7 @@ static struct plat_serial8250_port ixdp425_uart_data[] = {
                 .mapbase        = IXP4XX_UART1_BASE_PHYS,
                 .membase        = (char *)IXP4XX_UART1_BASE_VIRT + REG_OFFSET,
                 .irq            = IRQ_IXP4XX_UART1,
-                .flags          = UPF_BOOT_AUTOCONF,
+                .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST,
                 .iotype         = UPIO_MEM,
                 .regshift       = 2,
                 .uartclk        = IXP4XX_UART_XTAL,
@@ -91,7 +91,7 @@ static struct plat_serial8250_port ixdp425_uart_data[] = {
                 .mapbase        = IXP4XX_UART2_BASE_PHYS,
                 .membase        = (char *)IXP4XX_UART2_BASE_VIRT + REG_OFFSET,
                 .irq            = IRQ_IXP4XX_UART1,
-                .flags          = UPF_BOOT_AUTOCONF,
+                .flags          = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST,
                 .iotype         = UPIO_MEM,
                 .regshift       = 2,
                 .uartclk        = IXP4XX_UART_XTAL,
diff --git a/arch/arm/mach-s3c2410/mach-bast.c b/arch/arm/mach-s3c2410/mach-bast.c
index 1e7f343822d0..e9182242da95 100644
--- a/arch/arm/mach-s3c2410/mach-bast.c
+++ b/arch/arm/mach-s3c2410/mach-bast.c
@@ -30,6 +30,7 @@
  *     28-Jun-2005 BJD  Moved pm functionality out to common code
  *     17-Jul-2005 BJD  Changed to platform device for SuperIO 16550s
  *     25-Jul-2005 BJD  Removed ASIX static mappings
+ *     27-Jul-2005 BJD  Ensure maximum frequency of i2c bus
 */
 
 #include <linux/kernel.h>
@@ -60,6 +61,7 @@
 #include <asm/arch/regs-mem.h>
 #include <asm/arch/regs-lcd.h>
 #include <asm/arch/nand.h>
+#include <asm/arch/iic.h>
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
@@ -304,7 +306,7 @@ static void bast_nand_select(struct s3c2410_nand_set *set, int slot)
 }
 
 static struct s3c2410_platform_nand bast_nand_info = {
-        .tacls          = 80,
+        .tacls          = 40,
         .twrph0         = 80,
         .twrph1         = 80,
         .nr_sets        = ARRAY_SIZE(bast_nand_sets),
@@ -385,6 +387,17 @@ static struct platform_device bast_sio = {
         },
 };
 
+/* we have devices on the bus which cannot work much over the
+ * standard 100KHz i2c bus frequency
+*/
+
+static struct s3c2410_platform_i2c bast_i2c_info = {
+        .flags          = 0,
+        .slave_addr     = 0x10,
+        .bus_freq       = 100*1000,
+        .max_freq       = 130*1000,
+};
+
 /* Standard BAST devices */
 
 static struct platform_device *bast_devices[] __initdata = {
@@ -431,6 +444,7 @@ void __init bast_map_io(void)
         s3c24xx_uclk.parent  = &s3c24xx_clkout1;
 
         s3c_device_nand.dev.platform_data = &bast_nand_info;
+        s3c_device_i2c.dev.platform_data = &bast_i2c_info;
 
         s3c24xx_init_io(bast_iodesc, ARRAY_SIZE(bast_iodesc));
         s3c24xx_init_clocks(0);
diff --git a/arch/arm/mach-sa1100/jornada720.c b/arch/arm/mach-sa1100/jornada720.c
index eee3cbc5ec4f..2f497112c96a 100644
--- a/arch/arm/mach-sa1100/jornada720.c
+++ b/arch/arm/mach-sa1100/jornada720.c
@@ -97,6 +97,7 @@ static void __init jornada720_map_io(void)
 }
 
 MACHINE_START(JORNADA720, "HP Jornada 720")
+        /* Maintainer: Michael Gernoth <michael@gernoth.net> */
         .phys_ram       = 0xc0000000,
         .phys_io        = 0x80000000,
         .io_pg_offst    = ((0xf8000000) >> 18) & 0xfffc,
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index 65bfe84b6d67..0b6c4db44e08 100644
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -238,9 +238,9 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         up_read(&mm->mmap_sem);
 
         /*
-         * Handle the "normal" case first
+         * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
          */
-        if (fault > 0)
+        if (fault >= VM_FAULT_MINOR)
                 return 0;
 
         /*
@@ -261,7 +261,7 @@ do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                 do_exit(SIGKILL);
                 return 0;
 
-        case 0:
+        case VM_FAULT_SIGBUS:
                 /*
                  * We had some memory, but were unable to
                  * successfully fix up this page fault.
diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
index 2d977b4eeeab..b88de2700146 100644
--- a/arch/arm/mm/proc-xscale.S
+++ b/arch/arm/mm/proc-xscale.S
@@ -370,142 +370,6 @@ ENTRY(cpu_xscale_dcache_clean_area)
         bhi     1b
         mov     pc, lr
 
-/* ================================ CACHE LOCKING============================
- *
- * The XScale MicroArchitecture implements support for locking entries into
- * the data and instruction cache.  The following functions implement the core
- * low level instructions needed to accomplish the locking.  The developer's
- * manual states that the code that performs the locking must be in non-cached
- * memory.  To accomplish this, the code in xscale-cache-lock.c copies the
- * following functions from the cache into a non-cached memory region that
- * is allocated through consistent_alloc().
- *
- */
-        .align  5
-/*
- * xscale_icache_lock
- *
- * r0: starting address to lock
- * r1: end address to lock
- */
-ENTRY(xscale_icache_lock)
-
-iLockLoop:
-        bic     r0, r0, #CACHELINESIZE - 1
-        mcr     p15, 0, r0, c9, c1, 0   @ lock into cache
-        cmp     r0, r1                  @ are we done?
-        add     r0, r0, #CACHELINESIZE  @ advance to next cache line
-        bls     iLockLoop
-        mov     pc, lr
-
-/*
- * xscale_icache_unlock
- */
-ENTRY(xscale_icache_unlock)
-        mcr     p15, 0, r0, c9, c1, 1   @ Unlock icache
-        mov     pc, lr
-
-/*
- * xscale_dcache_lock
- *
- * r0: starting address to lock
- * r1: end address to lock
- */
-ENTRY(xscale_dcache_lock)
-        mcr     p15, 0, ip, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     r2, #1
-        mcr     p15, 0, r2, c9, c2, 0   @ Put dcache in lock mode
-        cpwait  ip                      @ Wait for completion
-
-        mrs     r2, cpsr
-        orr     r3, r2, #PSR_F_BIT | PSR_I_BIT
-dLockLoop:
-        msr     cpsr_c, r3
-        mcr     p15, 0, r0, c7, c10, 1  @ Write back line if it is dirty
-        mcr     p15, 0, r0, c7, c6, 1   @ Flush/invalidate line
-        msr     cpsr_c, r2
-        ldr     ip, [r0], #CACHELINESIZE @ Preload 32 bytes into cache from
-                                        @ location [r0]. Post-increment
-                                        @ r3 to next cache line
-        cmp     r0, r1                  @ Are we done?
-        bls     dLockLoop
-
-        mcr     p15, 0, ip, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mov     r2, #0
-        mcr     p15, 0, r2, c9, c2, 0   @ Get out of lock mode
-        cpwait_ret lr, ip
-
-/*
- * xscale_dcache_unlock
- */
-ENTRY(xscale_dcache_unlock)
-        mcr     p15, 0, ip, c7, c10, 4          @ Drain Write (& Fill) Buffer
-        mcr     p15, 0, ip, c9, c2, 1   @ Unlock cache
-        mov     pc, lr
-
-/*
- * Needed to determine the length of the code that needs to be copied.
- */
-        .align  5
-ENTRY(xscale_cache_dummy)
-        mov     pc, lr
-
-/* ================================ TLB LOCKING==============================
- *
- * The XScale MicroArchitecture implements support for locking entries into
- * the Instruction and Data TLBs.  The following functions provide the
- * low level support for supporting these under Linux.  xscale-lock.c
- * implements some higher level management code.  Most of the following
- * is taken straight out of the Developer's Manual.
- */
-
-/*
- * Lock I-TLB entry
- *
- * r0: Virtual address to translate and lock
- */
-        .align  5
-ENTRY(xscale_itlb_lock)
-        mrs     r2, cpsr
-        orr     r3, r2, #PSR_F_BIT | PSR_I_BIT
-        msr     cpsr_c, r3                      @ Disable interrupts
-        mcr     p15, 0, r0, c8, c5, 1           @ Invalidate I-TLB entry
-        mcr     p15, 0, r0, c10, c4, 0          @ Translate and lock
-        msr     cpsr_c, r2                      @ Restore interrupts
-        cpwait_ret lr, ip
-
-/*
- * Lock D-TLB entry
- *
- * r0: Virtual address to translate and lock
- */
-        .align  5
-ENTRY(xscale_dtlb_lock)
-        mrs     r2, cpsr
-        orr     r3, r2, #PSR_F_BIT | PSR_I_BIT
-        msr     cpsr_c, r3                      @ Disable interrupts
-        mcr     p15, 0, r0, c8, c6, 1           @ Invalidate D-TLB entry
-        mcr     p15, 0, r0, c10, c8, 0          @ Translate and lock
-        msr     cpsr_c, r2                      @ Restore interrupts
-        cpwait_ret lr, ip
-
-/*
- * Unlock all I-TLB entries
- */
-        .align  5
-ENTRY(xscale_itlb_unlock)
-        mcr     p15, 0, ip, c10, c4, 1          @ Unlock I-TLB
-        mcr     p15, 0, ip, c8, c5, 0           @ Invalidate I-TLB
-        cpwait_ret lr, ip
-
-/*
- * Unlock all D-TLB entries
- */
-ENTRY(xscale_dtlb_unlock)
-        mcr     p15, 0, ip, c10, c8, 1          @ Unlock D-TBL
-        mcr     p15, 0, ip, c8, c6, 0           @ Invalidate D-TLB
-        cpwait_ret lr, ip
-
 /* =============================== PageTable ============================== */
 
 #define PTE_CACHE_WRITE_ALLOCATE 0
diff --git a/arch/arm/nwfpe/double_cpdo.c b/arch/arm/nwfpe/double_cpdo.c
index 7ffd8cb9bc96..c51d1386a97c 100644
--- a/arch/arm/nwfpe/double_cpdo.c
+++ b/arch/arm/nwfpe/double_cpdo.c
@@ -40,17 +40,17 @@ float64 float64_arccos(float64 rFm);
 float64 float64_pow(float64 rFn, float64 rFm);
 float64 float64_pol(float64 rFn, float64 rFm);
 
-static float64 float64_rsf(float64 rFn, float64 rFm)
+static float64 float64_rsf(struct roundingData *roundData, float64 rFn, float64 rFm)
 {
-        return float64_sub(rFm, rFn);
+        return float64_sub(roundData, rFm, rFn);
 }
 
-static float64 float64_rdv(float64 rFn, float64 rFm)
+static float64 float64_rdv(struct roundingData *roundData, float64 rFn, float64 rFm)
 {
-        return float64_div(rFm, rFn);
+        return float64_div(roundData, rFm, rFn);
 }
 
-static float64 (*const dyadic_double[16])(float64 rFn, float64 rFm) = {
+static float64 (*const dyadic_double[16])(struct roundingData*, float64 rFn, float64 rFm) = {
         [ADF_CODE >> 20] = float64_add,
         [MUF_CODE >> 20] = float64_mul,
         [SUF_CODE >> 20] = float64_sub,
@@ -65,12 +65,12 @@ static float64 (*const dyadic_double[16])(float64 rFn, float64 rFm) = {
         [FRD_CODE >> 20] = float64_rdv,
 };
 
-static float64 float64_mvf(float64 rFm)
+static float64 float64_mvf(struct roundingData *roundData,float64 rFm)
 {
         return rFm;
 }
 
-static float64 float64_mnf(float64 rFm)
+static float64 float64_mnf(struct roundingData *roundData,float64 rFm)
 {
         union float64_components u;
 
@@ -84,7 +84,7 @@ static float64 float64_mnf(float64 rFm)
         return u.f64;
 }
 
-static float64 float64_abs(float64 rFm)
+static float64 float64_abs(struct roundingData *roundData,float64 rFm)
 {
         union float64_components u;
 
@@ -98,7 +98,7 @@ static float64 float64_abs(float64 rFm)
         return u.f64;
 }
 
-static float64 (*const monadic_double[16])(float64 rFm) = {
+static float64 (*const monadic_double[16])(struct roundingData *, float64 rFm) = {
         [MVF_CODE >> 20] = float64_mvf,
         [MNF_CODE >> 20] = float64_mnf,
         [ABS_CODE >> 20] = float64_abs,
@@ -108,7 +108,7 @@ static float64 (*const monadic_double[16])(float64 rFm) = {
         [NRM_CODE >> 20] = float64_mvf,
 };
 
-unsigned int DoubleCPDO(const unsigned int opcode, FPREG * rFd)
+unsigned int DoubleCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd)
 {
         FPA11 *fpa11 = GET_FPA11();
         float64 rFm;
@@ -151,13 +151,13 @@ unsigned int DoubleCPDO(const unsigned int opcode, FPREG * rFd)
                 }
 
                 if (dyadic_double[opc_mask_shift]) {
-                        rFd->fDouble = dyadic_double[opc_mask_shift](rFn, rFm);
+                        rFd->fDouble = dyadic_double[opc_mask_shift](roundData, rFn, rFm);
                 } else {
                         return 0;
                 }
         } else {
                 if (monadic_double[opc_mask_shift]) {
-                        rFd->fDouble = monadic_double[opc_mask_shift](rFm);
+                        rFd->fDouble = monadic_double[opc_mask_shift](roundData, rFm);
                 } else {
                         return 0;
                 }
diff --git a/arch/arm/nwfpe/extended_cpdo.c b/arch/arm/nwfpe/extended_cpdo.c
index c39f68a3449e..65a279ba927f 100644
--- a/arch/arm/nwfpe/extended_cpdo.c
+++ b/arch/arm/nwfpe/extended_cpdo.c
@@ -35,17 +35,17 @@ floatx80 floatx80_arccos(floatx80 rFm);
 floatx80 floatx80_pow(floatx80 rFn, floatx80 rFm);
 floatx80 floatx80_pol(floatx80 rFn, floatx80 rFm);
 
-static floatx80 floatx80_rsf(floatx80 rFn, floatx80 rFm)
+static floatx80 floatx80_rsf(struct roundingData *roundData, floatx80 rFn, floatx80 rFm)
 {
-        return floatx80_sub(rFm, rFn);
+        return floatx80_sub(roundData, rFm, rFn);
 }
 
-static floatx80 floatx80_rdv(floatx80 rFn, floatx80 rFm)
+static floatx80 floatx80_rdv(struct roundingData *roundData, floatx80 rFn, floatx80 rFm)
 {
-        return floatx80_div(rFm, rFn);
+        return floatx80_div(roundData, rFm, rFn);
 }
 
-static floatx80 (*const dyadic_extended[16])(floatx80 rFn, floatx80 rFm) = {
+static floatx80 (*const dyadic_extended[16])(struct roundingData*, floatx80 rFn, floatx80 rFm) = {
         [ADF_CODE >> 20] = floatx80_add,
         [MUF_CODE >> 20] = floatx80_mul,
         [SUF_CODE >> 20] = floatx80_sub,
@@ -60,24 +60,24 @@ static floatx80 (*const dyadic_extended[16])(floatx80 rFn, floatx80 rFm) = {
         [FRD_CODE >> 20] = floatx80_rdv,
 };
 
-static floatx80 floatx80_mvf(floatx80 rFm)
+static floatx80 floatx80_mvf(struct roundingData *roundData, floatx80 rFm)
 {
         return rFm;
 }
 
-static floatx80 floatx80_mnf(floatx80 rFm)
+static floatx80 floatx80_mnf(struct roundingData *roundData, floatx80 rFm)
 {
         rFm.high ^= 0x8000;
         return rFm;
 }
 
-static floatx80 floatx80_abs(floatx80 rFm)
+static floatx80 floatx80_abs(struct roundingData *roundData, floatx80 rFm)
 {
         rFm.high &= 0x7fff;
         return rFm;
 }
 
-static floatx80 (*const monadic_extended[16])(floatx80 rFm) = {
+static floatx80 (*const monadic_extended[16])(struct roundingData*, floatx80 rFm) = {
         [MVF_CODE >> 20] = floatx80_mvf,
         [MNF_CODE >> 20] = floatx80_mnf,
         [ABS_CODE >> 20] = floatx80_abs,
@@ -87,7 +87,7 @@ static floatx80 (*const monadic_extended[16])(floatx80 rFm) = {
         [NRM_CODE >> 20] = floatx80_mvf,
 };
 
-unsigned int ExtendedCPDO(const unsigned int opcode, FPREG * rFd)
+unsigned int ExtendedCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd)
 {
         FPA11 *fpa11 = GET_FPA11();
         floatx80 rFm;
@@ -138,13 +138,13 @@ unsigned int ExtendedCPDO(const unsigned int opcode, FPREG * rFd)
                 }
 
                 if (dyadic_extended[opc_mask_shift]) {
-                        rFd->fExtended = dyadic_extended[opc_mask_shift](rFn, rFm);
+                        rFd->fExtended = dyadic_extended[opc_mask_shift](roundData, rFn, rFm);
                 } else {
                         return 0;
                 }
         } else {
                 if (monadic_extended[opc_mask_shift]) {
-                        rFd->fExtended = monadic_extended[opc_mask_shift](rFm);
+                        rFd->fExtended = monadic_extended[opc_mask_shift](roundData, rFm);
                 } else {
                         return 0;
                 }
diff --git a/arch/arm/nwfpe/fpa11.c b/arch/arm/nwfpe/fpa11.c
index bf61696865ec..7690f731ee87 100644
--- a/arch/arm/nwfpe/fpa11.c
+++ b/arch/arm/nwfpe/fpa11.c
@@ -51,48 +51,42 @@ static void resetFPA11(void)
         fpa11->fpsr = FP_EMULATOR | BIT_AC;
 }
 
-void SetRoundingMode(const unsigned int opcode)
+int8 SetRoundingMode(const unsigned int opcode)
 {
         switch (opcode & MASK_ROUNDING_MODE) {
         default:
         case ROUND_TO_NEAREST:
-                float_rounding_mode = float_round_nearest_even;
-                break;
+                return float_round_nearest_even;
 
         case ROUND_TO_PLUS_INFINITY:
-                float_rounding_mode = float_round_up;
-                break;
+                return float_round_up;
 
         case ROUND_TO_MINUS_INFINITY:
-                float_rounding_mode = float_round_down;
-                break;
+                return float_round_down;
 
         case ROUND_TO_ZERO:
-                float_rounding_mode = float_round_to_zero;
-                break;
+                return float_round_to_zero;
         }
 }
 
-void SetRoundingPrecision(const unsigned int opcode)
+int8 SetRoundingPrecision(const unsigned int opcode)
 {
 #ifdef CONFIG_FPE_NWFPE_XP
         switch (opcode & MASK_ROUNDING_PRECISION) {
         case ROUND_SINGLE:
-                floatx80_rounding_precision = 32;
-                break;
+                return 32;
 
         case ROUND_DOUBLE:
-                floatx80_rounding_precision = 64;
-                break;
+                return 64;
 
         case ROUND_EXTENDED:
-                floatx80_rounding_precision = 80;
-                break;
+                return 80;
 
         default:
-                floatx80_rounding_precision = 80;
+                return 80;
         }
 #endif
+        return 80;
 }
 
 void nwfpe_init_fpa(union fp_state *fp)
@@ -103,8 +97,6 @@ void nwfpe_init_fpa(union fp_state *fp)
 #endif
         memset(fpa11, 0, sizeof(FPA11));
         resetFPA11();
-        SetRoundingMode(ROUND_TO_NEAREST);
-        SetRoundingPrecision(ROUND_EXTENDED);
         fpa11->initflag = 1;
 }
 
diff --git a/arch/arm/nwfpe/fpa11.h b/arch/arm/nwfpe/fpa11.h
index e4a61aea534b..93523ae4b7a1 100644
--- a/arch/arm/nwfpe/fpa11.h
+++ b/arch/arm/nwfpe/fpa11.h
@@ -37,6 +37,13 @@
 /* includes */
 #include "fpsr.h"               /* FP control and status register definitions */
 #include "milieu.h"
+
+struct roundingData {
+    int8 mode;
+    int8 precision;
+    signed char exception;
+};
+
 #include "softfloat.h"
 
 #define         typeNone                0x00
@@ -84,8 +91,8 @@ typedef struct tagFPA11 {
                                    initialised. */
 } FPA11;
 
-extern void SetRoundingMode(const unsigned int);
-extern void SetRoundingPrecision(const unsigned int);
+extern int8 SetRoundingMode(const unsigned int);
+extern int8 SetRoundingPrecision(const unsigned int);
 extern void nwfpe_init_fpa(union fp_state *fp);
 
 #endif
diff --git a/arch/arm/nwfpe/fpa11_cpdo.c b/arch/arm/nwfpe/fpa11_cpdo.c
index 1bea67437b6f..4a31dfd94068 100644
--- a/arch/arm/nwfpe/fpa11_cpdo.c
+++ b/arch/arm/nwfpe/fpa11_cpdo.c
@@ -24,15 +24,16 @@
 #include "fpa11.h"
 #include "fpopcode.h"
 
-unsigned int SingleCPDO(const unsigned int opcode, FPREG * rFd);
-unsigned int DoubleCPDO(const unsigned int opcode, FPREG * rFd);
-unsigned int ExtendedCPDO(const unsigned int opcode, FPREG * rFd);
+unsigned int SingleCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd);
+unsigned int DoubleCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd);
+unsigned int ExtendedCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd);
 
 unsigned int EmulateCPDO(const unsigned int opcode)
 {
         FPA11 *fpa11 = GET_FPA11();
         FPREG *rFd;
         unsigned int nType, nDest, nRc;
+        struct roundingData roundData;
 
         /* Get the destination size.  If not valid let Linux perform
            an invalid instruction trap. */
@@ -40,7 +41,9 @@ unsigned int EmulateCPDO(const unsigned int opcode)
         if (typeNone == nDest)
                 return 0;
 
-        SetRoundingMode(opcode);
+        roundData.mode = SetRoundingMode(opcode);
+        roundData.precision = SetRoundingPrecision(opcode);
+        roundData.exception = 0;
 
         /* Compare the size of the operands in Fn and Fm.
            Choose the largest size and perform operations in that size,
@@ -63,14 +66,14 @@ unsigned int EmulateCPDO(const unsigned int opcode)
 
         switch (nType) {
         case typeSingle:
-                nRc = SingleCPDO(opcode, rFd);
+                nRc = SingleCPDO(&roundData, opcode, rFd);
                 break;
         case typeDouble:
-                nRc = DoubleCPDO(opcode, rFd);
+                nRc = DoubleCPDO(&roundData, opcode, rFd);
                 break;
 #ifdef CONFIG_FPE_NWFPE_XP
         case typeExtended:
-                nRc = ExtendedCPDO(opcode, rFd);
+                nRc = ExtendedCPDO(&roundData, opcode, rFd);
                 break;
 #endif
         default:
@@ -93,9 +96,9 @@ unsigned int EmulateCPDO(const unsigned int opcode)
                         case typeSingle:
                                 {
                                         if (typeDouble == nType)
-                                                rFd->fSingle = float64_to_float32(rFd->fDouble);
+                                                rFd->fSingle = float64_to_float32(&roundData, rFd->fDouble);
                                         else
-                                                rFd->fSingle = floatx80_to_float32(rFd->fExtended);
+                                                rFd->fSingle = floatx80_to_float32(&roundData, rFd->fExtended);
                                 }
                                 break;
 
@@ -104,7 +107,7 @@ unsigned int EmulateCPDO(const unsigned int opcode)
                                         if (typeSingle == nType)
                                                 rFd->fDouble = float32_to_float64(rFd->fSingle);
                                         else
-                                                rFd->fDouble = floatx80_to_float64(rFd->fExtended);
+                                                rFd->fDouble = floatx80_to_float64(&roundData, rFd->fExtended);
                                 }
                                 break;
 
@@ -121,12 +124,15 @@ unsigned int EmulateCPDO(const unsigned int opcode)
 #else
                 if (nDest != nType) {
                         if (nDest == typeSingle)
-                                rFd->fSingle = float64_to_float32(rFd->fDouble);
+                                rFd->fSingle = float64_to_float32(&roundData, rFd->fDouble);
                         else
                                 rFd->fDouble = float32_to_float64(rFd->fSingle);
                 }
 #endif
         }
 
+        if (roundData.exception)
+                float_raise(roundData.exception);
+
         return nRc;
 }
diff --git a/arch/arm/nwfpe/fpa11_cpdt.c b/arch/arm/nwfpe/fpa11_cpdt.c
index 95fb63fa9d18..b0db5cbcc3b1 100644
--- a/arch/arm/nwfpe/fpa11_cpdt.c
+++ b/arch/arm/nwfpe/fpa11_cpdt.c
@@ -96,7 +96,7 @@ static inline void loadMultiple(const unsigned int Fn, const unsigned int __user
         }
 }
 
-static inline void storeSingle(const unsigned int Fn, unsigned int __user *pMem)
+static inline void storeSingle(struct roundingData *roundData, const unsigned int Fn, unsigned int __user *pMem)
 {
         FPA11 *fpa11 = GET_FPA11();
         union {
@@ -106,12 +106,12 @@ static inline void storeSingle(const unsigned int Fn, unsigned int __user *pMem)
 
         switch (fpa11->fType[Fn]) {
         case typeDouble:
-                val.f = float64_to_float32(fpa11->fpreg[Fn].fDouble);
+                val.f = float64_to_float32(roundData, fpa11->fpreg[Fn].fDouble);
                 break;
 
 #ifdef CONFIG_FPE_NWFPE_XP
         case typeExtended:
-                val.f = floatx80_to_float32(fpa11->fpreg[Fn].fExtended);
+                val.f = floatx80_to_float32(roundData, fpa11->fpreg[Fn].fExtended);
                 break;
 #endif
 
@@ -122,7 +122,7 @@ static inline void storeSingle(const unsigned int Fn, unsigned int __user *pMem)
         put_user(val.i[0], pMem);
 }
 
-static inline void storeDouble(const unsigned int Fn, unsigned int __user *pMem)
+static inline void storeDouble(struct roundingData *roundData, const unsigned int Fn, unsigned int __user *pMem)
 {
         FPA11 *fpa11 = GET_FPA11();
         union {
@@ -137,7 +137,7 @@ static inline void storeDouble(const unsigned int Fn, unsigned int __user *pMem)
 
 #ifdef CONFIG_FPE_NWFPE_XP
         case typeExtended:
-                val.f = floatx80_to_float64(fpa11->fpreg[Fn].fExtended);
+                val.f = floatx80_to_float64(roundData, fpa11->fpreg[Fn].fExtended);
                 break;
 #endif
 
@@ -259,8 +259,11 @@ unsigned int PerformSTF(const unsigned int opcode)
 {
         unsigned int __user *pBase, *pAddress, *pFinal;
         unsigned int nRc = 1, write_back = WRITE_BACK(opcode);
+        struct roundingData roundData;
 
-        SetRoundingMode(ROUND_TO_NEAREST);
+        roundData.mode = SetRoundingMode(opcode);
+        roundData.precision = SetRoundingPrecision(opcode);
+        roundData.exception = 0;
 
         pBase = (unsigned int __user *) readRegister(getRn(opcode));
         if (REG_PC == getRn(opcode)) {
@@ -281,10 +284,10 @@ unsigned int PerformSTF(const unsigned int opcode)
 
         switch (opcode & MASK_TRANSFER_LENGTH) {
         case TRANSFER_SINGLE:
-                storeSingle(getFd(opcode), pAddress);
+                storeSingle(&roundData, getFd(opcode), pAddress);
                 break;
         case TRANSFER_DOUBLE:
-                storeDouble(getFd(opcode), pAddress);
+                storeDouble(&roundData, getFd(opcode), pAddress);
                 break;
 #ifdef CONFIG_FPE_NWFPE_XP
         case TRANSFER_EXTENDED:
@@ -295,6 +298,9 @@ unsigned int PerformSTF(const unsigned int opcode)
                 nRc = 0;
         }
 
+        if (roundData.exception)
+                float_raise(roundData.exception);
+
         if (write_back)
                 writeRegister(getRn(opcode), (unsigned long) pFinal);
         return nRc;
diff --git a/arch/arm/nwfpe/fpa11_cprt.c b/arch/arm/nwfpe/fpa11_cprt.c
index db01fbc97216..adf8d3000540 100644
--- a/arch/arm/nwfpe/fpa11_cprt.c
+++ b/arch/arm/nwfpe/fpa11_cprt.c
@@ -33,8 +33,6 @@ extern flag floatx80_is_nan(floatx80);
 extern flag float64_is_nan(float64);
 extern flag float32_is_nan(float32);
 
-void SetRoundingMode(const unsigned int opcode);
-
 unsigned int PerformFLT(const unsigned int opcode);
 unsigned int PerformFIX(const unsigned int opcode);
 
@@ -77,14 +75,17 @@ unsigned int EmulateCPRT(const unsigned int opcode)
 unsigned int PerformFLT(const unsigned int opcode)
 {
         FPA11 *fpa11 = GET_FPA11();
-        SetRoundingMode(opcode);
-        SetRoundingPrecision(opcode);
+        struct roundingData roundData;
+
+        roundData.mode = SetRoundingMode(opcode);
+        roundData.precision = SetRoundingPrecision(opcode);
+        roundData.exception = 0;
 
         switch (opcode & MASK_ROUNDING_PRECISION) {
         case ROUND_SINGLE:
                 {
                         fpa11->fType[getFn(opcode)] = typeSingle;
-                        fpa11->fpreg[getFn(opcode)].fSingle = int32_to_float32(readRegister(getRd(opcode)));
+                        fpa11->fpreg[getFn(opcode)].fSingle = int32_to_float32(&roundData, readRegister(getRd(opcode)));
                 }
                 break;
 
@@ -108,6 +109,9 @@ unsigned int PerformFLT(const unsigned int opcode)
                 return 0;
         }
 
+        if (roundData.exception)
+                float_raise(roundData.exception);
+
         return 1;
 }
 
@@ -115,26 +119,29 @@ unsigned int PerformFIX(const unsigned int opcode)
 {
         FPA11 *fpa11 = GET_FPA11();
         unsigned int Fn = getFm(opcode);
+        struct roundingData roundData;
 
-        SetRoundingMode(opcode);
+        roundData.mode = SetRoundingMode(opcode);
+        roundData.precision = SetRoundingPrecision(opcode);
+        roundData.exception = 0;
 
         switch (fpa11->fType[Fn]) {
         case typeSingle:
                 {
-                        writeRegister(getRd(opcode), float32_to_int32(fpa11->fpreg[Fn].fSingle));
+                        writeRegister(getRd(opcode), float32_to_int32(&roundData, fpa11->fpreg[Fn].fSingle));
                 }
                 break;
 
         case typeDouble:
                 {
-                        writeRegister(getRd(opcode), float64_to_int32(fpa11->fpreg[Fn].fDouble));
+                        writeRegister(getRd(opcode), float64_to_int32(&roundData, fpa11->fpreg[Fn].fDouble));
                 }
                 break;
 
 #ifdef CONFIG_FPE_NWFPE_XP
         case typeExtended:
                 {
-                        writeRegister(getRd(opcode), floatx80_to_int32(fpa11->fpreg[Fn].fExtended));
+                        writeRegister(getRd(opcode), floatx80_to_int32(&roundData, fpa11->fpreg[Fn].fExtended));
                 }
                 break;
 #endif
@@ -143,6 +150,9 @@ unsigned int PerformFIX(const unsigned int opcode)
                 return 0;
         }
 
+        if (roundData.exception)
+                float_raise(roundData.exception);
+
         return 1;
 }
 
diff --git a/arch/arm/nwfpe/fpmodule.c b/arch/arm/nwfpe/fpmodule.c
index 12885f31d347..2dfe1ac42ee8 100644
--- a/arch/arm/nwfpe/fpmodule.c
+++ b/arch/arm/nwfpe/fpmodule.c
@@ -116,8 +116,6 @@ fpmodule.c to integrate with the NetBSD kernel (I hope!).
 code to access data in user space in some other source files at the 
 moment (grep for get_user / put_user calls).  --philb]
 
-float_exception_flags is a global variable in SoftFloat.
-
 This function is called by the SoftFloat routines to raise a floating
 point exception.  We check the trap enable byte in the FPSR, and raise
 a SIGFPE exception if necessary.  If not the relevant bits in the 
@@ -129,15 +127,14 @@ void float_raise(signed char flags)
         register unsigned int fpsr, cumulativeTraps;
 
 #ifdef CONFIG_DEBUG_USER
-        printk(KERN_DEBUG
-               "NWFPE: %s[%d] takes exception %08x at %p from %08lx\n",
-               current->comm, current->pid, flags,
-               __builtin_return_address(0), GET_USERREG()->ARM_pc);
+        /* Ignore inexact errors as there are far too many of them to log */
+        if (flags & ~BIT_IXC)
+                printk(KERN_DEBUG
+                       "NWFPE: %s[%d] takes exception %08x at %p from %08lx\n",
+                       current->comm, current->pid, flags,
+                       __builtin_return_address(0), GET_USERREG()->ARM_pc);
 #endif
 
-        /* Keep SoftFloat exception flags up to date.  */
-        float_exception_flags |= flags;
-
         /* Read fpsr and initialize the cumulativeTraps.  */
         fpsr = readFPSR();
         cumulativeTraps = 0;
diff --git a/arch/arm/nwfpe/single_cpdo.c b/arch/arm/nwfpe/single_cpdo.c
index 705808e88d9d..c66981d682cf 100644
--- a/arch/arm/nwfpe/single_cpdo.c
+++ b/arch/arm/nwfpe/single_cpdo.c
@@ -36,17 +36,17 @@ float32 float32_arccos(float32 rFm);
 float32 float32_pow(float32 rFn, float32 rFm);
 float32 float32_pol(float32 rFn, float32 rFm);
 
-static float32 float32_rsf(float32 rFn, float32 rFm)
+static float32 float32_rsf(struct roundingData *roundData, float32 rFn, float32 rFm)
 {
-        return float32_sub(rFm, rFn);
+        return float32_sub(roundData, rFm, rFn);
 }
 
-static float32 float32_rdv(float32 rFn, float32 rFm)
+static float32 float32_rdv(struct roundingData *roundData, float32 rFn, float32 rFm)
 {
-        return float32_div(rFm, rFn);
+        return float32_div(roundData, rFm, rFn);
 }
 
-static float32 (*const dyadic_single[16])(float32 rFn, float32 rFm) = {
+static float32 (*const dyadic_single[16])(struct roundingData *, float32 rFn, float32 rFm) = {
         [ADF_CODE >> 20] = float32_add,
         [MUF_CODE >> 20] = float32_mul,
         [SUF_CODE >> 20] = float32_sub,
@@ -60,22 +60,22 @@ static float32 (*const dyadic_single[16])(float32 rFn, float32 rFm) = {
         [FRD_CODE >> 20] = float32_rdv,
 };
 
-static float32 float32_mvf(float32 rFm)
+static float32 float32_mvf(struct roundingData *roundData, float32 rFm)
 {
         return rFm;
 }
 
-static float32 float32_mnf(float32 rFm)
+static float32 float32_mnf(struct roundingData *roundData, float32 rFm)
 {
         return rFm ^ 0x80000000;
 }
 
-static float32 float32_abs(float32 rFm)
+static float32 float32_abs(struct roundingData *roundData, float32 rFm)
 {
         return rFm & 0x7fffffff;
 }
 
-static float32 (*const monadic_single[16])(float32 rFm) = {
+static float32 (*const monadic_single[16])(struct roundingData*, float32 rFm) = {
         [MVF_CODE >> 20] = float32_mvf,
         [MNF_CODE >> 20] = float32_mnf,
         [ABS_CODE >> 20] = float32_abs,
@@ -85,7 +85,7 @@ static float32 (*const monadic_single[16])(float32 rFm) = {
         [NRM_CODE >> 20] = float32_mvf,
 };
 
-unsigned int SingleCPDO(const unsigned int opcode, FPREG * rFd)
+unsigned int SingleCPDO(struct roundingData *roundData, const unsigned int opcode, FPREG * rFd)
 {
         FPA11 *fpa11 = GET_FPA11();
         float32 rFm;
@@ -108,13 +108,13 @@ unsigned int SingleCPDO(const unsigned int opcode, FPREG * rFd)
                 if (fpa11->fType[Fn] == typeSingle &&
                     dyadic_single[opc_mask_shift]) {
                         rFn = fpa11->fpreg[Fn].fSingle;
-                        rFd->fSingle = dyadic_single[opc_mask_shift](rFn, rFm);
+                        rFd->fSingle = dyadic_single[opc_mask_shift](roundData, rFn, rFm);
                 } else {
                         return 0;
                 }
         } else {
                 if (monadic_single[opc_mask_shift]) {
-                        rFd->fSingle = monadic_single[opc_mask_shift](rFm);
+                        rFd->fSingle = monadic_single[opc_mask_shift](roundData, rFm);
                 } else {
                         return 0;
                 }
diff --git a/arch/arm/nwfpe/softfloat.c b/arch/arm/nwfpe/softfloat.c
index e038dd3be9b3..8b75a6e7cb3a 100644
--- a/arch/arm/nwfpe/softfloat.c
+++ b/arch/arm/nwfpe/softfloat.c
@@ -36,16 +36,6 @@ this code that are retained.
 
 /*
 -------------------------------------------------------------------------------
-Floating-point rounding mode, extended double-precision rounding precision,
-and exception flags.
--------------------------------------------------------------------------------
-*/
-int8 float_rounding_mode = float_round_nearest_even;
-int8 floatx80_rounding_precision = 80;
-int8 float_exception_flags;
-
-/*
--------------------------------------------------------------------------------
 Primitive arithmetic functions, including multi-word arithmetic, and
 division and square root approximations.  (Can be specialized to target if
 desired.)
@@ -77,14 +67,14 @@ input is too large, however, the invalid exception is raised and the largest
 positive or negative integer is returned.
 -------------------------------------------------------------------------------
 */
-static int32 roundAndPackInt32( flag zSign, bits64 absZ )
+static int32 roundAndPackInt32( struct roundingData *roundData, flag zSign, bits64 absZ )
 {
     int8 roundingMode;
     flag roundNearestEven;
     int8 roundIncrement, roundBits;
     int32 z;
 
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
     roundNearestEven = ( roundingMode == float_round_nearest_even );
     roundIncrement = 0x40;
     if ( ! roundNearestEven ) {
@@ -107,10 +97,10 @@ static int32 roundAndPackInt32( flag zSign, bits64 absZ )
     z = absZ;
     if ( zSign ) z = - z;
     if ( ( absZ>>32 ) || ( z && ( ( z < 0 ) ^ zSign ) ) ) {
-        float_exception_flags |= float_flag_invalid;
+        roundData->exception |= float_flag_invalid;
         return zSign ? 0x80000000 : 0x7FFFFFFF;
     }
-    if ( roundBits ) float_exception_flags |= float_flag_inexact;
+    if ( roundBits ) roundData->exception |= float_flag_inexact;
     return z;
 
 }
@@ -224,14 +214,14 @@ The handling of underflow and overflow follows the IEC/IEEE Standard for
 Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float32 roundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig )
+static float32 roundAndPackFloat32( struct roundingData *roundData, flag zSign, int16 zExp, bits32 zSig )
 {
     int8 roundingMode;
     flag roundNearestEven;
     int8 roundIncrement, roundBits;
     flag isTiny;
 
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
     roundNearestEven = ( roundingMode == float_round_nearest_even );
     roundIncrement = 0x40;
     if ( ! roundNearestEven ) {
@@ -254,7 +244,7 @@ static float32 roundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig )
              || (    ( zExp == 0xFD )
                   && ( (sbits32) ( zSig + roundIncrement ) < 0 ) )
            ) {
-            float_raise( float_flag_overflow | float_flag_inexact );
+            roundData->exception |= float_flag_overflow | float_flag_inexact;
             return packFloat32( zSign, 0xFF, 0 ) - ( roundIncrement == 0 );
         }
         if ( zExp < 0 ) {
@@ -265,10 +255,10 @@ static float32 roundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig )
             shift32RightJamming( zSig, - zExp, &zSig );
             zExp = 0;
             roundBits = zSig & 0x7F;
-            if ( isTiny && roundBits ) float_raise( float_flag_underflow );
+            if ( isTiny && roundBits ) roundData->exception |= float_flag_underflow;
         }
     }
-    if ( roundBits ) float_exception_flags |= float_flag_inexact;
+    if ( roundBits ) roundData->exception |= float_flag_inexact;
     zSig = ( zSig + roundIncrement )>>7;
     zSig &= ~ ( ( ( roundBits ^ 0x40 ) == 0 ) & roundNearestEven );
     if ( zSig == 0 ) zExp = 0;
@@ -287,12 +277,12 @@ point exponent.
 -------------------------------------------------------------------------------
 */
 static float32
- normalizeRoundAndPackFloat32( flag zSign, int16 zExp, bits32 zSig )
+ normalizeRoundAndPackFloat32( struct roundingData *roundData, flag zSign, int16 zExp, bits32 zSig )
 {
     int8 shiftCount;
 
     shiftCount = countLeadingZeros32( zSig ) - 1;
-    return roundAndPackFloat32( zSign, zExp - shiftCount, zSig<<shiftCount );
+    return roundAndPackFloat32( roundData, zSign, zExp - shiftCount, zSig<<shiftCount );
 
 }
 
@@ -395,14 +385,14 @@ The handling of underflow and overflow follows the IEC/IEEE Standard for
 Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float64 roundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig )
+static float64 roundAndPackFloat64( struct roundingData *roundData, flag zSign, int16 zExp, bits64 zSig )
 {
     int8 roundingMode;
     flag roundNearestEven;
     int16 roundIncrement, roundBits;
     flag isTiny;
 
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
     roundNearestEven = ( roundingMode == float_round_nearest_even );
     roundIncrement = 0x200;
     if ( ! roundNearestEven ) {
@@ -427,7 +417,7 @@ static float64 roundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig )
            ) {
             //register int lr = __builtin_return_address(0);
             //printk("roundAndPackFloat64 called from 0x%08x\n",lr);
-            float_raise( float_flag_overflow | float_flag_inexact );
+            roundData->exception |= float_flag_overflow | float_flag_inexact;
             return packFloat64( zSign, 0x7FF, 0 ) - ( roundIncrement == 0 );
         }
         if ( zExp < 0 ) {
@@ -438,10 +428,10 @@ static float64 roundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig )
             shift64RightJamming( zSig, - zExp, &zSig );
             zExp = 0;
             roundBits = zSig & 0x3FF;
-            if ( isTiny && roundBits ) float_raise( float_flag_underflow );
+            if ( isTiny && roundBits ) roundData->exception |= float_flag_underflow;
         }
     }
-    if ( roundBits ) float_exception_flags |= float_flag_inexact;
+    if ( roundBits ) roundData->exception |= float_flag_inexact;
     zSig = ( zSig + roundIncrement )>>10;
     zSig &= ~ ( ( ( roundBits ^ 0x200 ) == 0 ) & roundNearestEven );
     if ( zSig == 0 ) zExp = 0;
@@ -460,12 +450,12 @@ point exponent.
 -------------------------------------------------------------------------------
 */
 static float64
- normalizeRoundAndPackFloat64( flag zSign, int16 zExp, bits64 zSig )
+ normalizeRoundAndPackFloat64( struct roundingData *roundData, flag zSign, int16 zExp, bits64 zSig )
 {
     int8 shiftCount;
 
     shiftCount = countLeadingZeros64( zSig ) - 1;
-    return roundAndPackFloat64( zSign, zExp - shiftCount, zSig<<shiftCount );
+    return roundAndPackFloat64( roundData, zSign, zExp - shiftCount, zSig<<shiftCount );
 
 }
 
@@ -572,14 +562,15 @@ Floating-point Arithmetic.
 */
 static floatx80
  roundAndPackFloatx80(
-     int8 roundingPrecision, flag zSign, int32 zExp, bits64 zSig0, bits64 zSig1
+     struct roundingData *roundData, flag zSign, int32 zExp, bits64 zSig0, bits64 zSig1
  )
 {
-    int8 roundingMode;
+    int8 roundingMode, roundingPrecision;
     flag roundNearestEven, increment, isTiny;
     int64 roundIncrement, roundMask, roundBits;
 
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
+    roundingPrecision = roundData->precision;
     roundNearestEven = ( roundingMode == float_round_nearest_even );
     if ( roundingPrecision == 80 ) goto precision80;
     if ( roundingPrecision == 64 ) {
@@ -623,8 +614,8 @@ static floatx80
             shift64RightJamming( zSig0, 1 - zExp, &zSig0 );
             zExp = 0;
             roundBits = zSig0 & roundMask;
-            if ( isTiny && roundBits ) float_raise( float_flag_underflow );
-            if ( roundBits ) float_exception_flags |= float_flag_inexact;
+            if ( isTiny && roundBits ) roundData->exception |= float_flag_underflow;
+            if ( roundBits ) roundData->exception |= float_flag_inexact;
             zSig0 += roundIncrement;
             if ( (sbits64) zSig0 < 0 ) zExp = 1;
             roundIncrement = roundMask + 1;
@@ -635,7 +626,7 @@ static floatx80
             return packFloatx80( zSign, zExp, zSig0 );
         }
     }
-    if ( roundBits ) float_exception_flags |= float_flag_inexact;
+    if ( roundBits ) roundData->exception |= float_flag_inexact;
     zSig0 += roundIncrement;
     if ( zSig0 < roundIncrement ) {
         ++zExp;
@@ -672,7 +663,7 @@ static floatx80
            ) {
             roundMask = 0;
  overflow:
-            float_raise( float_flag_overflow | float_flag_inexact );
+            roundData->exception |= float_flag_overflow | float_flag_inexact;
             if (    ( roundingMode == float_round_to_zero )
                  || ( zSign && ( roundingMode == float_round_up ) )
                  || ( ! zSign && ( roundingMode == float_round_down ) )
@@ -689,8 +680,8 @@ static floatx80
                 || ( zSig0 < LIT64( 0xFFFFFFFFFFFFFFFF ) );
             shift64ExtraRightJamming( zSig0, zSig1, 1 - zExp, &zSig0, &zSig1 );
             zExp = 0;
-            if ( isTiny && zSig1 ) float_raise( float_flag_underflow );
-            if ( zSig1 ) float_exception_flags |= float_flag_inexact;
+            if ( isTiny && zSig1 ) roundData->exception |= float_flag_underflow;
+            if ( zSig1 ) roundData->exception |= float_flag_inexact;
             if ( roundNearestEven ) {
                 increment = ( (sbits64) zSig1 < 0 );
             }
@@ -710,7 +701,7 @@ static floatx80
             return packFloatx80( zSign, zExp, zSig0 );
         }
     }
-    if ( zSig1 ) float_exception_flags |= float_flag_inexact;
+    if ( zSig1 ) roundData->exception |= float_flag_inexact;
     if ( increment ) {
         ++zSig0;
         if ( zSig0 == 0 ) {
@@ -740,7 +731,7 @@ normalized.
 */
 static floatx80
  normalizeRoundAndPackFloatx80(
-     int8 roundingPrecision, flag zSign, int32 zExp, bits64 zSig0, bits64 zSig1
+     struct roundingData *roundData, flag zSign, int32 zExp, bits64 zSig0, bits64 zSig1
  )
 {
     int8 shiftCount;
@@ -754,7 +745,7 @@ static floatx80
     shortShift128Left( zSig0, zSig1, shiftCount, &zSig0, &zSig1 );
     zExp -= shiftCount;
     return
-        roundAndPackFloatx80( roundingPrecision, zSign, zExp, zSig0, zSig1 );
+        roundAndPackFloatx80( roundData, zSign, zExp, zSig0, zSig1 );
 
 }
 
@@ -767,14 +758,14 @@ the single-precision floating-point format.  The conversion is performed
 according to the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 int32_to_float32( int32 a )
+float32 int32_to_float32(struct roundingData *roundData, int32 a)
 {
     flag zSign;
 
     if ( a == 0 ) return 0;
     if ( a == 0x80000000 ) return packFloat32( 1, 0x9E, 0 );
     zSign = ( a < 0 );
-    return normalizeRoundAndPackFloat32( zSign, 0x9C, zSign ? - a : a );
+    return normalizeRoundAndPackFloat32( roundData, zSign, 0x9C, zSign ? - a : a );
 
 }
 
@@ -840,7 +831,7 @@ positive integer is returned.  Otherwise, if the conversion overflows, the
 largest integer with the same sign as `a' is returned.
 -------------------------------------------------------------------------------
 */
-int32 float32_to_int32( float32 a )
+int32 float32_to_int32( struct roundingData *roundData, float32 a )
 {
     flag aSign;
     int16 aExp, shiftCount;
@@ -856,7 +847,7 @@ int32 float32_to_int32( float32 a )
     zSig = aSig;
     zSig <<= 32;
     if ( 0 < shiftCount ) shift64RightJamming( zSig, shiftCount, &zSig );
-    return roundAndPackInt32( aSign, zSig );
+    return roundAndPackInt32( roundData, aSign, zSig );
 
 }
 
@@ -889,13 +880,13 @@ int32 float32_to_int32_round_to_zero( float32 a )
         return 0x80000000;
     }
     else if ( aExp <= 0x7E ) {
-        if ( aExp | aSig ) float_exception_flags |= float_flag_inexact;
+        if ( aExp | aSig ) float_raise( float_flag_inexact );
         return 0;
     }
     aSig = ( aSig | 0x00800000 )<<8;
     z = aSig>>( - shiftCount );
     if ( (bits32) ( aSig<<( shiftCount & 31 ) ) ) {
-        float_exception_flags |= float_flag_inexact;
+        float_raise( float_flag_inexact );
     }
     return aSign ? - z : z;
 
@@ -973,7 +964,7 @@ operation is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_round_to_int( float32 a )
+float32 float32_round_to_int( struct roundingData *roundData, float32 a )
 {
     flag aSign;
     int16 aExp;
@@ -988,11 +979,12 @@ float32 float32_round_to_int( float32 a )
         }
         return a;
     }
+    roundingMode = roundData->mode;
     if ( aExp <= 0x7E ) {
         if ( (bits32) ( a<<1 ) == 0 ) return a;
-        float_exception_flags |= float_flag_inexact;
+        roundData->exception |= float_flag_inexact;
         aSign = extractFloat32Sign( a );
-        switch ( float_rounding_mode ) {
+        switch ( roundingMode ) {
          case float_round_nearest_even:
             if ( ( aExp == 0x7E ) && extractFloat32Frac( a ) ) {
                 return packFloat32( aSign, 0x7F, 0 );
@@ -1009,7 +1001,6 @@ float32 float32_round_to_int( float32 a )
     lastBitMask <<= 0x96 - aExp;
     roundBitsMask = lastBitMask - 1;
     z = a;
-    roundingMode = float_rounding_mode;
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
@@ -1020,7 +1011,7 @@ float32 float32_round_to_int( float32 a )
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) float_exception_flags |= float_flag_inexact;
+    if ( z != a ) roundData->exception |= float_flag_inexact;
     return z;
 
 }
@@ -1034,7 +1025,7 @@ addition is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float32 addFloat32Sigs( float32 a, float32 b, flag zSign )
+static float32 addFloat32Sigs( struct roundingData *roundData, float32 a, float32 b, flag zSign )
 {
     int16 aExp, bExp, zExp;
     bits32 aSig, bSig, zSig;
@@ -1093,7 +1084,7 @@ static float32 addFloat32Sigs( float32 a, float32 b, flag zSign )
         ++zExp;
     }
  roundAndPack:
-    return roundAndPackFloat32( zSign, zExp, zSig );
+    return roundAndPackFloat32( roundData, zSign, zExp, zSig );
 
 }
 
@@ -1106,7 +1097,7 @@ result is a NaN.  The subtraction is performed according to the IEC/IEEE
 Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float32 subFloat32Sigs( float32 a, float32 b, flag zSign )
+static float32 subFloat32Sigs( struct roundingData *roundData, float32 a, float32 b, flag zSign )
 {
     int16 aExp, bExp, zExp;
     bits32 aSig, bSig, zSig;
@@ -1123,7 +1114,7 @@ static float32 subFloat32Sigs( float32 a, float32 b, flag zSign )
     if ( expDiff < 0 ) goto bExpBigger;
     if ( aExp == 0xFF ) {
         if ( aSig | bSig ) return propagateFloat32NaN( a, b );
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float32_default_nan;
     }
     if ( aExp == 0 ) {
@@ -1132,7 +1123,7 @@ static float32 subFloat32Sigs( float32 a, float32 b, flag zSign )
     }
     if ( bSig < aSig ) goto aBigger;
     if ( aSig < bSig ) goto bBigger;
-    return packFloat32( float_rounding_mode == float_round_down, 0, 0 );
+    return packFloat32( roundData->mode == float_round_down, 0, 0 );
  bExpBigger:
     if ( bExp == 0xFF ) {
         if ( bSig ) return propagateFloat32NaN( a, b );
@@ -1169,7 +1160,7 @@ static float32 subFloat32Sigs( float32 a, float32 b, flag zSign )
     zExp = aExp;
  normalizeRoundAndPack:
     --zExp;
-    return normalizeRoundAndPackFloat32( zSign, zExp, zSig );
+    return normalizeRoundAndPackFloat32( roundData, zSign, zExp, zSig );
 
 }
 
@@ -1180,17 +1171,17 @@ and `b'.  The operation is performed according to the IEC/IEEE Standard for
 Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_add( float32 a, float32 b )
+float32 float32_add( struct roundingData *roundData, float32 a, float32 b )
 {
     flag aSign, bSign;
 
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
     if ( aSign == bSign ) {
-        return addFloat32Sigs( a, b, aSign );
+        return addFloat32Sigs( roundData, a, b, aSign );
     }
     else {
-        return subFloat32Sigs( a, b, aSign );
+        return subFloat32Sigs( roundData, a, b, aSign );
     }
 
 }
@@ -1202,17 +1193,17 @@ Returns the result of subtracting the single-precision floating-point values
 for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_sub( float32 a, float32 b )
+float32 float32_sub( struct roundingData *roundData, float32 a, float32 b )
 {
     flag aSign, bSign;
 
     aSign = extractFloat32Sign( a );
     bSign = extractFloat32Sign( b );
     if ( aSign == bSign ) {
-        return subFloat32Sigs( a, b, aSign );
+        return subFloat32Sigs( roundData, a, b, aSign );
     }
     else {
-        return addFloat32Sigs( a, b, aSign );
+        return addFloat32Sigs( roundData, a, b, aSign );
     }
 
 }
@@ -1224,7 +1215,7 @@ Returns the result of multiplying the single-precision floating-point values
 for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_mul( float32 a, float32 b )
+float32 float32_mul( struct roundingData *roundData, float32 a, float32 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, zExp;
@@ -1244,7 +1235,7 @@ float32 float32_mul( float32 a, float32 b )
             return propagateFloat32NaN( a, b );
         }
         if ( ( bExp | bSig ) == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float32_default_nan;
         }
         return packFloat32( zSign, 0xFF, 0 );
@@ -1252,7 +1243,7 @@ float32 float32_mul( float32 a, float32 b )
     if ( bExp == 0xFF ) {
         if ( bSig ) return propagateFloat32NaN( a, b );
         if ( ( aExp | aSig ) == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float32_default_nan;
         }
         return packFloat32( zSign, 0xFF, 0 );
@@ -1274,7 +1265,7 @@ float32 float32_mul( float32 a, float32 b )
         zSig <<= 1;
         --zExp;
     }
-    return roundAndPackFloat32( zSign, zExp, zSig );
+    return roundAndPackFloat32( roundData, zSign, zExp, zSig );
 
 }
 
@@ -1285,7 +1276,7 @@ by the corresponding value `b'.  The operation is performed according to the
 IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_div( float32 a, float32 b )
+float32 float32_div( struct roundingData *roundData, float32 a, float32 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, zExp;
@@ -1302,7 +1293,7 @@ float32 float32_div( float32 a, float32 b )
         if ( aSig ) return propagateFloat32NaN( a, b );
         if ( bExp == 0xFF ) {
             if ( bSig ) return propagateFloat32NaN( a, b );
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float32_default_nan;
         }
         return packFloat32( zSign, 0xFF, 0 );
@@ -1314,10 +1305,10 @@ float32 float32_div( float32 a, float32 b )
     if ( bExp == 0 ) {
         if ( bSig == 0 ) {
             if ( ( aExp | aSig ) == 0 ) {
-                float_raise( float_flag_invalid );
+                roundData->exception |= float_flag_invalid;
                 return float32_default_nan;
             }
-            float_raise( float_flag_divbyzero );
+            roundData->exception |= float_flag_divbyzero;
             return packFloat32( zSign, 0xFF, 0 );
         }
         normalizeFloat32Subnormal( bSig, &bExp, &bSig );
@@ -1341,7 +1332,7 @@ float32 float32_div( float32 a, float32 b )
     if ( ( zSig & 0x3F ) == 0 ) {
         zSig |= ( ( (bits64) bSig ) * zSig != ( (bits64) aSig )<<32 );
     }
-    return roundAndPackFloat32( zSign, zExp, zSig );
+    return roundAndPackFloat32( roundData, zSign, zExp, zSig );
 
 }
 
@@ -1352,7 +1343,7 @@ with respect to the corresponding value `b'.  The operation is performed
 according to the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_rem( float32 a, float32 b )
+float32 float32_rem( struct roundingData *roundData, float32 a, float32 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, expDiff;
@@ -1372,7 +1363,7 @@ float32 float32_rem( float32 a, float32 b )
         if ( aSig || ( ( bExp == 0xFF ) && bSig ) ) {
             return propagateFloat32NaN( a, b );
         }
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float32_default_nan;
     }
     if ( bExp == 0xFF ) {
@@ -1381,7 +1372,7 @@ float32 float32_rem( float32 a, float32 b )
     }
     if ( bExp == 0 ) {
         if ( bSig == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float32_default_nan;
         }
         normalizeFloat32Subnormal( bSig, &bExp, &bSig );
@@ -1444,7 +1435,7 @@ float32 float32_rem( float32 a, float32 b )
     }
     zSign = ( (sbits32) aSig < 0 );
     if ( zSign ) aSig = - aSig;
-    return normalizeRoundAndPackFloat32( aSign ^ zSign, bExp, aSig );
+    return normalizeRoundAndPackFloat32( roundData, aSign ^ zSign, bExp, aSig );
 
 }
 
@@ -1455,7 +1446,7 @@ The operation is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float32_sqrt( float32 a )
+float32 float32_sqrt( struct roundingData *roundData, float32 a )
 {
     flag aSign;
     int16 aExp, zExp;
@@ -1468,12 +1459,12 @@ float32 float32_sqrt( float32 a )
     if ( aExp == 0xFF ) {
         if ( aSig ) return propagateFloat32NaN( a, 0 );
         if ( ! aSign ) return a;
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float32_default_nan;
     }
     if ( aSign ) {
         if ( ( aExp | aSig ) == 0 ) return a;
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float32_default_nan;
     }
     if ( aExp == 0 ) {
@@ -1499,7 +1490,7 @@ float32 float32_sqrt( float32 a )
         }
     }
     shift32RightJamming( zSig, 1, &zSig );
-    return roundAndPackFloat32( 0, zExp, zSig );
+    return roundAndPackFloat32( roundData, 0, zExp, zSig );
 
 }
 
@@ -1661,7 +1652,7 @@ positive integer is returned.  Otherwise, if the conversion overflows, the
 largest integer with the same sign as `a' is returned.
 -------------------------------------------------------------------------------
 */
-int32 float64_to_int32( float64 a )
+int32 float64_to_int32( struct roundingData *roundData, float64 a )
 {
     flag aSign;
     int16 aExp, shiftCount;
@@ -1674,7 +1665,7 @@ int32 float64_to_int32( float64 a )
     if ( aExp ) aSig |= LIT64( 0x0010000000000000 );
     shiftCount = 0x42C - aExp;
     if ( 0 < shiftCount ) shift64RightJamming( aSig, shiftCount, &aSig );
-    return roundAndPackInt32( aSign, aSig );
+    return roundAndPackInt32( roundData, aSign, aSig );
 
 }
 
@@ -1705,7 +1696,7 @@ int32 float64_to_int32_round_to_zero( float64 a )
         goto invalid;
     }
     else if ( 52 < shiftCount ) {
-        if ( aExp || aSig ) float_exception_flags |= float_flag_inexact;
+        if ( aExp || aSig ) float_raise( float_flag_inexact );
         return 0;
     }
     aSig |= LIT64( 0x0010000000000000 );
@@ -1715,11 +1706,11 @@ int32 float64_to_int32_round_to_zero( float64 a )
     if ( aSign ) z = - z;
     if ( ( z < 0 ) ^ aSign ) {
  invalid:
-        float_exception_flags |= float_flag_invalid;
+        float_raise( float_flag_invalid );
         return aSign ? 0x80000000 : 0x7FFFFFFF;
     }
     if ( ( aSig<<shiftCount ) != savedASig ) {
-        float_exception_flags |= float_flag_inexact;
+        float_raise( float_flag_inexact );
     }
     return z;
 
@@ -1736,7 +1727,7 @@ positive integer is returned.  Otherwise, if the conversion overflows, the
 largest positive integer is returned.
 -------------------------------------------------------------------------------
 */
-int32 float64_to_uint32( float64 a )
+int32 float64_to_uint32( struct roundingData *roundData, float64 a )
 {
     flag aSign;
     int16 aExp, shiftCount;
@@ -1749,7 +1740,7 @@ int32 float64_to_uint32( float64 a )
     if ( aExp ) aSig |= LIT64( 0x0010000000000000 );
     shiftCount = 0x42C - aExp;
     if ( 0 < shiftCount ) shift64RightJamming( aSig, shiftCount, &aSig );
-    return roundAndPackInt32( aSign, aSig );
+    return roundAndPackInt32( roundData, aSign, aSig );
 }
 
 /*
@@ -1778,7 +1769,7 @@ int32 float64_to_uint32_round_to_zero( float64 a )
         goto invalid;
     }
     else if ( 52 < shiftCount ) {
-        if ( aExp || aSig ) float_exception_flags |= float_flag_inexact;
+        if ( aExp || aSig ) float_raise( float_flag_inexact );
         return 0;
     }
     aSig |= LIT64( 0x0010000000000000 );
@@ -1788,11 +1779,11 @@ int32 float64_to_uint32_round_to_zero( float64 a )
     if ( aSign ) z = - z;
     if ( ( z < 0 ) ^ aSign ) {
  invalid:
-        float_exception_flags |= float_flag_invalid;
+        float_raise( float_flag_invalid );
         return aSign ? 0x80000000 : 0x7FFFFFFF;
     }
     if ( ( aSig<<shiftCount ) != savedASig ) {
-        float_exception_flags |= float_flag_inexact;
+        float_raise( float_flag_inexact );
     }
     return z;
 }
@@ -1805,7 +1796,7 @@ performed according to the IEC/IEEE Standard for Binary Floating-point
 Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 float64_to_float32( float64 a )
+float32 float64_to_float32( struct roundingData *roundData, float64 a )
 {
     flag aSign;
     int16 aExp;
@@ -1825,7 +1816,7 @@ float32 float64_to_float32( float64 a )
         zSig |= 0x40000000;
         aExp -= 0x381;
     }
-    return roundAndPackFloat32( aSign, aExp, zSig );
+    return roundAndPackFloat32( roundData, aSign, aExp, zSig );
 
 }
 
@@ -1872,7 +1863,7 @@ operation is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_round_to_int( float64 a )
+float64 float64_round_to_int( struct roundingData *roundData, float64 a )
 {
     flag aSign;
     int16 aExp;
@@ -1889,9 +1880,9 @@ float64 float64_round_to_int( float64 a )
     }
     if ( aExp <= 0x3FE ) {
         if ( (bits64) ( a<<1 ) == 0 ) return a;
-        float_exception_flags |= float_flag_inexact;
+        roundData->exception |= float_flag_inexact;
         aSign = extractFloat64Sign( a );
-        switch ( float_rounding_mode ) {
+        switch ( roundData->mode ) {
          case float_round_nearest_even:
             if ( ( aExp == 0x3FE ) && extractFloat64Frac( a ) ) {
                 return packFloat64( aSign, 0x3FF, 0 );
@@ -1909,7 +1900,7 @@ float64 float64_round_to_int( float64 a )
     lastBitMask <<= 0x433 - aExp;
     roundBitsMask = lastBitMask - 1;
     z = a;
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
     if ( roundingMode == float_round_nearest_even ) {
         z += lastBitMask>>1;
         if ( ( z & roundBitsMask ) == 0 ) z &= ~ lastBitMask;
@@ -1920,7 +1911,7 @@ float64 float64_round_to_int( float64 a )
         }
     }
     z &= ~ roundBitsMask;
-    if ( z != a ) float_exception_flags |= float_flag_inexact;
+    if ( z != a ) roundData->exception |= float_flag_inexact;
     return z;
 
 }
@@ -1934,7 +1925,7 @@ addition is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float64 addFloat64Sigs( float64 a, float64 b, flag zSign )
+static float64 addFloat64Sigs( struct roundingData *roundData, float64 a, float64 b, flag zSign )
 {
     int16 aExp, bExp, zExp;
     bits64 aSig, bSig, zSig;
@@ -1993,7 +1984,7 @@ static float64 addFloat64Sigs( float64 a, float64 b, flag zSign )
         ++zExp;
     }
  roundAndPack:
-    return roundAndPackFloat64( zSign, zExp, zSig );
+    return roundAndPackFloat64( roundData, zSign, zExp, zSig );
 
 }
 
@@ -2006,7 +1997,7 @@ result is a NaN.  The subtraction is performed according to the IEC/IEEE
 Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static float64 subFloat64Sigs( float64 a, float64 b, flag zSign )
+static float64 subFloat64Sigs( struct roundingData *roundData, float64 a, float64 b, flag zSign )
 {
     int16 aExp, bExp, zExp;
     bits64 aSig, bSig, zSig;
@@ -2023,7 +2014,7 @@ static float64 subFloat64Sigs( float64 a, float64 b, flag zSign )
     if ( expDiff < 0 ) goto bExpBigger;
     if ( aExp == 0x7FF ) {
         if ( aSig | bSig ) return propagateFloat64NaN( a, b );
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float64_default_nan;
     }
     if ( aExp == 0 ) {
@@ -2032,7 +2023,7 @@ static float64 subFloat64Sigs( float64 a, float64 b, flag zSign )
     }
     if ( bSig < aSig ) goto aBigger;
     if ( aSig < bSig ) goto bBigger;
-    return packFloat64( float_rounding_mode == float_round_down, 0, 0 );
+    return packFloat64( roundData->mode == float_round_down, 0, 0 );
  bExpBigger:
     if ( bExp == 0x7FF ) {
         if ( bSig ) return propagateFloat64NaN( a, b );
@@ -2069,7 +2060,7 @@ static float64 subFloat64Sigs( float64 a, float64 b, flag zSign )
     zExp = aExp;
  normalizeRoundAndPack:
     --zExp;
-    return normalizeRoundAndPackFloat64( zSign, zExp, zSig );
+    return normalizeRoundAndPackFloat64( roundData, zSign, zExp, zSig );
 
 }
 
@@ -2080,17 +2071,17 @@ and `b'.  The operation is performed according to the IEC/IEEE Standard for
 Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_add( float64 a, float64 b )
+float64 float64_add( struct roundingData *roundData, float64 a, float64 b )
 {
     flag aSign, bSign;
 
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
     if ( aSign == bSign ) {
-        return addFloat64Sigs( a, b, aSign );
+        return addFloat64Sigs( roundData, a, b, aSign );
     }
     else {
-        return subFloat64Sigs( a, b, aSign );
+        return subFloat64Sigs( roundData, a, b, aSign );
     }
 
 }
@@ -2102,17 +2093,17 @@ Returns the result of subtracting the double-precision floating-point values
 for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_sub( float64 a, float64 b )
+float64 float64_sub( struct roundingData *roundData, float64 a, float64 b )
 {
     flag aSign, bSign;
 
     aSign = extractFloat64Sign( a );
     bSign = extractFloat64Sign( b );
     if ( aSign == bSign ) {
-        return subFloat64Sigs( a, b, aSign );
+        return subFloat64Sigs( roundData, a, b, aSign );
     }
     else {
-        return addFloat64Sigs( a, b, aSign );
+        return addFloat64Sigs( roundData, a, b, aSign );
     }
 
 }
@@ -2124,7 +2115,7 @@ Returns the result of multiplying the double-precision floating-point values
 for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_mul( float64 a, float64 b )
+float64 float64_mul( struct roundingData *roundData, float64 a, float64 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, zExp;
@@ -2142,7 +2133,7 @@ float64 float64_mul( float64 a, float64 b )
             return propagateFloat64NaN( a, b );
         }
         if ( ( bExp | bSig ) == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float64_default_nan;
         }
         return packFloat64( zSign, 0x7FF, 0 );
@@ -2150,7 +2141,7 @@ float64 float64_mul( float64 a, float64 b )
     if ( bExp == 0x7FF ) {
         if ( bSig ) return propagateFloat64NaN( a, b );
         if ( ( aExp | aSig ) == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float64_default_nan;
         }
         return packFloat64( zSign, 0x7FF, 0 );
@@ -2172,7 +2163,7 @@ float64 float64_mul( float64 a, float64 b )
         zSig0 <<= 1;
         --zExp;
     }
-    return roundAndPackFloat64( zSign, zExp, zSig0 );
+    return roundAndPackFloat64( roundData, zSign, zExp, zSig0 );
 
 }
 
@@ -2183,7 +2174,7 @@ by the corresponding value `b'.  The operation is performed according to
 the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_div( float64 a, float64 b )
+float64 float64_div( struct roundingData *roundData, float64 a, float64 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, zExp;
@@ -2202,7 +2193,7 @@ float64 float64_div( float64 a, float64 b )
         if ( aSig ) return propagateFloat64NaN( a, b );
         if ( bExp == 0x7FF ) {
             if ( bSig ) return propagateFloat64NaN( a, b );
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float64_default_nan;
         }
         return packFloat64( zSign, 0x7FF, 0 );
@@ -2214,10 +2205,10 @@ float64 float64_div( float64 a, float64 b )
     if ( bExp == 0 ) {
         if ( bSig == 0 ) {
             if ( ( aExp | aSig ) == 0 ) {
-                float_raise( float_flag_invalid );
+                roundData->exception |= float_flag_invalid;
                 return float64_default_nan;
             }
-            float_raise( float_flag_divbyzero );
+            roundData->exception |= float_flag_divbyzero;
             return packFloat64( zSign, 0x7FF, 0 );
         }
         normalizeFloat64Subnormal( bSig, &bExp, &bSig );
@@ -2243,7 +2234,7 @@ float64 float64_div( float64 a, float64 b )
         }
         zSig |= ( rem1 != 0 );
     }
-    return roundAndPackFloat64( zSign, zExp, zSig );
+    return roundAndPackFloat64( roundData, zSign, zExp, zSig );
 
 }
 
@@ -2254,7 +2245,7 @@ with respect to the corresponding value `b'.  The operation is performed
 according to the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_rem( float64 a, float64 b )
+float64 float64_rem( struct roundingData *roundData, float64 a, float64 b )
 {
     flag aSign, bSign, zSign;
     int16 aExp, bExp, expDiff;
@@ -2272,7 +2263,7 @@ float64 float64_rem( float64 a, float64 b )
         if ( aSig || ( ( bExp == 0x7FF ) && bSig ) ) {
             return propagateFloat64NaN( a, b );
         }
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float64_default_nan;
     }
     if ( bExp == 0x7FF ) {
@@ -2281,7 +2272,7 @@ float64 float64_rem( float64 a, float64 b )
     }
     if ( bExp == 0 ) {
         if ( bSig == 0 ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             return float64_default_nan;
         }
         normalizeFloat64Subnormal( bSig, &bExp, &bSig );
@@ -2329,7 +2320,7 @@ float64 float64_rem( float64 a, float64 b )
     }
     zSign = ( (sbits64) aSig < 0 );
     if ( zSign ) aSig = - aSig;
-    return normalizeRoundAndPackFloat64( aSign ^ zSign, bExp, aSig );
+    return normalizeRoundAndPackFloat64( roundData, aSign ^ zSign, bExp, aSig );
 
 }
 
@@ -2340,7 +2331,7 @@ The operation is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 float64_sqrt( float64 a )
+float64 float64_sqrt( struct roundingData *roundData, float64 a )
 {
     flag aSign;
     int16 aExp, zExp;
@@ -2354,12 +2345,12 @@ float64 float64_sqrt( float64 a )
     if ( aExp == 0x7FF ) {
         if ( aSig ) return propagateFloat64NaN( a, a );
         if ( ! aSign ) return a;
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float64_default_nan;
     }
     if ( aSign ) {
         if ( ( aExp | aSig ) == 0 ) return a;
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return float64_default_nan;
     }
     if ( aExp == 0 ) {
@@ -2390,7 +2381,7 @@ float64 float64_sqrt( float64 a )
         }
     }
     shift64RightJamming( zSig, 1, &zSig );
-    return roundAndPackFloat64( 0, zExp, zSig );
+    return roundAndPackFloat64( roundData, 0, zExp, zSig );
 
 }
 
@@ -2554,7 +2545,7 @@ largest positive integer is returned.  Otherwise, if the conversion
 overflows, the largest integer with the same sign as `a' is returned.
 -------------------------------------------------------------------------------
 */
-int32 floatx80_to_int32( floatx80 a )
+int32 floatx80_to_int32( struct roundingData *roundData, floatx80 a )
 {
     flag aSign;
     int32 aExp, shiftCount;
@@ -2567,7 +2558,7 @@ int32 floatx80_to_int32( floatx80 a )
     shiftCount = 0x4037 - aExp;
     if ( shiftCount <= 0 ) shiftCount = 1;
     shift64RightJamming( aSig, shiftCount, &aSig );
-    return roundAndPackInt32( aSign, aSig );
+    return roundAndPackInt32( roundData, aSign, aSig );
 
 }
 
@@ -2598,7 +2589,7 @@ int32 floatx80_to_int32_round_to_zero( floatx80 a )
         goto invalid;
     }
     else if ( 63 < shiftCount ) {
-        if ( aExp || aSig ) float_exception_flags |= float_flag_inexact;
+        if ( aExp || aSig ) float_raise( float_flag_inexact );
         return 0;
     }
     savedASig = aSig;
@@ -2607,11 +2598,11 @@ int32 floatx80_to_int32_round_to_zero( floatx80 a )
     if ( aSign ) z = - z;
     if ( ( z < 0 ) ^ aSign ) {
  invalid:
-        float_exception_flags |= float_flag_invalid;
+        float_raise( float_flag_invalid );
         return aSign ? 0x80000000 : 0x7FFFFFFF;
     }
     if ( ( aSig<<shiftCount ) != savedASig ) {
-        float_exception_flags |= float_flag_inexact;
+        float_raise( float_flag_inexact );
     }
     return z;
 
@@ -2625,7 +2616,7 @@ conversion is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float32 floatx80_to_float32( floatx80 a )
+float32 floatx80_to_float32( struct roundingData *roundData, floatx80 a )
 {
     flag aSign;
     int32 aExp;
@@ -2642,7 +2633,7 @@ float32 floatx80_to_float32( floatx80 a )
     }
     shift64RightJamming( aSig, 33, &aSig );
     if ( aExp || aSig ) aExp -= 0x3F81;
-    return roundAndPackFloat32( aSign, aExp, aSig );
+    return roundAndPackFloat32( roundData, aSign, aExp, aSig );
 
 }
 
@@ -2654,7 +2645,7 @@ conversion is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-float64 floatx80_to_float64( floatx80 a )
+float64 floatx80_to_float64( struct roundingData *roundData, floatx80 a )
 {
     flag aSign;
     int32 aExp;
@@ -2671,7 +2662,7 @@ float64 floatx80_to_float64( floatx80 a )
     }
     shift64RightJamming( aSig, 1, &zSig );
     if ( aExp || aSig ) aExp -= 0x3C01;
-    return roundAndPackFloat64( aSign, aExp, zSig );
+    return roundAndPackFloat64( roundData, aSign, aExp, zSig );
 
 }
 
@@ -2683,7 +2674,7 @@ value.  The operation is performed according to the IEC/IEEE Standard for
 Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_round_to_int( floatx80 a )
+floatx80 floatx80_round_to_int( struct roundingData *roundData, floatx80 a )
 {
     flag aSign;
     int32 aExp;
@@ -2703,9 +2694,9 @@ floatx80 floatx80_round_to_int( floatx80 a )
              && ( (bits64) ( extractFloatx80Frac( a )<<1 ) == 0 ) ) {
             return a;
         }
-        float_exception_flags |= float_flag_inexact;
+        roundData->exception |= float_flag_inexact;
         aSign = extractFloatx80Sign( a );
-        switch ( float_rounding_mode ) {
+        switch ( roundData->mode ) {
          case float_round_nearest_even:
             if ( ( aExp == 0x3FFE ) && (bits64) ( extractFloatx80Frac( a )<<1 )
                ) {
@@ -2729,7 +2720,7 @@ floatx80 floatx80_round_to_int( floatx80 a )
     lastBitMask <<= 0x403E - aExp;
     roundBitsMask = lastBitMask - 1;
     z = a;
-    roundingMode = float_rounding_mode;
+    roundingMode = roundData->mode;
     if ( roundingMode == float_round_nearest_even ) {
         z.low += lastBitMask>>1;
         if ( ( z.low & roundBitsMask ) == 0 ) z.low &= ~ lastBitMask;
@@ -2744,7 +2735,7 @@ floatx80 floatx80_round_to_int( floatx80 a )
         ++z.high;
         z.low = LIT64( 0x8000000000000000 );
     }
-    if ( z.low != a.low ) float_exception_flags |= float_flag_inexact;
+    if ( z.low != a.low ) roundData->exception |= float_flag_inexact;
     return z;
 
 }
@@ -2758,7 +2749,7 @@ The addition is performed according to the IEC/IEEE Standard for Binary
 Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static floatx80 addFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
+static floatx80 addFloatx80Sigs( struct roundingData *roundData, floatx80 a, floatx80 b, flag zSign )
 {
     int32 aExp, bExp, zExp;
     bits64 aSig, bSig, zSig0, zSig1;
@@ -2814,7 +2805,7 @@ static floatx80 addFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
  roundAndPack:
     return
         roundAndPackFloatx80(
-            floatx80_rounding_precision, zSign, zExp, zSig0, zSig1 );
+            roundData, zSign, zExp, zSig0, zSig1 );
 
 }
 
@@ -2827,7 +2818,7 @@ result is a NaN.  The subtraction is performed according to the IEC/IEEE
 Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-static floatx80 subFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
+static floatx80 subFloatx80Sigs( struct roundingData *roundData, floatx80 a, floatx80 b, flag zSign )
 {
     int32 aExp, bExp, zExp;
     bits64 aSig, bSig, zSig0, zSig1;
@@ -2845,7 +2836,7 @@ static floatx80 subFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
         if ( (bits64) ( ( aSig | bSig )<<1 ) ) {
             return propagateFloatx80NaN( a, b );
         }
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         z.low = floatx80_default_nan_low;
         z.high = floatx80_default_nan_high;
         return z;
@@ -2857,7 +2848,7 @@ static floatx80 subFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
     zSig1 = 0;
     if ( bSig < aSig ) goto aBigger;
     if ( aSig < bSig ) goto bBigger;
-    return packFloatx80( float_rounding_mode == float_round_down, 0, 0 );
+    return packFloatx80( roundData->mode == float_round_down, 0, 0 );
  bExpBigger:
     if ( bExp == 0x7FFF ) {
         if ( (bits64) ( bSig<<1 ) ) return propagateFloatx80NaN( a, b );
@@ -2883,7 +2874,7 @@ static floatx80 subFloatx80Sigs( floatx80 a, floatx80 b, flag zSign )
  normalizeRoundAndPack:
     return
         normalizeRoundAndPackFloatx80(
-            floatx80_rounding_precision, zSign, zExp, zSig0, zSig1 );
+            roundData, zSign, zExp, zSig0, zSig1 );
 
 }
 
@@ -2894,17 +2885,17 @@ values `a' and `b'.  The operation is performed according to the IEC/IEEE
 Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_add( floatx80 a, floatx80 b )
+floatx80 floatx80_add( struct roundingData *roundData, floatx80 a, floatx80 b )
 {
     flag aSign, bSign;
     
     aSign = extractFloatx80Sign( a );
     bSign = extractFloatx80Sign( b );
     if ( aSign == bSign ) {
-        return addFloatx80Sigs( a, b, aSign );
+        return addFloatx80Sigs( roundData, a, b, aSign );
     }
     else {
-        return subFloatx80Sigs( a, b, aSign );
+        return subFloatx80Sigs( roundData, a, b, aSign );
     }
     
 }
@@ -2916,17 +2907,17 @@ point values `a' and `b'.  The operation is performed according to the
 IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_sub( floatx80 a, floatx80 b )
+floatx80 floatx80_sub( struct roundingData *roundData, floatx80 a, floatx80 b )
 {
     flag aSign, bSign;
 
     aSign = extractFloatx80Sign( a );
     bSign = extractFloatx80Sign( b );
     if ( aSign == bSign ) {
-        return subFloatx80Sigs( a, b, aSign );
+        return subFloatx80Sigs( roundData, a, b, aSign );
     }
     else {
-        return addFloatx80Sigs( a, b, aSign );
+        return addFloatx80Sigs( roundData, a, b, aSign );
     }
 
 }
@@ -2938,7 +2929,7 @@ point values `a' and `b'.  The operation is performed according to the
 IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_mul( floatx80 a, floatx80 b )
+floatx80 floatx80_mul( struct roundingData *roundData, floatx80 a, floatx80 b )
 {
     flag aSign, bSign, zSign;
     int32 aExp, bExp, zExp;
@@ -2964,7 +2955,7 @@ floatx80 floatx80_mul( floatx80 a, floatx80 b )
         if ( (bits64) ( bSig<<1 ) ) return propagateFloatx80NaN( a, b );
         if ( ( aExp | aSig ) == 0 ) {
  invalid:
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             z.low = floatx80_default_nan_low;
             z.high = floatx80_default_nan_high;
             return z;
@@ -2987,7 +2978,7 @@ floatx80 floatx80_mul( floatx80 a, floatx80 b )
     }
     return
         roundAndPackFloatx80(
-            floatx80_rounding_precision, zSign, zExp, zSig0, zSig1 );
+            roundData, zSign, zExp, zSig0, zSig1 );
 
 }
 
@@ -2998,7 +2989,7 @@ value `a' by the corresponding value `b'.  The operation is performed
 according to the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_div( floatx80 a, floatx80 b )
+floatx80 floatx80_div( struct roundingData *roundData, floatx80 a, floatx80 b )
 {
     flag aSign, bSign, zSign;
     int32 aExp, bExp, zExp;
@@ -3029,12 +3020,12 @@ floatx80 floatx80_div( floatx80 a, floatx80 b )
         if ( bSig == 0 ) {
             if ( ( aExp | aSig ) == 0 ) {
  invalid:
-                float_raise( float_flag_invalid );
+                roundData->exception |= float_flag_invalid;
                 z.low = floatx80_default_nan_low;
                 z.high = floatx80_default_nan_high;
                 return z;
             }
-            float_raise( float_flag_divbyzero );
+            roundData->exception |= float_flag_divbyzero;
             return packFloatx80( zSign, 0x7FFF, LIT64( 0x8000000000000000 ) );
         }
         normalizeFloatx80Subnormal( bSig, &bExp, &bSig );
@@ -3068,7 +3059,7 @@ floatx80 floatx80_div( floatx80 a, floatx80 b )
     }
     return
         roundAndPackFloatx80(
-            floatx80_rounding_precision, zSign, zExp, zSig0, zSig1 );
+            roundData, zSign, zExp, zSig0, zSig1 );
 
 }
 
@@ -3079,7 +3070,7 @@ Returns the remainder of the extended double-precision floating-point value
 according to the IEC/IEEE Standard for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_rem( floatx80 a, floatx80 b )
+floatx80 floatx80_rem( struct roundingData *roundData, floatx80 a, floatx80 b )
 {
     flag aSign, bSign, zSign;
     int32 aExp, bExp, expDiff;
@@ -3107,7 +3098,7 @@ floatx80 floatx80_rem( floatx80 a, floatx80 b )
     if ( bExp == 0 ) {
         if ( bSig == 0 ) {
  invalid:
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
             z.low = floatx80_default_nan_low;
             z.high = floatx80_default_nan_high;
             return z;
@@ -3164,9 +3155,10 @@ floatx80 floatx80_rem( floatx80 a, floatx80 b )
         aSig1 = alternateASig1;
         zSign = ! zSign;
     }
+
     return
         normalizeRoundAndPackFloatx80(
-            80, zSign, bExp + expDiff, aSig0, aSig1 );
+            roundData, zSign, bExp + expDiff, aSig0, aSig1 );
 
 }
 
@@ -3177,7 +3169,7 @@ value `a'.  The operation is performed according to the IEC/IEEE Standard
 for Binary Floating-point Arithmetic.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_sqrt( floatx80 a )
+floatx80 floatx80_sqrt( struct roundingData *roundData, floatx80 a )
 {
     flag aSign;
     int32 aExp, zExp;
@@ -3197,7 +3189,7 @@ floatx80 floatx80_sqrt( floatx80 a )
     if ( aSign ) {
         if ( ( aExp | aSig0 ) == 0 ) return a;
  invalid:
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         z.low = floatx80_default_nan_low;
         z.high = floatx80_default_nan_high;
         return z;
@@ -3242,7 +3234,7 @@ floatx80 floatx80_sqrt( floatx80 a )
     }
     return
         roundAndPackFloatx80(
-            floatx80_rounding_precision, 0, zExp, zSig0, zSig1 );
+            roundData, 0, zExp, zSig0, zSig1 );
 
 }
 
@@ -3264,7 +3256,7 @@ flag floatx80_eq( floatx80 a, floatx80 b )
        ) {
         if (    floatx80_is_signaling_nan( a )
              || floatx80_is_signaling_nan( b ) ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
         }
         return 0;
     }
@@ -3294,7 +3286,7 @@ flag floatx80_le( floatx80 a, floatx80 b )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
               && (bits64) ( extractFloatx80Frac( b )<<1 ) )
        ) {
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return 0;
     }
     aSign = extractFloatx80Sign( a );
@@ -3328,7 +3320,7 @@ flag floatx80_lt( floatx80 a, floatx80 b )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
               && (bits64) ( extractFloatx80Frac( b )<<1 ) )
        ) {
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return 0;
     }
     aSign = extractFloatx80Sign( a );
@@ -3361,7 +3353,7 @@ flag floatx80_eq_signaling( floatx80 a, floatx80 b )
          || (    ( extractFloatx80Exp( b ) == 0x7FFF )
               && (bits64) ( extractFloatx80Frac( b )<<1 ) )
        ) {
-        float_raise( float_flag_invalid );
+        roundData->exception |= float_flag_invalid;
         return 0;
     }
     return
@@ -3392,7 +3384,7 @@ flag floatx80_le_quiet( floatx80 a, floatx80 b )
        ) {
         if (    floatx80_is_signaling_nan( a )
              || floatx80_is_signaling_nan( b ) ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
         }
         return 0;
     }
@@ -3429,7 +3421,7 @@ flag floatx80_lt_quiet( floatx80 a, floatx80 b )
        ) {
         if (    floatx80_is_signaling_nan( a )
              || floatx80_is_signaling_nan( b ) ) {
-            float_raise( float_flag_invalid );
+            roundData->exception |= float_flag_invalid;
         }
         return 0;
     }
diff --git a/arch/arm/nwfpe/softfloat.h b/arch/arm/nwfpe/softfloat.h
index 1e1743173899..1c8799b9ee4d 100644
--- a/arch/arm/nwfpe/softfloat.h
+++ b/arch/arm/nwfpe/softfloat.h
@@ -74,7 +74,7 @@ enum {
 Software IEC/IEEE floating-point rounding mode.
 -------------------------------------------------------------------------------
 */
-extern signed char float_rounding_mode;
+//extern int8 float_rounding_mode;
 enum {
     float_round_nearest_even = 0,
     float_round_to_zero      = 1,
@@ -86,7 +86,6 @@ enum {
 -------------------------------------------------------------------------------
 Software IEC/IEEE floating-point exception flags.
 -------------------------------------------------------------------------------
-extern signed char float_exception_flags;
 enum {
     float_flag_inexact   =  1,
     float_flag_underflow =  2,
@@ -99,7 +98,6 @@ ScottB: November 4, 1998
 Changed the enumeration to match the bit order in the FPA11.
 */
 
-extern signed char float_exception_flags;
 enum {
     float_flag_invalid   =  1,
     float_flag_divbyzero =  2,
@@ -121,7 +119,7 @@ void float_raise( signed char );
 Software IEC/IEEE integer-to-floating-point conversion routines.
 -------------------------------------------------------------------------------
 */
-float32 int32_to_float32( signed int );
+float32 int32_to_float32( struct roundingData *, signed int );
 float64 int32_to_float64( signed int );
 #ifdef FLOATX80
 floatx80 int32_to_floatx80( signed int );
@@ -132,7 +130,7 @@ floatx80 int32_to_floatx80( signed int );
 Software IEC/IEEE single-precision conversion routines.
 -------------------------------------------------------------------------------
 */
-signed int float32_to_int32( float32 );
+signed int float32_to_int32( struct roundingData *, float32 );
 signed int float32_to_int32_round_to_zero( float32 );
 float64 float32_to_float64( float32 );
 #ifdef FLOATX80
@@ -144,13 +142,13 @@ floatx80 float32_to_floatx80( float32 );
 Software IEC/IEEE single-precision operations.
 -------------------------------------------------------------------------------
 */
-float32 float32_round_to_int( float32 );
-float32 float32_add( float32, float32 );
-float32 float32_sub( float32, float32 );
-float32 float32_mul( float32, float32 );
-float32 float32_div( float32, float32 );
-float32 float32_rem( float32, float32 );
-float32 float32_sqrt( float32 );
+float32 float32_round_to_int( struct roundingData*, float32 );
+float32 float32_add( struct roundingData *, float32, float32 );
+float32 float32_sub( struct roundingData *, float32, float32 );
+float32 float32_mul( struct roundingData *, float32, float32 );
+float32 float32_div( struct roundingData *, float32, float32 );
+float32 float32_rem( struct roundingData *, float32, float32 );
+float32 float32_sqrt( struct roundingData*, float32 );
 char float32_eq( float32, float32 );
 char float32_le( float32, float32 );
 char float32_lt( float32, float32 );
@@ -164,9 +162,9 @@ char float32_is_signaling_nan( float32 );
 Software IEC/IEEE double-precision conversion routines.
 -------------------------------------------------------------------------------
 */
-signed int float64_to_int32( float64 );
+signed int float64_to_int32( struct roundingData *, float64 );
 signed int float64_to_int32_round_to_zero( float64 );
-float32 float64_to_float32( float64 );
+float32 float64_to_float32( struct roundingData *, float64 );
 #ifdef FLOATX80
 floatx80 float64_to_floatx80( float64 );
 #endif
@@ -176,13 +174,13 @@ floatx80 float64_to_floatx80( float64 );
 Software IEC/IEEE double-precision operations.
 -------------------------------------------------------------------------------
 */
-float64 float64_round_to_int( float64 );
-float64 float64_add( float64, float64 );
-float64 float64_sub( float64, float64 );
-float64 float64_mul( float64, float64 );
-float64 float64_div( float64, float64 );
-float64 float64_rem( float64, float64 );
-float64 float64_sqrt( float64 );
+float64 float64_round_to_int( struct roundingData *, float64 );
+float64 float64_add( struct roundingData *, float64, float64 );
+float64 float64_sub( struct roundingData *, float64, float64 );
+float64 float64_mul( struct roundingData *, float64, float64 );
+float64 float64_div( struct roundingData *, float64, float64 );
+float64 float64_rem( struct roundingData *, float64, float64 );
+float64 float64_sqrt( struct roundingData *, float64 );
 char float64_eq( float64, float64 );
 char float64_le( float64, float64 );
 char float64_lt( float64, float64 );
@@ -198,31 +196,23 @@ char float64_is_signaling_nan( float64 );
 Software IEC/IEEE extended double-precision conversion routines.
 -------------------------------------------------------------------------------
 */
-signed int floatx80_to_int32( floatx80 );
+signed int floatx80_to_int32( struct roundingData *, floatx80 );
 signed int floatx80_to_int32_round_to_zero( floatx80 );
-float32 floatx80_to_float32( floatx80 );
-float64 floatx80_to_float64( floatx80 );
-
-/*
--------------------------------------------------------------------------------
-Software IEC/IEEE extended double-precision rounding precision.  Valid
-values are 32, 64, and 80.
--------------------------------------------------------------------------------
-*/
-extern signed char floatx80_rounding_precision;
+float32 floatx80_to_float32( struct roundingData *, floatx80 );
+float64 floatx80_to_float64( struct roundingData *, floatx80 );
 
 /*
 -------------------------------------------------------------------------------
 Software IEC/IEEE extended double-precision operations.
 -------------------------------------------------------------------------------
 */
-floatx80 floatx80_round_to_int( floatx80 );
-floatx80 floatx80_add( floatx80, floatx80 );
-floatx80 floatx80_sub( floatx80, floatx80 );
-floatx80 floatx80_mul( floatx80, floatx80 );
-floatx80 floatx80_div( floatx80, floatx80 );
-floatx80 floatx80_rem( floatx80, floatx80 );
-floatx80 floatx80_sqrt( floatx80 );
+floatx80 floatx80_round_to_int( struct roundingData *, floatx80 );
+floatx80 floatx80_add( struct roundingData *, floatx80, floatx80 );
+floatx80 floatx80_sub( struct roundingData *, floatx80, floatx80 );
+floatx80 floatx80_mul( struct roundingData *, floatx80, floatx80 );
+floatx80 floatx80_div( struct roundingData *, floatx80, floatx80 );
+floatx80 floatx80_rem( struct roundingData *, floatx80, floatx80 );
+floatx80 floatx80_sqrt( struct roundingData *, floatx80 );
 char floatx80_eq( floatx80, floatx80 );
 char floatx80_le( floatx80, floatx80 );
 char floatx80_lt( floatx80, floatx80 );
diff --git a/arch/arm/oprofile/backtrace.c b/arch/arm/oprofile/backtrace.c
index ec58d3e2eb8b..df35c452a8bf 100644
--- a/arch/arm/oprofile/backtrace.c
+++ b/arch/arm/oprofile/backtrace.c
@@ -115,7 +115,7 @@ static int valid_kernel_stack(struct frame_tail *tail, struct pt_regs *regs)
         return (tailaddr > stack) && (tailaddr < stack_base);
 }
 
-void arm_backtrace(struct pt_regs const *regs, unsigned int depth)
+void arm_backtrace(struct pt_regs * const regs, unsigned int depth)
 {
         struct frame_tail *tail;
         unsigned long last_address = 0;
diff --git a/arch/arm/vfp/vfpdouble.c b/arch/arm/vfp/vfpdouble.c
index b801cd66b6ea..9b367a65cb4d 100644
--- a/arch/arm/vfp/vfpdouble.c
+++ b/arch/arm/vfp/vfpdouble.c
@@ -770,6 +770,9 @@ vfp_double_add(struct vfp_double *vdd, struct vfp_double *vdn,
                 if ((s64)m_sig < 0) {
                         vdd->sign = vfp_sign_negate(vdd->sign);
                         m_sig = -m_sig;
+                } else if (m_sig == 0) {
+                        vdd->sign = (fpscr & FPSCR_RMODE_MASK) ==
+                                      FPSCR_ROUND_MINUSINF ? 0x8000 : 0;
                 }
         } else {
                 m_sig += vdn->significand;
diff --git a/arch/arm26/mm/fault.c b/arch/arm26/mm/fault.c
index dacca8bb7744..bd6f2db608b7 100644
--- a/arch/arm26/mm/fault.c
+++ b/arch/arm26/mm/fault.c
@@ -176,12 +176,12 @@ survive:
          * Handle the "normal" cases first - successful and sigbus
          */
         switch (fault) {
-        case 2:
+        case VM_FAULT_MAJOR:
                 tsk->maj_flt++;
                 return fault;
-        case 1:
+        case VM_FAULT_MINOR:
                 tsk->min_flt++;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 return fault;
         }
 
@@ -226,14 +226,11 @@ int do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
         /*
          * Handle the "normal" case first
          */
-        if (fault > 0)
+        switch (fault) {
+        case VM_FAULT_MINOR:
+        case VM_FAULT_MAJOR:
                 return 0;
-
-        /*
-         * We had some memory, but were unable to
-         * successfully fix up this page fault.
-         */
-        if (fault == 0){
+        case VM_FAULT_SIGBUS:
                 goto do_sigbus;
         }
 
diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
index fe1cc36b5aca..934c51078cce 100644
--- a/arch/cris/mm/fault.c
+++ b/arch/cris/mm/fault.c
@@ -284,13 +284,13 @@ do_page_fault(unsigned long address, struct pt_regs *regs,
          */
 
         switch (handle_mm_fault(mm, vma, address, writeaccess & 1)) {
-        case 1:
+        case VM_FAULT_MINOR:
                 tsk->min_flt++;
                 break;
-        case 2:
+        case VM_FAULT_MAJOR:
                 tsk->maj_flt++;
                 break;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 goto do_sigbus;
         default:
                 goto out_of_memory;
diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
index 41d02ac48233..8b3eb50c5105 100644
--- a/arch/frv/mm/fault.c
+++ b/arch/frv/mm/fault.c
@@ -163,13 +163,13 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
          * the fault.
          */
         switch (handle_mm_fault(mm, vma, ear0, write)) {
-        case 1:
+        case VM_FAULT_MINOR:
                 current->min_flt++;
                 break;
-        case 2:
+        case VM_FAULT_MAJOR:
                 current->maj_flt++;
                 break;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 goto do_sigbus;
         default:
                 goto out_of_memory;
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index a801d9d48606..619d843ba231 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -454,8 +454,9 @@ config HPET_TIMER
           Choose N to continue using the legacy 8254 timer.
 
 config HPET_EMULATE_RTC
-        bool "Provide RTC interrupt"
+        bool
         depends on HPET_TIMER && RTC=y
+        default y
 
 config SMP
         bool "Symmetric multi-processing support"
diff --git a/arch/i386/mach-visws/reboot.c b/arch/i386/mach-visws/reboot.c
index 9e9296676f93..5d73e042ed0a 100644
--- a/arch/i386/mach-visws/reboot.c
+++ b/arch/i386/mach-visws/reboot.c
@@ -9,12 +9,15 @@
 void (*pm_power_off)(void);
 EXPORT_SYMBOL(pm_power_off);
 
-void machine_restart(char * __unused)
+void machine_shutdown(void)
 {
 #ifdef CONFIG_SMP
         smp_send_stop();
 #endif
+}
 
+void machine_emergency_restart(void)
+{
         /*
          * Visual Workstations restart after this
          * register is poked on the PIIX4
@@ -22,6 +25,12 @@ void machine_restart(char * __unused)
         outb(PIIX4_RESET_VAL, PIIX4_RESET_PORT);
 }
 
+void machine_restart(char * __unused)
+{
+        machine_shutdown();
+        machine_emergency_restart();
+}
+
 void machine_power_off(void)
 {
         unsigned short pm_status;
diff --git a/arch/i386/mach-visws/setup.c b/arch/i386/mach-visws/setup.c
index 9f6d2d9b1be7..26ada6fc0d77 100644
--- a/arch/i386/mach-visws/setup.c
+++ b/arch/i386/mach-visws/setup.c
@@ -14,6 +14,8 @@
 #include "cobalt.h"
 #include "piix4.h"
 
+int no_broadcast;
+
 char visws_board_type = -1;
 char visws_board_rev = -1;
 
diff --git a/arch/i386/mach-voyager/voyager_basic.c b/arch/i386/mach-voyager/voyager_basic.c
index b3eda46e0fe9..c6384061328a 100644
--- a/arch/i386/mach-voyager/voyager_basic.c
+++ b/arch/i386/mach-voyager/voyager_basic.c
@@ -252,6 +252,12 @@ kb_wait(void)
 }
 
 void
+machine_shutdown(void)
+{
+        /* Architecture specific shutdown needed before a kexec */
+}
+
+void
 machine_restart(char *cmd)
 {
         printk("Voyager Warm Restart\n");
@@ -279,6 +285,13 @@ machine_restart(char *cmd)
 }
 
 void
+machine_emergency_restart(void)
+{
+        /*for now, just hook this to a warm restart */
+        machine_restart(NULL);
+}
+
+void
 mca_nmi_hook(void)
 {
         __u8 dumpval __attribute__((unused)) = inb(0xf823);
diff --git a/arch/i386/mm/discontig.c b/arch/i386/mm/discontig.c
index c369a8bf7cbe..6711ce3f6916 100644
--- a/arch/i386/mm/discontig.c
+++ b/arch/i386/mm/discontig.c
@@ -243,14 +243,6 @@ static unsigned long calculate_numa_remap_pages(void)
                 /* now the roundup is correct, convert to PAGE_SIZE pages */
                 size = size * PTRS_PER_PTE;
 
-                if (node_end_pfn[nid] & (PTRS_PER_PTE-1)) {
-                        /*
-                         * Adjust size if node_end_pfn is not on a proper
-                         * pmd boundary. remap_numa_kva will barf otherwise.
-                         */
-                        size +=  node_end_pfn[nid] & (PTRS_PER_PTE-1);
-                }
-
                 /*
                  * Validate the region we are allocating only contains valid
                  * pages.
@@ -270,6 +262,17 @@ static unsigned long calculate_numa_remap_pages(void)
                 reserve_pages += size;
                 printk("Shrinking node %d from %ld pages to %ld pages\n",
                         nid, node_end_pfn[nid], node_end_pfn[nid] - size);
+
+                if (node_end_pfn[nid] & (PTRS_PER_PTE-1)) {
+                        /*
+                         * Align node_end_pfn[] and node_remap_start_pfn[] to
+                         * pmd boundary. remap_numa_kva will barf otherwise.
+                         */
+                        printk("Shrinking node %d further by %ld pages for proper alignment\n",
+                                nid, node_end_pfn[nid] & (PTRS_PER_PTE-1));
+                        size +=  node_end_pfn[nid] & (PTRS_PER_PTE-1);
+                }
+
                 node_end_pfn[nid] -= size;
                 node_remap_start_pfn[nid] = node_end_pfn[nid];
         }
diff --git a/arch/i386/pci/visws.c b/arch/i386/pci/visws.c
index 314c933b6b8e..6c17433fdf7d 100644
--- a/arch/i386/pci/visws.c
+++ b/arch/i386/pci/visws.c
@@ -18,8 +18,10 @@
 extern struct pci_raw_ops pci_direct_conf1;
 
 static int pci_visws_enable_irq(struct pci_dev *dev) { return 0; }
+static void pci_visws_disable_irq(struct pci_dev *dev) { }
 
 int (*pcibios_enable_irq)(struct pci_dev *dev) = &pci_visws_enable_irq;
+void (*pcibios_disable_irq)(struct pci_dev *dev) = &pci_visws_disable_irq;
 
 void __init pcibios_penalize_isa_irq(int irq, int active) {}
 
diff --git a/arch/ia64/kernel/process.c b/arch/ia64/kernel/process.c
index 66e840609808..051e050359e4 100644
--- a/arch/ia64/kernel/process.c
+++ b/arch/ia64/kernel/process.c
@@ -179,7 +179,7 @@ static int can_do_pal_halt = 1;
 
 static int __init nohalt_setup(char * str)
 {
-        pal_halt = 0;
+        pal_halt = can_do_pal_halt = 0;
         return 1;
 }
 __setup("nohalt", nohalt_setup);
diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
index ac48b6d2aff6..aec15270d334 100644
--- a/arch/m68k/mm/fault.c
+++ b/arch/m68k/mm/fault.c
@@ -160,13 +160,13 @@ good_area:
         printk("handle_mm_fault returns %d\n",fault);
 #endif
         switch (fault) {
-        case 1:
+        case VM_FAULT_MINOR:
                 current->min_flt++;
                 break;
-        case 2:
+        case VM_FAULT_MAJOR:
                 current->maj_flt++;
                 break;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 goto bus_err;
         default:
                 goto out_of_memory;
diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
index eaa701479f5f..0ad945d4c0a4 100644
--- a/arch/parisc/mm/fault.c
+++ b/arch/parisc/mm/fault.c
@@ -178,17 +178,17 @@ good_area:
          */
 
         switch (handle_mm_fault(mm, vma, address, (acc_type & VM_WRITE) != 0)) {
-              case 1:
+              case VM_FAULT_MINOR:
                 ++current->min_flt;
                 break;
-              case 2:
+              case VM_FAULT_MAJOR:
                 ++current->maj_flt;
                 break;
-              case 0:
+              case VM_FAULT_SIGBUS:
                 /*
-                 * We ran out of memory, or some other thing happened
-                 * to us that made us unable to handle the page fault
-                 * gracefully.
+                 * We hit a hared mapping outside of the file, or some
+                 * other thing happened to us that made us unable to
+                 * handle the page fault gracefully.
                  */
                 goto bad_area;
               default:
diff --git a/arch/ppc/8xx_io/Kconfig b/arch/ppc/8xx_io/Kconfig
index 9e2227ec3b34..57dacf978532 100644
--- a/arch/ppc/8xx_io/Kconfig
+++ b/arch/ppc/8xx_io/Kconfig
@@ -69,9 +69,9 @@ config FEC_QS6612
         
 config ENET_BIG_BUFFERS
         bool "Use Big CPM Ethernet Buffers"
-        depends on NET_ETHERNET
+        depends on SCC_ENET || FEC_ENET
         help
-          Allocate large buffers for MPC8xx Etherenet.  Increases throughput
+          Allocate large buffers for MPC8xx Ethernet. Increases throughput
           and decreases the likelihood of dropped packets, but costs memory.
 
 config HTDMSOUND
diff --git a/arch/ppc/8xx_io/commproc.c b/arch/ppc/8xx_io/commproc.c
index 0cc2e7a9cb11..11726e2a4ec8 100644
--- a/arch/ppc/8xx_io/commproc.c
+++ b/arch/ppc/8xx_io/commproc.c
@@ -39,8 +39,6 @@
 #include <asm/tlbflush.h>
 #include <asm/rheap.h>
 
-extern int get_pteptr(struct mm_struct *mm, unsigned long addr, pte_t **ptep);
-
 static void m8xx_cpm_dpinit(void);
 static  uint    host_buffer;    /* One page of host buffer */
 static  uint    host_end;       /* end + 1 */
@@ -108,14 +106,11 @@ struct hw_interrupt_type cpm_pic = {
         .end            = cpm_eoi,
 };
 
-extern void flush_tlb_page(struct vm_area_struct *vma, unsigned long vmaddr);
-
 void
-m8xx_cpm_reset(uint bootpage)
+m8xx_cpm_reset(void)
 {
         volatile immap_t         *imp;
         volatile cpm8xx_t       *commproc;
-        pte_t *pte;
 
         imp = (immap_t *)IMAP_ADDR;
         commproc = (cpm8xx_t *)&imp->im_cpm;
@@ -143,17 +138,6 @@ m8xx_cpm_reset(uint bootpage)
         /* Reclaim the DP memory for our use. */
         m8xx_cpm_dpinit();
 
-        /* get the PTE for the bootpage */
-        if (!get_pteptr(&init_mm, bootpage, &pte))
-               panic("get_pteptr failed\n");
-                                                                                                                                                                                        
-        /* and make it uncachable */
-        pte_val(*pte) |= _PAGE_NO_CACHE;
-        _tlbie(bootpage);
-
-        host_buffer = bootpage;
-        host_end = host_buffer + PAGE_SIZE;
-
         /* Tell everyone where the comm processor resides.
         */
         cpmp = (cpm8xx_t *)commproc;
@@ -384,8 +368,6 @@ static rh_info_t cpm_dpmem_info;
 
 void m8xx_cpm_dpinit(void)
 {
-        cpm8xx_t *cp = &((immap_t *)IMAP_ADDR)->im_cpm;
-
         spin_lock_init(&cpm_dpmem_lock);
 
         /* Initialize the info header */
diff --git a/arch/ppc/8xx_io/fec.c b/arch/ppc/8xx_io/fec.c
index 0730392dcc20..62f68d6181c6 100644
--- a/arch/ppc/8xx_io/fec.c
+++ b/arch/ppc/8xx_io/fec.c
@@ -173,7 +173,7 @@ struct fec_enet_private {
         uint    phy_status;
         uint    phy_speed;
         phy_info_t      *phy;
-        struct tq_struct phy_task;
+        struct work_struct phy_task;
 
         uint    sequence_done;
 
@@ -199,7 +199,8 @@ static int fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev);
 #ifdef  CONFIG_USE_MDIO
 static void fec_enet_mii(struct net_device *dev);
 #endif  /* CONFIG_USE_MDIO */
-static void fec_enet_interrupt(int irq, void * dev_id, struct pt_regs * regs);
+static irqreturn_t fec_enet_interrupt(int irq, void * dev_id,
+                                                        struct pt_regs * regs);
 #ifdef CONFIG_FEC_PACKETHOOK
 static void  fec_enet_tx(struct net_device *dev, __u32 regval);
 static void  fec_enet_rx(struct net_device *dev, __u32 regval);
@@ -471,7 +472,7 @@ fec_timeout(struct net_device *dev)
 /* The interrupt handler.
  * This is called from the MPC core interrupt.
  */
-static  void
+static  irqreturn_t
 fec_enet_interrupt(int irq, void * dev_id, struct pt_regs * regs)
 {
         struct  net_device *dev = dev_id;
@@ -525,6 +526,7 @@ printk("%s[%d] %s: unexpected FEC_ENET_MII event\n", __FILE__,__LINE__,__FUNCTIO
                 }
 
         }
+        return IRQ_RETVAL(IRQ_HANDLED);
 }
 
 
@@ -1263,8 +1265,9 @@ static void mii_display_status(struct net_device *dev)
         printk(".\n");
 }
 
-static void mii_display_config(struct net_device *dev)
+static void mii_display_config(void *priv)
 {
+        struct net_device *dev = (struct net_device *)priv;
         struct fec_enet_private *fep = dev->priv;
         volatile uint *s = &(fep->phy_status);
 
@@ -1294,8 +1297,9 @@ static void mii_display_config(struct net_device *dev)
         fep->sequence_done = 1;
 }
 
-static void mii_relink(struct net_device *dev)
+static void mii_relink(void *priv)
 {
+        struct net_device *dev = (struct net_device *)priv;
         struct fec_enet_private *fep = dev->priv;
         int duplex;
 
@@ -1323,18 +1327,16 @@ static void mii_queue_relink(uint mii_reg, struct net_device *dev)
 {
         struct fec_enet_private *fep = dev->priv;
 
-        fep->phy_task.routine = (void *)mii_relink;
-        fep->phy_task.data = dev;
-        schedule_task(&fep->phy_task);
+        INIT_WORK(&fep->phy_task, mii_relink, (void *)dev);
+        schedule_work(&fep->phy_task);
 }
 
 static void mii_queue_config(uint mii_reg, struct net_device *dev)
 {
         struct fec_enet_private *fep = dev->priv;
 
-        fep->phy_task.routine = (void *)mii_display_config;
-        fep->phy_task.data = dev;
-        schedule_task(&fep->phy_task);
+        INIT_WORK(&fep->phy_task, mii_display_config, (void *)dev);
+        schedule_work(&fep->phy_task);
 }
 
 
@@ -1403,11 +1405,11 @@ mii_discover_phy(uint mii_reg, struct net_device *dev)
 
 /* This interrupt occurs when the PHY detects a link change.
 */
-static void
+static
 #ifdef CONFIG_RPXCLASSIC
-mii_link_interrupt(void *dev_id)
+void mii_link_interrupt(void *dev_id)
 #else
-mii_link_interrupt(int irq, void * dev_id, struct pt_regs * regs)
+irqreturn_t mii_link_interrupt(int irq, void * dev_id, struct pt_regs * regs)
 #endif
 {
 #ifdef  CONFIG_USE_MDIO
@@ -1440,6 +1442,9 @@ mii_link_interrupt(int irq, void * dev_id, struct pt_regs * regs)
 printk("%s[%d] %s: unexpected Link interrupt\n", __FILE__,__LINE__,__FUNCTION__);
 #endif  /* CONFIG_USE_MDIO */
 
+#ifndef CONFIG_RPXCLASSIC
+        return IRQ_RETVAL(IRQ_HANDLED);
+#endif  /* CONFIG_RPXCLASSIC */
 }
 
 static int
@@ -1575,7 +1580,7 @@ static int __init fec_enet_init(void)
         struct fec_enet_private *fep;
         int i, j, k, err;
         unsigned char   *eap, *iap, *ba;
-        unsigned long   mem_addr;
+        dma_addr_t      mem_addr;
         volatile        cbd_t   *bdp;
         cbd_t           *cbd_base;
         volatile        immap_t *immap;
@@ -1640,7 +1645,8 @@ static int __init fec_enet_init(void)
                 printk("FEC initialization failed.\n");
                 return 1;
         }
-        cbd_base = (cbd_t *)consistent_alloc(GFP_KERNEL, PAGE_SIZE, &mem_addr);
+        cbd_base = (cbd_t *)dma_alloc_coherent(dev->class_dev.dev, PAGE_SIZE,
+                                               &mem_addr, GFP_KERNEL);
 
         /* Set receive and transmit descriptor base.
         */
@@ -1657,7 +1663,10 @@ static int __init fec_enet_init(void)
 
                 /* Allocate a page.
                 */
-                ba = (unsigned char *)consistent_alloc(GFP_KERNEL, PAGE_SIZE, &mem_addr);
+                ba = (unsigned char *)dma_alloc_coherent(dev->class_dev.dev,
+                                                         PAGE_SIZE,
+                                                         &mem_addr,
+                                                         GFP_KERNEL);
                 /* BUG: no check for failure */
 
                 /* Initialize the BD for every fragment in the page.
diff --git a/arch/ppc/kernel/pci.c b/arch/ppc/kernel/pci.c
index 70cfb6ffd877..7b3586a3bf30 100644
--- a/arch/ppc/kernel/pci.c
+++ b/arch/ppc/kernel/pci.c
@@ -160,6 +160,21 @@ void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
 }
 EXPORT_SYMBOL(pcibios_resource_to_bus);
 
+void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                             struct pci_bus_region *region)
+{
+        unsigned long offset = 0;
+        struct pci_controller *hose = dev->sysdata;
+
+        if (hose && res->flags & IORESOURCE_IO)
+                offset = (unsigned long)hose->io_base_virt - isa_io_base;
+        else if (hose && res->flags & IORESOURCE_MEM)
+                offset = hose->pci_mem_offset;
+        res->start = region->start + offset;
+        res->end = region->end + offset;
+}
+EXPORT_SYMBOL(pcibios_bus_to_resource);
+
 /*
  * We need to avoid collisions with `mirrored' VGA ports
  * and other strange ISA hardware, so we always want the
diff --git a/arch/ppc/kernel/ppc_ksyms.c b/arch/ppc/kernel/ppc_ksyms.c
index d59ad07de8e7..e7d40cc6c1b6 100644
--- a/arch/ppc/kernel/ppc_ksyms.c
+++ b/arch/ppc/kernel/ppc_ksyms.c
@@ -324,7 +324,7 @@ EXPORT_SYMBOL(__res);
 
 EXPORT_SYMBOL(next_mmu_context);
 EXPORT_SYMBOL(set_context);
-EXPORT_SYMBOL(handle_mm_fault); /* For MOL */
+EXPORT_SYMBOL_GPL(__handle_mm_fault); /* For MOL */
 EXPORT_SYMBOL(disarm_decr);
 #ifdef CONFIG_PPC_STD_MMU
 extern long mol_trampoline;
diff --git a/arch/ppc/syslib/m8xx_setup.c b/arch/ppc/syslib/m8xx_setup.c
index c1db2ab1d154..55a381af4e37 100644
--- a/arch/ppc/syslib/m8xx_setup.c
+++ b/arch/ppc/syslib/m8xx_setup.c
@@ -57,7 +57,7 @@ unsigned char __res[sizeof(bd_t)];
 extern void m8xx_ide_init(void);
 
 extern unsigned long find_available_memory(void);
-extern void m8xx_cpm_reset(uint cpm_page);
+extern void m8xx_cpm_reset();
 extern void m8xx_wdt_handler_install(bd_t *bp);
 extern void rpxfb_alloc_pages(void);
 extern void cpm_interrupt_init(void);
@@ -70,13 +70,9 @@ board_init(void)
 void __init
 m8xx_setup_arch(void)
 {
-        int     cpm_page;
-
-        cpm_page = (int) alloc_bootmem_pages(PAGE_SIZE);
-
         /* Reset the Communication Processor Module.
         */
-        m8xx_cpm_reset(cpm_page);
+        m8xx_cpm_reset();
 
 #ifdef CONFIG_FB_RPX
         rpxfb_alloc_pages();
diff --git a/arch/ppc/syslib/mpc83xx_devices.c b/arch/ppc/syslib/mpc83xx_devices.c
index 75c8e9834ae7..5aaf0e58e1f9 100644
--- a/arch/ppc/syslib/mpc83xx_devices.c
+++ b/arch/ppc/syslib/mpc83xx_devices.c
@@ -191,8 +191,8 @@ struct platform_device ppc_sys_platform_devices[] = {
                 .num_resources   = 2,
                 .resource = (struct resource[]) {
                         {
-                                .start  = 0x22000,
-                                .end    = 0x22fff,
+                                .start  = 0x23000,
+                                .end    = 0x23fff,
                                 .flags  = IORESOURCE_MEM,
                         },
                         {
@@ -208,8 +208,8 @@ struct platform_device ppc_sys_platform_devices[] = {
                 .num_resources   = 2,
                 .resource = (struct resource[]) {
                         {
-                                .start  = 0x23000,
-                                .end    = 0x23fff,
+                                .start  = 0x22000,
+                                .end    = 0x22fff,
                                 .flags  = IORESOURCE_MEM,
                         },
                         {
diff --git a/arch/ppc64/boot/zlib.c b/arch/ppc64/boot/zlib.c
index 9d5e4e9832d2..78837e884b8b 100644
--- a/arch/ppc64/boot/zlib.c
+++ b/arch/ppc64/boot/zlib.c
@@ -1307,7 +1307,7 @@ local int huft_build(
   {
     *t = (inflate_huft *)Z_NULL;
     *m = 0;
-    return Z_OK;
+    return Z_DATA_ERROR;
   }
 
 
@@ -1351,6 +1351,7 @@ local int huft_build(
     if ((j = *p++) != 0)
       v[x[j]++] = i;
   } while (++i < n);
+  n = x[g];                     /* set n to length of v */
 
 
   /* Generate the Huffman codes and for each, make the table entries */
diff --git a/arch/ppc64/configs/bpa_defconfig b/arch/ppc64/configs/bpa_defconfig
new file mode 100644
index 000000000000..46c5da41c3ae
--- /dev/null
+++ b/arch/ppc64/configs/bpa_defconfig
@@ -0,0 +1,987 @@
+#
+# Automatically generated make config: don't edit
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:12:19 2005
+#
+CONFIG_64BIT=y
+CONFIG_MMU=y
+CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_CALIBRATE_DELAY=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_HAVE_DEC_LOCK=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_COMPAT=y
+CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_FORCE_MAX_ZONEORDER=13
+
+#
+# Code maturity level options
+#
+CONFIG_EXPERIMENTAL=y
+CONFIG_CLEAN_COMPILE=y
+CONFIG_LOCK_KERNEL=y
+CONFIG_INIT_ENV_ARG_LIMIT=32
+
+#
+# General setup
+#
+CONFIG_LOCALVERSION=""
+CONFIG_SWAP=y
+CONFIG_SYSVIPC=y
+# CONFIG_POSIX_MQUEUE is not set
+# CONFIG_BSD_PROCESS_ACCT is not set
+CONFIG_SYSCTL=y
+# CONFIG_AUDIT is not set
+CONFIG_HOTPLUG=y
+CONFIG_KOBJECT_UEVENT=y
+# CONFIG_IKCONFIG is not set
+# CONFIG_CPUSETS is not set
+# CONFIG_EMBEDDED is not set
+CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
+# CONFIG_KALLSYMS_EXTRA_PASS is not set
+CONFIG_PRINTK=y
+CONFIG_BUG=y
+CONFIG_BASE_FULL=y
+CONFIG_FUTEX=y
+CONFIG_EPOLL=y
+CONFIG_SHMEM=y
+CONFIG_CC_ALIGN_FUNCTIONS=0
+CONFIG_CC_ALIGN_LABELS=0
+CONFIG_CC_ALIGN_LOOPS=0
+CONFIG_CC_ALIGN_JUMPS=0
+# CONFIG_TINY_SHMEM is not set
+CONFIG_BASE_SMALL=0
+
+#
+# Loadable module support
+#
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+# CONFIG_MODULE_FORCE_UNLOAD is not set
+CONFIG_OBSOLETE_MODPARM=y
+# CONFIG_MODVERSIONS is not set
+# CONFIG_MODULE_SRCVERSION_ALL is not set
+# CONFIG_KMOD is not set
+CONFIG_STOP_MACHINE=y
+CONFIG_SYSVIPC_COMPAT=y
+
+#
+# Platform support
+#
+# CONFIG_PPC_ISERIES is not set
+CONFIG_PPC_MULTIPLATFORM=y
+# CONFIG_PPC_PSERIES is not set
+CONFIG_PPC_BPA=y
+# CONFIG_PPC_PMAC is not set
+# CONFIG_PPC_MAPLE is not set
+CONFIG_PPC=y
+CONFIG_PPC64=y
+CONFIG_PPC_OF=y
+CONFIG_BPA_IIC=y
+CONFIG_ALTIVEC=y
+CONFIG_KEXEC=y
+# CONFIG_U3_DART is not set
+# CONFIG_BOOTX_TEXT is not set
+# CONFIG_POWER4_ONLY is not set
+# CONFIG_IOMMU_VMERGE is not set
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_FLATMEM_ENABLE=y
+CONFIG_SELECT_MEMORY_MODEL=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_DISCONTIGMEM_MANUAL is not set
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
+# CONFIG_NUMA is not set
+CONFIG_SCHED_SMT=y
+CONFIG_PREEMPT_NONE=y
+# CONFIG_PREEMPT_VOLUNTARY is not set
+# CONFIG_PREEMPT is not set
+CONFIG_PREEMPT_BKL=y
+# CONFIG_HZ_100 is not set
+CONFIG_HZ_250=y
+# CONFIG_HZ_1000 is not set
+CONFIG_HZ=250
+CONFIG_GENERIC_HARDIRQS=y
+CONFIG_PPC_RTAS=y
+CONFIG_RTAS_PROC=y
+CONFIG_RTAS_FLASH=y
+CONFIG_SECCOMP=y
+CONFIG_ISA_DMA_API=y
+
+#
+# General setup
+#
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_BINFMT_ELF=y
+# CONFIG_BINFMT_MISC is not set
+CONFIG_PCI_LEGACY_PROC=y
+CONFIG_PCI_NAMES=y
+# CONFIG_PCI_DEBUG is not set
+
+#
+# PCCARD (PCMCIA/CardBus) support
+#
+# CONFIG_PCCARD is not set
+
+#
+# PCI Hotplug Support
+#
+# CONFIG_HOTPLUG_PCI is not set
+CONFIG_PROC_DEVICETREE=y
+# CONFIG_CMDLINE_BOOL is not set
+
+#
+# Networking
+#
+CONFIG_NET=y
+
+#
+# Networking options
+#
+CONFIG_PACKET=y
+# CONFIG_PACKET_MMAP is not set
+CONFIG_UNIX=y
+CONFIG_XFRM=y
+# CONFIG_XFRM_USER is not set
+# CONFIG_NET_KEY is not set
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+# CONFIG_IP_ADVANCED_ROUTER is not set
+CONFIG_IP_FIB_HASH=y
+# CONFIG_IP_PNP is not set
+CONFIG_NET_IPIP=y
+# CONFIG_NET_IPGRE is not set
+# CONFIG_IP_MROUTE is not set
+# CONFIG_ARPD is not set
+CONFIG_SYN_COOKIES=y
+# CONFIG_INET_AH is not set
+# CONFIG_INET_ESP is not set
+# CONFIG_INET_IPCOMP is not set
+CONFIG_INET_TUNNEL=y
+CONFIG_IP_TCPDIAG=y
+CONFIG_IP_TCPDIAG_IPV6=y
+# CONFIG_TCP_CONG_ADVANCED is not set
+CONFIG_TCP_CONG_BIC=y
+
+#
+# IP: Virtual Server Configuration
+#
+# CONFIG_IP_VS is not set
+CONFIG_IPV6=y
+# CONFIG_IPV6_PRIVACY is not set
+CONFIG_INET6_AH=m
+CONFIG_INET6_ESP=m
+CONFIG_INET6_IPCOMP=m
+CONFIG_INET6_TUNNEL=m
+CONFIG_IPV6_TUNNEL=m
+CONFIG_NETFILTER=y
+# CONFIG_NETFILTER_DEBUG is not set
+
+#
+# IP: Netfilter Configuration
+#
+CONFIG_IP_NF_CONNTRACK=y
+# CONFIG_IP_NF_CT_ACCT is not set
+# CONFIG_IP_NF_CONNTRACK_MARK is not set
+CONFIG_IP_NF_CT_PROTO_SCTP=y
+CONFIG_IP_NF_FTP=m
+CONFIG_IP_NF_IRC=m
+CONFIG_IP_NF_TFTP=m
+CONFIG_IP_NF_AMANDA=m
+CONFIG_IP_NF_QUEUE=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_MATCH_LIMIT=m
+CONFIG_IP_NF_MATCH_IPRANGE=m
+CONFIG_IP_NF_MATCH_MAC=m
+CONFIG_IP_NF_MATCH_PKTTYPE=m
+CONFIG_IP_NF_MATCH_MARK=m
+CONFIG_IP_NF_MATCH_MULTIPORT=m
+CONFIG_IP_NF_MATCH_TOS=m
+CONFIG_IP_NF_MATCH_RECENT=m
+CONFIG_IP_NF_MATCH_ECN=m
+CONFIG_IP_NF_MATCH_DSCP=m
+CONFIG_IP_NF_MATCH_AH_ESP=m
+CONFIG_IP_NF_MATCH_LENGTH=m
+CONFIG_IP_NF_MATCH_TTL=m
+CONFIG_IP_NF_MATCH_TCPMSS=m
+CONFIG_IP_NF_MATCH_HELPER=m
+CONFIG_IP_NF_MATCH_STATE=m
+CONFIG_IP_NF_MATCH_CONNTRACK=m
+CONFIG_IP_NF_MATCH_OWNER=m
+CONFIG_IP_NF_MATCH_ADDRTYPE=m
+CONFIG_IP_NF_MATCH_REALM=m
+CONFIG_IP_NF_MATCH_SCTP=m
+CONFIG_IP_NF_MATCH_COMMENT=m
+CONFIG_IP_NF_MATCH_HASHLIMIT=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_LOG=m
+CONFIG_IP_NF_TARGET_ULOG=m
+CONFIG_IP_NF_TARGET_TCPMSS=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_NAT_NEEDED=y
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_TARGET_REDIRECT=m
+CONFIG_IP_NF_TARGET_NETMAP=m
+CONFIG_IP_NF_TARGET_SAME=m
+CONFIG_IP_NF_NAT_SNMP_BASIC=m
+CONFIG_IP_NF_NAT_IRC=m
+CONFIG_IP_NF_NAT_FTP=m
+CONFIG_IP_NF_NAT_TFTP=m
+CONFIG_IP_NF_NAT_AMANDA=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP_NF_TARGET_TOS=m
+CONFIG_IP_NF_TARGET_ECN=m
+CONFIG_IP_NF_TARGET_DSCP=m
+CONFIG_IP_NF_TARGET_MARK=m
+CONFIG_IP_NF_TARGET_CLASSIFY=m
+CONFIG_IP_NF_RAW=m
+CONFIG_IP_NF_TARGET_NOTRACK=m
+CONFIG_IP_NF_ARPTABLES=m
+CONFIG_IP_NF_ARPFILTER=m
+CONFIG_IP_NF_ARP_MANGLE=m
+
+#
+# IPv6: Netfilter Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP6_NF_QUEUE is not set
+# CONFIG_IP6_NF_IPTABLES is not set
+
+#
+# SCTP Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_SCTP is not set
+# CONFIG_ATM is not set
+# CONFIG_BRIDGE is not set
+# CONFIG_VLAN_8021Q is not set
+# CONFIG_DECNET is not set
+# CONFIG_LLC2 is not set
+# CONFIG_IPX is not set
+# CONFIG_ATALK is not set
+# CONFIG_X25 is not set
+# CONFIG_LAPB is not set
+# CONFIG_NET_DIVERT is not set
+# CONFIG_ECONET is not set
+# CONFIG_WAN_ROUTER is not set
+# CONFIG_NET_SCHED is not set
+CONFIG_NET_CLS_ROUTE=y
+
+#
+# Network testing
+#
+# CONFIG_NET_PKTGEN is not set
+# CONFIG_HAMRADIO is not set
+# CONFIG_IRDA is not set
+# CONFIG_BT is not set
+
+#
+# Device Drivers
+#
+
+#
+# Generic Driver Options
+#
+CONFIG_STANDALONE=y
+CONFIG_PREVENT_FIRMWARE_BUILD=y
+CONFIG_FW_LOADER=y
+# CONFIG_DEBUG_DRIVER is not set
+
+#
+# Memory Technology Devices (MTD)
+#
+# CONFIG_MTD is not set
+
+#
+# Parallel port support
+#
+# CONFIG_PARPORT is not set
+
+#
+# Plug and Play support
+#
+
+#
+# Block devices
+#
+# CONFIG_BLK_DEV_FD is not set
+# CONFIG_BLK_CPQ_DA is not set
+# CONFIG_BLK_CPQ_CISS_DA is not set
+# CONFIG_BLK_DEV_DAC960 is not set
+# CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_COW_COMMON is not set
+CONFIG_BLK_DEV_LOOP=y
+# CONFIG_BLK_DEV_CRYPTOLOOP is not set
+CONFIG_BLK_DEV_NBD=y
+# CONFIG_BLK_DEV_SX8 is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=131072
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_INITRAMFS_SOURCE=""
+# CONFIG_CDROM_PKTCDVD is not set
+
+#
+# IO Schedulers
+#
+CONFIG_IOSCHED_NOOP=y
+CONFIG_IOSCHED_AS=y
+CONFIG_IOSCHED_DEADLINE=y
+CONFIG_IOSCHED_CFQ=y
+# CONFIG_ATA_OVER_ETH is not set
+
+#
+# ATA/ATAPI/MFM/RLL support
+#
+CONFIG_IDE=y
+CONFIG_BLK_DEV_IDE=y
+
+#
+# Please see Documentation/ide.txt for help/info on IDE drives
+#
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_BLK_DEV_IDEDISK=y
+CONFIG_IDEDISK_MULTI_MODE=y
+# CONFIG_BLK_DEV_IDECD is not set
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_BLK_DEV_IDEFLOPPY is not set
+# CONFIG_IDE_TASK_IOCTL is not set
+
+#
+# IDE chipset support/bugfixes
+#
+CONFIG_IDE_GENERIC=y
+CONFIG_BLK_DEV_IDEPCI=y
+CONFIG_IDEPCI_SHARE_IRQ=y
+# CONFIG_BLK_DEV_OFFBOARD is not set
+CONFIG_BLK_DEV_GENERIC=y
+# CONFIG_BLK_DEV_OPTI621 is not set
+# CONFIG_BLK_DEV_SL82C105 is not set
+CONFIG_BLK_DEV_IDEDMA_PCI=y
+# CONFIG_BLK_DEV_IDEDMA_FORCED is not set
+CONFIG_IDEDMA_PCI_AUTO=y
+# CONFIG_IDEDMA_ONLYDISK is not set
+CONFIG_BLK_DEV_AEC62XX=y
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CY82C693 is not set
+# CONFIG_BLK_DEV_CS5520 is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT34X is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+CONFIG_BLK_DEV_SIIMAGE=y
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_IDE_ARM is not set
+CONFIG_BLK_DEV_IDEDMA=y
+# CONFIG_IDEDMA_IVB is not set
+CONFIG_IDEDMA_AUTO=y
+# CONFIG_BLK_DEV_HD is not set
+
+#
+# SCSI device support
+#
+# CONFIG_SCSI is not set
+
+#
+# Multi-device support (RAID and LVM)
+#
+# CONFIG_MD is not set
+
+#
+# Fusion MPT device support
+#
+# CONFIG_FUSION is not set
+
+#
+# IEEE 1394 (FireWire) support
+#
+# CONFIG_IEEE1394 is not set
+
+#
+# I2O device support
+#
+# CONFIG_I2O is not set
+
+#
+# Macintosh device drivers
+#
+
+#
+# Network device support
+#
+CONFIG_NETDEVICES=y
+# CONFIG_DUMMY is not set
+# CONFIG_BONDING is not set
+# CONFIG_EQUALIZER is not set
+# CONFIG_TUN is not set
+
+#
+# ARCnet devices
+#
+# CONFIG_ARCNET is not set
+
+#
+# Ethernet (10 or 100Mbit)
+#
+CONFIG_NET_ETHERNET=y
+CONFIG_MII=y
+# CONFIG_HAPPYMEAL is not set
+# CONFIG_SUNGEM is not set
+# CONFIG_NET_VENDOR_3COM is not set
+
+#
+# Tulip family network device support
+#
+# CONFIG_NET_TULIP is not set
+# CONFIG_HP100 is not set
+# CONFIG_NET_PCI is not set
+
+#
+# Ethernet (1000 Mbit)
+#
+# CONFIG_ACENIC is not set
+# CONFIG_DL2K is not set
+CONFIG_E1000=m
+# CONFIG_E1000_NAPI is not set
+# CONFIG_NS83820 is not set
+# CONFIG_HAMACHI is not set
+# CONFIG_YELLOWFIN is not set
+# CONFIG_R8169 is not set
+CONFIG_SKGE=m
+# CONFIG_SK98LIN is not set
+# CONFIG_TIGON3 is not set
+# CONFIG_BNX2 is not set
+# CONFIG_MV643XX_ETH is not set
+
+#
+# Ethernet (10000 Mbit)
+#
+# CONFIG_IXGB is not set
+# CONFIG_S2IO is not set
+
+#
+# Token Ring devices
+#
+# CONFIG_TR is not set
+
+#
+# Wireless LAN (non-hamradio)
+#
+# CONFIG_NET_RADIO is not set
+
+#
+# Wan interfaces
+#
+# CONFIG_WAN is not set
+# CONFIG_FDDI is not set
+# CONFIG_HIPPI is not set
+# CONFIG_PPP is not set
+# CONFIG_SLIP is not set
+# CONFIG_SHAPER is not set
+# CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
+
+#
+# ISDN subsystem
+#
+# CONFIG_ISDN is not set
+
+#
+# Telephony Support
+#
+# CONFIG_PHONE is not set
+
+#
+# Input device support
+#
+CONFIG_INPUT=y
+
+#
+# Userland interfaces
+#
+CONFIG_INPUT_MOUSEDEV=y
+# CONFIG_INPUT_MOUSEDEV_PSAUX is not set
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+# CONFIG_INPUT_JOYDEV is not set
+# CONFIG_INPUT_TSDEV is not set
+# CONFIG_INPUT_EVDEV is not set
+# CONFIG_INPUT_EVBUG is not set
+
+#
+# Input Device Drivers
+#
+# CONFIG_INPUT_KEYBOARD is not set
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_INPUT_JOYSTICK is not set
+# CONFIG_INPUT_TOUCHSCREEN is not set
+# CONFIG_INPUT_MISC is not set
+
+#
+# Hardware I/O ports
+#
+CONFIG_SERIO=y
+# CONFIG_SERIO_I8042 is not set
+CONFIG_SERIO_SERPORT=y
+# CONFIG_SERIO_PCIPS2 is not set
+# CONFIG_SERIO_RAW is not set
+# CONFIG_GAMEPORT is not set
+
+#
+# Character devices
+#
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_HW_CONSOLE=y
+CONFIG_SERIAL_NONSTANDARD=y
+# CONFIG_ROCKETPORT is not set
+# CONFIG_CYCLADES is not set
+# CONFIG_MOXA_SMARTIO is not set
+# CONFIG_ISI is not set
+# CONFIG_SYNCLINK is not set
+# CONFIG_SYNCLINKMP is not set
+# CONFIG_N_HDLC is not set
+# CONFIG_SPECIALIX is not set
+# CONFIG_SX is not set
+# CONFIG_STALDRV is not set
+
+#
+# Serial drivers
+#
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+# CONFIG_SERIAL_8250_EXTENDED is not set
+
+#
+# Non-8250 serial port support
+#
+CONFIG_SERIAL_CORE=y
+CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_JSM is not set
+CONFIG_UNIX98_PTYS=y
+# CONFIG_LEGACY_PTYS is not set
+
+#
+# IPMI
+#
+# CONFIG_IPMI_HANDLER is not set
+
+#
+# Watchdog Cards
+#
+CONFIG_WATCHDOG=y
+# CONFIG_WATCHDOG_NOWAYOUT is not set
+
+#
+# Watchdog Device Drivers
+#
+# CONFIG_SOFT_WATCHDOG is not set
+CONFIG_WATCHDOG_RTAS=y
+
+#
+# PCI-based Watchdog Cards
+#
+# CONFIG_PCIPCWATCHDOG is not set
+# CONFIG_WDTPCI is not set
+# CONFIG_RTC is not set
+# CONFIG_DTLK is not set
+# CONFIG_R3964 is not set
+# CONFIG_APPLICOM is not set
+
+#
+# Ftape, the floppy tape device driver
+#
+# CONFIG_AGP is not set
+# CONFIG_DRM is not set
+# CONFIG_RAW_DRIVER is not set
+# CONFIG_HANGCHECK_TIMER is not set
+
+#
+# TPM devices
+#
+# CONFIG_TCG_TPM is not set
+
+#
+# I2C support
+#
+CONFIG_I2C=y
+# CONFIG_I2C_CHARDEV is not set
+
+#
+# I2C Algorithms
+#
+CONFIG_I2C_ALGOBIT=y
+# CONFIG_I2C_ALGOPCF is not set
+# CONFIG_I2C_ALGOPCA is not set
+
+#
+# I2C Hardware Bus support
+#
+# CONFIG_I2C_ALI1535 is not set
+# CONFIG_I2C_ALI1563 is not set
+# CONFIG_I2C_ALI15X3 is not set
+# CONFIG_I2C_AMD756 is not set
+# CONFIG_I2C_AMD8111 is not set
+# CONFIG_I2C_I801 is not set
+# CONFIG_I2C_I810 is not set
+# CONFIG_I2C_PIIX4 is not set
+# CONFIG_I2C_ISA is not set
+# CONFIG_I2C_NFORCE2 is not set
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_PROSAVAGE is not set
+# CONFIG_I2C_SAVAGE4 is not set
+# CONFIG_SCx200_ACB is not set
+# CONFIG_I2C_SIS5595 is not set
+# CONFIG_I2C_SIS630 is not set
+# CONFIG_I2C_SIS96X is not set
+# CONFIG_I2C_STUB is not set
+# CONFIG_I2C_VIA is not set
+# CONFIG_I2C_VIAPRO is not set
+# CONFIG_I2C_VOODOO3 is not set
+# CONFIG_I2C_PCA_ISA is not set
+# CONFIG_I2C_SENSOR is not set
+
+#
+# Miscellaneous I2C Chip support
+#
+# CONFIG_SENSORS_DS1337 is not set
+# CONFIG_SENSORS_DS1374 is not set
+# CONFIG_SENSORS_EEPROM is not set
+# CONFIG_SENSORS_PCF8574 is not set
+# CONFIG_SENSORS_PCA9539 is not set
+# CONFIG_SENSORS_PCF8591 is not set
+# CONFIG_SENSORS_RTC8564 is not set
+# CONFIG_SENSORS_MAX6875 is not set
+# CONFIG_I2C_DEBUG_CORE is not set
+# CONFIG_I2C_DEBUG_ALGO is not set
+# CONFIG_I2C_DEBUG_BUS is not set
+# CONFIG_I2C_DEBUG_CHIP is not set
+
+#
+# Dallas's 1-wire bus
+#
+# CONFIG_W1 is not set
+
+#
+# Hardware Monitoring support
+#
+# CONFIG_HWMON is not set
+
+#
+# Misc devices
+#
+
+#
+# Multimedia devices
+#
+# CONFIG_VIDEO_DEV is not set
+
+#
+# Digital Video Broadcasting Devices
+#
+# CONFIG_DVB is not set
+
+#
+# Graphics support
+#
+# CONFIG_FB is not set
+
+#
+# Console display driver support
+#
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_DUMMY_CONSOLE=y
+
+#
+# Sound
+#
+# CONFIG_SOUND is not set
+
+#
+# USB support
+#
+CONFIG_USB_ARCH_HAS_HCD=y
+CONFIG_USB_ARCH_HAS_OHCI=y
+# CONFIG_USB is not set
+
+#
+# USB Gadget Support
+#
+# CONFIG_USB_GADGET is not set
+
+#
+# MMC/SD Card support
+#
+# CONFIG_MMC is not set
+
+#
+# InfiniBand support
+#
+# CONFIG_INFINIBAND is not set
+
+#
+# SN Devices
+#
+
+#
+# File systems
+#
+CONFIG_EXT2_FS=y
+# CONFIG_EXT2_FS_XATTR is not set
+# CONFIG_EXT2_FS_XIP is not set
+CONFIG_EXT3_FS=y
+CONFIG_EXT3_FS_XATTR=y
+# CONFIG_EXT3_FS_POSIX_ACL is not set
+# CONFIG_EXT3_FS_SECURITY is not set
+CONFIG_JBD=y
+# CONFIG_JBD_DEBUG is not set
+CONFIG_FS_MBCACHE=y
+# CONFIG_REISERFS_FS is not set
+# CONFIG_JFS_FS is not set
+CONFIG_FS_POSIX_ACL=y
+
+#
+# XFS support
+#
+# CONFIG_XFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_ROMFS_FS is not set
+CONFIG_INOTIFY=y
+# CONFIG_QUOTA is not set
+CONFIG_DNOTIFY=y
+# CONFIG_AUTOFS_FS is not set
+# CONFIG_AUTOFS4_FS is not set
+
+#
+# CD-ROM/DVD Filesystems
+#
+CONFIG_ISO9660_FS=m
+CONFIG_JOLIET=y
+# CONFIG_ZISOFS is not set
+CONFIG_UDF_FS=m
+CONFIG_UDF_NLS=y
+
+#
+# DOS/FAT/NT Filesystems
+#
+CONFIG_FAT_FS=m
+CONFIG_MSDOS_FS=m
+CONFIG_VFAT_FS=m
+CONFIG_FAT_DEFAULT_CODEPAGE=437
+CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
+# CONFIG_NTFS_FS is not set
+
+#
+# Pseudo filesystems
+#
+CONFIG_PROC_FS=y
+CONFIG_PROC_KCORE=y
+CONFIG_SYSFS=y
+# CONFIG_DEVPTS_FS_XATTR is not set
+CONFIG_TMPFS=y
+CONFIG_TMPFS_XATTR=y
+# CONFIG_TMPFS_SECURITY is not set
+CONFIG_HUGETLBFS=y
+CONFIG_HUGETLB_PAGE=y
+CONFIG_RAMFS=y
+
+#
+# Miscellaneous filesystems
+#
+# CONFIG_ADFS_FS is not set
+# CONFIG_AFFS_FS is not set
+# CONFIG_HFS_FS is not set
+# CONFIG_HFSPLUS_FS is not set
+# CONFIG_BEFS_FS is not set
+# CONFIG_BFS_FS is not set
+# CONFIG_EFS_FS is not set
+# CONFIG_CRAMFS is not set
+# CONFIG_VXFS_FS is not set
+# CONFIG_HPFS_FS is not set
+# CONFIG_QNX4FS_FS is not set
+# CONFIG_SYSV_FS is not set
+# CONFIG_UFS_FS is not set
+
+#
+# Network File Systems
+#
+CONFIG_NFS_FS=m
+CONFIG_NFS_V3=y
+CONFIG_NFS_V3_ACL=y
+# CONFIG_NFS_V4 is not set
+# CONFIG_NFS_DIRECTIO is not set
+CONFIG_NFSD=m
+CONFIG_NFSD_V2_ACL=y
+CONFIG_NFSD_V3=y
+CONFIG_NFSD_V3_ACL=y
+# CONFIG_NFSD_V4 is not set
+CONFIG_NFSD_TCP=y
+CONFIG_LOCKD=m
+CONFIG_LOCKD_V4=y
+CONFIG_EXPORTFS=m
+CONFIG_NFS_ACL_SUPPORT=m
+CONFIG_NFS_COMMON=y
+CONFIG_SUNRPC=m
+# CONFIG_RPCSEC_GSS_KRB5 is not set
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
+# CONFIG_SMB_FS is not set
+# CONFIG_CIFS is not set
+# CONFIG_NCP_FS is not set
+# CONFIG_CODA_FS is not set
+# CONFIG_AFS_FS is not set
+
+#
+# Partition Types
+#
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_ACORN_PARTITION is not set
+# CONFIG_OSF_PARTITION is not set
+# CONFIG_AMIGA_PARTITION is not set
+# CONFIG_ATARI_PARTITION is not set
+# CONFIG_MAC_PARTITION is not set
+CONFIG_MSDOS_PARTITION=y
+# CONFIG_BSD_DISKLABEL is not set
+# CONFIG_MINIX_SUBPARTITION is not set
+# CONFIG_SOLARIS_X86_PARTITION is not set
+# CONFIG_UNIXWARE_DISKLABEL is not set
+# CONFIG_LDM_PARTITION is not set
+# CONFIG_SGI_PARTITION is not set
+# CONFIG_ULTRIX_PARTITION is not set
+# CONFIG_SUN_PARTITION is not set
+CONFIG_EFI_PARTITION=y
+
+#
+# Native Language Support
+#
+CONFIG_NLS=m
+CONFIG_NLS_DEFAULT="iso8859-1"
+# CONFIG_NLS_CODEPAGE_437 is not set
+# CONFIG_NLS_CODEPAGE_737 is not set
+# CONFIG_NLS_CODEPAGE_775 is not set
+# CONFIG_NLS_CODEPAGE_850 is not set
+# CONFIG_NLS_CODEPAGE_852 is not set
+# CONFIG_NLS_CODEPAGE_855 is not set
+# CONFIG_NLS_CODEPAGE_857 is not set
+# CONFIG_NLS_CODEPAGE_860 is not set
+# CONFIG_NLS_CODEPAGE_861 is not set
+# CONFIG_NLS_CODEPAGE_862 is not set
+# CONFIG_NLS_CODEPAGE_863 is not set
+# CONFIG_NLS_CODEPAGE_864 is not set
+# CONFIG_NLS_CODEPAGE_865 is not set
+# CONFIG_NLS_CODEPAGE_866 is not set
+# CONFIG_NLS_CODEPAGE_869 is not set
+# CONFIG_NLS_CODEPAGE_936 is not set
+# CONFIG_NLS_CODEPAGE_950 is not set
+# CONFIG_NLS_CODEPAGE_932 is not set
+# CONFIG_NLS_CODEPAGE_949 is not set
+# CONFIG_NLS_CODEPAGE_874 is not set
+# CONFIG_NLS_ISO8859_8 is not set
+# CONFIG_NLS_CODEPAGE_1250 is not set
+# CONFIG_NLS_CODEPAGE_1251 is not set
+# CONFIG_NLS_ASCII is not set
+CONFIG_NLS_ISO8859_1=m
+CONFIG_NLS_ISO8859_2=m
+CONFIG_NLS_ISO8859_3=m
+CONFIG_NLS_ISO8859_4=m
+CONFIG_NLS_ISO8859_5=m
+CONFIG_NLS_ISO8859_6=m
+CONFIG_NLS_ISO8859_7=m
+CONFIG_NLS_ISO8859_9=m
+CONFIG_NLS_ISO8859_13=m
+CONFIG_NLS_ISO8859_14=m
+CONFIG_NLS_ISO8859_15=m
+# CONFIG_NLS_KOI8_R is not set
+# CONFIG_NLS_KOI8_U is not set
+# CONFIG_NLS_UTF8 is not set
+
+#
+# Profiling support
+#
+# CONFIG_PROFILING is not set
+
+#
+# Kernel hacking
+#
+# CONFIG_PRINTK_TIME is not set
+CONFIG_DEBUG_KERNEL=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_LOG_BUF_SHIFT=15
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
+# CONFIG_DEBUG_KOBJECT is not set
+# CONFIG_DEBUG_INFO is not set
+CONFIG_DEBUG_FS=y
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_KPROBES is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+CONFIG_DEBUGGER=y
+# CONFIG_XMON is not set
+# CONFIG_PPCDBG is not set
+CONFIG_IRQSTACKS=y
+
+#
+# Security options
+#
+# CONFIG_KEYS is not set
+# CONFIG_SECURITY is not set
+
+#
+# Cryptographic options
+#
+CONFIG_CRYPTO=y
+CONFIG_CRYPTO_HMAC=y
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_MD4 is not set
+CONFIG_CRYPTO_MD5=m
+CONFIG_CRYPTO_SHA1=m
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_WP512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+CONFIG_CRYPTO_DES=m
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+CONFIG_CRYPTO_DEFLATE=m
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Hardware crypto devices
+#
+
+#
+# Library routines
+#
+# CONFIG_CRC_CCITT is not set
+CONFIG_CRC32=y
+# CONFIG_LIBCRC32C is not set
+CONFIG_ZLIB_INFLATE=m
+CONFIG_ZLIB_DEFLATE=m
diff --git a/arch/ppc64/configs/g5_defconfig b/arch/ppc64/configs/g5_defconfig
index 9e0abe8392fc..ab567741e80e 100644
--- a/arch/ppc64/configs/g5_defconfig
+++ b/arch/ppc64/configs/g5_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc3
-# Wed Jul 13 14:40:34 2005
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:16:59 2005
 #
 CONFIG_64BIT=y
 CONFIG_MMU=y
@@ -267,8 +267,6 @@ CONFIG_NET_CLS_ROUTE=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -468,6 +466,7 @@ CONFIG_SCSI_QLA2XXX=y
 # CONFIG_SCSI_QLA2300 is not set
 # CONFIG_SCSI_QLA2322 is not set
 # CONFIG_SCSI_QLA6312 is not set
+# CONFIG_SCSI_QLA24XX is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -539,11 +538,9 @@ CONFIG_IEEE1394_RAWIO=y
 #
 # Macintosh device drivers
 #
-CONFIG_ADB=y
 CONFIG_ADB_PMU=y
 CONFIG_PMAC_SMU=y
 # CONFIG_PMAC_BACKLIGHT is not set
-# CONFIG_INPUT_ADBHID is not set
 CONFIG_THERM_PM72=y
 
 #
@@ -631,6 +628,8 @@ CONFIG_PPPOE=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -718,7 +717,6 @@ CONFIG_LEGACY_PTY_COUNT=256
 #
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
diff --git a/arch/ppc64/configs/iSeries_defconfig b/arch/ppc64/configs/iSeries_defconfig
index dbd54d188c2b..394ba18b58c7 100644
--- a/arch/ppc64/configs/iSeries_defconfig
+++ b/arch/ppc64/configs/iSeries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc3
-# Wed Jul 13 14:43:39 2005
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:17:02 2005
 #
 CONFIG_64BIT=y
 CONFIG_MMU=y
@@ -257,10 +257,6 @@ CONFIG_NET_CLS_ROUTE=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-CONFIG_NETPOLL=y
-CONFIG_NETPOLL_RX=y
-CONFIG_NETPOLL_TRAP=y
-CONFIG_NET_POLL_CONTROLLER=y
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -388,6 +384,7 @@ CONFIG_SCSI_QLA2XXX=y
 # CONFIG_SCSI_QLA2300 is not set
 # CONFIG_SCSI_QLA2322 is not set
 # CONFIG_SCSI_QLA6312 is not set
+# CONFIG_SCSI_QLA24XX is not set
 # CONFIG_SCSI_LPFC is not set
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -537,6 +534,10 @@ CONFIG_PPPOE=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 CONFIG_NETCONSOLE=y
+CONFIG_NETPOLL=y
+CONFIG_NETPOLL_RX=y
+CONFIG_NETPOLL_TRAP=y
+CONFIG_NET_POLL_CONTROLLER=y
 
 #
 # ISDN subsystem
@@ -610,7 +611,6 @@ CONFIG_LEGACY_PTY_COUNT=256
 #
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
diff --git a/arch/ppc64/configs/maple_defconfig b/arch/ppc64/configs/maple_defconfig
index cda8e8cb6d1d..2033fe663dbe 100644
--- a/arch/ppc64/configs/maple_defconfig
+++ b/arch/ppc64/configs/maple_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc3
-# Wed Jul 13 14:46:18 2005
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:17:04 2005
 #
 CONFIG_64BIT=y
 CONFIG_MMU=y
@@ -193,8 +193,6 @@ CONFIG_TCP_CONG_BIC=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NETPOLL is not set
-# CONFIG_NET_POLL_CONTROLLER is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -433,6 +431,8 @@ CONFIG_E1000=y
 # CONFIG_SLIP is not set
 # CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
+# CONFIG_NETPOLL is not set
+# CONFIG_NET_POLL_CONTROLLER is not set
 
 #
 # ISDN subsystem
@@ -512,7 +512,6 @@ CONFIG_LEGACY_PTY_COUNT=256
 #
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
diff --git a/arch/ppc64/configs/pSeries_defconfig b/arch/ppc64/configs/pSeries_defconfig
index 5112edf18181..297fd5229487 100644
--- a/arch/ppc64/configs/pSeries_defconfig
+++ b/arch/ppc64/configs/pSeries_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc3
-# Wed Jul 13 14:47:54 2005
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:17:07 2005
 #
 CONFIG_64BIT=y
 CONFIG_MMU=y
@@ -287,10 +287,6 @@ CONFIG_NET_CLS_ROUTE=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-CONFIG_NETPOLL=y
-CONFIG_NETPOLL_RX=y
-CONFIG_NETPOLL_TRAP=y
-CONFIG_NET_POLL_CONTROLLER=y
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -488,6 +484,7 @@ CONFIG_SCSI_QLA22XX=m
 CONFIG_SCSI_QLA2300=m
 CONFIG_SCSI_QLA2322=m
 CONFIG_SCSI_QLA6312=m
+CONFIG_SCSI_QLA24XX=m
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -645,6 +642,10 @@ CONFIG_PPPOE=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 CONFIG_NETCONSOLE=y
+CONFIG_NETPOLL=y
+CONFIG_NETPOLL_RX=y
+CONFIG_NETPOLL_TRAP=y
+CONFIG_NET_POLL_CONTROLLER=y
 
 #
 # ISDN subsystem
@@ -746,7 +747,6 @@ CONFIG_HVCS=m
 #
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
diff --git a/arch/ppc64/defconfig b/arch/ppc64/defconfig
index fbf1f427ad35..c361e7727b7a 100644
--- a/arch/ppc64/defconfig
+++ b/arch/ppc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.13-rc3
-# Wed Jul 13 14:37:07 2005
+# Linux kernel version: 2.6.13-rc6
+# Mon Aug  8 14:16:54 2005
 #
 CONFIG_64BIT=y
 CONFIG_MMU=y
@@ -289,10 +289,6 @@ CONFIG_NET_CLS_ROUTE=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-CONFIG_NETPOLL=y
-CONFIG_NETPOLL_RX=y
-CONFIG_NETPOLL_TRAP=y
-CONFIG_NET_POLL_CONTROLLER=y
 # CONFIG_HAMRADIO is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
@@ -506,6 +502,7 @@ CONFIG_SCSI_QLA22XX=m
 CONFIG_SCSI_QLA2300=m
 CONFIG_SCSI_QLA2322=m
 CONFIG_SCSI_QLA6312=m
+CONFIG_SCSI_QLA24XX=m
 CONFIG_SCSI_LPFC=m
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
@@ -579,11 +576,9 @@ CONFIG_IEEE1394_AMDTP=m
 #
 # Macintosh device drivers
 #
-CONFIG_ADB=y
 CONFIG_ADB_PMU=y
 CONFIG_PMAC_SMU=y
 # CONFIG_PMAC_BACKLIGHT is not set
-# CONFIG_INPUT_ADBHID is not set
 CONFIG_THERM_PM72=y
 
 #
@@ -694,6 +689,10 @@ CONFIG_PPPOE=m
 # CONFIG_NET_FC is not set
 # CONFIG_SHAPER is not set
 CONFIG_NETCONSOLE=y
+CONFIG_NETPOLL=y
+CONFIG_NETPOLL_RX=y
+CONFIG_NETPOLL_TRAP=y
+CONFIG_NET_POLL_CONTROLLER=y
 
 #
 # ISDN subsystem
@@ -797,7 +796,6 @@ CONFIG_HVCS=m
 #
 # CONFIG_WATCHDOG is not set
 # CONFIG_RTC is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_DTLK is not set
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
diff --git a/arch/ppc64/kernel/head.S b/arch/ppc64/kernel/head.S
index 74fc3bc68604..784f56d4684c 100644
--- a/arch/ppc64/kernel/head.S
+++ b/arch/ppc64/kernel/head.S
@@ -2071,7 +2071,7 @@ _GLOBAL(hmt_start_secondary)
         blr
 #endif
 
-#if defined(CONFIG_SMP) && !defined(CONFIG_PPC_ISERIES)
+#if defined(CONFIG_KEXEC) || (defined(CONFIG_SMP) && !defined(CONFIG_PPC_ISERIES))
 _GLOBAL(smp_release_cpus)
         /* All secondary cpus are spinning on a common
          * spinloop, release them all now so they can start
diff --git a/arch/ppc64/kernel/machine_kexec.c b/arch/ppc64/kernel/machine_kexec.c
index fdb2fc649d72..4775f12a013c 100644
--- a/arch/ppc64/kernel/machine_kexec.c
+++ b/arch/ppc64/kernel/machine_kexec.c
@@ -185,7 +185,7 @@ void kexec_copy_flush(struct kimage *image)
 void kexec_smp_down(void *arg)
 {
         if (ppc_md.cpu_irq_down)
-                ppc_md.cpu_irq_down();
+                ppc_md.cpu_irq_down(1);
 
         local_irq_disable();
         kexec_smp_wait();
@@ -232,7 +232,7 @@ static void kexec_prepare_cpus(void)
 
         /* after we tell the others to go down */
         if (ppc_md.cpu_irq_down)
-                ppc_md.cpu_irq_down();
+                ppc_md.cpu_irq_down(0);
 
         put_cpu();
 
@@ -243,15 +243,19 @@ static void kexec_prepare_cpus(void)
 
 static void kexec_prepare_cpus(void)
 {
+        extern void smp_release_cpus(void);
         /*
          * move the secondarys to us so that we can copy
          * the new kernel 0-0x100 safely
          *
          * do this if kexec in setup.c ?
+         *
+         * We need to release the cpus if we are ever going from an
+         * UP to an SMP kernel.
          */
-        smp_relase_cpus();
+        smp_release_cpus();
         if (ppc_md.cpu_irq_down)
-                ppc_md.cpu_irq_down();
+                ppc_md.cpu_irq_down(0);
         local_irq_disable();
 }
 
diff --git a/arch/ppc64/kernel/mpic.c b/arch/ppc64/kernel/mpic.c
index e8fbab1df37f..cc262a05ddb4 100644
--- a/arch/ppc64/kernel/mpic.c
+++ b/arch/ppc64/kernel/mpic.c
@@ -794,10 +794,10 @@ void mpic_setup_this_cpu(void)
 
 /*
  * XXX: someone who knows mpic should check this.
- * do we need to eoi the ipi here (see xics comments)?
+ * do we need to eoi the ipi including for kexec cpu here (see xics comments)?
  * or can we reset the mpic in the new kernel?
  */
-void mpic_teardown_this_cpu(void)
+void mpic_teardown_this_cpu(int secondary)
 {
         struct mpic *mpic = mpic_primary;
         unsigned long flags;
diff --git a/arch/ppc64/kernel/mpic.h b/arch/ppc64/kernel/mpic.h
index 99fbbc9a084c..ca78a7f10528 100644
--- a/arch/ppc64/kernel/mpic.h
+++ b/arch/ppc64/kernel/mpic.h
@@ -256,7 +256,7 @@ extern unsigned int mpic_irq_get_priority(unsigned int irq);
 extern void mpic_setup_this_cpu(void);
 
 /* Clean up for kexec (or cpu offline or ...) */
-extern void mpic_teardown_this_cpu(void);
+extern void mpic_teardown_this_cpu(int secondary);
 
 /* Request IPIs on primary mpic */
 extern void mpic_request_ipis(void);
diff --git a/arch/ppc64/kernel/pci.c b/arch/ppc64/kernel/pci.c
index ae6f579d3fa0..d0d55c7908ef 100644
--- a/arch/ppc64/kernel/pci.c
+++ b/arch/ppc64/kernel/pci.c
@@ -108,8 +108,28 @@ void  pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region
         region->end = res->end - offset;
 }
 
+void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                              struct pci_bus_region *region)
+{
+        unsigned long offset = 0;
+        struct pci_controller *hose = pci_bus_to_host(dev->bus);
+
+        if (!hose)
+                return;
+
+        if (res->flags & IORESOURCE_IO)
+                offset = (unsigned long)hose->io_base_virt - pci_io_base;
+
+        if (res->flags & IORESOURCE_MEM)
+                offset = hose->pci_mem_offset;
+
+        res->start = region->start + offset;
+        res->end = region->end + offset;
+}
+
 #ifdef CONFIG_HOTPLUG
 EXPORT_SYMBOL(pcibios_resource_to_bus);
+EXPORT_SYMBOL(pcibios_bus_to_resource);
 #endif
 
 /*
diff --git a/arch/ppc64/kernel/xics.c b/arch/ppc64/kernel/xics.c
index 677c4450984a..d9dc6f28d050 100644
--- a/arch/ppc64/kernel/xics.c
+++ b/arch/ppc64/kernel/xics.c
@@ -647,29 +647,30 @@ static void xics_set_affinity(unsigned int virq, cpumask_t cpumask)
         }
 }
 
-void xics_teardown_cpu(void)
+void xics_teardown_cpu(int secondary)
 {
         int cpu = smp_processor_id();
-        int status;
 
         ops->cppr_info(cpu, 0x00);
         iosync();
 
         /*
-         * we need to EOI the IPI if we got here from kexec down IPI
-         *
-         * xics doesn't care if we duplicate an EOI as long as we
-         * don't EOI and raise priority.
-         *
-         * probably need to check all the other interrupts too
-         * should we be flagging idle loop instead?
-         * or creating some task to be scheduled?
+         * Some machines need to have at least one cpu in the GIQ,
+         * so leave the master cpu in the group.
          */
-        ops->xirr_info_set(cpu, XICS_IPI);
-
-        status = rtas_set_indicator(GLOBAL_INTERRUPT_QUEUE,
-                (1UL << interrupt_server_size) - 1 - default_distrib_server, 0);
-        WARN_ON(status != 0);
+        if (secondary) {
+                /*
+                 * we need to EOI the IPI if we got here from kexec down IPI
+                 *
+                 * probably need to check all the other interrupts too
+                 * should we be flagging idle loop instead?
+                 * or creating some task to be scheduled?
+                 */
+                ops->xirr_info_set(cpu, XICS_IPI);
+                rtas_set_indicator(GLOBAL_INTERRUPT_QUEUE,
+                        (1UL << interrupt_server_size) - 1 -
+                        default_distrib_server, 0);
+        }
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
diff --git a/arch/ppc64/xmon/xmon.c b/arch/ppc64/xmon/xmon.c
index 7f6e13a4b71e..05539439e6bc 100644
--- a/arch/ppc64/xmon/xmon.c
+++ b/arch/ppc64/xmon/xmon.c
@@ -329,13 +329,16 @@ int xmon_core(struct pt_regs *regs, int fromipi)
                 printf("cpu 0x%x: Exception %lx %s in xmon, "
                        "returning to main loop\n",
                        cpu, regs->trap, getvecname(TRAP(regs)));
+                release_output_lock();
                 longjmp(xmon_fault_jmp[cpu], 1);
         }
 
         if (setjmp(recurse_jmp) != 0) {
                 if (!in_xmon || !xmon_gate) {
+                        get_output_lock();
                         printf("xmon: WARNING: bad recursive fault "
                                "on cpu 0x%x\n", cpu);
+                        release_output_lock();
                         goto waiting;
                 }
                 secondary = !(xmon_taken && cpu == xmon_owner);
diff --git a/arch/sh64/mm/fault.c b/arch/sh64/mm/fault.c
index a24932881dbb..f08d0eaf6497 100644
--- a/arch/sh64/mm/fault.c
+++ b/arch/sh64/mm/fault.c
@@ -223,13 +223,13 @@ good_area:
          */
 survive:
         switch (handle_mm_fault(mm, vma, address, writeaccess)) {
-        case 1:
+        case VM_FAULT_MINOR:
                 tsk->min_flt++;
                 break;
-        case 2:
+        case VM_FAULT_MAJOR:
                 tsk->maj_flt++;
                 break;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 goto do_sigbus;
         default:
                 goto out_of_memory;
diff --git a/arch/sparc64/solaris/socket.c b/arch/sparc64/solaris/socket.c
index 06740582717e..d3a66ea74a7f 100644
--- a/arch/sparc64/solaris/socket.c
+++ b/arch/sparc64/solaris/socket.c
@@ -16,6 +16,7 @@
 #include <linux/net.h>
 #include <linux/compat.h>
 #include <net/compat.h>
+#include <net/sock.h>
 
 #include <asm/uaccess.h>
 #include <asm/string.h>
@@ -297,121 +298,165 @@ asmlinkage int solaris_sendmsg(int fd, struct sol_nmsghdr __user *user_msg, unsi
 {
         struct socket *sock;
         char address[MAX_SOCK_ADDR];
-        struct iovec iov[UIO_FASTIOV];
+        struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
         unsigned char ctl[sizeof(struct cmsghdr) + 20];
         unsigned char *ctl_buf = ctl;
-        struct msghdr kern_msg;
-        int err, total_len;
+        struct msghdr msg_sys;
+        int err, ctl_len, iov_size, total_len;
 
-        if(msghdr_from_user32_to_kern(&kern_msg, user_msg))
-                return -EFAULT;
-        if(kern_msg.msg_iovlen > UIO_MAXIOV)
-                return -EINVAL;
-        err = verify_compat_iovec(&kern_msg, iov, address, VERIFY_READ);
-        if (err < 0)
+        err = -EFAULT;
+        if (msghdr_from_user32_to_kern(&msg_sys, user_msg))
+                goto out;
+
+        sock = sockfd_lookup(fd, &err);
+        if (!sock)
                 goto out;
+
+        /* do not move before msg_sys is valid */
+        err = -EMSGSIZE;
+        if (msg_sys.msg_iovlen > UIO_MAXIOV)
+                goto out_put;
+
+        /* Check whether to allocate the iovec area*/
+        err = -ENOMEM;
+        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
+        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                if (!iov)
+                        goto out_put;
+        }
+
+        err = verify_compat_iovec(&msg_sys, iov, address, VERIFY_READ);
+        if (err < 0)
+                goto out_freeiov;
         total_len = err;
 
-        if(kern_msg.msg_controllen) {
-                struct sol_cmsghdr __user *ucmsg = kern_msg.msg_control;
+        err = -ENOBUFS;
+        if (msg_sys.msg_controllen > INT_MAX)
+                goto out_freeiov;
+
+        ctl_len = msg_sys.msg_controllen;
+        if (ctl_len) {
+                struct sol_cmsghdr __user *ucmsg = msg_sys.msg_control;
                 unsigned long *kcmsg;
                 compat_size_t cmlen;
 
-                if (kern_msg.msg_controllen <= sizeof(compat_size_t))
-                        return -EINVAL;
+                err = -EINVAL;
+                if (ctl_len <= sizeof(compat_size_t))
+                        goto out_freeiov;
 
-                if(kern_msg.msg_controllen > sizeof(ctl)) {
+                if (ctl_len > sizeof(ctl)) {
                         err = -ENOBUFS;
-                        ctl_buf = kmalloc(kern_msg.msg_controllen, GFP_KERNEL);
-                        if(!ctl_buf)
+                        ctl_buf = kmalloc(ctl_len, GFP_KERNEL);
+                        if (!ctl_buf)
                                 goto out_freeiov;
                 }
                 __get_user(cmlen, &ucmsg->cmsg_len);
                 kcmsg = (unsigned long *) ctl_buf;
                 *kcmsg++ = (unsigned long)cmlen;
                 err = -EFAULT;
-                if(copy_from_user(kcmsg, &ucmsg->cmsg_level,
-                                  kern_msg.msg_controllen - sizeof(compat_size_t)))
+                if (copy_from_user(kcmsg, &ucmsg->cmsg_level,
+                                   ctl_len - sizeof(compat_size_t)))
                         goto out_freectl;
-                kern_msg.msg_control = ctl_buf;
+                msg_sys.msg_control = ctl_buf;
         }
-        kern_msg.msg_flags = solaris_to_linux_msgflags(user_flags);
+        msg_sys.msg_flags = solaris_to_linux_msgflags(user_flags);
 
-        lock_kernel();
-        sock = sockfd_lookup(fd, &err);
-        if (sock != NULL) {
-                if (sock->file->f_flags & O_NONBLOCK)
-                        kern_msg.msg_flags |= MSG_DONTWAIT;
-                err = sock_sendmsg(sock, &kern_msg, total_len);
-                sockfd_put(sock);
-        }
-        unlock_kernel();
+        if (sock->file->f_flags & O_NONBLOCK)
+                msg_sys.msg_flags |= MSG_DONTWAIT;
+        err = sock_sendmsg(sock, &msg_sys, total_len);
 
 out_freectl:
-        /* N.B. Use kfree here, as kern_msg.msg_controllen might change? */
-        if(ctl_buf != ctl)
-                kfree(ctl_buf);
+        if (ctl_buf != ctl)    
+                sock_kfree_s(sock->sk, ctl_buf, ctl_len);
 out_freeiov:
-        if(kern_msg.msg_iov != iov)
-                kfree(kern_msg.msg_iov);
-out:
+        if (iov != iovstack)
+                sock_kfree_s(sock->sk, iov, iov_size);
+out_put:
+        sockfd_put(sock);
+out:       
         return err;
 }
 
 asmlinkage int solaris_recvmsg(int fd, struct sol_nmsghdr __user *user_msg, unsigned int user_flags)
 {
-        struct iovec iovstack[UIO_FASTIOV];
-        struct msghdr kern_msg;
-        char addr[MAX_SOCK_ADDR];
         struct socket *sock;
+        struct iovec iovstack[UIO_FASTIOV];
         struct iovec *iov = iovstack;
+        struct msghdr msg_sys;
+        unsigned long cmsg_ptr;
+        int err, iov_size, total_len, len;
+
+        /* kernel mode address */
+        char addr[MAX_SOCK_ADDR];
+
+        /* user mode address pointers */
         struct sockaddr __user *uaddr;
         int __user *uaddr_len;
-        unsigned long cmsg_ptr;
-        int err, total_len, len = 0;
 
-        if(msghdr_from_user32_to_kern(&kern_msg, user_msg))
+        if (msghdr_from_user32_to_kern(&msg_sys, user_msg))
                 return -EFAULT;
-        if(kern_msg.msg_iovlen > UIO_MAXIOV)
-                return -EINVAL;
 
-        uaddr = kern_msg.msg_name;
+        sock = sockfd_lookup(fd, &err);
+        if (!sock)
+                goto out;
+
+        err = -EMSGSIZE;
+        if (msg_sys.msg_iovlen > UIO_MAXIOV)
+                goto out_put;
+
+        /* Check whether to allocate the iovec area*/
+        err = -ENOMEM;
+        iov_size = msg_sys.msg_iovlen * sizeof(struct iovec);
+        if (msg_sys.msg_iovlen > UIO_FASTIOV) {
+                iov = sock_kmalloc(sock->sk, iov_size, GFP_KERNEL);
+                if (!iov)
+                        goto out_put;
+        }
+
+        /*
+         *      Save the user-mode address (verify_iovec will change the
+         *      kernel msghdr to use the kernel address space)
+         */
+         
+        uaddr = (void __user *) msg_sys.msg_name;
         uaddr_len = &user_msg->msg_namelen;
-        err = verify_compat_iovec(&kern_msg, iov, addr, VERIFY_WRITE);
+        err = verify_compat_iovec(&msg_sys, iov, addr, VERIFY_WRITE);
         if (err < 0)
-                goto out;
+                goto out_freeiov;
         total_len = err;
 
-        cmsg_ptr = (unsigned long) kern_msg.msg_control;
-        kern_msg.msg_flags = 0;
+        cmsg_ptr = (unsigned long) msg_sys.msg_control;
+        msg_sys.msg_flags = MSG_CMSG_COMPAT;
 
-        lock_kernel();
-        sock = sockfd_lookup(fd, &err);
-        if (sock != NULL) {
-                if (sock->file->f_flags & O_NONBLOCK)
-                        user_flags |= MSG_DONTWAIT;
-                err = sock_recvmsg(sock, &kern_msg, total_len, user_flags);
-                if(err >= 0)
-                        len = err;
-                sockfd_put(sock);
-        }
-        unlock_kernel();
-
-        if(uaddr != NULL && err >= 0)
-                err = move_addr_to_user(addr, kern_msg.msg_namelen, uaddr, uaddr_len);
-        if(err >= 0) {
-                err = __put_user(linux_to_solaris_msgflags(kern_msg.msg_flags), &user_msg->msg_flags);
-                if(!err) {
-                        /* XXX Convert cmsg back into userspace 32-bit format... */
-                        err = __put_user((unsigned long)kern_msg.msg_control - cmsg_ptr,
-                                         &user_msg->msg_controllen);
-                }
+        if (sock->file->f_flags & O_NONBLOCK)
+                user_flags |= MSG_DONTWAIT;
+
+        err = sock_recvmsg(sock, &msg_sys, total_len, user_flags);
+        if(err < 0)
+                goto out_freeiov;
+
+        len = err;
+
+        if (uaddr != NULL) {
+                err = move_addr_to_user(addr, msg_sys.msg_namelen, uaddr, uaddr_len);
+                if (err < 0)
+                        goto out_freeiov;
         }
+        err = __put_user(linux_to_solaris_msgflags(msg_sys.msg_flags), &user_msg->msg_flags);
+        if (err)
+                goto out_freeiov;
+        err = __put_user((unsigned long)msg_sys.msg_control - cmsg_ptr,
+                         &user_msg->msg_controllen);
+        if (err)
+                goto out_freeiov;
+        err = len;
 
-        if(kern_msg.msg_iov != iov)
-                kfree(kern_msg.msg_iov);
+out_freeiov:
+        if (iov != iovstack)
+                sock_kfree_s(sock->sk, iov, iov_size);
+out_put:
+        sockfd_put(sock);
 out:
-        if(err < 0)
-                return err;
-        return len;
+        return err;
 }
diff --git a/arch/x86_64/crypto/aes.c b/arch/x86_64/crypto/aes.c
index 2b5c4010ce38..acfdaa28791e 100644
--- a/arch/x86_64/crypto/aes.c
+++ b/arch/x86_64/crypto/aes.c
@@ -322,3 +322,4 @@ module_exit(aes_fini);
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("aes");
diff --git a/arch/x86_64/ia32/ptrace32.c b/arch/x86_64/ia32/ptrace32.c
index b98b6d2462f6..2a925e2af390 100644
--- a/arch/x86_64/ia32/ptrace32.c
+++ b/arch/x86_64/ia32/ptrace32.c
@@ -43,11 +43,11 @@ static int putreg32(struct task_struct *child, unsigned regno, u32 val)
         switch (regno) {
         case offsetof(struct user32, regs.fs):
                 if (val && (val & 3) != 3) return -EIO; 
-                child->thread.fs = val & 0xffff; 
+                child->thread.fsindex = val & 0xffff;
                 break;
         case offsetof(struct user32, regs.gs):
                 if (val && (val & 3) != 3) return -EIO; 
-                child->thread.gs = val & 0xffff;
+                child->thread.gsindex = val & 0xffff;
                 break;
         case offsetof(struct user32, regs.ds):
                 if (val && (val & 3) != 3) return -EIO; 
@@ -138,10 +138,10 @@ static int getreg32(struct task_struct *child, unsigned regno, u32 *val)
 
         switch (regno) {
         case offsetof(struct user32, regs.fs):
-                *val = child->thread.fs; 
+                *val = child->thread.fsindex;
                 break;
         case offsetof(struct user32, regs.gs):
-                *val = child->thread.gs;
+                *val = child->thread.gsindex;
                 break;
         case offsetof(struct user32, regs.ds):
                 *val = child->thread.ds;
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 3b267c91bb0c..8aa56736cde3 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -36,6 +36,7 @@ static unsigned long bank[NR_BANKS] = { [0 ... NR_BANKS-1] = ~0UL };
 static unsigned long console_logged;
 static int notify_user;
 static int rip_msr;
+static int mce_bootlog;
 
 /*
  * Lockless MCE logging infrastructure.
@@ -197,10 +198,11 @@ void do_machine_check(struct pt_regs * regs, long error_code)
                         rdmsrl(MSR_IA32_MC0_ADDR + i*4, m.addr);
 
                 mce_get_rip(&m, regs);
-                if (error_code != -1)
+                if (error_code >= 0)
                         rdtscll(m.tsc);
                 wrmsrl(MSR_IA32_MC0_STATUS + i*4, 0);
-                mce_log(&m);
+                if (error_code != -2)
+                        mce_log(&m);
 
                 /* Did this bank cause the exception? */
                 /* Assume that the bank with uncorrectable errors did it,
@@ -315,7 +317,7 @@ static void mce_init(void *dummy)
 
         /* Log the machine checks left over from the previous reset.
            This also clears all registers */
-        do_machine_check(NULL, -1);
+        do_machine_check(NULL, mce_bootlog ? -1 : -2);
 
         set_in_cr4(X86_CR4_MCE);
 
@@ -476,11 +478,17 @@ static int __init mcheck_disable(char *str)
 }
 
 /* mce=off disables machine check. Note you can reenable it later
-   using sysfs */
+   using sysfs.
+   mce=bootlog Log MCEs from before booting. Disabled by default to work
+   around buggy BIOS that leave bogus MCEs.  */
 static int __init mcheck_enable(char *str)
 {
+        if (*str == '=')
+                str++;
         if (!strcmp(str, "off"))
                 mce_dont_init = 1;
+        else if (!strcmp(str, "bootlog"))
+                mce_bootlog = 1;
         else
                 printk("mce= argument %s ignored. Please use /sys", str); 
         return 0;
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 0aa526298e92..116a491e2961 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -645,15 +645,15 @@ void __init setup_arch(char **cmdline_p)
                 }
         }
 #endif
-
-        sparse_init();
-
 #ifdef CONFIG_KEXEC
         if (crashk_res.start != crashk_res.end) {
                 reserve_bootmem(crashk_res.start,
                         crashk_res.end - crashk_res.start + 1);
         }
 #endif
+
+        sparse_init();
+
         paging_init();
 
         check_ioapic();
diff --git a/arch/x86_64/mm/fault.c b/arch/x86_64/mm/fault.c
index 13792721037e..493819e543a5 100644
--- a/arch/x86_64/mm/fault.c
+++ b/arch/x86_64/mm/fault.c
@@ -439,13 +439,13 @@ good_area:
          * the fault.
          */
         switch (handle_mm_fault(mm, vma, address, write)) {
-        case 1:
+        case VM_FAULT_MINOR:
                 tsk->min_flt++;
                 break;
-        case 2:
+        case VM_FAULT_MAJOR:
                 tsk->maj_flt++;
                 break;
-        case 0:
+        case VM_FAULT_SIGBUS:
                 goto do_sigbus;
         default:
                 goto out_of_memory;
diff --git a/drivers/acorn/block/fd1772.c b/drivers/acorn/block/fd1772.c
index 3cd2e968e96c..c0a37d98b4f3 100644
--- a/drivers/acorn/block/fd1772.c
+++ b/drivers/acorn/block/fd1772.c
@@ -1283,8 +1283,7 @@ static void do_fd_request(request_queue_t* q)
         if (fdc_busy) return;
         save_flags(flags);
         cli();
-        while (fdc_busy)
-                sleep_on(&fdc_wait);
+        wait_event(fdc_wait, !fdc_busy);
         fdc_busy = 1;
         ENABLE_IRQ();
         restore_flags(flags);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 986410e7b483..ba13896cae40 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -133,9 +133,10 @@ config ACPI_HOTKEY
         depends on ACPI_INTERPRETER
         depends on EXPERIMENTAL
         depends on !IA64_SGI_SN
-        default m
+        default n
         help
-        ACPI generic hotkey
+          Experimental consolidated hotkey driver.
+          If you are unsure, say N.
 
 config ACPI_FAN
         tristate "Fan"
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 0f45d45f05a0..8162fd0c21a7 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -26,6 +26,9 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/types.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
@@ -33,6 +36,9 @@
 #define ACPI_BUTTON_COMPONENT           0x00080000
 #define ACPI_BUTTON_DRIVER_NAME         "ACPI Button Driver"
 #define ACPI_BUTTON_CLASS               "button"
+#define ACPI_BUTTON_FILE_INFO           "info"
+#define ACPI_BUTTON_FILE_STATE          "state"
+#define ACPI_BUTTON_TYPE_UNKNOWN        0x00
 #define ACPI_BUTTON_NOTIFY_STATUS       0x80
 
 #define ACPI_BUTTON_SUBCLASS_POWER      "power"
@@ -64,6 +70,8 @@ MODULE_LICENSE("GPL");
 
 static int acpi_button_add (struct acpi_device *device);
 static int acpi_button_remove (struct acpi_device *device, int type);
+static int acpi_button_info_open_fs(struct inode *inode, struct file *file);
+static int acpi_button_state_open_fs(struct inode *inode, struct file *file);
 
 static struct acpi_driver acpi_button_driver = {
         .name =         ACPI_BUTTON_DRIVER_NAME,
@@ -82,6 +90,179 @@ struct acpi_button {
         unsigned long           pushed;
 };
 
+static struct file_operations acpi_button_info_fops = {
+        .open           = acpi_button_info_open_fs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct file_operations acpi_button_state_fops = {
+        .open           = acpi_button_state_open_fs,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+/* --------------------------------------------------------------------------
+                              FS Interface (/proc)
+   -------------------------------------------------------------------------- */
+
+static struct proc_dir_entry    *acpi_button_dir;
+
+static int acpi_button_info_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_button      *button = (struct acpi_button *) seq->private;
+
+        ACPI_FUNCTION_TRACE("acpi_button_info_seq_show");
+
+        if (!button || !button->device)
+                return_VALUE(0);
+
+        seq_printf(seq, "type:                    %s\n", 
+                acpi_device_name(button->device));
+
+        return_VALUE(0);
+}
+
+static int acpi_button_info_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_button_info_seq_show, PDE(inode)->data);
+}
+        
+static int acpi_button_state_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_button      *button = (struct acpi_button *) seq->private;
+        acpi_status             status;
+        unsigned long           state;
+
+        ACPI_FUNCTION_TRACE("acpi_button_state_seq_show");
+
+        if (!button || !button->device)
+                return_VALUE(0);
+
+        status = acpi_evaluate_integer(button->handle,"_LID",NULL,&state);
+        if (ACPI_FAILURE(status)) {
+                seq_printf(seq, "state:      unsupported\n");
+        }
+        else{
+                seq_printf(seq, "state:      %s\n", (state ? "open" : "closed")); 
+        }
+
+        return_VALUE(0);
+}
+
+static int acpi_button_state_open_fs(struct inode *inode, struct file *file)
+{
+        return single_open(file, acpi_button_state_seq_show, PDE(inode)->data);
+}
+
+static struct proc_dir_entry *acpi_power_dir;
+static struct proc_dir_entry *acpi_sleep_dir;
+static struct proc_dir_entry *acpi_lid_dir;
+
+static int
+acpi_button_add_fs (
+        struct acpi_device      *device)
+{
+        struct proc_dir_entry   *entry = NULL;
+        struct acpi_button      *button = NULL;
+
+        ACPI_FUNCTION_TRACE("acpi_button_add_fs");
+
+        if (!device || !acpi_driver_data(device))
+                return_VALUE(-EINVAL);
+
+        button = acpi_driver_data(device);
+
+        switch (button->type) {
+        case ACPI_BUTTON_TYPE_POWER:
+        case ACPI_BUTTON_TYPE_POWERF:
+                if (!acpi_power_dir)
+                        acpi_power_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_POWER, 
+                                acpi_button_dir);
+                entry = acpi_power_dir;
+                break;
+        case ACPI_BUTTON_TYPE_SLEEP:
+        case ACPI_BUTTON_TYPE_SLEEPF:
+                if (!acpi_sleep_dir)
+                        acpi_sleep_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_SLEEP, 
+                                acpi_button_dir);
+                entry = acpi_sleep_dir;
+                break;
+        case ACPI_BUTTON_TYPE_LID:
+                if (!acpi_lid_dir)
+                        acpi_lid_dir = proc_mkdir(ACPI_BUTTON_SUBCLASS_LID, 
+                                acpi_button_dir);
+                entry = acpi_lid_dir;
+                break;
+        }
+
+        if (!entry)
+                return_VALUE(-ENODEV);
+        entry->owner = THIS_MODULE;
+
+        acpi_device_dir(device) = proc_mkdir(acpi_device_bid(device), entry);
+        if (!acpi_device_dir(device))
+                return_VALUE(-ENODEV);
+        acpi_device_dir(device)->owner = THIS_MODULE;
+
+        /* 'info' [R] */
+        entry = create_proc_entry(ACPI_BUTTON_FILE_INFO,
+                S_IRUGO, acpi_device_dir(device));
+        if (!entry)
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                        "Unable to create '%s' fs entry\n",
+                        ACPI_BUTTON_FILE_INFO));
+        else {
+                entry->proc_fops = &acpi_button_info_fops;
+                entry->data = acpi_driver_data(device);
+                entry->owner = THIS_MODULE;
+        }
+
+        /* show lid state [R] */
+        if (button->type == ACPI_BUTTON_TYPE_LID) {
+                entry = create_proc_entry(ACPI_BUTTON_FILE_STATE,
+                        S_IRUGO, acpi_device_dir(device));
+                if (!entry)
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
+                                "Unable to create '%s' fs entry\n",
+                                ACPI_BUTTON_FILE_INFO));
+                else {
+                        entry->proc_fops = &acpi_button_state_fops;
+                        entry->data = acpi_driver_data(device);
+                        entry->owner = THIS_MODULE;
+                }
+        }
+
+        return_VALUE(0);
+}
+
+
+static int
+acpi_button_remove_fs (
+        struct acpi_device      *device)
+{
+        struct acpi_button      *button = NULL;
+
+        ACPI_FUNCTION_TRACE("acpi_button_remove_fs");
+
+        button = acpi_driver_data(device);
+        if (acpi_device_dir(device)) {
+                if (button->type == ACPI_BUTTON_TYPE_LID)
+                        remove_proc_entry(ACPI_BUTTON_FILE_STATE,
+                                             acpi_device_dir(device));
+                remove_proc_entry(ACPI_BUTTON_FILE_INFO,
+                                     acpi_device_dir(device));
+
+                remove_proc_entry(acpi_device_bid(device),
+                                     acpi_device_dir(device)->parent);
+                acpi_device_dir(device) = NULL;
+        }
+
+        return_VALUE(0);
+}
+
+
 /* --------------------------------------------------------------------------
                                 Driver Interface
    -------------------------------------------------------------------------- */
@@ -121,7 +302,8 @@ acpi_button_notify_fixed (
         
         ACPI_FUNCTION_TRACE("acpi_button_notify_fixed");
 
-        BUG_ON(!button);
+        if (!button)
+                return_ACPI_STATUS(AE_BAD_PARAMETER);
 
         acpi_button_notify(button->handle, ACPI_BUTTON_NOTIFY_STATUS, button);
 
@@ -197,6 +379,10 @@ acpi_button_add (
                 goto end;
         }
 
+        result = acpi_button_add_fs(device);
+        if (result)
+                goto end;
+
         switch (button->type) {
         case ACPI_BUTTON_TYPE_POWERF:
                 status = acpi_install_fixed_event_handler (
@@ -240,6 +426,7 @@ acpi_button_add (
 
 end:
         if (result) {
+                acpi_button_remove_fs(device);
                 kfree(button);
         }
 
@@ -280,6 +467,8 @@ acpi_button_remove (struct acpi_device *device, int type)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                         "Error removing notify handler\n"));
 
+        acpi_button_remove_fs(device);  
+
         kfree(button);
 
         return_VALUE(0);
@@ -293,14 +482,20 @@ acpi_button_init (void)
 
         ACPI_FUNCTION_TRACE("acpi_button_init");
 
+        acpi_button_dir = proc_mkdir(ACPI_BUTTON_CLASS, acpi_root_dir);
+        if (!acpi_button_dir)
+                return_VALUE(-ENODEV);
+        acpi_button_dir->owner = THIS_MODULE;
         result = acpi_bus_register_driver(&acpi_button_driver);
         if (result < 0) {
+                remove_proc_entry(ACPI_BUTTON_CLASS, acpi_root_dir);
                 return_VALUE(-ENODEV);
         }
 
         return_VALUE(0);
 }
 
+
 static void __exit
 acpi_button_exit (void)
 {
@@ -308,8 +503,17 @@ acpi_button_exit (void)
 
         acpi_bus_unregister_driver(&acpi_button_driver);
 
+        if (acpi_power_dir) 
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_POWER, acpi_button_dir);
+        if (acpi_sleep_dir)
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_SLEEP, acpi_button_dir);
+        if (acpi_lid_dir)
+                remove_proc_entry(ACPI_BUTTON_SUBCLASS_LID, acpi_button_dir);
+        remove_proc_entry(ACPI_BUTTON_CLASS, acpi_root_dir);
+
         return_VOID;
 }
 
+
 module_init(acpi_button_init);
 module_exit(acpi_button_exit);
diff --git a/drivers/acpi/dispatcher/dswload.c b/drivers/acpi/dispatcher/dswload.c
index 1ac197ccfc80..d11620018421 100644
--- a/drivers/acpi/dispatcher/dswload.c
+++ b/drivers/acpi/dispatcher/dswload.c
@@ -491,12 +491,6 @@ acpi_ds_load2_begin_op (
                 if ((!(walk_state->op_info->flags & AML_NSOPCODE) &&
                           (walk_state->opcode != AML_INT_NAMEPATH_OP)) ||
                         (!(walk_state->op_info->flags & AML_NAMED))) {
-                        if ((walk_state->op_info->class == AML_CLASS_EXECUTE) ||
-                                (walk_state->op_info->class == AML_CLASS_CONTROL)) {
-                                ACPI_REPORT_WARNING ((
-                                        "Encountered executable code at module level, [%s]\n",
-                                        acpi_ps_get_opcode_name (walk_state->opcode)));
-                        }
                         return_ACPI_STATUS (AE_OK);
                 }
 
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 2dadb7f63269..1ac5731d45e5 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -76,13 +76,14 @@ static int acpi_ec_remove (struct acpi_device *device, int type);
 static int acpi_ec_start (struct acpi_device *device);
 static int acpi_ec_stop (struct acpi_device *device, int type);
 static int acpi_ec_burst_add ( struct acpi_device *device);
+static int acpi_ec_polling_add ( struct acpi_device     *device);
 
 static struct acpi_driver acpi_ec_driver = {
         .name =         ACPI_EC_DRIVER_NAME,
         .class =        ACPI_EC_CLASS,
         .ids =          ACPI_EC_HID,
         .ops =          {
-                                .add =          acpi_ec_burst_add,
+                                .add =          acpi_ec_polling_add,
                                 .remove =       acpi_ec_remove,
                                 .start =        acpi_ec_start,
                                 .stop =         acpi_ec_stop,
@@ -164,7 +165,7 @@ static union acpi_ec	*ec_ecdt;
 
 /* External interfaces use first EC only, so remember */
 static struct acpi_device *first_ec;
-static int acpi_ec_polling_mode;
+static int acpi_ec_polling_mode = EC_POLLING;
 
 /* --------------------------------------------------------------------------
                              Transaction Management
@@ -1710,11 +1711,24 @@ static int __init acpi_fake_ecdt_setup(char *str)
         acpi_fake_ecdt_enabled = 1;
         return 0;
 }
+
 __setup("acpi_fake_ecdt", acpi_fake_ecdt_setup);
 static int __init acpi_ec_set_polling_mode(char *str)
 {
-        acpi_ec_polling_mode = EC_POLLING;
-        acpi_ec_driver.ops.add = acpi_ec_polling_add;
+        int burst;
+
+        if (!get_option(&str, &burst))
+                return 0;
+
+        if (burst) {
+                acpi_ec_polling_mode = EC_BURST;
+                acpi_ec_driver.ops.add = acpi_ec_burst_add;
+        } else {
+                acpi_ec_polling_mode = EC_POLLING;
+                acpi_ec_driver.ops.add = acpi_ec_polling_add;
+        }
+        printk(KERN_INFO PREFIX "EC %s mode.\n",
+                burst ? "burst": "polling");
         return 0;
 }
-__setup("ec_polling", acpi_ec_set_polling_mode);
+__setup("ec_burst=", acpi_ec_set_polling_mode);
diff --git a/drivers/acpi/hotkey.c b/drivers/acpi/hotkey.c
index babdf762eadb..1f76a40badec 100644
--- a/drivers/acpi/hotkey.c
+++ b/drivers/acpi/hotkey.c
@@ -1,5 +1,5 @@
-/* 
- *  hotkey.c - ACPI Hotkey Driver ($Revision:$)
+/*
+ *  hotkey.c - ACPI Hotkey Driver ($Revision: 0.2 $)
  *
  *  Copyright (C) 2004 Luming Yu <luming.yu@intel.com>
  *
@@ -51,17 +51,18 @@
 #define ACPI_HOTKEY_POLLING 0x2
 #define ACPI_UNDEFINED_EVENT    0xf
 
-#define MAX_CONFIG_RECORD_LEN   80
-#define MAX_NAME_PATH_LEN   80
-#define MAX_CALL_PARM       80
+#define RESULT_STR_LEN      80
 
-#define IS_EVENT(e)       0xff  /* ((e) & 0x40000000)  */
-#define IS_POLL(e)      0xff    /* (~((e) & 0x40000000))  */
+#define ACTION_METHOD   0
+#define POLL_METHOD     1
 
+#define IS_EVENT(e)             ((e) <= 10000 && (e) >0)
+#define IS_POLL(e)              ((e) > 10000)
+#define IS_OTHERS(e)            ((e)<=0 || (e)>=20000)
 #define _COMPONENT              ACPI_HOTKEY_COMPONENT
 ACPI_MODULE_NAME("acpi_hotkey")
 
-    MODULE_AUTHOR("luming.yu@intel.com");
+MODULE_AUTHOR("luming.yu@intel.com");
 MODULE_DESCRIPTION(ACPI_HOTK_NAME);
 MODULE_LICENSE("GPL");
 
@@ -114,7 +115,7 @@ struct acpi_event_hotkey {
         char *action_method;    /* action method */
 };
 
-/* 
+/*
  * There are two ways to poll status
  * 1. directy call read_xxx method, without any arguments passed in
  * 2. call write_xxx method, with arguments passed in, you need
@@ -131,7 +132,7 @@ struct acpi_polling_hotkey {
         char *poll_method;      /* poll method */
         acpi_handle action_handle;      /* acpi handle attached action method */
         char *action_method;    /* action method */
-        void *poll_result;      /* polling_result */
+        union acpi_object *poll_result; /* polling_result */
         struct proc_dir_entry *proc;
 };
 
@@ -162,20 +163,25 @@ static struct acpi_driver hotkey_driver = {
                 },
 };
 
+static void free_hotkey_device(union acpi_hotkey *key);
+static void free_hotkey_buffer(union acpi_hotkey *key);
+static void free_poll_hotkey_buffer(union acpi_hotkey *key);
 static int hotkey_open_config(struct inode *inode, struct file *file);
+static int hotkey_poll_open_config(struct inode *inode, struct file *file);
 static ssize_t hotkey_write_config(struct file *file,
                                    const char __user * buffer,
                                    size_t count, loff_t * data);
-static ssize_t hotkey_write_poll_config(struct file *file,
-                                        const char __user * buffer,
-                                        size_t count, loff_t * data);
 static int hotkey_info_open_fs(struct inode *inode, struct file *file);
 static int hotkey_action_open_fs(struct inode *inode, struct file *file);
 static ssize_t hotkey_execute_aml_method(struct file *file,
                                          const char __user * buffer,
                                          size_t count, loff_t * data);
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset);
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset);
 static int hotkey_polling_open_fs(struct inode *inode, struct file *file);
+static union acpi_hotkey *get_hotkey_by_event(struct
+                              acpi_hotkey_list
+                              *hotkey_list, int event);
 
 /* event based config */
 static struct file_operations hotkey_config_fops = {
@@ -188,9 +194,9 @@ static struct file_operations hotkey_config_fops = {
 
 /* polling based config */
 static struct file_operations hotkey_poll_config_fops = {
-        .open = hotkey_open_config,
+        .open = hotkey_poll_open_config,
         .read = seq_read,
-        .write = hotkey_write_poll_config,
+        .write = hotkey_write_config,
         .llseek = seq_lseek,
         .release = single_release,
 };
@@ -227,7 +233,7 @@ static int hotkey_info_seq_show(struct seq_file *seq, void *offset)
 {
         ACPI_FUNCTION_TRACE("hotkey_info_seq_show");
 
-        seq_printf(seq, "Hotkey generic driver ver: %s", HOTKEY_ACPI_VERSION);
+        seq_printf(seq, "Hotkey generic driver ver: %s\n", HOTKEY_ACPI_VERSION);
 
         return_VALUE(0);
 }
@@ -239,27 +245,35 @@ static int hotkey_info_open_fs(struct inode *inode, struct file *file)
 
 static char *format_result(union acpi_object *object)
 {
-        char *buf = (char *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-
-        memset(buf, 0, sizeof(union acpi_object));
+        char *buf = NULL;
+        
+        buf = (char *)kmalloc(RESULT_STR_LEN, GFP_KERNEL);
+        if (buf)
+                memset(buf, 0, RESULT_STR_LEN);
+        else
+                goto do_fail;
 
         /* Now, just support integer type */
         if (object->type == ACPI_TYPE_INTEGER)
-                sprintf(buf, "%d", (u32) object->integer.value);
-
-        return buf;
+                sprintf(buf, "%d\n", (u32) object->integer.value);
+do_fail:
+        return (buf);
 }
 
 static int hotkey_polling_seq_show(struct seq_file *seq, void *offset)
 {
         struct acpi_polling_hotkey *poll_hotkey =
             (struct acpi_polling_hotkey *)seq->private;
+        char *buf;
 
         ACPI_FUNCTION_TRACE("hotkey_polling_seq_show");
 
-        if (poll_hotkey->poll_result)
-                seq_printf(seq, "%s", format_result(poll_hotkey->poll_result));
-
+        if (poll_hotkey->poll_result){
+                buf = format_result(poll_hotkey->poll_result);
+                if(buf)
+                        seq_printf(seq, "%s", buf);
+                kfree(buf);
+        }
         return_VALUE(0);
 }
 
@@ -276,19 +290,19 @@ static int hotkey_action_open_fs(struct inode *inode, struct file *file)
 /* Mapping external hotkey number to standardized hotkey event num */
 static int hotkey_get_internal_event(int event, struct acpi_hotkey_list *list)
 {
-        struct list_head *entries, *next;
-        int val = 0;
+        struct list_head *entries;
+        int val = -1;
 
         ACPI_FUNCTION_TRACE("hotkey_get_internal_event");
 
-        list_for_each_safe(entries, next, list->entries) {
+        list_for_each(entries, list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
                 if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-                    && key->event_hotkey.external_hotkey_num == event)
+                    && key->event_hotkey.external_hotkey_num == event){
                         val = key->link.hotkey_standard_num;
-                else
-                        val = -1;
+                        break;
+                }
         }
 
         return_VALUE(val);
@@ -306,7 +320,7 @@ acpi_hotkey_notify_handler(acpi_handle handle, u32 event, void *data)
                 return_VOID;
 
         internal_event = hotkey_get_internal_event(event, &global_hotkey_list);
-        acpi_bus_generate_event(device, event, 0);
+        acpi_bus_generate_event(device, internal_event, 0);
 
         return_VOID;
 }
@@ -329,13 +343,17 @@ static int auto_hotkey_remove(struct acpi_device *device, int type)
 static int create_polling_proc(union acpi_hotkey *device)
 {
         struct proc_dir_entry *proc;
+        char  proc_name[80];
         mode_t mode;
 
         ACPI_FUNCTION_TRACE("create_polling_proc");
         mode = S_IFREG | S_IRUGO | S_IWUGO;
 
-        proc = create_proc_entry(device->poll_hotkey.action_method,
-                                 mode, hotkey_proc_dir);
+        sprintf(proc_name, "%d", device->link.hotkey_standard_num);
+        /*
+        strcat(proc_name, device->poll_hotkey.poll_method);
+        */
+        proc = create_proc_entry(proc_name, mode, hotkey_proc_dir);
 
         if (!proc) {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
@@ -353,23 +371,6 @@ static int create_polling_proc(union acpi_hotkey *device)
         return_VALUE(0);
 }
 
-static int is_valid_acpi_path(const char *pathname)
-{
-        acpi_handle handle;
-        acpi_status status;
-        ACPI_FUNCTION_TRACE("is_valid_acpi_path");
-
-        status = acpi_get_handle(NULL, (char *)pathname, &handle);
-        return_VALUE(!ACPI_FAILURE(status));
-}
-
-static int is_valid_hotkey(union acpi_hotkey *device)
-{
-        ACPI_FUNCTION_TRACE("is_valid_hotkey");
-        /* Implement valid check */
-        return_VALUE(1);
-}
-
 static int hotkey_add(union acpi_hotkey *device)
 {
         int status = 0;
@@ -378,15 +379,11 @@ static int hotkey_add(union acpi_hotkey *device)
         ACPI_FUNCTION_TRACE("hotkey_add");
 
         if (device->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-                status =
-                    acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
-                if (status)
-                        return_VALUE(status);
-
+                acpi_bus_get_device(device->event_hotkey.bus_handle, &dev);
                 status = acpi_install_notify_handler(dev->handle,
-                                                     ACPI_SYSTEM_NOTIFY,
+                                                     ACPI_DEVICE_NOTIFY,
                                                      acpi_hotkey_notify_handler,
-                                                     device);
+                                                     dev);
         } else                  /* Add polling hotkey */
                 create_polling_proc(device);
 
@@ -409,84 +406,143 @@ static int hotkey_remove(union acpi_hotkey *device)
                 if (key->link.hotkey_standard_num ==
                     device->link.hotkey_standard_num) {
                         list_del(&key->link.entries);
-                        remove_proc_entry(key->poll_hotkey.action_method,
-                                          hotkey_proc_dir);
+                        free_hotkey_device(key);
                         global_hotkey_list.count--;
                         break;
                 }
         }
+        kfree(device);
         return_VALUE(0);
 }
 
-static void hotkey_update(union acpi_hotkey *key)
+static int  hotkey_update(union acpi_hotkey *key)
 {
-        struct list_head *entries, *next;
+        struct list_head *entries;
 
         ACPI_FUNCTION_TRACE("hotkey_update");
 
-        list_for_each_safe(entries, next, global_hotkey_list.entries) {
-                union acpi_hotkey *key =
+        list_for_each(entries, global_hotkey_list.entries) {
+                union acpi_hotkey *tmp=
                     container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_standard_num ==
+                if (tmp->link.hotkey_standard_num ==
                     key->link.hotkey_standard_num) {
-                        key->event_hotkey.bus_handle =
-                            key->event_hotkey.bus_handle;
-                        key->event_hotkey.external_hotkey_num =
-                            key->event_hotkey.external_hotkey_num;
-                        key->event_hotkey.action_handle =
-                            key->event_hotkey.action_handle;
-                        key->event_hotkey.action_method =
-                            key->event_hotkey.action_method;
+                        if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
+                                free_hotkey_buffer(tmp);
+                                tmp->event_hotkey.bus_handle =
+                                        key->event_hotkey.bus_handle;
+                                tmp->event_hotkey.external_hotkey_num =
+                                        key->event_hotkey.external_hotkey_num;
+                                tmp->event_hotkey.action_handle =
+                                        key->event_hotkey.action_handle;
+                                tmp->event_hotkey.action_method =
+                                        key->event_hotkey.action_method;
+                                kfree(key);
+                        } else {
+                                /*
+                                char  proc_name[80];
+
+                                sprintf(proc_name, "%d", tmp->link.hotkey_standard_num);
+                                strcat(proc_name, tmp->poll_hotkey.poll_method);
+                                remove_proc_entry(proc_name,hotkey_proc_dir);
+                                */
+                                free_poll_hotkey_buffer(tmp);
+                                tmp->poll_hotkey.poll_handle =
+                                        key->poll_hotkey.poll_handle;
+                                tmp->poll_hotkey.poll_method =
+                                        key->poll_hotkey.poll_method;
+                                tmp->poll_hotkey.action_handle =
+                                        key->poll_hotkey.action_handle;
+                                tmp->poll_hotkey.action_method =
+                                        key->poll_hotkey.action_method;
+                                tmp->poll_hotkey.poll_result =
+                                        key->poll_hotkey.poll_result;
+                                /*
+                                create_polling_proc(tmp);
+                                */
+                                kfree(key);
+                        }
+                        return_VALUE(0);
                         break;
                 }
         }
 
-        return_VOID;
+        return_VALUE(-ENODEV);
 }
 
 static void free_hotkey_device(union acpi_hotkey *key)
 {
         struct acpi_device *dev;
-        int status;
 
         ACPI_FUNCTION_TRACE("free_hotkey_device");
 
         if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
-                status =
-                    acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
+                acpi_bus_get_device(key->event_hotkey.bus_handle, &dev);
                 if (dev->handle)
                         acpi_remove_notify_handler(dev->handle,
-                                                   ACPI_SYSTEM_NOTIFY,
+                                                   ACPI_DEVICE_NOTIFY,
                                                    acpi_hotkey_notify_handler);
-        } else
-                remove_proc_entry(key->poll_hotkey.action_method,
-                                  hotkey_proc_dir);
+                free_hotkey_buffer(key);
+        } else {
+                char  proc_name[80];
+
+                sprintf(proc_name, "%d", key->link.hotkey_standard_num);
+                /*
+                strcat(proc_name, key->poll_hotkey.poll_method);
+                */
+                remove_proc_entry(proc_name,hotkey_proc_dir);
+                free_poll_hotkey_buffer(key);
+        }
         kfree(key);
         return_VOID;
 }
 
+static void
+free_hotkey_buffer(union acpi_hotkey *key)
+{
+        kfree(key->event_hotkey.action_method);
+}
+
+static void
+free_poll_hotkey_buffer(union acpi_hotkey *key)
+{
+        kfree(key->poll_hotkey.action_method);
+        kfree(key->poll_hotkey.poll_method);
+        kfree(key->poll_hotkey.poll_result);
+}
 static int
 init_hotkey_device(union acpi_hotkey *key, char *bus_str, char *action_str,
                    char *method, int std_num, int external_num)
 {
+        acpi_handle     tmp_handle;
+        acpi_status status = AE_OK;
+
         ACPI_FUNCTION_TRACE("init_hotkey_device");
 
+        if(std_num < 0 || IS_POLL(std_num) || !key )
+                goto do_fail;
+
+        if(!bus_str || !action_str || !method)
+                goto do_fail;
+
         key->link.hotkey_type = ACPI_HOTKEY_EVENT;
         key->link.hotkey_standard_num = std_num;
         key->event_hotkey.flag = 0;
-        if (is_valid_acpi_path(bus_str))
-                acpi_get_handle((acpi_handle) 0,
-                                bus_str, &(key->event_hotkey.bus_handle));
-        else
-                return_VALUE(-ENODEV);
-        key->event_hotkey.external_hotkey_num = external_num;
-        if (is_valid_acpi_path(action_str))
-                acpi_get_handle((acpi_handle) 0,
-                                action_str, &(key->event_hotkey.action_handle));
-        key->event_hotkey.action_method = kmalloc(sizeof(method), GFP_KERNEL);
-        strcpy(key->event_hotkey.action_method, method);
+        key->event_hotkey.action_method = method;
 
-        return_VALUE(!is_valid_hotkey(key));
+        status = acpi_get_handle(NULL,bus_str, &(key->event_hotkey.bus_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        key->event_hotkey.external_hotkey_num = external_num;
+        status = acpi_get_handle(NULL,action_str, &(key->event_hotkey.action_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->event_hotkey.action_handle,
+                                method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        return_VALUE(AE_OK);
+do_fail:
+        return_VALUE(-ENODEV);
 }
 
 static int
@@ -495,34 +551,46 @@ init_poll_hotkey_device(union acpi_hotkey *key,
                         char *poll_method,
                         char *action_str, char *action_method, int std_num)
 {
+        acpi_status status = AE_OK;
+        acpi_handle     tmp_handle;
+
         ACPI_FUNCTION_TRACE("init_poll_hotkey_device");
 
+        if(std_num < 0 || IS_EVENT(std_num) || !key)
+                goto do_fail;
+
+        if(!poll_str || !poll_method || !action_str || !action_method)
+                goto do_fail;
+
         key->link.hotkey_type = ACPI_HOTKEY_POLLING;
         key->link.hotkey_standard_num = std_num;
         key->poll_hotkey.flag = 0;
-        if (is_valid_acpi_path(poll_str))
-                acpi_get_handle((acpi_handle) 0,
-                                poll_str, &(key->poll_hotkey.poll_handle));
-        else
-                return_VALUE(-ENODEV);
         key->poll_hotkey.poll_method = poll_method;
-        if (is_valid_acpi_path(action_str))
-                acpi_get_handle((acpi_handle) 0,
-                                action_str, &(key->poll_hotkey.action_handle));
-        key->poll_hotkey.action_method =
-            kmalloc(sizeof(action_method), GFP_KERNEL);
-        strcpy(key->poll_hotkey.action_method, action_method);
+        key->poll_hotkey.action_method = action_method;
+
+        status = acpi_get_handle(NULL,poll_str, &(key->poll_hotkey.poll_handle));
+        if(ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->poll_hotkey.poll_handle,
+                                poll_method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(NULL,action_str, &(key->poll_hotkey.action_handle));
+        if (ACPI_FAILURE(status))
+                goto do_fail;
+        status = acpi_get_handle(key->poll_hotkey.action_handle,
+                                action_method, &tmp_handle);
+        if (ACPI_FAILURE(status))
+                goto do_fail;
         key->poll_hotkey.poll_result =
             (union acpi_object *)kmalloc(sizeof(union acpi_object), GFP_KERNEL);
-        return_VALUE(is_valid_hotkey(key));
+        if(!key->poll_hotkey.poll_result)
+                goto do_fail;
+        return_VALUE(AE_OK);
+do_fail:
+        return_VALUE(-ENODEV);
 }
 
-static int check_hotkey_valid(union acpi_hotkey *key,
-                              struct acpi_hotkey_list *list)
-{
-        ACPI_FUNCTION_TRACE("check_hotkey_valid");
-        return_VALUE(0);
-}
 
 static int hotkey_open_config(struct inode *inode, struct file *file)
 {
@@ -531,10 +599,17 @@ static int hotkey_open_config(struct inode *inode, struct file *file)
                      (file, hotkey_config_seq_show, PDE(inode)->data));
 }
 
+static int hotkey_poll_open_config(struct inode *inode, struct file *file)
+{
+        ACPI_FUNCTION_TRACE("hotkey_poll_open_config");
+        return_VALUE(single_open
+                     (file, hotkey_poll_config_seq_show, PDE(inode)->data));
+}
+
 static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 {
         struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        struct list_head *entries, *next;
+        struct list_head *entries;
         char bus_name[ACPI_PATHNAME_MAX] = { 0 };
         char action_name[ACPI_PATHNAME_MAX] = { 0 };
         struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
@@ -542,10 +617,7 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
 
         ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
 
-        if (!hotkey_list)
-                goto end;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
+        list_for_each(entries, hotkey_list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
                 if (key->link.hotkey_type == ACPI_HOTKEY_EVENT) {
@@ -553,18 +625,37 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
                                       ACPI_NAME_TYPE_MAX, &bus);
                         acpi_get_name(key->event_hotkey.action_handle,
                                       ACPI_NAME_TYPE_MAX, &act);
-                        seq_printf(seq, "%s:%s:%s:%d:%d", bus_name,
+                        seq_printf(seq, "%s:%s:%s:%d:%d\n", bus_name,
                                    action_name,
                                    key->event_hotkey.action_method,
                                    key->link.hotkey_standard_num,
                                    key->event_hotkey.external_hotkey_num);
-                } /* ACPI_HOTKEY_POLLING */
-                else {
+                }
+        }
+        seq_puts(seq, "\n");
+        return_VALUE(0);
+}
+
+static int hotkey_poll_config_seq_show(struct seq_file *seq, void *offset)
+{
+        struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
+        struct list_head *entries;
+        char bus_name[ACPI_PATHNAME_MAX] = { 0 };
+        char action_name[ACPI_PATHNAME_MAX] = { 0 };
+        struct acpi_buffer bus = { ACPI_PATHNAME_MAX, bus_name };
+        struct acpi_buffer act = { ACPI_PATHNAME_MAX, action_name };
+
+        ACPI_FUNCTION_TRACE(("hotkey_config_seq_show"));
+
+        list_for_each(entries, hotkey_list->entries) {
+                union acpi_hotkey *key =
+                    container_of(entries, union acpi_hotkey, entries);
+                if (key->link.hotkey_type == ACPI_HOTKEY_POLLING) {
                         acpi_get_name(key->poll_hotkey.poll_handle,
                                       ACPI_NAME_TYPE_MAX, &bus);
                         acpi_get_name(key->poll_hotkey.action_handle,
                                       ACPI_NAME_TYPE_MAX, &act);
-                        seq_printf(seq, "%s:%s:%s:%s:%d", bus_name,
+                        seq_printf(seq, "%s:%s:%s:%s:%d\n", bus_name,
                                    key->poll_hotkey.poll_method,
                                    action_name,
                                    key->poll_hotkey.action_method,
@@ -572,49 +663,83 @@ static int hotkey_config_seq_show(struct seq_file *seq, void *offset)
                 }
         }
         seq_puts(seq, "\n");
-      end:
         return_VALUE(0);
 }
 
 static int
 get_parms(char *config_record,
           int *cmd,
-          char *bus_handle,
-          char *bus_method,
-          char *action_handle,
-          char *method, int *internal_event_num, int *external_event_num)
+          char **bus_handle,
+          char **bus_method,
+          char **action_handle,
+          char **method, int *internal_event_num, int *external_event_num)
 {
-        char *tmp, *tmp1;
+        char *tmp, *tmp1, count;
         ACPI_FUNCTION_TRACE(("get_parms"));
 
         sscanf(config_record, "%d", cmd);
 
+        if(*cmd == 1){
+                if(sscanf(config_record, "%d:%d", cmd, internal_event_num)!=2)
+                        goto do_fail;
+                else
+                        return (6);
+        }
         tmp = strchr(config_record, ':');
+        if (!tmp)
+                goto do_fail;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(bus_handle, tmp, tmp1 - tmp);
-        bus_handle[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+
+        count = tmp1 - tmp;
+        *bus_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*bus_handle)
+                goto do_fail;
+        strncpy(*bus_handle, tmp, count);
+        *(*bus_handle + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(bus_method, tmp, tmp1 - tmp);
-        bus_method[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *bus_method = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*bus_method)
+                goto do_fail;
+        strncpy(*bus_method, tmp, count);
+        *(*bus_method + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(action_handle, tmp, tmp1 - tmp);
-        action_handle[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *action_handle = (char *) kmalloc(count+1, GFP_KERNEL);
+        strncpy(*action_handle, tmp, count);
+        *(*action_handle + count) = 0;
 
         tmp = tmp1;
         tmp++;
         tmp1 = strchr(tmp, ':');
-        strncpy(method, tmp, tmp1 - tmp);
-        method[tmp1 - tmp] = 0;
+        if (!tmp1)
+                goto do_fail;
+        count = tmp1 - tmp;
+        *method = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!*method)
+                goto do_fail;
+        strncpy(*method, tmp, count);
+        *(*method + count) = 0;
+
+        if(sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num)<=0)
+                goto do_fail;
 
-        sscanf(tmp1 + 1, "%d:%d", internal_event_num, external_event_num);
         return_VALUE(6);
+do_fail:
+        return_VALUE(-1);
 }
 
 /*  count is length for one input record */
@@ -622,135 +747,117 @@ static ssize_t hotkey_write_config(struct file *file,
                                    const char __user * buffer,
                                    size_t count, loff_t * data)
 {
-        struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        char config_record[MAX_CONFIG_RECORD_LEN];
-        char bus_handle[MAX_NAME_PATH_LEN];
-        char bus_method[MAX_NAME_PATH_LEN];
-        char action_handle[MAX_NAME_PATH_LEN];
-        char method[20];
+        char *config_record = NULL;
+        char *bus_handle = NULL;
+        char *bus_method = NULL;
+        char *action_handle = NULL;
+        char *method = NULL;
         int cmd, internal_event_num, external_event_num;
         int ret = 0;
         union acpi_hotkey *key = NULL;
 
         ACPI_FUNCTION_TRACE(("hotkey_write_config"));
 
-        if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-                return_VALUE(-EINVAL);
-        }
+        config_record = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!config_record)
+                return_VALUE(-ENOMEM);
 
         if (copy_from_user(config_record, buffer, count)) {
+                kfree(config_record);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
                 return_VALUE(-EINVAL);
         }
-        config_record[count] = '\0';
+        config_record[count] = 0;
 
         ret = get_parms(config_record,
                         &cmd,
-                        bus_handle,
-                        bus_method,
-                        action_handle,
-                        method, &internal_event_num, &external_event_num);
+                        &bus_handle,
+                        &bus_method,
+                        &action_handle,
+                        &method, &internal_event_num, &external_event_num);
+
+        kfree(config_record);
+        if(IS_OTHERS(internal_event_num))
+                goto do_fail;
         if (ret != 6) {
+do_fail:        
+                kfree(bus_handle);
+                kfree(bus_method);
+                kfree(action_handle);
+                kfree(method);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Invalid data format ret=%d\n", ret));
                 return_VALUE(-EINVAL);
         }
 
         key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-        ret = init_hotkey_device(key, bus_handle, action_handle, method,
+        if(!key)
+                goto do_fail;
+        memset(key, 0, sizeof(union acpi_hotkey));
+        if(cmd == 1) {
+                union acpi_hotkey *tmp = NULL;
+                tmp = get_hotkey_by_event(&global_hotkey_list,
+                                internal_event_num);
+                if(!tmp)
+                        ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid key"));
+                else
+                        memcpy(key, tmp, sizeof(union acpi_hotkey));
+                goto cont_cmd;
+        }
+        if (IS_EVENT(internal_event_num)) {
+                kfree(bus_method);
+                ret = init_hotkey_device(key, bus_handle, action_handle, method,
                                  internal_event_num, external_event_num);
-
-        if (ret || check_hotkey_valid(key, hotkey_list)) {
+        } else
+                ret = init_poll_hotkey_device(key, bus_handle, bus_method,
+                                      action_handle, method,
+                                      internal_event_num);
+        if (ret) {
+                kfree(bus_handle);
+                kfree(action_handle);
+                if(IS_EVENT(internal_event_num))
+                        free_hotkey_buffer(key);
+                else
+                        free_poll_hotkey_buffer(key);
                 kfree(key);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
                 return_VALUE(-EINVAL);
         }
-        switch (cmd) {
-        case 0:
-                hotkey_add(key);
-                break;
-        case 1:
-                hotkey_remove(key);
-                free_hotkey_device(key);
-                break;
-        case 2:
-                hotkey_update(key);
-                break;
-        default:
-                break;
-        }
-        return_VALUE(count);
-}
-
-/*  count is length for one input record */
-static ssize_t hotkey_write_poll_config(struct file *file,
-                                        const char __user * buffer,
-                                        size_t count, loff_t * data)
-{
-        struct seq_file *m = (struct seq_file *)file->private_data;
-        struct acpi_hotkey_list *hotkey_list =
-            (struct acpi_hotkey_list *)m->private;
-
-        char config_record[MAX_CONFIG_RECORD_LEN];
-        char polling_handle[MAX_NAME_PATH_LEN];
-        char action_handle[MAX_NAME_PATH_LEN];
-        char poll_method[20], action_method[20];
-        int ret, internal_event_num, cmd, external_event_num;
-        union acpi_hotkey *key = NULL;
-
-        ACPI_FUNCTION_TRACE("hotkey_write_poll_config");
-
-        if (!hotkey_list || count > MAX_CONFIG_RECORD_LEN) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid arguments\n"));
-                return_VALUE(-EINVAL);
-        }
-
-        if (copy_from_user(config_record, buffer, count)) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data \n"));
-                return_VALUE(-EINVAL);
-        }
-        config_record[count] = '\0';
 
-        ret = get_parms(config_record,
-                        &cmd,
-                        polling_handle,
-                        poll_method,
-                        action_handle,
-                        action_method,
-                        &internal_event_num, &external_event_num);
-
-        if (ret != 6) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid data format\n"));
-                return_VALUE(-EINVAL);
-        }
+cont_cmd:
+        kfree(bus_handle);
+        kfree(action_handle);
 
-        key = kmalloc(sizeof(union acpi_hotkey), GFP_KERNEL);
-        ret = init_poll_hotkey_device(key, polling_handle, poll_method,
-                                      action_handle, action_method,
-                                      internal_event_num);
-        if (ret || check_hotkey_valid(key, hotkey_list)) {
-                kfree(key);
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid hotkey \n"));
-                return_VALUE(-EINVAL);
-        }
         switch (cmd) {
         case 0:
-                hotkey_add(key);
+                if(get_hotkey_by_event(&global_hotkey_list,key->link.hotkey_standard_num))
+                        goto fail_out;
+                else
+                        hotkey_add(key);
                 break;
         case 1:
                 hotkey_remove(key);
                 break;
         case 2:
-                hotkey_update(key);
+                if(hotkey_update(key))
+                        goto fail_out;
                 break;
         default:
+                goto fail_out;
                 break;
         }
         return_VALUE(count);
+fail_out:
+        if(IS_EVENT(internal_event_num))
+                free_hotkey_buffer(key);
+        else
+                free_poll_hotkey_buffer(key);
+        kfree(key);
+        ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "invalid key\n"));
+        return_VALUE(-EINVAL);
 }
 
-/*  
+/*
  * This function evaluates an ACPI method, given an int as parameter, the
  * method is searched within the scope of the handle, can be NULL. The output
  * of the method is written is output, which can also be NULL
@@ -775,7 +882,7 @@ static int write_acpi_int(acpi_handle handle, const char *method, int val,
         return_VALUE(status == AE_OK);
 }
 
-static int read_acpi_int(acpi_handle handle, const char *method, int *val)
+static int read_acpi_int(acpi_handle handle, const char *method, union acpi_object *val)
 {
         struct acpi_buffer output;
         union acpi_object out_obj;
@@ -786,62 +893,32 @@ static int read_acpi_int(acpi_handle handle, const char *method, int *val)
         output.pointer = &out_obj;
 
         status = acpi_evaluate_object(handle, (char *)method, NULL, &output);
-        *val = out_obj.integer.value;
+        if(val){
+                val->integer.value = out_obj.integer.value;
+                val->type = out_obj.type;
+        } else
+                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "null val pointer"));
         return_VALUE((status == AE_OK)
                      && (out_obj.type == ACPI_TYPE_INTEGER));
 }
 
-static acpi_handle
-get_handle_from_hotkeylist(struct acpi_hotkey_list *hotkey_list, int event_num)
+static union acpi_hotkey *get_hotkey_by_event(struct
+                              acpi_hotkey_list
+                              *hotkey_list, int event)
 {
-        struct list_head *entries, *next;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
-                union acpi_hotkey *key =
-                    container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_type == ACPI_HOTKEY_EVENT
-                    && key->link.hotkey_standard_num == event_num) {
-                        return (key->event_hotkey.action_handle);
-                }
-        }
-        return (NULL);
-}
-
-static
-char *get_method_from_hotkeylist(struct acpi_hotkey_list *hotkey_list,
-                                 int event_num)
-{
-        struct list_head *entries, *next;
-
-        list_for_each_safe(entries, next, hotkey_list->entries) {
-                union acpi_hotkey *key =
-                    container_of(entries, union acpi_hotkey, entries);
-
-                if (key->link.hotkey_type == ACPI_HOTKEY_EVENT &&
-                    key->link.hotkey_standard_num == event_num)
-                        return (key->event_hotkey.action_method);
-        }
-        return (NULL);
-}
-
-static struct acpi_polling_hotkey *get_hotkey_by_event(struct
-                                                       acpi_hotkey_list
-                                                       *hotkey_list, int event)
-{
-        struct list_head *entries, *next;
+        struct list_head *entries;
 
-        list_for_each_safe(entries, next, hotkey_list->entries) {
+        list_for_each(entries, hotkey_list->entries) {
                 union acpi_hotkey *key =
                     container_of(entries, union acpi_hotkey, entries);
-                if (key->link.hotkey_type == ACPI_HOTKEY_POLLING
-                    && key->link.hotkey_standard_num == event) {
-                        return (&key->poll_hotkey);
+                if (key->link.hotkey_standard_num == event) {
+                        return(key);
                 }
         }
-        return (NULL);
+        return(NULL);
 }
 
-/*  
+/*
  * user call AML method interface:
  * Call convention:
  * echo "event_num: arg type : value"
@@ -854,48 +931,56 @@ static ssize_t hotkey_execute_aml_method(struct file *file,
                                          size_t count, loff_t * data)
 {
         struct acpi_hotkey_list *hotkey_list = &global_hotkey_list;
-        char arg[MAX_CALL_PARM];
-        int event, type, value;
-
-        char *method;
-        acpi_handle handle;
+        char *arg;
+        int event,method_type,type, value;
+        union acpi_hotkey *key;
 
         ACPI_FUNCTION_TRACE("hotkey_execte_aml_method");
 
-        if (!hotkey_list || count > MAX_CALL_PARM) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 1"));
-                return_VALUE(-EINVAL);
-        }
+        arg = (char *) kmalloc(count+1, GFP_KERNEL);
+        if(!arg)
+                return_VALUE(-ENOMEM);
+        arg[count]=0;
 
         if (copy_from_user(arg, buffer, count)) {
+                kfree(arg);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 2"));
                 return_VALUE(-EINVAL);
         }
 
-        arg[count] = '\0';
-
-        if (sscanf(arg, "%d:%d:%d", &event, &type, &value) != 3) {
+        if (sscanf(arg, "%d:%d:%d:%d", &event, &method_type, &type, &value) != 4) {
+                kfree(arg);
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Invalid argument 3"));
                 return_VALUE(-EINVAL);
         }
-
+        kfree(arg);
         if (type == ACPI_TYPE_INTEGER) {
-                handle = get_handle_from_hotkeylist(hotkey_list, event);
-                method = (char *)get_method_from_hotkeylist(hotkey_list, event);
+                key = get_hotkey_by_event(hotkey_list, event);
+                if(!key)
+                        goto do_fail;
                 if (IS_EVENT(event))
-                        write_acpi_int(handle, method, value, NULL);
+                        write_acpi_int(key->event_hotkey.action_handle,
+                                        key->event_hotkey.action_method, value, NULL);
                 else if (IS_POLL(event)) {
-                        struct acpi_polling_hotkey *key;
-                        key = (struct acpi_polling_hotkey *)
-                            get_hotkey_by_event(hotkey_list, event);
-                        read_acpi_int(handle, method, key->poll_result);
+                        if ( method_type == POLL_METHOD )
+                                read_acpi_int(key->poll_hotkey.poll_handle,
+                                        key->poll_hotkey.poll_method,
+                                        key->poll_hotkey.poll_result);
+                        else if ( method_type == ACTION_METHOD )
+                                write_acpi_int(key->poll_hotkey.action_handle,
+                                        key->poll_hotkey.action_method, value, NULL);
+                        else
+                                goto do_fail;
+
                 }
         } else {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR, "Not supported"));
                 return_VALUE(-EINVAL);
         }
-
         return_VALUE(count);
+do_fail:
+        return_VALUE(-EINVAL);
+
 }
 
 static int __init hotkey_init(void)
@@ -928,7 +1013,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_EV_CONFIG));
-                return (-ENODEV);
+                goto do_fail1;
         } else {
                 hotkey_config->proc_fops = &hotkey_config_fops;
                 hotkey_config->data = &global_hotkey_list;
@@ -943,7 +1028,8 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_EV_CONFIG));
-                return (-ENODEV);
+
+                goto do_fail2;
         } else {
                 hotkey_poll_config->proc_fops = &hotkey_poll_config_fops;
                 hotkey_poll_config->data = &global_hotkey_list;
@@ -957,7 +1043,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_ACTION));
-                return (-ENODEV);
+                goto do_fail3;
         } else {
                 hotkey_action->proc_fops = &hotkey_action_fops;
                 hotkey_action->owner = THIS_MODULE;
@@ -970,7 +1056,7 @@ static int __init hotkey_init(void)
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "Hotkey: Unable to create %s entry\n",
                                   HOTKEY_INFO));
-                return (-ENODEV);
+                goto do_fail4;
         } else {
                 hotkey_info->proc_fops = &hotkey_info_fops;
                 hotkey_info->owner = THIS_MODULE;
@@ -979,23 +1065,33 @@ static int __init hotkey_init(void)
         }
 
         result = acpi_bus_register_driver(&hotkey_driver);
-        if (result < 0) {
-                remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
-                return (-ENODEV);
-        }
+        if (result < 0)
+                goto do_fail5;
         global_hotkey_list.count = 0;
         global_hotkey_list.entries = &hotkey_entries;
 
         INIT_LIST_HEAD(&hotkey_entries);
 
         return (0);
+
+do_fail5:
+        remove_proc_entry(HOTKEY_INFO, hotkey_proc_dir);
+do_fail4:
+        remove_proc_entry(HOTKEY_ACTION, hotkey_proc_dir);
+do_fail3:
+        remove_proc_entry(HOTKEY_PL_CONFIG, hotkey_proc_dir);
+do_fail2:
+        remove_proc_entry(HOTKEY_EV_CONFIG, hotkey_proc_dir);
+do_fail1:
+        remove_proc_entry(HOTKEY_PROC, acpi_root_dir);
+        return (-ENODEV);
 }
 
 static void __exit hotkey_exit(void)
 {
         struct list_head *entries, *next;
 
-        ACPI_FUNCTION_TRACE("hotkey_remove");
+        ACPI_FUNCTION_TRACE("hotkey_exit");
 
         list_for_each_safe(entries, next, global_hotkey_list.entries) {
                 union acpi_hotkey *key =
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index 61ea70742d49..2934475d67d6 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -43,7 +43,7 @@ ACPI_MODULE_NAME		("acpi_motherboard")
  */
 #define IS_RESERVED_ADDR(base, len) \
         (((len) > 0) && ((base) > 0) && ((base) + (len) < IO_SPACE_LIMIT) \
-        && ((base) + (len) > PCIBIOS_MIN_IO))
+        && ((base) + (len) > 0x1000))
 
 /*
  * Clearing the flag (IORESOURCE_BUSY) allows drivers to use
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index bdd9f37f8101..7289da3c4db6 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -145,10 +145,14 @@ acpi_os_vprintf(const char *fmt, va_list args)
 #endif
 }
 
+extern int acpi_in_resume;
 void *
 acpi_os_allocate(acpi_size size)
 {
-        return kmalloc(size, GFP_KERNEL);
+        if (acpi_in_resume)
+                return kmalloc(size, GFP_ATOMIC);
+        else
+                return kmalloc(size, GFP_KERNEL);
 }
 
 void
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index d9a9b86ecb28..834c2ceff1aa 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -692,7 +692,18 @@ acpi_pci_link_free_irq(acpi_handle handle)
                 return_VALUE(-1);
         }
 
+#ifdef  FUTURE_USE
+        /*
+         * The Link reference count allows us to _DISable an unused link
+         * and suspend time, and set it again  on resume.
+         * However, 2.6.12 still has irq_router.resume
+         * which blindly restores the link state.
+         * So we disable the reference count method
+         * to prevent duplicate acpi_pci_link_set()
+         * which would harm some systems
+         */
         link->refcnt --;
+#endif
         ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                 "Link %s is dereferenced\n", acpi_device_bid(link->device)));
 
@@ -787,6 +798,11 @@ acpi_pci_link_resume(
                 return_VALUE(0);
 }
 
+/*
+ * FIXME: this is a workaround to avoid nasty warning.  It will be removed
+ * after every device calls pci_disable_device in .resume.
+ */
+int acpi_in_resume;
 static int
 irqrouter_resume(
         struct sys_device *dev)
@@ -796,6 +812,7 @@ irqrouter_resume(
 
         ACPI_FUNCTION_TRACE("irqrouter_resume");
 
+        acpi_in_resume = 1;
         list_for_each(node, &acpi_link.entries) {
                 link = list_entry(node, struct acpi_pci_link, node);
                 if (!link) {
@@ -805,6 +822,7 @@ irqrouter_resume(
                 }
                 acpi_pci_link_resume(link);
         }
+        acpi_in_resume = 0;
         return_VALUE(0);
 }
 
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index af271d994f15..2c04740c6543 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -86,12 +86,11 @@ static int set_max_cstate(struct dmi_system_id *id)
         if (max_cstate > ACPI_PROCESSOR_MAX_POWER)
                 return 0;
 
-        printk(KERN_NOTICE PREFIX "%s detected - %s disabled."
+        printk(KERN_NOTICE PREFIX "%s detected - limiting to C%ld max_cstate."
                 " Override with \"processor.max_cstate=%d\"\n", id->ident,
-                ((int)id->driver_data == 1)? "C2,C3":"C3",
-               ACPI_PROCESSOR_MAX_POWER + 1);
+                (long)id->driver_data, ACPI_PROCESSOR_MAX_POWER + 1);
 
-        max_cstate = (int)id->driver_data;
+        max_cstate = (long)id->driver_data;
 
         return 0;
 }
diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 692a5fced76e..3c818544475e 100644
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -719,7 +719,7 @@ struct request *blk_queue_find_tag(request_queue_t *q, int tag)
 {
         struct blk_queue_tag *bqt = q->queue_tags;
 
-        if (unlikely(bqt == NULL || tag >= bqt->max_depth))
+        if (unlikely(bqt == NULL || tag >= bqt->real_max_depth))
                 return NULL;
 
         return bqt->tag_index[tag];
@@ -798,6 +798,7 @@ init_tag_map(request_queue_t *q, struct blk_queue_tag *tags, int depth)
 
         memset(tag_index, 0, depth * sizeof(struct request *));
         memset(tag_map, 0, nr_ulongs * sizeof(unsigned long));
+        tags->real_max_depth = depth;
         tags->max_depth = depth;
         tags->tag_index = tag_index;
         tags->tag_map = tag_map;
@@ -872,11 +873,22 @@ int blk_queue_resize_tags(request_queue_t *q, int new_depth)
                 return -ENXIO;
 
         /*
+         * if we already have large enough real_max_depth.  just
+         * adjust max_depth.  *NOTE* as requests with tag value
+         * between new_depth and real_max_depth can be in-flight, tag
+         * map can not be shrunk blindly here.
+         */
+        if (new_depth <= bqt->real_max_depth) {
+                bqt->max_depth = new_depth;
+                return 0;
+        }
+
+        /*
          * save the old state info, so we can copy it back
          */
         tag_index = bqt->tag_index;
         tag_map = bqt->tag_map;
-        max_depth = bqt->max_depth;
+        max_depth = bqt->real_max_depth;
 
         if (init_tag_map(q, bqt, new_depth))
                 return -ENOMEM;
@@ -913,7 +925,7 @@ void blk_queue_end_tag(request_queue_t *q, struct request *rq)
 
         BUG_ON(tag == -1);
 
-        if (unlikely(tag >= bqt->max_depth))
+        if (unlikely(tag >= bqt->real_max_depth))
                 /*
                  * This can happen after tag depth has been reduced.
                  * FIXME: how about a warning or info message here?
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 2771c861f185..f696da6f417b 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -367,11 +367,8 @@ static inline void bpa10x_free_urb(struct urb *urb)
         if (!urb)
                 return;
 
-        if (urb->setup_packet)
-                kfree(urb->setup_packet);
-
-        if (urb->transfer_buffer)
-                kfree(urb->transfer_buffer);
+        kfree(urb->setup_packet);
+        kfree(urb->transfer_buffer);
 
         usb_free_urb(urb);
 }
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index c0ed213fc857..858fddb046de 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -58,8 +58,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 static int hciextn = 1;
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index ade94a57bb11..533323b60e63 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 /* Initialize protocol */
@@ -125,7 +123,6 @@ static inline int h4_check_data_len(struct h4_struct *h4, int len)
 
         BT_DBG("len %d room %d", len, room);
         if (!len) {
-                BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
                 hci_recv_frame(h4->rx_skb);
         } else if (len > room) {
                 BT_ERR("Data length is too large");
@@ -169,8 +166,6 @@ static int h4_recv(struct hci_uart *hu, void *data, int count)
                         case H4_W4_DATA:
                                 BT_DBG("Complete data");
 
-                                BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
-
                                 hci_recv_frame(h4->rx_skb);
 
                                 h4->rx_state = H4_W4_PACKET_TYPE;
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index f766bc22c6bb..90be2eae52e0 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUART_DEBUG
 #undef  BT_DBG
 #define BT_DBG( A... )
-#undef  BT_DMP
-#define BT_DMP( A... )
 #endif
 
 static int reset = 0;
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index b120ecf7b8c9..657719b8254f 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -57,8 +57,6 @@
 #ifndef CONFIG_BT_HCIUSB_DEBUG
 #undef  BT_DBG
 #define BT_DBG(D...)
-#undef  BT_DMP
-#define BT_DMP(D...)
 #endif
 
 #ifndef CONFIG_BT_HCIUSB_ZERO_PACKET
@@ -110,6 +108,9 @@ static struct usb_device_id blacklist_ids[] = {
         /* Microsoft Wireless Transceiver for Bluetooth 2.0 */
         { USB_DEVICE(0x045e, 0x009c), .driver_info = HCI_RESET },
 
+        /* Kensington Bluetooth USB adapter */
+        { USB_DEVICE(0x047d, 0x105d), .driver_info = HCI_RESET },
+
         /* ISSC Bluetooth Adapter v3.1 */
         { USB_DEVICE(0x1131, 0x1001), .driver_info = HCI_RESET },
 
@@ -387,10 +388,8 @@ static void hci_usb_unlink_urbs(struct hci_usb *husb)
                         urb = &_urb->urb;
                         BT_DBG("%s freeing _urb %p type %d urb %p",
                                         husb->hdev->name, _urb, _urb->type, urb);
-                        if (urb->setup_packet)
-                                kfree(urb->setup_packet);
-                        if (urb->transfer_buffer)
-                                kfree(urb->transfer_buffer);
+                        kfree(urb->setup_packet);
+                        kfree(urb->transfer_buffer);
                         _urb_free(_urb);
                 }
 
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index d8f9e94ae475..cd4fe8b1709f 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -1209,6 +1209,7 @@ static int rtc_proc_open(struct inode *inode, struct file *file)
 
 void rtc_get_rtc_time(struct rtc_time *rtc_tm)
 {
+        unsigned long uip_watchdog = jiffies;
         unsigned char ctrl;
 #ifdef CONFIG_MACH_DECSTATION
         unsigned int real_year;
@@ -1224,8 +1225,10 @@ void rtc_get_rtc_time(struct rtc_time *rtc_tm)
          * Once the read clears, read the RTC time (again via ioctl). Easy.
          */
 
-        if (rtc_is_updating() != 0)
-                msleep(20);
+        while (rtc_is_updating() != 0 && jiffies - uip_watchdog < 2*HZ/100) {
+                barrier();
+                cpu_relax();
+        }
 
         /*
          * Only the values that we read from the RTC are set. We leave
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 94a3b3e20bf9..79e9832ef1f3 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -17,6 +17,8 @@ config TCG_TPM
           obtained at: <http://sourceforge.net/projects/trousers>.  To 
           compile this driver as a module, choose M here; the module 
           will be called tpm. If unsure, say N.
+          Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI_BUS
+          and CONFIG_PNPACPI.
 
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
@@ -36,12 +38,13 @@ config TCG_ATMEL
           as a module, choose M here; the module will be called tpm_atmel.
 
 config TCG_INFINEON
-        tristate "Infineon Technologies SLD 9630 TPM Interface"
-        depends on TCG_TPM
+        tristate "Infineon Technologies TPM Interface"
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from Infineon Technologies
-          say Yes and it will be accessible from within Linux.  To
-          compile this driver as a module, choose M here; the module
+          (either SLD 9630 TT 1.1 or SLB 9635 TT 1.2) say Yes and it
+          will be accessible from within Linux.
+          To compile this driver as a module, choose M here; the module
           will be called tpm_infineon.
           Further information on this driver and the supported hardware
           can be found at http://www.prosec.rub.de/tpm
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 0e3241645c19..dc8c540391fd 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -1,7 +1,7 @@
 /*
  * Description:
  * Device Driver for the Infineon Technologies
- * SLD 9630 TT Trusted Platform Module
+ * SLD 9630 TT 1.1 and SLB 9635 TT 1.2 Trusted Platform Module
  * Specifications at www.trustedcomputinggroup.org
  *
  * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de>
@@ -12,9 +12,10 @@
  * modify it under the terms of the GNU General Public License as
  * published by the Free Software Foundation, version 2 of the
  * License.
- *
  */
 
+#include <acpi/acpi_bus.h>
+#include <linux/pnp.h>
 #include "tpm.h"
 
 /* Infineon specific definitions */
@@ -26,8 +27,11 @@
 #define TPM_MSLEEP_TIME         3
 /* gives number of max. msleep()-calls before throwing timeout */
 #define TPM_MAX_TRIES           5000
-#define TCPA_INFINEON_DEV_VEN_VALUE     0x15D1
-#define TPM_DATA                        (TPM_ADDR + 1) & 0xff
+#define TPM_INFINEON_DEV_VEN_VALUE      0x15D1
+
+/* These values will be filled after ACPI-call */
+static int TPM_INF_DATA = 0;
+static int TPM_INF_ADDR = 0;
 
 /* TPM header definitions */
 enum infineon_tpm_header {
@@ -305,9 +309,10 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
 
 static void tpm_inf_cancel(struct tpm_chip *chip)
 {
-        /* Nothing yet!
-           This has something to do with the internal functions
-           of the TPM. Abort isn't really necessary...
+        /*
+           Since we are using the legacy mode to communicate
+           with the TPM, we have no cancel functions, but have
+           a workaround for interrupting the TPM through WTX.
          */
 }
 
@@ -345,6 +350,32 @@ static struct tpm_vendor_specific tpm_inf = {
         .miscdev = {.fops = &inf_ops,},
 };
 
+static const struct pnp_device_id tpm_pnp_tbl[] = {
+        /* Infineon TPMs */
+        {"IFX0101", 0},
+        {"IFX0102", 0},
+        {"", 0}
+};
+
+static int __devinit tpm_inf_acpi_probe(struct pnp_dev *dev,
+                                        const struct pnp_device_id *dev_id)
+{
+        TPM_INF_ADDR = (pnp_port_start(dev, 0) & 0xff);
+        TPM_INF_DATA = ((TPM_INF_ADDR + 1) & 0xff);
+        tpm_inf.base = pnp_port_start(dev, 1);
+        dev_info(&dev->dev, "Found %s with ID %s\n",
+                 dev->name, dev_id->id);
+        if (!((tpm_inf.base >> 8) & 0xff))
+                tpm_inf.base = 0;
+        return 0;
+}
+
+static struct pnp_driver tpm_inf_pnp = {
+        .name = "tpm_inf_pnp",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_inf_acpi_probe,
+};
+
 static int __devinit tpm_inf_probe(struct pci_dev *pci_dev,
                                    const struct pci_device_id *pci_id)
 {
@@ -353,64 +384,99 @@ static int __devinit tpm_inf_probe(struct pci_dev *pci_dev,
         int vendorid[2];
         int version[2];
         int productid[2];
+        char chipname[20];
 
         if (pci_enable_device(pci_dev))
                 return -EIO;
 
         dev_info(&pci_dev->dev, "LPC-bus found at 0x%x\n", pci_id->device);
 
+        /* read IO-ports from ACPI */
+        pnp_register_driver(&tpm_inf_pnp);
+        pnp_unregister_driver(&tpm_inf_pnp);
+
+        /* Make sure, we have received valid config ports */
+        if (!TPM_INF_ADDR) {
+                pci_disable_device(pci_dev);
+                return -EIO;
+        }
+
         /* query chip for its vendor, its version number a.s.o. */
-        outb(ENABLE_REGISTER_PAIR, TPM_ADDR);
-        outb(IDVENL, TPM_ADDR);
-        vendorid[1] = inb(TPM_DATA);
-        outb(IDVENH, TPM_ADDR);
-        vendorid[0] = inb(TPM_DATA);
-        outb(IDPDL, TPM_ADDR);
-        productid[1] = inb(TPM_DATA);
-        outb(IDPDH, TPM_ADDR);
-        productid[0] = inb(TPM_DATA);
-        outb(CHIP_ID1, TPM_ADDR);
-        version[1] = inb(TPM_DATA);
-        outb(CHIP_ID2, TPM_ADDR);
-        version[0] = inb(TPM_DATA);
-
-        if ((vendorid[0] << 8 | vendorid[1]) == (TCPA_INFINEON_DEV_VEN_VALUE)) {
-
-                /* read IO-ports from TPM */
-                outb(IOLIMH, TPM_ADDR);
-                ioh = inb(TPM_DATA);
-                outb(IOLIML, TPM_ADDR);
-                iol = inb(TPM_DATA);
-                tpm_inf.base = (ioh << 8) | iol;
+        outb(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        outb(IDVENL, TPM_INF_ADDR);
+        vendorid[1] = inb(TPM_INF_DATA);
+        outb(IDVENH, TPM_INF_ADDR);
+        vendorid[0] = inb(TPM_INF_DATA);
+        outb(IDPDL, TPM_INF_ADDR);
+        productid[1] = inb(TPM_INF_DATA);
+        outb(IDPDH, TPM_INF_ADDR);
+        productid[0] = inb(TPM_INF_DATA);
+        outb(CHIP_ID1, TPM_INF_ADDR);
+        version[1] = inb(TPM_INF_DATA);
+        outb(CHIP_ID2, TPM_INF_ADDR);
+        version[0] = inb(TPM_INF_DATA);
+
+        switch ((productid[0] << 8) | productid[1]) {
+        case 6:
+                sprintf(chipname, " (SLD 9630 TT 1.1)");
+                break;
+        case 11:
+                sprintf(chipname, " (SLB 9635 TT 1.2)");
+                break;
+        default:
+                sprintf(chipname, " (unknown chip)");
+                break;
+        }
+        chipname[19] = 0;
+
+        if ((vendorid[0] << 8 | vendorid[1]) == (TPM_INFINEON_DEV_VEN_VALUE)) {
 
                 if (tpm_inf.base == 0) {
-                        dev_err(&pci_dev->dev, "No IO-ports set!\n");
+                        dev_err(&pci_dev->dev, "No IO-ports found!\n");
                         pci_disable_device(pci_dev);
-                        return -ENODEV;
+                        return -EIO;
+                }
+                /* configure TPM with IO-ports */
+                outb(IOLIMH, TPM_INF_ADDR);
+                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(IOLIML, TPM_INF_ADDR);
+                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+
+                /* control if IO-ports are set correctly */
+                outb(IOLIMH, TPM_INF_ADDR);
+                ioh = inb(TPM_INF_DATA);
+                outb(IOLIML, TPM_INF_ADDR);
+                iol = inb(TPM_INF_DATA);
+
+                if ((ioh << 8 | iol) != tpm_inf.base) {
+                        dev_err(&pci_dev->dev,
+                                "Could not set IO-ports to %04x\n",
+                                tpm_inf.base);
+                        pci_disable_device(pci_dev);
+                        return -EIO;
                 }
 
                 /* activate register */
-                outb(TPM_DAR, TPM_ADDR);
-                outb(0x01, TPM_DATA);
-                outb(DISABLE_REGISTER_PAIR, TPM_ADDR);
+                outb(TPM_DAR, TPM_INF_ADDR);
+                outb(0x01, TPM_INF_DATA);
+                outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
                 outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&pci_dev->dev, "TPM found: "
+                         "config base 0x%x, "
                          "io base 0x%x, "
                          "chip version %02x%02x, "
                          "vendor id %x%x (Infineon), "
                          "product id %02x%02x"
                          "%s\n",
+                         TPM_INF_ADDR,
                          tpm_inf.base,
                          version[0], version[1],
                          vendorid[0], vendorid[1],
-                         productid[0], productid[1], ((productid[0] == 0)
-                                                      && (productid[1] ==
-                                                          6)) ?
-                         " (SLD 9630 TT 1.1)" : "");
+                         productid[0], productid[1], chipname);
 
                 rc = tpm_register_hardware(pci_dev, &tpm_inf);
                 if (rc < 0) {
@@ -462,6 +528,6 @@ module_init(init_inf);
 module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
-MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT");
-MODULE_VERSION("1.4");
+MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
+MODULE_VERSION("1.5");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index f975dab1ddf9..a13395e2c372 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -1,5 +1,5 @@
 /*
- *      i8xx_tco 0.07:  TCO timer driver for i8xx chipsets
+ *      i8xx_tco:       TCO timer driver for i8xx chipsets
  *
  *      (c) Copyright 2000 kernel concepts <nils@kernelconcepts.de>, All Rights Reserved.
  *                              http://www.kernelconcepts.de
@@ -63,6 +63,9 @@
  *  20050128 Wim Van Sebroeck <wim@iguana.be>
  *      0.07 Added support for the ICH4-M, ICH6, ICH6R, ICH6-M, ICH6W and ICH6RW
  *           chipsets. Also added support for the "undocumented" ICH7 chipset.
+ *  20050807 Wim Van Sebroeck <wim@iguana.be>
+ *      0.08 Make sure that the watchdog is only "armed" when started.
+ *           (Kernel Bug 4251)
  */
 
 /*
@@ -87,7 +90,7 @@
 #include "i8xx_tco.h"
 
 /* Module and version information */
-#define TCO_VERSION "0.07"
+#define TCO_VERSION "0.08"
 #define TCO_MODULE_NAME "i8xx TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 #define PFX TCO_MODULE_NAME ": "
@@ -125,10 +128,18 @@ static int tco_timer_start (void)
         unsigned char val;
 
         spin_lock(&tco_lock);
+
+        /* disable chipset's NO_REBOOT bit */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
+        val &= 0xfd;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
+
+        /* Bit 11: TCO Timer Halt -> 0 = The TCO timer is enabled to count */
         val = inb (TCO1_CNT + 1);
         val &= 0xf7;
         outb (val, TCO1_CNT + 1);
         val = inb (TCO1_CNT + 1);
+
         spin_unlock(&tco_lock);
 
         if (val & 0x08)
@@ -138,13 +149,20 @@ static int tco_timer_start (void)
 
 static int tco_timer_stop (void)
 {
-        unsigned char val;
+        unsigned char val, val1;
 
         spin_lock(&tco_lock);
+        /* Bit 11: TCO Timer Halt -> 1 = The TCO timer is disabled */
         val = inb (TCO1_CNT + 1);
         val |= 0x08;
         outb (val, TCO1_CNT + 1);
         val = inb (TCO1_CNT + 1);
+
+        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
+        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
+        val1 |= 0x02;
+        pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
+
         spin_unlock(&tco_lock);
 
         if ((val & 0x08) == 0)
@@ -155,6 +173,7 @@ static int tco_timer_stop (void)
 static int tco_timer_keepalive (void)
 {
         spin_lock(&tco_lock);
+        /* Reload the timer by writing to the TCO Timer Reload register */
         outb (0x01, TCO1_RLD);
         spin_unlock(&tco_lock);
         return 0;
@@ -417,9 +436,8 @@ static unsigned char __init i8xx_tco_getdevice (void)
                         printk (KERN_ERR PFX "failed to get TCOBASE address\n");
                         return 0;
                 }
-                /*
-                 * Check chipset's NO_REBOOT bit
-                 */
+
+                /* Check chipset's NO_REBOOT bit */
                 pci_read_config_byte (i8xx_tco_pci, 0xd4, &val1);
                 if (val1 & 0x02) {
                         val1 &= 0xfd;
@@ -430,6 +448,10 @@ static unsigned char __init i8xx_tco_getdevice (void)
                                 return 0;       /* Cannot reset NO_REBOOT bit */
                         }
                 }
+                /* Disable reboots untill the watchdog starts */
+                val1 |= 0x02;
+                pci_write_config_byte (i8xx_tco_pci, 0xd4, val1);
+
                 /* Set the TCO_EN bit in SMI_EN register */
                 if (!request_region (SMI_EN + 1, 1, "i8xx TCO")) {
                         printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
@@ -505,17 +527,10 @@ out:
 
 static void __exit watchdog_cleanup (void)
 {
-        u8 val;
-
         /* Stop the timer before we leave */
         if (!nowayout)
                 tco_timer_stop ();
 
-        /* Set the NO_REBOOT bit to prevent later reboots, just for sure */
-        pci_read_config_byte (i8xx_tco_pci, 0xd4, &val);
-        val |= 0x02;
-        pci_write_config_byte (i8xx_tco_pci, 0xd4, val);
-
         /* Deregister */
         misc_deregister (&i8xx_tco_miscdev);
         unregister_reboot_notifier(&i8xx_tco_notifier);
diff --git a/drivers/char/watchdog/sa1100_wdt.c b/drivers/char/watchdog/sa1100_wdt.c
index 1b2132617dc3..fb88b4041dca 100644
--- a/drivers/char/watchdog/sa1100_wdt.c
+++ b/drivers/char/watchdog/sa1100_wdt.c
@@ -36,13 +36,10 @@
 #include <asm/uaccess.h>
 
 #define OSCR_FREQ               CLOCK_TICK_RATE
-#define SA1100_CLOSE_MAGIC      (0x5afc4453)
 
 static unsigned long sa1100wdt_users;
-static int expect_close;
 static int pre_margin;
 static int boot_status;
-static int nowayout = WATCHDOG_NOWAYOUT;
 
 /*
  *      Allow only one person to hold it open
@@ -62,55 +59,33 @@ static int sa1100dog_open(struct inode *inode, struct file *file)
 }
 
 /*
- *      Shut off the timer.
- *      Lock it in if it's a module and we defined ...NOWAYOUT
- *      Oddly, the watchdog can only be enabled, but we can turn off
- *      the interrupt, which appears to prevent the watchdog timing out.
+ * The watchdog cannot be disabled.
+ *
+ * Previous comments suggested that turning off the interrupt by
+ * clearing OIER[E3] would prevent the watchdog timing out but this
+ * does not appear to be true (at least on the PXA255).
  */
 static int sa1100dog_release(struct inode *inode, struct file *file)
 {
-        OSMR3 = OSCR + pre_margin;
-
-        if (expect_close == SA1100_CLOSE_MAGIC) {
-                OIER &= ~OIER_E3;
-        } else {
-                printk(KERN_CRIT "WATCHDOG: WDT device closed unexpectedly.  WDT will not stop!\n");
-        }
+        printk(KERN_CRIT "WATCHDOG: Device closed - timer will not stop\n");
 
         clear_bit(1, &sa1100wdt_users);
-        expect_close = 0;
 
         return 0;
 }
 
 static ssize_t sa1100dog_write(struct file *file, const char *data, size_t len, loff_t *ppos)
 {
-        if (len) {
-                if (!nowayout) {
-                        size_t i;
-
-                        expect_close = 0;
-
-                        for (i = 0; i != len; i++) {
-                                char c;
-
-                                if (get_user(c, data + i))
-                                        return -EFAULT;
-                                if (c == 'V')
-                                        expect_close = SA1100_CLOSE_MAGIC;
-                        }
-                }
+        if (len)
                 /* Refresh OSMR3 timer. */
                 OSMR3 = OSCR + pre_margin;
-        }
 
         return len;
 }
 
 static struct watchdog_info ident = {
-        .options        = WDIOF_CARDRESET | WDIOF_MAGICCLOSE |
-                          WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
-        .identity       = "SA1100 Watchdog",
+        .options        = WDIOF_CARDRESET | WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+        .identity       = "SA1100/PXA255 Watchdog",
 };
 
 static int sa1100dog_ioctl(struct inode *inode, struct file *file,
@@ -172,7 +147,7 @@ static struct file_operations sa1100dog_fops =
 static struct miscdevice sa1100dog_miscdev =
 {
         .minor          = WATCHDOG_MINOR,
-        .name           = "SA1100/PXA2xx watchdog",
+        .name           = "watchdog",
         .fops           = &sa1100dog_fops,
 };
 
@@ -194,7 +169,6 @@ static int __init sa1100dog_init(void)
         if (ret == 0)
                 printk("SA1100/PXA2xx Watchdog Timer: timer margin %d sec\n",
                        margin);
-
         return ret;
 }
 
@@ -212,8 +186,5 @@ MODULE_DESCRIPTION("SA1100/PXA2xx Watchdog");
 module_param(margin, int, 0);
 MODULE_PARM_DESC(margin, "Watchdog margin in seconds (default 60s)");
 
-module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started");
-
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/fc4/fc.c b/drivers/fc4/fc.c
index 5d961f5e0ca0..e4710d1d1f9d 100644
--- a/drivers/fc4/fc.c
+++ b/drivers/fc4/fc.c
@@ -1004,8 +1004,8 @@ int fcp_scsi_dev_reset(Scsi_Cmnd *SCpnt)
                 return FAILED;
         }
         fc->rst_pkt->eh_state = SCSI_STATE_UNUSED;
-        return SUCCESS;
 #endif
+        return SUCCESS;
 }
 
 static int __fcp_scsi_host_reset(Scsi_Cmnd *SCpnt)
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 1c99536b673b..fa503ed9f86d 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -23,8 +23,8 @@
 #include <asm/sibyte/sb1250_smbus.h>
 
 static struct i2c_algo_sibyte_data sibyte_board_data[2] = {
-        { NULL, 0, (void *) (KSEG1+A_SMB_BASE(0)) },
-        { NULL, 1, (void *) (KSEG1+A_SMB_BASE(1)) }
+        { NULL, 0, (void *) (CKSEG1+A_SMB_BASE(0)) },
+        { NULL, 1, (void *) (CKSEG1+A_SMB_BASE(1)) }
 };
 
 static struct i2c_adapter sibyte_board_adapter[2] = {
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index f9c1acb4ed6a..c9d3a00a3c0c 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -1220,7 +1220,7 @@ static int ide_disk_probe(struct device *dev)
                 goto failed;
 
         g = alloc_disk_node(1 << PARTN_BITS,
-                        pcibus_to_node(drive->hwif->pci_dev->bus));
+                        hwif_to_node(drive->hwif));
         if (!g)
                 goto out_free_idkp;
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 7df85af75371..c1128ae5cd2f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -978,8 +978,7 @@ static int ide_init_queue(ide_drive_t *drive)
          *      do not.
          */
 
-        q = blk_init_queue_node(do_ide_request, &ide_lock,
-                                pcibus_to_node(drive->hwif->pci_dev->bus));
+        q = blk_init_queue_node(do_ide_request, &ide_lock, hwif_to_node(hwif));
         if (!q)
                 return 1;
 
@@ -1048,6 +1047,8 @@ static int init_irq (ide_hwif_t *hwif)
 
         BUG_ON(in_interrupt());
         BUG_ON(irqs_disabled());        
+        BUG_ON(hwif == NULL);
+
         down(&ide_cfg_sem);
         hwif->hwgroup = NULL;
 #if MAX_HWIFS > 1
@@ -1097,7 +1098,7 @@ static int init_irq (ide_hwif_t *hwif)
                 spin_unlock_irq(&ide_lock);
         } else {
                 hwgroup = kmalloc_node(sizeof(ide_hwgroup_t), GFP_KERNEL,
-                        pcibus_to_node(hwif->drives[0].hwif->pci_dev->bus));
+                                        hwif_to_node(hwif->drives[0].hwif));
                 if (!hwgroup)
                         goto out_up;
 
diff --git a/drivers/infiniband/include/ib_cm.h b/drivers/infiniband/include/ib_cm.h
index e5d74a730a70..da650115e79a 100644
--- a/drivers/infiniband/include/ib_cm.h
+++ b/drivers/infiniband/include/ib_cm.h
@@ -169,7 +169,8 @@ enum ib_cm_rej_reason {
         IB_CM_REJ_INVALID_ALT_TRAFFIC_CLASS     = __constant_htons(21),
         IB_CM_REJ_INVALID_ALT_HOP_LIMIT         = __constant_htons(22),
         IB_CM_REJ_INVALID_ALT_PACKET_RATE       = __constant_htons(23),
-        IB_CM_REJ_PORT_REDIRECT                 = __constant_htons(24),
+        IB_CM_REJ_PORT_CM_REDIRECT              = __constant_htons(24),
+        IB_CM_REJ_PORT_REDIRECT                 = __constant_htons(25),
         IB_CM_REJ_INVALID_MTU                   = __constant_htons(26),
         IB_CM_REJ_INSUFFICIENT_RESP_RESOURCES   = __constant_htons(27),
         IB_CM_REJ_CONSUMER_DEFINED              = __constant_htons(28),
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6f60abbaebd5..fa00816a3cf7 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -600,9 +600,10 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                         ipoib_mcast_send(dev, (union ib_gid *) (phdr->hwaddr + 4), skb);
                 } else {
-                        /* unicast GID -- should be ARP reply */
+                        /* unicast GID -- should be ARP or RARP reply */
 
-                        if (be16_to_cpup((u16 *) skb->data) != ETH_P_ARP) {
+                        if ((be16_to_cpup((__be16 *) skb->data) != ETH_P_ARP) &&
+                            (be16_to_cpup((__be16 *) skb->data) != ETH_P_RARP)) {
                                 ipoib_warn(priv, "Unicast, no %s: type %04x, QPN %06x "
                                            IPOIB_GID_FMT "\n",
                                            skb->dst ? "neigh" : "dst",
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index e0d1b01cc74c..386df71eee74 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1650,7 +1650,7 @@ static void __exit icn_exit(void)
 {
         isdn_ctrl cmd;
         icn_card *card = cards;
-        icn_card *last;
+        icn_card *last, *tmpcard;
         int i;
         unsigned long flags;
 
@@ -1670,8 +1670,9 @@ static void __exit icn_exit(void)
                         for (i = 0; i < ICN_BCH; i++)
                                 icn_free_queue(card, i);
                 }
-                card = card->next;
+                tmpcard = card->next;
                 spin_unlock_irqrestore(&card->lock, flags);
+                card = tmpcard;
         }
         card = cards;
         cards = NULL;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 70bca955e0de..41df4cda66e2 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -818,8 +818,7 @@ int bitmap_unplug(struct bitmap *bitmap)
         return 0;
 }
 
-static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
-        unsigned long sectors, int in_sync);
+static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset);
 /* * bitmap_init_from_disk -- called at bitmap_create time to initialize
  * the in-memory bitmap from the on-disk bitmap -- also, sets up the
  * memory mapping of the bitmap file
@@ -828,7 +827,7 @@ static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
  *   previously kicked from the array, we mark all the bits as
  *   1's in order to cause a full resync.
  */
-static int bitmap_init_from_disk(struct bitmap *bitmap, int in_sync)
+static int bitmap_init_from_disk(struct bitmap *bitmap)
 {
         unsigned long i, chunks, index, oldindex, bit;
         struct page *page = NULL, *oldpage = NULL;
@@ -929,8 +928,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, int in_sync)
                 }
                 if (test_bit(bit, page_address(page))) {
                         /* if the disk bit is set, set the memory bit */
-                        bitmap_set_memory_bits(bitmap,
-                                        i << CHUNK_BLOCK_SHIFT(bitmap), 1, in_sync);
+                        bitmap_set_memory_bits(bitmap, i << CHUNK_BLOCK_SHIFT(bitmap));
                         bit_cnt++;
                 }
         }
@@ -1426,35 +1424,53 @@ void bitmap_close_sync(struct bitmap *bitmap)
         }
 }
 
-static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset,
-                                   unsigned long sectors, int in_sync)
+static void bitmap_set_memory_bits(struct bitmap *bitmap, sector_t offset)
 {
         /* For each chunk covered by any of these sectors, set the
-         * counter to 1 and set resync_needed unless in_sync.  They should all
+         * counter to 1 and set resync_needed.  They should all
          * be 0 at this point
          */
-        while (sectors) {
-                int secs;
-                bitmap_counter_t *bmc;
-                spin_lock_irq(&bitmap->lock);
-                bmc = bitmap_get_counter(bitmap, offset, &secs, 1);
-                if (!bmc) {
-                        spin_unlock_irq(&bitmap->lock);
-                        return;
-                }
-                if (! *bmc) {
-                        struct page *page;
-                        *bmc = 1 | (in_sync? 0 : NEEDED_MASK);
-                        bitmap_count_page(bitmap, offset, 1);
-                        page = filemap_get_page(bitmap, offset >> CHUNK_BLOCK_SHIFT(bitmap));
-                        set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
-                }
+
+        int secs;
+        bitmap_counter_t *bmc;
+        spin_lock_irq(&bitmap->lock);
+        bmc = bitmap_get_counter(bitmap, offset, &secs, 1);
+        if (!bmc) {
                 spin_unlock_irq(&bitmap->lock);
-                if (sectors > secs)
-                        sectors -= secs;
-                else
-                        sectors = 0;
+                return;
+        }
+        if (! *bmc) {
+                struct page *page;
+                *bmc = 1 | NEEDED_MASK;
+                bitmap_count_page(bitmap, offset, 1);
+                page = filemap_get_page(bitmap, offset >> CHUNK_BLOCK_SHIFT(bitmap));
+                set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
         }
+        spin_unlock_irq(&bitmap->lock);
+
+}
+
+/*
+ * flush out any pending updates
+ */
+void bitmap_flush(mddev_t *mddev)
+{
+        struct bitmap *bitmap = mddev->bitmap;
+        int sleep;
+
+        if (!bitmap) /* there was no bitmap */
+                return;
+
+        /* run the daemon_work three time to ensure everything is flushed
+         * that can be
+         */
+        sleep = bitmap->daemon_sleep;
+        bitmap->daemon_sleep = 0;
+        bitmap_daemon_work(bitmap);
+        bitmap_daemon_work(bitmap);
+        bitmap_daemon_work(bitmap);
+        bitmap->daemon_sleep = sleep;
+        bitmap_update_sb(bitmap);
 }
 
 /*
@@ -1565,7 +1581,8 @@ int bitmap_create(mddev_t *mddev)
 
         /* now that we have some pages available, initialize the in-memory
          * bitmap from the on-disk bitmap */
-        err = bitmap_init_from_disk(bitmap, mddev->recovery_cp == MaxSector);
+        err = bitmap_init_from_disk(bitmap);
+
         if (err)
                 return err;
 
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 12031c9d3f1e..b08df8b9b2ca 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -1230,7 +1230,7 @@ static int __init dm_mirror_init(void)
         if (r)
                 return r;
 
-        _kmirrord_wq = create_workqueue("kmirrord");
+        _kmirrord_wq = create_singlethread_workqueue("kmirrord");
         if (!_kmirrord_wq) {
                 DMERR("couldn't start kmirrord");
                 dm_dirty_log_exit();
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 6580e0fa4a47..480f658db6f2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1798,6 +1798,8 @@ static int do_md_stop(mddev_t * mddev, int ro)
                                 goto out;
                         mddev->ro = 1;
                 } else {
+                        bitmap_flush(mddev);
+                        wait_event(mddev->sb_wait, atomic_read(&mddev->pending_writes)==0);
                         if (mddev->ro)
                                 set_disk_ro(disk, 0);
                         blk_queue_make_request(mddev->queue, md_fail_request);
@@ -3484,7 +3486,6 @@ static void md_do_sync(mddev_t *mddev)
                         goto skip;
                 }
                 ITERATE_MDDEV(mddev2,tmp) {
-                        printk(".");
                         if (mddev2 == mddev)
                                 continue;
                         if (mddev2->curr_resync && 
@@ -4007,3 +4008,4 @@ EXPORT_SYMBOL(md_wakeup_thread);
 EXPORT_SYMBOL(md_print_devices);
 EXPORT_SYMBOL(md_check_recovery);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("md");
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d3a64a04a6d8..51d9645ed09c 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -893,7 +893,6 @@ static int end_sync_read(struct bio *bio, unsigned int bytes_done, int error)
         if (!uptodate) {
                 md_error(r1_bio->mddev,
                          conf->mirrors[r1_bio->read_disk].rdev);
-                set_bit(R1BIO_Degraded, &r1_bio->state);
         } else
                 set_bit(R1BIO_Uptodate, &r1_bio->state);
         rdev_dec_pending(conf->mirrors[r1_bio->read_disk].rdev, conf->mddev);
@@ -918,10 +917,9 @@ static int end_sync_write(struct bio *bio, unsigned int bytes_done, int error)
                         mirror = i;
                         break;
                 }
-        if (!uptodate) {
+        if (!uptodate)
                 md_error(mddev, conf->mirrors[mirror].rdev);
-                set_bit(R1BIO_Degraded, &r1_bio->state);
-        }
+
         update_head_pos(mirror, r1_bio);
 
         if (atomic_dec_and_test(&r1_bio->remaining)) {
@@ -1109,6 +1107,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         int i;
         int write_targets = 0;
         int sync_blocks;
+        int still_degraded = 0;
 
         if (!conf->r1buf_pool)
         {
@@ -1137,7 +1136,10 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 return 0;
         }
 
-        if (!bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, mddev->degraded) &&
+        /* before building a request, check if we can skip these blocks..
+         * This call the bitmap_start_sync doesn't actually record anything
+         */
+        if (!bitmap_start_sync(mddev->bitmap, sector_nr, &sync_blocks, 1) &&
             !conf->fullsync) {
                 /* We can skip this block, and probably several more */
                 *skipped = 1;
@@ -1203,24 +1205,23 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 if (i == disk) {
                         bio->bi_rw = READ;
                         bio->bi_end_io = end_sync_read;
-                } else if (conf->mirrors[i].rdev &&
-                           !conf->mirrors[i].rdev->faulty &&
-                           (!conf->mirrors[i].rdev->in_sync ||
-                            sector_nr + RESYNC_SECTORS > mddev->recovery_cp)) {
+                } else if (conf->mirrors[i].rdev == NULL ||
+                           conf->mirrors[i].rdev->faulty) {
+                        still_degraded = 1;
+                        continue;
+                } else if (!conf->mirrors[i].rdev->in_sync ||
+                           sector_nr + RESYNC_SECTORS > mddev->recovery_cp) {
                         bio->bi_rw = WRITE;
                         bio->bi_end_io = end_sync_write;
                         write_targets ++;
                 } else
+                        /* no need to read or write here */
                         continue;
                 bio->bi_sector = sector_nr + conf->mirrors[i].rdev->data_offset;
                 bio->bi_bdev = conf->mirrors[i].rdev->bdev;
                 bio->bi_private = r1_bio;
         }
 
-        if (write_targets + 1 < conf->raid_disks)
-                /* array degraded, can't clear bitmap */
-                set_bit(R1BIO_Degraded, &r1_bio->state);
-
         if (write_targets == 0) {
                 /* There is nowhere to write, so all non-sync
                  * drives must be failed - so we are finished
@@ -1243,7 +1244,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                         break;
                 if (sync_blocks == 0) {
                         if (!bitmap_start_sync(mddev->bitmap, sector_nr,
-                                        &sync_blocks, mddev->degraded) &&
+                                        &sync_blocks, still_degraded) &&
                                         !conf->fullsync)
                                 break;
                         if (sync_blocks < (PAGE_SIZE>>9))
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index e83256d0fd14..a50a41f6f79d 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -188,7 +188,7 @@ config DVB_BCM3510
           support this frontend.
 
 config DVB_LGDT330X
-        tristate "LGDT3302 or LGDT3303 based (DViCO FusionHDTV Gold)"
+        tristate "LG Electronics LGDT3302/LGDT3303 based"
         depends on DVB_CORE
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index 5264310c070e..536c35d969b7 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -225,6 +225,22 @@ struct dvb_pll_desc dvb_pll_tua6034 = {
 };
 EXPORT_SYMBOL(dvb_pll_tua6034);
 
+/* Infineon TUA6034
+ * used in LG Innotek TDVS-H062F
+ */
+struct dvb_pll_desc dvb_pll_tdvs_tua6034 = {
+        .name  = "LG/Infineon TUA6034",
+        .min   =  54000000,
+        .max   = 863000000,
+        .count = 3,
+        .entries = {
+                {  160000000, 44000000, 62500, 0xce, 0x01 },
+                {  455000000, 44000000, 62500, 0xce, 0x02 },
+                {  999999999, 44000000, 62500, 0xce, 0x04 },
+        },
+};
+EXPORT_SYMBOL(dvb_pll_tdvs_tua6034);
+
 /* Philips FMD1216ME
  * used in Medion Hybrid PCMCIA card and USB Box
  */
diff --git a/drivers/media/dvb/frontends/dvb-pll.h b/drivers/media/dvb/frontends/dvb-pll.h
index cb794759d89e..205b2d1a8852 100644
--- a/drivers/media/dvb/frontends/dvb-pll.h
+++ b/drivers/media/dvb/frontends/dvb-pll.h
@@ -31,6 +31,7 @@ extern struct dvb_pll_desc dvb_pll_unknown_1;
 extern struct dvb_pll_desc dvb_pll_tua6010xs;
 extern struct dvb_pll_desc dvb_pll_env57h1xd5;
 extern struct dvb_pll_desc dvb_pll_tua6034;
+extern struct dvb_pll_desc dvb_pll_tdvs_tua6034;
 extern struct dvb_pll_desc dvb_pll_tda665x;
 extern struct dvb_pll_desc dvb_pll_fmd1216me;
 extern struct dvb_pll_desc dvb_pll_tded4;
diff --git a/drivers/media/dvb/frontends/lgdt330x.c b/drivers/media/dvb/frontends/lgdt330x.c
index e94dee50eecd..1f1cd7a8d500 100644
--- a/drivers/media/dvb/frontends/lgdt330x.c
+++ b/drivers/media/dvb/frontends/lgdt330x.c
@@ -1,11 +1,8 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FusionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
- *    Based on code from  Kirk Lapray <kirk_lapray@bigfoot.com>
- *                           Copyright (C) 2005
- *
  *    This program is free software; you can redistribute it and/or modify
  *    it under the terms of the GNU General Public License as published by
  *    the Free Software Foundation; either version 2 of the License, or
@@ -25,11 +22,13 @@
 /*
  *                      NOTES ABOUT THIS DRIVER
  *
- * This driver supports DViCO FusionHDTV Gold under Linux.
+ * This Linux driver supports:
+ *   DViCO FusionHDTV 3 Gold-Q
+ *   DViCO FusionHDTV 3 Gold-T
+ *   DViCO FusionHDTV 5 Gold
  *
  * TODO:
- * BER and signal strength always return 0.
- * Include support for LGDT3303
+ * signal strength always returns 0.
  *
  */
 
@@ -41,7 +40,6 @@
 #include <asm/byteorder.h>
 
 #include "dvb_frontend.h"
-#include "dvb-pll.h"
 #include "lgdt330x_priv.h"
 #include "lgdt330x.h"
 
@@ -70,55 +68,37 @@ struct lgdt330x_state
         u32 current_frequency;
 };
 
-static int i2c_writebytes (struct lgdt330x_state* state,
-                           u8 addr, /* demod_address or pll_address */
+static int i2c_write_demod_bytes (struct lgdt330x_state* state,
                            u8 *buf, /* data bytes to send */
                            int len  /* number of bytes to send */ )
 {
-        u8 tmp[] = { buf[0], buf[1] };
         struct i2c_msg msg =
-                { .addr = addr, .flags = 0, .buf = tmp,  .len = 2 };
-        int err;
+                { .addr = state->config->demod_address,
+                  .flags = 0,
+                  .buf = buf,
+                  .len = 2 };
         int i;
+        int err;
 
-        for (i=1; i<len; i++) {
-                tmp[1] = buf[i];
+        for (i=0; i<len-1; i+=2){
                 if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err == %i)\n", __FUNCTION__, addr, buf[0], err);
+                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, msg.buf[0], msg.buf[1], err);
                         if (err < 0)
                                 return err;
                         else
                                 return -EREMOTEIO;
                 }
-                tmp[0]++;
+                msg.buf += 2;
         }
         return 0;
 }
 
-#if 0
-static int i2c_readbytes (struct lgdt330x_state* state,
-                          u8 addr, /* demod_address or pll_address */
-                          u8 *buf, /* holds data bytes read */
-                          int len  /* number of bytes to read */ )
-{
-        struct i2c_msg msg =
-                { .addr = addr, .flags = I2C_M_RD, .buf = buf,  .len = len };
-        int err;
-
-        if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                printk(KERN_WARNING "lgdt330x: %s error (addr %02x, err == %i)\n", __FUNCTION__, addr, err);
-                return -EREMOTEIO;
-        }
-        return 0;
-}
-#endif
-
 /*
  * This routine writes the register (reg) to the demod bus
  * then reads the data returned for (len) bytes.
  */
 
-static u8 i2c_selectreadbytes (struct lgdt330x_state* state,
+static u8 i2c_read_demod_bytes (struct lgdt330x_state* state,
                                enum I2C_REG reg, u8* buf, int len)
 {
         u8 wr [] = { reg };
@@ -139,7 +119,7 @@ static u8 i2c_selectreadbytes (struct lgdt330x_state* state,
 }
 
 /* Software reset */
-int lgdt330x_SwReset(struct lgdt330x_state* state)
+static int lgdt3302_SwReset(struct lgdt330x_state* state)
 {
         u8 ret;
         u8 reset[] = {
@@ -148,23 +128,51 @@ int lgdt330x_SwReset(struct lgdt330x_state* state)
                       * bits 5-0 are 1 to mask interrupts */
         };
 
-        ret = i2c_writebytes(state,
-                             state->config->demod_address,
+        ret = i2c_write_demod_bytes(state,
+                             reset, sizeof(reset));
+        if (ret == 0) {
+
+                /* force reset high (inactive) and unmask interrupts */
+                reset[1] = 0x7f;
+                ret = i2c_write_demod_bytes(state,
+                                     reset, sizeof(reset));
+        }
+        return ret;
+}
+
+static int lgdt3303_SwReset(struct lgdt330x_state* state)
+{
+        u8 ret;
+        u8 reset[] = {
+                0x02,
+                0x00 /* bit 0 is active low software reset */
+        };
+
+        ret = i2c_write_demod_bytes(state,
                              reset, sizeof(reset));
         if (ret == 0) {
-                /* spec says reset takes 100 ns why wait */
-                /* mdelay(100);    */ /* keep low for 100mS */
-                reset[1] = 0x7f;      /* force reset high (inactive)
-                                       * and unmask interrupts */
-                ret = i2c_writebytes(state,
-                                     state->config->demod_address,
+
+                /* force reset high (inactive) */
+                reset[1] = 0x01;
+                ret = i2c_write_demod_bytes(state,
                                      reset, sizeof(reset));
         }
-        /* Spec does not indicate a need for this either */
-        /*mdelay(5); */               /* wait 5 msec before doing more */
         return ret;
 }
 
+static int lgdt330x_SwReset(struct lgdt330x_state* state)
+{
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                return lgdt3302_SwReset(state);
+        case LGDT3303:
+                return lgdt3303_SwReset(state);
+        default:
+                return -ENODEV;
+        }
+}
+
+
 static int lgdt330x_init(struct dvb_frontend* fe)
 {
         /* Hardware reset is done using gpio[0] of cx23880x chip.
@@ -173,22 +181,98 @@ static int lgdt330x_init(struct dvb_frontend* fe)
          * Maybe there needs to be a callable function in cx88-core or
          * the caller of this function needs to do it. */
 
-        dprintk("%s entered\n", __FUNCTION__);
-        return lgdt330x_SwReset((struct lgdt330x_state*) fe->demodulator_priv);
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize each different chip
+         */
+        static u8 lgdt3302_init_data[] = {
+                /* Use 50MHz parameter values from spec sheet since xtal is 50 */
+                /* Change the value of NCOCTFV[25:0] of carrier
+                   recovery center frequency register */
+                VSB_CARRIER_FREQ0, 0x00,
+                VSB_CARRIER_FREQ1, 0x87,
+                VSB_CARRIER_FREQ2, 0x8e,
+                VSB_CARRIER_FREQ3, 0x01,
+                /* Change the TPCLK pin polarity
+                   data is valid on falling clock */
+                DEMUX_CONTROL, 0xfb,
+                /* Change the value of IFBW[11:0] of
+                   AGC IF/RF loop filter bandwidth register */
+                AGC_RF_BANDWIDTH0, 0x40,
+                AGC_RF_BANDWIDTH1, 0x93,
+                AGC_RF_BANDWIDTH2, 0x00,
+                /* Change the value of bit 6, 'nINAGCBY' and
+                   'NSSEL[1:0] of ACG function control register 2 */
+                AGC_FUNC_CTRL2, 0xc6,
+                /* Change the value of bit 6 'RFFIX'
+                   of AGC function control register 3 */
+                AGC_FUNC_CTRL3, 0x40,
+                /* Set the value of 'INLVTHD' register 0x2a/0x2c
+                   to 0x7fe */
+                AGC_DELAY0, 0x07,
+                AGC_DELAY2, 0xfe,
+                /* Change the value of IAGCBW[15:8]
+                   of inner AGC loop filter bandwith */
+                AGC_LOOP_BANDWIDTH0, 0x08,
+                AGC_LOOP_BANDWIDTH1, 0x9a
+        };
+
+        static u8 lgdt3303_init_data[] = {
+                0x4c, 0x14
+        };
+
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        char  *chip_name;
+        int    err;
+
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                chip_name = "LGDT3302";
+                err = i2c_write_demod_bytes(state, lgdt3302_init_data,
+                                                                        sizeof(lgdt3302_init_data));
+                break;
+        case LGDT3303:
+                chip_name = "LGDT3303";
+                err = i2c_write_demod_bytes(state, lgdt3303_init_data,
+                                                                        sizeof(lgdt3303_init_data));
+                break;
+        default:
+                chip_name = "undefined";
+                printk (KERN_WARNING "Only LGDT3302 and LGDT3303 are supported chips.\n");
+                err = -ENODEV;
+        }
+        dprintk("%s entered as %s\n", __FUNCTION__, chip_name);
+        if (err < 0)
+                return err;
+        return lgdt330x_SwReset(state);
 }
 
 static int lgdt330x_read_ber(struct dvb_frontend* fe, u32* ber)
 {
-        *ber = 0; /* Dummy out for now */
+        *ber = 0; /* Not supplied by the demod chips */
         return 0;
 }
 
 static int lgdt330x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        int err;
         u8 buf[2];
 
-        i2c_selectreadbytes(state, PACKET_ERR_COUNTER1, buf, sizeof(buf));
+        switch (state->config->demod_chip) {
+        case LGDT3302:
+                err = i2c_read_demod_bytes(state, LGDT3302_PACKET_ERR_COUNTER1,
+                                                                  buf, sizeof(buf));
+                break;
+        case LGDT3303:
+                err = i2c_read_demod_bytes(state, LGDT3303_PACKET_ERR_COUNTER1,
+                                                                  buf, sizeof(buf));
+                break;
+        default:
+                printk(KERN_WARNING
+                           "Only LGDT3302 and LGDT3303 are supported chips.\n");
+                err = -ENODEV;
+        }
 
         *ucblocks = (buf[0] << 8) | buf[1];
         return 0;
@@ -197,123 +281,113 @@ static int lgdt330x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 static int lgdt330x_set_parameters(struct dvb_frontend* fe,
                                    struct dvb_frontend_parameters *param)
 {
-        struct lgdt330x_state* state =
-                (struct lgdt330x_state*) fe->demodulator_priv;
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize 8VSB for lgdt3303 chip 50 MHz IF
+         */
+        static u8 lgdt3303_8vsb_44_data[] = {
+                0x04, 0x00,
+                0x0d, 0x40,
+        0x0e, 0x87,
+        0x0f, 0x8e,
+        0x10, 0x01,
+        0x47, 0x8b };
+
+        /*
+         * Array of byte pairs <address, value>
+         * to initialize QAM for lgdt3303 chip
+         */
+        static u8 lgdt3303_qam_data[] = {
+                0x04, 0x00,
+                0x0d, 0x00,
+                0x0e, 0x00,
+                0x0f, 0x00,
+                0x10, 0x00,
+                0x51, 0x63,
+                0x47, 0x66,
+                0x48, 0x66,
+                0x4d, 0x1a,
+                0x49, 0x08,
+                0x4a, 0x9b };
+
+        struct lgdt330x_state* state = fe->demodulator_priv;
 
-        /* Use 50MHz parameter values from spec sheet since xtal is 50 */
         static u8 top_ctrl_cfg[]   = { TOP_CONTROL, 0x03 };
-        static u8 vsb_freq_cfg[]   = { VSB_CARRIER_FREQ0, 0x00, 0x87, 0x8e, 0x01 };
-        static u8 demux_ctrl_cfg[] = { DEMUX_CONTROL, 0xfb };
-        static u8 agc_rf_cfg[]     = { AGC_RF_BANDWIDTH0, 0x40, 0x93, 0x00 };
-        static u8 agc_ctrl_cfg[]   = { AGC_FUNC_CTRL2, 0xc6, 0x40 };
-        static u8 agc_delay_cfg[]  = { AGC_DELAY0, 0x07, 0x00, 0xfe };
-        static u8 agc_loop_cfg[]   = { AGC_LOOP_BANDWIDTH0, 0x08, 0x9a };
 
+        int err;
         /* Change only if we are actually changing the modulation */
         if (state->current_modulation != param->u.vsb.modulation) {
                 switch(param->u.vsb.modulation) {
                 case VSB_8:
                         dprintk("%s: VSB_8 MODE\n", __FUNCTION__);
 
-                        /* Select VSB mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x07;
+                        /* Select VSB mode */
+                        top_ctrl_cfg[1] = 0x03;
 
                         /* Select ANT connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 1);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_8vsb_44_data,
+                                                                                        sizeof(lgdt3303_8vsb_44_data));
+                        }
                         break;
 
                 case QAM_64:
                         dprintk("%s: QAM_64 MODE\n", __FUNCTION__);
 
-                        /* Select QAM_64 mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x04;
+                        /* Select QAM_64 mode */
+                        top_ctrl_cfg[1] = 0x00;
 
                         /* Select CABLE connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 0);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_qam_data,
+                                                                                        sizeof(lgdt3303_qam_data));
+                        }
                         break;
 
                 case QAM_256:
                         dprintk("%s: QAM_256 MODE\n", __FUNCTION__);
 
-                        /* Select QAM_256 mode and serial MPEG interface */
-                        top_ctrl_cfg[1] = 0x05;
+                        /* Select QAM_256 mode */
+                        top_ctrl_cfg[1] = 0x01;
 
                         /* Select CABLE connector if supported by card */
                         if (state->config->pll_rf_set)
                                 state->config->pll_rf_set(fe, 0);
+
+                        if (state->config->demod_chip == LGDT3303) {
+                                err = i2c_write_demod_bytes(state, lgdt3303_qam_data,
+                                                                                        sizeof(lgdt3303_qam_data));
+                        }
                         break;
                 default:
                         printk(KERN_WARNING "lgdt330x: %s: Modulation type(%d) UNSUPPORTED\n", __FUNCTION__, param->u.vsb.modulation);
                         return -1;
                 }
-                /* Initializations common to all modes */
+                /*
+                 * select serial or parallel MPEG harware interface
+                 * Serial:   0x04 for LGDT3302 or 0x40 for LGDT3303
+                 * Parallel: 0x00
+                 */
+                top_ctrl_cfg[1] |= state->config->serial_mpeg;
 
                 /* Select the requested mode */
-                i2c_writebytes(state, state->config->demod_address,
-                               top_ctrl_cfg, sizeof(top_ctrl_cfg));
-
-                /* Change the value of IFBW[11:0]
-                   of AGC IF/RF loop filter bandwidth register */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_rf_cfg, sizeof(agc_rf_cfg));
-
-                /* Change the value of bit 6, 'nINAGCBY' and
-                   'NSSEL[1:0] of ACG function control register 2 */
-                /* Change the value of bit 6 'RFFIX'
-                   of AGC function control register 3 */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_ctrl_cfg, sizeof(agc_ctrl_cfg));
-
-                /* Change the TPCLK pin polarity
-                   data is valid on falling clock */
-                i2c_writebytes(state, state->config->demod_address,
-                               demux_ctrl_cfg, sizeof(demux_ctrl_cfg));
-
-                /* Change the value of NCOCTFV[25:0] of carrier
-                   recovery center frequency register */
-                i2c_writebytes(state, state->config->demod_address,
-                                       vsb_freq_cfg, sizeof(vsb_freq_cfg));
-
-                /* Set the value of 'INLVTHD' register 0x2a/0x2c to 0x7fe */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_delay_cfg, sizeof(agc_delay_cfg));
-
-                /* Change the value of IAGCBW[15:8]
-                   of inner AGC loop filter bandwith */
-                i2c_writebytes(state, state->config->demod_address,
-                               agc_loop_cfg, sizeof(agc_loop_cfg));
-
+                i2c_write_demod_bytes(state, top_ctrl_cfg,
+                                                          sizeof(top_ctrl_cfg));
                 state->config->set_ts_params(fe, 0);
                 state->current_modulation = param->u.vsb.modulation;
         }
 
         /* Change only if we are actually changing the channel */
         if (state->current_frequency != param->frequency) {
-                u8 buf[5];
-                struct i2c_msg msg = { .flags = 0, .buf = &buf[1], .len = 4 };
-                int err;
-
-                state->config->pll_set(fe, param, buf);
-                msg.addr = buf[0];
-
-                dprintk("%s: tuner at 0x%02x bytes: 0x%02x 0x%02x "
-                        "0x%02x 0x%02x\n", __FUNCTION__,
-                        buf[0],buf[1],buf[2],buf[3],buf[4]);
-                if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, buf[0], buf[1], err);
-                        if (err < 0)
-                                return err;
-                        else
-                                return -EREMOTEIO;
-                }
-#if 0
-                /* Check the status of the tuner pll */
-                i2c_readbytes(state, buf[0], &buf[1], 1);
-                dprintk("%s: tuner status byte = 0x%02x\n", __FUNCTION__, buf[1]);
-#endif
-                /* Update current frequency */
+                /* Tune to the new frequency */
+                state->config->pll_set(fe, param);
+                /* Keep track of the new frequency */
                 state->current_frequency = param->frequency;
         }
         lgdt330x_SwReset(state);
@@ -328,21 +402,15 @@ static int lgdt330x_get_frontend(struct dvb_frontend* fe,
         return 0;
 }
 
-static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
+static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = fe->demodulator_priv;
         u8 buf[3];
 
         *status = 0; /* Reset status result */
 
-        /*
-         * You must set the Mask bits to 1 in the IRQ_MASK in order
-         * to see that status bit in the IRQ_STATUS register.
-         * This is done in SwReset();
-         */
-
         /* AGC status register */
-        i2c_selectreadbytes(state, AGC_STATUS, buf, 1);
+        i2c_read_demod_bytes(state, AGC_STATUS, buf, 1);
         dprintk("%s: AGC_STATUS = 0x%02x\n", __FUNCTION__, buf[0]);
         if ((buf[0] & 0x0c) == 0x8){
                 /* Test signal does not exist flag */
@@ -353,16 +421,15 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
                 return 0;
         }
 
+        /*
+         * You must set the Mask bits to 1 in the IRQ_MASK in order
+         * to see that status bit in the IRQ_STATUS register.
+         * This is done in SwReset();
+         */
         /* signal status */
-        i2c_selectreadbytes(state, TOP_CONTROL, buf, sizeof(buf));
+        i2c_read_demod_bytes(state, TOP_CONTROL, buf, sizeof(buf));
         dprintk("%s: TOP_CONTROL = 0x%02x, IRO_MASK = 0x%02x, IRQ_STATUS = 0x%02x\n", __FUNCTION__, buf[0], buf[1], buf[2]);
 
-#if 0
-        /* Alternative method to check for a signal */
-        /* using the SNR good/bad interrupts.   */
-        if ((buf[2] & 0x30) == 0x10)
-                *status |= FE_HAS_SIGNAL;
-#endif
 
         /* sync status */
         if ((buf[2] & 0x03) == 0x01) {
@@ -376,7 +443,7 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
         }
 
         /* Carrier Recovery Lock Status Register */
-        i2c_selectreadbytes(state, CARRIER_LOCK, buf, 1);
+        i2c_read_demod_bytes(state, CARRIER_LOCK, buf, 1);
         dprintk("%s: CARRIER_LOCK = 0x%02x\n", __FUNCTION__, buf[0]);
         switch (state->current_modulation) {
         case QAM_256:
@@ -396,13 +463,75 @@ static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
         return 0;
 }
 
+static int lgdt3303_read_status(struct dvb_frontend* fe, fe_status_t* status)
+{
+        struct lgdt330x_state* state = fe->demodulator_priv;
+        int err;
+        u8 buf[3];
+
+        *status = 0; /* Reset status result */
+
+        /* lgdt3303 AGC status register */
+        err = i2c_read_demod_bytes(state, 0x58, buf, 1);
+        if (err < 0)
+                return err;
+
+        dprintk("%s: AGC_STATUS = 0x%02x\n", __FUNCTION__, buf[0]);
+        if ((buf[0] & 0x21) == 0x01){
+                /* Test input signal does not exist flag */
+                /* as well as the AGC lock flag.   */
+                *status |= FE_HAS_SIGNAL;
+        } else {
+                /* Without a signal all other status bits are meaningless */
+                return 0;
+        }
+
+        /* Carrier Recovery Lock Status Register */
+        i2c_read_demod_bytes(state, CARRIER_LOCK, buf, 1);
+        dprintk("%s: CARRIER_LOCK = 0x%02x\n", __FUNCTION__, buf[0]);
+        switch (state->current_modulation) {
+        case QAM_256:
+        case QAM_64:
+                /* Need to undestand why there are 3 lock levels here */
+                if ((buf[0] & 0x07) == 0x07)
+                        *status |= FE_HAS_CARRIER;
+                else
+                        break;
+                i2c_read_demod_bytes(state, 0x8a, buf, 1);
+                if ((buf[0] & 0x04) == 0x04)
+                        *status |= FE_HAS_SYNC;
+                if ((buf[0] & 0x01) == 0x01)
+                        *status |= FE_HAS_LOCK;
+                if ((buf[0] & 0x08) == 0x08)
+                        *status |= FE_HAS_VITERBI;
+                break;
+        case VSB_8:
+                if ((buf[0] & 0x80) == 0x80)
+                        *status |= FE_HAS_CARRIER;
+                else
+                        break;
+                i2c_read_demod_bytes(state, 0x38, buf, 1);
+                if ((buf[0] & 0x02) == 0x00)
+                        *status |= FE_HAS_SYNC;
+                if ((buf[0] & 0x01) == 0x01) {
+                        *status |= FE_HAS_LOCK;
+                        *status |= FE_HAS_VITERBI;
+                }
+                break;
+        default:
+                printk("KERN_WARNING lgdt330x: %s: Modulation set to unsupported value\n", __FUNCTION__);
+        }
+        return 0;
+}
+
 static int lgdt330x_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
         /* not directly available. */
+        *strength = 0;
         return 0;
 }
 
-static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
+static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
 {
 #ifdef SNR_IN_DB
         /*
@@ -451,7 +580,7 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
                   91,    115,    144,    182,    229,    288, 362,   456,   574,   722,
                   909,   1144,   1440,   1813,   2282,   2873, 3617,  4553,  5732,  7216,
                   9084,  11436,  14396,  18124,  22817,  28724,  36161, 45524, 57312, 72151,
-                  90833, 114351, 143960, 181235, 228161, 0x040000
+                  90833, 114351, 143960, 181235, 228161, 0x080000
                 };
 
         static u8 buf[5];/* read data buffer */
@@ -459,8 +588,8 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         static u32 snr_db;  /* index into SNR_EQ[] */
         struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
-        /* read both equalizer and pase tracker noise data */
-        i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
+        /* read both equalizer and phase tracker noise data */
+        i2c_read_demod_bytes(state, EQPH_ERR0, buf, sizeof(buf));
 
         if (state->current_modulation == VSB_8) {
                 /* Equalizer Mean-Square Error Register for VSB */
@@ -496,19 +625,20 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
         /* read both equalizer and pase tracker noise data */
-        i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
+        i2c_read_demod_bytes(state, EQPH_ERR0, buf, sizeof(buf));
 
         if (state->current_modulation == VSB_8) {
-                /* Equalizer Mean-Square Error Register for VSB */
-                noise = ((buf[0] & 7) << 16) | (buf[1] << 8) | buf[2];
-        } else {
-                /* Phase Tracker Mean-Square Error Register for QAM */
+                /* Phase Tracker Mean-Square Error Register for VSB */
                 noise = ((buf[0] & 7<<3) << 13) | (buf[3] << 8) | buf[4];
+        } else {
+
+                /* Carrier Recovery Mean-Square Error for QAM */
+                i2c_read_demod_bytes(state, 0x1a, buf, 2);
+                noise = ((buf[0] & 3) << 8) | buf[1];
         }
 
         /* Small values for noise mean signal is better so invert noise */
-        /* Noise is 19 bit value so discard 3 LSB*/
-        *snr = ~noise>>3;
+        *snr = ~noise;
 #endif
 
         dprintk("%s: noise = 0x%05x, snr = %idb\n",__FUNCTION__, noise, *snr);
@@ -516,6 +646,32 @@ static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
         return 0;
 }
 
+static int lgdt3303_read_snr(struct dvb_frontend* fe, u16* snr)
+{
+        /* Return the raw noise value */
+        static u8 buf[5];/* read data buffer */
+        static u32 noise;   /* noise value */
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
+
+        if (state->current_modulation == VSB_8) {
+
+                /* Phase Tracker Mean-Square Error Register for VSB */
+                noise = ((buf[0] & 7) << 16) | (buf[3] << 8) | buf[4];
+        } else {
+
+                /* Carrier Recovery Mean-Square Error for QAM */
+                i2c_read_demod_bytes(state, 0x1a, buf, 2);
+                noise = (buf[0] << 8) | buf[1];
+        }
+
+        /* Small values for noise mean signal is better so invert noise */
+        *snr = ~noise;
+
+        dprintk("%s: noise = 0x%05x, snr = %idb\n",__FUNCTION__, noise, *snr);
+
+        return 0;
+}
+
 static int lgdt330x_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fe_tune_settings)
 {
         /* I have no idea about this - it may not be needed */
@@ -531,7 +687,8 @@ static void lgdt330x_release(struct dvb_frontend* fe)
         kfree(state);
 }
 
-static struct dvb_frontend_ops lgdt330x_ops;
+static struct dvb_frontend_ops lgdt3302_ops;
+static struct dvb_frontend_ops lgdt3303_ops;
 
 struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
                                      struct i2c_adapter* i2c)
@@ -548,9 +705,19 @@ struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
         /* Setup the state */
         state->config = config;
         state->i2c = i2c;
-        memcpy(&state->ops, &lgdt330x_ops, sizeof(struct dvb_frontend_ops));
+        switch (config->demod_chip) {
+        case LGDT3302:
+                memcpy(&state->ops, &lgdt3302_ops, sizeof(struct dvb_frontend_ops));
+                break;
+        case LGDT3303:
+                memcpy(&state->ops, &lgdt3303_ops, sizeof(struct dvb_frontend_ops));
+                break;
+        default:
+                goto error;
+        }
+
         /* Verify communication with demod chip */
-        if (i2c_selectreadbytes(state, 2, buf, 1))
+        if (i2c_read_demod_bytes(state, 2, buf, 1))
                 goto error;
 
         state->current_frequency = -1;
@@ -568,9 +735,33 @@ error:
         return NULL;
 }
 
-static struct dvb_frontend_ops lgdt330x_ops = {
+static struct dvb_frontend_ops lgdt3302_ops = {
+        .info = {
+                .name= "LG Electronics LGDT3302 VSB/QAM Frontend",
+                .type = FE_ATSC,
+                .frequency_min= 54000000,
+                .frequency_max= 858000000,
+                .frequency_stepsize= 62500,
+                /* Symbol rate is for all VSB modes need to check QAM */
+                .symbol_rate_min    = 10762000,
+                .symbol_rate_max    = 10762000,
+                .caps = FE_CAN_QAM_64 | FE_CAN_QAM_256 | FE_CAN_8VSB
+        },
+        .init                 = lgdt330x_init,
+        .set_frontend         = lgdt330x_set_parameters,
+        .get_frontend         = lgdt330x_get_frontend,
+        .get_tune_settings    = lgdt330x_get_tune_settings,
+        .read_status          = lgdt3302_read_status,
+        .read_ber             = lgdt330x_read_ber,
+        .read_signal_strength = lgdt330x_read_signal_strength,
+        .read_snr             = lgdt3302_read_snr,
+        .read_ucblocks        = lgdt330x_read_ucblocks,
+        .release              = lgdt330x_release,
+};
+
+static struct dvb_frontend_ops lgdt3303_ops = {
         .info = {
-                .name= "LG Electronics lgdt330x VSB/QAM Frontend",
+                .name= "LG Electronics LGDT3303 VSB/QAM Frontend",
                 .type = FE_ATSC,
                 .frequency_min= 54000000,
                 .frequency_max= 858000000,
@@ -584,15 +775,15 @@ static struct dvb_frontend_ops lgdt330x_ops = {
         .set_frontend         = lgdt330x_set_parameters,
         .get_frontend         = lgdt330x_get_frontend,
         .get_tune_settings    = lgdt330x_get_tune_settings,
-        .read_status          = lgdt330x_read_status,
+        .read_status          = lgdt3303_read_status,
         .read_ber             = lgdt330x_read_ber,
         .read_signal_strength = lgdt330x_read_signal_strength,
-        .read_snr             = lgdt330x_read_snr,
+        .read_snr             = lgdt3303_read_snr,
         .read_ucblocks        = lgdt330x_read_ucblocks,
         .release              = lgdt330x_release,
 };
 
-MODULE_DESCRIPTION("lgdt330x [DViCO FusionHDTV 3 Gold] (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
+MODULE_DESCRIPTION("LGDT330X (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
 MODULE_AUTHOR("Wilson Michaels");
 MODULE_LICENSE("GPL");
 
@@ -601,6 +792,5 @@ EXPORT_SYMBOL(lgdt330x_attach);
 /*
  * Local variables:
  * c-basic-offset: 8
- * compile-command: "make DVB=1"
  * End:
  */
diff --git a/drivers/media/dvb/frontends/lgdt330x.h b/drivers/media/dvb/frontends/lgdt330x.h
index 04986f8e7565..e209ba1e47c5 100644
--- a/drivers/media/dvb/frontends/lgdt330x.h
+++ b/drivers/media/dvb/frontends/lgdt330x.h
@@ -1,5 +1,5 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -24,14 +24,26 @@
 
 #include <linux/dvb/frontend.h>
 
+typedef enum lg_chip_t {
+                UNDEFINED,
+                LGDT3302,
+                LGDT3303
+}lg_chip_type;
+
 struct lgdt330x_config
 {
         /* The demodulator's i2c address */
         u8 demod_address;
 
+        /* LG demodulator chip LGDT3302 or LGDT3303 */
+        lg_chip_type demod_chip;
+
+        /* MPEG hardware interface - 0:parallel 1:serial */
+        int serial_mpeg;
+
         /* PLL interface */
         int (*pll_rf_set) (struct dvb_frontend* fe, int index);
-        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params, u8* pll_address);
+        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params);
 
         /* Need to set device param for start_dma */
         int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
diff --git a/drivers/media/dvb/frontends/lgdt330x_priv.h b/drivers/media/dvb/frontends/lgdt330x_priv.h
index 4143ce8f1a95..59b7c5b9012d 100644
--- a/drivers/media/dvb/frontends/lgdt330x_priv.h
+++ b/drivers/media/dvb/frontends/lgdt330x_priv.h
@@ -1,5 +1,5 @@
 /*
- *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
+ *    Support for LGDT3302 and LGDT3303 - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -57,8 +57,10 @@ enum I2C_REG {
         PH_ERR1= 0x4a,
         PH_ERR2= 0x4b,
         DEMUX_CONTROL= 0x66,
-        PACKET_ERR_COUNTER1= 0x6a,
-        PACKET_ERR_COUNTER2= 0x6b,
+        LGDT3302_PACKET_ERR_COUNTER1= 0x6a,
+        LGDT3302_PACKET_ERR_COUNTER2= 0x6b,
+        LGDT3303_PACKET_ERR_COUNTER1= 0x8b,
+        LGDT3303_PACKET_ERR_COUNTER2= 0x8c,
 };
 
 #endif /* _LGDT330X_PRIV_ */
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index 6c52fd0bb7df..a97b9b958ed6 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -95,7 +95,7 @@ static int __devinit pvr_boot(struct bttv *btv);
 static unsigned int triton1=0;
 static unsigned int vsfx=0;
 static unsigned int latency = UNSET;
-static unsigned int no_overlay=-1;
+int no_overlay=-1;
 
 static unsigned int card[BTTV_MAX]   = { [ 0 ... (BTTV_MAX-1) ] = UNSET };
 static unsigned int pll[BTTV_MAX]    = { [ 0 ... (BTTV_MAX-1) ] = UNSET };
@@ -4296,9 +4296,11 @@ void __devinit bttv_check_chipset(void)
                 printk(KERN_INFO "bttv: Host bridge needs VSFX enabled.\n");
         if (pcipci_fail) {
                 printk(KERN_WARNING "bttv: BT848 and your chipset may not work together.\n");
-                if (UNSET == no_overlay) {
-                        printk(KERN_WARNING "bttv: going to disable overlay.\n");
+                if (!no_overlay) {
+                        printk(KERN_WARNING "bttv: overlay will be disabled.\n");
                         no_overlay = 1;
+                } else {
+                        printk(KERN_WARNING "bttv: overlay forced. Use this option at your own risk.\n");
                 }
         }
         if (UNSET != latency)
diff --git a/drivers/media/video/bttv-driver.c b/drivers/media/video/bttv-driver.c
index 67f331eeeb19..eee9322ce21b 100644
--- a/drivers/media/video/bttv-driver.c
+++ b/drivers/media/video/bttv-driver.c
@@ -1,5 +1,5 @@
 /*
-    $Id: bttv-driver.c,v 1.45 2005/07/20 19:43:24 mkrufky Exp $
+    $Id: bttv-driver.c,v 1.52 2005/08/04 00:55:16 mchehab Exp $
 
     bttv - Bt848 frame grabber driver
 
@@ -80,6 +80,7 @@ static unsigned int irq_iswitch = 0;
 static unsigned int uv_ratio    = 50;
 static unsigned int full_luma_range = 0;
 static unsigned int coring      = 0;
+extern int no_overlay;
 
 /* API features (turn on/off stuff for testing) */
 static unsigned int v4l2        = 1;
@@ -2151,6 +2152,10 @@ static int bttv_s_fmt(struct bttv_fh *fh, struct bttv *btv,
                 return 0;
         }
         case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                if (no_overlay > 0) {
+                        printk ("V4L2_BUF_TYPE_VIDEO_OVERLAY: no_overlay\n");
+                        return -EINVAL;
+                }
                 return setup_window(fh, btv, &f->fmt.win, 1);
         case V4L2_BUF_TYPE_VBI_CAPTURE:
                 retval = bttv_switch_type(fh,f->type);
@@ -2224,9 +2229,11 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                         /* others */
                         cap->type = VID_TYPE_CAPTURE|
                                 VID_TYPE_TUNER|
-                                VID_TYPE_OVERLAY|
                                 VID_TYPE_CLIPPING|
                                 VID_TYPE_SCALES;
+                        if (no_overlay <= 0)
+                                cap->type |= VID_TYPE_OVERLAY;
+
                         cap->maxwidth  = bttv_tvnorms[btv->tvnorm].swidth;
                         cap->maxheight = bttv_tvnorms[btv->tvnorm].sheight;
                         cap->minwidth  = 48;
@@ -2302,6 +2309,11 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 struct video_window *win = arg;
                 struct v4l2_window w2;
 
+                if (no_overlay > 0) {
+                        printk ("VIDIOCSWIN: no_overlay\n");
+                        return -EINVAL;
+                }
+
                 w2.field = V4L2_FIELD_ANY;
                 w2.w.left    = win->x;
                 w2.w.top     = win->y;
@@ -2577,10 +2589,12 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                 cap->version = BTTV_VERSION_CODE;
                 cap->capabilities =
                         V4L2_CAP_VIDEO_CAPTURE |
-                        V4L2_CAP_VIDEO_OVERLAY |
                         V4L2_CAP_VBI_CAPTURE |
                         V4L2_CAP_READWRITE |
                         V4L2_CAP_STREAMING;
+                if (no_overlay <= 0)
+                        cap->capabilities |= V4L2_CAP_VIDEO_OVERLAY;
+
                 if (bttv_tvcards[btv->c.type].tuner != UNSET &&
                     bttv_tvcards[btv->c.type].tuner != TUNER_ABSENT)
                         cap->capabilities |= V4L2_CAP_TUNER;
@@ -3076,7 +3090,7 @@ static struct file_operations bttv_fops =
 static struct video_device bttv_video_template =
 {
         .name     = "UNSET",
-        .type     = VID_TYPE_CAPTURE|VID_TYPE_TUNER|VID_TYPE_OVERLAY|
+        .type     = VID_TYPE_CAPTURE|VID_TYPE_TUNER|
                     VID_TYPE_CLIPPING|VID_TYPE_SCALES,
         .hardware = VID_HARDWARE_BT848,
         .fops     = &bttv_fops,
@@ -3756,6 +3770,12 @@ static void bttv_unregister_video(struct bttv *btv)
 /* register video4linux devices */
 static int __devinit bttv_register_video(struct bttv *btv)
 {
+        if (no_overlay <= 0) {
+                bttv_video_template.type |= VID_TYPE_OVERLAY;
+        } else {
+                printk("bttv: Overlay support disabled.\n");
+        }
+
         /* video */
         btv->video_dev = vdev_init(btv, &bttv_video_template, "video");
         if (NULL == btv->video_dev)
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index ef0e9a85c359..78d223257a68 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -1,5 +1,5 @@
 /*
- * $Id: cx88-dvb.c,v 1.54 2005/07/25 05:13:50 mkrufky Exp $
+ * $Id: cx88-dvb.c,v 1.58 2005/08/07 09:24:08 mkrufky Exp $
  *
  * device driver for Conexant 2388x based TV cards
  * MPEG Transport Stream (DVB) routines
@@ -208,14 +208,26 @@ static struct or51132_config pchdtv_hd3000 = {
 
 #ifdef HAVE_LGDT330X
 static int lgdt330x_pll_set(struct dvb_frontend* fe,
-                            struct dvb_frontend_parameters* params,
-                            u8* pllbuf)
+                            struct dvb_frontend_parameters* params)
 {
         struct cx8802_dev *dev= fe->dvb->priv;
+        u8 buf[4];
+        struct i2c_msg msg =
+                { .addr = dev->core->pll_addr, .flags = 0, .buf = buf, .len = 4 };
+        int err;
 
-        pllbuf[0] = dev->core->pll_addr;
-        dvb_pll_configure(dev->core->pll_desc, &pllbuf[1],
-                          params->frequency, 0);
+        dvb_pll_configure(dev->core->pll_desc, buf, params->frequency, 0);
+        dprintk(1, "%s: tuner at 0x%02x bytes: 0x%02x 0x%02x 0x%02x 0x%02x\n",
+                        __FUNCTION__, msg.addr, buf[0],buf[1],buf[2],buf[3]);
+        if ((err = i2c_transfer(&dev->core->i2c_adap, &msg, 1)) != 1) {
+                printk(KERN_WARNING "cx88-dvb: %s error "
+                           "(addr %02x <- %02x, err = %i)\n",
+                           __FUNCTION__, buf[0], buf[1], err);
+                if (err < 0)
+                        return err;
+                else
+                        return -EREMOTEIO;
+        }
         return 0;
 }
 
@@ -244,6 +256,8 @@ static int lgdt330x_set_ts_param(struct dvb_frontend* fe, int is_punctured)
 
 static struct lgdt330x_config fusionhdtv_3_gold = {
         .demod_address    = 0x0e,
+        .demod_chip       = LGDT3302,
+        .serial_mpeg      = 0x04, /* TPSERIAL for 3302 in TOP_CONTROL */
         .pll_set          = lgdt330x_pll_set,
         .set_ts_params    = lgdt330x_set_ts_param,
 };
diff --git a/drivers/message/i2o/Kconfig b/drivers/message/i2o/Kconfig
index 06e8eb19a05c..43a942a29c2e 100644
--- a/drivers/message/i2o/Kconfig
+++ b/drivers/message/i2o/Kconfig
@@ -53,6 +53,9 @@ config I2O_CONFIG
           To compile this support as a module, choose M here: the
           module will be called i2o_config.
 
+          Note: If you want to use the new API you have to download the
+          i2o_config patch from http://i2o.shadowconnect.com/
+
 config I2O_CONFIG_OLD_IOCTL
         bool "Enable ioctls (OBSOLETE)"
         depends on I2O_CONFIG
diff --git a/drivers/message/i2o/config-osm.c b/drivers/message/i2o/config-osm.c
index fe2e7afc9eae..af32ab4e90cd 100644
--- a/drivers/message/i2o/config-osm.c
+++ b/drivers/message/i2o/config-osm.c
@@ -30,503 +30,9 @@
 
 static struct i2o_driver i2o_config_driver;
 
-/* Special file operations for sysfs */
-struct fops_attribute {
-        struct bin_attribute bin;
-        struct file_operations fops;
-};
-
-/**
- *      sysfs_read_dummy
- */
-static ssize_t sysfs_read_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                size_t count)
-{
-        return 0;
-};
-
-/**
- *      sysfs_write_dummy
- */
-static ssize_t sysfs_write_dummy(struct kobject *kobj, char *buf, loff_t offset,
-                                 size_t count)
-{
-        return 0;
-};
-
-/**
- *      sysfs_create_fops_file - Creates attribute with special file operations
- *      @kobj: kobject which should contains the attribute
- *      @attr: attributes which should be used to create file
- *
- *      First creates attribute @attr in kobject @kobj. If it is the first time
- *      this function is called, merge old fops from sysfs with new one and
- *      write it back. Afterwords the new fops will be set for the created
- *      attribute.
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static int sysfs_create_fops_file(struct kobject *kobj,
-                                  struct fops_attribute *attr)
-{
-        struct file_operations tmp, *fops;
-        struct dentry *d;
-        struct qstr qstr;
-        int rc;
-
-        fops = &attr->fops;
-
-        if (fops->read)
-                attr->bin.read = sysfs_read_dummy;
-
-        if (fops->write)
-                attr->bin.write = sysfs_write_dummy;
-
-        if ((rc = sysfs_create_bin_file(kobj, &attr->bin)))
-                return rc;
-
-        qstr.name = attr->bin.attr.name;
-        qstr.len = strlen(qstr.name);
-        qstr.hash = full_name_hash(qstr.name, qstr.len);
-
-        if ((d = lookup_hash(&qstr, kobj->dentry))) {
-                if (!fops->owner) {
-                        memcpy(&tmp, d->d_inode->i_fop, sizeof(tmp));
-                        if (fops->read)
-                                tmp.read = fops->read;
-                        if (fops->write)
-                                tmp.write = fops->write;
-                        memcpy(fops, &tmp, sizeof(tmp));
-                }
-
-                d->d_inode->i_fop = fops;
-        } else
-                sysfs_remove_bin_file(kobj, &attr->bin);
-
-        return -ENOENT;
-};
-
-/**
- *      sysfs_remove_fops_file - Remove attribute with special file operations
- *      @kobj: kobject which contains the attribute
- *      @attr: attributes which are used to create file
- *
- *      Only wrapper arround sysfs_remove_bin_file()
- *
- *      Returns 0 on success or negative error code on failure.
- */
-static inline int sysfs_remove_fops_file(struct kobject *kobj,
-                                         struct fops_attribute *attr)
-{
-        return sysfs_remove_bin_file(kobj, &attr->bin);
-};
-
-/**
- *      i2o_config_read_hrt - Returns the HRT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the HRT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the HRT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_hrt(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        i2o_hrt *hrt = c->hrt.virt;
-
-        u32 size = (hrt->num_entries * hrt->entry_len + 2) * 4;
-
-        if (offset > size)
-                return 0;
-
-        if (offset + count > size)
-                count = size - offset;
-
-        memcpy(buf, (u8 *) hrt + offset, count);
-
-        return count;
-};
-
-/**
- *      i2o_config_read_lct - Returns the LCT of the controller
- *      @kob: kernel object handle
- *      @buf: buffer into which the LCT should be copied
- *      @off: file offset
- *      @count: number of bytes to read
- *
- *      Put @count bytes starting at @off into @buf from the LCT of the I2O
- *      controller corresponding to @kobj.
- *
- *      Returns number of bytes copied into buffer.
- */
-static ssize_t i2o_config_read_lct(struct kobject *kobj, char *buf,
-                                   loff_t offset, size_t count)
-{
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 size = c->lct->table_size * 4;
-
-        if (offset > size)
-                return 0;
-
-        if (offset + count > size)
-                count = size - offset;
-
-        memcpy(buf, (u8 *) c->lct + offset, count);
-
-        return count;
-};
-
-#define I2O_CONFIG_SW_ATTR(_name,_mode,_type,_swid) \
-static ssize_t i2o_config_##_name##_read(struct file *file, char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_read(file, buf, count, offset, _type, _swid); \
-};\
-\
-static ssize_t i2o_config_##_name##_write(struct file *file, const char __user *buf, size_t count, loff_t * offset) { \
-        return i2o_config_sw_write(file, buf, count, offset, _type, _swid); \
-}; \
-\
-static struct fops_attribute i2o_config_attr_##_name = { \
-        .bin = { .attr = { .name = __stringify(_name), .mode = _mode, \
-                           .owner = THIS_MODULE }, \
-                 .size = 0, }, \
-        .fops = { .write = i2o_config_##_name##_write, \
-                  .read = i2o_config_##_name##_read} \
-};
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-
-/**
- *      i2o_config_dpt_reagion - Converts type and id to flash region
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Converts type and id from I2O spec to the matching region for DPT /
- *      Adaptec controllers.
- *
- *      Returns region which match type and id or -1 on error.
- */
-static u32 i2o_config_dpt_region(u8 swtype, u8 swid)
-{
-        switch (swtype) {
-        case I2O_SOFTWARE_MODULE_IRTOS:
-                /*
-                 * content: operation firmware
-                 * region size:
-                 *      0xbc000 for 2554, 3754, 2564, 3757
-                 *      0x170000 for 2865
-                 *      0x17c000 for 3966
-                 */
-                if (!swid)
-                        return 0;
-
-                break;
-
-        case I2O_SOFTWARE_MODULE_IOP_PRIVATE:
-                /*
-                 * content: BIOS and SMOR
-                 * BIOS size: first 0x8000 bytes
-                 * region size:
-                 *      0x40000 for 2554, 3754, 2564, 3757
-                 *      0x80000 for 2865, 3966
-                 */
-                if (!swid)
-                        return 1;
-
-                break;
-
-        case I2O_SOFTWARE_MODULE_IOP_CONFIG:
-                switch (swid) {
-                case 0:
-                        /*
-                         * content: NVRAM defaults
-                         * region size: 0x2000 bytes
-                         */
-                        return 2;
-                case 1:
-                        /*
-                         * content: serial number
-                         * region size: 0x2000 bytes
-                         */
-                        return 3;
-                }
-                break;
-        }
-
-        return -1;
-};
-
-#endif
-
-/**
- *      i2o_config_sw_read - Read a software module from controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module reading
- *      @swid: id of software which should be read
- *
- *      Transfers @count bytes at offset @offset from IOP into buffer using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied into buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_read(struct file *file, char __user * buf,
-                                  size_t count, loff_t * offset, u8 swtype,
-                                  u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_UPLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-
-        mptr = &msg->body[3];
-
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL))) {
-                i2o_msg_nop(c, m);
-                return rc;
-        }
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_READ,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-
-        writel(0xD0000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-
-        if (status == I2O_POST_WAIT_OK) {
-                if (!(rc = copy_to_user(buf, buffer.virt, count))) {
-                        rc = count;
-                        *offset += count;
-                }
-        } else
-                rc = -EIO;
-
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-
-        return rc;
-};
-
-/**
- *      i2o_config_sw_write - Write a software module to controller
- *      @file: file pointer
- *      @buf: buffer into which the data should be copied
- *      @count: number of bytes to read
- *      @off: file offset
- *      @swtype: type of software module writing
- *      @swid: id of software which should be written
- *
- *      Transfers @count bytes at offset @offset from buffer to IOP using
- *      type @swtype and id @swid as described in I2O spec.
- *
- *      Returns number of bytes copied from buffer or error code on failure.
- */
-static ssize_t i2o_config_sw_write(struct file *file, const char __user * buf,
-                                   size_t count, loff_t * offset, u8 swtype,
-                                   u32 swid)
-{
-        struct sysfs_dirent *sd = file->f_dentry->d_parent->d_fsdata;
-        struct kobject *kobj = sd->s_element;
-        struct i2o_controller *c = kobj_to_i2o_device(kobj)->iop;
-        u32 m, function = I2O_CMD_SW_DOWNLOAD;
-        struct i2o_dma buffer;
-        struct i2o_message __iomem *msg;
-        u32 __iomem *mptr;
-        int rc, status;
-
-        m = i2o_msg_get_wait(c, &msg, I2O_TIMEOUT_MESSAGE_GET);
-        if (m == I2O_QUEUE_EMPTY)
-                return -EBUSY;
-
-        mptr = &msg->body[3];
-
-        if ((rc = i2o_dma_alloc(&c->pdev->dev, &buffer, count, GFP_KERNEL)))
-                goto nop_msg;
-
-        if ((rc = copy_from_user(buffer.virt, buf, count)))
-                goto free_buffer;
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                mptr = &msg->body[4];
-                function = I2O_CMD_PRIVATE;
-
-                writel(TEN_WORD_MSG_SIZE | SGL_OFFSET_8, &msg->u.head[0]);
-
-                writel(I2O_VENDOR_DPT << 16 | I2O_DPT_FLASH_WRITE,
-                       &msg->body[0]);
-                writel(i2o_config_dpt_region(swtype, swid), &msg->body[1]);
-                writel(*offset, &msg->body[2]);
-                writel(count, &msg->body[3]);
-        } else
-#endif
-                writel(NINE_WORD_MSG_SIZE | SGL_OFFSET_7, &msg->u.head[0]);
-
-        writel(0xD4000000 | count, mptr++);
-        writel(buffer.phys, mptr);
-
-        writel(function << 24 | HOST_TID << 12 | ADAPTER_TID, &msg->u.head[1]);
-        writel(i2o_config_driver.context, &msg->u.head[2]);
-        writel(0, &msg->u.head[3]);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (!c->adaptec)
-#endif
-        {
-                writel((u32) swtype << 16 | (u32) 1 << 8, &msg->body[0]);
-                writel(0, &msg->body[1]);
-                writel(swid, &msg->body[2]);
-        }
-
-        status = i2o_msg_post_wait_mem(c, m, 60, &buffer);
-
-        if (status != -ETIMEDOUT)
-                i2o_dma_free(&c->pdev->dev, &buffer);
-
-        if (status != I2O_POST_WAIT_OK)
-                return -EIO;
-
-        *offset += count;
-
-        return count;
-
-      free_buffer:
-        i2o_dma_free(&c->pdev->dev, &buffer);
-
-      nop_msg:
-        i2o_msg_nop(c, m);
-
-        return rc;
-};
-
-/* attribute for HRT in sysfs */
-static struct bin_attribute i2o_config_hrt_attr = {
-        .attr = {
-                 .name = "hrt",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_hrt
-};
-
-/* attribute for LCT in sysfs */
-static struct bin_attribute i2o_config_lct_attr = {
-        .attr = {
-                 .name = "lct",
-                 .mode = S_IRUGO,
-                 .owner = THIS_MODULE},
-        .size = 0,
-        .read = i2o_config_read_lct
-};
-
-/* IRTOS firmware access */
-I2O_CONFIG_SW_ATTR(irtos, S_IWRSR, I2O_SOFTWARE_MODULE_IRTOS, 0);
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-
-/*
- * attribute for BIOS / SMOR, nvram and serial number access on DPT / Adaptec
- * controllers
- */
-I2O_CONFIG_SW_ATTR(bios, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_PRIVATE, 0);
-I2O_CONFIG_SW_ATTR(nvram, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 0);
-I2O_CONFIG_SW_ATTR(serial, S_IWRSR, I2O_SOFTWARE_MODULE_IOP_CONFIG, 1);
-
-#endif
-
-/**
- *      i2o_config_notify_controller_add - Notify of added controller
- *      @c: the controller which was added
- *
- *      If a I2O controller is added, we catch the notification to add sysfs
- *      entries.
- */
-static void i2o_config_notify_controller_add(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-
-        sysfs_create_bin_file(kobj, &i2o_config_hrt_attr);
-        sysfs_create_bin_file(kobj, &i2o_config_lct_attr);
-
-        sysfs_create_fops_file(kobj, &i2o_config_attr_irtos);
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_create_fops_file(kobj, &i2o_config_attr_bios);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_create_fops_file(kobj, &i2o_config_attr_serial);
-        }
-#endif
-};
-
-/**
- *      i2o_config_notify_controller_remove - Notify of removed controller
- *      @c: the controller which was removed
- *
- *      If a I2O controller is removed, we catch the notification to remove the
- *      sysfs entries.
- */
-static void i2o_config_notify_controller_remove(struct i2o_controller *c)
-{
-        struct kobject *kobj = &c->exec->device.kobj;
-
-#ifdef CONFIG_I2O_EXT_ADAPTEC
-        if (c->adaptec) {
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_serial);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_nvram);
-                sysfs_remove_fops_file(kobj, &i2o_config_attr_bios);
-        }
-#endif
-        sysfs_remove_fops_file(kobj, &i2o_config_attr_irtos);
-
-        sysfs_remove_bin_file(kobj, &i2o_config_lct_attr);
-        sysfs_remove_bin_file(kobj, &i2o_config_hrt_attr);
-};
-
 /* Config OSM driver struct */
 static struct i2o_driver i2o_config_driver = {
         .name = OSM_NAME,
-        .notify_controller_add = i2o_config_notify_controller_add,
-        .notify_controller_remove = i2o_config_notify_controller_remove
 };
 
 #ifdef CONFIG_I2O_CONFIG_OLD_IOCTL
diff --git a/drivers/message/i2o/pci.c b/drivers/message/i2o/pci.c
index 7a60fd7be8ad..66c03e882570 100644
--- a/drivers/message/i2o/pci.c
+++ b/drivers/message/i2o/pci.c
@@ -32,6 +32,8 @@
 #include <linux/i2o.h>
 #include "core.h"
 
+#define OSM_DESCRIPTION "I2O-subsystem"
+
 /* PCI device id table for all I2O controllers */
 static struct pci_device_id __devinitdata i2o_pci_ids[] = {
         {PCI_DEVICE_CLASS(PCI_CLASS_INTELLIGENT_I2O << 8, 0xffff00)},
@@ -66,6 +68,8 @@ static void i2o_pci_free(struct i2o_controller *c)
 
         if (c->base.virt)
                 iounmap(c->base.virt);
+
+        pci_release_regions(c->pdev);
 }
 
 /**
@@ -84,6 +88,11 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
         struct device *dev = &pdev->dev;
         int i;
 
+        if (pci_request_regions(pdev, OSM_DESCRIPTION)) {
+                printk(KERN_ERR "%s: device already claimed\n", c->name);
+                return -ENODEV;
+        }
+
         for (i = 0; i < 6; i++) {
                 /* Skip I/O spaces */
                 if (!(pci_resource_flags(pdev, i) & IORESOURCE_IO)) {
@@ -138,6 +147,7 @@ static int __devinit i2o_pci_alloc(struct i2o_controller *c)
         c->base.virt = ioremap_nocache(c->base.phys, c->base.len);
         if (!c->base.virt) {
                 printk(KERN_ERR "%s: Unable to map controller.\n", c->name);
+                i2o_pci_free(c);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 201a550f0bcc..368b8fb14023 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -66,8 +66,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.34"
-#define DRV_MODULE_RELDATE      "July 25, 2005"
+#define DRV_MODULE_VERSION      "3.35"
+#define DRV_MODULE_RELDATE      "August 6, 2005"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -10421,6 +10421,12 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         tg3_init_coal(tp);
 
+        /* Now that we have fully setup the chip, save away a snapshot
+         * of the PCI config space.  We need to restore this after
+         * GRC_MISC_CFG core clock resets and some resume events.
+         */
+        pci_save_state(tp->pdev);
+
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR PFX "Cannot register net device, "
@@ -10430,12 +10436,6 @@ static int __devinit tg3_init_one(struct pci_dev *pdev,
 
         pci_set_drvdata(pdev, dev);
 
-        /* Now that we have fully setup the chip, save away a snapshot
-         * of the PCI config space.  We need to restore this after
-         * GRC_MISC_CFG core clock resets and some resume events.
-         */
-        pci_save_state(tp->pdev);
-
         printk(KERN_INFO "%s: Tigon3 [partno(%s) rev %04x PHY(%s)] (PCI%s:%s:%s) %sBaseT Ethernet ",
                dev->name,
                tp->board_part_number,
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 8d0968bd527e..a9160ad16581 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -373,6 +373,25 @@ static void __devinit quirk_vt82c686_acpi(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_82C686_4,     quirk_vt82c686_acpi );
 
+/*
+ * VIA VT8235 ISA Bridge: Two IO regions pointed to by words at
+ *      0x88 (128 bytes of power management registers)
+ *      0xd0 (16 bytes of SMB registers)
+ */
+static void __devinit quirk_vt8235_acpi(struct pci_dev *dev)
+{
+        u16 pm, smb;
+
+        pci_read_config_word(dev, 0x88, &pm);
+        pm &= PCI_BASE_ADDRESS_IO_MASK;
+        quirk_io_region(dev, pm, 128, PCI_BRIDGE_RESOURCES);
+
+        pci_read_config_word(dev, 0xd0, &smb);
+        smb &= PCI_BASE_ADDRESS_IO_MASK;
+        quirk_io_region(dev, smb, 16, PCI_BRIDGE_RESOURCES + 1);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,     PCI_DEVICE_ID_VIA_8235, quirk_vt8235_acpi);
+
 
 #ifdef CONFIG_X86_IO_APIC 
 
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 1ca21d2ba11c..84eedc965688 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -33,6 +33,11 @@ pci_update_resource(struct pci_dev *dev, struct resource *res, int resno)
         u32 new, check, mask;
         int reg;
 
+        /* Ignore resources for unimplemented BARs and unused resource slots
+           for 64 bit BARs. */
+        if (!res->flags)
+                return;
+
         pcibios_resource_to_bus(dev, &region, res);
 
         pr_debug("  got res [%lx:%lx] bus [%lx:%lx] flags %lx for "
@@ -67,7 +72,7 @@ pci_update_resource(struct pci_dev *dev, struct resource *res, int resno)
 
         if ((new & (PCI_BASE_ADDRESS_SPACE|PCI_BASE_ADDRESS_MEM_TYPE_MASK)) ==
             (PCI_BASE_ADDRESS_SPACE_MEMORY|PCI_BASE_ADDRESS_MEM_TYPE_64)) {
-                new = 0; /* currently everyone zeros the high address */
+                new = region.start >> 16 >> 16;
                 pci_write_config_dword(dev, reg + 4, new);
                 pci_read_config_dword(dev, reg + 4, &check);
                 if (check != new) {
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 91e7457d5b04..62fd705203fb 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -605,9 +605,8 @@ static int yenta_search_res(struct yenta_socket *socket, struct resource *res,
 
 static void yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned type, int addr_start, int addr_end)
 {
-        struct pci_bus *bus;
         struct resource *root, *res;
-        u32 start, end;
+        struct pci_bus_region region;
         unsigned mask;
 
         res = socket->dev->resource + PCI_BRIDGE_RESOURCES + nr;
@@ -620,15 +619,13 @@ static void yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned typ
         if (type & IORESOURCE_IO)
                 mask = ~3;
 
-        bus = socket->dev->subordinate;
-        res->name = bus->name;
+        res->name = socket->dev->subordinate->name;
         res->flags = type;
 
-        start = config_readl(socket, addr_start) & mask;
-        end = config_readl(socket, addr_end) | ~mask;
-        if (start && end > start && !override_bios) {
-                res->start = start;
-                res->end = end;
+        region.start = config_readl(socket, addr_start) & mask;
+        region.end = config_readl(socket, addr_end) | ~mask;
+        if (region.start && region.end > region.start && !override_bios) {
+                pcibios_bus_to_resource(socket->dev, res, &region);
                 root = pci_find_parent_resource(socket->dev, res);
                 if (root && (request_resource(root, res) == 0))
                         return;
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index 8f4d2999af8e..79c74f3a11f5 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8120,20 +8120,22 @@ static struct notifier_block qeth_ip6_notifier = {
 #endif
 
 static int
-qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
+__qeth_reboot_event_card(struct device *dev, void *data)
 {
-
-        struct device *entry;
         struct qeth_card *card;
 
-        down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
-               list_for_each_entry(entry, &qeth_ccwgroup_driver.driver.devices,
-                                   driver_list) {
-                       card = (struct qeth_card *) entry->driver_data;
-                       qeth_clear_ip_list(card, 0, 0);
-                       qeth_qdio_clear_card(card, 0);
-               }
-        up_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
+        card = (struct qeth_card *) dev->driver_data;
+        qeth_clear_ip_list(card, 0, 0);
+        qeth_qdio_clear_card(card, 0);
+        return 0;
+}
+
+static int
+qeth_reboot_event(struct notifier_block *this, unsigned long event, void *ptr)
+{
+
+        driver_for_each_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                               __qeth_reboot_event_card);
         return NOTIFY_DONE;
 }
 
diff --git a/drivers/s390/net/qeth_proc.c b/drivers/s390/net/qeth_proc.c
index 04719196fd20..f2ccfea8fdb8 100644
--- a/drivers/s390/net/qeth_proc.c
+++ b/drivers/s390/net/qeth_proc.c
@@ -27,23 +27,33 @@ const char *VERSION_QETH_PROC_C = "$Revision: 1.13 $";
 #define QETH_PROCFILE_NAME "qeth"
 static struct proc_dir_entry *qeth_procfile;
 
+static int
+qeth_procfile_seq_match(struct device *dev, void *data)
+{
+        return 1;
+}
+
 static void *
 qeth_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev;
+        loff_t nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
 
-        if (*offset == 0)
+        nr = *offset;
+        if (nr == 0)
                 return SEQ_START_TOKEN;
 
-        /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices)
-                if (++i == *offset)
-                        return next_card;
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL,
+                                 NULL, qeth_procfile_seq_match);
 
-        return NULL;
+        /* get card at pos *offset */
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -55,23 +65,21 @@ qeth_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        struct list_head *current_card;
+        struct device *prev, *next;
 
         if (it == SEQ_START_TOKEN) {
-                next_card = qeth_ccwgroup_driver.driver.devices.next;
-                if (next_card->next == next_card) /* list empty */
-                        return NULL;
-                (*offset)++;
-        } else {
-                current_card = (struct list_head *)it;
-                if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                        return NULL; /* end of list reached */
-                next_card = current_card->next;
-                (*offset)++;
+                next = driver_find_device(&qeth_ccwgroup_driver.driver,
+                                          NULL, NULL, qeth_procfile_seq_match);
+                if (next)
+                        (*offset)++;
+                return (void *) next;
         }
-
-        return next_card;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver,
+                                  prev, NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static inline const char *
@@ -126,7 +134,7 @@ qeth_procfile_seq_show(struct seq_file *s, void *it)
                               "-------------- ---- ------ ---------- ---- "
                               "---- ----- -----\n");
         } else {
-                device = list_entry(it, struct device, driver_list);
+                device = (struct device *) it;
                 card = device->driver_data;
                 seq_printf(s, "%s/%s/%s x%02X   %-10s %-14s %-4i ",
                                 CARD_RDEV_ID(card),
@@ -180,17 +188,20 @@ static struct proc_dir_entry *qeth_perf_procfile;
 static void *
 qeth_perf_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev = NULL;
+        int nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
         /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices){
-                if (i == *offset)
-                        return next_card;
-                i++;
-        }
-        return NULL;
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                                 qeth_procfile_seq_match);
+
+        /* get card at pos *offset */
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -202,12 +213,14 @@ qeth_perf_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_perf_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *current_card = (struct list_head *)it;
+        struct device *prev, *next;
 
-        if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                return NULL; /* end of list reached */
-        (*offset)++;
-        return current_card->next;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
+                                  NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static int
@@ -216,7 +229,7 @@ qeth_perf_procfile_seq_show(struct seq_file *s, void *it)
         struct device *device;
         struct qeth_card *card;
 
-        device = list_entry(it, struct device, driver_list);
+        device = (struct device *) it;
         card = device->driver_data;
         seq_printf(s, "For card with devnos %s/%s/%s (%s):\n",
                         CARD_RDEV_ID(card),
@@ -318,8 +331,8 @@ static struct proc_dir_entry *qeth_ipato_procfile;
 static void *
 qeth_ipato_procfile_seq_start(struct seq_file *s, loff_t *offset)
 {
-        struct list_head *next_card = NULL;
-        int i = 0;
+        struct device *dev;
+        loff_t nr;
 
         down_read(&qeth_ccwgroup_driver.driver.bus->subsys.rwsem);
         /* TODO: finish this */
@@ -328,13 +341,16 @@ qeth_ipato_procfile_seq_start(struct seq_file *s, loff_t *offset)
          * output driver settings then;
          * else output setting for respective card
          */
+
+        dev = driver_find_device(&qeth_ccwgroup_driver.driver, NULL, NULL,
+                                 qeth_procfile_seq_match);
+
         /* get card at pos *offset */
-        list_for_each(next_card, &qeth_ccwgroup_driver.driver.devices){
-                if (i == *offset)
-                        return next_card;
-                i++;
-        }
-        return NULL;
+        nr = *offset;
+        while (nr-- > 1 && dev)
+                dev = driver_find_device(&qeth_ccwgroup_driver.driver, dev,
+                                         NULL, qeth_procfile_seq_match);
+        return (void *) dev;
 }
 
 static void
@@ -346,18 +362,14 @@ qeth_ipato_procfile_seq_stop(struct seq_file *s, void* it)
 static void *
 qeth_ipato_procfile_seq_next(struct seq_file *s, void *it, loff_t *offset)
 {
-        struct list_head *current_card = (struct list_head *)it;
+        struct device *prev, *next;
 
-        /* TODO: finish this */
-        /*
-         * maybe SEQ_SATRT_TOKEN can be returned for offset 0
-         * output driver settings then;
-         * else output setting for respective card
-         */
-        if (current_card->next == &qeth_ccwgroup_driver.driver.devices)
-                return NULL; /* end of list reached */
-        (*offset)++;
-        return current_card->next;
+        prev = (struct device *) it;
+        next = driver_find_device(&qeth_ccwgroup_driver.driver, prev,
+                                  NULL, qeth_procfile_seq_match);
+        if (next)
+                (*offset)++;
+        return (void *) next;
 }
 
 static int
@@ -372,7 +384,7 @@ qeth_ipato_procfile_seq_show(struct seq_file *s, void *it)
          * output driver settings then;
          * else output setting for respective card
          */
-        device = list_entry(it, struct device, driver_list);
+        device = (struct device *) it;
         card = device->driver_data;
 
         return 0;
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index b8a2c7353b0a..d44205d52bf3 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -7,6 +7,7 @@
 #define __KERNEL_SYSCALLS__
 
 #include <linux/kernel.h>
+#include <linux/kthread.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -459,10 +460,6 @@ static struct task_struct *kenvctrld_task;
 
 static int kenvctrld(void *__unused)
 {
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-        kenvctrld_task = current;
-
         printk(KERN_INFO "bbc_envctrl: kenvctrld starting...\n");
         last_warning_jiffies = jiffies - WARN_INTERVAL;
         for (;;) {
@@ -470,7 +467,7 @@ static int kenvctrld(void *__unused)
                 struct bbc_fan_control *fp;
 
                 msleep_interruptible(POLL_INTERVAL);
-                if (signal_pending(current))
+                if (kthread_should_stop())
                         break;
 
                 for (tp = all_bbc_temps; tp; tp = tp->next) {
@@ -577,7 +574,6 @@ int bbc_envctrl_init(void)
         int temp_index = 0;
         int fan_index = 0;
         int devidx = 0;
-        int err = 0;
 
         while ((echild = bbc_i2c_getdev(devidx++)) != NULL) {
                 if (!strcmp(echild->prom_name, "temperature"))
@@ -585,9 +581,13 @@ int bbc_envctrl_init(void)
                 if (!strcmp(echild->prom_name, "fan-control"))
                         attach_one_fan(echild, fan_index++);
         }
-        if (temp_index != 0 && fan_index != 0)
-                err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
-        return err;
+        if (temp_index != 0 && fan_index != 0) {
+                kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
+                if (IS_ERR(kenvctrld_task))
+                        return PTR_ERR(kenvctrld_task);
+        }
+
+        return 0;
 }
 
 static void destroy_one_temp(struct bbc_cpu_temperature *tp)
@@ -607,26 +607,7 @@ void bbc_envctrl_cleanup(void)
         struct bbc_cpu_temperature *tp;
         struct bbc_fan_control *fp;
 
-        if (kenvctrld_task != NULL) {
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-                        if (!found)
-                                break;
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
+        kthread_stop(kenvctrld_task);
 
         tp = all_bbc_temps;
         while (tp != NULL) {
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 9a8c572554f5..d765cc1bf060 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -24,6 +24,7 @@
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
@@ -1010,16 +1011,13 @@ static int kenvctrld(void *__unused)
 
         poll_interval = 5000; /* TODO env_mon_interval */
 
-        daemonize("kenvctrld");
-        allow_signal(SIGKILL);
-
-        kenvctrld_task = current;
-
         printk(KERN_INFO "envctrl: %s starting...\n", current->comm);
         for (;;) {
-                if(msleep_interruptible(poll_interval))
-                        break;
+                msleep_interruptible(poll_interval);
 
+                if (kthread_should_stop())
+                        break;
+                
                 for (whichcpu = 0; whichcpu < ENVCTRL_MAX_CPU; ++whichcpu) {
                         if (0 < envctrl_read_cpu_info(whichcpu, cputemp,
                                                       ENVCTRL_CPUTEMP_MON,
@@ -1041,7 +1039,6 @@ static int kenvctrld(void *__unused)
 
 static int __init envctrl_init(void)
 {
-#ifdef CONFIG_PCI
         struct linux_ebus *ebus = NULL;
         struct linux_ebus_device *edev = NULL;
         struct linux_ebus_child *edev_child = NULL;
@@ -1118,9 +1115,11 @@ done:
                         i2c_childlist[i].addr, (0 == i) ? ("\n") : (" "));
         }
 
-        err = kernel_thread(kenvctrld, NULL, CLONE_FS | CLONE_FILES);
-        if (err < 0)
+        kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
+        if (IS_ERR(kenvctrld_task)) {
+                err = PTR_ERR(kenvctrld_task);
                 goto out_deregister;
+        }
 
         return 0;
 
@@ -1133,37 +1132,13 @@ out_iounmap:
                         kfree(i2c_childlist[i].tables);
         }
         return err;
-#else
-        return -ENODEV;
-#endif
 }
 
 static void __exit envctrl_cleanup(void)
 {
         int i;
 
-        if (NULL != kenvctrld_task) {
-                force_sig(SIGKILL, kenvctrld_task);
-                for (;;) {
-                        struct task_struct *p;
-                        int found = 0;
-
-                        read_lock(&tasklist_lock);
-                        for_each_process(p) {
-                                if (p == kenvctrld_task) {
-                                        found = 1;
-                                        break;
-                                }
-                        }
-                        read_unlock(&tasklist_lock);
-
-                        if (!found)
-                                break;
-
-                        msleep(1000);
-                }
-                kenvctrld_task = NULL;
-        }
+        kthread_stop(kenvctrld_task);
 
         iounmap(i2c);
         misc_deregister(&envctrl_dev);
diff --git a/drivers/sbus/char/vfc.h b/drivers/sbus/char/vfc.h
index e56a43af0f62..a7782e7da42e 100644
--- a/drivers/sbus/char/vfc.h
+++ b/drivers/sbus/char/vfc.h
@@ -129,8 +129,6 @@ struct vfc_dev {
         struct vfc_regs *phys_regs;
         unsigned int control_reg;
         struct semaphore device_lock_sem;
-        struct timer_list poll_timer;
-        wait_queue_head_t poll_wait;
         int instance;
         int busy;
         unsigned long which_io;
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 86ce54130954..7a103698fa3c 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -137,7 +137,6 @@ int init_vfc_devstruct(struct vfc_dev *dev, int instance)
         dev->instance=instance;
         init_MUTEX(&dev->device_lock_sem);
         dev->control_reg=0;
-        init_waitqueue_head(&dev->poll_wait);
         dev->busy=0;
         return 0;
 }
diff --git a/drivers/sbus/char/vfc_i2c.c b/drivers/sbus/char/vfc_i2c.c
index 1faf1e75f71f..739cad9b19a1 100644
--- a/drivers/sbus/char/vfc_i2c.c
+++ b/drivers/sbus/char/vfc_i2c.c
@@ -79,25 +79,10 @@ int vfc_pcf8584_init(struct vfc_dev *dev)
         return 0;
 }
 
-void vfc_i2c_delay_wakeup(struct vfc_dev *dev) 
-{
-        /* Used to profile code and eliminate too many delays */
-        VFC_I2C_DEBUG_PRINTK(("vfc%d: Delaying\n", dev->instance));
-        wake_up(&dev->poll_wait);
-}
-
 void vfc_i2c_delay_no_busy(struct vfc_dev *dev, unsigned long usecs) 
 {
-        DEFINE_WAIT(wait);
-        init_timer(&dev->poll_timer);
-        dev->poll_timer.expires = jiffies + usecs_to_jiffies(usecs);
-        dev->poll_timer.data=(unsigned long)dev;
-        dev->poll_timer.function=(void *)(unsigned long)vfc_i2c_delay_wakeup;
-        add_timer(&dev->poll_timer);
-        prepare_to_wait(&dev->poll_wait, &wait, TASK_UNINTERRUPTIBLE);
-        schedule();
-        del_timer(&dev->poll_timer);
-        finish_wait(&dev->poll_wait, &wait);
+        set_current_state(TASK_UNINTERRUPTIBLE);
+        schedule_timeout(usecs_to_jiffies(usecs));
 }
 
 void inline vfc_i2c_delay(struct vfc_dev *dev) 
diff --git a/drivers/scsi/aic7xxx/aic7xxx_osm.c b/drivers/scsi/aic7xxx/aic7xxx_osm.c
index 116d0f51ca2c..687f19e9cf03 100644
--- a/drivers/scsi/aic7xxx/aic7xxx_osm.c
+++ b/drivers/scsi/aic7xxx/aic7xxx_osm.c
@@ -1264,14 +1264,12 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
         }
         switch ((dev->flags & (AHC_DEV_Q_BASIC|AHC_DEV_Q_TAGGED))) {
         case AHC_DEV_Q_BASIC:
-                scsi_adjust_queue_depth(sdev,
-                                        MSG_SIMPLE_TASK,
-                                        dev->openings + dev->active);
+                scsi_set_tag_type(sdev, MSG_SIMPLE_TAG);
+                scsi_activate_tcq(sdev, dev->openings + dev->active);
                 break;
         case AHC_DEV_Q_TAGGED:
-                scsi_adjust_queue_depth(sdev,
-                                        MSG_ORDERED_TASK,
-                                        dev->openings + dev->active);
+                scsi_set_tag_type(sdev, MSG_ORDERED_TAG);
+                scsi_activate_tcq(sdev, dev->openings + dev->active);
                 break;
         default:
                 /*
@@ -1280,9 +1278,7 @@ ahc_platform_set_tags(struct ahc_softc *ahc, struct ahc_devinfo *devinfo,
                  * serially on the controller/device.  This should
                  * remove some latency.
                  */
-                scsi_adjust_queue_depth(sdev,
-                                        /*NON-TAGGED*/0,
-                                        /*queue depth*/2);
+                scsi_deactivate_tcq(sdev, 2);
                 break;
         }
 }
@@ -1635,9 +1631,9 @@ ahc_send_async(struct ahc_softc *ahc, char channel,
                 spi_period(starget) = tinfo->curr.period;
                 spi_width(starget) = tinfo->curr.width;
                 spi_offset(starget) = tinfo->curr.offset;
-                spi_dt(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_DT_REQ;
-                spi_qas(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_QAS_REQ;
-                spi_iu(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_IU_REQ;
+                spi_dt(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_DT_REQ ? 1 : 0;
+                spi_qas(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_QAS_REQ ? 1 : 0;
+                spi_iu(starget) = tinfo->curr.ppr_options & MSG_EXT_PPR_IU_REQ ? 1 : 0;
                 spi_display_xfer_agreement(starget);
                 break;
         }
@@ -2429,12 +2425,14 @@ static void ahc_linux_set_dt(struct scsi_target *starget, int dt)
         unsigned int ppr_options = tinfo->goal.ppr_options
                 & ~MSG_EXT_PPR_DT_REQ;
         unsigned int period = tinfo->goal.period;
+        unsigned int width = tinfo->goal.width;
         unsigned long flags;
         struct ahc_syncrate *syncrate;
 
         if (dt) {
-                period = 9;     /* 12.5ns is the only period valid for DT */
                 ppr_options |= MSG_EXT_PPR_DT_REQ;
+                if (!width)
+                        ahc_linux_set_width(starget, 1);
         } else if (period == 9)
                 period = 10;    /* if resetting DT, period must be >= 25ns */
 
diff --git a/drivers/scsi/ibmvscsi/srp.h b/drivers/scsi/ibmvscsi/srp.h
index 2ae5154fd89c..7d8e4c4accb9 100644
--- a/drivers/scsi/ibmvscsi/srp.h
+++ b/drivers/scsi/ibmvscsi/srp.h
@@ -35,7 +35,7 @@
 enum srp_types {
         SRP_LOGIN_REQ_TYPE = 0x00,
         SRP_LOGIN_RSP_TYPE = 0xC0,
-        SRP_LOGIN_REJ_TYPE = 0x80,
+        SRP_LOGIN_REJ_TYPE = 0xC2,
         SRP_I_LOGOUT_TYPE = 0x03,
         SRP_T_LOGOUT_TYPE = 0x80,
         SRP_TSK_MGMT_TYPE = 0x01,
diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c
index 6dfcb4fbccdd..4cdd891781b1 100644
--- a/drivers/scsi/ips.c
+++ b/drivers/scsi/ips.c
@@ -133,10 +133,12 @@
 /* 6.10.00  - Remove 1G Addressing Limitations                               */
 /* 6.11.xx  - Get VersionInfo buffer off the stack !              DDTS 60401 */
 /* 6.11.xx  - Make Logical Drive Info structure safe for DMA      DDTS 60639 */
-/* 7.10.xx  - Add highmem_io flag in SCSI Templete for 2.4 kernels           */
+/* 7.10.18  - Add highmem_io flag in SCSI Templete for 2.4 kernels           */
 /*          - Fix path/name for scsi_hosts.h include for 2.6 kernels         */
 /*          - Fix sort order of 7k                                           */
 /*          - Remove 3 unused "inline" functions                             */
+/* 7.12.xx  - Use STATIC functions whereever possible                        */
+/*          - Clean up deprecated MODULE_PARM calls                          */
 /*****************************************************************************/
 
 /*
@@ -207,8 +209,8 @@ module_param(ips, charp, 0);
 /*
  * DRIVER_VER
  */
-#define IPS_VERSION_HIGH        "7.10"
-#define IPS_VERSION_LOW         ".18 "
+#define IPS_VERSION_HIGH        "7.12"
+#define IPS_VERSION_LOW         ".02 "
 
 #if !defined(__i386__) && !defined(__ia64__) && !defined(__x86_64__)
 #warning "This driver has only been tested on the x86/ia64/x86_64 platforms"
diff --git a/drivers/scsi/ips.h b/drivers/scsi/ips.h
index 480e06f4d6ae..505e967013de 100644
--- a/drivers/scsi/ips.h
+++ b/drivers/scsi/ips.h
@@ -87,15 +87,14 @@
       #define scsi_set_pci_device(sh,dev) (0)
    #endif
 
-   #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
-   
-      #ifndef irqreturn_t
-         typedef void irqreturn_t;
-      #endif 
-      
+   #ifndef IRQ_NONE
+      typedef void irqreturn_t;
       #define IRQ_NONE
       #define IRQ_HANDLED
       #define IRQ_RETVAL(x)
+   #endif
+   
+   #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
       #define IPS_REGISTER_HOSTS(SHT)      scsi_register_module(MODULE_SCSI_HA,SHT)
       #define IPS_UNREGISTER_HOSTS(SHT)    scsi_unregister_module(MODULE_SCSI_HA,SHT)
       #define IPS_ADD_HOST(shost,device)
@@ -123,6 +122,10 @@
    #ifndef min
       #define min(x,y) ((x) < (y) ? x : y)
    #endif
+   
+   #ifndef __iomem       /* For clean compiles in earlier kernels without __iomem annotations */
+      #define __iomem
+   #endif
 
    #define pci_dma_hi32(a)         ((a >> 16) >> 16)
    #define pci_dma_lo32(a)         (a & 0xffffffff)
@@ -1206,13 +1209,13 @@ typedef struct {
 
 #define IPS_VER_MAJOR 7
 #define IPS_VER_MAJOR_STRING "7"
-#define IPS_VER_MINOR 10
-#define IPS_VER_MINOR_STRING "10"
-#define IPS_VER_BUILD 18
-#define IPS_VER_BUILD_STRING "18"
-#define IPS_VER_STRING "7.10.18"
+#define IPS_VER_MINOR 12
+#define IPS_VER_MINOR_STRING "12"
+#define IPS_VER_BUILD 02
+#define IPS_VER_BUILD_STRING "02"
+#define IPS_VER_STRING "7.12.02"
 #define IPS_RELEASE_ID 0x00020000
-#define IPS_BUILD_IDENT 731
+#define IPS_BUILD_IDENT 761
 #define IPS_LEGALCOPYRIGHT_STRING "(C) Copyright IBM Corp. 1994, 2002. All Rights Reserved."
 #define IPS_ADAPTECCOPYRIGHT_STRING "(c) Copyright Adaptec, Inc. 2002 to 2004. All Rights Reserved."
 #define IPS_DELLCOPYRIGHT_STRING "(c) Copyright Dell 2004. All Rights Reserved."
@@ -1223,12 +1226,12 @@ typedef struct {
 #define IPS_VER_SERVERAID2 "2.88.13"
 #define IPS_VER_NAVAJO "2.88.13"
 #define IPS_VER_SERVERAID3 "6.10.24"
-#define IPS_VER_SERVERAID4H "7.10.11"
-#define IPS_VER_SERVERAID4MLx "7.10.18"
-#define IPS_VER_SARASOTA "7.10.18"
-#define IPS_VER_MARCO "7.10.18"
-#define IPS_VER_SEBRING "7.10.18"
-#define IPS_VER_KEYWEST "7.10.18"
+#define IPS_VER_SERVERAID4H "7.12.02"
+#define IPS_VER_SERVERAID4MLx "7.12.02"
+#define IPS_VER_SARASOTA "7.12.02"
+#define IPS_VER_MARCO "7.12.02"
+#define IPS_VER_SEBRING "7.12.02"
+#define IPS_VER_KEYWEST "7.12.02"
 
 /* Compatability IDs for various adapters */
 #define IPS_COMPAT_UNKNOWN ""
diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index 0291a8fb654d..0a7839db5752 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4149,12 +4149,10 @@ static int __init init_st(void)
                         do_create_driverfs_files();
                         return 0;
                 }
-                if (st_sysfs_class)
-                        class_destroy(st_sysfs_class);
                 unregister_chrdev_region(MKDEV(SCSI_TAPE_MAJOR, 0),
-
                                          ST_MAX_TAPE_ENTRIES);
         }
+        class_destroy(st_sysfs_class);
 
         printk(KERN_ERR "Unable to get major %d for SCSI tapes\n", SCSI_TAPE_MAJOR);
         return 1;
@@ -4162,13 +4160,11 @@ static int __init init_st(void)
 
 static void __exit exit_st(void)
 {
-        if (st_sysfs_class)
-                class_destroy(st_sysfs_class);
-        st_sysfs_class = NULL;
         do_remove_driverfs_files();
         scsi_unregister_driver(&st_template.gendrv);
         unregister_chrdev_region(MKDEV(SCSI_TAPE_MAJOR, 0),
                                  ST_MAX_TAPE_ENTRIES);
+        class_destroy(st_sysfs_class);
         kfree(scsi_tapes);
         printk(KERN_INFO "st: Unloaded.\n");
 }
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index 5f6187baad86..73c8a088c160 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -40,13 +40,15 @@
 #define TX_NUM_FIFO     4
 #define TX_BUF_SIZE     32
 
+#define SCC_WAIT_CLOSING 100
+
 struct uart_cpm_port {
         struct uart_port        port;
-        u16                     rx_nrfifos;     
+        u16                     rx_nrfifos;
         u16                     rx_fifosize;
-        u16                     tx_nrfifos;     
+        u16                     tx_nrfifos;
         u16                     tx_fifosize;
-        smc_t                   *smcp;  
+        smc_t                   *smcp;
         smc_uart_t              *smcup;
         scc_t                   *sccp;
         scc_uart_t              *sccup;
@@ -67,6 +69,8 @@ struct uart_cpm_port {
         int                      bits;
         /* Keep track of 'odd' SMC2 wirings */
         int                     is_portb;
+        /* wait on close if needed */
+        int                     wait_closing;
 };
 
 extern int cpm_uart_port_map[UART_NR];
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index 29db677d4284..d639ac92a117 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -9,9 +9,10 @@
  *
  *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
  *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
+ *            (C) 2005 MontaVista Software, Inc. by Vitaly Bordug <vbordug@ru.mvista.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -70,8 +71,22 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 
 /**************************************************************/
 
+static inline unsigned long cpu2cpm_addr(void *addr)
+{
+        if ((unsigned long)addr >= CPM_ADDR)
+                return (unsigned long)addr;
+        return virt_to_bus(addr);
+}
+
+static inline void *cpm2cpu_addr(unsigned long addr)
+{
+        if (addr >= CPM_ADDR)
+                return (void *)addr;
+        return bus_to_virt(addr);
+}
+
 /*
- * Check, if transmit buffers are processed             
+ * Check, if transmit buffers are processed
 */
 static unsigned int cpm_uart_tx_empty(struct uart_port *port)
 {
@@ -143,15 +158,18 @@ static void cpm_uart_start_tx(struct uart_port *port, unsigned int tty_start)
         }
 
         if (cpm_uart_tx_pump(port) != 0) {
-                if (IS_SMC(pinfo))
+                if (IS_SMC(pinfo)) {
                         smcp->smc_smcm |= SMCM_TX;
-                else
+                        smcp->smc_smcmr |= SMCMR_TEN;
+                } else {
                         sccp->scc_sccm |= UART_SCCM_TX;
+                        pinfo->sccp->scc_gsmrl |= SCC_GSMRL_ENT;
+                }
         }
 }
 
 /*
- * Stop receiver 
+ * Stop receiver
  */
 static void cpm_uart_stop_rx(struct uart_port *port)
 {
@@ -176,7 +194,7 @@ static void cpm_uart_enable_ms(struct uart_port *port)
 }
 
 /*
- * Generate a break. 
+ * Generate a break.
  */
 static void cpm_uart_break_ctl(struct uart_port *port, int break_state)
 {
@@ -231,7 +249,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 /* get number of characters, and check spce in flip-buffer */
                 i = bdp->cbd_datlen;
 
-                /* If we have not enough room in tty flip buffer, then we try 
+                /* If we have not enough room in tty flip buffer, then we try
                  * later, which will be the next rx-interrupt or a timeout
                  */
                 if ((tty->flip.count + i) >= TTY_FLIPBUF_SIZE) {
@@ -243,7 +261,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }
 
                 /* get pointer */
-                cp = (unsigned char *)bus_to_virt(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
 
                 /* loop through the buffer */
                 while (i-- > 0) {
@@ -265,13 +283,14 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }               /* End while (i--) */
 
                 /* This BD is ready to be used again. Clear status. get next */
-                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV);
+                bdp->cbd_sc &= ~(BD_SC_BR | BD_SC_FR | BD_SC_PR | BD_SC_OV | BD_SC_ID);
                 bdp->cbd_sc |= BD_SC_EMPTY;
 
                 if (bdp->cbd_sc & BD_SC_WRAP)
                         bdp = pinfo->rx_bd_base;
                 else
                         bdp++;
+
         } /* End for (;;) */
 
         /* Write back buffer pointer */
@@ -336,22 +355,22 @@ static irqreturn_t cpm_uart_int(int irq, void *data, struct pt_regs *regs)
 
         if (IS_SMC(pinfo)) {
                 events = smcp->smc_smce;
+                smcp->smc_smce = events;
                 if (events & SMCM_BRKE)
                         uart_handle_break(port);
                 if (events & SMCM_RX)
                         cpm_uart_int_rx(port, regs);
                 if (events & SMCM_TX)
                         cpm_uart_int_tx(port, regs);
-                smcp->smc_smce = events;
         } else {
                 events = sccp->scc_scce;
+                sccp->scc_scce = events;
                 if (events & UART_SCCM_BRKE)
                         uart_handle_break(port);
                 if (events & UART_SCCM_RX)
                         cpm_uart_int_rx(port, regs);
                 if (events & UART_SCCM_TX)
                         cpm_uart_int_tx(port, regs);
-                sccp->scc_scce = events;
         }
         return (events) ? IRQ_HANDLED : IRQ_NONE;
 }
@@ -360,6 +379,7 @@ static int cpm_uart_startup(struct uart_port *port)
 {
         int retval;
         struct uart_cpm_port *pinfo = (struct uart_cpm_port *)port;
+        int line = pinfo - cpm_uart_ports;
 
         pr_debug("CPM uart[%d]:startup\n", port->line);
 
@@ -376,9 +396,19 @@ static int cpm_uart_startup(struct uart_port *port)
                 pinfo->sccp->scc_sccm |= UART_SCCM_RX;
         }
 
+        if (!(pinfo->flags & FLAG_CONSOLE))
+                cpm_line_cr_cmd(line,CPM_CR_INIT_TRX);
         return 0;
 }
 
+inline void cpm_uart_wait_until_send(struct uart_cpm_port *pinfo)
+{
+        unsigned long target_jiffies = jiffies + pinfo->wait_closing;
+
+        while (!time_after(jiffies, target_jiffies))
+                schedule();
+}
+
 /*
  * Shutdown the uart
  */
@@ -394,6 +424,12 @@ static void cpm_uart_shutdown(struct uart_port *port)
 
         /* If the port is not the console, disable Rx and Tx. */
         if (!(pinfo->flags & FLAG_CONSOLE)) {
+                /* Wait for all the BDs marked sent */
+                while(!cpm_uart_tx_empty(port))
+                        schedule_timeout(2);
+                if(pinfo->wait_closing)
+                        cpm_uart_wait_until_send(pinfo);
+
                 /* Stop uarts */
                 if (IS_SMC(pinfo)) {
                         volatile smc_t *smcp = pinfo->smcp;
@@ -502,7 +538,7 @@ static void cpm_uart_set_termios(struct uart_port *port,
          */
         if ((termios->c_cflag & CREAD) == 0)
                 port->read_status_mask &= ~BD_SC_EMPTY;
-        
+
         spin_lock_irqsave(&port->lock, flags);
 
         /* Start bit has not been added (so don't, because we would just
@@ -569,7 +605,8 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 /* Pick next descriptor and fill from buffer */
                 bdp = pinfo->tx_cur;
 
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+
                 *p++ = xmit->buf[xmit->tail];
                 bdp->cbd_datlen = 1;
                 bdp->cbd_sc |= BD_SC_READY;
@@ -595,7 +632,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
 
         while (!(bdp->cbd_sc & BD_SC_READY) && (xmit->tail != xmit->head)) {
                 count = 0;
-                p = bus_to_virt(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr);
                 while (count < pinfo->tx_fifosize) {
                         *p++ = xmit->buf[xmit->tail];
                         xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -606,6 +643,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 }
                 bdp->cbd_datlen = count;
                 bdp->cbd_sc |= BD_SC_READY;
+                __asm__("eieio");
                 /* Get next BD. */
                 if (bdp->cbd_sc & BD_SC_WRAP)
                         bdp = pinfo->tx_bd_base;
@@ -643,12 +681,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr;
         bdp = pinfo->rx_cur = pinfo->rx_bd_base;
         for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                 bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
                 mem_addr += pinfo->rx_fifosize;
         }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
 
         /* Set the physical address of the host memory
@@ -658,12 +696,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
         bdp = pinfo->tx_cur = pinfo->tx_bd_base;
         for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
                 bdp->cbd_sc = BD_SC_INTRPT;
                 mem_addr += pinfo->tx_fifosize;
         }
-        
-        bdp->cbd_bufaddr = virt_to_bus(mem_addr);
+
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
 }
 
@@ -763,6 +801,8 @@ static void cpm_uart_init_smc(struct uart_cpm_port *pinfo)
         /* Using idle charater time requires some additional tuning.  */
         up->smc_mrblr = pinfo->rx_fifosize;
         up->smc_maxidl = pinfo->rx_fifosize;
+        up->smc_brklen = 0;
+        up->smc_brkec = 0;
         up->smc_brkcr = 1;
 
         cpm_line_cr_cmd(line, CPM_CR_INIT_TRX);
@@ -796,7 +836,7 @@ static int cpm_uart_request_port(struct uart_port *port)
         /*
          * Setup any port IO, connect any baud rate generators,
          * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
          */
         if (pinfo->set_lineif)
                 pinfo->set_lineif(pinfo);
@@ -815,6 +855,10 @@ static int cpm_uart_request_port(struct uart_port *port)
                 return ret;
 
         cpm_uart_initbd(pinfo);
+        if (IS_SMC(pinfo))
+                cpm_uart_init_smc(pinfo);
+        else
+                cpm_uart_init_scc(pinfo);
 
         return 0;
 }
@@ -869,7 +913,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .flags = FLAG_SMC,
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = smc1_lineif,
         },
@@ -883,7 +927,7 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 .flags = FLAG_SMC,
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = smc2_lineif,
 #ifdef CONFIG_SERIAL_CPM_ALT_SMC2
@@ -899,9 +943,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc1_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC2] = {
                 .port = {
@@ -912,9 +957,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc2_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC3] = {
                 .port = {
@@ -925,9 +971,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc3_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
         [UART_SCC4] = {
                 .port = {
@@ -938,9 +985,10 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
                 },
                 .tx_nrfifos = TX_NUM_FIFO,
                 .tx_fifosize = TX_BUF_SIZE,
-                .rx_nrfifos = RX_NUM_FIFO, 
+                .rx_nrfifos = RX_NUM_FIFO,
                 .rx_fifosize = RX_BUF_SIZE,
                 .set_lineif = scc4_lineif,
+                .wait_closing = SCC_WAIT_CLOSING,
         },
 };
 
@@ -983,11 +1031,8 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                  * If the buffer address is in the CPM DPRAM, don't
                  * convert it.
                  */
-                if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
-                        cp = (unsigned char *) (bdp->cbd_bufaddr);
-                else
-                        cp = bus_to_virt(bdp->cbd_bufaddr);
-                
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+
                 *cp = *s;
 
                 bdp->cbd_datlen = 1;
@@ -1003,10 +1048,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                         while ((bdp->cbd_sc & BD_SC_READY) != 0)
                                 ;
 
-                        if ((uint) (bdp->cbd_bufaddr) > (uint) CPM_ADDR)
-                                cp = (unsigned char *) (bdp->cbd_bufaddr);
-                        else
-                                cp = bus_to_virt(bdp->cbd_bufaddr);
+                        cp = cpm2cpu_addr(bdp->cbd_bufaddr);
 
                         *cp = 13;
                         bdp->cbd_datlen = 1;
@@ -1045,7 +1087,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         port =
             (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
         pinfo = (struct uart_cpm_port *)port;
-        
+
         pinfo->flags |= FLAG_CONSOLE;
 
         if (options) {
@@ -1062,7 +1104,7 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         /*
          * Setup any port IO, connect any baud rate generators,
          * etc.  This is expected to be handled by board
-         * dependant code 
+         * dependant code
          */
         if (pinfo->set_lineif)
                 pinfo->set_lineif(pinfo);
@@ -1092,14 +1134,14 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         return 0;
 }
 
-extern struct uart_driver cpm_reg;
+static struct uart_driver cpm_reg;
 static struct console cpm_scc_uart_console = {
-        .name           "ttyCPM",
-        .write          cpm_uart_console_write,
-        .device         uart_console_device,
-        .setup          cpm_uart_console_setup,
-        .flags          CON_PRINTBUFFER,
-        .index          -1,
+        .name           = "ttyCPM",
+        .write          = cpm_uart_console_write,
+        .device         = uart_console_device,
+        .setup          = cpm_uart_console_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
         .data           = &cpm_reg,
 };
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 8efbd6d1d6a4..4b0786e7eb7f 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -5,7 +5,7 @@
  *
  *  Maintainer: Kumar Gala (kumar.gala@freescale.com) (CPM2)
  *              Pantelis Antoniou (panto@intracom.gr) (CPM1)
- * 
+ *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
  *
@@ -82,6 +82,17 @@ void cpm_line_cr_cmd(int line, int cmd)
 void smc1_lineif(struct uart_cpm_port *pinfo)
 {
         volatile cpm8xx_t *cp = cpmp;
+
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
+        /* Enable SMC1 transceivers */
+        {
+                cp->cp_pepar |= 0x000000c0;
+                cp->cp_pedir &= ~0x000000c0;
+                cp->cp_peso &= ~0x00000040;
+                cp->cp_peso |= 0x00000080;
+        }
+#elif defined (CONFIG_MPC86XADS)
         unsigned int iobits = 0x000000c0;
 
         if (!pinfo->is_portb) {
@@ -93,41 +104,33 @@ void smc1_lineif(struct uart_cpm_port *pinfo)
                 ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
                 ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
         }
-
-#ifdef CONFIG_MPC885ADS
-        /* Enable SMC1 transceivers */
-        {
-                volatile uint __iomem *bcsr1 = ioremap(BCSR1, 4);
-                uint tmp;
-
-                tmp = in_be32(bcsr1);
-                tmp &= ~BCSR1_RS232EN_1;
-                out_be32(bcsr1, tmp);
-                iounmap(bcsr1);
-        }
 #endif
-
         pinfo->brg = 1;
 }
 
 void smc2_lineif(struct uart_cpm_port *pinfo)
 {
-#ifdef CONFIG_MPC885ADS
         volatile cpm8xx_t *cp = cpmp;
-        volatile uint __iomem *bcsr1;
-        uint tmp;
 
+        (void)cp;       /* fix warning */
+#if defined (CONFIG_MPC885ADS)
         cp->cp_pepar |= 0x00000c00;
         cp->cp_pedir &= ~0x00000c00;
         cp->cp_peso &= ~0x00000400;
         cp->cp_peso |= 0x00000800;
+#elif defined (CONFIG_MPC86XADS)
+        unsigned int iobits = 0x00000c00;
+
+        if (!pinfo->is_portb) {
+                cp->cp_pbpar |= iobits;
+                cp->cp_pbdir &= ~iobits;
+                cp->cp_pbodr &= ~iobits;
+        } else {
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
+                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
+        }
 
-        /* Enable SMC2 transceivers */
-        bcsr1 = ioremap(BCSR1, 4);
-        tmp = in_be32(bcsr1);
-        tmp &= ~BCSR1_RS232EN_2;
-        out_be32(bcsr1, tmp);
-        iounmap(bcsr1);
 #endif
 
         pinfo->brg = 2;
@@ -158,7 +161,7 @@ void scc4_lineif(struct uart_cpm_port *pinfo)
 }
 
 /*
- * Allocate DP-Ram and memory buffers. We need to allocate a transmit and 
+ * Allocate DP-Ram and memory buffers. We need to allocate a transmit and
  * receive buffer descriptors from dual port ram, and a character
  * buffer area from host mem. If we are allocating for the console we need
  * to do it from bootmem
@@ -185,6 +188,8 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
             L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
         if (is_con) {
+                /* was hostalloc but changed cause it blows away the */
+                /* large tlb mapping when pinning the kernel area    */
                 mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
                 dma_addr = 0;
         } else
diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c
index 50cb01831075..b01efb6b36f6 100644
--- a/drivers/usb/host/ehci-dbg.c
+++ b/drivers/usb/host/ehci-dbg.c
@@ -527,7 +527,7 @@ show_periodic (struct class_device *class_dev, char *buf)
                                                 p.qh->period,
                                                 le32_to_cpup (&p.qh->hw_info2)
                                                         /* uframe masks */
-                                                        & 0xffff,
+                                                        & (QH_CMASK | QH_SMASK),
                                                 p.qh);
                                 size -= temp;
                                 next += temp;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 4f97a4ad1ed3..20df01a79b2e 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -222,7 +222,7 @@ __acquires(ehci->lock)
                 struct ehci_qh  *qh = (struct ehci_qh *) urb->hcpriv;
 
                 /* S-mask in a QH means it's an interrupt urb */
-                if ((qh->hw_info2 & __constant_cpu_to_le32 (0x00ff)) != 0) {
+                if ((qh->hw_info2 & __constant_cpu_to_le32 (QH_SMASK)) != 0) {
 
                         /* ... update hc-wide periodic stats (for usbfs) */
                         ehci_to_hcd(ehci)->self.bandwidth_int_reqs--;
@@ -428,7 +428,8 @@ halt:
                         /* should be rare for periodic transfers,
                          * except maybe high bandwidth ...
                          */
-                        if (qh->period) {
+                        if ((__constant_cpu_to_le32 (QH_SMASK)
+                                        & qh->hw_info2) != 0) {
                                 intr_deschedule (ehci, qh);
                                 (void) qh_schedule (ehci, qh);
                         } else
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 9af4f64532a9..b56f25864ed6 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -301,7 +301,7 @@ static int qh_link_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         dev_dbg (&qh->dev->dev,
                 "link qh%d-%04x/%p start %d [%d/%d us]\n",
-                period, le32_to_cpup (&qh->hw_info2) & 0xffff,
+                period, le32_to_cpup (&qh->hw_info2) & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* high bandwidth, or otherwise every microframe */
@@ -385,7 +385,8 @@ static void qh_unlink_periodic (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         dev_dbg (&qh->dev->dev,
                 "unlink qh%d-%04x/%p start %d [%d/%d us]\n",
-                qh->period, le32_to_cpup (&qh->hw_info2) & 0xffff,
+                qh->period,
+                le32_to_cpup (&qh->hw_info2) & (QH_CMASK | QH_SMASK),
                 qh, qh->start, qh->usecs, qh->c_usecs);
 
         /* qh->qh_next still "live" to HC */
@@ -411,7 +412,7 @@ static void intr_deschedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
          * active high speed queues may need bigger delays...
          */
         if (list_empty (&qh->qtd_list)
-                        || (__constant_cpu_to_le32 (0x0ff << 8)
+                        || (__constant_cpu_to_le32 (QH_CMASK)
                                         & qh->hw_info2) != 0)
                 wait = 2;
         else
@@ -533,7 +534,7 @@ static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
 
         /* reuse the previous schedule slots, if we can */
         if (frame < qh->period) {
-                uframe = ffs (le32_to_cpup (&qh->hw_info2) & 0x00ff);
+                uframe = ffs (le32_to_cpup (&qh->hw_info2) & QH_SMASK);
                 status = check_intr_schedule (ehci, frame, --uframe,
                                 qh, &c_mask);
         } else {
@@ -569,10 +570,10 @@ static int qh_schedule (struct ehci_hcd *ehci, struct ehci_qh *qh)
                 qh->start = frame;
 
                 /* reset S-frame and (maybe) C-frame masks */
-                qh->hw_info2 &= __constant_cpu_to_le32 (~0xffff);
+                qh->hw_info2 &= __constant_cpu_to_le32(~(QH_CMASK | QH_SMASK));
                 qh->hw_info2 |= qh->period
                         ? cpu_to_le32 (1 << uframe)
-                        : __constant_cpu_to_le32 (0xff);
+                        : __constant_cpu_to_le32 (QH_SMASK);
                 qh->hw_info2 |= c_mask;
         } else
                 ehci_dbg (ehci, "reused qh %p schedule\n", qh);
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 4df498231752..a7542157534c 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -385,6 +385,11 @@ struct ehci_qh {
         __le32                  hw_info1;        /* see EHCI 3.6.2 */
 #define QH_HEAD         0x00008000
         __le32                  hw_info2;        /* see EHCI 3.6.2 */
+#define QH_SMASK        0x000000ff
+#define QH_CMASK        0x0000ff00
+#define QH_HUBADDR      0x007f0000
+#define QH_HUBPORT      0x3f800000
+#define QH_MULT         0xc0000000
         __le32                  hw_current;      /* qtd list - see EHCI 3.6.4 */
         
         /* qtd overlay (hardware parts of a struct ehci_qtd) */
diff --git a/drivers/usb/host/isp116x-hcd.c b/drivers/usb/host/isp116x-hcd.c
index 50b1970fe6b6..76cb496c5836 100644
--- a/drivers/usb/host/isp116x-hcd.c
+++ b/drivers/usb/host/isp116x-hcd.c
@@ -229,9 +229,11 @@ static void preproc_atl_queue(struct isp116x *isp116x)
         struct isp116x_ep *ep;
         struct urb *urb;
         struct ptd *ptd;
-        u16 toggle = 0, dir = PTD_DIR_SETUP, len;
+        u16 len;
 
         for (ep = isp116x->atl_active; ep; ep = ep->active) {
+                u16 toggle = 0, dir = PTD_DIR_SETUP;
+
                 BUG_ON(list_empty(&ep->hep->urb_list));
                 urb = container_of(ep->hep->urb_list.next,
                                    struct urb, urb_list);
diff --git a/drivers/usb/mon/Kconfig b/drivers/usb/mon/Kconfig
index 777642e26b9a..deb9ddffa402 100644
--- a/drivers/usb/mon/Kconfig
+++ b/drivers/usb/mon/Kconfig
@@ -9,9 +9,8 @@ config USB_MON
         help
           If you say Y here, a component which captures the USB traffic
           between peripheral-specific drivers and HC drivers will be built.
-          The USB_MON is similar in spirit and may be compatible with Dave
-          Harding's USBMon.
+          For more information, see <file:Documentation/usb/usbmon.txt>.
 
-          This is somewhat experimental at this time, but it should be safe,
-          as long as you aren't using modular USB and try to remove this
-          module.
+          This is somewhat experimental at this time, but it should be safe.
+
+          If unsure, say Y.
diff --git a/drivers/usb/mon/Makefile b/drivers/usb/mon/Makefile
index f18d10ce91f9..b0015b8a1d1f 100644
--- a/drivers/usb/mon/Makefile
+++ b/drivers/usb/mon/Makefile
@@ -4,4 +4,5 @@
 
 usbmon-objs     := mon_main.o mon_stat.o mon_text.o
 
+# This does not use CONFIG_USB_MON because we want this to use a tristate.
 obj-$(CONFIG_USB)       += usbmon.o
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index fbf659b6dab0..3edc9f49344b 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -246,6 +246,11 @@ static const struct fb_videomode modedb[] = {
         /* 480x300 @ 72 Hz, 48.0 kHz hsync */
         NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
         0, FB_VMODE_DOUBLE
+    }, {
+        /* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
+        NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
+        FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+        FB_VMODE_NONINTERLACED
     },
 };
 
diff --git a/drivers/video/nvidia/nvidia.c b/drivers/video/nvidia/nvidia.c
index b2e6b2407869..52b16850a54e 100644
--- a/drivers/video/nvidia/nvidia.c
+++ b/drivers/video/nvidia/nvidia.c
@@ -1324,6 +1324,13 @@ static int __devinit nvidia_set_fbinfo(struct fb_info *info)
 
                 fb_videomode_to_var(&nvidiafb_default_var, &modedb);
                 nvidiafb_default_var.bits_per_pixel = 8;
+        } else if (par->fpWidth && par->fpHeight) {
+                char buf[16];
+
+                memset(buf, 0, 16);
+                snprintf(buf, 15, "%dx%d", par->fpWidth, par->fpHeight);
+                fb_find_mode(&nvidiafb_default_var, info, buf, specs->modedb,
+                             specs->modedb_len, &modedb, 8);
         }
 
         if (mode_option)
diff --git a/drivers/video/sa1100fb.c b/drivers/video/sa1100fb.c
index 2d29db7ef800..beeec7b51425 100644
--- a/drivers/video/sa1100fb.c
+++ b/drivers/video/sa1100fb.c
@@ -598,7 +598,7 @@ sa1100fb_setcolreg(u_int regno, u_int red, u_int green, u_int blue,
  *    requests for the LCD controller.  If we hit this, it means we're
  *    doing nothing but LCD DMA.
  */
-static unsigned int sa1100fb_display_dma_period(struct fb_var_screeninfo *var)
+static inline unsigned int sa1100fb_display_dma_period(struct fb_var_screeninfo *var)
 {
         /*
          * Period = pixclock * bits_per_byte * bytes_per_transfer
diff --git a/fs/Kconfig b/fs/Kconfig
index 5d0c4be43dba..e54be7058359 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -363,12 +363,15 @@ config INOTIFY
         bool "Inotify file change notification support"
         default y
         ---help---
-          Say Y here to enable inotify support and the /dev/inotify character
-          device.  Inotify is a file change notification system and a
+          Say Y here to enable inotify support and the associated system
+          calls.  Inotify is a file change notification system and a
           replacement for dnotify.  Inotify fixes numerous shortcomings in
           dnotify and introduces several new features.  It allows monitoring
-          of both files and directories via a single open fd.  Multiple file
-          events are supported.
+          of both files and directories via a single open fd.  Other features
+          include multiple file events, one-shot support, and unmount
+          notification.
+
+          For more information, see Documentation/filesystems/inotify.txt
 
           If unsure, say Y.
 
diff --git a/fs/bio.c b/fs/bio.c
index 249dd6bb66c8..1f2d4649b188 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -248,17 +248,13 @@ inline void __bio_clone(struct bio *bio, struct bio *bio_src)
 {
         request_queue_t *q = bdev_get_queue(bio_src->bi_bdev);
 
-        memcpy(bio->bi_io_vec, bio_src->bi_io_vec, bio_src->bi_max_vecs * sizeof(struct bio_vec));
+        memcpy(bio->bi_io_vec, bio_src->bi_io_vec,
+                bio_src->bi_max_vecs * sizeof(struct bio_vec));
 
         bio->bi_sector = bio_src->bi_sector;
         bio->bi_bdev = bio_src->bi_bdev;
         bio->bi_flags |= 1 << BIO_CLONED;
         bio->bi_rw = bio_src->bi_rw;
-
-        /*
-         * notes -- maybe just leave bi_idx alone. assume identical mapping
-         * for the clone
-         */
         bio->bi_vcnt = bio_src->bi_vcnt;
         bio->bi_size = bio_src->bi_size;
         bio->bi_idx = bio_src->bi_idx;
diff --git a/fs/dcache.c b/fs/dcache.c
index 3aa8a7e980d8..a15a2e1f5520 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -19,6 +19,7 @@
 #include <linux/string.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
+#include <linux/fsnotify.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/smp_lock.h>
@@ -101,6 +102,7 @@ static inline void dentry_iput(struct dentry * dentry)
                 list_del_init(&dentry->d_alias);
                 spin_unlock(&dentry->d_lock);
                 spin_unlock(&dcache_lock);
+                fsnotify_inoderemove(inode);
                 if (dentry->d_op && dentry->d_op->d_iput)
                         dentry->d_op->d_iput(dentry, inode);
                 else
@@ -1165,13 +1167,16 @@ out:
  
 void d_delete(struct dentry * dentry)
 {
+        int isdir = 0;
         /*
          * Are we the only user?
          */
         spin_lock(&dcache_lock);
         spin_lock(&dentry->d_lock);
+        isdir = S_ISDIR(dentry->d_inode->i_mode);
         if (atomic_read(&dentry->d_count) == 1) {
                 dentry_iput(dentry);
+                fsnotify_nameremove(dentry, isdir);
                 return;
         }
 
@@ -1180,6 +1185,8 @@ void d_delete(struct dentry * dentry)
 
         spin_unlock(&dentry->d_lock);
         spin_unlock(&dcache_lock);
+
+        fsnotify_nameremove(dentry, isdir);
 }
 
 static void __d_rehash(struct dentry * entry, struct hlist_head *list)
diff --git a/fs/isofs/compress.c b/fs/isofs/compress.c
index 34a44e451689..4917315db732 100644
--- a/fs/isofs/compress.c
+++ b/fs/isofs/compress.c
@@ -129,8 +129,14 @@ static int zisofs_readpage(struct file *file, struct page *page)
         cend = le32_to_cpu(*(__le32 *)(bh->b_data + (blockendptr & bufmask)));
         brelse(bh);
 
+        if (cstart > cend)
+                goto eio;
+                
         csize = cend-cstart;
 
+        if (csize > deflateBound(1UL << zisofs_block_shift))
+                goto eio;
+
         /* Now page[] contains an array of pages, any of which can be NULL,
            and the locks on which we hold.  We should now read the data and
            release the pages.  If the pages are NULL the decompressed data
diff --git a/fs/namei.c b/fs/namei.c
index 4a27eb798118..57046d98a746 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1801,7 +1801,6 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
         }
         up(&dentry->d_inode->i_sem);
         if (!error) {
-                fsnotify_rmdir(dentry, dentry->d_inode, dir);
                 d_delete(dentry);
         }
         dput(dentry);
@@ -1874,7 +1873,6 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
 
         /* We don't d_delete() NFS sillyrenamed files--they still exist. */
         if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
-                fsnotify_unlink(dentry, dir);
                 d_delete(dentry);
         }
 
diff --git a/fs/namespace.c b/fs/namespace.c
index 587eb0d707ee..79bd8a46e1e7 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -160,7 +160,7 @@ clone_mnt(struct vfsmount *old, struct dentry *root)
                 mnt->mnt_root = dget(root);
                 mnt->mnt_mountpoint = mnt->mnt_root;
                 mnt->mnt_parent = mnt;
-                mnt->mnt_namespace = old->mnt_namespace;
+                mnt->mnt_namespace = current->namespace;
 
                 /* stick the duplicate mount on the same expiry list
                  * as the original if that was on one */
diff --git a/include/asm-alpha/pci.h b/include/asm-alpha/pci.h
index 28957697e59c..f681e675b823 100644
--- a/include/asm-alpha/pci.h
+++ b/include/asm-alpha/pci.h
@@ -251,6 +251,9 @@ static inline int pci_get_legacy_ide_irq(struct pci_dev *dev, int channel)
 extern void pcibios_resource_to_bus(struct pci_dev *, struct pci_bus_region *,
                                     struct resource *);
 
+extern void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                                    struct pci_bus_region *region);
+
 #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
 
 static inline int pci_proc_domain(struct pci_bus *bus)
diff --git a/include/asm-arm/pci.h b/include/asm-arm/pci.h
index b28f1c95dd62..38ea5899a580 100644
--- a/include/asm-arm/pci.h
+++ b/include/asm-arm/pci.h
@@ -60,6 +60,10 @@ extern void
 pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
                          struct resource *res);
 
+extern void
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region);
+
 static inline void pcibios_add_platform_entries(struct pci_dev *dev)
 {
 }
diff --git a/include/asm-generic/pci.h b/include/asm-generic/pci.h
index 9d4cc47bde39..ee1d8b5d8168 100644
--- a/include/asm-generic/pci.h
+++ b/include/asm-generic/pci.h
@@ -22,6 +22,14 @@ pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
         region->end = res->end;
 }
 
+static inline void
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region)
+{
+        res->start = region->start;
+        res->end = region->end;
+}
+
 #define pcibios_scan_all_fns(a, b)      0
 
 #ifndef HAVE_ARCH_PCI_GET_LEGACY_IDE_IRQ
diff --git a/include/asm-i386/mach-visws/do_timer.h b/include/asm-i386/mach-visws/do_timer.h
index 33acd50fd9a8..92d638fc8b11 100644
--- a/include/asm-i386/mach-visws/do_timer.h
+++ b/include/asm-i386/mach-visws/do_timer.h
@@ -1,6 +1,7 @@
 /* defines for inline arch setup functions */
 
 #include <asm/fixmap.h>
+#include <asm/i8259.h>
 #include "cobalt.h"
 
 static inline void do_timer_interrupt_hook(struct pt_regs *regs)
diff --git a/include/asm-i386/pci.h b/include/asm-i386/pci.h
index 78c85985aee3..2cbab30734d6 100644
--- a/include/asm-i386/pci.h
+++ b/include/asm-i386/pci.h
@@ -18,11 +18,9 @@ extern unsigned int pcibios_assign_all_busses(void);
 #define pcibios_scan_all_fns(a, b)      0
 
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x1000
+#define PCIBIOS_MIN_IO          0x4000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
 
-#define PCIBIOS_MIN_CARDBUS_IO  0x4000
-
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
 
diff --git a/include/asm-parisc/pci.h b/include/asm-parisc/pci.h
index ee741c150176..98d79a3d54fa 100644
--- a/include/asm-parisc/pci.h
+++ b/include/asm-parisc/pci.h
@@ -253,6 +253,10 @@ extern void
 pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
                          struct resource *res);
 
+extern void
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region);
+
 static inline void pcibios_add_platform_entries(struct pci_dev *dev)
 {
 }
diff --git a/include/asm-ppc/pci.h b/include/asm-ppc/pci.h
index a13d55870e62..a811e440c978 100644
--- a/include/asm-ppc/pci.h
+++ b/include/asm-ppc/pci.h
@@ -105,6 +105,10 @@ extern void
 pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
                         struct resource *res);
 
+extern void
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region);
+
 extern void pcibios_add_platform_entries(struct pci_dev *dev);
 
 struct file;
diff --git a/include/asm-ppc/pgtable.h b/include/asm-ppc/pgtable.h
index 4d4b20c9de78..92f30b28b252 100644
--- a/include/asm-ppc/pgtable.h
+++ b/include/asm-ppc/pgtable.h
@@ -202,18 +202,64 @@ extern unsigned long ioremap_bot, ioremap_base;
  *
  * Note that these bits preclude future use of a page size
  * less than 4KB.
+ *
+ *
+ * PPC 440 core has following TLB attribute fields;
+ *
+ *   TLB1:
+ *   0  1  2  3  4  ... 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
+ *   RPN.................................  -  -  -  -  -  - ERPN.......
+ *
+ *   TLB2:
+ *   0  1  2  3  4  ... 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
+ *   -  -  -  -  -    - U0 U1 U2 U3 W  I  M  G  E   - UX UW UR SX SW SR
+ *
+ * There are some constrains and options, to decide mapping software bits
+ * into TLB entry.
+ *
+ *   - PRESENT *must* be in the bottom three bits because swap cache
+ *     entries use the top 29 bits for TLB2.
+ *
+ *   - FILE *must* be in the bottom three bits because swap cache
+ *     entries use the top 29 bits for TLB2.
+ *
+ *   - CACHE COHERENT bit (M) has no effect on PPC440 core, because it
+ *     doesn't support SMP. So we can use this as software bit, like
+ *     DIRTY.
+ *
+ * With the PPC 44x Linux implementation, the 0-11th LSBs of the PTE are used
+ * for memory protection related functions (see PTE structure in
+ * include/asm-ppc/mmu.h).  The _PAGE_XXX definitions in this file map to the
+ * above bits.  Note that the bit values are CPU specific, not architecture
+ * specific.
+ *
+ * The kernel PTE entry holds an arch-dependent swp_entry structure under
+ * certain situations. In other words, in such situations some portion of
+ * the PTE bits are used as a swp_entry. In the PPC implementation, the
+ * 3-24th LSB are shared with swp_entry, however the 0-2nd three LSB still
+ * hold protection values. That means the three protection bits are
+ * reserved for both PTE and SWAP entry at the most significant three
+ * LSBs.
+ *
+ * There are three protection bits available for SWAP entry:
+ *      _PAGE_PRESENT
+ *      _PAGE_FILE
+ *      _PAGE_HASHPTE (if HW has)
+ *
+ * So those three bits have to be inside of 0-2nd LSB of PTE.
+ *
  */
+
 #define _PAGE_PRESENT   0x00000001              /* S: PTE valid */
 #define _PAGE_RW        0x00000002              /* S: Write permission */
-#define _PAGE_DIRTY     0x00000004              /* S: Page dirty */
+#define _PAGE_FILE      0x00000004              /* S: nonlinear file mapping */
 #define _PAGE_ACCESSED  0x00000008              /* S: Page referenced */
 #define _PAGE_HWWRITE   0x00000010              /* H: Dirty & RW */
 #define _PAGE_HWEXEC    0x00000020              /* H: Execute permission */
 #define _PAGE_USER      0x00000040              /* S: User page */
 #define _PAGE_ENDIAN    0x00000080              /* H: E bit */
 #define _PAGE_GUARDED   0x00000100              /* H: G bit */
-#define _PAGE_COHERENT  0x00000200              /* H: M bit */
-#define _PAGE_FILE      0x00000400              /* S: nonlinear file mapping */
+#define _PAGE_DIRTY     0x00000200              /* S: Page dirty */
 #define _PAGE_NO_CACHE  0x00000400              /* H: I bit */
 #define _PAGE_WRITETHRU 0x00000800              /* H: W bit */
 
diff --git a/include/asm-ppc64/machdep.h b/include/asm-ppc64/machdep.h
index f0c1d2d92672..f0ef06375947 100644
--- a/include/asm-ppc64/machdep.h
+++ b/include/asm-ppc64/machdep.h
@@ -84,7 +84,7 @@ struct machdep_calls {
 
         void            (*init_IRQ)(void);
         int             (*get_irq)(struct pt_regs *);
-        void            (*cpu_irq_down)(void);
+        void            (*cpu_irq_down)(int secondary);
 
         /* PCI stuff */
         void            (*pcibios_fixup)(void);
diff --git a/include/asm-ppc64/pci.h b/include/asm-ppc64/pci.h
index faa772223075..4d057452f59b 100644
--- a/include/asm-ppc64/pci.h
+++ b/include/asm-ppc64/pci.h
@@ -134,6 +134,10 @@ extern void
 pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
                         struct resource *res);
 
+extern void
+pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
+                        struct pci_bus_region *region);
+
 extern int
 unmap_bus_range(struct pci_bus *bus);
 
diff --git a/include/asm-ppc64/xics.h b/include/asm-ppc64/xics.h
index 0c45e14e26ca..1092af55d707 100644
--- a/include/asm-ppc64/xics.h
+++ b/include/asm-ppc64/xics.h
@@ -17,7 +17,7 @@
 void xics_init_IRQ(void);
 int xics_get_irq(struct pt_regs *);
 void xics_setup_cpu(void);
-void xics_teardown_cpu(void);
+void xics_teardown_cpu(int secondary);
 void xics_cause_IPI(int cpu);
 void xics_request_IPIs(void);
 void xics_migrate_irqs_away(void);
diff --git a/include/asm-x86_64/pci.h b/include/asm-x86_64/pci.h
index eeb3088a1c9e..9c4527eb55e2 100644
--- a/include/asm-x86_64/pci.h
+++ b/include/asm-x86_64/pci.h
@@ -22,11 +22,9 @@ extern unsigned int pcibios_assign_all_busses(void);
 extern int no_iommu, force_iommu;
 
 extern unsigned long pci_mem_start;
-#define PCIBIOS_MIN_IO          0x1000
+#define PCIBIOS_MIN_IO          0x4000
 #define PCIBIOS_MIN_MEM         (pci_mem_start)
 
-#define PCIBIOS_MIN_CARDBUS_IO  0x4000
-
 void pcibios_config_init(void);
 struct pci_bus * pcibios_scan_root(int bus);
 extern int (*pci_config_read)(int seg, int bus, int dev, int fn, int reg, int len, u32 *value);
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0881b5cdee3d..19bd8e7e11bf 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -301,6 +301,7 @@ struct blk_queue_tag {
         struct list_head busy_list;     /* fifo list of busy tags */
         int busy;                       /* current depth */
         int max_depth;                  /* what we will send to device */
+        int real_max_depth;             /* what the array can hold */
         atomic_t refcnt;                /* map can be shared */
 };
 
diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
index e96a4306ab3b..602c305c8585 100644
--- a/include/linux/fsnotify.h
+++ b/include/linux/fsnotify.h
@@ -44,28 +44,22 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
 }
 
 /*
- * fsnotify_unlink - file was unlinked
+ * fsnotify_nameremove - a filename was removed from a directory
  */
-static inline void fsnotify_unlink(struct dentry *dentry, struct inode *dir)
+static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
 {
-        struct inode *inode = dentry->d_inode;
-
-        inode_dir_notify(dir, DN_DELETE);
-        inotify_inode_queue_event(dir, IN_DELETE, 0, dentry->d_name.name);
-        inotify_inode_queue_event(inode, IN_DELETE_SELF, 0, NULL);
-
-        inotify_inode_is_dead(inode);
+        if (isdir)
+                isdir = IN_ISDIR;
+        dnotify_parent(dentry, DN_DELETE);
+        inotify_dentry_parent_queue_event(dentry, IN_DELETE|isdir, 0, dentry->d_name.name);
 }
 
 /*
- * fsnotify_rmdir - directory was removed
+ * fsnotify_inoderemove - an inode is going away
  */
-static inline void fsnotify_rmdir(struct dentry *dentry, struct inode *inode,
-                                  struct inode *dir)
+static inline void fsnotify_inoderemove(struct inode *inode)
 {
-        inode_dir_notify(dir, DN_DELETE);
-        inotify_inode_queue_event(dir,IN_DELETE|IN_ISDIR,0,dentry->d_name.name);
-        inotify_inode_queue_event(inode, IN_DELETE_SELF | IN_ISDIR, 0, NULL);
+        inotify_inode_queue_event(inode, IN_DELETE_SELF, 0, NULL);
         inotify_inode_is_dead(inode);
 }
 
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 92129078d4f3..a6dbb51ecd7b 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -1501,4 +1501,10 @@ extern struct bus_type ide_bus_type;
 #define ide_id_has_flush_cache_ext(id)  \
         (((id)->cfs_enable_2 & 0x2400) == 0x2400)
 
+static inline int hwif_to_node(ide_hwif_t *hwif)
+{
+        struct pci_dev *dev = hwif->pci_dev;
+        return dev ? pcibus_to_node(dev->bus) : -1;
+}
+
 #endif /* _IDE_H */
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6eb7f48317f8..82d7024f0765 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -625,10 +625,16 @@ static inline int page_mapped(struct page *page)
  * Used to decide whether a process gets delivered SIGBUS or
  * just gets major/minor fault counters bumped up.
  */
-#define VM_FAULT_OOM    (-1)
-#define VM_FAULT_SIGBUS 0
-#define VM_FAULT_MINOR  1
-#define VM_FAULT_MAJOR  2
+#define VM_FAULT_OOM    0x00
+#define VM_FAULT_SIGBUS 0x01
+#define VM_FAULT_MINOR  0x02
+#define VM_FAULT_MAJOR  0x03
+
+/* 
+ * Special case for get_user_pages.
+ * Must be in a distinct bit from the above VM_FAULT_ flags.
+ */
+#define VM_FAULT_WRITE  0x10
 
 #define offset_in_page(p)       ((unsigned long)(p) & ~PAGE_MASK)
 
@@ -704,7 +710,13 @@ extern pte_t *FASTCALL(pte_alloc_kernel(struct mm_struct *mm, pmd_t *pmd, unsign
 extern pte_t *FASTCALL(pte_alloc_map(struct mm_struct *mm, pmd_t *pmd, unsigned long address));
 extern int install_page(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long addr, struct page *page, pgprot_t prot);
 extern int install_file_pte(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long addr, unsigned long pgoff, pgprot_t prot);
-extern int handle_mm_fault(struct mm_struct *mm,struct vm_area_struct *vma, unsigned long address, int write_access);
+extern int __handle_mm_fault(struct mm_struct *mm,struct vm_area_struct *vma, unsigned long address, int write_access);
+
+static inline int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, unsigned long address, int write_access)
+{
+        return __handle_mm_fault(mm, vma, address, write_access) & (~VM_FAULT_WRITE);
+}
+
 extern int make_pages_present(unsigned long addr, unsigned long end);
 extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
 void install_arg_page(struct vm_area_struct *, struct page *, unsigned long);
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 70c2a9dc4b2b..6552b71bfa73 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -12,15 +12,13 @@
 #define NETLINK_NFLOG           5       /* netfilter/iptables ULOG */
 #define NETLINK_XFRM            6       /* ipsec */
 #define NETLINK_SELINUX         7       /* SELinux event notifications */
-#define NETLINK_ARPD            8
+#define NETLINK_ISCSI           8       /* Open-iSCSI */
 #define NETLINK_AUDIT           9       /* auditing */
 #define NETLINK_FIB_LOOKUP      10      
-#define NETLINK_ROUTE6          11      /* af_inet6 route comm channel */
 #define NETLINK_NETFILTER       12      /* netfilter subsystem */
 #define NETLINK_IP6_FW          13
 #define NETLINK_DNRTMSG         14      /* DECnet routing messages */
 #define NETLINK_KOBJECT_UEVENT  15      /* Kernel messages to userspace */
-#define NETLINK_TAPBASE         16      /* 16 to 31 are ethertap */
 
 #define MAX_LINKS 32            
 
diff --git a/include/linux/raid/bitmap.h b/include/linux/raid/bitmap.h
index 6213e976eade..4bf1659f8aa8 100644
--- a/include/linux/raid/bitmap.h
+++ b/include/linux/raid/bitmap.h
@@ -248,6 +248,7 @@ struct bitmap {
 
 /* these are used only by md/bitmap */
 int  bitmap_create(mddev_t *mddev);
+void bitmap_flush(mddev_t *mddev);
 void bitmap_destroy(mddev_t *mddev);
 int  bitmap_active(struct bitmap *bitmap);
 
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 239f520cc49e..bfe3e763ccf2 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -7,7 +7,6 @@
 #include <linux/mmzone.h>
 #include <linux/list.h>
 #include <linux/sched.h>
-#include <linux/pagemap.h>
 
 #include <asm/atomic.h>
 #include <asm/page.h>
@@ -255,6 +254,8 @@ static inline void put_swap_token(struct mm_struct *mm)
 
 #define si_swapinfo(val) \
         do { (val)->freeswap = (val)->totalswap = 0; } while (0)
+/* only sparc can not include linux/pagemap.h in this file
+ * so leave page_cache_release and release_pages undeclared... */
 #define free_page_and_swap_cache(page) \
         page_cache_release(page)
 #define free_pages_and_swap_cache(pages, nr) \
diff --git a/include/linux/zlib.h b/include/linux/zlib.h
index 850076ea14d3..74f7b78c22d2 100644
--- a/include/linux/zlib.h
+++ b/include/linux/zlib.h
@@ -506,6 +506,11 @@ extern int zlib_deflateReset (z_streamp strm);
    stream state was inconsistent (such as zalloc or state being NULL).
 */
 
+static inline unsigned long deflateBound(unsigned long s)
+{
+        return s + ((s + 7) >> 3) + ((s + 63) >> 6) + 11;
+}
+
 extern int zlib_deflateParams (z_streamp strm, int level, int strategy);
 /*
      Dynamically update the compression level and compression strategy.  The
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 42a84c53678b..06b24f637026 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -57,12 +57,6 @@
 #define BT_DBG(fmt, arg...)  printk(KERN_INFO "%s: " fmt "\n" , __FUNCTION__ , ## arg)
 #define BT_ERR(fmt, arg...)  printk(KERN_ERR  "%s: " fmt "\n" , __FUNCTION__ , ## arg)
 
-#ifdef HCI_DATA_DUMP
-#define BT_DMP(buf, len) bt_dump(__FUNCTION__, buf, len)
-#else
-#define BT_DMP(D...)
-#endif
-
 extern struct proc_dir_entry *proc_bt;
 
 /* Connection and socket states */
@@ -174,8 +168,6 @@ static inline int skb_frags_no(struct sk_buff *skb)
         return n;
 }
 
-void bt_dump(char *pref, __u8 *buf, int count);
-
 int bt_err(__u16 code);
 
 #endif /* __BLUETOOTH_H */
diff --git a/ipc/sem.c b/ipc/sem.c
index 7e8a25c82ef3..70975ce0784a 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -895,7 +895,7 @@ static inline void lock_semundo(void)
         struct sem_undo_list *undo_list;
 
         undo_list = current->sysvsem.undo_list;
-        if ((undo_list != NULL) && (atomic_read(&undo_list->refcnt) != 1))
+        if (undo_list)
                 spin_lock(&undo_list->lock);
 }
 
@@ -915,7 +915,7 @@ static inline void unlock_semundo(void)
         struct sem_undo_list *undo_list;
 
         undo_list = current->sysvsem.undo_list;
-        if ((undo_list != NULL) && (atomic_read(&undo_list->refcnt) != 1))
+        if (undo_list)
                 spin_unlock(&undo_list->lock);
 }
 
@@ -943,9 +943,7 @@ static inline int get_undo_list(struct sem_undo_list **undo_listp)
                 if (undo_list == NULL)
                         return -ENOMEM;
                 memset(undo_list, 0, size);
-                /* don't initialize unodhd->lock here.  It's done
-                 * in copy_semundo() instead.
-                 */
+                spin_lock_init(&undo_list->lock);
                 atomic_set(&undo_list->refcnt, 1);
                 current->sysvsem.undo_list = undo_list;
         }
@@ -1231,8 +1229,6 @@ int copy_semundo(unsigned long clone_flags, struct task_struct *tsk)
                 error = get_undo_list(&undo_list);
                 if (error)
                         return error;
-                if (atomic_read(&undo_list->refcnt) == 1)
-                        spin_lock_init(&undo_list->lock);
                 atomic_inc(&undo_list->refcnt);
                 tsk->sysvsem.undo_list = undo_list;
         } else 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 805fb9097318..21a4e3b2cbda 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -398,21 +398,31 @@ static int cpuset_path(const struct cpuset *cs, char *buf, int buflen)
  * to continue to serve a useful existence.  Next time it's released,
  * we will get notified again, if it still has 'notify_on_release' set.
  *
- * Note final arg to call_usermodehelper() is 0 - that means
- * don't wait.  Since we are holding the global cpuset_sem here,
- * and we are asking another thread (started from keventd) to rmdir a
- * cpuset, we can't wait - or we'd deadlock with the removing thread
- * on cpuset_sem.
+ * The final arg to call_usermodehelper() is 0, which means don't
+ * wait.  The separate /sbin/cpuset_release_agent task is forked by
+ * call_usermodehelper(), then control in this thread returns here,
+ * without waiting for the release agent task.  We don't bother to
+ * wait because the caller of this routine has no use for the exit
+ * status of the /sbin/cpuset_release_agent task, so no sense holding
+ * our caller up for that.
+ *
+ * The simple act of forking that task might require more memory,
+ * which might need cpuset_sem.  So this routine must be called while
+ * cpuset_sem is not held, to avoid a possible deadlock.  See also
+ * comments for check_for_release(), below.
  */
 
-static int cpuset_release_agent(char *cpuset_str)
+static void cpuset_release_agent(const char *pathbuf)
 {
         char *argv[3], *envp[3];
         int i;
 
+        if (!pathbuf)
+                return;
+
         i = 0;
         argv[i++] = "/sbin/cpuset_release_agent";
-        argv[i++] = cpuset_str;
+        argv[i++] = (char *)pathbuf;
         argv[i] = NULL;
 
         i = 0;
@@ -421,17 +431,29 @@ static int cpuset_release_agent(char *cpuset_str)
         envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
         envp[i] = NULL;
 
-        return call_usermodehelper(argv[0], argv, envp, 0);
+        call_usermodehelper(argv[0], argv, envp, 0);
+        kfree(pathbuf);
 }
 
 /*
  * Either cs->count of using tasks transitioned to zero, or the
  * cs->children list of child cpusets just became empty.  If this
  * cs is notify_on_release() and now both the user count is zero and
- * the list of children is empty, send notice to user land.
+ * the list of children is empty, prepare cpuset path in a kmalloc'd
+ * buffer, to be returned via ppathbuf, so that the caller can invoke
+ * cpuset_release_agent() with it later on, once cpuset_sem is dropped.
+ * Call here with cpuset_sem held.
+ *
+ * This check_for_release() routine is responsible for kmalloc'ing
+ * pathbuf.  The above cpuset_release_agent() is responsible for
+ * kfree'ing pathbuf.  The caller of these routines is responsible
+ * for providing a pathbuf pointer, initialized to NULL, then
+ * calling check_for_release() with cpuset_sem held and the address
+ * of the pathbuf pointer, then dropping cpuset_sem, then calling
+ * cpuset_release_agent() with pathbuf, as set by check_for_release().
  */
 
-static void check_for_release(struct cpuset *cs)
+static void check_for_release(struct cpuset *cs, char **ppathbuf)
 {
         if (notify_on_release(cs) && atomic_read(&cs->count) == 0 &&
             list_empty(&cs->children)) {
@@ -441,10 +463,9 @@ static void check_for_release(struct cpuset *cs)
                 if (!buf)
                         return;
                 if (cpuset_path(cs, buf, PAGE_SIZE) < 0)
-                        goto out;
-                cpuset_release_agent(buf);
-out:
-                kfree(buf);
+                        kfree(buf);
+                else
+                        *ppathbuf = buf;
         }
 }
 
@@ -727,14 +748,14 @@ static int update_flag(cpuset_flagbits_t bit, struct cpuset *cs, char *buf)
         return 0;
 }
 
-static int attach_task(struct cpuset *cs, char *buf)
+static int attach_task(struct cpuset *cs, char *pidbuf, char **ppathbuf)
 {
         pid_t pid;
         struct task_struct *tsk;
         struct cpuset *oldcs;
         cpumask_t cpus;
 
-        if (sscanf(buf, "%d", &pid) != 1)
+        if (sscanf(pidbuf, "%d", &pid) != 1)
                 return -EIO;
         if (cpus_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed))
                 return -ENOSPC;
@@ -777,7 +798,7 @@ static int attach_task(struct cpuset *cs, char *buf)
 
         put_task_struct(tsk);
         if (atomic_dec_and_test(&oldcs->count))
-                check_for_release(oldcs);
+                check_for_release(oldcs, ppathbuf);
         return 0;
 }
 
@@ -801,6 +822,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
         struct cftype *cft = __d_cft(file->f_dentry);
         cpuset_filetype_t type = cft->private;
         char *buffer;
+        char *pathbuf = NULL;
         int retval = 0;
 
         /* Crude upper limit on largest legitimate cpulist user might write. */
@@ -841,7 +863,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
                 retval = update_flag(CS_NOTIFY_ON_RELEASE, cs, buffer);
                 break;
         case FILE_TASKLIST:
-                retval = attach_task(cs, buffer);
+                retval = attach_task(cs, buffer, &pathbuf);
                 break;
         default:
                 retval = -EINVAL;
@@ -852,6 +874,7 @@ static ssize_t cpuset_common_file_write(struct file *file, const char __user *us
                 retval = nbytes;
 out2:
         up(&cpuset_sem);
+        cpuset_release_agent(pathbuf);
 out1:
         kfree(buffer);
         return retval;
@@ -1357,6 +1380,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
         struct cpuset *cs = dentry->d_fsdata;
         struct dentry *d;
         struct cpuset *parent;
+        char *pathbuf = NULL;
 
         /* the vfs holds both inode->i_sem already */
 
@@ -1376,7 +1400,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
                 update_cpu_domains(cs);
         list_del(&cs->sibling); /* delete my sibling from parent->children */
         if (list_empty(&parent->children))
-                check_for_release(parent);
+                check_for_release(parent, &pathbuf);
         spin_lock(&cs->dentry->d_lock);
         d = dget(cs->dentry);
         cs->dentry = NULL;
@@ -1384,6 +1408,7 @@ static int cpuset_rmdir(struct inode *unused_dir, struct dentry *dentry)
         cpuset_d_remove_dir(d);
         dput(d);
         up(&cpuset_sem);
+        cpuset_release_agent(pathbuf);
         return 0;
 }
 
@@ -1483,10 +1508,13 @@ void cpuset_exit(struct task_struct *tsk)
         task_unlock(tsk);
 
         if (notify_on_release(cs)) {
+                char *pathbuf = NULL;
+
                 down(&cpuset_sem);
                 if (atomic_dec_and_test(&cs->count))
-                        check_for_release(cs);
+                        check_for_release(cs, &pathbuf);
                 up(&cpuset_sem);
+                cpuset_release_agent(pathbuf);
         } else {
                 atomic_dec(&cs->count);
         }
diff --git a/kernel/exit.c b/kernel/exit.c
index 9d1b10ed0135..5b0fb9f09f21 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -829,8 +829,10 @@ fastcall NORET_TYPE void do_exit(long code)
         acct_update_integrals(tsk);
         update_mem_hiwater(tsk);
         group_dead = atomic_dec_and_test(&tsk->signal->live);
-        if (group_dead)
+        if (group_dead) {
+                del_timer_sync(&tsk->signal->real_timer);
                 acct_process(code);
+        }
         exit_mm(tsk);
 
         exit_sem(tsk);
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 10b2ad749d14..38798a2ff994 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -1166,7 +1166,6 @@ void exit_itimers(struct signal_struct *sig)
                 tmr = list_entry(sig->posix_timers.next, struct k_itimer, list);
                 itimer_delete(tmr);
         }
-        del_timer_sync(&sig->real_timer);
 }
 
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index 000e81ad2c1d..0bcaed6560ac 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -404,7 +404,6 @@ void kernel_halt(void)
 {
         notifier_call_chain(&reboot_notifier_list, SYS_HALT, NULL);
         system_state = SYSTEM_HALT;
-        device_suspend(PMSG_SUSPEND);
         device_shutdown();
         printk(KERN_EMERG "System halted.\n");
         machine_halt();
@@ -415,7 +414,6 @@ void kernel_power_off(void)
 {
         notifier_call_chain(&reboot_notifier_list, SYS_POWER_OFF, NULL);
         system_state = SYSTEM_POWER_OFF;
-        device_suspend(PMSG_SUSPEND);
         device_shutdown();
         printk(KERN_EMERG "Power down.\n");
         machine_power_off();
diff --git a/lib/crc32.c b/lib/crc32.c
index 58b222783f9c..065198f98b3f 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -473,7 +473,7 @@ static u32 test_step(u32 init, unsigned char *buf, size_t len)
         init = bitreverse(init);
         crc2 = bitreverse(crc1);
         if (crc1 != bitreverse(crc2))
-                printf("\nBit reversal fail: 0x%08x -> %0x08x -> 0x%08x\n",
+                printf("\nBit reversal fail: 0x%08x -> 0x%08x -> 0x%08x\n",
                        crc1, crc2, bitreverse(crc2));
         crc1 = crc32_le(init, buf, len);
         if (crc1 != crc2)
diff --git a/lib/inflate.c b/lib/inflate.c
index 75e7d303c72e..6db6e98d1637 100644
--- a/lib/inflate.c
+++ b/lib/inflate.c
@@ -326,7 +326,7 @@ DEBG("huft1 ");
   {
     *t = (struct huft *)NULL;
     *m = 0;
-    return 0;
+    return 2;
   }
 
 DEBG("huft2 ");
@@ -374,6 +374,7 @@ DEBG("huft5 ");
     if ((j = *p++) != 0)
       v[x[j]++] = i;
   } while (++i < n);
+  n = x[g];                   /* set n to length of v */
 
 DEBG("h6 ");
 
@@ -410,12 +411,13 @@ DEBG1("1 ");
 DEBG1("2 ");
           f -= a + 1;           /* deduct codes from patterns left */
           xp = c + k;
-          while (++j < z)       /* try smaller tables up to z bits */
-          {
-            if ((f <<= 1) <= *++xp)
-              break;            /* enough codes to use up j bits */
-            f -= *xp;           /* else deduct codes from patterns */
-          }
+          if (j < z)
+            while (++j < z)       /* try smaller tables up to z bits */
+            {
+              if ((f <<= 1) <= *++xp)
+                break;            /* enough codes to use up j bits */
+              f -= *xp;           /* else deduct codes from patterns */
+            }
         }
 DEBG1("3 ");
         z = 1 << j;             /* table entries for j-bit table */
diff --git a/lib/zlib_inflate/inftrees.c b/lib/zlib_inflate/inftrees.c
index 874950ec4858..c5f66fbb0dd0 100644
--- a/lib/zlib_inflate/inftrees.c
+++ b/lib/zlib_inflate/inftrees.c
@@ -141,7 +141,7 @@ static int huft_build(
   {
     *t = NULL;
     *m = 0;
-    return Z_OK;
+    return Z_DATA_ERROR;
   }
 
 
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index fbd1111ea119..6bf720bc662c 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -301,6 +301,7 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
 {
         struct mm_struct *mm = vma->vm_mm;
         unsigned long address;
+        pte_t *ptep;
         pte_t pte;
         struct page *page;
 
@@ -309,9 +310,17 @@ void unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
         BUG_ON(end & ~HPAGE_MASK);
 
         for (address = start; address < end; address += HPAGE_SIZE) {
-                pte = huge_ptep_get_and_clear(mm, address, huge_pte_offset(mm, address));
+                ptep = huge_pte_offset(mm, address);
+                if (! ptep)
+                        /* This can happen on truncate, or if an
+                         * mmap() is aborted due to an error before
+                         * the prefault */
+                        continue;
+
+                pte = huge_ptep_get_and_clear(mm, address, ptep);
                 if (pte_none(pte))
                         continue;
+
                 page = pte_page(pte);
                 put_page(page);
         }
diff --git a/mm/memory.c b/mm/memory.c
index 2405289dfdf8..e046b7e4b530 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -811,15 +811,18 @@ static struct page *__follow_page(struct mm_struct *mm, unsigned long address,
         pte = *ptep;
         pte_unmap(ptep);
         if (pte_present(pte)) {
-                if (write && !pte_dirty(pte))
+                if (write && !pte_write(pte))
                         goto out;
                 if (read && !pte_read(pte))
                         goto out;
                 pfn = pte_pfn(pte);
                 if (pfn_valid(pfn)) {
                         page = pfn_to_page(pfn);
-                        if (accessed)
+                        if (accessed) {
+                                if (write && !pte_dirty(pte) &&!PageDirty(page))
+                                        set_page_dirty(page);
                                 mark_page_accessed(page);
+                        }
                         return page;
                 }
         }
@@ -941,10 +944,13 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 }
                 spin_lock(&mm->page_table_lock);
                 do {
+                        int write_access = write;
                         struct page *page;
 
                         cond_resched_lock(&mm->page_table_lock);
-                        while (!(page = follow_page(mm, start, write))) {
+                        while (!(page = follow_page(mm, start, write_access))) {
+                                int ret;
+
                                 /*
                                  * Shortcut for anonymous pages. We don't want
                                  * to force the creation of pages tables for
@@ -957,7 +963,18 @@ int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                                         break;
                                 }
                                 spin_unlock(&mm->page_table_lock);
-                                switch (handle_mm_fault(mm,vma,start,write)) {
+                                ret = __handle_mm_fault(mm, vma, start, write_access);
+
+                                /*
+                                 * The VM_FAULT_WRITE bit tells us that do_wp_page has
+                                 * broken COW when necessary, even if maybe_mkwrite
+                                 * decided not to set pte_write. We can thus safely do
+                                 * subsequent page lookups as if they were reads.
+                                 */
+                                if (ret & VM_FAULT_WRITE)
+                                        write_access = 0;
+                                
+                                switch (ret & ~VM_FAULT_WRITE) {
                                 case VM_FAULT_MINOR:
                                         tsk->min_flt++;
                                         break;
@@ -1220,6 +1237,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct * vma,
         struct page *old_page, *new_page;
         unsigned long pfn = pte_pfn(pte);
         pte_t entry;
+        int ret;
 
         if (unlikely(!pfn_valid(pfn))) {
                 /*
@@ -1247,7 +1265,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct * vma,
                         lazy_mmu_prot_update(entry);
                         pte_unmap(page_table);
                         spin_unlock(&mm->page_table_lock);
-                        return VM_FAULT_MINOR;
+                        return VM_FAULT_MINOR|VM_FAULT_WRITE;
                 }
         }
         pte_unmap(page_table);
@@ -1274,6 +1292,7 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct * vma,
         /*
          * Re-check the pte - we dropped the lock
          */
+        ret = VM_FAULT_MINOR;
         spin_lock(&mm->page_table_lock);
         page_table = pte_offset_map(pmd, address);
         if (likely(pte_same(*page_table, pte))) {
@@ -1290,12 +1309,13 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct * vma,
 
                 /* Free the old page.. */
                 new_page = old_page;
+                ret |= VM_FAULT_WRITE;
         }
         pte_unmap(page_table);
         page_cache_release(new_page);
         page_cache_release(old_page);
         spin_unlock(&mm->page_table_lock);
-        return VM_FAULT_MINOR;
+        return ret;
 
 no_new_page:
         page_cache_release(old_page);
@@ -1987,7 +2007,6 @@ static inline int handle_pte_fault(struct mm_struct *mm,
         if (write_access) {
                 if (!pte_write(entry))
                         return do_wp_page(mm, vma, address, pte, pmd, entry);
-
                 entry = pte_mkdirty(entry);
         }
         entry = pte_mkyoung(entry);
@@ -2002,7 +2021,7 @@ static inline int handle_pte_fault(struct mm_struct *mm,
 /*
  * By the time we get here, we already hold the mm semaphore
  */
-int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct * vma,
+int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct * vma,
                 unsigned long address, int write_access)
 {
         pgd_t *pgd;
diff --git a/mm/mmap.c b/mm/mmap.c
index da3fa90a0aae..404319477e71 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -143,7 +143,11 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
            leave 3% of the size of this process for other processes */
         allowed -= current->mm->total_vm / 32;
 
-        if (atomic_read(&vm_committed_space) < allowed)
+        /*
+         * cast `allowed' as a signed long because vm_committed_space
+         * sometimes has a negative value
+         */
+        if (atomic_read(&vm_committed_space) < (long)allowed)
                 return 0;
 
         vm_unacct_memory(pages);
diff --git a/mm/mremap.c b/mm/mremap.c
index ec7238a78f36..fc45dc9a617b 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -229,6 +229,7 @@ static unsigned long move_vma(struct vm_area_struct *vma,
          * since do_munmap() will decrement it by old_len == new_len
          */
         mm->total_vm += new_len >> PAGE_SHIFT;
+        __vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
 
         if (do_munmap(mm, old_addr, old_len) < 0) {
                 /* OOM: unable to split vma, just get accounts right */
@@ -243,7 +244,6 @@ static unsigned long move_vma(struct vm_area_struct *vma,
                         vma->vm_next->vm_flags |= VM_ACCOUNT;
         }
 
-        __vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
                 mm->locked_vm += new_len >> PAGE_SHIFT;
                 if (new_len > old_len)
diff --git a/mm/nommu.c b/mm/nommu.c
index ce74452c02d9..fd4e8df0f02d 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1167,7 +1167,11 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
            leave 3% of the size of this process for other processes */
         allowed -= current->mm->total_vm / 32;
 
-        if (atomic_read(&vm_committed_space) < allowed)
+        /*
+         * cast `allowed' as a signed long because vm_committed_space
+         * sometimes has a negative value
+         */
+        if (atomic_read(&vm_committed_space) < (long)allowed)
                 return 0;
 
         vm_unacct_memory(pages);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index fb5524365bc2..ffa26c10bfe8 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -299,7 +299,6 @@ struct hci_dev *hci_dev_get(int index)
         read_unlock(&hci_dev_list_lock);
         return hdev;
 }
-EXPORT_SYMBOL(hci_dev_get);
 
 /* ---- Inquiry support ---- */
 static void inquiry_cache_flush(struct hci_dev *hdev)
@@ -1042,7 +1041,6 @@ int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *p
 
         return 0;
 }
-EXPORT_SYMBOL(hci_send_cmd);
 
 /* Get data from the previously sent command */
 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c4b592b4ef10..46367bd129c3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1035,9 +1035,11 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         ev->type = type;
         memcpy(ev->data, data, dlen);
 
+        bt_cb(skb)->incoming = 1;
+        do_gettimeofday(&skb->stamp);
+
         skb->pkt_type = HCI_EVENT_PKT;
         skb->dev = (void *) hdev;
         hci_send_to_sock(hdev, skb);
         kfree_skb(skb);
 }
-EXPORT_SYMBOL(hci_si_event);
diff --git a/net/bluetooth/lib.c b/net/bluetooth/lib.c
index 9efb0a093612..ee6a66979913 100644
--- a/net/bluetooth/lib.c
+++ b/net/bluetooth/lib.c
@@ -34,31 +34,6 @@
 
 #include <net/bluetooth/bluetooth.h>
 
-void bt_dump(char *pref, __u8 *buf, int count)
-{
-        char *ptr;
-        char line[100];
-        unsigned int i;
-
-        printk(KERN_INFO "%s: dump, len %d\n", pref, count);
-
-        ptr = line;
-        *ptr = 0;
-        for (i = 0; i < count; i++) {
-                ptr += sprintf(ptr, " %2.2X", buf[i]);
-
-                if (i && !((i + 1) % 20)) {
-                        printk(KERN_INFO "%s:%s\n", pref, line);
-                        ptr = line;
-                        *ptr = 0;
-                }
-        }
-
-        if (line[0])
-                printk(KERN_INFO "%s:%s\n", pref, line);
-}
-EXPORT_SYMBOL(bt_dump);
-
 void baswap(bdaddr_t *dst, bdaddr_t *src)
 {
         unsigned char *d = (unsigned char *) dst;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e9e6fda66f1a..27bf5047cd33 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -389,8 +389,6 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
                 rfcomm_dlc_unlock(d);
 
                 skb_queue_purge(&d->tx_queue);
-                rfcomm_session_put(s);
-
                 rfcomm_dlc_unlink(d);
         }
 
@@ -600,8 +598,6 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
                 goto failed;
         }
 
-        rfcomm_session_hold(s);
-
         s->initiator = 1;
 
         bacpy(&addr.l2_bdaddr, dst);
diff --git a/net/compat.c b/net/compat.c
index be5d936dc423..d99ab9695893 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -91,20 +91,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
         } else
                 kern_msg->msg_name = NULL;
 
-        if(kern_msg->msg_iovlen > UIO_FASTIOV) {
-                kern_iov = kmalloc(kern_msg->msg_iovlen * sizeof(struct iovec),
-                                   GFP_KERNEL);
-                if(!kern_iov)
-                        return -ENOMEM;
-        }
-
         tot_len = iov_from_user_compat_to_kern(kern_iov,
                                           (struct compat_iovec __user *)kern_msg->msg_iov,
                                           kern_msg->msg_iovlen);
         if(tot_len >= 0)
                 kern_msg->msg_iov = kern_iov;
-        else if(kern_msg->msg_iovlen > UIO_FASTIOV)
-                kfree(kern_iov);
 
         return tot_len;
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c886b28ba9f5..e278cb9d0075 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -593,10 +593,13 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
                           struct hlist_head *new_laddrhash,
                           unsigned int new_size)
 {
+        struct hlist_head *old_info_hash, *old_laddrhash;
         unsigned int old_size = fib_hash_size;
-        unsigned int i;
+        unsigned int i, bytes;
 
         write_lock(&fib_info_lock);
+        old_info_hash = fib_info_hash;
+        old_laddrhash = fib_info_laddrhash;
         fib_hash_size = new_size;
 
         for (i = 0; i < old_size; i++) {
@@ -636,6 +639,10 @@ static void fib_hash_move(struct hlist_head *new_info_hash,
         fib_info_laddrhash = new_laddrhash;
 
         write_unlock(&fib_info_lock);
+
+        bytes = old_size * sizeof(struct hlist_head *);
+        fib_hash_free(old_info_hash, bytes);
+        fib_hash_free(old_laddrhash, bytes);
 }
 
 struct fib_info *
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 279f57abfecb..3d78464f64ea 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -936,8 +936,7 @@ int icmp_rcv(struct sk_buff *skb)
         case CHECKSUM_HW:
                 if (!(u16)csum_fold(skb->csum))
                         break;
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "icmp v4 hw csum failure\n"));
         case CHECKSUM_NONE:
                 if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0)))
                         goto error;
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 7f68e27eb4ea..eb377ae15305 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -377,7 +377,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
         return ip_frag_intern(hash, qp);
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit()) printk(KERN_ERR "ip_frag_create: no memory left !\n"));
+        LIMIT_NETDEBUG(printk(KERN_ERR "ip_frag_create: no memory left !\n"));
         return NULL;
 }
 
@@ -625,10 +625,8 @@ static struct sk_buff *ip_frag_reasm(struct ipq *qp, struct net_device *dev)
         return head;
 
 out_nomem:
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_ERR 
-                        "IP: queue_glue: no memory for gluing queue %p\n",
-                        qp));
+        LIMIT_NETDEBUG(printk(KERN_ERR "IP: queue_glue: no memory for gluing "
+                              "queue %p\n", qp));
         goto out_fail;
 out_oversize:
         if (net_ratelimit())
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7c481d0d79..ff4bd067b397 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -848,6 +848,9 @@ mc_msf_out:
  
                 case IP_IPSEC_POLICY:
                 case IP_XFRM_POLICY:
+                        err = -EPERM;
+                        if (!capable(CAP_NET_ADMIN))
+                                break;
                         err = xfrm_user_policy(sk, optname, optval, optlen);
                         break;
 
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index bc59d0d6e89e..91d5ea1dbbc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -102,6 +102,10 @@ ip_nat_fn(unsigned int hooknum,
                 return NF_ACCEPT;
         }
 
+        /* Don't try to NAT if this packet is not conntracked */
+        if (ct == &ip_conntrack_untracked)
+                return NF_ACCEPT;
+
         switch (ctinfo) {
         case IP_CT_RELATED:
         case IP_CT_RELATED+IP_CT_IS_REPLY:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 62f62bb05c2a..5d91213d34c0 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1494,12 +1494,11 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                          * to destinations, already remembered
                          * to the moment of synflood.
                          */
-                        NETDEBUG(if (net_ratelimit()) \
-                                        printk(KERN_DEBUG "TCP: drop open "
-                                                          "request from %u.%u."
-                                                          "%u.%u/%u\n", \
-                                               NIPQUAD(saddr),
-                                               ntohs(skb->h.th->source)));
+                        LIMIT_NETDEBUG(printk(KERN_DEBUG "TCP: drop open "
+                                              "request from %u.%u."
+                                              "%u.%u/%u\n",
+                                              NIPQUAD(saddr),
+                                              ntohs(skb->h.th->source)));
                         dst_release(dst);
                         goto drop_and_free;
                 }
@@ -1627,8 +1626,7 @@ static int tcp_v4_checksum_init(struct sk_buff *skb)
                                   skb->nh.iph->daddr, skb->csum))
                         return 0;
 
-                NETDEBUG(if (net_ratelimit())
-                                printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "hw tcp v4 csum failed\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->len <= 76) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e3f8ea1bfa9c..7d076f0db100 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -403,11 +403,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
                 sk->sk_send_head = skb;
 }
 
-static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
+static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        if (skb->len <= tp->mss_cache ||
+        if (skb->len <= mss_now ||
             !(sk->sk_route_caps & NETIF_F_TSO)) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
@@ -417,10 +415,10 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
         } else {
                 unsigned int factor;
 
-                factor = skb->len + (tp->mss_cache - 1);
-                factor /= tp->mss_cache;
+                factor = skb->len + (mss_now - 1);
+                factor /= mss_now;
                 skb_shinfo(skb)->tso_segs = factor;
-                skb_shinfo(skb)->tso_size = tp->mss_cache;
+                skb_shinfo(skb)->tso_size = mss_now;
         }
 }
 
@@ -429,7 +427,7 @@ static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb)
  * packet to the list.  This won't be called frequently, I hope. 
  * Remember, these are still headerless SKBs at this point.
  */
-static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
+static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss_now)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
@@ -492,8 +490,8 @@ static int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len)
         }
 
         /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
 
         if (TCP_SKB_CB(skb)->sacked & TCPCB_LOST) {
                 tp->lost_out += tcp_skb_pcount(skb);
@@ -569,7 +567,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
          * factor and mss.
          */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb);
+                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk, 1));
 
         return 0;
 }
@@ -734,12 +732,14 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp, struct sk_buff *sk
 /* This must be invoked the first time we consider transmitting
  * SKB onto the wire.
  */
-static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb)
+static inline int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb, unsigned int mss_now)
 {
         int tso_segs = tcp_skb_pcount(skb);
 
-        if (!tso_segs) {
-                tcp_set_skb_tso_segs(sk, skb);
+        if (!tso_segs ||
+            (tso_segs > 1 &&
+             skb_shinfo(skb)->tso_size != mss_now)) {
+                tcp_set_skb_tso_segs(sk, skb, mss_now);
                 tso_segs = tcp_skb_pcount(skb);
         }
         return tso_segs;
@@ -817,7 +817,7 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned int cwnd_quota;
 
-        tcp_init_tso_segs(sk, skb);
+        tcp_init_tso_segs(sk, skb, cur_mss);
 
         if (!tcp_nagle_test(tp, skb, cur_mss, nonagle))
                 return 0;
@@ -854,7 +854,7 @@ int tcp_may_send_now(struct sock *sk, struct tcp_sock *tp)
  * know that all the data is in scatter-gather pages, and that the
  * packet has never been sent out before (and thus is not cloned).
  */
-static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len)
+static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len, unsigned int mss_now)
 {
         struct sk_buff *buff;
         int nlen = skb->len - len;
@@ -887,8 +887,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len)
         skb_split(skb, buff, len);
 
         /* Fix up tso_factor for both original and new SKB.  */
-        tcp_set_skb_tso_segs(sk, skb);
-        tcp_set_skb_tso_segs(sk, buff);
+        tcp_set_skb_tso_segs(sk, skb, mss_now);
+        tcp_set_skb_tso_segs(sk, buff, mss_now);
 
         /* Link BUFF into the send queue. */
         skb_header_release(buff);
@@ -972,19 +972,18 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
         if (unlikely(sk->sk_state == TCP_CLOSE))
                 return 0;
 
-        skb = sk->sk_send_head;
-        if (unlikely(!skb))
-                return 0;
-
-        tso_segs = tcp_init_tso_segs(sk, skb);
-        cwnd_quota = tcp_cwnd_test(tp, skb);
-        if (unlikely(!cwnd_quota))
-                goto out;
-
         sent_pkts = 0;
-        while (likely(tcp_snd_wnd_test(tp, skb, mss_now))) {
+        while ((skb = sk->sk_send_head)) {
+                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
+                cwnd_quota = tcp_cwnd_test(tp, skb);
+                if (!cwnd_quota)
+                        break;
+
+                if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
+                        break;
+
                 if (tso_segs == 1) {
                         if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
                                                      (tcp_skb_is_last(sk, skb) ?
@@ -1006,11 +1005,11 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
                                         limit = skb->len - trim;
                         }
                         if (skb->len > limit) {
-                                if (tso_fragment(sk, skb, limit))
+                                if (tso_fragment(sk, skb, limit, mss_now))
                                         break;
                         }
                 } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb,  mss_now)))
+                        if (unlikely(tcp_fragment(sk, skb,  mss_now, mss_now)))
                                 break;
                 }
 
@@ -1026,27 +1025,12 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle)
 
                 tcp_minshall_update(tp, mss_now, skb);
                 sent_pkts++;
-
-                /* Do not optimize this to use tso_segs. If we chopped up
-                 * the packet above, tso_segs will no longer be valid.
-                 */
-                cwnd_quota -= tcp_skb_pcount(skb);
-
-                BUG_ON(cwnd_quota < 0);
-                if (!cwnd_quota)
-                        break;
-
-                skb = sk->sk_send_head;
-                if (!skb)
-                        break;
-                tso_segs = tcp_init_tso_segs(sk, skb);
         }
 
         if (likely(sent_pkts)) {
                 tcp_cwnd_validate(sk, tp);
                 return 0;
         }
-out:
         return !tp->packets_out && sk->sk_send_head;
 }
 
@@ -1076,7 +1060,7 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
 
         BUG_ON(!skb || skb->len < mss_now);
 
-        tso_segs = tcp_init_tso_segs(sk, skb);
+        tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
         cwnd_quota = tcp_snd_test(sk, skb, mss_now, TCP_NAGLE_PUSH);
 
         if (likely(cwnd_quota)) {
@@ -1093,11 +1077,11 @@ void tcp_push_one(struct sock *sk, unsigned int mss_now)
                                         limit = skb->len - trim;
                         }
                         if (skb->len > limit) {
-                                if (unlikely(tso_fragment(sk, skb, limit)))
+                                if (unlikely(tso_fragment(sk, skb, limit, mss_now)))
                                         return;
                         }
                 } else if (unlikely(skb->len > mss_now)) {
-                        if (unlikely(tcp_fragment(sk, skb, mss_now)))
+                        if (unlikely(tcp_fragment(sk, skb, mss_now, mss_now)))
                                 return;
                 }
 
@@ -1388,7 +1372,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
                 int old_factor = tcp_skb_pcount(skb);
                 int new_factor;
 
-                if (tcp_fragment(sk, skb, cur_mss))
+                if (tcp_fragment(sk, skb, cur_mss, cur_mss))
                         return -ENOMEM; /* We'll try again later. */
 
                 /* New SKB created, account for it. */
@@ -1991,7 +1975,7 @@ int tcp_write_wakeup(struct sock *sk)
                             skb->len > mss) {
                                 seg_size = min(seg_size, mss);
                                 TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
-                                if (tcp_fragment(sk, skb, seg_size))
+                                if (tcp_fragment(sk, skb, seg_size, mss))
                                         return -1;
                                 /* SWS override triggered forced fragmentation.
                                  * Disable TSO, the connection is too sick. */
@@ -2000,7 +1984,7 @@ int tcp_write_wakeup(struct sock *sk)
                                         sk->sk_route_caps &= ~NETIF_F_TSO;
                                 }
                         } else if (!tcp_skb_pcount(skb))
-                                tcp_set_skb_tso_segs(sk, skb);
+                                tcp_set_skb_tso_segs(sk, skb, mss);
 
                         TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
                         TCP_SKB_CB(skb)->when = tcp_time_stamp;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 7c24e64b443f..dc4d07357e3a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -628,7 +628,7 @@ back_from_confirm:
                 /* ... which is an evident application bug. --ANK */
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 2\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 2\n"));
                 err = -EINVAL;
                 goto out;
         }
@@ -693,7 +693,7 @@ static int udp_sendpage(struct sock *sk, struct page *page, int offset,
         if (unlikely(!up->pending)) {
                 release_sock(sk);
 
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp cork app bug 3\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp cork app bug 3\n"));
                 return -EINVAL;
         }
 
@@ -1102,7 +1102,7 @@ static int udp_checksum_init(struct sk_buff *skb, struct udphdr *uh,
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                 if (!udp_check(uh, ulen, saddr, daddr, skb->csum))
                         return 0;
-                NETDEBUG(if (net_ratelimit()) printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
+                LIMIT_NETDEBUG(printk(KERN_DEBUG "udp v4 hw csum failure.\n"));
                 skb->ip_summed = CHECKSUM_NONE;
         }
         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -1181,14 +1181,13 @@ int udp_rcv(struct sk_buff *skb)
         return(0);
 
 short_packet:
-        NETDEBUG(if (net_ratelimit())
-                printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        ulen,
-                        len,
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest)));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: short packet: From %u.%u.%u.%u:%u %d/%d to %u.%u.%u.%u:%u\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              ulen,
+                              len,
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest)));
 no_header:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
@@ -1199,13 +1198,12 @@ csum_error:
          * RFC1122: OK.  Discards the bad packet silently (as far as 
          * the network is concerned, anyway) as per 4.1.3.4 (MUST). 
          */
-        NETDEBUG(if (net_ratelimit())
-                 printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
-                        NIPQUAD(saddr),
-                        ntohs(uh->source),
-                        NIPQUAD(daddr),
-                        ntohs(uh->dest),
-                        ulen));
+        LIMIT_NETDEBUG(printk(KERN_DEBUG "UDP: bad checksum. From %d.%d.%d.%d:%d to %d.%d.%d.%d:%d ulen %d\n",
+                              NIPQUAD(saddr),
+                              ntohs(uh->source),
+                              NIPQUAD(daddr),
+                              ntohs(uh->dest),
+                              ulen));
 drop:
         UDP_INC_STATS_BH(UDP_MIB_INERRORS);
         kfree_skb(skb);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f3ef4c38d315..3bc144a79fa5 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -504,6 +504,9 @@ done:
                 break;
         case IPV6_IPSEC_POLICY:
         case IPV6_XFRM_POLICY:
+                retv = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        break;
                 retv = xfrm_user_policy(sk, optname, optval, optlen);
                 break;
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 56db8f13e6cb..d0c3120d0233 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -586,7 +586,7 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
         }
         if (skb->stamp.tv_sec == 0) {
                 skb->stamp.tv_sec = xtime.tv_sec; 
-                skb->stamp.tv_usec = xtime.tv_nsec * 1000; 
+                skb->stamp.tv_usec = xtime.tv_nsec / NSEC_PER_USEC; 
                 /* Don't enable netstamp, sunrpc doesn't 
                    need that much accuracy */
         }
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index fea262860ea0..a6516a64b297 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -49,9 +49,6 @@ asmlinkage long sys_add_key(const char __user *_type,
                 goto error;
         type[31] = '\0';
 
-        if (!type[0])
-                goto error;
-
         ret = -EPERM;
         if (type[0] == '.')
                 goto error;
@@ -144,6 +141,10 @@ asmlinkage long sys_request_key(const char __user *_type,
                 goto error;
         type[31] = '\0';
 
+        ret = -EPERM;
+        if (type[0] == '.')
+                goto error;
+
         /* pull the description into kernel space */
         ret = -EFAULT;
         dlen = strnlen_user(_description, PAGE_SIZE - 1);
@@ -362,7 +363,7 @@ long keyctl_revoke_key(key_serial_t id)
 
         key_put(key);
  error:
-        return 0;
+        return ret;
 
 } /* end keyctl_revoke_key() */
 
@@ -685,6 +686,8 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
                         goto can_read_key2;
 
                 ret = PTR_ERR(skey);
+                if (ret == -EAGAIN)
+                        ret = -EACCES;
                 goto error2;
         }
 
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index a1f6bac647a1..9c208c756df8 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -201,7 +201,11 @@ static void keyring_destroy(struct key *keyring)
 
         if (keyring->description) {
                 write_lock(&keyring_name_lock);
-                list_del(&keyring->type_data.link);
+
+                if (keyring->type_data.link.next != NULL &&
+                    !list_empty(&keyring->type_data.link))
+                        list_del(&keyring->type_data.link);
+
                 write_unlock(&keyring_name_lock);
         }
 
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 9b0369c5a223..c089f78fb94e 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -678,7 +678,7 @@ long join_session_keyring(const char *name)
                 keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);
                 if (IS_ERR(keyring)) {
                         ret = PTR_ERR(keyring);
-                        goto error;
+                        goto error2;
                 }
         }
         else if (IS_ERR(keyring)) {
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index dfcd983af1fd..90c1506d007c 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -405,7 +405,7 @@ struct key *request_key_and_link(struct key_type *type,
                 key_user_put(user);
 
                 /* link the new key into the appropriate keyring */
-                if (!PTR_ERR(key))
+                if (!IS_ERR(key))
                         request_key_link(key, dest_keyring);
         }