Merge branch 'linus' into core/ipi

556 files changed, 8955 insertions, 4468 deletions

diff --git a/Documentation/ABI/testing/sysfs-bus-pci b/Documentation/ABI/testing/sysfs-bus-pci
index ceddcff4082a..e638e15a8895 100644
--- a/Documentation/ABI/testing/sysfs-bus-pci
+++ b/Documentation/ABI/testing/sysfs-bus-pci
@@ -1,3 +1,46 @@
+What:           /sys/bus/pci/drivers/.../bind
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device location to this file will cause
+                the driver to attempt to bind to the device found at
+                this location.  This is useful for overriding default
+                bindings.  The format for the location is: DDDD:BB:DD.F.
+                That is Domain:Bus:Device.Function and is the same as
+                found in /sys/bus/pci/devices/.  For example:
+                # echo 0000:00:19.0 > /sys/bus/pci/drivers/foo/bind
+                (Note: kernels before 2.6.28 may require echo -n).
+
+What:           /sys/bus/pci/drivers/.../unbind
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device location to this file will cause the
+                driver to attempt to unbind from the device found at
+                this location.  This may be useful when overriding default
+                bindings.  The format for the location is: DDDD:BB:DD.F.
+                That is Domain:Bus:Device.Function and is the same as
+                found in /sys/bus/pci/devices/. For example:
+                # echo 0000:00:19.0 > /sys/bus/pci/drivers/foo/unbind
+                (Note: kernels before 2.6.28 may require echo -n).
+
+What:           /sys/bus/pci/drivers/.../new_id
+Date:           December 2003
+Contact:        linux-pci@vger.kernel.org
+Description:
+                Writing a device ID to this file will attempt to
+                dynamically add a new device ID to a PCI device driver.
+                This may allow the driver to support more hardware than
+                was included in the driver's static device ID support
+                table at compile time.  The format for the device ID is:
+                VVVV DDDD SVVV SDDD CCCC MMMM PPPP.  That is Vendor ID,
+                Device ID, Subsystem Vendor ID, Subsystem Device ID,
+                Class, Class Mask, and Private Driver Data.  The Vendor ID
+                and Device ID fields are required, the rest are optional.
+                Upon successfully adding an ID, the driver will probe
+                for the device and attempt to bind to it.  For example:
+                # echo "8086 10f5" > /sys/bus/pci/drivers/foo/new_id
+
 What:           /sys/bus/pci/devices/.../vpd
 Date:           February 2008
 Contact:        Ben Hutchings <bhutchings@solarflare.com>
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index 6e253407b3dc..accfe2f5247d 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -298,3 +298,15 @@ over a rather long period of time, but improvements are always welcome!
 
         Note that, rcu_assign_pointer() and rcu_dereference() relate to
         SRCU just as they do to other forms of RCU.
+
+15.     The whole point of call_rcu(), synchronize_rcu(), and friends
+        is to wait until all pre-existing readers have finished before
+        carrying out some otherwise-destructive operation.  It is
+        therefore critically important to -first- remove any path
+        that readers can follow that could be affected by the
+        destructive operation, and -only- -then- invoke call_rcu(),
+        synchronize_rcu(), or friends.
+
+        Because these primitives only wait for pre-existing readers,
+        it is the caller's responsibility to guarantee safety to
+        any subsequent readers.
diff --git a/Documentation/dvb/README.flexcop b/Documentation/dvb/README.flexcop
deleted file mode 100644
index 5515469de7cf..000000000000
--- a/Documentation/dvb/README.flexcop
+++ /dev/null
@@ -1,205 +0,0 @@
-This README escorted the skystar2-driver rewriting procedure. It describes the
-state of the new flexcop-driver set and some internals are written down here
-too.
-
-This document hopefully describes things about the flexcop and its
-device-offsprings. Goal was to write an easy-to-write and easy-to-read set of
-drivers based on the skystar2.c and other information.
-
-Remark: flexcop-pci.c was a copy of skystar2.c, but every line has been
-touched and rewritten.
-
-History & News
-==============
-  2005-04-01 - correct USB ISOC transfers (thanks to Vadim Catana)
-
-
-
-
-General coding processing
-=========================
-
-We should proceed as follows (as long as no one complains):
-
-0) Think before start writing code!
-
-1) rewriting the skystar2.c with the help of the flexcop register descriptions
-and splitting up the files to a pci-bus-part and a flexcop-part.
-The new driver will be called b2c2-flexcop-pci.ko/b2c2-flexcop-usb.ko for the
-device-specific part and b2c2-flexcop.ko for the common flexcop-functions.
-
-2) Search for errors in the leftover of flexcop-pci.c (compare with pluto2.c
-and other pci drivers)
-
-3) make some beautification (see 'Improvements when rewriting (refactoring) is
-done')
-
-4) Testing the new driver and maybe substitute the skystar2.c with it, to reach
-a wider tester audience.
-
-5) creating an usb-bus-part using the already written flexcop code for the pci
-card.
-
-Idea: create a kernel-object for the flexcop and export all important
-functions. This option saves kernel-memory, but maybe a lot of functions have
-to be exported to kernel namespace.
-
-
-Current situation
-=================
-
-0) Done :)
-1) Done (some minor issues left)
-2) Done
-3) Not ready yet, more information is necessary
-4) next to be done (see the table below)
-5) USB driver is working (yes, there are some minor issues)
-
-What seems to be ready?
------------------------
-
-1) Rewriting
-1a) i2c is cut off from the flexcop-pci.c and seems to work
-1b) moved tuner and demod stuff from flexcop-pci.c to flexcop-tuner-fe.c
-1c) moved lnb and diseqc stuff from flexcop-pci.c to flexcop-tuner-fe.c
-1e) eeprom (reading MAC address)
-1d) sram (no dynamic sll size detection (commented out) (using default as JJ told me))
-1f) misc. register accesses for reading parameters (e.g. resetting, revision)
-1g) pid/mac filter (flexcop-hw-filter.c)
-1i) dvb-stuff initialization in flexcop.c (done)
-1h) dma stuff (now just using the size-irq, instead of all-together, to be done)
-1j) remove flexcop initialization from flexcop-pci.c completely (done)
-1l) use a well working dma IRQ method (done, see 'Known bugs and problems and TODO')
-1k) cleanup flexcop-files (remove unused EXPORT_SYMBOLs, make static from
-non-static where possible, moved code to proper places)
-
-2) Search for errors in the leftover of flexcop-pci.c (partially done)
-5a) add MAC address reading
-5c) feeding of ISOC data to the software demux (format of the isochronous data
-and speed optimization, no real error) (thanks to Vadim Catana)
-
-What to do in the near future?
---------------------------------------
-(no special order here)
-
-5) USB driver
-5b) optimize isoc-transfer (submitting/killing isoc URBs when transfer is starting)
-
-Testing changes
----------------
-
-O             = item is working
-P             = item is partially working
-X             = item is not working
-N             = item does not apply here
-<empty field> = item need to be examined
-
-       | PCI                               | USB
-item   | mt352 | nxt2002 | stv0299 | mt312 | mt352 | nxt2002 | stv0299 | mt312
--------+-------+---------+---------+-------+-------+---------+---------+-------
-1a)    | O     |         |         |       | N     | N       | N       | N
-1b)    | O     |         |         |       |       |         | O       |
-1c)    | N     | N       |         |       | N     | N       | O       |
-1d)    |                 O                 |                 O
-1e)    |                 O                 |                 O
-1f)    |                                   P
-1g)    |                                   O
-1h)    |                 P                 |
-1i)    |                 O                 |                 N
-1j)    |                 O                 |                 N
-1l)    |                 O                 |                 N
-2)     |                 O                 |                 N
-5a)    |                 N                 |                 O
-5b)*   |                 N                 |
-5c)    |                 N                 |                 O
-
-* - not done yet
-
-Known bugs and problems and TODO
---------------------------------
-
-1g/h/l) when pid filtering is enabled on the pci card
-
-DMA usage currently:
-  The DMA is splitted in 2 equal-sized subbuffers. The Flexcop writes to first
-  address and triggers an IRQ when it's full and starts writing to the second
-  address. When the second address is full, the IRQ is triggered again, and
-  the flexcop writes to first address again, and so on.
-  The buffersize of each address is currently 640*188 bytes.
-
-  Problem is, when using hw-pid-filtering and doing some low-bandwidth
-  operation (like scanning) the buffers won't be filled enough to trigger
-  the IRQ. That's why:
-
-  When PID filtering is activated, the timer IRQ is used. Every 1.97 ms the IRQ
-  is triggered.  Is the current write address of DMA1 different to the one
-  during the last IRQ, then the data is passed to the demuxer.
-
-  There is an additional DMA-IRQ-method: packet count IRQ. This isn't
-  implemented correctly yet.
-
-  The solution is to disable HW PID filtering, but I don't know how the DVB
-  API software demux behaves on slow systems with 45MBit/s TS.
-
-Solved bugs :)
---------------
-1g) pid-filtering (somehow pid index 4 and 5 (EMM_PID and ECM_PID) aren't
-working)
-SOLUTION: also index 0 was affected, because net_translation is done for
-these indexes by default
-
-5b) isochronous transfer does only work in the first attempt (for the Sky2PC
-USB, Air2PC is working) SOLUTION: the flexcop was going asleep and never really
-woke up again (don't know if this need fixes, see
-flexcop-fe-tuner.c:flexcop_sleep)
-
-NEWS: when the driver is loaded and unloaded and loaded again (w/o doing
-anything in the while the driver is loaded the first time), no transfers take
-place anymore.
-
-Improvements when rewriting (refactoring) is done
-=================================================
-
-- split sleeping of the flexcop (misc_204.ACPI3_sig = 1;) from lnb_control
-  (enable sleeping for other demods than dvb-s)
-- add support for CableStar (stv0297 Microtune 203x/ALPS) (almost done, incompatibilities with the Nexus-CA)
-
-Debugging
----------
-- add verbose debugging to skystar2.c (dump the reg_dw_data) and compare it
-  with this flexcop, this is important, because i2c is now using the
-  flexcop_ibi_value union from flexcop-reg.h (do you have a better idea for
-  that, please tell us so).
-
-Everything which is identical in the following table, can be put into a common
-flexcop-module.
-
-                  PCI                  USB
--------------------------------------------------------------------------------
-Different:
-Register access:  accessing IO memory  USB control message
-I2C bus:          I2C bus of the FC    USB control message
-Data transfer:    DMA                  isochronous transfer
-EEPROM transfer:  through i2c bus      not clear yet
-
-Identical:
-Streaming:                 accessing registers
-PID Filtering:             accessing registers
-Sram destinations:         accessing registers
-Tuner/Demod:                     I2C bus
-DVB-stuff:            can be written for common use
-
-Acknowledgements (just for the rewriting part)
-================
-
-Bjarne Steinsbo thought a lot in the first place of the pci part for this code
-sharing idea.
-
-Andreas Oberritter for providing a recent PCI initialization template
-(pluto2.c).
-
-Boleslaw Ciesielski for pointing out a problem with firmware loader.
-
-Vadim Catana for correcting the USB transfer.
-
-comments, critics and ideas to linux-dvb@linuxtv.org.
diff --git a/Documentation/dvb/technisat.txt b/Documentation/dvb/technisat.txt
index cdf6ee4b2da1..3f435ffb289c 100644
--- a/Documentation/dvb/technisat.txt
+++ b/Documentation/dvb/technisat.txt
@@ -1,5 +1,5 @@
-How to set up the Technisat devices
-===================================
+How to set up the Technisat/B2C2 Flexcop devices
+================================================
 
 1) Find out what device you have
 ================================
@@ -16,54 +16,60 @@ DVB: registering frontend 0 (Conexant CX24123/CX24109)...
 
 If the Technisat is the only TV device in your box get rid of unnecessary modules and check this one:
 "Multimedia devices" => "Customise analog and hybrid tuner modules to build"
-In this directory uncheck every driver which is activated there.
+In this directory uncheck every driver which is activated there (except "Simple tuner support" for case 9 only).
 
 Then please activate:
 2a) Main module part:
 
 a.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters"
-b.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Technisat/B2C2 Air/Sky/Cable2PC PCI" in case of a PCI card OR
+b.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Technisat/B2C2 Air/Sky/Cable2PC PCI" in case of a PCI card
+OR
 c.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Technisat/B2C2 Air/Sky/Cable2PC USB" in case of an USB 1.1 adapter
 d.)"Multimedia devices" => "DVB/ATSC adapters" => "Technisat/B2C2 FlexcopII(b) and FlexCopIII adapters" => "Enable debug for the B2C2 FlexCop drivers"
 Notice: d.) is helpful for troubleshooting
 
 2b) Frontend module part:
 
-1.) Revision 2.3:
+1.) SkyStar DVB-S Revision 2.3:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "Zarlink VP310/MT312/ZL10313 based"
 
-2.) Revision 2.6:
+2.) SkyStar DVB-S Revision 2.6:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "ST STV0299 based"
 
-3.) Revision 2.7:
+3.) SkyStar DVB-S Revision 2.7:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "Samsung S5H1420 based"
 c.)"Multimedia devices" => "Customise DVB frontends" => "Integrant ITD1000 Zero IF tuner for DVB-S/DSS"
 d.)"Multimedia devices" => "Customise DVB frontends" => "ISL6421 SEC controller"
 
-4.) Revision 2.8:
+4.) SkyStar DVB-S Revision 2.8:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "Conexant CX24113/CX24128 tuner for DVB-S/DSS"
 c.)"Multimedia devices" => "Customise DVB frontends" => "Conexant CX24123 based"
 d.)"Multimedia devices" => "Customise DVB frontends" => "ISL6421 SEC controller"
 
-5.) DVB-T card:
+5.) AirStar DVB-T card:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "Zarlink MT352 based"
 
-6.) DVB-C card:
+6.) CableStar DVB-C card:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "ST STV0297 based"
 
-7.) ATSC card 1st generation:
+7.) AirStar ATSC card 1st generation:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "Broadcom BCM3510"
 
-8.) ATSC card 2nd generation:
+8.) AirStar ATSC card 2nd generation:
 a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
 b.)"Multimedia devices" => "Customise DVB frontends" => "NxtWave Communications NXT2002/NXT2004 based"
-c.)"Multimedia devices" => "Customise DVB frontends" => "LG Electronics LGDT3302/LGDT3303 based"
+c.)"Multimedia devices" => "Customise DVB frontends" => "Generic I2C PLL based tuners"
 
-Author: Uwe Bugla <uwe.bugla@gmx.de> December 2008
+9.) AirStar ATSC card 3rd generation:
+a.)"Multimedia devices" => "Customise DVB frontends" => "Customise the frontend modules to build"
+b.)"Multimedia devices" => "Customise DVB frontends" => "LG Electronics LGDT3302/LGDT3303 based"
+c.)"Multimedia devices" => "Customise analog and hybrid tuner modules to build" => "Simple tuner support"
+
+Author: Uwe Bugla <uwe.bugla@gmx.de> February 2009
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 5ddbe350487a..20d3b94703a4 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -335,3 +335,12 @@ Why:	In 2.6.18 the Secmark concept was introduced to replace the "compat_net"
         Secmark, it is time to deprecate the older mechanism and start the
         process of removing the old code.
 Who:    Paul Moore <paul.moore@hp.com>
+---------------------------
+
+What:   sysfs ui for changing p4-clockmod parameters
+When:   September 2009
+Why:    See commits 129f8ae9b1b5be94517da76009ea956e89104ce8 and
+        e088e4c9cdb618675874becb91b2fd581ee707e6.
+        Removal is subject to fixing any remaining bugs in ACPI which may
+        cause the thermal throttling not to happen at the right time.
+Who:    Dave Jones <davej@redhat.com>, Matthew Garrett <mjg@redhat.com>
diff --git a/Documentation/filesystems/ext2.txt b/Documentation/filesystems/ext2.txt
index 4333e836c495..23448551cabe 100644
--- a/Documentation/filesystems/ext2.txt
+++ b/Documentation/filesystems/ext2.txt
@@ -373,10 +373,10 @@ Filesystem Resizing	http://ext2resize.sourceforge.net/
 Compression (*)         http://e2compr.sourceforge.net/
 
 Implementations for:
-Windows 95/98/NT/2000   http://uranus.it.swin.edu.au/~jn/linux/Explore2fs.htm
-Windows 95 (*)          http://www.yipton.demon.co.uk/content.html#FSDEXT2
+Windows 95/98/NT/2000   http://www.chrysocome.net/explore2fs
+Windows 95 (*)          http://www.yipton.net/content.html#FSDEXT2
 DOS client (*)          ftp://metalab.unc.edu/pub/Linux/system/filesystems/ext2/
-OS/2                    http://perso.wanadoo.fr/matthieu.willm/ext2-os2/
-RISC OS client          ftp://ftp.barnet.ac.uk/pub/acorn/armlinux/iscafs/
+OS/2 (*)                ftp://metalab.unc.edu/pub/Linux/system/filesystems/ext2/
+RISC OS client          http://www.esw-heim.tu-clausthal.de/~marco/smorbrod/IscaFS/
 
-(*) no longer actively developed/supported (as of Apr 2001)
+(*) no longer actively developed/supported (as of Mar 2009)
diff --git a/Documentation/filesystems/ext3.txt b/Documentation/filesystems/ext3.txt
index 9dd2a3bb2acc..e5f3833a6ef8 100644
--- a/Documentation/filesystems/ext3.txt
+++ b/Documentation/filesystems/ext3.txt
@@ -198,5 +198,5 @@ kernel source:	<file:fs/ext3/>
 programs:       http://e2fsprogs.sourceforge.net/
                 http://ext2resize.sourceforge.net
 
-useful links:   http://www-106.ibm.com/developerworks/linux/library/l-fs7/
-                http://www-106.ibm.com/developerworks/linux/library/l-fs8/
+useful links:   http://www.ibm.com/developerworks/library/l-fs7.html
+                http://www.ibm.com/developerworks/library/l-fs8.html
diff --git a/Documentation/filesystems/squashfs.txt b/Documentation/filesystems/squashfs.txt
index 3e79e4a7a392..b324c033035a 100644
--- a/Documentation/filesystems/squashfs.txt
+++ b/Documentation/filesystems/squashfs.txt
@@ -22,7 +22,7 @@ Squashfs filesystem features versus Cramfs:
 
                                 Squashfs                Cramfs
 
-Max filesystem size:            2^64                    16 MiB
+Max filesystem size:            2^64                    256 MiB
 Max file size:                  ~ 2 TiB                 16 MiB
 Max files:                      unlimited               unlimited
 Max directories:                unlimited               unlimited
diff --git a/Documentation/hwmon/lm90 b/Documentation/hwmon/lm90
index 0e8411710238..93d8e3d55150 100644
--- a/Documentation/hwmon/lm90
+++ b/Documentation/hwmon/lm90
@@ -42,6 +42,11 @@ Supported chips:
     Addresses scanned: I2C 0x4e
     Datasheet: Publicly available at the Maxim website
                http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497
+  * Maxim MAX6648
+    Prefix: 'max6646'
+    Addresses scanned: I2C 0x4c
+    Datasheet: Publicly available at the Maxim website
+               http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3500
   * Maxim MAX6649
     Prefix: 'max6646'
     Addresses scanned: I2C 0x4c
@@ -74,6 +79,11 @@ Supported chips:
                            0x4c, 0x4d and 0x4e
     Datasheet: Publicly available at the Maxim website
                http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3370
+  * Maxim MAX6692
+    Prefix: 'max6646'
+    Addresses scanned: I2C 0x4c
+    Datasheet: Publicly available at the Maxim website
+               http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3500
 
 
 Author: Jean Delvare <khali@linux-fr.org>
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 319785b6dcb1..54f21a5c262b 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -114,7 +114,7 @@ In addition, the following text indicates that the option:
 Parameters denoted with BOOT are actually interpreted by the boot
 loader, and have no meaning to the kernel directly.
 Do not modify the syntax of boot loader parameters without extreme
-need or coordination with <Documentation/x86/i386/boot.txt>.
+need or coordination with <Documentation/x86/boot.txt>.
 
 There are also arch-specific kernel-parameters not documented here.
 See for example <Documentation/x86/x86_64/boot-options.txt>.
@@ -868,8 +868,10 @@ and is between 256 and 4096 characters. It is defined in the file
         icn=            [HW,ISDN]
                         Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
 
-        ide=            [HW] (E)IDE subsystem
-                        Format: ide=nodma or ide=doubler
+        ide-core.nodma= [HW] (E)IDE subsystem
+                        Format: =0.0 to prevent dma on hda, =0.1 hdb =1.0 hdc
+                        .vlb_clock .pci_clock .noflush .noprobe .nowerr .cdrom
+                        .chs .ignore_cable are additional options
                         See Documentation/ide/ide.txt.
 
         idebus=         [HW] (E)IDE subsystem - VLB/PCI bus speed
@@ -2449,7 +2451,7 @@ and is between 256 and 4096 characters. It is defined in the file
                         See Documentation/fb/modedb.txt.
 
         vga=            [BOOT,X86-32] Select a particular video mode
-                        See Documentation/x86/i386/boot.txt and
+                        See Documentation/x86/boot.txt and
                         Documentation/svga.txt.
                         Use vga=ask for menu.
                         This is actually a boot loader parameter; the value is
diff --git a/Documentation/networking/ipv6.txt b/Documentation/networking/ipv6.txt
new file mode 100644
index 000000000000..268e5c103dd8
--- /dev/null
+++ b/Documentation/networking/ipv6.txt
@@ -0,0 +1,35 @@
+
+Options for the ipv6 module are supplied as parameters at load time.
+
+Module options may be given as command line arguments to the insmod
+or modprobe command, but are usually specified in either the
+/etc/modules.conf or /etc/modprobe.conf configuration file, or in a
+distro-specific configuration file.
+
+The available ipv6 module parameters are listed below.  If a parameter
+is not specified the default value is used.
+
+The parameters are as follows:
+
+disable
+
+        Specifies whether to load the IPv6 module, but disable all
+        its functionality.  This might be used when another module
+        has a dependency on the IPv6 module being loaded, but no
+        IPv6 addresses or operations are desired.
+
+        The possible values and their effects are:
+
+        0
+                IPv6 is enabled.
+
+                This is the default value.
+
+        1
+                IPv6 is disabled.
+
+                No IPv6 addresses will be added to interfaces, and
+                it will not be possible to open an IPv6 socket.
+
+                A reboot is required to enable IPv6.
+
diff --git a/Documentation/scsi/cxgb3i.txt b/Documentation/scsi/cxgb3i.txt
index 8141fa01978e..7ac8032ee9b2 100644
--- a/Documentation/scsi/cxgb3i.txt
+++ b/Documentation/scsi/cxgb3i.txt
@@ -4,7 +4,7 @@ Introduction
 ============
 
 The Chelsio T3 ASIC based Adapters (S310, S320, S302, S304, Mezz cards, etc.
-series of products) supports iSCSI acceleration and iSCSI Direct Data Placement
+series of products) support iSCSI acceleration and iSCSI Direct Data Placement
 (DDP) where the hardware handles the expensive byte touching operations, such
 as CRC computation and verification, and direct DMA to the final host memory
 destination:
@@ -31,9 +31,9 @@ destination:
           the TCP segments onto the wire. It handles TCP retransmission if
           needed.
 
-          On receving, S3 h/w recovers the iSCSI PDU by reassembling TCP
+          On receiving, S3 h/w recovers the iSCSI PDU by reassembling TCP
           segments, separating the header and data, calculating and verifying
-          the digests, then forwards the header to the host. The payload data,
+          the digests, then forwarding the header to the host. The payload data,
           if possible, will be directly placed into the pre-posted host DDP
           buffer. Otherwise, the payload data will be sent to the host too.
 
@@ -68,9 +68,8 @@ The following steps need to be taken to accelerates the open-iscsi initiator:
         sure the ip address is unique in the network.
 
 3. edit /etc/iscsi/iscsid.conf
-   The default setting for MaxRecvDataSegmentLength (131072) is too big,
-   replace "node.conn[0].iscsi.MaxRecvDataSegmentLength" to be a value no
-   bigger than 15360 (for example 8192):
+   The default setting for MaxRecvDataSegmentLength (131072) is too big;
+   replace with a value no bigger than 15360 (for example 8192):
 
         node.conn[0].iscsi.MaxRecvDataSegmentLength = 8192
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 59fd2d1d94a7..61aeb5aae244 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1469,8 +1469,6 @@ L:	linux-acpi@vger.kernel.org
 S:      Supported
 
 DOCUMENTATION (/Documentation directory)
-P:      Michael Kerrisk
-M:      mtk.manpages@gmail.com
 P:      Randy Dunlap
 M:      rdunlap@xenotime.net
 L:      linux-doc@vger.kernel.org
@@ -2464,7 +2462,7 @@ S:	Maintained
 
 ISDN SUBSYSTEM
 P:      Karsten Keil
-M:      kkeil@suse.de
+M:      isdn@linux-pingi.de
 L:      isdn4linux@listserv.isdn4linux.de (subscribers-only)
 W:      http://www.isdn4linux.de
 T:      git kernel.org:/pub/scm/linux/kernel/kkeil/isdn-2.6.git
@@ -2879,7 +2877,7 @@ P:	Michael Kerrisk
 M:      mtk.manpages@gmail.com
 W:      http://www.kernel.org/doc/man-pages
 L:      linux-man@vger.kernel.org
-S:      Supported
+S:      Maintained
 
 MARVELL LIBERTAS WIRELESS DRIVER
 P:      Dan Williams
diff --git a/Makefile b/Makefile
index df6ce3e80090..5a5b82eaaec2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 29
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Erotic Pickled Herring
 
 # *DOCUMENTATION*
@@ -904,12 +904,18 @@ localver = $(subst $(space),, $(string) \
 # and if the SCM is know a tag from the SCM is appended.
 # The appended tag is determined by the SCM used.
 #
-# Currently, only git is supported.
-# Other SCMs can edit scripts/setlocalversion and add the appropriate
-# checks as needed.
+# .scmversion is used when generating rpm packages so we do not loose
+# the version information from the SCM when we do the build of the kernel
+# from the copied source
 ifdef CONFIG_LOCALVERSION_AUTO
-        _localver-auto = $(shell $(CONFIG_SHELL) \
-                          $(srctree)/scripts/setlocalversion $(srctree))
+
+ifeq ($(wildcard .scmversion),)
+        _localver-auto = $(shell $(CONFIG_SHELL) \
+                         $(srctree)/scripts/setlocalversion $(srctree))
+else
+        _localver-auto = $(shell cat .scmversion 2> /dev/null)
+endif
+
         localver-auto  = $(LOCALVERSION)$(_localver-auto)
 endif
 
@@ -1537,7 +1543,7 @@ quiet_cmd_depmod = DEPMOD  $(KERNELRELEASE)
       cmd_depmod = \
         if [ -r System.map -a -x $(DEPMOD) ]; then                              \
                 $(DEPMOD) -ae -F System.map                                     \
-                $(if $(strip $(INSTALL_MOD_PATH)), -b $(INSTALL_MOD_PATH) -r)   \
+                $(if $(strip $(INSTALL_MOD_PATH)), -b $(INSTALL_MOD_PATH) )     \
                 $(KERNELRELEASE);                                               \
         fi
 
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index 7049815d66d5..68d6494c0389 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -233,12 +233,13 @@ static void __init cacheid_init(void)
         unsigned int cachetype = read_cpuid_cachetype();
         unsigned int arch = cpu_architecture();
 
-        if (arch >= CPU_ARCH_ARMv7) {
-                cacheid = CACHEID_VIPT_NONALIASING;
-                if ((cachetype & (3 << 14)) == 1 << 14)
-                        cacheid |= CACHEID_ASID_TAGGED;
-        } else if (arch >= CPU_ARCH_ARMv6) {
-                if (cachetype & (1 << 23))
+        if (arch >= CPU_ARCH_ARMv6) {
+                if ((cachetype & (7 << 29)) == 4 << 29) {
+                        /* ARMv7 register format */
+                        cacheid = CACHEID_VIPT_NONALIASING;
+                        if ((cachetype & (3 << 14)) == 1 << 14)
+                                cacheid |= CACHEID_ASID_TAGGED;
+                } else if (cachetype & (1 << 23))
                         cacheid = CACHEID_VIPT_ALIASING;
                 else
                         cacheid = CACHEID_VIPT_NONALIASING;
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index 134af97ff340..b7f233242315 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -347,6 +347,111 @@ void __init at91_add_device_mmc(short mmc_id, struct at91_mmc_data *data)
 void __init at91_add_device_mmc(short mmc_id, struct at91_mmc_data *data) {}
 #endif
 
+/* --------------------------------------------------------------------
+ *  Compact Flash (PCMCIA or IDE)
+ * -------------------------------------------------------------------- */
+
+#if defined(CONFIG_AT91_CF) || defined(CONFIG_AT91_CF_MODULE) || \
+    defined(CONFIG_BLK_DEV_IDE_AT91) || defined(CONFIG_BLK_DEV_IDE_AT91_MODULE)
+
+static struct at91_cf_data cf0_data;
+
+static struct resource cf0_resources[] = {
+        [0] = {
+                .start  = AT91_CHIPSELECT_4,
+                .end    = AT91_CHIPSELECT_4 + SZ_256M - 1,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_8AND16BIT,
+        }
+};
+
+static struct platform_device cf0_device = {
+        .id             = 0,
+        .dev            = {
+                                .platform_data  = &cf0_data,
+        },
+        .resource       = cf0_resources,
+        .num_resources  = ARRAY_SIZE(cf0_resources),
+};
+
+static struct at91_cf_data cf1_data;
+
+static struct resource cf1_resources[] = {
+        [0] = {
+                .start  = AT91_CHIPSELECT_5,
+                .end    = AT91_CHIPSELECT_5 + SZ_256M - 1,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_8AND16BIT,
+        }
+};
+
+static struct platform_device cf1_device = {
+        .id             = 1,
+        .dev            = {
+                                .platform_data  = &cf1_data,
+        },
+        .resource       = cf1_resources,
+        .num_resources  = ARRAY_SIZE(cf1_resources),
+};
+
+void __init at91_add_device_cf(struct at91_cf_data *data)
+{
+        unsigned long ebi0_csa;
+        struct platform_device *pdev;
+
+        if (!data)
+                return;
+
+        /*
+         * assign CS4 or CS5 to SMC with Compact Flash logic support,
+         * we assume SMC timings are configured by board code,
+         * except True IDE where timings are controlled by driver
+         */
+        ebi0_csa = at91_sys_read(AT91_MATRIX_EBI0CSA);
+        switch (data->chipselect) {
+        case 4:
+                at91_set_A_periph(AT91_PIN_PD6, 0);  /* EBI0_NCS4/CFCS0 */
+                ebi0_csa |= AT91_MATRIX_EBI0_CS4A_SMC_CF1;
+                cf0_data = *data;
+                pdev = &cf0_device;
+                break;
+        case 5:
+                at91_set_A_periph(AT91_PIN_PD7, 0);  /* EBI0_NCS5/CFCS1 */
+                ebi0_csa |= AT91_MATRIX_EBI0_CS5A_SMC_CF2;
+                cf1_data = *data;
+                pdev = &cf1_device;
+                break;
+        default:
+                printk(KERN_ERR "AT91 CF: bad chip-select requested (%u)\n",
+                       data->chipselect);
+                return;
+        }
+        at91_sys_write(AT91_MATRIX_EBI0CSA, ebi0_csa);
+
+        if (data->det_pin) {
+                at91_set_gpio_input(data->det_pin, 1);
+                at91_set_deglitch(data->det_pin, 1);
+        }
+
+        if (data->irq_pin) {
+                at91_set_gpio_input(data->irq_pin, 1);
+                at91_set_deglitch(data->irq_pin, 1);
+        }
+
+        if (data->vcc_pin)
+                /* initially off */
+                at91_set_gpio_output(data->vcc_pin, 0);
+
+        /* enable EBI controlled pins */
+        at91_set_A_periph(AT91_PIN_PD5, 1);  /* NWAIT */
+        at91_set_A_periph(AT91_PIN_PD8, 0);  /* CFCE1 */
+        at91_set_A_periph(AT91_PIN_PD9, 0);  /* CFCE2 */
+        at91_set_A_periph(AT91_PIN_PD14, 0); /* CFNRW */
+
+        pdev->name = (data->flags & AT91_CF_TRUE_IDE) ? "at91_ide" : "at91_cf";
+        platform_device_register(pdev);
+}
+#else
+void __init at91_add_device_cf(struct at91_cf_data *data) {}
+#endif
 
 /* --------------------------------------------------------------------
  *  NAND / SmartMedia
diff --git a/arch/arm/mach-at91/include/mach/board.h b/arch/arm/mach-at91/include/mach/board.h
index 0b3ae21b4565..793fe7b25f36 100644
--- a/arch/arm/mach-at91/include/mach/board.h
+++ b/arch/arm/mach-at91/include/mach/board.h
@@ -56,6 +56,9 @@ struct at91_cf_data {
         u8      vcc_pin;                /* power switching */
         u8      rst_pin;                /* card reset */
         u8      chipselect;             /* EBI Chip Select number */
+        u8      flags;
+#define AT91_CF_TRUE_IDE        0x01
+#define AT91_IDE_SWAP_A0_A2     0x02
 };
 extern void __init at91_add_device_cf(struct at91_cf_data *data);
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 9bb4f043aa22..7ac812dc055a 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -332,7 +332,6 @@ static int at91_pm_enter(suspend_state_t state)
                         at91_sys_read(AT91_AIC_IPR) & at91_sys_read(AT91_AIC_IMR));
 
 error:
-        sdram_selfrefresh_disable();
         target_state = PM_SUSPEND_ON;
         at91_irq_resume();
         at91_gpio_resume();
diff --git a/arch/arm/mach-davinci/board-evm.c b/arch/arm/mach-davinci/board-evm.c
index a957d239a683..38b6a9ce2a93 100644
--- a/arch/arm/mach-davinci/board-evm.c
+++ b/arch/arm/mach-davinci/board-evm.c
@@ -311,6 +311,9 @@ evm_u35_setup(struct i2c_client *client, int gpio, unsigned ngpio, void *c)
         gpio_request(gpio + 7, "nCF_SEL");
         gpio_direction_output(gpio + 7, 1);
 
+        /* irlml6401 sustains over 3A, switches 5V in under 8 msec */
+        setup_usb(500, 8);
+
         return 0;
 }
 
@@ -417,9 +420,6 @@ static __init void davinci_evm_init(void)
         platform_add_devices(davinci_evm_devices,
                              ARRAY_SIZE(davinci_evm_devices));
         evm_init_i2c();
-
-        /* irlml6401 sustains over 3A, switches 5V in under 8 msec */
-        setup_usb(500, 8);
 }
 
 static __init void davinci_evm_irq_init(void)
diff --git a/arch/arm/mach-davinci/clock.c b/arch/arm/mach-davinci/clock.c
index 28f6dbc95bd7..abb92b7eca0c 100644
--- a/arch/arm/mach-davinci/clock.c
+++ b/arch/arm/mach-davinci/clock.c
@@ -231,6 +231,11 @@ static struct clk davinci_clks[] = {
                 .lpsc = DAVINCI_LPSC_GPIO,
         },
         {
+                .name = "usb",
+                .rate = &commonrate,
+                .lpsc = DAVINCI_LPSC_USB,
+        },
+        {
                 .name = "AEMIFCLK",
                 .rate = &commonrate,
                 .lpsc = DAVINCI_LPSC_AEMIF,
diff --git a/arch/arm/mach-davinci/usb.c b/arch/arm/mach-davinci/usb.c
index 867ead2559ad..69680784448a 100644
--- a/arch/arm/mach-davinci/usb.c
+++ b/arch/arm/mach-davinci/usb.c
@@ -47,6 +47,7 @@ static struct musb_hdrc_platform_data usb_data = {
 #elif defined(CONFIG_USB_MUSB_HOST)
         .mode           = MUSB_HOST,
 #endif
+        .clock          = "usb",
         .config         = &musb_config,
 };
 
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index f6a13451d1fd..6031e179926b 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -81,7 +81,7 @@ static inline void __init ldp_init_smc911x(void)
         }
 
         ldp_smc911x_resources[0].start = cs_mem_base + 0x0;
-        ldp_smc911x_resources[0].end   = cs_mem_base + 0xf;
+        ldp_smc911x_resources[0].end   = cs_mem_base + 0xff;
         udelay(100);
 
         eth_gpio = LDP_SMC911X_GPIO;
diff --git a/arch/arm/mach-rpc/riscpc.c b/arch/arm/mach-rpc/riscpc.c
index e88d417736af..c7fc01e9d1f6 100644
--- a/arch/arm/mach-rpc/riscpc.c
+++ b/arch/arm/mach-rpc/riscpc.c
@@ -19,6 +19,7 @@
 #include <linux/serial_8250.h>
 #include <linux/ata_platform.h>
 #include <linux/io.h>
+#include <linux/i2c.h>
 
 #include <asm/elf.h>
 #include <asm/mach-types.h>
@@ -201,8 +202,13 @@ static struct platform_device *devs[] __initdata = {
         &pata_device,
 };
 
+static struct i2c_board_info i2c_rtc = {
+        I2C_BOARD_INFO("pcf8583", 0x50)
+};
+
 static int __init rpc_init(void)
 {
+        i2c_register_board_info(0, &i2c_rtc, 1);
         return platform_add_devices(devs, ARRAY_SIZE(devs));
 }
 
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index 8a7f65ba14b7..94077fbd96b7 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -23,7 +23,8 @@ ENTRY(v6_early_abort)
 #ifdef CONFIG_CPU_32v6K
         clrex
 #else
-        strex   r0, r1, [sp]                    @ Clear the exclusive monitor
+        sub     r1, sp, #4                      @ Get unused stack location
+        strex   r0, r1, [r1]                    @ Clear the exclusive monitor
 #endif
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
diff --git a/arch/arm/plat-s3c64xx/irq-eint.c b/arch/arm/plat-s3c64xx/irq-eint.c
index 1f7cc0067f5c..ebb305ce7689 100644
--- a/arch/arm/plat-s3c64xx/irq-eint.c
+++ b/arch/arm/plat-s3c64xx/irq-eint.c
@@ -55,7 +55,7 @@ static void s3c_irq_eint_unmask(unsigned int irq)
         u32 mask;
 
         mask = __raw_readl(S3C64XX_EINT0MASK);
-        mask |= eint_irq_to_bit(irq);
+        mask &= ~eint_irq_to_bit(irq);
         __raw_writel(mask, S3C64XX_EINT0MASK);
 }
 
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index 8f1f97d56e1e..0c1f86e3e44a 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -1129,6 +1129,7 @@ endchoice
 
 config PM_WAKEUP_BY_GPIO
         bool "Allow Wakeup from Standby by GPIO"
+        depends on PM && !BF54x
 
 config PM_WAKEUP_GPIO_NUMBER
         int "GPIO number"
@@ -1168,6 +1169,12 @@ config PM_BFIN_WAKE_GP
         default n
         help
           Enable General-Purpose Wake-Up (Voltage Regulator Power-Up)
+          (all processors, except ADSP-BF549). This option sets
+          the general-purpose wake-up enable (GPWE) control bit to enable
+          wake-up upon detection of an active low signal on the /GPW (PH7) pin.
+          On ADSP-BF549 this option enables the the same functionality on the
+          /MRXON pin also PH7.
+
 endmenu
 
 menu "CPU Frequency scaling"
diff --git a/arch/blackfin/Kconfig.debug b/arch/blackfin/Kconfig.debug
index 5f981d9ca625..79e7e63ab709 100644
--- a/arch/blackfin/Kconfig.debug
+++ b/arch/blackfin/Kconfig.debug
@@ -21,12 +21,6 @@ config DEBUG_STACK_USAGE
 config HAVE_ARCH_KGDB
         def_bool y
 
-config KGDB_TESTCASE
-        tristate "KGDB: for test case in expect"
-        default n
-        help
-          This is a kgdb test case for automated testing.
-
 config DEBUG_VERBOSE
         bool "Verbose fault messages"
         default y
diff --git a/arch/blackfin/configs/BF518F-EZBRD_defconfig b/arch/blackfin/configs/BF518F-EZBRD_defconfig
index 4fdb9e04759f..281f4b60e603 100644
--- a/arch/blackfin/configs/BF518F-EZBRD_defconfig
+++ b/arch/blackfin/configs/BF518F-EZBRD_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc2
-# Fri Jan  9 17:58:41 2009
+# Linux kernel version: 2.6.28
+# Fri Feb 20 10:01:44 2009
 #
 # CONFIG_MMU is not set
 # CONFIG_FPU is not set
@@ -133,10 +133,15 @@ CONFIG_BF518=y
 # CONFIG_BF538 is not set
 # CONFIG_BF539 is not set
 # CONFIG_BF542 is not set
+# CONFIG_BF542M is not set
 # CONFIG_BF544 is not set
+# CONFIG_BF544M is not set
 # CONFIG_BF547 is not set
+# CONFIG_BF547M is not set
 # CONFIG_BF548 is not set
+# CONFIG_BF548M is not set
 # CONFIG_BF549 is not set
+# CONFIG_BF549M is not set
 # CONFIG_BF561 is not set
 CONFIG_BF_REV_MIN=0
 CONFIG_BF_REV_MAX=2
@@ -426,7 +431,17 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
-# CONFIG_NET_DSA is not set
+CONFIG_NET_DSA=y
+# CONFIG_NET_DSA_TAG_DSA is not set
+# CONFIG_NET_DSA_TAG_EDSA is not set
+# CONFIG_NET_DSA_TAG_TRAILER is not set
+CONFIG_NET_DSA_TAG_STPID=y
+# CONFIG_NET_DSA_MV88E6XXX is not set
+# CONFIG_NET_DSA_MV88E6060 is not set
+# CONFIG_NET_DSA_MV88E6XXX_NEED_PPU is not set
+# CONFIG_NET_DSA_MV88E6131 is not set
+# CONFIG_NET_DSA_MV88E6123_61_65 is not set
+CONFIG_NET_DSA_KSZ8893M=y
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
 # CONFIG_LLC2 is not set
@@ -529,6 +544,8 @@ CONFIG_MTD_COMPLEX_MAPPINGS=y
 #
 # Self-contained MTD device drivers
 #
+# CONFIG_MTD_DATAFLASH is not set
+# CONFIG_MTD_M25P80 is not set
 # CONFIG_MTD_SLRAM is not set
 # CONFIG_MTD_PHRAM is not set
 # CONFIG_MTD_MTDRAM is not set
@@ -561,7 +578,9 @@ CONFIG_BLK_DEV_RAM_SIZE=4096
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_EEPROM_93CX6 is not set
+# CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_C2PORT is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -607,6 +626,7 @@ CONFIG_BFIN_RX_DESC_NUM=20
 # CONFIG_SMC91X is not set
 # CONFIG_SMSC911X is not set
 # CONFIG_DM9000 is not set
+# CONFIG_ENC28J60 is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
@@ -764,7 +784,23 @@ CONFIG_I2C_BLACKFIN_TWI_CLK_KHZ=100
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-# CONFIG_SPI is not set
+CONFIG_SPI=y
+# CONFIG_SPI_DEBUG is not set
+CONFIG_SPI_MASTER=y
+
+#
+# SPI Master Controller Drivers
+#
+CONFIG_SPI_BFIN=y
+# CONFIG_SPI_BFIN_LOCK is not set
+# CONFIG_SPI_BITBANG is not set
+
+#
+# SPI Protocol Masters
+#
+# CONFIG_SPI_AT25 is not set
+# CONFIG_SPI_SPIDEV is not set
+# CONFIG_SPI_TLE62X0 is not set
 CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
@@ -788,8 +824,10 @@ CONFIG_BFIN_WDT=y
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
@@ -861,10 +899,18 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_M41T80 is not set
 # CONFIG_RTC_DRV_S35390A is not set
 # CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
 
 #
 # SPI RTC drivers
 #
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
+# CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_DS3234 is not set
 
 #
 # Platform RTC drivers
@@ -1062,12 +1108,20 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_FAULT_INJECTION is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
+
+#
+# Tracers
+#
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_BOOT_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_KGDB_TESTCASE is not set
 CONFIG_DEBUG_VERBOSE=y
 CONFIG_DEBUG_MMRS=y
 # CONFIG_DEBUG_HWERR is not set
@@ -1100,6 +1154,7 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 # CONFIG_CRYPTO_MANAGER is not set
+# CONFIG_CRYPTO_MANAGER2 is not set
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/blackfin/configs/BF527-EZKIT_defconfig b/arch/blackfin/configs/BF527-EZKIT_defconfig
index 833128b39724..a50050f17706 100644
--- a/arch/blackfin/configs/BF527-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF527-EZKIT_defconfig
@@ -327,8 +327,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/BF533-EZKIT_defconfig b/arch/blackfin/configs/BF533-EZKIT_defconfig
index 334c94b51c40..0a2a00d63887 100644
--- a/arch/blackfin/configs/BF533-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF533-EZKIT_defconfig
@@ -290,8 +290,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/BF533-STAMP_defconfig b/arch/blackfin/configs/BF533-STAMP_defconfig
index 9d733436e300..eb027587a355 100644
--- a/arch/blackfin/configs/BF533-STAMP_defconfig
+++ b/arch/blackfin/configs/BF533-STAMP_defconfig
@@ -290,8 +290,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/BF537-STAMP_defconfig b/arch/blackfin/configs/BF537-STAMP_defconfig
index 4fb4108d3103..9e62b9f40eb1 100644
--- a/arch/blackfin/configs/BF537-STAMP_defconfig
+++ b/arch/blackfin/configs/BF537-STAMP_defconfig
@@ -298,8 +298,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
@@ -568,15 +568,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 # CONFIG_MTD_DOC2000 is not set
 # CONFIG_MTD_DOC2001 is not set
 # CONFIG_MTD_DOC2001PLUS is not set
-CONFIG_MTD_NAND=m
-# CONFIG_MTD_NAND_VERIFY_WRITE is not set
-# CONFIG_MTD_NAND_ECC_SMC is not set
-# CONFIG_MTD_NAND_MUSEUM_IDS is not set
-# CONFIG_MTD_NAND_BFIN is not set
-CONFIG_MTD_NAND_IDS=m
-# CONFIG_MTD_NAND_DISKONCHIP is not set
-# CONFIG_MTD_NAND_NANDSIM is not set
-CONFIG_MTD_NAND_PLATFORM=m
+# CONFIG_MTD_NAND is not set
 # CONFIG_MTD_ONENAND is not set
 
 #
diff --git a/arch/blackfin/configs/BF538-EZKIT_defconfig b/arch/blackfin/configs/BF538-EZKIT_defconfig
index cb32f5624a1b..dd6ad6be1c87 100644
--- a/arch/blackfin/configs/BF538-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF538-EZKIT_defconfig
@@ -306,8 +306,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/BF548-EZKIT_defconfig b/arch/blackfin/configs/BF548-EZKIT_defconfig
index 0f8697618aa5..6bc2fb1b2a70 100644
--- a/arch/blackfin/configs/BF548-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF548-EZKIT_defconfig
@@ -361,8 +361,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_BFIN_L2_CACHEABLE is not set
 # CONFIG_MPU is not set
 
@@ -680,7 +680,7 @@ CONFIG_SCSI=y
 CONFIG_SCSI_DMA=y
 # CONFIG_SCSI_TGT is not set
 # CONFIG_SCSI_NETLINK is not set
-CONFIG_SCSI_PROC_FS=y
+# CONFIG_SCSI_PROC_FS is not set
 
 #
 # SCSI support type (disk, tape, CD-ROM)
diff --git a/arch/blackfin/configs/BF561-EZKIT_defconfig b/arch/blackfin/configs/BF561-EZKIT_defconfig
index 042c7adfccfa..69714fb3e608 100644
--- a/arch/blackfin/configs/BF561-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF561-EZKIT_defconfig
@@ -329,8 +329,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_BFIN_L2_CACHEABLE is not set
 # CONFIG_MPU is not set
 
diff --git a/arch/blackfin/configs/BlackStamp_defconfig b/arch/blackfin/configs/BlackStamp_defconfig
index 3a20e281d23c..017c6ea071b5 100644
--- a/arch/blackfin/configs/BlackStamp_defconfig
+++ b/arch/blackfin/configs/BlackStamp_defconfig
@@ -288,8 +288,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/CM-BF527_defconfig b/arch/blackfin/configs/CM-BF527_defconfig
index 865ed85a5760..d880ef786770 100644
--- a/arch/blackfin/configs/CM-BF527_defconfig
+++ b/arch/blackfin/configs/CM-BF527_defconfig
@@ -332,8 +332,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 # CONFIG_MPU is not set
 
 #
diff --git a/arch/blackfin/configs/CM-BF548_defconfig b/arch/blackfin/configs/CM-BF548_defconfig
index efe9741b1f14..f410430b4e3d 100644
--- a/arch/blackfin/configs/CM-BF548_defconfig
+++ b/arch/blackfin/configs/CM-BF548_defconfig
@@ -336,8 +336,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 CONFIG_L1_MAX_PIECE=16
 # CONFIG_MPU is not set
 
@@ -595,7 +595,7 @@ CONFIG_SCSI=y
 CONFIG_SCSI_DMA=y
 # CONFIG_SCSI_TGT is not set
 # CONFIG_SCSI_NETLINK is not set
-CONFIG_SCSI_PROC_FS=y
+# CONFIG_SCSI_PROC_FS is not set
 
 #
 # SCSI support type (disk, tape, CD-ROM)
diff --git a/arch/blackfin/configs/IP0X_defconfig b/arch/blackfin/configs/IP0X_defconfig
index eae83b5de92f..7db93874c987 100644
--- a/arch/blackfin/configs/IP0X_defconfig
+++ b/arch/blackfin/configs/IP0X_defconfig
@@ -612,7 +612,7 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 CONFIG_SCSI=y
 # CONFIG_SCSI_TGT is not set
 # CONFIG_SCSI_NETLINK is not set
-CONFIG_SCSI_PROC_FS=y
+# CONFIG_SCSI_PROC_FS is not set
 
 #
 # SCSI support type (disk, tape, CD-ROM)
diff --git a/arch/blackfin/configs/SRV1_defconfig b/arch/blackfin/configs/SRV1_defconfig
index fa580affc9d6..a46529c6ade3 100644
--- a/arch/blackfin/configs/SRV1_defconfig
+++ b/arch/blackfin/configs/SRV1_defconfig
@@ -282,8 +282,8 @@ CONFIG_BFIN_ICACHE=y
 CONFIG_BFIN_DCACHE=y
 # CONFIG_BFIN_DCACHE_BANKA is not set
 # CONFIG_BFIN_ICACHE_LOCK is not set
-# CONFIG_BFIN_WB is not set
-CONFIG_BFIN_WT=y
+CONFIG_BFIN_WB=y
+# CONFIG_BFIN_WT is not set
 CONFIG_L1_MAX_PIECE=16
 
 #
diff --git a/arch/blackfin/include/asm/Kbuild b/arch/blackfin/include/asm/Kbuild
index 606ecfdcc962..09c31418cc08 100644
--- a/arch/blackfin/include/asm/Kbuild
+++ b/arch/blackfin/include/asm/Kbuild
@@ -1,3 +1,4 @@
 include include/asm-generic/Kbuild.asm
 
+unifdef-y += bfin_sport.h
 unifdef-y += fixed_code.h
diff --git a/arch/blackfin/include/asm/bfin_sport.h b/arch/blackfin/include/asm/bfin_sport.h
index fe88a2c19213..65a651db5b07 100644
--- a/arch/blackfin/include/asm/bfin_sport.h
+++ b/arch/blackfin/include/asm/bfin_sport.h
@@ -1,30 +1,9 @@
 /*
- * File:         include/asm-blackfin/bfin_sport.h
- * Based on:
- * Author:       Roy Huang (roy.huang@analog.com)
+ * bfin_sport.h - userspace header for bfin sport driver
  *
- * Created:      Thu Aug. 24 2006
- * Description:
+ * Copyright 2004-2008 Analog Devices Inc.
  *
- * Modified:
- *               Copyright 2004-2006 Analog Devices Inc.
- *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ * Licensed under the GPL-2 or later.
  */
 
 #ifndef __BFIN_SPORT_H__
@@ -42,11 +21,10 @@
 #define NORM_FORMAT     0x0
 #define ALAW_FORMAT     0x2
 #define ULAW_FORMAT     0x3
-struct sport_register;
 
 /* Function driver which use sport must initialize the structure */
 struct sport_config {
-        /*TDM (multichannels), I2S or other mode */
+        /* TDM (multichannels), I2S or other mode */
         unsigned int mode:3;
 
         /* if TDM mode is selected, channels must be set */
@@ -72,12 +50,18 @@ struct sport_config {
         int serial_clk;
         int fsync_clk;
 
-        unsigned int data_format:2;     /*Normal, u-law or a-law */
+        unsigned int data_format:2;     /* Normal, u-law or a-law */
 
         int word_len;           /* How length of the word in bits, 3-32 bits */
         int dma_enabled;
 };
 
+/* Userspace interface */
+#define SPORT_IOC_MAGIC         'P'
+#define SPORT_IOC_CONFIG        _IOWR('P', 0x01, struct sport_config)
+
+#ifdef __KERNEL__
+
 struct sport_register {
         unsigned short tcr1;
         unsigned short reserved0;
@@ -117,9 +101,6 @@ struct sport_register {
         unsigned long mrcs3;
 };
 
-#define SPORT_IOC_MAGIC         'P'
-#define SPORT_IOC_CONFIG        _IOWR('P', 0x01, struct sport_config)
-
 struct sport_dev {
         struct cdev cdev;       /* Char device structure */
 
@@ -149,6 +130,8 @@ struct sport_dev {
         struct sport_config config;
 };
 
+#endif
+
 #define SPORT_TCR1      0
 #define SPORT_TCR2      1
 #define SPORT_TCLKDIV   2
@@ -169,4 +152,4 @@ struct sport_dev {
 #define SPORT_MRCS2     22
 #define SPORT_MRCS3     23
 
-#endif                          /*__BFIN_SPORT_H__*/
+#endif
diff --git a/arch/blackfin/include/asm/ipipe.h b/arch/blackfin/include/asm/ipipe.h
index 76f53d8b9a0d..343b56361ec9 100644
--- a/arch/blackfin/include/asm/ipipe.h
+++ b/arch/blackfin/include/asm/ipipe.h
@@ -35,9 +35,9 @@
 #include <asm/atomic.h>
 #include <asm/traps.h>
 
-#define IPIPE_ARCH_STRING     "1.8-00"
+#define IPIPE_ARCH_STRING     "1.9-00"
 #define IPIPE_MAJOR_NUMBER    1
-#define IPIPE_MINOR_NUMBER    8
+#define IPIPE_MINOR_NUMBER    9
 #define IPIPE_PATCH_NUMBER    0
 
 #ifdef CONFIG_SMP
@@ -83,9 +83,9 @@ struct ipipe_sysinfo {
                                 "%2 = CYCLES2\n"                \
                                 "CC = %2 == %0\n"               \
                                 "if ! CC jump 1b\n"             \
-                                : "=r" (((unsigned long *)&t)[1]),      \
-                                  "=r" (((unsigned long *)&t)[0]),      \
-                                  "=r" (__cy2)                          \
+                                : "=d,a" (((unsigned long *)&t)[1]),    \
+                                  "=d,a" (((unsigned long *)&t)[0]),    \
+                                  "=d,a" (__cy2)                                \
                                 : /*no input*/ : "CC");                 \
         t;                                                              \
         })
@@ -118,35 +118,40 @@ void __ipipe_disable_irqdesc(struct ipipe_domain *ipd,
 
 #define __ipipe_disable_irq(irq)        (irq_desc[irq].chip->mask(irq))
 
-#define __ipipe_lock_root()                                     \
-        set_bit(IPIPE_ROOTLOCK_FLAG, &ipipe_root_domain->flags)
+static inline int __ipipe_check_tickdev(const char *devname)
+{
+        return 1;
+}
 
-#define __ipipe_unlock_root()                                   \
-        clear_bit(IPIPE_ROOTLOCK_FLAG, &ipipe_root_domain->flags)
+static inline void __ipipe_lock_root(void)
+{
+        set_bit(IPIPE_SYNCDEFER_FLAG, &ipipe_root_cpudom_var(status));
+}
+
+static inline void __ipipe_unlock_root(void)
+{
+        clear_bit(IPIPE_SYNCDEFER_FLAG, &ipipe_root_cpudom_var(status));
+}
 
 void __ipipe_enable_pipeline(void);
 
 #define __ipipe_hook_critical_ipi(ipd) do { } while (0)
 
-#define __ipipe_sync_pipeline(syncmask)                                 \
-        do {                                                            \
-                struct ipipe_domain *ipd = ipipe_current_domain;        \
-                if (likely(ipd != ipipe_root_domain || !test_bit(IPIPE_ROOTLOCK_FLAG, &ipd->flags))) \
-                        __ipipe_sync_stage(syncmask);                   \
-        } while (0)
+#define __ipipe_sync_pipeline  ___ipipe_sync_pipeline
+void ___ipipe_sync_pipeline(unsigned long syncmask);
 
 void __ipipe_handle_irq(unsigned irq, struct pt_regs *regs);
 
 int __ipipe_get_irq_priority(unsigned irq);
 
-int __ipipe_get_irqthread_priority(unsigned irq);
-
 void __ipipe_stall_root_raw(void);
 
 void __ipipe_unstall_root_raw(void);
 
 void __ipipe_serial_debug(const char *fmt, ...);
 
+asmlinkage void __ipipe_call_irqtail(unsigned long addr);
+
 DECLARE_PER_CPU(struct pt_regs, __ipipe_tick_regs);
 
 extern unsigned long __ipipe_core_clock;
@@ -162,42 +167,25 @@ static inline unsigned long __ipipe_ffnz(unsigned long ul)
 
 #define __ipipe_run_irqtail()  /* Must be a macro */                    \
         do {                                                            \
-                asmlinkage void __ipipe_call_irqtail(void);             \
                 unsigned long __pending;                                \
-                CSYNC();                                        \
+                CSYNC();                                                \
                 __pending = bfin_read_IPEND();                          \
                 if (__pending & 0x8000) {                               \
                         __pending &= ~0x8010;                           \
                         if (__pending && (__pending & (__pending - 1)) == 0) \
-                                __ipipe_call_irqtail();                 \
+                                __ipipe_call_irqtail(__ipipe_irq_tail_hook); \
                 }                                                       \
         } while (0)
 
 #define __ipipe_run_isr(ipd, irq)                                       \
         do {                                                            \
                 if (ipd == ipipe_root_domain) {                         \
-                        /*                                              \
-                         * Note: the I-pipe implements a threaded interrupt model on \
-                         * this arch for Linux external IRQs. The interrupt handler we \
-                         * call here only wakes up the associated IRQ thread. \
-                         */                                             \
-                        if (ipipe_virtual_irq_p(irq)) {                 \
-                                /* No irqtail here; virtual interrupts have no effect \
-                                   on IPEND so there is no need for processing \
-                                   deferral. */                         \
-                                local_irq_enable_nohead(ipd);           \
+                        local_irq_enable_hw();                          \
+                        if (ipipe_virtual_irq_p(irq))                   \
                                 ipd->irqs[irq].handler(irq, ipd->irqs[irq].cookie); \
-                                local_irq_disable_nohead(ipd);          \
-                        } else                                          \
-                                /*                                      \
-                                 * No need to run the irqtail here either; \
-                                 * we can't be preempted by hw IRQs, so \
-                                 * non-Linux IRQs cannot stack over the short \
-                                 * thread wakeup code. Which in turn means \
-                                 * that no irqtail condition could be pending \
-                                 * for domains above Linux in the pipeline. \
-                                 */                                     \
+                        else                                            \
                                 ipd->irqs[irq].handler(irq, &__raw_get_cpu_var(__ipipe_tick_regs)); \
+                        local_irq_disable_hw();                         \
                 } else {                                                \
                         __clear_bit(IPIPE_SYNC_FLAG, &ipipe_cpudom_var(ipd, status)); \
                         local_irq_enable_nohead(ipd);                   \
@@ -217,42 +205,24 @@ void ipipe_init_irq_threads(void);
 
 int ipipe_start_irq_thread(unsigned irq, struct irq_desc *desc);
 
-#define IS_SYSIRQ(irq)          ((irq) > IRQ_CORETMR && (irq) <= SYS_IRQS)
-#define IS_GPIOIRQ(irq)         ((irq) >= GPIO_IRQ_BASE && (irq) < NR_IRQS)
-
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+#define IRQ_SYSTMR              IRQ_CORETMR
+#define IRQ_PRIOTMR             IRQ_CORETMR
+#else
 #define IRQ_SYSTMR              IRQ_TIMER0
 #define IRQ_PRIOTMR             CONFIG_IRQ_TIMER0
+#endif
 
-#if defined(CONFIG_BF531) || defined(CONFIG_BF532) || defined(CONFIG_BF533)
-#define PRIO_GPIODEMUX(irq)     CONFIG_PFA
-#elif defined(CONFIG_BF534) || defined(CONFIG_BF536) || defined(CONFIG_BF537)
-#define PRIO_GPIODEMUX(irq)     CONFIG_IRQ_PROG_INTA
-#elif defined(CONFIG_BF52x)
-#define PRIO_GPIODEMUX(irq)     ((irq) == IRQ_PORTF_INTA ? CONFIG_IRQ_PORTF_INTA : \
-                                 (irq) == IRQ_PORTG_INTA ? CONFIG_IRQ_PORTG_INTA : \
-                                 (irq) == IRQ_PORTH_INTA ? CONFIG_IRQ_PORTH_INTA : \
-                                 -1)
-#elif defined(CONFIG_BF561)
-#define PRIO_GPIODEMUX(irq)     ((irq) == IRQ_PROG0_INTA ? CONFIG_IRQ_PROG0_INTA : \
-                                 (irq) == IRQ_PROG1_INTA ? CONFIG_IRQ_PROG1_INTA : \
-                                 (irq) == IRQ_PROG2_INTA ? CONFIG_IRQ_PROG2_INTA : \
-                                 -1)
+#ifdef CONFIG_BF561
 #define bfin_write_TIMER_DISABLE(val)   bfin_write_TMRS8_DISABLE(val)
 #define bfin_write_TIMER_ENABLE(val)    bfin_write_TMRS8_ENABLE(val)
 #define bfin_write_TIMER_STATUS(val)    bfin_write_TMRS8_STATUS(val)
 #define bfin_read_TIMER_STATUS()        bfin_read_TMRS8_STATUS()
 #elif defined(CONFIG_BF54x)
-#define PRIO_GPIODEMUX(irq)     ((irq) == IRQ_PINT0 ? CONFIG_IRQ_PINT0 : \
-                                 (irq) == IRQ_PINT1 ? CONFIG_IRQ_PINT1 : \
-                                 (irq) == IRQ_PINT2 ? CONFIG_IRQ_PINT2 : \
-                                 (irq) == IRQ_PINT3 ? CONFIG_IRQ_PINT3 : \
-                                 -1)
 #define bfin_write_TIMER_DISABLE(val)   bfin_write_TIMER_DISABLE0(val)
 #define bfin_write_TIMER_ENABLE(val)    bfin_write_TIMER_ENABLE0(val)
 #define bfin_write_TIMER_STATUS(val)    bfin_write_TIMER_STATUS0(val)
 #define bfin_read_TIMER_STATUS(val)     bfin_read_TIMER_STATUS0(val)
-#else
-# error "no PRIO_GPIODEMUX() for this part"
 #endif
 
 #define __ipipe_root_tick_p(regs)       ((regs->ipend & 0x10) != 0)
@@ -275,4 +245,6 @@ int ipipe_start_irq_thread(unsigned irq, struct irq_desc *desc);
 
 #endif /* !CONFIG_IPIPE */
 
+#define ipipe_update_tick_evtdev(evtdev)        do { } while (0)
+
 #endif  /* !__ASM_BLACKFIN_IPIPE_H */
diff --git a/arch/blackfin/include/asm/ipipe_base.h b/arch/blackfin/include/asm/ipipe_base.h
index cb1025aeabcf..3e8acbd1a3be 100644
--- a/arch/blackfin/include/asm/ipipe_base.h
+++ b/arch/blackfin/include/asm/ipipe_base.h
@@ -1,5 +1,5 @@
 /*   -*- linux-c -*-
- *   include/asm-blackfin/_baseipipe.h
+ *   include/asm-blackfin/ipipe_base.h
  *
  *   Copyright (C) 2007 Philippe Gerum.
  *
@@ -27,8 +27,9 @@
 #define IPIPE_NR_XIRQS          NR_IRQS
 #define IPIPE_IRQ_ISHIFT        5       /* 2^5 for 32bits arch. */
 
-/* Blackfin-specific, global domain flags */
-#define IPIPE_ROOTLOCK_FLAG     1       /* Lock pipeline for root */
+/* Blackfin-specific, per-cpu pipeline status */
+#define IPIPE_SYNCDEFER_FLAG    15
+#define IPIPE_SYNCDEFER_MASK    (1L << IPIPE_SYNCDEFER_MASK)
 
  /* Blackfin traps -- i.e. exception vector numbers */
 #define IPIPE_NR_FAULTS         52 /* We leave a gap after VEC_ILL_RES. */
@@ -48,11 +49,6 @@
 
 #ifndef __ASSEMBLY__
 
-#include <linux/bitops.h>
-
-extern int test_bit(int nr, const void *addr);
-
-
 extern unsigned long __ipipe_root_status; /* Alias to ipipe_root_cpudom_var(status) */
 
 static inline void __ipipe_stall_root(void)
diff --git a/arch/blackfin/include/asm/irq.h b/arch/blackfin/include/asm/irq.h
index 3d977909ce7d..7645e85a5f6f 100644
--- a/arch/blackfin/include/asm/irq.h
+++ b/arch/blackfin/include/asm/irq.h
@@ -61,20 +61,38 @@ void __ipipe_restore_root(unsigned long flags);
 #define raw_irqs_disabled_flags(flags)  (!irqs_enabled_from_flags_hw(flags))
 #define local_test_iflag_hw(x)          irqs_enabled_from_flags_hw(x)
 
-#define local_save_flags(x)                                             \
-        do {                                                            \
-                (x) = __ipipe_test_root() ? \
+#define local_save_flags(x)                                      \
+        do {                                                     \
+                (x) = __ipipe_test_root() ?                      \
                         __all_masked_irq_flags : bfin_irq_flags; \
+                barrier();                                       \
         } while (0)
 
-#define local_irq_save(x)                               \
-        do {                                            \
-                (x) = __ipipe_test_and_stall_root();    \
+#define local_irq_save(x)                                        \
+        do {                                                     \
+                (x) = __ipipe_test_and_stall_root() ?            \
+                        __all_masked_irq_flags : bfin_irq_flags; \
+                barrier();                                       \
+        } while (0)
+
+static inline void local_irq_restore(unsigned long x)
+{
+        barrier();
+        __ipipe_restore_root(x == __all_masked_irq_flags);
+}
+
+#define local_irq_disable()                     \
+        do {                                    \
+                __ipipe_stall_root();           \
+                barrier();                      \
         } while (0)
 
-#define local_irq_restore(x)    __ipipe_restore_root(x)
-#define local_irq_disable()     __ipipe_stall_root()
-#define local_irq_enable()      __ipipe_unstall_root()
+static inline void local_irq_enable(void)
+{
+        barrier();
+        __ipipe_unstall_root();
+}
+
 #define irqs_disabled()         __ipipe_test_root()
 
 #define local_save_flags_hw(x) \
diff --git a/arch/blackfin/include/asm/thread_info.h b/arch/blackfin/include/asm/thread_info.h
index e721ce55956c..2920087516f2 100644
--- a/arch/blackfin/include/asm/thread_info.h
+++ b/arch/blackfin/include/asm/thread_info.h
@@ -122,6 +122,7 @@ static inline struct thread_info *current_thread_info(void)
 #define TIF_MEMDIE              4
 #define TIF_RESTORE_SIGMASK     5       /* restore signal mask in do_signal() */
 #define TIF_FREEZE              6       /* is freezing for suspend */
+#define TIF_IRQ_SYNC            7       /* sync pipeline stage */
 
 /* as above, but as bit values */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
@@ -130,6 +131,7 @@ static inline struct thread_info *current_thread_info(void)
 #define _TIF_POLLING_NRFLAG     (1<<TIF_POLLING_NRFLAG)
 #define _TIF_RESTORE_SIGMASK    (1<<TIF_RESTORE_SIGMASK)
 #define _TIF_FREEZE             (1<<TIF_FREEZE)
+#define _TIF_IRQ_SYNC           (1<<TIF_IRQ_SYNC)
 
 #define _TIF_WORK_MASK          0x0000FFFE      /* work to do on interrupt/exception return */
 
diff --git a/arch/blackfin/kernel/Makefile b/arch/blackfin/kernel/Makefile
index 4a92a86824b7..fd4d4328a0f2 100644
--- a/arch/blackfin/kernel/Makefile
+++ b/arch/blackfin/kernel/Makefile
@@ -15,13 +15,15 @@ else
     obj-y += time.o
 endif
 
-CFLAGS_kgdb_test.o := -mlong-calls -O0
-
 obj-$(CONFIG_IPIPE)                  += ipipe.o
 obj-$(CONFIG_IPIPE_TRACE_MCOUNT)     += mcount.o
 obj-$(CONFIG_BFIN_GPTIMERS)          += gptimers.o
 obj-$(CONFIG_CPLB_INFO)              += cplbinfo.o
 obj-$(CONFIG_MODULES)                += module.o
 obj-$(CONFIG_KGDB)                   += kgdb.o
-obj-$(CONFIG_KGDB_TESTCASE)          += kgdb_test.o
+obj-$(CONFIG_KGDB_TESTS)             += kgdb_test.o
 obj-$(CONFIG_EARLY_PRINTK)           += early_printk.o
+
+# the kgdb test puts code into L2 and without linker
+# relaxation, we need to force long calls to/from it
+CFLAGS_kgdb_test.o := -mlong-calls -O0
diff --git a/arch/blackfin/kernel/cplb-nompu/cplbinit.c b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
index 0e28f7595733..d6c067782e63 100644
--- a/arch/blackfin/kernel/cplb-nompu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-nompu/cplbinit.c
@@ -53,9 +53,13 @@ void __init generate_cplb_tables_cpu(unsigned int cpu)
 
         i_d = i_i = 0;
 
+#ifdef CONFIG_DEBUG_HUNT_FOR_ZERO
         /* Set up the zero page.  */
         d_tbl[i_d].addr = 0;
         d_tbl[i_d++].data = SDRAM_OOPS | PAGE_SIZE_1KB;
+        i_tbl[i_i].addr = 0;
+        i_tbl[i_i++].data = SDRAM_OOPS | PAGE_SIZE_1KB;
+#endif
 
         /* Cover kernel memory with 4M pages.  */
         addr = 0;
diff --git a/arch/blackfin/kernel/ipipe.c b/arch/blackfin/kernel/ipipe.c
index 339be5a3ae6a..a5de8d45424c 100644
--- a/arch/blackfin/kernel/ipipe.c
+++ b/arch/blackfin/kernel/ipipe.c
@@ -35,14 +35,8 @@
 #include <asm/atomic.h>
 #include <asm/io.h>
 
-static int create_irq_threads;
-
 DEFINE_PER_CPU(struct pt_regs, __ipipe_tick_regs);
 
-static DEFINE_PER_CPU(unsigned long, pending_irqthread_mask);
-
-static DEFINE_PER_CPU(int [IVG13 + 1], pending_irq_count);
-
 asmlinkage void asm_do_IRQ(unsigned int irq, struct pt_regs *regs);
 
 static void __ipipe_no_irqtail(void);
@@ -93,6 +87,7 @@ void __ipipe_enable_pipeline(void)
  */
 void __ipipe_handle_irq(unsigned irq, struct pt_regs *regs)
 {
+        struct ipipe_percpu_domain_data *p = ipipe_root_cpudom_ptr();
         struct ipipe_domain *this_domain, *next_domain;
         struct list_head *head, *pos;
         int m_ack, s = -1;
@@ -104,7 +99,6 @@ void __ipipe_handle_irq(unsigned irq, struct pt_regs *regs)
          * interrupt.
          */
         m_ack = (regs == NULL || irq == IRQ_SYSTMR || irq == IRQ_CORETMR);
-
         this_domain = ipipe_current_domain;
 
         if (unlikely(test_bit(IPIPE_STICKY_FLAG, &this_domain->irqs[irq].control)))
@@ -114,49 +108,28 @@ void __ipipe_handle_irq(unsigned irq, struct pt_regs *regs)
                 next_domain = list_entry(head, struct ipipe_domain, p_link);
                 if (likely(test_bit(IPIPE_WIRED_FLAG, &next_domain->irqs[irq].control))) {
                         if (!m_ack && next_domain->irqs[irq].acknowledge != NULL)
-                                next_domain->irqs[irq].acknowledge(irq, irq_desc + irq);
-                        if (test_bit(IPIPE_ROOTLOCK_FLAG, &ipipe_root_domain->flags))
-                                s = __test_and_set_bit(IPIPE_STALL_FLAG,
-                                                       &ipipe_root_cpudom_var(status));
+                                next_domain->irqs[irq].acknowledge(irq, irq_to_desc(irq));
+                        if (test_bit(IPIPE_SYNCDEFER_FLAG, &p->status))
+                                s = __test_and_set_bit(IPIPE_STALL_FLAG, &p->status);
                         __ipipe_dispatch_wired(next_domain, irq);
-                                goto finalize;
-                        return;
+                        goto out;
                 }
         }
 
         /* Ack the interrupt. */
 
         pos = head;
-
         while (pos != &__ipipe_pipeline) {
                 next_domain = list_entry(pos, struct ipipe_domain, p_link);
-                /*
-                 * For each domain handling the incoming IRQ, mark it
-                 * as pending in its log.
-                 */
                 if (test_bit(IPIPE_HANDLE_FLAG, &next_domain->irqs[irq].control)) {
-                        /*
-                         * Domains that handle this IRQ are polled for
-                         * acknowledging it by decreasing priority
-                         * order. The interrupt must be made pending
-                         * _first_ in the domain's status flags before
-                         * the PIC is unlocked.
-                         */
                         __ipipe_set_irq_pending(next_domain, irq);
-
                         if (!m_ack && next_domain->irqs[irq].acknowledge != NULL) {
-                                next_domain->irqs[irq].acknowledge(irq, irq_desc + irq);
+                                next_domain->irqs[irq].acknowledge(irq, irq_to_desc(irq));
                                 m_ack = 1;
                         }
                 }
-
-                /*
-                 * If the domain does not want the IRQ to be passed
-                 * down the interrupt pipe, exit the loop now.
-                 */
                 if (!test_bit(IPIPE_PASS_FLAG, &next_domain->irqs[irq].control))
                         break;
-
                 pos = next_domain->p_link.next;
         }
 
@@ -166,18 +139,24 @@ void __ipipe_handle_irq(unsigned irq, struct pt_regs *regs)
          * immediately to the current domain if the interrupt has been
          * marked as 'sticky'. This search does not go beyond the
          * current domain in the pipeline. We also enforce the
-         * additional root stage lock (blackfin-specific). */
+         * additional root stage lock (blackfin-specific).
+         */
+        if (test_bit(IPIPE_SYNCDEFER_FLAG, &p->status))
+                s = __test_and_set_bit(IPIPE_STALL_FLAG, &p->status);
 
-        if (test_bit(IPIPE_ROOTLOCK_FLAG, &ipipe_root_domain->flags))
-                s = __test_and_set_bit(IPIPE_STALL_FLAG,
-                                       &ipipe_root_cpudom_var(status));
-finalize:
+        /*
+         * If the interrupt preempted the head domain, then do not
+         * even try to walk the pipeline, unless an interrupt is
+         * pending for it.
+         */
+        if (test_bit(IPIPE_AHEAD_FLAG, &this_domain->flags) &&
+            ipipe_head_cpudom_var(irqpend_himask) == 0)
+                goto out;
 
         __ipipe_walk_pipeline(head);
-
+out:
         if (!s)
-                __clear_bit(IPIPE_STALL_FLAG,
-                            &ipipe_root_cpudom_var(status));
+                __clear_bit(IPIPE_STALL_FLAG, &p->status);
 }
 
 int __ipipe_check_root(void)
@@ -187,7 +166,7 @@ int __ipipe_check_root(void)
 
 void __ipipe_enable_irqdesc(struct ipipe_domain *ipd, unsigned irq)
 {
-        struct irq_desc *desc = irq_desc + irq;
+        struct irq_desc *desc = irq_to_desc(irq);
         int prio = desc->ic_prio;
 
         desc->depth = 0;
@@ -199,7 +178,7 @@ EXPORT_SYMBOL(__ipipe_enable_irqdesc);
 
 void __ipipe_disable_irqdesc(struct ipipe_domain *ipd, unsigned irq)
 {
-        struct irq_desc *desc = irq_desc + irq;
+        struct irq_desc *desc = irq_to_desc(irq);
         int prio = desc->ic_prio;
 
         if (ipd != &ipipe_root &&
@@ -236,15 +215,18 @@ int __ipipe_syscall_root(struct pt_regs *regs)
 {
         unsigned long flags;
 
-        /* We need to run the IRQ tail hook whenever we don't
+        /*
+         * We need to run the IRQ tail hook whenever we don't
          * propagate a syscall to higher domains, because we know that
          * important operations might be pending there (e.g. Xenomai
-         * deferred rescheduling). */
+         * deferred rescheduling).
+         */
 
-        if (!__ipipe_syscall_watched_p(current, regs->orig_p0)) {
+        if (regs->orig_p0 < NR_syscalls) {
                 void (*hook)(void) = (void (*)(void))__ipipe_irq_tail_hook;
                 hook();
-                return 0;
+                if ((current->flags & PF_EVNOTIFY) == 0)
+                        return 0;
         }
 
         /*
@@ -312,112 +294,46 @@ int ipipe_trigger_irq(unsigned irq)
 {
         unsigned long flags;
 
+#ifdef CONFIG_IPIPE_DEBUG
         if (irq >= IPIPE_NR_IRQS ||
             (ipipe_virtual_irq_p(irq)
              && !test_bit(irq - IPIPE_VIRQ_BASE, &__ipipe_virtual_irq_map)))
                 return -EINVAL;
+#endif
 
         local_irq_save_hw(flags);
-
         __ipipe_handle_irq(irq, NULL);
-
         local_irq_restore_hw(flags);
 
         return 1;
 }
 
-/* Move Linux IRQ to threads. */
-
-static int do_irqd(void *__desc)
+asmlinkage void __ipipe_sync_root(void)
 {
-        struct irq_desc *desc = __desc;
-        unsigned irq = desc - irq_desc;
-        int thrprio = desc->thr_prio;
-        int thrmask = 1 << thrprio;
-        int cpu = smp_processor_id();
-        cpumask_t cpumask;
-
-        sigfillset(&current->blocked);
-        current->flags |= PF_NOFREEZE;
-        cpumask = cpumask_of_cpu(cpu);
-        set_cpus_allowed(current, cpumask);
-        ipipe_setscheduler_root(current, SCHED_FIFO, 50 + thrprio);
-
-        while (!kthread_should_stop()) {
-                local_irq_disable();
-                if (!(desc->status & IRQ_SCHEDULED)) {
-                        set_current_state(TASK_INTERRUPTIBLE);
-resched:
-                        local_irq_enable();
-                        schedule();
-                        local_irq_disable();
-                }
-                __set_current_state(TASK_RUNNING);
-                /*
-                 * If higher priority interrupt servers are ready to
-                 * run, reschedule immediately. We need this for the
-                 * GPIO demux IRQ handler to unmask the interrupt line
-                 * _last_, after all GPIO IRQs have run.
-                 */
-                if (per_cpu(pending_irqthread_mask, cpu) & ~(thrmask|(thrmask-1)))
-                        goto resched;
-                if (--per_cpu(pending_irq_count[thrprio], cpu) == 0)
-                        per_cpu(pending_irqthread_mask, cpu) &= ~thrmask;
-                desc->status &= ~IRQ_SCHEDULED;
-                desc->thr_handler(irq, &__raw_get_cpu_var(__ipipe_tick_regs));
-                local_irq_enable();
-        }
-        __set_current_state(TASK_RUNNING);
-        return 0;
-}
+        unsigned long flags;
 
-static void kick_irqd(unsigned irq, void *cookie)
-{
-        struct irq_desc *desc = irq_desc + irq;
-        int thrprio = desc->thr_prio;
-        int thrmask = 1 << thrprio;
-        int cpu = smp_processor_id();
-
-        if (!(desc->status & IRQ_SCHEDULED)) {
-                desc->status |= IRQ_SCHEDULED;
-                per_cpu(pending_irqthread_mask, cpu) |= thrmask;
-                ++per_cpu(pending_irq_count[thrprio], cpu);
-                wake_up_process(desc->thread);
-        }
-}
+        BUG_ON(irqs_disabled());
 
-int ipipe_start_irq_thread(unsigned irq, struct irq_desc *desc)
-{
-        if (desc->thread || !create_irq_threads)
-                return 0;
-
-        desc->thread = kthread_create(do_irqd, desc, "IRQ %d", irq);
-        if (desc->thread == NULL) {
-                printk(KERN_ERR "irqd: could not create IRQ thread %d!\n", irq);
-                return -ENOMEM;
-        }
+        local_irq_save_hw(flags);
 
-        wake_up_process(desc->thread);
+        clear_thread_flag(TIF_IRQ_SYNC);
 
-        desc->thr_handler = ipipe_root_domain->irqs[irq].handler;
-        ipipe_root_domain->irqs[irq].handler = &kick_irqd;
+        if (ipipe_root_cpudom_var(irqpend_himask) != 0)
+                __ipipe_sync_pipeline(IPIPE_IRQMASK_ANY);
 
-        return 0;
+        local_irq_restore_hw(flags);
 }
 
-void __init ipipe_init_irq_threads(void)
+void ___ipipe_sync_pipeline(unsigned long syncmask)
 {
-        unsigned irq;
-        struct irq_desc *desc;
-
-        create_irq_threads = 1;
+        struct ipipe_domain *ipd = ipipe_current_domain;
 
-        for (irq = 0; irq < NR_IRQS; irq++) {
-                desc = irq_desc + irq;
-                if (desc->action != NULL ||
-                        (desc->status & IRQ_NOREQUEST) != 0)
-                        ipipe_start_irq_thread(irq, desc);
+        if (ipd == ipipe_root_domain) {
+                if (test_bit(IPIPE_SYNCDEFER_FLAG, &ipipe_root_cpudom_var(status)))
+                        return;
         }
+
+        __ipipe_sync_stage(syncmask);
 }
 
 EXPORT_SYMBOL(show_stack);
diff --git a/arch/blackfin/kernel/irqchip.c b/arch/blackfin/kernel/irqchip.c
index 75724eee6494..7fd126564846 100644
--- a/arch/blackfin/kernel/irqchip.c
+++ b/arch/blackfin/kernel/irqchip.c
@@ -144,11 +144,15 @@ asmlinkage void asm_do_IRQ(unsigned int irq, struct pt_regs *regs)
 #endif
         generic_handle_irq(irq);
 
-#ifndef CONFIG_IPIPE    /* Useless and bugous over the I-pipe: IRQs are threaded. */
-        /* If we're the only interrupt running (ignoring IRQ15 which is for
-           syscalls), lower our priority to IRQ14 so that softirqs run at
-           that level.  If there's another, lower-level interrupt, irq_exit
-           will defer softirqs to that.  */
+#ifndef CONFIG_IPIPE
+        /*
+         * If we're the only interrupt running (ignoring IRQ15 which
+         * is for syscalls), lower our priority to IRQ14 so that
+         * softirqs run at that level.  If there's another,
+         * lower-level interrupt, irq_exit will defer softirqs to
+         * that. If the interrupt pipeline is enabled, we are already
+         * running at IRQ14 priority, so we don't need this code.
+         */
         CSYNC();
         pending = bfin_read_IPEND() & ~0x8000;
         other_ints = pending & (pending - 1);
diff --git a/arch/blackfin/kernel/kgdb_test.c b/arch/blackfin/kernel/kgdb_test.c
index 3dba9c17304a..dbcf3e45cb0b 100644
--- a/arch/blackfin/kernel/kgdb_test.c
+++ b/arch/blackfin/kernel/kgdb_test.c
@@ -20,6 +20,7 @@
 static char cmdline[256];
 static unsigned long len;
 
+#ifndef CONFIG_SMP
 static int num1 __attribute__((l1_data));
 
 void kgdb_l1_test(void) __attribute__((l1_text));
@@ -32,6 +33,8 @@ void kgdb_l1_test(void)
         printk(KERN_ALERT "L1(after change) : data variable addr = 0x%p, data value is %d\n", &num1, num1);
         return ;
 }
+#endif
+
 #if L2_LENGTH
 
 static int num2 __attribute__((l2));
@@ -59,10 +62,12 @@ int kgdb_test(char *name, int len, int count, int z)
 static int test_proc_output(char *buf)
 {
         kgdb_test("hello world!", 12, 0x55, 0x10);
+#ifndef CONFIG_SMP
         kgdb_l1_test();
-        #if L2_LENGTH
+#endif
+#if L2_LENGTH
         kgdb_l2_test();
-        #endif
+#endif
 
         return 0;
 }
diff --git a/arch/blackfin/kernel/ptrace.c b/arch/blackfin/kernel/ptrace.c
index 594e325b40e4..d76618db50df 100644
--- a/arch/blackfin/kernel/ptrace.c
+++ b/arch/blackfin/kernel/ptrace.c
@@ -45,6 +45,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/dma.h>
 #include <asm/fixed_code.h>
+#include <asm/cacheflush.h>
 #include <asm/mem_map.h>
 
 #define TEXT_OFFSET 0
@@ -240,7 +241,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 
                         } else if (addr >= FIXED_CODE_START
                             && addr + sizeof(tmp) <= FIXED_CODE_END) {
-                                memcpy(&tmp, (const void *)(addr), sizeof(tmp));
+                                copy_from_user_page(0, 0, 0, &tmp, (const void *)(addr), sizeof(tmp));
                                 copied = sizeof(tmp);
 
                         } else
@@ -320,7 +321,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 
                         } else if (addr >= FIXED_CODE_START
                             && addr + sizeof(data) <= FIXED_CODE_END) {
-                                memcpy((void *)(addr), &data, sizeof(data));
+                                copy_to_user_page(0, 0, 0, (void *)(addr), &data, sizeof(data));
                                 copied = sizeof(data);
 
                         } else
diff --git a/arch/blackfin/kernel/setup.c b/arch/blackfin/kernel/setup.c
index e5c116230800..a58687bdee6a 100644
--- a/arch/blackfin/kernel/setup.c
+++ b/arch/blackfin/kernel/setup.c
@@ -889,6 +889,10 @@ void __init setup_arch(char **cmdline_p)
                                CPU, bfin_revid());
         }
 
+        /* We can't run on BF548-0.1 due to ANOMALY 05000448 */
+        if (bfin_cpuid() == 0x27de && bfin_revid() == 1)
+                panic("You can't run on this processor due to 05000448\n");
+
         printk(KERN_INFO "Blackfin Linux support by http://blackfin.uclinux.org/\n");
 
         printk(KERN_INFO "Processor Speed: %lu MHz core clock and %lu MHz System Clock\n",
@@ -1141,12 +1145,12 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                 icache_size = 0;
 
         seq_printf(m, "cache size\t: %d KB(L1 icache) "
-                "%d KB(L1 dcache-%s) %d KB(L2 cache)\n",
+                "%d KB(L1 dcache%s) %d KB(L2 cache)\n",
                 icache_size, dcache_size,
 #if defined CONFIG_BFIN_WB
-                "wb"
+                "-wb"
 #elif defined CONFIG_BFIN_WT
-                "wt"
+                "-wt"
 #endif
                 "", 0);
 
diff --git a/arch/blackfin/kernel/time.c b/arch/blackfin/kernel/time.c
index 172b4c588467..1bbacfbd4c5d 100644
--- a/arch/blackfin/kernel/time.c
+++ b/arch/blackfin/kernel/time.c
@@ -134,7 +134,10 @@ irqreturn_t timer_interrupt(int irq, void *dummy)
 
         write_seqlock(&xtime_lock);
 #if defined(CONFIG_TICK_SOURCE_SYSTMR0) && !defined(CONFIG_IPIPE)
-/* FIXME: Here TIMIL0 is not set when IPIPE enabled, why? */
+        /*
+         * TIMIL0 is latched in __ipipe_grab_irq() when the I-Pipe is
+         * enabled.
+         */
         if (get_gptimer_status(0) & TIMER_STATUS_TIMIL0) {
 #endif
                 do_timer(1);
diff --git a/arch/blackfin/mach-bf518/boards/ezbrd.c b/arch/blackfin/mach-bf518/boards/ezbrd.c
index 0e175342112e..41f2eacfef20 100644
--- a/arch/blackfin/mach-bf518/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf518/boards/ezbrd.c
@@ -113,7 +113,6 @@ static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
         .dev.platform_data = &bfin_mii_bus,
 };
-#endif
 
 #if defined(CONFIG_NET_DSA_KSZ8893M) || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
 static struct dsa_platform_data ksz8893m_switch_data = {
@@ -132,6 +131,7 @@ static struct platform_device ksz8893m_switch_device = {
         .dev.platform_data = &ksz8893m_switch_data,
 };
 #endif
+#endif
 
 #if defined(CONFIG_MTD_M25P80) \
         || defined(CONFIG_MTD_M25P80_MODULE)
@@ -171,6 +171,7 @@ static struct bfin5xx_spi_chip spi_adc_chip_info = {
 };
 #endif
 
+#if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
 #if defined(CONFIG_NET_DSA_KSZ8893M) \
         || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
 /* SPI SWITCH CHIP */
@@ -179,10 +180,11 @@ static struct bfin5xx_spi_chip spi_switch_info = {
         .bits_per_word = 8,
 };
 #endif
+#endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -259,6 +261,7 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
+#if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
 #if defined(CONFIG_NET_DSA_KSZ8893M) \
         || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
         {
@@ -271,24 +274,15 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
                 .mode = SPI_MODE_3,
         },
 #endif
+#endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc_dummy",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
@@ -630,11 +624,10 @@ static struct platform_device *stamp_devices[] __initdata = {
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
         &bfin_mii_bus,
         &bfin_mac_device,
-#endif
-
 #if defined(CONFIG_NET_DSA_KSZ8893M) || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
         &ksz8893m_switch_device,
 #endif
+#endif
 
 #if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
         &bfin_spi0_device,
diff --git a/arch/blackfin/mach-bf518/include/mach/anomaly.h b/arch/blackfin/mach-bf518/include/mach/anomaly.h
index e5b4bef0edae..c847bb101076 100644
--- a/arch/blackfin/mach-bf518/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf518/include/mach/anomaly.h
@@ -2,12 +2,12 @@
  * File: include/asm-blackfin/mach-bf518/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
 /* This file shoule be up to date with:
- *  - ????
+ *  - Revision B, 02/03/2009; ADSP-BF512/BF514/BF516/BF518 Blackfin Processor Anomaly List
  */
 
 #ifndef _MACH_ANOMALY_H_
@@ -19,6 +19,8 @@
 #define ANOMALY_05000122 (1)
 /* False Hardware Error from an Access in the Shadow of a Conditional Branch */
 #define ANOMALY_05000245 (1)
+/* Incorrect Timer Pulse Width in Single-Shot PWM_OUT Mode with External Clock */
+#define ANOMALY_05000254 (1)
 /* Sensitivity To Noise with Slow Input Edge Rates on External SPORT TX and RX Clocks */
 #define ANOMALY_05000265 (1)
 /* False Hardware Errors Caused by Fetches at the Boundary of Reserved Memory */
@@ -53,6 +55,12 @@
 #define ANOMALY_05000443 (1)
 /* Incorrect L1 Instruction Bank B Memory Map Location */
 #define ANOMALY_05000444 (1)
+/* Incorrect Default Hysteresis Setting for RESET, NMI, and BMODE Signals */
+#define ANOMALY_05000452 (1)
+/* PWM_TRIPB Signal Not Available on PG10 */
+#define ANOMALY_05000453 (1)
+/* PPI_FS3 is Driven One Half Cycle Later Than PPI Data */
+#define ANOMALY_05000455 (1)
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000125 (0)
@@ -65,15 +73,20 @@
 #define ANOMALY_05000263 (0)
 #define ANOMALY_05000266 (0)
 #define ANOMALY_05000273 (0)
+#define ANOMALY_05000278 (0)
 #define ANOMALY_05000285 (0)
+#define ANOMALY_05000305 (0)
 #define ANOMALY_05000307 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000312 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000353 (0)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (0)
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000432 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
index b50a63b975a2..e21c1c3e4ec7 100644
--- a/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf518/include/mach/bfin_serial_5xx.h
@@ -144,7 +144,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
          CH_UART0_TX,
          CH_UART0_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
          CONFIG_UART0_CTS_PIN,
          CONFIG_UART0_RTS_PIN,
 #endif
@@ -158,7 +158,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
          CH_UART1_TX,
          CH_UART1_RX,
 #endif
-#ifdef CONFIG_BFIN_UART1_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
          CONFIG_UART1_CTS_PIN,
          CONFIG_UART1_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-bf527/boards/cm_bf527.c b/arch/blackfin/mach-bf527/boards/cm_bf527.c
index 856c097b5317..48e69eecdba4 100644
--- a/arch/blackfin/mach-bf527/boards/cm_bf527.c
+++ b/arch/blackfin/mach-bf527/boards/cm_bf527.c
@@ -487,9 +487,9 @@ static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip  mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -585,23 +585,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
                 .controller_data = &ad9960_spi_chip_info,
         },
 #endif
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
+                .modalias = "mmc_spi",
+                .max_speed_hz = 20000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf527/boards/ezbrd.c b/arch/blackfin/mach-bf527/boards/ezbrd.c
index 83606fcdde27..7fe480e4ebe8 100644
--- a/arch/blackfin/mach-bf527/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf527/boards/ezbrd.c
@@ -256,9 +256,9 @@ static struct bfin5xx_spi_chip spi_adc_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -366,23 +366,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc_dummy",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/anomaly.h b/arch/blackfin/mach-bf527/include/mach/anomaly.h
index 035e8d835058..df6808d8a6ef 100644
--- a/arch/blackfin/mach-bf527/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf527/include/mach/anomaly.h
@@ -2,7 +2,7 @@
  * File: include/asm-blackfin/mach-bf527/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
@@ -167,12 +167,16 @@
 #define ANOMALY_05000263 (0)
 #define ANOMALY_05000266 (0)
 #define ANOMALY_05000273 (0)
+#define ANOMALY_05000278 (0)
 #define ANOMALY_05000285 (0)
+#define ANOMALY_05000305 (0)
 #define ANOMALY_05000307 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000312 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000363 (0)
 #define ANOMALY_05000412 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
index 75722d6008b0..e8c41fd842b5 100644
--- a/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf527/include/mach/bfin_serial_5xx.h
@@ -144,7 +144,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
          CH_UART0_TX,
          CH_UART0_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
          CONFIG_UART0_CTS_PIN,
          CONFIG_UART0_RTS_PIN,
 #endif
@@ -158,7 +158,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
          CH_UART1_TX,
          CH_UART1_RX,
 #endif
-#ifdef CONFIG_BFIN_UART1_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
          CONFIG_UART1_CTS_PIN,
          CONFIG_UART1_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-bf533/boards/Kconfig b/arch/blackfin/mach-bf533/boards/Kconfig
index 308c98dc5aba..8d8b3e7321e6 100644
--- a/arch/blackfin/mach-bf533/boards/Kconfig
+++ b/arch/blackfin/mach-bf533/boards/Kconfig
@@ -38,9 +38,4 @@ config BFIN532_IP0X
         help
           Core support for IP04/IP04 open hardware IP-PBX.
 
-config GENERIC_BF533_BOARD
-        bool "Generic"
-        help
-          Generic or Custom board support.
-
 endchoice
diff --git a/arch/blackfin/mach-bf533/boards/Makefile b/arch/blackfin/mach-bf533/boards/Makefile
index 9afbe72b484f..ff1e832f80d2 100644
--- a/arch/blackfin/mach-bf533/boards/Makefile
+++ b/arch/blackfin/mach-bf533/boards/Makefile
@@ -2,7 +2,6 @@
 # arch/blackfin/mach-bf533/boards/Makefile
 #
 
-obj-$(CONFIG_GENERIC_BF533_BOARD)      += generic_board.o
 obj-$(CONFIG_BFIN533_STAMP)            += stamp.o
 obj-$(CONFIG_BFIN532_IP0X)             += ip0x.o
 obj-$(CONFIG_BFIN533_EZKIT)            += ezkit.o
diff --git a/arch/blackfin/mach-bf533/boards/blackstamp.c b/arch/blackfin/mach-bf533/boards/blackstamp.c
index 015c18f85e7f..0765872a8ada 100644
--- a/arch/blackfin/mach-bf533/boards/blackstamp.c
+++ b/arch/blackfin/mach-bf533/boards/blackstamp.c
@@ -101,9 +101,9 @@ static struct bfin5xx_spi_chip spi_flash_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -129,23 +129,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 20000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 20000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf533/boards/cm_bf533.c b/arch/blackfin/mach-bf533/boards/cm_bf533.c
index e7061c7e8c42..e8974878d8c2 100644
--- a/arch/blackfin/mach-bf533/boards/cm_bf533.c
+++ b/arch/blackfin/mach-bf533/boards/cm_bf533.c
@@ -96,9 +96,9 @@ static struct bfin5xx_spi_chip ad1836_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -138,23 +138,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf533/boards/generic_board.c b/arch/blackfin/mach-bf533/boards/generic_board.c
deleted file mode 100644
index 986eeec53b1f..000000000000
--- a/arch/blackfin/mach-bf533/boards/generic_board.c
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * File:         arch/blackfin/mach-bf533/generic_board.c
- * Based on:     arch/blackfin/mach-bf533/ezkit.c
- * Author:       Aidan Williams <aidan@nicta.com.au>
- *
- * Created:      2005
- * Description:
- *
- * Modified:
- *               Copyright 2005 National ICT Australia (NICTA)
- *               Copyright 2004-2006 Analog Devices Inc.
- *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include <linux/device.h>
-#include <linux/platform_device.h>
-#include <linux/irq.h>
-
-/*
- * Name the Board for the /proc/cpuinfo
- */
-const char bfin_board_name[] = "UNKNOWN BOARD";
-
-#if defined(CONFIG_RTC_DRV_BFIN) || defined(CONFIG_RTC_DRV_BFIN_MODULE)
-static struct platform_device rtc_device = {
-        .name = "rtc-bfin",
-        .id   = -1,
-};
-#endif
-
-/*
- *  Driver needs to know address, irq and flag pin.
- */
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-static struct resource smc91x_resources[] = {
-        {
-                .start = 0x20300300,
-                .end = 0x20300300 + 16,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = IRQ_PROG_INTB,
-                .end = IRQ_PROG_INTB,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        }, {
-                .start = IRQ_PF7,
-                .end = IRQ_PF7,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-
-static struct platform_device smc91x_device = {
-        .name = "smc91x",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(smc91x_resources),
-        .resource = smc91x_resources,
-};
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-static struct resource bfin_sir0_resources[] = {
-        {
-                .start = 0xFFC00400,
-                .end = 0xFFC004FF,
-                .flags = IORESOURCE_MEM,
-        },
-        {
-                .start = IRQ_UART0_RX,
-                .end = IRQ_UART0_RX+1,
-                .flags = IORESOURCE_IRQ,
-        },
-        {
-                .start = CH_UART0_RX,
-                .end = CH_UART0_RX+1,
-                .flags = IORESOURCE_DMA,
-        },
-};
-
-static struct platform_device bfin_sir0_device = {
-        .name = "bfin_sir",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(bfin_sir0_resources),
-        .resource = bfin_sir0_resources,
-};
-#endif
-#endif
-
-static struct platform_device *generic_board_devices[] __initdata = {
-#if defined(CONFIG_RTC_DRV_BFIN) || defined(CONFIG_RTC_DRV_BFIN_MODULE)
-        &rtc_device,
-#endif
-
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-        &smc91x_device,
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-        &bfin_sir0_device,
-#endif
-#endif
-};
-
-static int __init generic_board_init(void)
-{
-        printk(KERN_INFO "%s(): registering device resources\n", __func__);
-        return platform_add_devices(generic_board_devices, ARRAY_SIZE(generic_board_devices));
-}
-
-arch_initcall(generic_board_init);
diff --git a/arch/blackfin/mach-bf533/boards/ip0x.c b/arch/blackfin/mach-bf533/boards/ip0x.c
index e30b1b7d1442..f19b63378b12 100644
--- a/arch/blackfin/mach-bf533/boards/ip0x.c
+++ b/arch/blackfin/mach-bf533/boards/ip0x.c
@@ -127,8 +127,8 @@ static struct platform_device dm9000_device2 = {
 #if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
 /* all SPI peripherals info goes here */
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
 /*
  * CPOL (Clock Polarity)
  *  0 - Active high SCK
@@ -152,14 +152,13 @@ static struct bfin5xx_spi_chip spi_mmc_chip_info = {
 /* Notice: for blackfin, the speed_hz is the value of register
  * SPI_BAUD, not the real baudrate */
 static struct spi_board_info bfin_spi_board_info[] __initdata = {
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 2,
                 .bus_num = 1,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
         },
 #endif
 };
diff --git a/arch/blackfin/mach-bf533/include/mach/anomaly.h b/arch/blackfin/mach-bf533/include/mach/anomaly.h
index 0d3a03429fb9..1cf893e2e55b 100644
--- a/arch/blackfin/mach-bf533/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf533/include/mach/anomaly.h
@@ -2,7 +2,7 @@
  * File: include/asm-blackfin/mach-bf533/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
@@ -160,7 +160,7 @@
 #define ANOMALY_05000301 (__SILICON_REVISION__ < 6)
 /* SSYNCs After Writes To DMA MMR Registers May Not Be Handled Correctly */
 #define ANOMALY_05000302 (__SILICON_REVISION__ < 5)
-/* New Feature: Additional Hysteresis on SPORT Input Pins (Not Available On Older Silicon) */
+/* SPORT_HYS Bit in PLL_CTL Register Is Not Functional */
 #define ANOMALY_05000305 (__SILICON_REVISION__ < 5)
 /* New Feature: Additional PPI Frame Sync Sampling Options (Not Available On Older Silicon) */
 #define ANOMALY_05000306 (__SILICON_REVISION__ < 5)
@@ -278,9 +278,12 @@
 #define ANOMALY_05000266 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000353 (1)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000432 (0)
 #define ANOMALY_05000435 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
index f3d9e495230c..5f517f53b0fd 100644
--- a/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf533/include/mach/bfin_serial_5xx.h
@@ -134,7 +134,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART_TX,
         CH_UART_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART0_CTS_PIN,
         CONFIG_UART0_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-bf537/boards/Kconfig b/arch/blackfin/mach-bf537/boards/Kconfig
index 42a57b0acb29..77c59da87e85 100644
--- a/arch/blackfin/mach-bf537/boards/Kconfig
+++ b/arch/blackfin/mach-bf537/boards/Kconfig
@@ -33,9 +33,4 @@ config CAMSIG_MINOTAUR
         help
           Board supply package for CSP Minotaur
 
-config GENERIC_BF537_BOARD
-        bool "Generic"
-        help
-          Generic or Custom board support.
-
 endchoice
diff --git a/arch/blackfin/mach-bf537/boards/Makefile b/arch/blackfin/mach-bf537/boards/Makefile
index 7168cc14afd8..68b98a7af6a6 100644
--- a/arch/blackfin/mach-bf537/boards/Makefile
+++ b/arch/blackfin/mach-bf537/boards/Makefile
@@ -2,7 +2,6 @@
 # arch/blackfin/mach-bf537/boards/Makefile
 #
 
-obj-$(CONFIG_GENERIC_BF537_BOARD)      += generic_board.o
 obj-$(CONFIG_BFIN537_STAMP)            += stamp.o
 obj-$(CONFIG_BFIN537_BLUETECHNIX_CM)   += cm_bf537.o
 obj-$(CONFIG_BFIN537_BLUETECHNIX_TCM)  += tcm_bf537.o
diff --git a/arch/blackfin/mach-bf537/boards/cm_bf537.c b/arch/blackfin/mach-bf537/boards/cm_bf537.c
index 9cd8fb2a30d3..41c75b9bfac0 100644
--- a/arch/blackfin/mach-bf537/boards/cm_bf537.c
+++ b/arch/blackfin/mach-bf537/boards/cm_bf537.c
@@ -108,9 +108,9 @@ static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip  mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -160,23 +160,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 7,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
+                .modalias = "mmc_spi",
+                .max_speed_hz = 20000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 1,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf537/boards/generic_board.c b/arch/blackfin/mach-bf537/boards/generic_board.c
deleted file mode 100644
index da710fdc4569..000000000000
--- a/arch/blackfin/mach-bf537/boards/generic_board.c
+++ /dev/null
@@ -1,745 +0,0 @@
-/*
- * File:         arch/blackfin/mach-bf537/boards/generic_board.c
- * Based on:     arch/blackfin/mach-bf533/boards/ezkit.c
- * Author:       Aidan Williams <aidan@nicta.com.au>
- *
- * Created:
- * Description:
- *
- * Modified:
- *               Copyright 2005 National ICT Australia (NICTA)
- *               Copyright 2004-2008 Analog Devices Inc.
- *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include <linux/device.h>
-#include <linux/etherdevice.h>
-#include <linux/platform_device.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/partitions.h>
-#include <linux/spi/spi.h>
-#include <linux/spi/flash.h>
-#if defined(CONFIG_USB_ISP1362_HCD) || defined(CONFIG_USB_ISP1362_HCD_MODULE)
-#include <linux/usb/isp1362.h>
-#endif
-#include <linux/irq.h>
-#include <linux/interrupt.h>
-#include <linux/usb/sl811.h>
-#include <asm/dma.h>
-#include <asm/bfin5xx_spi.h>
-#include <asm/reboot.h>
-#include <asm/portmux.h>
-#include <linux/spi/ad7877.h>
-
-/*
- * Name the Board for the /proc/cpuinfo
- */
-const char bfin_board_name[] = "UNKNOWN BOARD";
-
-/*
- *  Driver needs to know address, irq and flag pin.
- */
-
-#if defined(CONFIG_USB_ISP1760_HCD) || defined(CONFIG_USB_ISP1760_HCD_MODULE)
-#include <linux/usb/isp1760.h>
-static struct resource bfin_isp1760_resources[] = {
-        [0] = {
-                .start  = 0x203C0000,
-                .end    = 0x203C0000 + 0x000fffff,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = IRQ_PF7,
-                .end    = IRQ_PF7,
-                .flags  = IORESOURCE_IRQ,
-        },
-};
-
-static struct isp1760_platform_data isp1760_priv = {
-        .is_isp1761 = 0,
-        .port1_disable = 0,
-        .bus_width_16 = 1,
-        .port1_otg = 0,
-        .analog_oc = 0,
-        .dack_polarity_high = 0,
-        .dreq_polarity_high = 0,
-};
-
-static struct platform_device bfin_isp1760_device = {
-        .name           = "isp1760-hcd",
-        .id             = 0,
-        .dev = {
-                .platform_data = &isp1760_priv,
-        },
-        .num_resources  = ARRAY_SIZE(bfin_isp1760_resources),
-        .resource       = bfin_isp1760_resources,
-};
-#endif
-
-#if defined(CONFIG_BFIN_CFPCMCIA) || defined(CONFIG_BFIN_CFPCMCIA_MODULE)
-static struct resource bfin_pcmcia_cf_resources[] = {
-        {
-                .start = 0x20310000, /* IO PORT */
-                .end = 0x20312000,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = 0x20311000, /* Attribute Memory */
-                .end = 0x20311FFF,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = IRQ_PF4,
-                .end = IRQ_PF4,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWLEVEL,
-        }, {
-                .start = 6, /* Card Detect PF6 */
-                .end = 6,
-                .flags = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device bfin_pcmcia_cf_device = {
-        .name = "bfin_cf_pcmcia",
-        .id = -1,
-        .num_resources = ARRAY_SIZE(bfin_pcmcia_cf_resources),
-        .resource = bfin_pcmcia_cf_resources,
-};
-#endif
-
-#if defined(CONFIG_RTC_DRV_BFIN) || defined(CONFIG_RTC_DRV_BFIN_MODULE)
-static struct platform_device rtc_device = {
-        .name = "rtc-bfin",
-        .id   = -1,
-};
-#endif
-
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-static struct resource smc91x_resources[] = {
-        {
-                .name = "smc91x-regs",
-                .start = 0x20300300,
-                .end = 0x20300300 + 16,
-                .flags = IORESOURCE_MEM,
-        }, {
-
-                .start = IRQ_PF7,
-                .end = IRQ_PF7,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-static struct platform_device smc91x_device = {
-        .name = "smc91x",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(smc91x_resources),
-        .resource = smc91x_resources,
-};
-#endif
-
-#if defined(CONFIG_DM9000) || defined(CONFIG_DM9000_MODULE)
-static struct resource dm9000_resources[] = {
-        [0] = {
-                .start  = 0x203FB800,
-                .end    = 0x203FB800 + 1,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = 0x203FB800 + 4,
-                .end    = 0x203FB800 + 5,
-                .flags  = IORESOURCE_MEM,
-        },
-        [2] = {
-                .start  = IRQ_PF9,
-                .end    = IRQ_PF9,
-                .flags  = (IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHEDGE),
-        },
-};
-
-static struct platform_device dm9000_device = {
-        .name           = "dm9000",
-        .id             = -1,
-        .num_resources  = ARRAY_SIZE(dm9000_resources),
-        .resource       = dm9000_resources,
-};
-#endif
-
-#if defined(CONFIG_USB_SL811_HCD) || defined(CONFIG_USB_SL811_HCD_MODULE)
-static struct resource sl811_hcd_resources[] = {
-        {
-                .start = 0x20340000,
-                .end = 0x20340000,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = 0x20340004,
-                .end = 0x20340004,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = CONFIG_USB_SL811_BFIN_IRQ,
-                .end = CONFIG_USB_SL811_BFIN_IRQ,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-
-#if defined(CONFIG_USB_SL811_BFIN_USE_VBUS)
-void sl811_port_power(struct device *dev, int is_on)
-{
-        gpio_request(CONFIG_USB_SL811_BFIN_GPIO_VBUS, "usb:SL811_VBUS");
-        gpio_direction_output(CONFIG_USB_SL811_BFIN_GPIO_VBUS, is_on);
-
-}
-#endif
-
-static struct sl811_platform_data sl811_priv = {
-        .potpg = 10,
-        .power = 250,       /* == 500mA */
-#if defined(CONFIG_USB_SL811_BFIN_USE_VBUS)
-        .port_power = &sl811_port_power,
-#endif
-};
-
-static struct platform_device sl811_hcd_device = {
-        .name = "sl811-hcd",
-        .id = 0,
-        .dev = {
-                .platform_data = &sl811_priv,
-        },
-        .num_resources = ARRAY_SIZE(sl811_hcd_resources),
-        .resource = sl811_hcd_resources,
-};
-#endif
-
-#if defined(CONFIG_USB_ISP1362_HCD) || defined(CONFIG_USB_ISP1362_HCD_MODULE)
-static struct resource isp1362_hcd_resources[] = {
-        {
-                .start = 0x20360000,
-                .end = 0x20360000,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = 0x20360004,
-                .end = 0x20360004,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = CONFIG_USB_ISP1362_BFIN_GPIO_IRQ,
-                .end = CONFIG_USB_ISP1362_BFIN_GPIO_IRQ,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-
-static struct isp1362_platform_data isp1362_priv = {
-        .sel15Kres = 1,
-        .clknotstop = 0,
-        .oc_enable = 0,
-        .int_act_high = 0,
-        .int_edge_triggered = 0,
-        .remote_wakeup_connected = 0,
-        .no_power_switching = 1,
-        .power_switching_mode = 0,
-};
-
-static struct platform_device isp1362_hcd_device = {
-        .name = "isp1362-hcd",
-        .id = 0,
-        .dev = {
-                .platform_data = &isp1362_priv,
-        },
-        .num_resources = ARRAY_SIZE(isp1362_hcd_resources),
-        .resource = isp1362_hcd_resources,
-};
-#endif
-
-#if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
-static struct platform_device bfin_mii_bus = {
-        .name = "bfin_mii_bus",
-};
-
-static struct platform_device bfin_mac_device = {
-        .name = "bfin_mac",
-        .dev.platform_data = &bfin_mii_bus,
-};
-#endif
-
-#if defined(CONFIG_USB_NET2272) || defined(CONFIG_USB_NET2272_MODULE)
-static struct resource net2272_bfin_resources[] = {
-        {
-                .start = 0x20300000,
-                .end = 0x20300000 + 0x100,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = IRQ_PF7,
-                .end = IRQ_PF7,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-
-static struct platform_device net2272_bfin_device = {
-        .name = "net2272",
-        .id = -1,
-        .num_resources = ARRAY_SIZE(net2272_bfin_resources),
-        .resource = net2272_bfin_resources,
-};
-#endif
-
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-/* all SPI peripherals info goes here */
-
-#if defined(CONFIG_MTD_M25P80) \
-        || defined(CONFIG_MTD_M25P80_MODULE)
-static struct mtd_partition bfin_spi_flash_partitions[] = {
-        {
-                .name = "bootloader(spi)",
-                .size = 0x00020000,
-                .offset = 0,
-                .mask_flags = MTD_CAP_ROM
-        }, {
-                .name = "linux kernel(spi)",
-                .size = 0xe0000,
-                .offset = 0x20000
-        }, {
-                .name = "file system(spi)",
-                .size = 0x700000,
-                .offset = 0x00100000,
-        }
-};
-
-static struct flash_platform_data bfin_spi_flash_data = {
-        .name = "m25p80",
-        .parts = bfin_spi_flash_partitions,
-        .nr_parts = ARRAY_SIZE(bfin_spi_flash_partitions),
-        .type = "m25p64",
-};
-
-/* SPI flash chip (m25p64) */
-static struct bfin5xx_spi_chip spi_flash_chip_info = {
-        .enable_dma = 0,         /* use dma transfer with this chip*/
-        .bits_per_word = 8,
-};
-#endif
-
-#if defined(CONFIG_SPI_ADC_BF533) \
-        || defined(CONFIG_SPI_ADC_BF533_MODULE)
-/* SPI ADC chip */
-static struct bfin5xx_spi_chip spi_adc_chip_info = {
-        .enable_dma = 1,         /* use dma transfer with this chip*/
-        .bits_per_word = 16,
-};
-#endif
-
-#if defined(CONFIG_SND_BLACKFIN_AD1836) \
-        || defined(CONFIG_SND_BLACKFIN_AD1836_MODULE)
-static struct bfin5xx_spi_chip ad1836_spi_chip_info = {
-        .enable_dma = 0,
-        .bits_per_word = 16,
-};
-#endif
-
-#if defined(CONFIG_AD9960) || defined(CONFIG_AD9960_MODULE)
-static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
-        .enable_dma = 0,
-        .bits_per_word = 16,
-};
-#endif
-
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
-        .bits_per_word = 8,
-};
-#endif
-
-#if defined(CONFIG_PBX)
-static struct bfin5xx_spi_chip spi_si3xxx_chip_info = {
-        .ctl_reg        = 0x4, /* send zero */
-        .enable_dma     = 0,
-        .bits_per_word  = 8,
-        .cs_change_per_word = 1,
-};
-#endif
-
-#if defined(CONFIG_TOUCHSCREEN_AD7877) || defined(CONFIG_TOUCHSCREEN_AD7877_MODULE)
-static struct bfin5xx_spi_chip spi_ad7877_chip_info = {
-        .enable_dma = 0,
-        .bits_per_word = 16,
-};
-
-static const struct ad7877_platform_data bfin_ad7877_ts_info = {
-        .model                  = 7877,
-        .vref_delay_usecs       = 50,   /* internal, no capacitor */
-        .x_plate_ohms           = 419,
-        .y_plate_ohms           = 486,
-        .pressure_max           = 1000,
-        .pressure_min           = 0,
-        .stopacq_polarity       = 1,
-        .first_conversion_delay = 3,
-        .acquisition_time       = 1,
-        .averaging              = 1,
-        .pen_down_acc_interval  = 1,
-};
-#endif
-
-static struct spi_board_info bfin_spi_board_info[] __initdata = {
-#if defined(CONFIG_MTD_M25P80) \
-        || defined(CONFIG_MTD_M25P80_MODULE)
-        {
-                /* the modalias must be the same as spi device driver name */
-                .modalias = "m25p80", /* Name of spi_driver for this device */
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0, /* Framework bus number */
-                .chip_select = 1, /* Framework chip select. On STAMP537 it is SPISSEL1*/
-                .platform_data = &bfin_spi_flash_data,
-                .controller_data = &spi_flash_chip_info,
-                .mode = SPI_MODE_3,
-        },
-#endif
-
-#if defined(CONFIG_SPI_ADC_BF533) \
-        || defined(CONFIG_SPI_ADC_BF533_MODULE)
-        {
-                .modalias = "bfin_spi_adc", /* Name of spi_driver for this device */
-                .max_speed_hz = 6250000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0, /* Framework bus number */
-                .chip_select = 1, /* Framework chip select. */
-                .platform_data = NULL, /* No spi_driver specific config */
-                .controller_data = &spi_adc_chip_info,
-        },
-#endif
-
-#if defined(CONFIG_SND_BLACKFIN_AD1836) \
-        || defined(CONFIG_SND_BLACKFIN_AD1836_MODULE)
-        {
-                .modalias = "ad1836-spi",
-                .max_speed_hz = 3125000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = CONFIG_SND_BLACKFIN_SPI_PFBIT,
-                .controller_data = &ad1836_spi_chip_info,
-        },
-#endif
-#if defined(CONFIG_AD9960) || defined(CONFIG_AD9960_MODULE)
-        {
-                .modalias = "ad9960-spi",
-                .max_speed_hz = 10000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 1,
-                .controller_data = &ad9960_spi_chip_info,
-        },
-#endif
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-#endif
-#if defined(CONFIG_PBX)
-        {
-                .modalias = "fxs-spi",
-                .max_speed_hz = 12500000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 8 - CONFIG_J11_JUMPER,
-                .controller_data = &spi_si3xxx_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "fxo-spi",
-                .max_speed_hz = 12500000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 8 - CONFIG_J19_JUMPER,
-                .controller_data = &spi_si3xxx_chip_info,
-                .mode = SPI_MODE_3,
-        },
-#endif
-#if defined(CONFIG_TOUCHSCREEN_AD7877) || defined(CONFIG_TOUCHSCREEN_AD7877_MODULE)
-        {
-                .modalias               = "ad7877",
-                .platform_data          = &bfin_ad7877_ts_info,
-                .irq                    = IRQ_PF6,
-                .max_speed_hz   = 12500000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num        = 0,
-                .chip_select  = 1,
-                .controller_data = &spi_ad7877_chip_info,
-        },
-#endif
-};
-
-/* SPI controller data */
-static struct bfin5xx_spi_master bfin_spi0_info = {
-        .num_chipselect = 8,
-        .enable_dma = 1,  /* master has the ability to do dma transfer */
-        .pin_req = {P_SPI0_SCK, P_SPI0_MISO, P_SPI0_MOSI, 0},
-};
-
-/* SPI (0) */
-static struct resource bfin_spi0_resource[] = {
-        [0] = {
-                .start = SPI0_REGBASE,
-                .end   = SPI0_REGBASE + 0xFF,
-                .flags = IORESOURCE_MEM,
-                },
-        [1] = {
-                .start = CH_SPI,
-                .end   = CH_SPI,
-                .flags = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device bfin_spi0_device = {
-        .name = "bfin-spi",
-        .id = 0, /* Bus number */
-        .num_resources = ARRAY_SIZE(bfin_spi0_resource),
-        .resource = bfin_spi0_resource,
-        .dev = {
-                .platform_data = &bfin_spi0_info, /* Passed to driver */
-        },
-};
-#endif  /* spi master and devices */
-
-#if defined(CONFIG_FB_BF537_LQ035) || defined(CONFIG_FB_BF537_LQ035_MODULE)
-static struct platform_device bfin_fb_device = {
-        .name = "bf537-lq035",
-};
-#endif
-
-#if defined(CONFIG_FB_BFIN_7393) || defined(CONFIG_FB_BFIN_7393_MODULE)
-static struct platform_device bfin_fb_adv7393_device = {
-        .name = "bfin-adv7393",
-};
-#endif
-
-#if defined(CONFIG_SERIAL_BFIN) || defined(CONFIG_SERIAL_BFIN_MODULE)
-static struct resource bfin_uart_resources[] = {
-        {
-                .start = 0xFFC00400,
-                .end = 0xFFC004FF,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = 0xFFC02000,
-                .end = 0xFFC020FF,
-                .flags = IORESOURCE_MEM,
-        },
-};
-
-static struct platform_device bfin_uart_device = {
-        .name = "bfin-uart",
-        .id = 1,
-        .num_resources = ARRAY_SIZE(bfin_uart_resources),
-        .resource = bfin_uart_resources,
-};
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-static struct resource bfin_sir0_resources[] = {
-        {
-                .start = 0xFFC00400,
-                .end = 0xFFC004FF,
-                .flags = IORESOURCE_MEM,
-        },
-        {
-                .start = IRQ_UART0_RX,
-                .end = IRQ_UART0_RX+1,
-                .flags = IORESOURCE_IRQ,
-        },
-        {
-                .start = CH_UART0_RX,
-                .end = CH_UART0_RX+1,
-                .flags = IORESOURCE_DMA,
-        },
-};
-
-static struct platform_device bfin_sir0_device = {
-        .name = "bfin_sir",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(bfin_sir0_resources),
-        .resource = bfin_sir0_resources,
-};
-#endif
-#ifdef CONFIG_BFIN_SIR1
-static struct resource bfin_sir1_resources[] = {
-        {
-                .start = 0xFFC02000,
-                .end = 0xFFC020FF,
-                .flags = IORESOURCE_MEM,
-        },
-        {
-                .start = IRQ_UART1_RX,
-                .end = IRQ_UART1_RX+1,
-                .flags = IORESOURCE_IRQ,
-        },
-        {
-                .start = CH_UART1_RX,
-                .end = CH_UART1_RX+1,
-                .flags = IORESOURCE_DMA,
-        },
-};
-
-static struct platform_device bfin_sir1_device = {
-        .name = "bfin_sir",
-        .id = 1,
-        .num_resources = ARRAY_SIZE(bfin_sir1_resources),
-        .resource = bfin_sir1_resources,
-};
-#endif
-#endif
-
-#if defined(CONFIG_I2C_BLACKFIN_TWI) || defined(CONFIG_I2C_BLACKFIN_TWI_MODULE)
-static struct resource bfin_twi0_resource[] = {
-        [0] = {
-                .start = TWI0_REGBASE,
-                .end   = TWI0_REGBASE + 0xFF,
-                .flags = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start = IRQ_TWI,
-                .end   = IRQ_TWI,
-                .flags = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device i2c_bfin_twi_device = {
-        .name = "i2c-bfin-twi",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(bfin_twi0_resource),
-        .resource = bfin_twi0_resource,
-};
-#endif
-
-#if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
-static struct platform_device bfin_sport0_uart_device = {
-        .name = "bfin-sport-uart",
-        .id = 0,
-};
-
-static struct platform_device bfin_sport1_uart_device = {
-        .name = "bfin-sport-uart",
-        .id = 1,
-};
-#endif
-
-static struct platform_device *stamp_devices[] __initdata = {
-#if defined(CONFIG_BFIN_CFPCMCIA) || defined(CONFIG_BFIN_CFPCMCIA_MODULE)
-        &bfin_pcmcia_cf_device,
-#endif
-
-#if defined(CONFIG_RTC_DRV_BFIN) || defined(CONFIG_RTC_DRV_BFIN_MODULE)
-        &rtc_device,
-#endif
-
-#if defined(CONFIG_USB_SL811_HCD) || defined(CONFIG_USB_SL811_HCD_MODULE)
-        &sl811_hcd_device,
-#endif
-
-#if defined(CONFIG_USB_ISP1362_HCD) || defined(CONFIG_USB_ISP1362_HCD_MODULE)
-        &isp1362_hcd_device,
-#endif
-
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-        &smc91x_device,
-#endif
-
-#if defined(CONFIG_DM9000) || defined(CONFIG_DM9000_MODULE)
-        &dm9000_device,
-#endif
-
-#if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
-        &bfin_mii_bus,
-        &bfin_mac_device,
-#endif
-
-#if defined(CONFIG_USB_NET2272) || defined(CONFIG_USB_NET2272_MODULE)
-        &net2272_bfin_device,
-#endif
-
-#if defined(CONFIG_USB_ISP1760_HCD) || defined(CONFIG_USB_ISP1760_HCD_MODULE)
-        &bfin_isp1760_device,
-#endif
-
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-        &bfin_spi0_device,
-#endif
-
-#if defined(CONFIG_FB_BF537_LQ035) || defined(CONFIG_FB_BF537_LQ035_MODULE)
-        &bfin_fb_device,
-#endif
-
-#if defined(CONFIG_FB_BFIN_7393) || defined(CONFIG_FB_BFIN_7393_MODULE)
-        &bfin_fb_adv7393_device,
-#endif
-
-#if defined(CONFIG_SERIAL_BFIN) || defined(CONFIG_SERIAL_BFIN_MODULE)
-        &bfin_uart_device,
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-        &bfin_sir0_device,
-#endif
-#ifdef CONFIG_BFIN_SIR1
-        &bfin_sir1_device,
-#endif
-#endif
-
-#if defined(CONFIG_I2C_BLACKFIN_TWI) || defined(CONFIG_I2C_BLACKFIN_TWI_MODULE)
-        &i2c_bfin_twi_device,
-#endif
-
-#if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
-        &bfin_sport0_uart_device,
-        &bfin_sport1_uart_device,
-#endif
-};
-
-static int __init generic_init(void)
-{
-        printk(KERN_INFO "%s(): registering device resources\n", __func__);
-        platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
-#if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
-        spi_register_board_info(bfin_spi_board_info,
-                                ARRAY_SIZE(bfin_spi_board_info));
-#endif
-
-        return 0;
-}
-
-arch_initcall(generic_init);
-
-void native_machine_restart(char *cmd)
-{
-        /* workaround reboot hang when booting from SPI */
-        if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
-}
-
-#if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
-void bfin_get_ether_addr(char *addr)
-{
-        random_ether_addr(addr);
-        printk(KERN_WARNING "%s:%s: Setting Ethernet MAC to a random one\n", __FILE__, __func__);
-}
-EXPORT_SYMBOL(bfin_get_ether_addr);
-#endif
diff --git a/arch/blackfin/mach-bf537/boards/minotaur.c b/arch/blackfin/mach-bf537/boards/minotaur.c
index db7d3a385e4b..3c159819e555 100644
--- a/arch/blackfin/mach-bf537/boards/minotaur.c
+++ b/arch/blackfin/mach-bf537/boards/minotaur.c
@@ -134,9 +134,9 @@ static struct bfin5xx_spi_chip spi_flash_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -156,23 +156,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc_dummy",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 5000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = 0,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
-        {
-                .modalias = "spi_mmc",
-                .max_speed_hz = 5000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf537/boards/pnav10.c b/arch/blackfin/mach-bf537/boards/pnav10.c
index 590eb3a139b7..4e1de1e53f89 100644
--- a/arch/blackfin/mach-bf537/boards/pnav10.c
+++ b/arch/blackfin/mach-bf537/boards/pnav10.c
@@ -289,9 +289,9 @@ static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -364,23 +364,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
                 .controller_data = &ad9960_spi_chip_info,
         },
 #endif
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 7,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf537/boards/tcm_bf537.c b/arch/blackfin/mach-bf537/boards/tcm_bf537.c
index 3f4f203a06ec..53ad10f3cd76 100644
--- a/arch/blackfin/mach-bf537/boards/tcm_bf537.c
+++ b/arch/blackfin/mach-bf537/boards/tcm_bf537.c
@@ -108,9 +108,9 @@ static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -160,23 +160,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-        {
-                .modalias = "spi_mmc_dummy",
-                .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
-                .bus_num = 0,
-                .chip_select = 7,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
-                .mode = SPI_MODE_3,
-        },
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf537/include/mach/anomaly.h b/arch/blackfin/mach-bf537/include/mach/anomaly.h
index 9cb39121d1cb..1bfd80c26c90 100644
--- a/arch/blackfin/mach-bf537/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf537/include/mach/anomaly.h
@@ -2,7 +2,7 @@
  * File: include/asm-blackfin/mach-bf537/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
@@ -110,7 +110,7 @@
 #define ANOMALY_05000301 (1)
 /* SSYNCs After Writes To CAN/DMA MMR Registers Are Not Always Handled Correctly */
 #define ANOMALY_05000304 (__SILICON_REVISION__ < 3)
-/* New Feature: Additional Hysteresis on SPORT Input Pins (Not Available On Older Silicon) */
+/* SPORT_HYS Bit in PLL_CTL Register Is Not Functional */
 #define ANOMALY_05000305 (__SILICON_REVISION__ < 3)
 /* SCKELOW Bit Does Not Maintain State Through Hibernate */
 #define ANOMALY_05000307 (__SILICON_REVISION__ < 3)
@@ -168,9 +168,12 @@
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000353 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000432 (0)
 #define ANOMALY_05000435 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
index b3f87e1d16a2..9e34700844a2 100644
--- a/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf537/include/mach/bfin_serial_5xx.h
@@ -144,7 +144,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART0_TX,
         CH_UART0_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART0_CTS_PIN,
         CONFIG_UART0_RTS_PIN,
 #endif
@@ -158,7 +158,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART1_TX,
         CH_UART1_RX,
 #endif
-#ifdef CONFIG_BFIN_UART1_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART1_CTS_PIN,
         CONFIG_UART1_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-bf538/include/mach/anomaly.h b/arch/blackfin/mach-bf538/include/mach/anomaly.h
index e130b4f8a05d..3a5699827363 100644
--- a/arch/blackfin/mach-bf538/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf538/include/mach/anomaly.h
@@ -2,7 +2,7 @@
  * File: include/asm-blackfin/mach-bf538/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
@@ -120,13 +120,17 @@
 #define ANOMALY_05000198 (0)
 #define ANOMALY_05000230 (0)
 #define ANOMALY_05000263 (0)
+#define ANOMALY_05000305 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000353 (1)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000432 (0)
 #define ANOMALY_05000435 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
index 40503b6b89a3..3c2811ebecdd 100644
--- a/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf538/include/mach/bfin_serial_5xx.h
@@ -144,7 +144,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART0_TX,
         CH_UART0_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART0_CTS_PIN,
         CONFIG_UART0_RTS_PIN,
 #endif
@@ -158,7 +158,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART1_TX,
         CH_UART1_RX,
 #endif
-#ifdef CONFIG_BFIN_UART1_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART1_CTS_PIN,
         CONFIG_UART1_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-bf548/include/mach/anomaly.h b/arch/blackfin/mach-bf548/include/mach/anomaly.h
index 23d03c52f4b4..882e40ccf0d1 100644
--- a/arch/blackfin/mach-bf548/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf548/include/mach/anomaly.h
@@ -2,12 +2,12 @@
  * File: include/asm-blackfin/mach-bf548/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
 /* This file shoule be up to date with:
- *  - Revision G, 08/07/2008; ADSP-BF542/BF544/BF547/BF548/BF549 Blackfin Processor Anomaly List
+ *  - Revision H, 01/16/2009; ADSP-BF542/BF544/BF547/BF548/BF549 Blackfin Processor Anomaly List
  */
 
 #ifndef _MACH_ANOMALY_H_
@@ -91,8 +91,6 @@
 #define ANOMALY_05000371 (__SILICON_REVISION__ < 2)
 /* USB DP/DM Data Pins May Lose State When Entering Hibernate */
 #define ANOMALY_05000372 (__SILICON_REVISION__ < 1)
-/* Mobile DDR Operation Not Functional */
-#define ANOMALY_05000377 (1)
 /* Security/Authentication Speedpath Causes Authentication To Fail To Initiate */
 #define ANOMALY_05000378 (__SILICON_REVISION__ < 2)
 /* 16-Bit NAND FLASH Boot Mode Is Not Functional */
@@ -157,8 +155,22 @@
 #define ANOMALY_05000429 (__SILICON_REVISION__ < 2)
 /* Software System Reset Corrupts PLL_LOCKCNT Register */
 #define ANOMALY_05000430 (__SILICON_REVISION__ >= 2)
+/* Incorrect Use of Stack in Lockbox Firmware During Authentication */
+#define ANOMALY_05000431 (__SILICON_REVISION__ < 3)
+/* OTP Write Accesses Not Supported */
+#define ANOMALY_05000442 (__SILICON_REVISION__ < 1)
 /* IFLUSH Instruction at End of Hardware Loop Causes Infinite Stall */
 #define ANOMALY_05000443 (1)
+/* CDMAPRIO and L2DMAPRIO Bits in the SYSCR Register Are Not Functional */
+#define ANOMALY_05000446 (1)
+/* UART IrDA Receiver Fails on Extended Bit Pulses */
+#define ANOMALY_05000447 (1)
+/* DDR Clock Duty Cycle Spec Violation (tCH, tCL) */
+#define ANOMALY_05000448 (__SILICON_REVISION__ == 1)
+/* Reduced Timing Margins on DDR Output Setup and Hold (tDS and tDH) */
+#define ANOMALY_05000449 (__SILICON_REVISION__ == 1)
+/* USB DMA Mode 1 Short Packet Data Corruption */
+#define ANOMALY_05000450 (1
 
 /* Anomalies that don't exist on this proc */
 #define ANOMALY_05000125 (0)
@@ -171,6 +183,8 @@
 #define ANOMALY_05000263 (0)
 #define ANOMALY_05000266 (0)
 #define ANOMALY_05000273 (0)
+#define ANOMALY_05000278 (0)
+#define ANOMALY_05000305 (0)
 #define ANOMALY_05000307 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000323 (0)
diff --git a/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
index e4cf35e7ab9f..c05e79cba257 100644
--- a/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf548/include/mach/bfin_serial_5xx.h
@@ -63,7 +63,7 @@
 #define UART_ENABLE_INTS(x, v) UART_SET_IER(x, v)
 #define UART_DISABLE_INTS(x) UART_CLEAR_IER(x, 0xF)
 
-#if defined(CONFIG_BFIN_UART0_CTSRTS) || defined(CONFIG_BFIN_UART1_CTSRTS)
+#if defined(CONFIG_BFIN_UART0_CTSRTS) || defined(CONFIG_BFIN_UART2_CTSRTS)
 # define CONFIG_SERIAL_BFIN_CTSRTS
 
 # ifndef CONFIG_UART0_CTS_PIN
@@ -74,12 +74,12 @@
 #  define CONFIG_UART0_RTS_PIN -1
 # endif
 
-# ifndef CONFIG_UART1_CTS_PIN
-#  define CONFIG_UART1_CTS_PIN -1
+# ifndef CONFIG_UART2_CTS_PIN
+#  define CONFIG_UART2_CTS_PIN -1
 # endif
 
-# ifndef CONFIG_UART1_RTS_PIN
-#  define CONFIG_UART1_RTS_PIN -1
+# ifndef CONFIG_UART2_RTS_PIN
+#  define CONFIG_UART2_RTS_PIN -1
 # endif
 #endif
 
@@ -130,7 +130,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART0_TX,
         CH_UART0_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART0_CTS_PIN,
         CONFIG_UART0_RTS_PIN,
 #endif
@@ -144,6 +144,10 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART1_TX,
         CH_UART1_RX,
 #endif
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
+        0,
+        0,
+#endif
         },
 #endif
 #ifdef CONFIG_SERIAL_BFIN_UART2
@@ -154,7 +158,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART2_TX,
         CH_UART2_RX,
 #endif
-#ifdef CONFIG_BFIN_UART2_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART2_CTS_PIN,
         CONFIG_UART2_RTS_PIN,
 #endif
@@ -168,6 +172,10 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART3_TX,
         CH_UART3_RX,
 #endif
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
+        0,
+        0,
+#endif
         },
 #endif
 };
diff --git a/arch/blackfin/mach-bf548/include/mach/irq.h b/arch/blackfin/mach-bf548/include/mach/irq.h
index 60299a71e090..f194625f6821 100644
--- a/arch/blackfin/mach-bf548/include/mach/irq.h
+++ b/arch/blackfin/mach-bf548/include/mach/irq.h
@@ -123,8 +123,8 @@ Events         (highest priority)  EMU         0
 #define IRQ_MXVR_ERROR          BFIN_IRQ(51)    /* MXVR Status (Error) Interrupt */
 #define IRQ_MXVR_MSG            BFIN_IRQ(52)    /* MXVR Message Interrupt */
 #define IRQ_MXVR_PKT            BFIN_IRQ(53)    /* MXVR Packet Interrupt */
-#define IRQ_EPP1_ERROR          BFIN_IRQ(54)    /* EPPI1 Error Interrupt */
-#define IRQ_EPP2_ERROR          BFIN_IRQ(55)    /* EPPI2 Error Interrupt */
+#define IRQ_EPPI1_ERROR         BFIN_IRQ(54)    /* EPPI1 Error Interrupt */
+#define IRQ_EPPI2_ERROR         BFIN_IRQ(55)    /* EPPI2 Error Interrupt */
 #define IRQ_UART3_ERROR         BFIN_IRQ(56)    /* UART3 Status (Error) Interrupt */
 #define IRQ_HOST_ERROR          BFIN_IRQ(57)    /* HOST Status (Error) Interrupt */
 #define IRQ_PIXC_ERROR          BFIN_IRQ(59)    /* PIXC Status (Error) Interrupt */
@@ -361,8 +361,8 @@ Events         (highest priority)  EMU         0
 #define IRQ_UART2_ERR           IRQ_UART2_ERROR
 #define IRQ_CAN0_ERR            IRQ_CAN0_ERROR
 #define IRQ_MXVR_ERR            IRQ_MXVR_ERROR
-#define IRQ_EPP1_ERR            IRQ_EPP1_ERROR
-#define IRQ_EPP2_ERR            IRQ_EPP2_ERROR
+#define IRQ_EPPI1_ERR           IRQ_EPPI1_ERROR
+#define IRQ_EPPI2_ERR           IRQ_EPPI2_ERROR
 #define IRQ_UART3_ERR           IRQ_UART3_ERROR
 #define IRQ_HOST_ERR            IRQ_HOST_ERROR
 #define IRQ_PIXC_ERR            IRQ_PIXC_ERROR
diff --git a/arch/blackfin/mach-bf561/boards/Kconfig b/arch/blackfin/mach-bf561/boards/Kconfig
index e41a67b1fb53..e4bc6d7c5a6a 100644
--- a/arch/blackfin/mach-bf561/boards/Kconfig
+++ b/arch/blackfin/mach-bf561/boards/Kconfig
@@ -19,9 +19,4 @@ config BFIN561_BLUETECHNIX_CM
         help
           CM-BF561 support for EVAL- and DEV-Board.
 
-config GENERIC_BF561_BOARD
-        bool "Generic"
-        help
-          Generic or Custom board support.
-
 endchoice
diff --git a/arch/blackfin/mach-bf561/boards/Makefile b/arch/blackfin/mach-bf561/boards/Makefile
index 04add010b568..3a152559e957 100644
--- a/arch/blackfin/mach-bf561/boards/Makefile
+++ b/arch/blackfin/mach-bf561/boards/Makefile
@@ -2,7 +2,6 @@
 # arch/blackfin/mach-bf561/boards/Makefile
 #
 
-obj-$(CONFIG_GENERIC_BF561_BOARD)      += generic_board.o
 obj-$(CONFIG_BFIN561_BLUETECHNIX_CM)   += cm_bf561.o
 obj-$(CONFIG_BFIN561_EZKIT)            += ezkit.o
 obj-$(CONFIG_BFIN561_TEPLA)            += tepla.o
diff --git a/arch/blackfin/mach-bf561/boards/cm_bf561.c b/arch/blackfin/mach-bf561/boards/cm_bf561.c
index 6880d1ebfe60..f623c6b0719f 100644
--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c
+++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c
@@ -105,9 +105,9 @@ static struct bfin5xx_spi_chip ad9960_spi_chip_info = {
 };
 #endif
 
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
-static struct bfin5xx_spi_chip spi_mmc_chip_info = {
-        .enable_dma = 1,
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
+static struct bfin5xx_spi_chip mmc_spi_chip_info = {
+        .enable_dma = 0,
         .bits_per_word = 8,
 };
 #endif
@@ -155,14 +155,13 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
                 .controller_data = &ad9960_spi_chip_info,
         },
 #endif
-#if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
+#if defined(CONFIG_MMC_SPI) || defined(CONFIG_MMC_SPI_MODULE)
         {
-                .modalias = "spi_mmc",
+                .modalias = "mmc_spi",
                 .max_speed_hz = 25000000,     /* max spi clock (SCK) speed in HZ */
                 .bus_num = 0,
-                .chip_select = CONFIG_SPI_MMC_CS_CHAN,
-                .platform_data = NULL,
-                .controller_data = &spi_mmc_chip_info,
+                .chip_select = 5,
+                .controller_data = &mmc_spi_chip_info,
                 .mode = SPI_MODE_3,
         },
 #endif
diff --git a/arch/blackfin/mach-bf561/boards/generic_board.c b/arch/blackfin/mach-bf561/boards/generic_board.c
deleted file mode 100644
index 0ba366a0e696..000000000000
--- a/arch/blackfin/mach-bf561/boards/generic_board.c
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * File:         arch/blackfin/mach-bf561/generic_board.c
- * Based on:     arch/blackfin/mach-bf533/ezkit.c
- * Author:       Aidan Williams <aidan@nicta.com.au>
- *
- * Created:
- * Description:
- *
- * Modified:
- *               Copyright 2005 National ICT Australia (NICTA)
- *               Copyright 2004-2006 Analog Devices Inc.
- *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include <linux/device.h>
-#include <linux/platform_device.h>
-#include <linux/irq.h>
-
-const char bfin_board_name[] = "UNKNOWN BOARD";
-
-/*
- *  Driver needs to know address, irq and flag pin.
- */
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-static struct resource smc91x_resources[] = {
-        {
-                .start = 0x2C010300,
-                .end = 0x2C010300 + 16,
-                .flags = IORESOURCE_MEM,
-        }, {
-                .start = IRQ_PROG_INTB,
-                .end = IRQ_PROG_INTB,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        }, {
-                .start = IRQ_PF9,
-                .end = IRQ_PF9,
-                .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL,
-        },
-};
-
-static struct platform_device smc91x_device = {
-        .name = "smc91x",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(smc91x_resources),
-        .resource = smc91x_resources,
-};
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-static struct resource bfin_sir0_resources[] = {
-        {
-                .start = 0xFFC00400,
-                .end = 0xFFC004FF,
-                .flags = IORESOURCE_MEM,
-        },
-        {
-                .start = IRQ_UART0_RX,
-                .end = IRQ_UART0_RX+1,
-                .flags = IORESOURCE_IRQ,
-        },
-        {
-                .start = CH_UART0_RX,
-                .end = CH_UART0_RX+1,
-                .flags = IORESOURCE_DMA,
-        },
-};
-
-static struct platform_device bfin_sir0_device = {
-        .name = "bfin_sir",
-        .id = 0,
-        .num_resources = ARRAY_SIZE(bfin_sir0_resources),
-        .resource = bfin_sir0_resources,
-};
-#endif
-#endif
-
-static struct platform_device *generic_board_devices[] __initdata = {
-#if defined(CONFIG_SMC91X) || defined(CONFIG_SMC91X_MODULE)
-        &smc91x_device,
-#endif
-
-#if defined(CONFIG_BFIN_SIR) || defined(CONFIG_BFIN_SIR_MODULE)
-#ifdef CONFIG_BFIN_SIR0
-        &bfin_sir0_device,
-#endif
-#endif
-};
-
-static int __init generic_board_init(void)
-{
-        printk(KERN_INFO "%s(): registering device resources\n", __func__);
-        return platform_add_devices(generic_board_devices,
-                                    ARRAY_SIZE(generic_board_devices));
-}
-
-arch_initcall(generic_board_init);
diff --git a/arch/blackfin/mach-bf561/include/mach/anomaly.h b/arch/blackfin/mach-bf561/include/mach/anomaly.h
index 1a9e17562821..d0b0b3506440 100644
--- a/arch/blackfin/mach-bf561/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf561/include/mach/anomaly.h
@@ -2,7 +2,7 @@
  * File: include/asm-blackfin/mach-bf561/anomaly.h
  * Bugs: Enter bugs at http://blackfin.uclinux.org/
  *
- * Copyright (C) 2004-2008 Analog Devices Inc.
+ * Copyright (C) 2004-2009 Analog Devices Inc.
  * Licensed under the GPL-2 or later.
  */
 
@@ -224,7 +224,7 @@
 #define ANOMALY_05000301 (1)
 /* SSYNCs After Writes To DMA MMR Registers May Not Be Handled Correctly */
 #define ANOMALY_05000302 (1)
-/* New Feature: Additional Hysteresis on SPORT Input Pins (Not Available On Older Silicon) */
+/* SPORT_HYS Bit in PLL_CTL Register Is Not Functional */
 #define ANOMALY_05000305 (__SILICON_REVISION__ < 5)
 /* SCKELOW Bit Does Not Maintain State Through Hibernate */
 #define ANOMALY_05000307 (__SILICON_REVISION__ < 5)
@@ -283,8 +283,11 @@
 #define ANOMALY_05000273 (0)
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000353 (1)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000386 (1)
 #define ANOMALY_05000432 (0)
 #define ANOMALY_05000435 (0)
+#define ANOMALY_05000447 (0)
+#define ANOMALY_05000448 (0)
 
 #endif
diff --git a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
index 043bfcf26c52..ca8c5f645209 100644
--- a/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
+++ b/arch/blackfin/mach-bf561/include/mach/bfin_serial_5xx.h
@@ -134,7 +134,7 @@ struct bfin_serial_res bfin_serial_resource[] = {
         CH_UART_TX,
         CH_UART_RX,
 #endif
-#ifdef CONFIG_BFIN_UART0_CTSRTS
+#ifdef CONFIG_SERIAL_BFIN_CTSRTS
         CONFIG_UART0_CTS_PIN,
         CONFIG_UART0_RTS_PIN,
 #endif
diff --git a/arch/blackfin/mach-common/arch_checks.c b/arch/blackfin/mach-common/arch_checks.c
index 98133b968f7b..80d39b2f9db2 100644
--- a/arch/blackfin/mach-common/arch_checks.c
+++ b/arch/blackfin/mach-common/arch_checks.c
@@ -62,3 +62,12 @@
 #if (CONFIG_BOOT_LOAD & 0x3)
 # error "The kernel load address must be 4 byte aligned"
 #endif
+
+/* The entire kernel must be able to make a 24bit pcrel call to start of L1 */
+#if ((0xffffffff - L1_CODE_START + 1) + CONFIG_BOOT_LOAD) > 0x1000000
+# error "The kernel load address is too high; keep it below 10meg for safety"
+#endif
+
+#if ANOMALY_05000448
+# error You are using a part with anomaly 05000448, this issue causes random memory read/write failures - that means random crashes.
+#endif
diff --git a/arch/blackfin/mach-common/cache.S b/arch/blackfin/mach-common/cache.S
index 3c98dacbf289..aa0648c6a9fe 100644
--- a/arch/blackfin/mach-common/cache.S
+++ b/arch/blackfin/mach-common/cache.S
@@ -66,11 +66,33 @@
 
 /* Invalidate all instruction cache lines assocoiated with this memory area */
 ENTRY(_blackfin_icache_flush_range)
+/*
+ * Walkaround to avoid loading wrong instruction after invalidating icache
+ * and following sequence is met.
+ *
+ * 1) One instruction address is cached in the instruction cache.
+ * 2) This instruction in SDRAM is changed.
+ * 3) IFLASH[P0] is executed only once in blackfin_icache_flush_range().
+ * 4) This instruction is executed again, but the old one is loaded.
+ */
+        P0 = R0;
+        IFLUSH[P0];
         do_flush IFLUSH, , nop
 ENDPROC(_blackfin_icache_flush_range)
 
 /* Flush all cache lines assocoiated with this area of memory. */
 ENTRY(_blackfin_icache_dcache_flush_range)
+/*
+ * Walkaround to avoid loading wrong instruction after invalidating icache
+ * and following sequence is met.
+ *
+ * 1) One instruction address is cached in the instruction cache.
+ * 2) This instruction in SDRAM is changed.
+ * 3) IFLASH[P0] is executed only once in blackfin_icache_flush_range().
+ * 4) This instruction is executed again, but the old one is loaded.
+ */
+        P0 = R0;
+        IFLUSH[P0];
         do_flush FLUSH, IFLUSH
 ENDPROC(_blackfin_icache_dcache_flush_range)
 
diff --git a/arch/blackfin/mach-common/clocks-init.c b/arch/blackfin/mach-common/clocks-init.c
index 9dddb6f8cc85..35393651359b 100644
--- a/arch/blackfin/mach-common/clocks-init.c
+++ b/arch/blackfin/mach-common/clocks-init.c
@@ -17,7 +17,7 @@
 #define SDGCTL_WIDTH (1 << 31)  /* SDRAM external data path width */
 #define PLL_CTL_VAL \
         (((CONFIG_VCO_MULT & 63) << 9) | CLKIN_HALF | \
-         (PLL_BYPASS << 8) | (ANOMALY_05000265 ? 0x8000 : 0))
+         (PLL_BYPASS << 8) | (ANOMALY_05000305 ? 0 : 0x8000))
 
 __attribute__((l1_text))
 static void do_sync(void)
diff --git a/arch/blackfin/mach-common/dpmc_modes.S b/arch/blackfin/mach-common/dpmc_modes.S
index 4da50bcd9300..8009a512fb11 100644
--- a/arch/blackfin/mach-common/dpmc_modes.S
+++ b/arch/blackfin/mach-common/dpmc_modes.S
@@ -376,10 +376,22 @@ ENTRY(_do_hibernate)
 #endif
 
 #ifdef PINT0_ASSIGN
+        PM_SYS_PUSH(PINT0_MASK_SET)
+        PM_SYS_PUSH(PINT1_MASK_SET)
+        PM_SYS_PUSH(PINT2_MASK_SET)
+        PM_SYS_PUSH(PINT3_MASK_SET)
         PM_SYS_PUSH(PINT0_ASSIGN)
         PM_SYS_PUSH(PINT1_ASSIGN)
         PM_SYS_PUSH(PINT2_ASSIGN)
         PM_SYS_PUSH(PINT3_ASSIGN)
+        PM_SYS_PUSH(PINT0_INVERT_SET)
+        PM_SYS_PUSH(PINT1_INVERT_SET)
+        PM_SYS_PUSH(PINT2_INVERT_SET)
+        PM_SYS_PUSH(PINT3_INVERT_SET)
+        PM_SYS_PUSH(PINT0_EDGE_SET)
+        PM_SYS_PUSH(PINT1_EDGE_SET)
+        PM_SYS_PUSH(PINT2_EDGE_SET)
+        PM_SYS_PUSH(PINT3_EDGE_SET)
 #endif
 
         PM_SYS_PUSH(EBIU_AMBCTL0)
@@ -714,10 +726,22 @@ ENTRY(_do_hibernate)
         PM_SYS_POP(EBIU_AMBCTL0)
 
 #ifdef PINT0_ASSIGN
+        PM_SYS_POP(PINT3_EDGE_SET)
+        PM_SYS_POP(PINT2_EDGE_SET)
+        PM_SYS_POP(PINT1_EDGE_SET)
+        PM_SYS_POP(PINT0_EDGE_SET)
+        PM_SYS_POP(PINT3_INVERT_SET)
+        PM_SYS_POP(PINT2_INVERT_SET)
+        PM_SYS_POP(PINT1_INVERT_SET)
+        PM_SYS_POP(PINT0_INVERT_SET)
         PM_SYS_POP(PINT3_ASSIGN)
         PM_SYS_POP(PINT2_ASSIGN)
         PM_SYS_POP(PINT1_ASSIGN)
         PM_SYS_POP(PINT0_ASSIGN)
+        PM_SYS_POP(PINT3_MASK_SET)
+        PM_SYS_POP(PINT2_MASK_SET)
+        PM_SYS_POP(PINT1_MASK_SET)
+        PM_SYS_POP(PINT0_MASK_SET)
 #endif
 
 #ifdef SICA_IWR1
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index 88de053bbe8e..21e65a339a22 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -600,6 +600,19 @@ ENTRY(_system_call)
         p2 = [p2];
 
         [p2+(TASK_THREAD+THREAD_KSP)] = sp;
+#ifdef CONFIG_IPIPE
+        r0 = sp;
+        SP += -12;
+        call ___ipipe_syscall_root;
+        SP += 12;
+        cc = r0 == 1;
+        if cc jump .Lsyscall_really_exit;
+        cc = r0 == -1;
+        if cc jump .Lresume_userspace;
+        r3 = [sp + PT_R3];
+        r4 = [sp + PT_R4];
+        p0 = [sp + PT_ORIG_P0];
+#endif /* CONFIG_IPIPE */
 
         /* Check the System Call */
         r7 = __NR_syscall;
@@ -654,6 +667,17 @@ ENTRY(_system_call)
         r7 =  r7 & r4;
 
 .Lsyscall_resched:
+#ifdef CONFIG_IPIPE
+        cc = BITTST(r7, TIF_IRQ_SYNC);
+        if !cc jump .Lsyscall_no_irqsync;
+        [--sp] = reti;
+        r0 = [sp++];
+        SP += -12;
+        call ___ipipe_sync_root;
+        SP += 12;
+        jump .Lresume_userspace_1;
+.Lsyscall_no_irqsync:
+#endif
         cc = BITTST(r7, TIF_NEED_RESCHED);
         if !cc jump .Lsyscall_sigpending;
 
@@ -685,6 +709,10 @@ ENTRY(_system_call)
 .Lsyscall_really_exit:
         r5 = [sp + PT_RESERVED];
         rets = r5;
+#ifdef CONFIG_IPIPE
+        [--sp] = reti;
+        r5 = [sp++];
+#endif /* CONFIG_IPIPE */
         rts;
 ENDPROC(_system_call)
 
@@ -771,6 +799,15 @@ _new_old_task:
 ENDPROC(_resume)
 
 ENTRY(_ret_from_exception)
+#ifdef CONFIG_IPIPE
+        [--sp] = rets;
+        SP += -12;
+        call ___ipipe_check_root
+        SP += 12
+        rets = [sp++];
+        cc = r0 == 0;
+        if cc jump 4f;                /* not on behalf of Linux, get out */
+#endif /* CONFIG_IPIPE */
         p2.l = lo(IPEND);
         p2.h = hi(IPEND);
 
@@ -827,6 +864,28 @@ ENTRY(_ret_from_exception)
         rts;
 ENDPROC(_ret_from_exception)
 
+#ifdef CONFIG_IPIPE
+
+_sync_root_irqs:
+        [--sp] = reti;          /* Reenable interrupts */
+        r0 = [sp++];
+        jump.l ___ipipe_sync_root
+
+_resume_kernel_from_int:
+        r0.l = _sync_root_irqs
+        r0.h = _sync_root_irqs
+        [--sp] = rets;
+        [--sp] = ( r7:4, p5:3 );
+        SP += -12;
+        call ___ipipe_call_irqtail
+        SP += 12;
+        ( r7:4, p5:3 ) = [sp++];
+        rets = [sp++];
+        rts
+#else
+#define _resume_kernel_from_int  2f
+#endif
+
 ENTRY(_return_from_int)
         /* If someone else already raised IRQ 15, do nothing.  */
         csync;
@@ -848,7 +907,7 @@ ENTRY(_return_from_int)
         r1 = r0 - r1;
         r2 = r0 & r1;
         cc = r2 == 0;
-        if !cc jump 2f;
+        if !cc jump _resume_kernel_from_int;
 
         /* Lower the interrupt level to 15.  */
         p0.l = lo(EVT15);
diff --git a/arch/blackfin/mach-common/interrupt.S b/arch/blackfin/mach-common/interrupt.S
index 43c4eb9acb65..0069c2dd4625 100644
--- a/arch/blackfin/mach-common/interrupt.S
+++ b/arch/blackfin/mach-common/interrupt.S
@@ -235,6 +235,7 @@ ENDPROC(_evt_system_call)
 
 #ifdef CONFIG_IPIPE
 ENTRY(___ipipe_call_irqtail)
+        p0 = r0;
         r0.l = 1f;
         r0.h = 1f;
         reti = r0;
@@ -242,9 +243,6 @@ ENTRY(___ipipe_call_irqtail)
 1:
         [--sp] = rets;
         [--sp] = ( r7:4, p5:3 );
-        p0.l = ___ipipe_irq_tail_hook;
-        p0.h = ___ipipe_irq_tail_hook;
-        p0 = [p0];
         sp += -12;
         call (p0);
         sp += 12;
@@ -259,7 +257,7 @@ ENTRY(___ipipe_call_irqtail)
         p0.h = hi(EVT14);
         [p0] = r0;
         csync;
-        r0 = 0x401f;
+        r0 = 0x401f (z);
         sti r0;
         raise 14;
         [--sp] = reti;          /* IRQs on. */
@@ -277,11 +275,7 @@ ENTRY(___ipipe_call_irqtail)
         p0.h = _bfin_irq_flags;
         r0 = [p0];
         sti r0;
-#if 0 /* FIXME: this actually raises scheduling latencies */
-        /* Reenable interrupts */
-        [--sp] = reti;
-        r0 = [sp++];
-#endif
         rts;
 ENDPROC(___ipipe_call_irqtail)
+
 #endif /* CONFIG_IPIPE */
diff --git a/arch/blackfin/mach-common/ints-priority.c b/arch/blackfin/mach-common/ints-priority.c
index 202494568c6c..a7d7b2dd4059 100644
--- a/arch/blackfin/mach-common/ints-priority.c
+++ b/arch/blackfin/mach-common/ints-priority.c
@@ -161,11 +161,15 @@ static void bfin_core_unmask_irq(unsigned int irq)
 
 static void bfin_internal_mask_irq(unsigned int irq)
 {
+        unsigned long flags;
+
 #ifdef CONFIG_BF53x
+        local_irq_save_hw(flags);
         bfin_write_SIC_IMASK(bfin_read_SIC_IMASK() &
                              ~(1 << SIC_SYSIRQ(irq)));
 #else
         unsigned mask_bank, mask_bit;
+        local_irq_save_hw(flags);
         mask_bank = SIC_SYSIRQ(irq) / 32;
         mask_bit = SIC_SYSIRQ(irq) % 32;
         bfin_write_SIC_IMASK(mask_bank, bfin_read_SIC_IMASK(mask_bank) &
@@ -175,15 +179,20 @@ static void bfin_internal_mask_irq(unsigned int irq)
                              ~(1 << mask_bit));
 #endif
 #endif
+        local_irq_restore_hw(flags);
 }
 
 static void bfin_internal_unmask_irq(unsigned int irq)
 {
+        unsigned long flags;
+
 #ifdef CONFIG_BF53x
+        local_irq_save_hw(flags);
         bfin_write_SIC_IMASK(bfin_read_SIC_IMASK() |
                              (1 << SIC_SYSIRQ(irq)));
 #else
         unsigned mask_bank, mask_bit;
+        local_irq_save_hw(flags);
         mask_bank = SIC_SYSIRQ(irq) / 32;
         mask_bit = SIC_SYSIRQ(irq) % 32;
         bfin_write_SIC_IMASK(mask_bank, bfin_read_SIC_IMASK(mask_bank) |
@@ -193,6 +202,7 @@ static void bfin_internal_unmask_irq(unsigned int irq)
                              (1 << mask_bit));
 #endif
 #endif
+        local_irq_restore_hw(flags);
 }
 
 #ifdef CONFIG_PM
@@ -390,7 +400,7 @@ static void bfin_demux_error_irq(unsigned int int_err_irq,
 static inline void bfin_set_irq_handler(unsigned irq, irq_flow_handler_t handle)
 {
 #ifdef CONFIG_IPIPE
-        _set_irq_handler(irq, handle_edge_irq);
+        _set_irq_handler(irq, handle_level_irq);
 #else
         struct irq_desc *desc = irq_desc + irq;
         /* May not call generic set_irq_handler() due to spinlock
@@ -1055,13 +1065,18 @@ int __init init_arch_irq(void)
 #endif
                 default:
 #ifdef CONFIG_IPIPE
-        /*
-         * We want internal interrupt sources to be masked, because
-         * ISRs may trigger interrupts recursively (e.g. DMA), but
-         * interrupts are _not_ masked at CPU level. So let's handle
-         * them as level interrupts.
-         */
-                        set_irq_handler(irq, handle_level_irq);
+                        /*
+                         * We want internal interrupt sources to be
+                         * masked, because ISRs may trigger interrupts
+                         * recursively (e.g. DMA), but interrupts are
+                         * _not_ masked at CPU level. So let's handle
+                         * most of them as level interrupts, except
+                         * the timer interrupt which is special.
+                         */
+                        if (irq == IRQ_SYSTMR || irq == IRQ_CORETMR)
+                                set_irq_handler(irq, handle_simple_irq);
+                        else
+                                set_irq_handler(irq, handle_level_irq);
 #else /* !CONFIG_IPIPE */
                         set_irq_handler(irq, handle_simple_irq);
 #endif /* !CONFIG_IPIPE */
@@ -1123,9 +1138,8 @@ int __init init_arch_irq(void)
 
 #ifdef CONFIG_IPIPE
         for (irq = 0; irq < NR_IRQS; irq++) {
-                struct irq_desc *desc = irq_desc + irq;
+                struct irq_desc *desc = irq_to_desc(irq);
                 desc->ic_prio = __ipipe_get_irq_priority(irq);
-                desc->thr_prio = __ipipe_get_irqthread_priority(irq);
         }
 #endif /* CONFIG_IPIPE */
 
@@ -1208,76 +1222,21 @@ int __ipipe_get_irq_priority(unsigned irq)
         return IVG15;
 }
 
-int __ipipe_get_irqthread_priority(unsigned irq)
-{
-        int ient, prio;
-        int demux_irq;
-
-        /* The returned priority value is rescaled to [0..IVG13+1]
-         * with 0 being the lowest effective priority level. */
-
-        if (irq <= IRQ_CORETMR)
-                return IVG13 - irq + 1;
-
-        /* GPIO IRQs are given the priority of the demux
-         * interrupt. */
-        if (IS_GPIOIRQ(irq)) {
-#if defined(CONFIG_BF54x)
-                u32 bank = PINT_2_BANK(irq2pint_lut[irq - SYS_IRQS]);
-                demux_irq = (bank == 0 ? IRQ_PINT0 :
-                                bank == 1 ? IRQ_PINT1 :
-                                bank == 2 ? IRQ_PINT2 :
-                                IRQ_PINT3);
-#elif defined(CONFIG_BF561)
-                demux_irq = (irq >= IRQ_PF32 ? IRQ_PROG2_INTA :
-                                irq >= IRQ_PF16 ? IRQ_PROG1_INTA :
-                                IRQ_PROG0_INTA);
-#elif defined(CONFIG_BF52x)
-                demux_irq = (irq >= IRQ_PH0 ? IRQ_PORTH_INTA :
-                                irq >= IRQ_PG0 ? IRQ_PORTG_INTA :
-                                IRQ_PORTF_INTA);
-#else
-                demux_irq = irq;
-#endif
-                return IVG13 - PRIO_GPIODEMUX(demux_irq) + 1;
-        }
-
-        /* The GPIO demux interrupt is given a lower priority
-         * than the GPIO IRQs, so that its threaded handler
-         * unmasks the interrupt line after the decoded IRQs
-         * have been processed. */
-        prio = PRIO_GPIODEMUX(irq);
-        /* demux irq? */
-        if (prio != -1)
-                return IVG13 - prio;
-
-        for (ient = 0; ient < NR_PERI_INTS; ient++) {
-                struct ivgx *ivg = ivg_table + ient;
-                if (ivg->irqno == irq) {
-                        for (prio = 0; prio <= IVG13-IVG7; prio++) {
-                                if (ivg7_13[prio].ifirst <= ivg &&
-                                    ivg7_13[prio].istop > ivg)
-                                        return IVG7 - prio;
-                        }
-                }
-        }
-
-        return 0;
-}
-
 /* Hw interrupts are disabled on entry (check SAVE_CONTEXT). */
 #ifdef CONFIG_DO_IRQ_L1
 __attribute__((l1_text))
 #endif
 asmlinkage int __ipipe_grab_irq(int vec, struct pt_regs *regs)
 {
+        struct ipipe_percpu_domain_data *p = ipipe_root_cpudom_ptr();
+        struct ipipe_domain *this_domain = ipipe_current_domain;
         struct ivgx *ivg_stop = ivg7_13[vec-IVG7].istop;
         struct ivgx *ivg = ivg7_13[vec-IVG7].ifirst;
-        int irq;
+        int irq, s;
 
         if (likely(vec == EVT_IVTMR_P)) {
                 irq = IRQ_CORETMR;
-                goto handle_irq;
+                goto core_tick;
         }
 
         SSYNC();
@@ -1319,24 +1278,39 @@ asmlinkage int __ipipe_grab_irq(int vec, struct pt_regs *regs)
         irq = ivg->irqno;
 
         if (irq == IRQ_SYSTMR) {
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+core_tick:
+#else
                 bfin_write_TIMER_STATUS(1); /* Latch TIMIL0 */
+#endif
                 /* This is basically what we need from the register frame. */
                 __raw_get_cpu_var(__ipipe_tick_regs).ipend = regs->ipend;
                 __raw_get_cpu_var(__ipipe_tick_regs).pc = regs->pc;
-                if (!ipipe_root_domain_p)
-                        __raw_get_cpu_var(__ipipe_tick_regs).ipend |= 0x10;
-                else
+                if (this_domain != ipipe_root_domain)
                         __raw_get_cpu_var(__ipipe_tick_regs).ipend &= ~0x10;
+                else
+                        __raw_get_cpu_var(__ipipe_tick_regs).ipend |= 0x10;
         }
 
-handle_irq:
+#ifndef CONFIG_GENERIC_CLOCKEVENTS
+core_tick:
+#endif
+        if (this_domain == ipipe_root_domain) {
+                s = __test_and_set_bit(IPIPE_SYNCDEFER_FLAG, &p->status);
+                barrier();
+        }
 
         ipipe_trace_irq_entry(irq);
         __ipipe_handle_irq(irq, regs);
-       ipipe_trace_irq_exit(irq);
+        ipipe_trace_irq_exit(irq);
 
-       if (ipipe_root_domain_p)
-                return !test_bit(IPIPE_STALL_FLAG, &ipipe_root_cpudom_var(status));
+        if (this_domain == ipipe_root_domain) {
+                set_thread_flag(TIF_IRQ_SYNC);
+                if (!s) {
+                        __clear_bit(IPIPE_SYNCDEFER_FLAG, &p->status);
+                        return !test_bit(IPIPE_STALL_FLAG, &p->status);
+                }
+        }
 
        return 0;
 }
diff --git a/arch/blackfin/mach-common/smp.c b/arch/blackfin/mach-common/smp.c
index 77c992847094..93eab6146079 100644
--- a/arch/blackfin/mach-common/smp.c
+++ b/arch/blackfin/mach-common/smp.c
@@ -158,10 +158,14 @@ static irqreturn_t ipi_handler(int irq, void *dev_instance)
                         kfree(msg);
                         break;
                 case BFIN_IPI_CALL_FUNC:
+                        spin_unlock(&msg_queue->lock);
                         ipi_call_function(cpu, msg);
+                        spin_lock(&msg_queue->lock);
                         break;
                 case BFIN_IPI_CPU_STOP:
+                        spin_unlock(&msg_queue->lock);
                         ipi_cpu_stop(cpu);
+                        spin_lock(&msg_queue->lock);
                         kfree(msg);
                         break;
                 default:
@@ -457,7 +461,7 @@ void smp_icache_flush_range_others(unsigned long start, unsigned long end)
         smp_flush_data.start = start;
         smp_flush_data.end = end;
 
-        if (smp_call_function(&ipi_flush_icache, &smp_flush_data, 1))
+        if (smp_call_function(&ipi_flush_icache, &smp_flush_data, 0))
                 printk(KERN_WARNING "SMP: failed to run I-cache flush request on other CPUs\n");
 }
 EXPORT_SYMBOL_GPL(smp_icache_flush_range_others);
diff --git a/arch/blackfin/mm/init.c b/arch/blackfin/mm/init.c
index d0532b72bba5..9c3629b9a689 100644
--- a/arch/blackfin/mm/init.c
+++ b/arch/blackfin/mm/init.c
@@ -104,7 +104,7 @@ void __init paging_init(void)
         }
 }
 
-asmlinkage void init_pda(void)
+asmlinkage void __init init_pda(void)
 {
         unsigned int cpu = raw_smp_processor_id();
 
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 4eb45c012498..153e727a6e8e 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -638,6 +638,17 @@ config DMAR
           and include PCI device scope covered by these DMA
           remapping devices.
 
+config DMAR_DEFAULT_ON
+        def_bool y
+        prompt "Enable DMA Remapping Devices by default"
+        depends on DMAR
+        help
+          Selecting this option will enable a DMAR device at boot time if
+          one is found. If this option is not selected, DMAR support can
+          be enabled by passing intel_iommu=on to the kernel. It is
+          recommended you say N here while the DMAR code remains
+          experimental.
+
 endmenu
 
 endif
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 5cfd3d91001a..e13125058bed 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -507,7 +507,7 @@ static int iosapic_find_sharable_irq(unsigned long trigger, unsigned long pol)
         if (trigger == IOSAPIC_EDGE)
                 return -EINVAL;
 
-        for (i = 0; i <= NR_IRQS; i++) {
+        for (i = 0; i < NR_IRQS; i++) {
                 info = &iosapic_intr_info[i];
                 if (info->trigger == trigger && info->polarity == pol &&
                     (info->dmode == IOSAPIC_FIXED ||
diff --git a/arch/ia64/kernel/unwind.c b/arch/ia64/kernel/unwind.c
index 67810b77d998..b6c0e63a0bf6 100644
--- a/arch/ia64/kernel/unwind.c
+++ b/arch/ia64/kernel/unwind.c
@@ -2149,7 +2149,7 @@ unw_remove_unwind_table (void *handle)
 
         /* next, remove hash table entries for this table */
 
-        for (index = 0; index <= UNW_HASH_SIZE; ++index) {
+        for (index = 0; index < UNW_HASH_SIZE; ++index) {
                 tmp = unw.cache + unw.hash[index];
                 if (unw.hash[index] >= UNW_CACHE_SIZE
                     || tmp->ip < table->start || tmp->ip >= table->end)
diff --git a/arch/ia64/sn/pci/pcibr/pcibr_dma.c b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
index e626e50a938a..060df4aa9916 100644
--- a/arch/ia64/sn/pci/pcibr/pcibr_dma.c
+++ b/arch/ia64/sn/pci/pcibr/pcibr_dma.c
@@ -135,11 +135,10 @@ pcibr_dmatrans_direct64(struct pcidev_info * info, u64 paddr,
         if (SN_DMA_ADDRTYPE(dma_flags) == SN_DMA_ADDR_PHYS)
                 pci_addr = IS_PIC_SOFT(pcibus_info) ?
                                 PHYS_TO_DMA(paddr) :
-                                PHYS_TO_TIODMA(paddr) | dma_attributes;
+                                PHYS_TO_TIODMA(paddr);
         else
-                pci_addr = IS_PIC_SOFT(pcibus_info) ?
-                                paddr :
-                                paddr | dma_attributes;
+                pci_addr = paddr;
+        pci_addr |= dma_attributes;
 
         /* Handle Bus mode */
         if (IS_PCIX(pcibus_info))
diff --git a/arch/m68knommu/platform/5206e/config.c b/arch/m68knommu/platform/5206e/config.c
index d01a5d2b7557..db902540bf2c 100644
--- a/arch/m68knommu/platform/5206e/config.c
+++ b/arch/m68knommu/platform/5206e/config.c
@@ -17,6 +17,7 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfdma.h>
+#include <asm/mcfuart.h>
 
 /***************************************************************************/
 
diff --git a/arch/m68knommu/platform/528x/config.c b/arch/m68knommu/platform/528x/config.c
index dfdb5c2ed8e6..44baeb225dc7 100644
--- a/arch/m68knommu/platform/528x/config.c
+++ b/arch/m68knommu/platform/528x/config.c
@@ -24,7 +24,6 @@
 #include <asm/coldfire.h>
 #include <asm/mcfsim.h>
 #include <asm/mcfuart.h>
-#include <asm/mcfqspi.h>
 
 #ifdef CONFIG_MTD_PARTITIONS
 #include <linux/mtd/partitions.h>
@@ -33,233 +32,6 @@
 /***************************************************************************/
 
 void coldfire_reset(void);
-static void coldfire_qspi_cs_control(u8 cs, u8 command);
-
-/***************************************************************************/
-
-#if defined(CONFIG_SPI)
-
-#if defined(CONFIG_WILDFIRE)
-#define SPI_NUM_CHIPSELECTS     0x02
-#define SPI_PAR_VAL             0x07  /* Enable DIN, DOUT, CLK */
-#define SPI_CS_MASK             0x18
-
-#define FLASH_BLOCKSIZE         (1024*64)
-#define FLASH_NUMBLOCKS         16
-#define FLASH_TYPE              "m25p80"
-
-#define M25P80_CS               0
-#define MMC_CS                  1
-
-#ifdef CONFIG_MTD_PARTITIONS
-static struct mtd_partition stm25p_partitions[] = {
-        /* sflash */
-        [0] = {
-                .name = "stm25p80",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
-                .mask_flags = 0
-        }
-};
-
-#endif
-
-#elif defined(CONFIG_WILDFIREMOD)
-
-#define SPI_NUM_CHIPSELECTS     0x08
-#define SPI_PAR_VAL             0x07  /* Enable DIN, DOUT, CLK */
-#define SPI_CS_MASK             0x78
-
-#define FLASH_BLOCKSIZE         (1024*64)
-#define FLASH_NUMBLOCKS         64
-#define FLASH_TYPE              "m25p32"
-/* Reserve 1M for the kernel parition */
-#define FLASH_KERNEL_SIZE   (1024 * 1024)
-
-#define M25P80_CS               5
-#define MMC_CS                  6
-
-#ifdef CONFIG_MTD_PARTITIONS
-static struct mtd_partition stm25p_partitions[] = {
-        /* sflash */
-        [0] = {
-                .name = "kernel",
-                .offset = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
-                .size = FLASH_KERNEL_SIZE,
-                .mask_flags = 0
-        },
-        [1] = {
-                .name = "image",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS - FLASH_KERNEL_SIZE,
-                .mask_flags = 0
-        },
-        [2] = {
-                .name = "all",
-                .offset = 0x00000000,
-                .size = FLASH_BLOCKSIZE * FLASH_NUMBLOCKS,
-                .mask_flags = 0
-        }
-};
-#endif
-
-#else
-#define SPI_NUM_CHIPSELECTS     0x04
-#define SPI_PAR_VAL             0x7F  /* Enable DIN, DOUT, CLK, CS0 - CS4 */
-#endif
-
-#ifdef MMC_CS
-static struct coldfire_spi_chip flash_chip_info = {
-        .mode = SPI_MODE_0,
-        .bits_per_word = 16,
-        .del_cs_to_clk = 17,
-        .del_after_trans = 1,
-        .void_write_data = 0
-};
-
-static struct coldfire_spi_chip mmc_chip_info = {
-        .mode = SPI_MODE_0,
-        .bits_per_word = 16,
-        .del_cs_to_clk = 17,
-        .del_after_trans = 1,
-        .void_write_data = 0xFFFF
-};
-#endif
-
-#ifdef M25P80_CS
-static struct flash_platform_data stm25p80_platform_data = {
-        .name = "ST M25P80 SPI Flash chip",
-#ifdef CONFIG_MTD_PARTITIONS
-        .parts = stm25p_partitions,
-        .nr_parts = sizeof(stm25p_partitions) / sizeof(*stm25p_partitions),
-#endif
-        .type = FLASH_TYPE
-};
-#endif
-
-static struct spi_board_info spi_board_info[] __initdata = {
-#ifdef M25P80_CS
-        {
-                .modalias = "m25p80",
-                .max_speed_hz = 16000000,
-                .bus_num = 1,
-                .chip_select = M25P80_CS,
-                .platform_data = &stm25p80_platform_data,
-                .controller_data = &flash_chip_info
-        },
-#endif
-#ifdef MMC_CS
-        {
-                .modalias = "mmc_spi",
-                .max_speed_hz = 16000000,
-                .bus_num = 1,
-                .chip_select = MMC_CS,
-                .controller_data = &mmc_chip_info
-        }
-#endif
-};
-
-static struct coldfire_spi_master coldfire_master_info = {
-        .bus_num = 1,
-        .num_chipselect = SPI_NUM_CHIPSELECTS,
-        .irq_source = MCF5282_QSPI_IRQ_SOURCE,
-        .irq_vector = MCF5282_QSPI_IRQ_VECTOR,
-        .irq_mask = ((0x01 << MCF5282_QSPI_IRQ_SOURCE) | 0x01),
-        .irq_lp = 0x2B,  /* Level 5 and Priority 3 */
-        .par_val = SPI_PAR_VAL,
-        .cs_control = coldfire_qspi_cs_control,
-};
-
-static struct resource coldfire_spi_resources[] = {
-        [0] = {
-                .name = "qspi-par",
-                .start = MCF5282_QSPI_PAR,
-                .end = MCF5282_QSPI_PAR,
-                .flags = IORESOURCE_MEM
-        },
-
-        [1] = {
-                .name = "qspi-module",
-                .start = MCF5282_QSPI_QMR,
-                .end = MCF5282_QSPI_QMR + 0x18,
-                .flags = IORESOURCE_MEM
-        },
-
-        [2] = {
-                .name = "qspi-int-level",
-                .start = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
-                .end = MCF5282_INTC0 + MCFINTC_ICR0 + MCF5282_QSPI_IRQ_SOURCE,
-                .flags = IORESOURCE_MEM
-        },
-
-        [3] = {
-                .name = "qspi-int-mask",
-                .start = MCF5282_INTC0 + MCFINTC_IMRL,
-                .end = MCF5282_INTC0 + MCFINTC_IMRL,
-                .flags = IORESOURCE_MEM
-        }
-};
-
-static struct platform_device coldfire_spi = {
-        .name = "spi_coldfire",
-        .id = -1,
-        .resource = coldfire_spi_resources,
-        .num_resources = ARRAY_SIZE(coldfire_spi_resources),
-        .dev = {
-                .platform_data = &coldfire_master_info,
-        }
-};
-
-static void coldfire_qspi_cs_control(u8 cs, u8 command)
-{
-        u8 cs_bit = ((0x01 << cs) << 3) & SPI_CS_MASK;
-
-#if defined(CONFIG_WILDFIRE)
-        u8 cs_mask = ~(((0x01 << cs) << 3) & SPI_CS_MASK);
-#endif
-#if defined(CONFIG_WILDFIREMOD)
-        u8 cs_mask = (cs << 3) & SPI_CS_MASK;
-#endif
-
-        /*
-         * Don't do anything if the chip select is not
-         * one of the port qs pins.
-         */
-        if (command & QSPI_CS_INIT) {
-#if defined(CONFIG_WILDFIRE)
-                MCF5282_GPIO_DDRQS  |= cs_bit;
-                MCF5282_GPIO_PQSPAR &= ~cs_bit;
-#endif
-
-#if defined(CONFIG_WILDFIREMOD)
-                MCF5282_GPIO_DDRQS  |= SPI_CS_MASK;
-                MCF5282_GPIO_PQSPAR &= ~SPI_CS_MASK;
-#endif
-        }
-
-        if (command & QSPI_CS_ASSERT) {
-                MCF5282_GPIO_PORTQS &= ~SPI_CS_MASK;
-                MCF5282_GPIO_PORTQS |= cs_mask;
-        } else if (command & QSPI_CS_DROP) {
-                MCF5282_GPIO_PORTQS |= SPI_CS_MASK;
-        }
-}
-
-static int __init spi_dev_init(void)
-{
-        int retval;
-
-        retval = platform_device_register(&coldfire_spi);
-        if (retval < 0)
-                return retval;
-
-        if (ARRAY_SIZE(spi_board_info))
-                retval = spi_register_board_info(spi_board_info, ARRAY_SIZE(spi_board_info));
-
-        return retval;
-}
-
-#endif /* CONFIG_SPI */
 
 /***************************************************************************/
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 600eef3f3ac7..e61465a18c7e 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -603,7 +603,7 @@ config CAVIUM_OCTEON_SIMULATOR
         select SYS_SUPPORTS_64BIT_KERNEL
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_HIGHMEM
-        select CPU_CAVIUM_OCTEON
+        select SYS_HAS_CPU_CAVIUM_OCTEON
         help
           The Octeon simulator is software performance model of the Cavium
           Octeon Processor. It supports simulating Octeon processors on x86
@@ -618,7 +618,7 @@ config CAVIUM_OCTEON_REFERENCE_BOARD
         select SYS_SUPPORTS_BIG_ENDIAN
         select SYS_SUPPORTS_HIGHMEM
         select SYS_HAS_EARLY_PRINTK
-        select CPU_CAVIUM_OCTEON
+        select SYS_HAS_CPU_CAVIUM_OCTEON
         select SWAP_IO_SPACE
         help
           This option supports all of the Octeon reference boards from Cavium
@@ -1234,6 +1234,7 @@ config CPU_SB1
 
 config CPU_CAVIUM_OCTEON
         bool "Cavium Octeon processor"
+        depends on SYS_HAS_CPU_CAVIUM_OCTEON
         select IRQ_CPU
         select IRQ_CPU_OCTEON
         select CPU_HAS_PREFETCH
@@ -1314,6 +1315,9 @@ config SYS_HAS_CPU_RM9000
 config SYS_HAS_CPU_SB1
         bool
 
+config SYS_HAS_CPU_CAVIUM_OCTEON
+        bool
+
 #
 # CPU may reorder R->R, R->W, W->R, W->W
 # Reordering beyond LL and SC is handled in WEAK_REORDERING_BEYOND_LLSC
@@ -1387,6 +1391,7 @@ config 32BIT
 config 64BIT
         bool "64-bit kernel"
         depends on CPU_SUPPORTS_64BIT_KERNEL && SYS_SUPPORTS_64BIT_KERNEL
+        select HAVE_SYSCALL_WRAPPERS
         help
           Select this option if you want to build a 64-bit kernel.
 
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 6fd441d16af5..f58d4ffb8945 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -118,7 +118,7 @@ void __init plat_time_init(void)
          * setup counter 1 (RTC) to tick at full speed
          */
         t = 0xffffff;
-        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T1S) && t--)
+        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T1S) && --t)
                 asm volatile ("nop");
         if (!t)
                 goto cntr_err;
@@ -127,7 +127,7 @@ void __init plat_time_init(void)
         au_sync();
 
         t = 0xffffff;
-        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_C1S) && t--)
+        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_C1S) && --t)
                 asm volatile ("nop");
         if (!t)
                 goto cntr_err;
@@ -135,7 +135,7 @@ void __init plat_time_init(void)
         au_sync();
 
         t = 0xffffff;
-        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_C1S) && t--)
+        while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_C1S) && --t)
                 asm volatile ("nop");
         if (!t)
                 goto cntr_err;
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index f2baea3039bb..0208723adf28 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -512,7 +512,7 @@ CONFIG_MD_LINEAR=m
 CONFIG_MD_RAID0=y
 CONFIG_MD_RAID1=y
 CONFIG_MD_RAID10=m
-CONFIG_MD_RAID456=m
+CONFIG_MD_RAID456=y
 CONFIG_MD_RAID5_RESHAPE=y
 CONFIG_MD_MULTIPATH=m
 CONFIG_MD_FAULTY=m
diff --git a/arch/mips/configs/jmr3927_defconfig b/arch/mips/configs/jmr3927_defconfig
index 9d5bd2a0af3d..5380f1f582d9 100644
--- a/arch/mips/configs/jmr3927_defconfig
+++ b/arch/mips/configs/jmr3927_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc9
-# Fri Jul 11 23:01:36 2008
+# Linux kernel version: 2.6.29-rc7
+# Wed Mar  4 23:07:16 2009
 #
 CONFIG_MIPS=y
 
@@ -18,8 +18,10 @@ CONFIG_MIPS=y
 # CONFIG_LEMOTE_FULONG is not set
 # CONFIG_MIPS_MALTA is not set
 # CONFIG_MIPS_SIM is not set
-# CONFIG_MARKEINS is not set
+# CONFIG_MACH_EMMA is not set
 # CONFIG_MACH_VR41XX is not set
+# CONFIG_NXP_STB220 is not set
+# CONFIG_NXP_STB225 is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_PMC_MSP is not set
@@ -39,7 +41,11 @@ CONFIG_MIPS=y
 # CONFIG_SNI_RM is not set
 CONFIG_MACH_TX39XX=y
 # CONFIG_MACH_TX49XX is not set
+# CONFIG_MIKROTIK_RB532 is not set
 # CONFIG_WR_PPMC is not set
+# CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
+# CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
+CONFIG_MACH_TXX9=y
 CONFIG_TOSHIBA_JMR3927=y
 CONFIG_SOC_TX3927=y
 # CONFIG_TOSHIBA_FPCIB0 is not set
@@ -54,12 +60,14 @@ CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CMOS_UPDATE=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_CEVT_TXX9=y
 CONFIG_GPIO_TXX9=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
 # CONFIG_HOTPLUG_CPU is not set
 # CONFIG_NO_IOPORT is not set
 CONFIG_GENERIC_GPIO=y
@@ -87,6 +95,7 @@ CONFIG_CPU_TX39XX=y
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
+# CONFIG_CPU_R5500 is not set
 # CONFIG_CPU_R6000 is not set
 # CONFIG_CPU_NEVADA is not set
 # CONFIG_CPU_R8000 is not set
@@ -94,6 +103,7 @@ CONFIG_CPU_TX39XX=y
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
+# CONFIG_CPU_CAVIUM_OCTEON is not set
 CONFIG_SYS_HAS_CPU_TX39XX=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
 CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
@@ -117,14 +127,12 @@ CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
-# CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
-# CONFIG_RESOURCES_64BIT is not set
+# CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-# CONFIG_TICK_ONESHOT is not set
+CONFIG_UNEVICTABLE_LRU=y
 # CONFIG_NO_HZ is not set
 # CONFIG_HIGH_RES_TIMERS is not set
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
@@ -159,6 +167,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
@@ -171,7 +188,6 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 # CONFIG_HOTPLUG is not set
@@ -188,26 +204,23 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
+CONFIG_AIO=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
-# CONFIG_HAVE_KPROBES is not set
-# CONFIG_HAVE_KRETPROBES is not set
-# CONFIG_HAVE_DMA_ATTRS is not set
-CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_MODULES is not set
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
 
 #
 # IO Schedulers
@@ -221,7 +234,7 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
-CONFIG_CLASSIC_RCU=y
+# CONFIG_FREEZER is not set
 
 #
 # Bus options (PCI, PCMCIA, EISA, ISA, TC)
@@ -231,12 +244,15 @@ CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 CONFIG_PCI_LEGACY=y
+# CONFIG_PCI_STUB is not set
 CONFIG_MMU=y
 
 #
 # Executable file formats
 #
 CONFIG_BINFMT_ELF=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
 CONFIG_TRAD_SIGNALS=y
 
@@ -245,15 +261,12 @@ CONFIG_TRAD_SIGNALS=y
 #
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_PM is not set
-
-#
-# Networking
-#
 CONFIG_NET=y
 
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -293,6 +306,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -302,14 +316,9 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
-
-#
-# Wireless
-#
-# CONFIG_CFG80211 is not set
-# CONFIG_WIRELESS_EXT is not set
-# CONFIG_MAC80211 is not set
-# CONFIG_IEEE80211 is not set
+# CONFIG_PHONET is not set
+# CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 
 #
@@ -323,7 +332,89 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
-# CONFIG_MTD is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+# CONFIG_MTD_CONCAT is not set
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_REDBOOT_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
+
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+# CONFIG_MTD_BLKDEVS is not set
+# CONFIG_MTD_BLOCK is not set
+# CONFIG_MTD_BLOCK_RO is not set
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
+
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+# CONFIG_MTD_INTEL_VR_NOR is not set
+# CONFIG_MTD_PLATRAM is not set
+
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_ONENAND is not set
+
+#
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+
+#
+# UBI - Unsorted block images
+#
+# CONFIG_MTD_UBI is not set
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_CPQ_DA is not set
@@ -336,6 +427,7 @@ CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_RAM is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_HD is not set
 # CONFIG_MISC_DEVICES is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
@@ -361,7 +453,6 @@ CONFIG_HAVE_IDE=y
 # CONFIG_IEEE1394 is not set
 # CONFIG_I2O is not set
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
@@ -383,6 +474,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -392,6 +486,7 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_SUNGEM is not set
 # CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_SMC91X is not set
 # CONFIG_DM9000 is not set
 # CONFIG_NET_TULIP is not set
 # CONFIG_HP100 is not set
@@ -399,6 +494,9 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 CONFIG_NET_PCI=y
 # CONFIG_PCNET32 is not set
 # CONFIG_AMD8111_ETH is not set
@@ -406,7 +504,6 @@ CONFIG_NET_PCI=y
 # CONFIG_B44 is not set
 # CONFIG_FORCEDETH is not set
 CONFIG_TC35815=y
-# CONFIG_EEPRO100 is not set
 # CONFIG_E100 is not set
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
@@ -415,9 +512,11 @@ CONFIG_TC35815=y
 # CONFIG_R6040 is not set
 # CONFIG_SIS900 is not set
 # CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
 # CONFIG_SUNDANCE is not set
 # CONFIG_TLAN is not set
 # CONFIG_VIA_RHINE is not set
+# CONFIG_ATL2 is not set
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
 # CONFIG_TR is not set
@@ -428,6 +527,10 @@ CONFIG_TC35815=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_PPP is not set
@@ -440,27 +543,7 @@ CONFIG_TC35815=y
 #
 # Input device support
 #
-CONFIG_INPUT=y
-# CONFIG_INPUT_FF_MEMLESS is not set
-# CONFIG_INPUT_POLLDEV is not set
-
-#
-# Userland interfaces
-#
-# CONFIG_INPUT_MOUSEDEV is not set
-# CONFIG_INPUT_JOYDEV is not set
-# CONFIG_INPUT_EVDEV is not set
-# CONFIG_INPUT_EVBUG is not set
-
-#
-# Input Device Drivers
-#
-# CONFIG_INPUT_KEYBOARD is not set
-# CONFIG_INPUT_MOUSE is not set
-# CONFIG_INPUT_JOYSTICK is not set
-# CONFIG_INPUT_TABLET is not set
-# CONFIG_INPUT_TOUCHSCREEN is not set
-# CONFIG_INPUT_MISC is not set
+# CONFIG_INPUT is not set
 
 #
 # Hardware I/O ports
@@ -517,10 +600,11 @@ CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_DEVPORT=y
 # CONFIG_I2C is not set
 # CONFIG_SPI is not set
-CONFIG_HAVE_GPIO_LIB=y
+CONFIG_ARCH_REQUIRE_GPIOLIB=y
+CONFIG_GPIOLIB=y
 
 #
-# GPIO Support
+# Memory mapped GPIO expanders:
 #
 
 #
@@ -528,6 +612,11 @@ CONFIG_HAVE_GPIO_LIB=y
 #
 
 #
+# PCI GPIO expanders:
+#
+# CONFIG_GPIO_BT8XX is not set
+
+#
 # SPI GPIO expanders:
 #
 # CONFIG_W1 is not set
@@ -542,6 +631,7 @@ CONFIG_WATCHDOG=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_ALIM7101_WDT is not set
 CONFIG_TXX9_WDT=y
 
 #
@@ -549,18 +639,21 @@ CONFIG_TXX9_WDT=y
 #
 # CONFIG_PCIPCWATCHDOG is not set
 # CONFIG_WDTPCI is not set
+CONFIG_SSB_POSSIBLE=y
 
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
 # CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
@@ -591,16 +684,26 @@ CONFIG_SSB_POSSIBLE=y
 # Display device support
 #
 # CONFIG_DISPLAY_SUPPORT is not set
-
-#
-# Sound
-#
 # CONFIG_SOUND is not set
-# CONFIG_HID_SUPPORT is not set
 # CONFIG_USB_SUPPORT is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
-# CONFIG_NEW_LEDS is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+
+#
+# LED drivers
+#
+CONFIG_LEDS_GPIO=y
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
 CONFIG_RTC_LIB=y
@@ -626,27 +729,34 @@ CONFIG_RTC_INTF_DEV=y
 # Platform RTC drivers
 #
 # CONFIG_RTC_DRV_CMOS is not set
+# CONFIG_RTC_DRV_DS1286 is not set
 # CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
 CONFIG_RTC_DRV_DS1742=y
 # CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
 # CONFIG_RTC_DRV_V3020 is not set
 
 #
 # on-CPU RTC drivers
 #
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
+# CONFIG_STAGING is not set
 
 #
 # File systems
 #
 # CONFIG_EXT2_FS is not set
 # CONFIG_EXT3_FS is not set
+# CONFIG_EXT4_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
+CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
 CONFIG_DNOTIFY=y
@@ -676,28 +786,17 @@ CONFIG_INOTIFY_USER=y
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
 # CONFIG_TMPFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
-# CONFIG_HFSPLUS_FS is not set
-# CONFIG_CRAMFS is not set
-# CONFIG_VXFS_FS is not set
-# CONFIG_MINIX_FS is not set
-# CONFIG_HPFS_FS is not set
-# CONFIG_QNX4FS_FS is not set
-# CONFIG_ROMFS_FS is not set
-# CONFIG_SYSV_FS is not set
-# CONFIG_UFS_FS is not set
+# CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NETWORK_FILESYSTEMS=y
 CONFIG_NFS_FS=y
 # CONFIG_NFS_V3 is not set
-# CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
+# CONFIG_NFSD is not set
 CONFIG_LOCKD=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
@@ -726,7 +825,16 @@ CONFIG_FRAME_WARN=1024
 # CONFIG_DEBUG_FS is not set
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+
+#
+# Tracers
+#
+# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_CMDLINE=""
 
 #
@@ -734,15 +842,18 @@ CONFIG_CMDLINE=""
 #
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
 # CONFIG_CRYPTO is not set
 
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
-# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
+# CONFIG_CRC_T10DIF is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/mips/configs/rbtx49xx_defconfig b/arch/mips/configs/rbtx49xx_defconfig
index 83d5c58662c8..1efe977497dd 100644
--- a/arch/mips/configs/rbtx49xx_defconfig
+++ b/arch/mips/configs/rbtx49xx_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc9
-# Fri Jul 11 23:03:21 2008
+# Linux kernel version: 2.6.29-rc7
+# Wed Mar  4 23:08:06 2009
 #
 CONFIG_MIPS=y
 
@@ -18,8 +18,10 @@ CONFIG_MIPS=y
 # CONFIG_LEMOTE_FULONG is not set
 # CONFIG_MIPS_MALTA is not set
 # CONFIG_MIPS_SIM is not set
-# CONFIG_MARKEINS is not set
+# CONFIG_MACH_EMMA is not set
 # CONFIG_MACH_VR41XX is not set
+# CONFIG_NXP_STB220 is not set
+# CONFIG_NXP_STB225 is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_PMC_MSP is not set
@@ -39,20 +41,28 @@ CONFIG_MIPS=y
 # CONFIG_SNI_RM is not set
 # CONFIG_MACH_TX39XX is not set
 CONFIG_MACH_TX49XX=y
+# CONFIG_MIKROTIK_RB532 is not set
 # CONFIG_WR_PPMC is not set
+# CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
+# CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
+CONFIG_MACH_TXX9=y
 CONFIG_TOSHIBA_RBTX4927=y
 CONFIG_TOSHIBA_RBTX4938=y
+CONFIG_TOSHIBA_RBTX4939=y
 CONFIG_SOC_TX4927=y
 CONFIG_SOC_TX4938=y
+CONFIG_SOC_TX4939=y
+CONFIG_TXX9_7SEGLED=y
 # CONFIG_TOSHIBA_FPCIB0 is not set
 CONFIG_PICMG_PCI_BACKPLANE_DEFAULT=y
 
 #
 # Multiplex Pin Select
 #
-CONFIG_TOSHIBA_RBTX4938_MPLEX_PIO58_61=y
+# CONFIG_TOSHIBA_RBTX4938_MPLEX_PIO58_61 is not set
 # CONFIG_TOSHIBA_RBTX4938_MPLEX_NAND is not set
 # CONFIG_TOSHIBA_RBTX4938_MPLEX_ATA is not set
+CONFIG_TOSHIBA_RBTX4938_MPLEX_KEEP=y
 CONFIG_PCI_TX4927=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
@@ -64,14 +74,18 @@ CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CMOS_UPDATE=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
+CONFIG_CEVT_R4K_LIB=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_TXX9=y
+CONFIG_CSRC_R4K_LIB=y
 CONFIG_CSRC_R4K=y
 CONFIG_GPIO_TXX9=y
 CONFIG_DMA_NONCOHERENT=y
 CONFIG_DMA_NEED_PCI_MAP_STATE=y
+CONFIG_EARLY_PRINTK=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
 # CONFIG_HOTPLUG_CPU is not set
 # CONFIG_NO_IOPORT is not set
 CONFIG_GENERIC_GPIO=y
@@ -100,6 +114,7 @@ CONFIG_MIPS_L1_CACHE_SHIFT=5
 CONFIG_CPU_TX49XX=y
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
+# CONFIG_CPU_R5500 is not set
 # CONFIG_CPU_R6000 is not set
 # CONFIG_CPU_NEVADA is not set
 # CONFIG_CPU_R8000 is not set
@@ -107,6 +122,7 @@ CONFIG_CPU_TX49XX=y
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 # CONFIG_CPU_SB1 is not set
+# CONFIG_CPU_CAVIUM_OCTEON is not set
 CONFIG_SYS_HAS_CPU_TX49XX=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
 CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
@@ -134,13 +150,12 @@ CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
-# CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
-# CONFIG_RESOURCES_64BIT is not set
+# CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
+CONFIG_UNEVICTABLE_LRU=y
 CONFIG_TICK_ONESHOT=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -176,6 +191,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -190,7 +214,6 @@ CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_SYSCTL=y
 CONFIG_EMBEDDED=y
 CONFIG_SYSCTL_SYSCALL=y
-CONFIG_SYSCTL_SYSCALL_CHECK=y
 CONFIG_KALLSYMS=y
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 # CONFIG_HOTPLUG is not set
@@ -207,30 +230,26 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
+CONFIG_AIO=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
-# CONFIG_HAVE_KPROBES is not set
-# CONFIG_HAVE_KRETPROBES is not set
-# CONFIG_HAVE_DMA_ATTRS is not set
-CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
-# CONFIG_MODULE_UNLOAD is not set
+CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
 
 #
 # IO Schedulers
@@ -244,7 +263,8 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
+# CONFIG_PROBE_INITRD_HEADER is not set
+# CONFIG_FREEZER is not set
 
 #
 # Bus options (PCI, PCMCIA, EISA, ISA, TC)
@@ -254,12 +274,15 @@ CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 # CONFIG_PCI_LEGACY is not set
+# CONFIG_PCI_STUB is not set
 CONFIG_MMU=y
 
 #
 # Executable file formats
 #
 CONFIG_BINFMT_ELF=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
 CONFIG_TRAD_SIGNALS=y
 
@@ -268,15 +291,12 @@ CONFIG_TRAD_SIGNALS=y
 #
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_PM is not set
-
-#
-# Networking
-#
 CONFIG_NET=y
 
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -318,6 +338,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -327,14 +348,9 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
-
-#
-# Wireless
-#
-# CONFIG_CFG80211 is not set
-# CONFIG_WIRELESS_EXT is not set
-# CONFIG_MAC80211 is not set
-# CONFIG_IEEE80211 is not set
+# CONFIG_PHONET is not set
+# CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 
 #
@@ -348,7 +364,90 @@ CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
-# CONFIG_MTD is not set
+CONFIG_MTD=y
+# CONFIG_MTD_DEBUG is not set
+# CONFIG_MTD_CONCAT is not set
+CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
+# CONFIG_MTD_REDBOOT_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+# CONFIG_MTD_AR7_PARTS is not set
+
+#
+# User Modules And Translation Layers
+#
+CONFIG_MTD_CHAR=y
+# CONFIG_MTD_BLKDEVS is not set
+# CONFIG_MTD_BLOCK is not set
+# CONFIG_MTD_BLOCK_RO is not set
+# CONFIG_FTL is not set
+# CONFIG_NFTL is not set
+# CONFIG_INFTL is not set
+# CONFIG_RFD_FTL is not set
+# CONFIG_SSFDC is not set
+# CONFIG_MTD_OOPS is not set
+
+#
+# RAM/ROM/Flash chip drivers
+#
+CONFIG_MTD_CFI=y
+CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_GEN_PROBE=y
+# CONFIG_MTD_CFI_ADV_OPTIONS is not set
+CONFIG_MTD_MAP_BANK_WIDTH_1=y
+CONFIG_MTD_MAP_BANK_WIDTH_2=y
+CONFIG_MTD_MAP_BANK_WIDTH_4=y
+# CONFIG_MTD_MAP_BANK_WIDTH_8 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_16 is not set
+# CONFIG_MTD_MAP_BANK_WIDTH_32 is not set
+CONFIG_MTD_CFI_I1=y
+CONFIG_MTD_CFI_I2=y
+# CONFIG_MTD_CFI_I4 is not set
+# CONFIG_MTD_CFI_I8 is not set
+# CONFIG_MTD_CFI_INTELEXT is not set
+CONFIG_MTD_CFI_AMDSTD=y
+# CONFIG_MTD_CFI_STAA is not set
+CONFIG_MTD_CFI_UTIL=y
+# CONFIG_MTD_RAM is not set
+# CONFIG_MTD_ROM is not set
+# CONFIG_MTD_ABSENT is not set
+
+#
+# Mapping drivers for chip access
+#
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_MTD_PHYSMAP=y
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
+# CONFIG_MTD_INTEL_VR_NOR is not set
+# CONFIG_MTD_PLATRAM is not set
+
+#
+# Self-contained MTD device drivers
+#
+# CONFIG_MTD_PMC551 is not set
+# CONFIG_MTD_SLRAM is not set
+# CONFIG_MTD_PHRAM is not set
+# CONFIG_MTD_MTDRAM is not set
+# CONFIG_MTD_BLOCK2MTD is not set
+
+#
+# Disk-On-Chip Device Drivers
+#
+# CONFIG_MTD_DOC2000 is not set
+# CONFIG_MTD_DOC2001 is not set
+# CONFIG_MTD_DOC2001PLUS is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_MTD_ONENAND is not set
+
+#
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+
+#
+# UBI - Unsorted block images
+#
+# CONFIG_MTD_UBI is not set
 # CONFIG_PARPORT is not set
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_CPQ_DA is not set
@@ -365,9 +464,60 @@ CONFIG_BLK_DEV_RAM_SIZE=8192
 # CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_HD is not set
 # CONFIG_MISC_DEVICES is not set
 CONFIG_HAVE_IDE=y
-# CONFIG_IDE is not set
+CONFIG_IDE=y
+
+#
+# Please see Documentation/ide/ide.txt for help/info on IDE drives
+#
+CONFIG_IDE_TIMINGS=y
+# CONFIG_BLK_DEV_IDE_SATA is not set
+CONFIG_IDE_GD=y
+CONFIG_IDE_GD_ATA=y
+# CONFIG_IDE_GD_ATAPI is not set
+# CONFIG_BLK_DEV_IDECD is not set
+# CONFIG_BLK_DEV_IDETAPE is not set
+# CONFIG_IDE_TASK_IOCTL is not set
+CONFIG_IDE_PROC_FS=y
+
+#
+# IDE chipset support/bugfixes
+#
+# CONFIG_IDE_GENERIC is not set
+# CONFIG_BLK_DEV_PLATFORM is not set
+CONFIG_BLK_DEV_IDEDMA_SFF=y
+
+#
+# PCI IDE chipsets support
+#
+# CONFIG_BLK_DEV_GENERIC is not set
+# CONFIG_BLK_DEV_AEC62XX is not set
+# CONFIG_BLK_DEV_ALI15X3 is not set
+# CONFIG_BLK_DEV_AMD74XX is not set
+# CONFIG_BLK_DEV_CMD64X is not set
+# CONFIG_BLK_DEV_TRIFLEX is not set
+# CONFIG_BLK_DEV_CS5530 is not set
+# CONFIG_BLK_DEV_HPT366 is not set
+# CONFIG_BLK_DEV_JMICRON is not set
+# CONFIG_BLK_DEV_SC1200 is not set
+# CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT8172 is not set
+# CONFIG_BLK_DEV_IT8213 is not set
+# CONFIG_BLK_DEV_IT821X is not set
+# CONFIG_BLK_DEV_NS87415 is not set
+# CONFIG_BLK_DEV_PDC202XX_OLD is not set
+# CONFIG_BLK_DEV_PDC202XX_NEW is not set
+# CONFIG_BLK_DEV_SVWKS is not set
+# CONFIG_BLK_DEV_SIIMAGE is not set
+# CONFIG_BLK_DEV_SLC90E66 is not set
+# CONFIG_BLK_DEV_TRM290 is not set
+# CONFIG_BLK_DEV_VIA82CXXX is not set
+# CONFIG_BLK_DEV_TC86C001 is not set
+CONFIG_BLK_DEV_IDE_TX4938=y
+CONFIG_BLK_DEV_IDE_TX4939=y
+CONFIG_BLK_DEV_IDEDMA=y
 
 #
 # SCSI device support
@@ -390,7 +540,6 @@ CONFIG_HAVE_IDE=y
 # CONFIG_IEEE1394 is not set
 # CONFIG_I2O is not set
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_EQUALIZER is not set
@@ -412,15 +561,19 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
-# CONFIG_MII is not set
+CONFIG_MII=y
 # CONFIG_AX88796 is not set
 # CONFIG_HAPPYMEAL is not set
 # CONFIG_SUNGEM is not set
 # CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
+CONFIG_SMC91X=y
 # CONFIG_DM9000 is not set
 # CONFIG_NET_TULIP is not set
 # CONFIG_HP100 is not set
@@ -429,6 +582,9 @@ CONFIG_NE2000=y
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 CONFIG_NET_PCI=y
 # CONFIG_PCNET32 is not set
 # CONFIG_AMD8111_ETH is not set
@@ -436,7 +592,6 @@ CONFIG_NET_PCI=y
 # CONFIG_B44 is not set
 # CONFIG_FORCEDETH is not set
 CONFIG_TC35815=y
-# CONFIG_EEPRO100 is not set
 # CONFIG_E100 is not set
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
@@ -445,9 +600,11 @@ CONFIG_TC35815=y
 # CONFIG_R6040 is not set
 # CONFIG_SIS900 is not set
 # CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
 # CONFIG_SUNDANCE is not set
 # CONFIG_TLAN is not set
 # CONFIG_VIA_RHINE is not set
+# CONFIG_ATL2 is not set
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
 # CONFIG_TR is not set
@@ -458,6 +615,10 @@ CONFIG_TC35815=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_PPP is not set
@@ -502,6 +663,7 @@ CONFIG_SERIAL_TXX9_CONSOLE=y
 CONFIG_SERIAL_TXX9_STDSERIAL=y
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_IPMI_HANDLER is not set
@@ -517,17 +679,19 @@ CONFIG_SPI_MASTER=y
 #
 # SPI Master Controller Drivers
 #
+# CONFIG_SPI_BITBANG is not set
+# CONFIG_SPI_GPIO is not set
 CONFIG_SPI_TXX9=y
 
 #
 # SPI Protocol Masters
 #
-CONFIG_EEPROM_AT25=y
 # CONFIG_SPI_TLE62X0 is not set
-CONFIG_HAVE_GPIO_LIB=y
+CONFIG_ARCH_REQUIRE_GPIOLIB=y
+CONFIG_GPIOLIB=y
 
 #
-# GPIO Support
+# Memory mapped GPIO expanders:
 #
 
 #
@@ -535,8 +699,14 @@ CONFIG_HAVE_GPIO_LIB=y
 #
 
 #
+# PCI GPIO expanders:
+#
+# CONFIG_GPIO_BT8XX is not set
+
+#
 # SPI GPIO expanders:
 #
+# CONFIG_GPIO_MAX7301 is not set
 # CONFIG_GPIO_MCP23S08 is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
@@ -550,6 +720,7 @@ CONFIG_WATCHDOG=y
 # Watchdog Device Drivers
 #
 # CONFIG_SOFT_WATCHDOG is not set
+# CONFIG_ALIM7101_WDT is not set
 CONFIG_TXX9_WDT=m
 
 #
@@ -557,18 +728,21 @@ CONFIG_TXX9_WDT=m
 #
 # CONFIG_PCIPCWATCHDOG is not set
 # CONFIG_WDTPCI is not set
+CONFIG_SSB_POSSIBLE=y
 
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
 # CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
@@ -599,15 +773,27 @@ CONFIG_SSB_POSSIBLE=y
 # Display device support
 #
 # CONFIG_DISPLAY_SUPPORT is not set
-
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 # CONFIG_USB_SUPPORT is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
-# CONFIG_NEW_LEDS is not set
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+
+#
+# LED drivers
+#
+CONFIG_LEDS_GPIO=y
+
+#
+# LED Triggers
+#
+CONFIG_LEDS_TRIGGERS=y
+# CONFIG_LEDS_TRIGGER_TIMER is not set
+CONFIG_LEDS_TRIGGER_IDE_DISK=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
+# CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
 CONFIG_RTC_LIB=y
@@ -628,35 +814,47 @@ CONFIG_RTC_INTF_DEV_UIE_EMUL=y
 #
 # SPI RTC drivers
 #
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
 # CONFIG_RTC_DRV_R9701 is not set
 CONFIG_RTC_DRV_RS5C348=y
+# CONFIG_RTC_DRV_DS3234 is not set
 
 #
 # Platform RTC drivers
 #
 # CONFIG_RTC_DRV_CMOS is not set
+# CONFIG_RTC_DRV_DS1286 is not set
 # CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
 CONFIG_RTC_DRV_DS1742=y
 # CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
 # CONFIG_RTC_DRV_V3020 is not set
 
 #
 # on-CPU RTC drivers
 #
+CONFIG_RTC_DRV_TX4939=y
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
+# CONFIG_STAGING is not set
 
 #
 # File systems
 #
 # CONFIG_EXT2_FS is not set
 # CONFIG_EXT3_FS is not set
+# CONFIG_EXT4_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
+CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
 # CONFIG_DNOTIFY is not set
@@ -687,30 +885,19 @@ CONFIG_GENERIC_ACL=y
 CONFIG_PROC_FS=y
 # CONFIG_PROC_KCORE is not set
 CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
-# CONFIG_HFSPLUS_FS is not set
-# CONFIG_CRAMFS is not set
-# CONFIG_VXFS_FS is not set
-# CONFIG_MINIX_FS is not set
-# CONFIG_HPFS_FS is not set
-# CONFIG_QNX4FS_FS is not set
-# CONFIG_ROMFS_FS is not set
-# CONFIG_SYSV_FS is not set
-# CONFIG_UFS_FS is not set
+# CONFIG_MISC_FILESYSTEMS is not set
 CONFIG_NETWORK_FILESYSTEMS=y
 CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
-# CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
+# CONFIG_NFSD is not set
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_NFS_COMMON=y
@@ -740,7 +927,16 @@ CONFIG_FRAME_WARN=1024
 CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
 # CONFIG_DEBUG_KERNEL is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+CONFIG_SYSCTL_SYSCALL_CHECK=y
+
+#
+# Tracers
+#
+# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_CMDLINE=""
 
 #
@@ -748,15 +944,18 @@ CONFIG_CMDLINE=""
 #
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
+# CONFIG_SECURITYFS is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
 # CONFIG_CRYPTO is not set
 
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
-# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
+# CONFIG_CRC_T10DIF is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h
index ac5d541368e9..6c5b40905dd6 100644
--- a/arch/mips/include/asm/compat.h
+++ b/arch/mips/include/asm/compat.h
@@ -3,6 +3,8 @@
 /*
  * Architecture specific compatibility types
  */
+#include <linux/seccomp.h>
+#include <linux/thread_info.h>
 #include <linux/types.h>
 #include <asm/page.h>
 #include <asm/ptrace.h>
@@ -218,4 +220,9 @@ struct compat_shmid64_ds {
         compat_ulong_t  __unused2;
 };
 
+static inline int is_compat_task(void)
+{
+        return test_thread_flag(TIF_32BIT);
+}
+
 #endif /* _ASM_COMPAT_H */
diff --git a/arch/mips/include/asm/hazards.h b/arch/mips/include/asm/hazards.h
index 43baed16a109..134e1fc8f4d6 100644
--- a/arch/mips/include/asm/hazards.h
+++ b/arch/mips/include/asm/hazards.h
@@ -138,7 +138,8 @@ do {									\
                 __instruction_hazard();                                 \
 } while (0)
 
-#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_CAVIUM_OCTEON)
+#elif defined(CONFIG_CPU_R10000) || defined(CONFIG_CPU_CAVIUM_OCTEON) || \
+      defined(CONFIG_CPU_R5500)
 
 /*
  * R10000 rocks - all hazards handled in hardware, so this becomes a nobrainer.
diff --git a/arch/mips/include/asm/prefetch.h b/arch/mips/include/asm/prefetch.h
index 17850834ccb0..a56594f360ee 100644
--- a/arch/mips/include/asm/prefetch.h
+++ b/arch/mips/include/asm/prefetch.h
@@ -26,7 +26,7 @@
  * Pref_WriteBackInvalidate is a nop and Pref_PrepareForStore is broken in
  * current versions due to erratum G105.
  *
- * VR7701 only implements the Load prefetch.
+ * VR5500 (including VR5701 and VR7701) only implement load prefetch.
  *
  * Finally MIPS32 and MIPS64 implement all of the following hints.
  */
diff --git a/arch/mips/include/asm/seccomp.h b/arch/mips/include/asm/seccomp.h
index 36ed44070256..a6772e9507f5 100644
--- a/arch/mips/include/asm/seccomp.h
+++ b/arch/mips/include/asm/seccomp.h
@@ -1,6 +1,5 @@
 #ifndef __ASM_SECCOMP_H
 
-#include <linux/thread_info.h>
 #include <linux/unistd.h>
 
 #define __NR_seccomp_read __NR_read
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index a7162a4484cf..1bdbcad3bb74 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -149,6 +149,7 @@ void __init check_wait(void)
         case CPU_R4650:
         case CPU_R4700:
         case CPU_R5000:
+        case CPU_R5500:
         case CPU_NEVADA:
         case CPU_4KC:
         case CPU_4KEC:
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
index a0ff2b66e22b..4b4007b3083a 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
@@ -111,7 +111,6 @@ int show_interrupts(struct seq_file *p, void *v)
                         seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
 #endif
                 seq_printf(p, " %14s", irq_desc[i].chip->name);
-                seq_printf(p, "-%-8s", irq_desc[i].name);
                 seq_printf(p, "  %s", action->name);
 
                 for (action=action->next; action; action = action->next)
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index aa2c55e3b55f..1a86f84fa947 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -32,6 +32,7 @@
 #include <linux/module.h>
 #include <linux/binfmts.h>
 #include <linux/security.h>
+#include <linux/syscalls.h>
 #include <linux/compat.h>
 #include <linux/vfs.h>
 #include <linux/ipc.h>
@@ -63,9 +64,9 @@
 #define merge_64(r1, r2) ((((r2) & 0xffffffffUL) << 32) + ((r1) & 0xffffffffUL))
 #endif
 
-asmlinkage unsigned long
-sys32_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
-         unsigned long flags, unsigned long fd, unsigned long pgoff)
+SYSCALL_DEFINE6(32_mmap2, unsigned long, addr, unsigned long, len,
+        unsigned long, prot, unsigned long, flags, unsigned long, fd,
+        unsigned long, pgoff)
 {
         struct file * file = NULL;
         unsigned long error;
@@ -121,21 +122,21 @@ struct rlimit32 {
         int     rlim_max;
 };
 
-asmlinkage long sys32_truncate64(const char __user * path,
-        unsigned long __dummy, int a2, int a3)
+SYSCALL_DEFINE4(32_truncate64, const char __user *, path,
+        unsigned long, __dummy, unsigned long, a2, unsigned long, a3)
 {
         return sys_truncate(path, merge_64(a2, a3));
 }
 
-asmlinkage long sys32_ftruncate64(unsigned int fd, unsigned long __dummy,
-        int a2, int a3)
+SYSCALL_DEFINE4(32_ftruncate64, unsigned long, fd, unsigned long, __dummy,
+        unsigned long, a2, unsigned long, a3)
 {
         return sys_ftruncate(fd, merge_64(a2, a3));
 }
 
-asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high,
-                            unsigned int offset_low, loff_t __user * result,
-                            unsigned int origin)
+SYSCALL_DEFINE5(32_llseek, unsigned long, fd, unsigned long, offset_high,
+        unsigned long, offset_low, loff_t __user *, result,
+        unsigned long, origin)
 {
         return sys_llseek(fd, offset_high, offset_low, result, origin);
 }
@@ -144,20 +145,20 @@ asmlinkage int sys32_llseek(unsigned int fd, unsigned int offset_high,
    lseek back to original location.  They fail just like lseek does on
    non-seekable files.  */
 
-asmlinkage ssize_t sys32_pread(unsigned int fd, char __user * buf,
-                               size_t count, u32 unused, u64 a4, u64 a5)
+SYSCALL_DEFINE6(32_pread, unsigned long, fd, char __user *, buf, size_t, count,
+        unsigned long, unused, unsigned long, a4, unsigned long, a5)
 {
         return sys_pread64(fd, buf, count, merge_64(a4, a5));
 }
 
-asmlinkage ssize_t sys32_pwrite(unsigned int fd, const char __user * buf,
-                                size_t count, u32 unused, u64 a4, u64 a5)
+SYSCALL_DEFINE6(32_pwrite, unsigned int, fd, const char __user *, buf,
+        size_t, count, u32, unused, u64, a4, u64, a5)
 {
         return sys_pwrite64(fd, buf, count, merge_64(a4, a5));
 }
 
-asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
-        struct compat_timespec __user *interval)
+SYSCALL_DEFINE2(32_sched_rr_get_interval, compat_pid_t, pid,
+        struct compat_timespec __user *, interval)
 {
         struct timespec t;
         int ret;
@@ -174,8 +175,8 @@ asmlinkage int sys32_sched_rr_get_interval(compat_pid_t pid,
 
 #ifdef CONFIG_SYSVIPC
 
-asmlinkage long
-sys32_ipc(u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+SYSCALL_DEFINE6(32_ipc, u32, call, long, first, long, second, long, third,
+        unsigned long, ptr, unsigned long, fifth)
 {
         int version, err;
 
@@ -233,8 +234,8 @@ sys32_ipc(u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 
 #else
 
-asmlinkage long
-sys32_ipc(u32 call, int first, int second, int third, u32 ptr, u32 fifth)
+SYSCALL_DEFINE6(32_ipc, u32, call, int, first, int, second, int, third,
+        u32, ptr, u32, fifth)
 {
         return -ENOSYS;
 }
@@ -242,7 +243,7 @@ sys32_ipc(u32 call, int first, int second, int third, u32 ptr, u32 fifth)
 #endif /* CONFIG_SYSVIPC */
 
 #ifdef CONFIG_MIPS32_N32
-asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
+SYSCALL_DEFINE4(n32_semctl, int, semid, int, semnum, int, cmd, u32, arg)
 {
         /* compat_sys_semctl expects a pointer to union semun */
         u32 __user *uptr = compat_alloc_user_space(sizeof(u32));
@@ -251,13 +252,14 @@ asmlinkage long sysn32_semctl(int semid, int semnum, int cmd, u32 arg)
         return compat_sys_semctl(semid, semnum, cmd, uptr);
 }
 
-asmlinkage long sysn32_msgsnd(int msqid, u32 msgp, unsigned msgsz, int msgflg)
+SYSCALL_DEFINE4(n32_msgsnd, int, msqid, u32, msgp, unsigned int, msgsz,
+        int, msgflg)
 {
         return compat_sys_msgsnd(msqid, msgsz, msgflg, compat_ptr(msgp));
 }
 
-asmlinkage long sysn32_msgrcv(int msqid, u32 msgp, size_t msgsz, int msgtyp,
-                              int msgflg)
+SYSCALL_DEFINE5(n32_msgrcv, int, msqid, u32, msgp, size_t, msgsz,
+        int, msgtyp, int, msgflg)
 {
         return compat_sys_msgrcv(msqid, msgsz, msgtyp, msgflg, IPC_64,
                                  compat_ptr(msgp));
@@ -277,7 +279,7 @@ struct sysctl_args32
 
 #ifdef CONFIG_SYSCTL_SYSCALL
 
-asmlinkage long sys32_sysctl(struct sysctl_args32 __user *args)
+SYSCALL_DEFINE1(32_sysctl, struct sysctl_args32 __user *, args)
 {
         struct sysctl_args32 tmp;
         int error;
@@ -316,9 +318,16 @@ asmlinkage long sys32_sysctl(struct sysctl_args32 __user *args)
         return error;
 }
 
+#else
+
+SYSCALL_DEFINE1(32_sysctl, struct sysctl_args32 __user *, args)
+{
+        return -ENOSYS;
+}
+
 #endif /* CONFIG_SYSCTL_SYSCALL */
 
-asmlinkage long sys32_newuname(struct new_utsname __user * name)
+SYSCALL_DEFINE1(32_newuname, struct new_utsname __user *, name)
 {
         int ret = 0;
 
@@ -334,7 +343,7 @@ asmlinkage long sys32_newuname(struct new_utsname __user * name)
         return ret;
 }
 
-asmlinkage int sys32_personality(unsigned long personality)
+SYSCALL_DEFINE1(32_personality, unsigned long, personality)
 {
         int ret;
         personality &= 0xffffffff;
@@ -357,7 +366,7 @@ struct ustat32 {
 
 extern asmlinkage long sys_ustat(dev_t dev, struct ustat __user * ubuf);
 
-asmlinkage int sys32_ustat(dev_t dev, struct ustat32 __user * ubuf32)
+SYSCALL_DEFINE2(32_ustat, dev_t, dev, struct ustat32 __user *, ubuf32)
 {
         int err;
         struct ustat tmp;
@@ -381,8 +390,8 @@ out:
         return err;
 }
 
-asmlinkage int sys32_sendfile(int out_fd, int in_fd, compat_off_t __user *offset,
-        s32 count)
+SYSCALL_DEFINE4(32_sendfile, long, out_fd, long, in_fd,
+        compat_off_t __user *, offset, s32, count)
 {
         mm_segment_t old_fs = get_fs();
         int ret;
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 51d1ba415b90..9ab70c3b5be6 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -399,7 +399,7 @@ einval:	li	v0, -ENOSYS
         sys     sys_swapon              2
         sys     sys_reboot              3
         sys     sys_old_readdir         3
-        sys     old_mmap                6       /* 4090 */
+        sys     sys_mips_mmap           6       /* 4090 */
         sys     sys_munmap              2
         sys     sys_truncate            2
         sys     sys_ftruncate           2
@@ -519,7 +519,7 @@ einval:	li	v0, -ENOSYS
         sys     sys_sendfile            4
         sys     sys_ni_syscall          0
         sys     sys_ni_syscall          0
-        sys     sys_mmap2               6       /* 4210 */
+        sys     sys_mips_mmap2          6       /* 4210 */
         sys     sys_truncate64          4
         sys     sys_ftruncate64         4
         sys     sys_stat64              2
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index a9e171618994..9b4698667154 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -207,7 +207,7 @@ sys_call_table:
         PTR     sys_newlstat
         PTR     sys_poll
         PTR     sys_lseek
-        PTR     old_mmap
+        PTR     sys_mips_mmap
         PTR     sys_mprotect                    /* 5010 */
         PTR     sys_munmap
         PTR     sys_brk
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 30f3b6317a83..7438e92f8a01 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -129,12 +129,12 @@ EXPORT(sysn32_call_table)
         PTR     sys_newlstat
         PTR     sys_poll
         PTR     sys_lseek
-        PTR     old_mmap
+        PTR     sys_mips_mmap
         PTR     sys_mprotect                    /* 6010 */
         PTR     sys_munmap
         PTR     sys_brk
-        PTR     sys32_rt_sigaction
-        PTR     sys32_rt_sigprocmask
+        PTR     sys_32_rt_sigaction
+        PTR     sys_32_rt_sigprocmask
         PTR     compat_sys_ioctl                /* 6015 */
         PTR     sys_pread64
         PTR     sys_pwrite64
@@ -159,7 +159,7 @@ EXPORT(sysn32_call_table)
         PTR     compat_sys_setitimer
         PTR     sys_alarm
         PTR     sys_getpid
-        PTR     sys32_sendfile
+        PTR     sys_32_sendfile
         PTR     sys_socket                      /* 6040 */
         PTR     sys_connect
         PTR     sys_accept
@@ -181,14 +181,14 @@ EXPORT(sysn32_call_table)
         PTR     sys_exit
         PTR     compat_sys_wait4
         PTR     sys_kill                        /* 6060 */
-        PTR     sys32_newuname
+        PTR     sys_32_newuname
         PTR     sys_semget
         PTR     sys_semop
-        PTR     sysn32_semctl
+        PTR     sys_n32_semctl
         PTR     sys_shmdt                       /* 6065 */
         PTR     sys_msgget
-        PTR     sysn32_msgsnd
-        PTR     sysn32_msgrcv
+        PTR     sys_n32_msgsnd
+        PTR     sys_n32_msgrcv
         PTR     compat_sys_msgctl
         PTR     compat_sys_fcntl                /* 6070 */
         PTR     sys_flock
@@ -245,15 +245,15 @@ EXPORT(sysn32_call_table)
         PTR     sys_getsid
         PTR     sys_capget
         PTR     sys_capset
-        PTR     sys32_rt_sigpending             /* 6125 */
+        PTR     sys_32_rt_sigpending            /* 6125 */
         PTR     compat_sys_rt_sigtimedwait
-        PTR     sys32_rt_sigqueueinfo
+        PTR     sys_32_rt_sigqueueinfo
         PTR     sysn32_rt_sigsuspend
         PTR     sys32_sigaltstack
         PTR     compat_sys_utime                /* 6130 */
         PTR     sys_mknod
-        PTR     sys32_personality
-        PTR     sys32_ustat
+        PTR     sys_32_personality
+        PTR     sys_32_ustat
         PTR     compat_sys_statfs
         PTR     compat_sys_fstatfs              /* 6135 */
         PTR     sys_sysfs
@@ -265,14 +265,14 @@ EXPORT(sysn32_call_table)
         PTR     sys_sched_getscheduler
         PTR     sys_sched_get_priority_max
         PTR     sys_sched_get_priority_min
-        PTR     sys32_sched_rr_get_interval     /* 6145 */
+        PTR     sys_32_sched_rr_get_interval    /* 6145 */
         PTR     sys_mlock
         PTR     sys_munlock
         PTR     sys_mlockall
         PTR     sys_munlockall
         PTR     sys_vhangup                     /* 6150 */
         PTR     sys_pivot_root
-        PTR     sys32_sysctl
+        PTR     sys_32_sysctl
         PTR     sys_prctl
         PTR     compat_sys_adjtimex
         PTR     compat_sys_setrlimit            /* 6155 */
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index fefef4af8595..b0fef4ff9827 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -265,12 +265,12 @@ sys_call_table:
         PTR     sys_olduname
         PTR     sys_umask                       /* 4060 */
         PTR     sys_chroot
-        PTR     sys32_ustat
+        PTR     sys_32_ustat
         PTR     sys_dup2
         PTR     sys_getppid
         PTR     sys_getpgrp                     /* 4065 */
         PTR     sys_setsid
-        PTR     sys32_sigaction
+        PTR     sys_32_sigaction
         PTR     sys_sgetmask
         PTR     sys_ssetmask
         PTR     sys_setreuid                    /* 4070 */
@@ -293,7 +293,7 @@ sys_call_table:
         PTR     sys_swapon
         PTR     sys_reboot
         PTR     compat_sys_old_readdir
-        PTR     old_mmap                        /* 4090 */
+        PTR     sys_mips_mmap                   /* 4090 */
         PTR     sys_munmap
         PTR     sys_truncate
         PTR     sys_ftruncate
@@ -320,12 +320,12 @@ sys_call_table:
         PTR     compat_sys_wait4
         PTR     sys_swapoff                     /* 4115 */
         PTR     compat_sys_sysinfo
-        PTR     sys32_ipc
+        PTR     sys_32_ipc
         PTR     sys_fsync
         PTR     sys32_sigreturn
         PTR     sys32_clone                     /* 4120 */
         PTR     sys_setdomainname
-        PTR     sys32_newuname
+        PTR     sys_32_newuname
         PTR     sys_ni_syscall                  /* sys_modify_ldt */
         PTR     compat_sys_adjtimex
         PTR     sys_mprotect                    /* 4125 */
@@ -339,11 +339,11 @@ sys_call_table:
         PTR     sys_fchdir
         PTR     sys_bdflush
         PTR     sys_sysfs                       /* 4135 */
-        PTR     sys32_personality
+        PTR     sys_32_personality
         PTR     sys_ni_syscall                  /* for afs_syscall */
         PTR     sys_setfsuid
         PTR     sys_setfsgid
-        PTR     sys32_llseek                    /* 4140 */
+        PTR     sys_32_llseek                   /* 4140 */
         PTR     compat_sys_getdents
         PTR     compat_sys_select
         PTR     sys_flock
@@ -356,7 +356,7 @@ sys_call_table:
         PTR     sys_ni_syscall                  /* 4150 */
         PTR     sys_getsid
         PTR     sys_fdatasync
-        PTR     sys32_sysctl
+        PTR     sys_32_sysctl
         PTR     sys_mlock
         PTR     sys_munlock                     /* 4155 */
         PTR     sys_mlockall
@@ -368,7 +368,7 @@ sys_call_table:
         PTR     sys_sched_yield
         PTR     sys_sched_get_priority_max
         PTR     sys_sched_get_priority_min
-        PTR     sys32_sched_rr_get_interval     /* 4165 */
+        PTR     sys_32_sched_rr_get_interval    /* 4165 */
         PTR     compat_sys_nanosleep
         PTR     sys_mremap
         PTR     sys_accept
@@ -397,25 +397,25 @@ sys_call_table:
         PTR     sys_getresgid
         PTR     sys_prctl
         PTR     sys32_rt_sigreturn
-        PTR     sys32_rt_sigaction
-        PTR     sys32_rt_sigprocmask            /* 4195 */
-        PTR     sys32_rt_sigpending
+        PTR     sys_32_rt_sigaction
+        PTR     sys_32_rt_sigprocmask           /* 4195 */
+        PTR     sys_32_rt_sigpending
         PTR     compat_sys_rt_sigtimedwait
-        PTR     sys32_rt_sigqueueinfo
+        PTR     sys_32_rt_sigqueueinfo
         PTR     sys32_rt_sigsuspend
-        PTR     sys32_pread                     /* 4200 */
-        PTR     sys32_pwrite
+        PTR     sys_32_pread                    /* 4200 */
+        PTR     sys_32_pwrite
         PTR     sys_chown
         PTR     sys_getcwd
         PTR     sys_capget
         PTR     sys_capset                      /* 4205 */
         PTR     sys32_sigaltstack
-        PTR     sys32_sendfile
+        PTR     sys_32_sendfile
         PTR     sys_ni_syscall
         PTR     sys_ni_syscall
-        PTR     sys32_mmap2                     /* 4210 */
-        PTR     sys32_truncate64
-        PTR     sys32_ftruncate64
+        PTR     sys_mips_mmap2                  /* 4210 */
+        PTR     sys_32_truncate64
+        PTR     sys_32_ftruncate64
         PTR     sys_newstat
         PTR     sys_newlstat
         PTR     sys_newfstat                    /* 4215 */
@@ -481,7 +481,7 @@ sys_call_table:
         PTR     compat_sys_mq_notify            /* 4275 */
         PTR     compat_sys_mq_getsetattr
         PTR     sys_ni_syscall                  /* sys_vserver */
-        PTR     sys32_waitid
+        PTR     sys_32_waitid
         PTR     sys_ni_syscall                  /* available, was setaltroot */
         PTR     sys_add_key                     /* 4280 */
         PTR     sys_request_key
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index a4e106c56ab5..830c5ef9932b 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -19,6 +19,7 @@
 #include <linux/ptrace.h>
 #include <linux/unistd.h>
 #include <linux/compiler.h>
+#include <linux/syscalls.h>
 #include <linux/uaccess.h>
 
 #include <asm/abi.h>
@@ -338,8 +339,8 @@ asmlinkage int sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
 }
 
 #ifdef CONFIG_TRAD_SIGNALS
-asmlinkage int sys_sigaction(int sig, const struct sigaction __user *act,
-        struct sigaction __user *oact)
+SYSCALL_DEFINE3(sigaction, int, sig, const struct sigaction __user *, act,
+        struct sigaction __user *, oact)
 {
         struct k_sigaction new_ka, old_ka;
         int ret;
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 652709b353ad..2e74075ac0ca 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -349,8 +349,8 @@ asmlinkage int sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         return -ERESTARTNOHAND;
 }
 
-asmlinkage int sys32_sigaction(int sig, const struct sigaction32 __user *act,
-                               struct sigaction32 __user *oact)
+SYSCALL_DEFINE3(32_sigaction, long, sig, const struct sigaction32 __user *, act,
+        struct sigaction32 __user *, oact)
 {
         struct k_sigaction new_ka, old_ka;
         int ret;
@@ -704,9 +704,9 @@ struct mips_abi mips_abi_32 = {
         .restart        = __NR_O32_restart_syscall
 };
 
-asmlinkage int sys32_rt_sigaction(int sig, const struct sigaction32 __user *act,
-                                  struct sigaction32 __user *oact,
-                                  unsigned int sigsetsize)
+SYSCALL_DEFINE4(32_rt_sigaction, int, sig,
+        const struct sigaction32 __user *, act,
+        struct sigaction32 __user *, oact, unsigned int, sigsetsize)
 {
         struct k_sigaction new_sa, old_sa;
         int ret = -EINVAL;
@@ -748,8 +748,8 @@ out:
         return ret;
 }
 
-asmlinkage int sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
-        compat_sigset_t __user *oset, unsigned int sigsetsize)
+SYSCALL_DEFINE4(32_rt_sigprocmask, int, how, compat_sigset_t __user *, set,
+        compat_sigset_t __user *, oset, unsigned int, sigsetsize)
 {
         sigset_t old_set, new_set;
         int ret;
@@ -770,8 +770,8 @@ asmlinkage int sys32_rt_sigprocmask(int how, compat_sigset_t __user *set,
         return ret;
 }
 
-asmlinkage int sys32_rt_sigpending(compat_sigset_t __user *uset,
-        unsigned int sigsetsize)
+SYSCALL_DEFINE2(32_rt_sigpending, compat_sigset_t __user *, uset,
+        unsigned int, sigsetsize)
 {
         int ret;
         sigset_t set;
@@ -787,7 +787,8 @@ asmlinkage int sys32_rt_sigpending(compat_sigset_t __user *uset,
         return ret;
 }
 
-asmlinkage int sys32_rt_sigqueueinfo(int pid, int sig, compat_siginfo_t __user *uinfo)
+SYSCALL_DEFINE3(32_rt_sigqueueinfo, int, pid, int, sig,
+        compat_siginfo_t __user *, uinfo)
 {
         siginfo_t info;
         int ret;
@@ -802,10 +803,9 @@ asmlinkage int sys32_rt_sigqueueinfo(int pid, int sig, compat_siginfo_t __user *
         return ret;
 }
 
-asmlinkage long
-sys32_waitid(int which, compat_pid_t pid,
-             compat_siginfo_t __user *uinfo, int options,
-             struct compat_rusage __user *uru)
+SYSCALL_DEFINE5(32_waitid, int, which, compat_pid_t, pid,
+             compat_siginfo_t __user *, uinfo, int, options,
+             struct compat_rusage __user *, uru)
 {
         siginfo_t info;
         struct rusage ru;
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 37970d9b2186..8cf384644040 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -152,9 +152,9 @@ out:
         return error;
 }
 
-asmlinkage unsigned long
-old_mmap(unsigned long addr, unsigned long len, int prot,
-        int flags, int fd, off_t offset)
+SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
+        unsigned long, prot, unsigned long, flags, unsigned long,
+        fd, off_t, offset)
 {
         unsigned long result;
 
@@ -168,9 +168,9 @@ out:
         return result;
 }
 
-asmlinkage unsigned long
-sys_mmap2(unsigned long addr, unsigned long len, unsigned long prot,
-          unsigned long flags, unsigned long fd, unsigned long pgoff)
+SYSCALL_DEFINE6(mips_mmap2, unsigned long, addr, unsigned long, len,
+        unsigned long, prot, unsigned long, flags, unsigned long, fd,
+        unsigned long, pgoff)
 {
         if (pgoff & (~PAGE_MASK >> 12))
                 return -EINVAL;
@@ -240,7 +240,7 @@ out:
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_uname(struct old_utsname __user * name)
+SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
 {
         if (name && !copy_to_user(name, utsname(), sizeof (*name)))
                 return 0;
@@ -250,7 +250,7 @@ asmlinkage int sys_uname(struct old_utsname __user * name)
 /*
  * Compacrapability ...
  */
-asmlinkage int sys_olduname(struct oldold_utsname __user * name)
+SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
 {
         int error;
 
@@ -279,7 +279,7 @@ asmlinkage int sys_olduname(struct oldold_utsname __user * name)
         return error;
 }
 
-asmlinkage int sys_set_thread_area(unsigned long addr)
+SYSCALL_DEFINE1(set_thread_area, unsigned long, addr)
 {
         struct thread_info *ti = task_thread_info(current);
 
@@ -290,7 +290,7 @@ asmlinkage int sys_set_thread_area(unsigned long addr)
         return 0;
 }
 
-asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
+asmlinkage int _sys_sysmips(long cmd, long arg1, long arg2, long arg3)
 {
         switch (cmd) {
         case MIPS_ATOMIC_SET:
@@ -325,8 +325,8 @@ asmlinkage int _sys_sysmips(int cmd, long arg1, int arg2, int arg3)
  *
  * This is really horribly ugly.
  */
-asmlinkage int sys_ipc(unsigned int call, int first, int second,
-                       unsigned long third, void __user *ptr, long fifth)
+SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, int, second,
+        unsigned long, third, void __user *, ptr, long, fifth)
 {
         int version, ret;
 
@@ -411,7 +411,7 @@ asmlinkage int sys_ipc(unsigned int call, int first, int second,
 /*
  * No implemented yet ...
  */
-asmlinkage int sys_cachectl(char *addr, int nbytes, int op)
+SYSCALL_DEFINE3(cachectl, char *, addr, int, nbytes, int, op)
 {
         return -ENOSYS;
 }
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index 98ad0a82c29e..694d51f523d1 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -13,6 +13,7 @@
 #include <linux/linkage.h>
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <linux/syscalls.h>
 #include <linux/mm.h>
 
 #include <asm/cacheflush.h>
@@ -58,8 +59,8 @@ EXPORT_SYMBOL(_dma_cache_wback_inv);
  * We could optimize the case where the cache argument is not BCACHE but
  * that seems very atypical use ...
  */
-asmlinkage int sys_cacheflush(unsigned long addr,
-        unsigned long bytes, unsigned int cache)
+SYSCALL_DEFINE3(cacheflush, unsigned long, addr, unsigned long, bytes,
+        unsigned int, cache)
 {
         if (bytes == 0)
                 return 0;
diff --git a/arch/mips/mm/page.c b/arch/mips/mm/page.c
index 1417c6494858..48060c635acd 100644
--- a/arch/mips/mm/page.c
+++ b/arch/mips/mm/page.c
@@ -172,8 +172,9 @@ static void __cpuinit set_prefetch_parameters(void)
                  */
                 cache_line_size = cpu_dcache_line_size();
                 switch (current_cpu_type()) {
+                case CPU_R5500:
                 case CPU_TX49XX:
-                        /* TX49 supports only Pref_Load */
+                        /* These processors only support the Pref_Load. */
                         pref_bias_copy_load = 256;
                         break;
 
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 42942038d0fd..f335cf6cdd78 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -318,6 +318,7 @@ static void __cpuinit build_tlb_write_entry(u32 **p, struct uasm_label **l,
         case CPU_BCM4710:
         case CPU_LOONGSON2:
         case CPU_CAVIUM_OCTEON:
+        case CPU_R5500:
                 if (m4kc_tlbp_war())
                         uasm_i_nop(p);
                 tlbw(p);
diff --git a/arch/powerpc/configs/40x/virtex_defconfig b/arch/powerpc/configs/40x/virtex_defconfig
index b6888384dd74..f5698f962e58 100644
--- a/arch/powerpc/configs/40x/virtex_defconfig
+++ b/arch/powerpc/configs/40x/virtex_defconfig
@@ -686,7 +686,7 @@ CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
-# CONFIG_SERIAL_OF_PLATFORM is not set
+CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
diff --git a/arch/powerpc/configs/44x/virtex5_defconfig b/arch/powerpc/configs/44x/virtex5_defconfig
index 15aab1ca6384..1bf0a63614b1 100644
--- a/arch/powerpc/configs/44x/virtex5_defconfig
+++ b/arch/powerpc/configs/44x/virtex5_defconfig
@@ -691,7 +691,7 @@ CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
-# CONFIG_SERIAL_OF_PLATFORM is not set
+CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_SERIAL_OF_PLATFORM_NWPSERIAL is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
diff --git a/arch/powerpc/configs/linkstation_defconfig b/arch/powerpc/configs/linkstation_defconfig
index aa5855a156de..15900dcf0bfa 100644
--- a/arch/powerpc/configs/linkstation_defconfig
+++ b/arch/powerpc/configs/linkstation_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.29-rc2
-# Mon Jan 26 15:35:29 2009
+# Linux kernel version: 2.6.29-rc6
+# Fri Mar  6 00:07:38 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -71,6 +71,15 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
@@ -88,6 +97,7 @@ CONFIG_NAMESPACES=y
 # CONFIG_IPC_NS is not set
 # CONFIG_USER_NS is not set
 # CONFIG_PID_NS is not set
+# CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -153,11 +163,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
-# CONFIG_TREE_RCU is not set
-# CONFIG_PREEMPT_RCU is not set
-# CONFIG_TREE_RCU_TRACE is not set
-# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_FREEZER is not set
 
 #
@@ -294,7 +299,6 @@ CONFIG_NET=y
 #
 # Networking options
 #
-# CONFIG_NET_NS is not set
 CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
@@ -508,8 +512,8 @@ CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
-# CONFIG_MTD_CMDLINE_PARTS is not set
-# CONFIG_MTD_OF_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_OF_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
 
 #
@@ -587,7 +591,6 @@ CONFIG_MTD_PHYSMAP=y
 # LPDDR flash memory drivers
 #
 # CONFIG_MTD_LPDDR is not set
-# CONFIG_MTD_QINFO_PROBE is not set
 
 #
 # UBI - Unsorted block images
@@ -617,13 +620,19 @@ CONFIG_BLK_DEV_RAM_SIZE=8192
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+CONFIG_EEPROM_LEGACY=m
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -839,6 +848,7 @@ CONFIG_R8169=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
 # CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
@@ -1037,8 +1047,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-CONFIG_EEPROM_LEGACY=m
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
diff --git a/arch/powerpc/configs/storcenter_defconfig b/arch/powerpc/configs/storcenter_defconfig
index 86512c8790d1..94903465ea12 100644
--- a/arch/powerpc/configs/storcenter_defconfig
+++ b/arch/powerpc/configs/storcenter_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.29-rc2
-# Mon Jan 26 15:35:46 2009
+# Linux kernel version: 2.6.29-rc6
+# Fri Mar  6 00:09:08 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -71,6 +71,15 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_GROUP_SCHED=y
@@ -144,11 +153,6 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
-CONFIG_CLASSIC_RCU=y
-# CONFIG_TREE_RCU is not set
-# CONFIG_PREEMPT_RCU is not set
-# CONFIG_TREE_RCU_TRACE is not set
-# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_FREEZER is not set
 
 #
@@ -377,8 +381,8 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
-# CONFIG_MTD_CMDLINE_PARTS is not set
-# CONFIG_MTD_OF_PARTS is not set
+CONFIG_MTD_CMDLINE_PARTS=y
+CONFIG_MTD_OF_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
 
 #
@@ -452,7 +456,6 @@ CONFIG_MTD_PHYSMAP=y
 # LPDDR flash memory drivers
 #
 # CONFIG_MTD_LPDDR is not set
-# CONFIG_MTD_QINFO_PROBE is not set
 
 #
 # UBI - Unsorted block images
@@ -478,13 +481,19 @@ CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 CONFIG_IDE=y
 
@@ -677,6 +686,7 @@ CONFIG_R8169=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
 # CONFIG_JME is not set
 # CONFIG_NETDEV_10000 is not set
 # CONFIG_TR is not set
@@ -818,8 +828,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -1159,6 +1167,7 @@ CONFIG_JFFS2_RTIME=y
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 # CONFIG_NETWORK_FILESYSTEMS is not set
+CONFIG_EXPORTFS=m
 
 #
 # Partition Types
diff --git a/arch/powerpc/include/asm/compat.h b/arch/powerpc/include/asm/compat.h
index d811a8cd7b58..4774c2f92232 100644
--- a/arch/powerpc/include/asm/compat.h
+++ b/arch/powerpc/include/asm/compat.h
@@ -210,5 +210,10 @@ struct compat_shmid64_ds {
         compat_ulong_t __unused6;
 };
 
+static inline int is_compat_task(void)
+{
+        return test_thread_flag(TIF_32BIT);
+}
+
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_COMPAT_H */
diff --git a/arch/powerpc/include/asm/seccomp.h b/arch/powerpc/include/asm/seccomp.h
index 853765eb1f65..00c1d9133cfe 100644
--- a/arch/powerpc/include/asm/seccomp.h
+++ b/arch/powerpc/include/asm/seccomp.h
@@ -1,10 +1,6 @@
 #ifndef _ASM_POWERPC_SECCOMP_H
 #define _ASM_POWERPC_SECCOMP_H
 
-#ifdef __KERNEL__
-#include <linux/thread_info.h>
-#endif
-
 #include <linux/unistd.h>
 
 #define __NR_seccomp_read __NR_read
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index ada06924a423..73cb6a3229ae 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -367,27 +367,24 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr,
 static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg,
                            unsigned int flags)
 {
-        char *ptr = (char *) &current->thread.TS_FPR(reg);
-        int i, ret;
+        char *ptr0 = (char *) &current->thread.TS_FPR(reg);
+        char *ptr1 = (char *) &current->thread.TS_FPR(reg+1);
+        int i, ret, sw = 0;
 
         if (!(flags & F))
                 return 0;
         if (reg & 1)
                 return 0;       /* invalid form: FRS/FRT must be even */
-        if (!(flags & SW)) {
-                /* not byte-swapped - easy */
-                if (!(flags & ST))
-                        ret = __copy_from_user(ptr, addr, 16);
-                else
-                        ret = __copy_to_user(addr, ptr, 16);
-        } else {
-                /* each FPR value is byte-swapped separately */
-                ret = 0;
-                for (i = 0; i < 16; ++i) {
-                        if (!(flags & ST))
-                                ret |= __get_user(ptr[i^7], addr + i);
-                        else
-                                ret |= __put_user(ptr[i^7], addr + i);
+        if (flags & SW)
+                sw = 7;
+        ret = 0;
+        for (i = 0; i < 8; ++i) {
+                if (!(flags & ST)) {
+                        ret |= __get_user(ptr0[i^sw], addr + i);
+                        ret |= __get_user(ptr1[i^sw], addr + i + 8);
+                } else {
+                        ret |= __put_user(ptr0[i^sw], addr + i);
+                        ret |= __put_user(ptr1[i^sw], addr + i + 8);
                 }
         }
         if (ret)
diff --git a/arch/powerpc/lib/copyuser_64.S b/arch/powerpc/lib/copyuser_64.S
index 70693a5c12a1..693b14a778fa 100644
--- a/arch/powerpc/lib/copyuser_64.S
+++ b/arch/powerpc/lib/copyuser_64.S
@@ -62,18 +62,19 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 72:     std     r8,8(r3)
         beq+    3f
         addi    r3,r3,16
-23:     ld      r9,8(r4)
 .Ldo_tail:
         bf      cr7*4+1,1f
-        rotldi  r9,r9,32
+23:     lwz     r9,8(r4)
+        addi    r4,r4,4
 73:     stw     r9,0(r3)
         addi    r3,r3,4
 1:      bf      cr7*4+2,2f
-        rotldi  r9,r9,16
+44:     lhz     r9,8(r4)
+        addi    r4,r4,2
 74:     sth     r9,0(r3)
         addi    r3,r3,2
 2:      bf      cr7*4+3,3f
-        rotldi  r9,r9,8
+45:     lbz     r9,8(r4)
 75:     stb     r9,0(r3)
 3:      li      r3,0
         blr
@@ -141,11 +142,24 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 6:      cmpwi   cr1,r5,8
         addi    r3,r3,32
         sld     r9,r9,r10
-        ble     cr1,.Ldo_tail
+        ble     cr1,7f
 34:     ld      r0,8(r4)
         srd     r7,r0,r11
         or      r9,r7,r9
-        b       .Ldo_tail
+7:
+        bf      cr7*4+1,1f
+        rotldi  r9,r9,32
+94:     stw     r9,0(r3)
+        addi    r3,r3,4
+1:      bf      cr7*4+2,2f
+        rotldi  r9,r9,16
+95:     sth     r9,0(r3)
+        addi    r3,r3,2
+2:      bf      cr7*4+3,3f
+        rotldi  r9,r9,8
+96:     stb     r9,0(r3)
+3:      li      r3,0
+        blr
 
 .Ldst_unaligned:
         PPC_MTOCRF      0x01,r6         /* put #bytes to 8B bdry into cr7 */
@@ -218,7 +232,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 121:
 132:
         addi    r3,r3,8
-123:
 134:
 135:
 138:
@@ -226,6 +239,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 140:
 141:
 142:
+123:
+144:
+145:
 
 /*
  * here we have had a fault on a load and r3 points to the first
@@ -309,6 +325,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 187:
 188:
 189:    
+194:
+195:
+196:
 1:
         ld      r6,-24(r1)
         ld      r5,-8(r1)
@@ -329,7 +348,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         .llong  72b,172b
         .llong  23b,123b
         .llong  73b,173b
+        .llong  44b,144b
         .llong  74b,174b
+        .llong  45b,145b
         .llong  75b,175b
         .llong  24b,124b
         .llong  25b,125b
@@ -347,6 +368,9 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         .llong  79b,179b
         .llong  80b,180b
         .llong  34b,134b
+        .llong  94b,194b
+        .llong  95b,195b
+        .llong  96b,196b
         .llong  35b,135b
         .llong  81b,181b
         .llong  36b,136b
diff --git a/arch/powerpc/lib/memcpy_64.S b/arch/powerpc/lib/memcpy_64.S
index fe2d34e5332d..e178922b2c21 100644
--- a/arch/powerpc/lib/memcpy_64.S
+++ b/arch/powerpc/lib/memcpy_64.S
@@ -53,18 +53,19 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 3:      std     r8,8(r3)
         beq     3f
         addi    r3,r3,16
-        ld      r9,8(r4)
 .Ldo_tail:
         bf      cr7*4+1,1f
-        rotldi  r9,r9,32
+        lwz     r9,8(r4)
+        addi    r4,r4,4
         stw     r9,0(r3)
         addi    r3,r3,4
 1:      bf      cr7*4+2,2f
-        rotldi  r9,r9,16
+        lhz     r9,8(r4)
+        addi    r4,r4,2
         sth     r9,0(r3)
         addi    r3,r3,2
 2:      bf      cr7*4+3,3f
-        rotldi  r9,r9,8
+        lbz     r9,8(r4)
         stb     r9,0(r3)
 3:      ld      r3,48(r1)       /* return dest pointer */
         blr
@@ -133,11 +134,24 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
         cmpwi   cr1,r5,8
         addi    r3,r3,32
         sld     r9,r9,r10
-        ble     cr1,.Ldo_tail
+        ble     cr1,6f
         ld      r0,8(r4)
         srd     r7,r0,r11
         or      r9,r7,r9
-        b       .Ldo_tail
+6:
+        bf      cr7*4+1,1f
+        rotldi  r9,r9,32
+        stw     r9,0(r3)
+        addi    r3,r3,4
+1:      bf      cr7*4+2,2f
+        rotldi  r9,r9,16
+        sth     r9,0(r3)
+        addi    r3,r3,2
+2:      bf      cr7*4+3,3f
+        rotldi  r9,r9,8
+        stb     r9,0(r3)
+3:      ld      r3,48(r1)       /* return dest pointer */
+        blr
 
 .Ldst_unaligned:
         PPC_MTOCRF      0x01,r6         # put #bytes to 8B bdry into cr7
diff --git a/arch/powerpc/platforms/86xx/gef_sbc610.c b/arch/powerpc/platforms/86xx/gef_sbc610.c
index fb371f5ce132..d6b772ba3b8f 100644
--- a/arch/powerpc/platforms/86xx/gef_sbc610.c
+++ b/arch/powerpc/platforms/86xx/gef_sbc610.c
@@ -142,6 +142,10 @@ static void __init gef_sbc610_nec_fixup(struct pci_dev *pdev)
 {
         unsigned int val;
 
+        /* Do not do the fixup on other platforms! */
+        if (!machine_is(gef_sbc610))
+                return;
+
         printk(KERN_INFO "Running NEC uPD720101 Fixup\n");
 
         /* Ensure ports 1, 2, 3, 4 & 5 are enabled */
diff --git a/arch/powerpc/platforms/embedded6xx/linkstation.c b/arch/powerpc/platforms/embedded6xx/linkstation.c
index 2ca7be65c2d2..244f997de791 100644
--- a/arch/powerpc/platforms/embedded6xx/linkstation.c
+++ b/arch/powerpc/platforms/embedded6xx/linkstation.c
@@ -12,7 +12,6 @@
 
 #include <linux/kernel.h>
 #include <linux/initrd.h>
-#include <linux/mtd/physmap.h>
 #include <linux/of_platform.h>
 
 #include <asm/time.h>
@@ -22,39 +21,6 @@
 
 #include "mpc10x.h"
 
-static struct mtd_partition linkstation_physmap_partitions[] = {
-        {
-                .name   = "mtd_firmimg",
-                .offset = 0x000000,
-                .size   = 0x300000,
-        },
-        {
-                .name   = "mtd_bootcode",
-                .offset = 0x300000,
-                .size   = 0x070000,
-        },
-        {
-                .name   = "mtd_status",
-                .offset = 0x370000,
-                .size   = 0x010000,
-        },
-        {
-                .name   = "mtd_conf",
-                .offset = 0x380000,
-                .size   = 0x080000,
-        },
-        {
-                .name   = "mtd_allflash",
-                .offset = 0x000000,
-                .size   = 0x400000,
-        },
-        {
-                .name   = "mtd_data",
-                .offset = 0x310000,
-                .size   = 0x0f0000,
-        },
-};
-
 static __initdata struct of_device_id of_bus_ids[] = {
         { .type = "soc", },
         { .compatible = "simple-bus", },
@@ -99,10 +65,6 @@ static int __init linkstation_add_bridge(struct device_node *dev)
 static void __init linkstation_setup_arch(void)
 {
         struct device_node *np;
-#ifdef CONFIG_MTD_PHYSMAP
-        physmap_set_partitions(linkstation_physmap_partitions,
-                               ARRAY_SIZE(linkstation_physmap_partitions));
-#endif
 
         /* Lookup PCI host bridges */
         for_each_compatible_node(np, "pci", "mpc10x-pci")
diff --git a/arch/powerpc/platforms/embedded6xx/storcenter.c b/arch/powerpc/platforms/embedded6xx/storcenter.c
index 8864e4884980..613070e9ddbe 100644
--- a/arch/powerpc/platforms/embedded6xx/storcenter.c
+++ b/arch/powerpc/platforms/embedded6xx/storcenter.c
@@ -14,7 +14,6 @@
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/initrd.h>
-#include <linux/mtd/physmap.h>
 #include <linux/of_platform.h>
 
 #include <asm/system.h>
@@ -26,32 +25,6 @@
 #include "mpc10x.h"
 
 
-#ifdef CONFIG_MTD_PHYSMAP
-static struct mtd_partition storcenter_physmap_partitions[] = {
-        {
-                .name   = "kernel",
-                .offset = 0x000000,
-                .size   = 0x170000,
-        },
-        {
-                .name   = "rootfs",
-                .offset = 0x170000,
-                .size   = 0x590000,
-        },
-        {
-                .name   = "uboot",
-                .offset = 0x700000,
-                .size   = 0x040000,
-        },
-        {
-                .name   = "config",
-                .offset = 0x740000,
-                .size   = 0x0c0000,
-        },
-};
-#endif
-
-
 static __initdata struct of_device_id storcenter_of_bus[] = {
         { .name = "soc", },
         {},
@@ -96,11 +69,6 @@ static void __init storcenter_setup_arch(void)
 {
         struct device_node *np;
 
-#ifdef CONFIG_MTD_PHYSMAP
-        physmap_set_partitions(storcenter_physmap_partitions,
-                               ARRAY_SIZE(storcenter_physmap_partitions));
-#endif
-
         /* Lookup PCI host bridges */
         for_each_compatible_node(np, "pci", "mpc10x-pci")
                 storcenter_add_bridge(np);
diff --git a/arch/powerpc/sysdev/ppc4xx_pci.c b/arch/powerpc/sysdev/ppc4xx_pci.c
index 77fae5f64f2e..5558d932b4d5 100644
--- a/arch/powerpc/sysdev/ppc4xx_pci.c
+++ b/arch/powerpc/sysdev/ppc4xx_pci.c
@@ -204,6 +204,23 @@ static int __init ppc4xx_setup_one_pci_PMM(struct pci_controller	*hose,
 {
         u32 ma, pcila, pciha;
 
+        /* Hack warning ! The "old" PCI 2.x cell only let us configure the low
+         * 32-bit of incoming PLB addresses. The top 4 bits of the 36-bit
+         * address are actually hard wired to a value that appears to depend
+         * on the specific SoC. For example, it's 0 on 440EP and 1 on 440EPx.
+         *
+         * The trick here is we just crop those top bits and ignore them when
+         * programming the chip. That means the device-tree has to be right
+         * for the specific part used (we don't print a warning if it's wrong
+         * but on the other hand, you'll crash quickly enough), but at least
+         * this code should work whatever the hard coded value is
+         */
+        plb_addr &= 0xffffffffull;
+
+        /* Note: Due to the above hack, the test below doesn't actually test
+         * if you address is above 4G, but it tests that address and
+         * (address + size) are both contained in the same 4G
+         */
         if ((plb_addr + size) > 0xffffffffull || !is_power_of_2(size) ||
             size < 0x1000 || (plb_addr & (size - 1)) != 0) {
                 printk(KERN_WARNING "%s: Resource out of range\n",
diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c
index c42cd898f68b..6118890c946d 100644
--- a/arch/s390/crypto/aes_s390.c
+++ b/arch/s390/crypto/aes_s390.c
@@ -556,7 +556,7 @@ static void __exit aes_s390_fini(void)
 module_init(aes_s390_init);
 module_exit(aes_s390_fini);
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS("aes-all");
 
 MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm");
 MODULE_LICENSE("GPL");
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index 7c35787d29b4..15b6d450fbf0 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -22,7 +22,7 @@
 #include <linux/gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_gpio.h>
-#include <media/ov772x.h>
+#include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
 #include <media/sh_mobile_ceu.h>
 #include <video/sh_mobile_lcdc.h>
@@ -224,7 +224,6 @@ static void camera_power(int val)
 }
 
 #ifdef CONFIG_I2C
-/* support for the old ncm03j camera */
 static unsigned char camera_ncm03j_magic[] =
 {
         0x87, 0x00, 0x88, 0x08, 0x89, 0x01, 0x8A, 0xE8,
@@ -245,23 +244,6 @@ static unsigned char camera_ncm03j_magic[] =
         0x63, 0xD4, 0x64, 0xEA, 0xD6, 0x0F,
 };
 
-static int camera_probe(void)
-{
-        struct i2c_adapter *a = i2c_get_adapter(0);
-        struct i2c_msg msg;
-        int ret;
-
-        camera_power(1);
-        msg.addr = 0x6e;
-        msg.buf = camera_ncm03j_magic;
-        msg.len = 2;
-        msg.flags = 0;
-        ret = i2c_transfer(a, &msg, 1);
-        camera_power(0);
-
-        return ret;
-}
-
 static int camera_set_capture(struct soc_camera_platform_info *info,
                               int enable)
 {
@@ -313,35 +295,8 @@ static struct platform_device camera_device = {
                 .platform_data  = &camera_info,
         },
 };
-
-static int __init camera_setup(void)
-{
-        if (camera_probe() > 0)
-                platform_device_register(&camera_device);
-
-        return 0;
-}
-late_initcall(camera_setup);
-
 #endif /* CONFIG_I2C */
 
-static int ov7725_power(struct device *dev, int mode)
-{
-        camera_power(0);
-        if (mode)
-                camera_power(1);
-
-        return 0;
-}
-
-static struct ov772x_camera_info ov7725_info = {
-        .buswidth  = SOCAM_DATAWIDTH_8,
-        .flags = OV772X_FLAG_VFLIP | OV772X_FLAG_HFLIP,
-        .link = {
-                .power  = ov7725_power,
-        },
-};
-
 static struct sh_mobile_ceu_info sh_mobile_ceu_info = {
         .flags = SOCAM_PCLK_SAMPLE_RISING | SOCAM_HSYNC_ACTIVE_HIGH |
         SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_MASTER | SOCAM_DATAWIDTH_8,
@@ -392,6 +347,9 @@ static struct platform_device *ap325rxa_devices[] __initdata = {
         &ap325rxa_nor_flash_device,
         &lcdc_device,
         &ceu_device,
+#ifdef CONFIG_I2C
+        &camera_device,
+#endif
         &nand_flash_device,
         &sdcard_cn3_device,
 };
@@ -400,10 +358,6 @@ static struct i2c_board_info __initdata ap325rxa_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("pcf8563", 0x51),
         },
-        {
-                I2C_BOARD_INFO("ov772x", 0x21),
-                .platform_data = &ov7725_info,
-        },
 };
 
 static struct spi_board_info ap325rxa_spi_devices[] = {
diff --git a/arch/sh/kernel/cpu/sh2a/clock-sh7201.c b/arch/sh/kernel/cpu/sh2a/clock-sh7201.c
index 020a96fe961a..4a5e59732334 100644
--- a/arch/sh/kernel/cpu/sh2a/clock-sh7201.c
+++ b/arch/sh/kernel/cpu/sh2a/clock-sh7201.c
@@ -18,8 +18,8 @@
 #include <asm/freq.h>
 #include <asm/io.h>
 
-const static int pll1rate[]={1,2,3,4,6,8};
-const static int pfc_divisors[]={1,2,3,4,6,8,12};
+static const int pll1rate[]={1,2,3,4,6,8};
+static const int pfc_divisors[]={1,2,3,4,6,8,12};
 #define ifc_divisors pfc_divisors
 
 #if (CONFIG_SH_CLK_MD == 0)
diff --git a/arch/sparc/include/asm/compat.h b/arch/sparc/include/asm/compat.h
index f260b58f5ce9..0e706257918f 100644
--- a/arch/sparc/include/asm/compat.h
+++ b/arch/sparc/include/asm/compat.h
@@ -240,4 +240,9 @@ struct compat_shmid64_ds {
         unsigned int    __unused2;
 };
 
+static inline int is_compat_task(void)
+{
+        return test_thread_flag(TIF_32BIT);
+}
+
 #endif /* _ASM_SPARC64_COMPAT_H */
diff --git a/arch/sparc/include/asm/seccomp.h b/arch/sparc/include/asm/seccomp.h
index 7fcd9968192b..adca1bce41d4 100644
--- a/arch/sparc/include/asm/seccomp.h
+++ b/arch/sparc/include/asm/seccomp.h
@@ -1,11 +1,5 @@
 #ifndef _ASM_SECCOMP_H
 
-#include <linux/thread_info.h> /* already defines TIF_32BIT */
-
-#ifndef TIF_32BIT
-#error "unexpected TIF_32BIT on sparc64"
-#endif
-
 #include <linux/unistd.h>
 
 #define __NR_seccomp_read __NR_read
diff --git a/arch/sparc/kernel/chmc.c b/arch/sparc/kernel/chmc.c
index 3b9f4d6e14a9..e1a9598e2a4d 100644
--- a/arch/sparc/kernel/chmc.c
+++ b/arch/sparc/kernel/chmc.c
@@ -306,6 +306,7 @@ static int jbusmc_print_dimm(int syndrome_code,
                 buf[1] = '?';
                 buf[2] = '?';
                 buf[3] = '\0';
+                return 0;
         }
         p = dp->controller;
         prop = &p->layout;
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index e289376198eb..1c378d8e90c5 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -323,17 +323,25 @@ static void sun4u_set_affinity(unsigned int virt_irq,
         sun4u_irq_enable(virt_irq);
 }
 
+/* Don't do anything.  The desc->status check for IRQ_DISABLED in
+ * handler_irq() will skip the handler call and that will leave the
+ * interrupt in the sent state.  The next ->enable() call will hit the
+ * ICLR register to reset the state machine.
+ *
+ * This scheme is necessary, instead of clearing the Valid bit in the
+ * IMAP register, to handle the case of IMAP registers being shared by
+ * multiple INOs (and thus ICLR registers).  Since we use a different
+ * virtual IRQ for each shared IMAP instance, the generic code thinks
+ * there is only one user so it prematurely calls ->disable() on
+ * free_irq().
+ *
+ * We have to provide an explicit ->disable() method instead of using
+ * NULL to get the default.  The reason is that if the generic code
+ * sees that, it also hooks up a default ->shutdown method which
+ * invokes ->mask() which we do not want.  See irq_chip_set_defaults().
+ */
 static void sun4u_irq_disable(unsigned int virt_irq)
 {
-        struct irq_handler_data *data = get_irq_chip_data(virt_irq);
-
-        if (likely(data)) {
-                unsigned long imap = data->imap;
-                unsigned long tmp = upa_readq(imap);
-
-                tmp &= ~IMAP_VALID;
-                upa_writeq(tmp, imap);
-        }
 }
 
 static void sun4u_irq_eoi(unsigned int virt_irq)
@@ -746,7 +754,8 @@ void handler_irq(int irq, struct pt_regs *regs)
 
                 desc = irq_desc + virt_irq;
 
-                desc->handle_irq(virt_irq, desc);
+                if (!(desc->status & IRQ_DISABLED))
+                        desc->handle_irq(virt_irq, desc);
 
                 bucket_pa = next_pa;
         }
diff --git a/arch/um/kernel/ptrace.c b/arch/um/kernel/ptrace.c
index 15e8b7c4de13..8e3d69e4fcb5 100644
--- a/arch/um/kernel/ptrace.c
+++ b/arch/um/kernel/ptrace.c
@@ -64,6 +64,11 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                 ret = poke_user(child, addr, data);
                 break;
 
+        case PTRACE_SYSEMU:
+        case PTRACE_SYSEMU_SINGLESTEP:
+                ret = -EIO;
+                break;
+
         /* continue and stop at next (return from) syscall */
         case PTRACE_SYSCALL:
         /* restart after signal. */
diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c
index 74f49bb9b125..89b48a116a89 100644
--- a/arch/um/os-Linux/user_syms.c
+++ b/arch/um/os-Linux/user_syms.c
@@ -14,7 +14,6 @@
 #undef memset
 
 extern size_t strlen(const char *);
-extern void *memcpy(void *, const void *, size_t);
 extern void *memmove(void *, const void *, size_t);
 extern void *memset(void *, int, size_t);
 extern int printf(const char *, ...);
@@ -24,7 +23,11 @@ extern int printf(const char *, ...);
 EXPORT_SYMBOL(strstr);
 #endif
 
+#ifndef __x86_64__
+extern void *memcpy(void *, const void *, size_t);
 EXPORT_SYMBOL(memcpy);
+#endif
+
 EXPORT_SYMBOL(memmove);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(printf);
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9c39095b33fc..bc2fbadff9f9 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -1803,7 +1803,7 @@ config DMAR
           remapping devices.
 
 config DMAR_DEFAULT_ON
-        def_bool n
+        def_bool y
         prompt "Enable DMA Remapping Devices by default"
         depends on DMAR
         help
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index ca5ffb2856b6..edc90f23e708 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -37,8 +37,6 @@ extern unsigned long asmlinkage efi_call_phys(void *, ...);
 
 #else /* !CONFIG_X86_32 */
 
-#define MAX_EFI_IO_PAGES        100
-
 extern u64 efi_call0(void *fp);
 extern u64 efi_call1(void *fp, u64 arg1);
 extern u64 efi_call2(void *fp, u64 arg1, u64 arg2);
diff --git a/arch/x86/include/asm/fixmap_64.h b/arch/x86/include/asm/fixmap_64.h
index 00a30ab9b1a5..8be740977db8 100644
--- a/arch/x86/include/asm/fixmap_64.h
+++ b/arch/x86/include/asm/fixmap_64.h
@@ -16,7 +16,6 @@
 #include <asm/apicdef.h>
 #include <asm/page.h>
 #include <asm/vsyscall.h>
-#include <asm/efi.h>
 
 /*
  * Here we define all the compile-time 'special' virtual
@@ -43,9 +42,6 @@ enum fixed_addresses {
         FIX_APIC_BASE,  /* local (CPU) APIC) -- required for SMP or not */
         FIX_IO_APIC_BASE_0,
         FIX_IO_APIC_BASE_END = FIX_IO_APIC_BASE_0 + MAX_IO_APICS - 1,
-        FIX_EFI_IO_MAP_LAST_PAGE,
-        FIX_EFI_IO_MAP_FIRST_PAGE = FIX_EFI_IO_MAP_LAST_PAGE
-                                  + MAX_EFI_IO_PAGES - 1,
 #ifdef CONFIG_PARAVIRT
         FIX_PARAVIRT_BOOTMAP,
 #endif
diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
index 48f0004db8c9..71c9e5183982 100644
--- a/arch/x86/include/asm/i387.h
+++ b/arch/x86/include/asm/i387.h
@@ -172,7 +172,13 @@ static inline void __save_init_fpu(struct task_struct *tsk)
 
 #else  /* CONFIG_X86_32 */
 
-extern void finit(void);
+#ifdef CONFIG_MATH_EMULATION
+extern void finit_task(struct task_struct *tsk);
+#else
+static inline void finit_task(struct task_struct *tsk)
+{
+}
+#endif
 
 static inline void tolerant_fwait(void)
 {
diff --git a/arch/x86/include/asm/iomap.h b/arch/x86/include/asm/iomap.h
index c1f06289b14b..86af26091d6c 100644
--- a/arch/x86/include/asm/iomap.h
+++ b/arch/x86/include/asm/iomap.h
@@ -23,6 +23,9 @@
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 
+int
+is_io_mapping_possible(resource_size_t base, unsigned long size);
+
 void *
 iomap_atomic_prot_pfn(unsigned long pfn, enum km_type type, pgprot_t prot);
 
diff --git a/arch/x86/include/asm/seccomp_32.h b/arch/x86/include/asm/seccomp_32.h
index a6ad87b352c4..b811d6f5780c 100644
--- a/arch/x86/include/asm/seccomp_32.h
+++ b/arch/x86/include/asm/seccomp_32.h
@@ -1,12 +1,6 @@
 #ifndef _ASM_X86_SECCOMP_32_H
 #define _ASM_X86_SECCOMP_32_H
 
-#include <linux/thread_info.h>
-
-#ifdef TIF_32BIT
-#error "unexpected TIF_32BIT on i386"
-#endif
-
 #include <linux/unistd.h>
 
 #define __NR_seccomp_read __NR_read
diff --git a/arch/x86/include/asm/seccomp_64.h b/arch/x86/include/asm/seccomp_64.h
index 4171bb794e9e..84ec1bd161a5 100644
--- a/arch/x86/include/asm/seccomp_64.h
+++ b/arch/x86/include/asm/seccomp_64.h
@@ -1,14 +1,6 @@
 #ifndef _ASM_X86_SECCOMP_64_H
 #define _ASM_X86_SECCOMP_64_H
 
-#include <linux/thread_info.h>
-
-#ifdef TIF_32BIT
-#error "unexpected TIF_32BIT on x86_64"
-#else
-#define TIF_32BIT TIF_IA32
-#endif
-
 #include <linux/unistd.h>
 #include <asm/ia32_unistd.h>
 
diff --git a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
index b585e04cbc9e..3178c3acd97e 100644
--- a/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
+++ b/arch/x86/kernel/cpu/cpufreq/p4-clockmod.c
@@ -277,7 +277,6 @@ static struct cpufreq_driver p4clockmod_driver = {
         .name           = "p4-clockmod",
         .owner          = THIS_MODULE,
         .attr           = p4clockmod_attr,
-        .hide_interface = 1,
 };
 
 
diff --git a/arch/x86/kernel/ds.c b/arch/x86/kernel/ds.c
index 169a120587be..87b67e3a765a 100644
--- a/arch/x86/kernel/ds.c
+++ b/arch/x86/kernel/ds.c
@@ -729,7 +729,7 @@ struct pebs_tracer *ds_request_pebs(struct task_struct *task,
 
         spin_unlock_irqrestore(&ds_lock, irq);
 
-        ds_write_config(tracer->ds.context, &tracer->trace.ds, ds_bts);
+        ds_write_config(tracer->ds.context, &tracer->trace.ds, ds_pebs);
         ds_resume_pebs(tracer);
 
         return tracer;
@@ -1029,5 +1029,4 @@ void ds_copy_thread(struct task_struct *tsk, struct task_struct *father)
 
 void ds_exit_thread(struct task_struct *tsk)
 {
-        WARN_ON(tsk->thread.ds_ctx);
 }
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 1119d247fe11..eb1ef3b67dd5 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -467,7 +467,7 @@ void __init efi_enter_virtual_mode(void)
         efi_memory_desc_t *md;
         efi_status_t status;
         unsigned long size;
-        u64 end, systab, addr, npages;
+        u64 end, systab, addr, npages, end_pfn;
         void *p, *va;
 
         efi.systab = NULL;
@@ -479,7 +479,10 @@ void __init efi_enter_virtual_mode(void)
                 size = md->num_pages << EFI_PAGE_SHIFT;
                 end = md->phys_addr + size;
 
-                if (PFN_UP(end) <= max_low_pfn_mapped)
+                end_pfn = PFN_UP(end);
+                if (end_pfn <= max_low_pfn_mapped
+                    || (end_pfn > (1UL << (32 - PAGE_SHIFT))
+                        && end_pfn <= max_pfn_mapped))
                         va = __va(md->phys_addr);
                 else
                         va = efi_ioremap(md->phys_addr, size);
diff --git a/arch/x86/kernel/efi_64.c b/arch/x86/kernel/efi_64.c
index 652c5287215f..cb783b92c50c 100644
--- a/arch/x86/kernel/efi_64.c
+++ b/arch/x86/kernel/efi_64.c
@@ -99,24 +99,11 @@ void __init efi_call_phys_epilog(void)
 
 void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size)
 {
-        static unsigned pages_mapped __initdata;
-        unsigned i, pages;
-        unsigned long offset;
+        unsigned long last_map_pfn;
 
-        pages = PFN_UP(phys_addr + size) - PFN_DOWN(phys_addr);
-        offset = phys_addr & ~PAGE_MASK;
-        phys_addr &= PAGE_MASK;
-
-        if (pages_mapped + pages > MAX_EFI_IO_PAGES)
+        last_map_pfn = init_memory_mapping(phys_addr, phys_addr + size);
+        if ((last_map_pfn << PAGE_SHIFT) < phys_addr + size)
                 return NULL;
 
-        for (i = 0; i < pages; i++) {
-                __set_fixmap(FIX_EFI_IO_MAP_FIRST_PAGE - pages_mapped,
-                             phys_addr, PAGE_KERNEL);
-                phys_addr += PAGE_SIZE;
-                pages_mapped++;
-        }
-
-        return (void __iomem *)__fix_to_virt(FIX_EFI_IO_MAP_FIRST_PAGE - \
-                                             (pages_mapped - pages)) + offset;
+        return (void __iomem *)__va(phys_addr);
 }
diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
index b0f61f0dcd0a..f2f8540a7f3d 100644
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -136,7 +136,7 @@ int init_fpu(struct task_struct *tsk)
 #ifdef CONFIG_X86_32
         if (!HAVE_HWFP) {
                 memset(tsk->thread.xstate, 0, xstate_size);
-                finit();
+                finit_task(tsk);
                 set_stopped_child_used_math(tsk);
                 return 0;
         }
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 5a4c23d89892..06ca07f6ad86 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -1388,7 +1388,7 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs,
 #ifdef CONFIG_X86_32
 # define IS_IA32        1
 #elif defined CONFIG_IA32_EMULATION
-# define IS_IA32        test_thread_flag(TIF_IA32)
+# define IS_IA32        is_compat_task()
 #else
 # define IS_IA32        0
 #endif
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 2b46eb41643b..4526b3a75ed2 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -217,6 +217,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq"),
                 },
         },
+        {       /* Handle problems with rebooting on Dell XPS710 */
+                .callback = set_bios_reboot,
+                .ident = "Dell XPS710",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Dell XPS710"),
+                },
+        },
         { }
 };
 
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index c461f6d69074..6a8811a69324 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -770,6 +770,9 @@ void __init setup_arch(char **cmdline_p)
 
         finish_e820_parsing();
 
+        if (efi_enabled)
+                efi_init();
+
         dmi_scan_machine();
 
         dmi_check_system(bad_bios_dmi_table);
@@ -789,8 +792,6 @@ void __init setup_arch(char **cmdline_p)
         insert_resource(&iomem_resource, &data_resource);
         insert_resource(&iomem_resource, &bss_resource);
 
-        if (efi_enabled)
-                efi_init();
 
 #ifdef CONFIG_X86_32
         if (ppro_with_ram_bug()) {
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 92f1c6f3e19d..960a8d9c049c 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -343,6 +343,11 @@ static void lguest_cpuid(unsigned int *ax, unsigned int *bx,
                  * flush_tlb_user() for both user and kernel mappings unless
                  * the Page Global Enable (PGE) feature bit is set. */
                 *dx |= 0x00002000;
+                /* We also lie, and say we're family id 5.  6 or greater
+                 * leads to a rdmsr in early_init_intel which we can't handle.
+                 * Family ID is returned as bits 8-12 in ax. */
+                *ax &= 0xFFFFF0FF;
+                *ax |= 0x00000500;
                 break;
         case 0x80000000:
                 /* Futureproof this a little: if they ask how much extended
@@ -589,19 +594,21 @@ static void __init lguest_init_IRQ(void)
                 /* Some systems map "vectors" to interrupts weirdly.  Lguest has
                  * a straightforward 1 to 1 mapping, so force that here. */
                 __get_cpu_var(vector_irq)[vector] = i;
-                if (vector != SYSCALL_VECTOR) {
-                        set_intr_gate(vector,
-                                      interrupt[vector-FIRST_EXTERNAL_VECTOR]);
-                        set_irq_chip_and_handler_name(i, &lguest_irq_controller,
-                                                      handle_level_irq,
-                                                      "level");
-                }
+                if (vector != SYSCALL_VECTOR)
+                        set_intr_gate(vector, interrupt[i]);
         }
         /* This call is required to set up for 4k stacks, where we have
          * separate stacks for hard and soft interrupts. */
         irq_ctx_init(smp_processor_id());
 }
 
+void lguest_setup_irq(unsigned int irq)
+{
+        irq_to_desc_alloc_cpu(irq, 0);
+        set_irq_chip_and_handler_name(irq, &lguest_irq_controller,
+                                      handle_level_irq, "level");
+}
+
 /*
  * Time.
  *
diff --git a/arch/x86/mach-voyager/voyager_smp.c b/arch/x86/mach-voyager/voyager_smp.c
index 7ffcdeec4631..b9cc84a2a4fc 100644
--- a/arch/x86/mach-voyager/voyager_smp.c
+++ b/arch/x86/mach-voyager/voyager_smp.c
@@ -65,7 +65,7 @@ static volatile unsigned long smp_invalidate_needed;
 
 /* Bitmask of CPUs present in the system - exported by i386_syms.c, used
  * by scheduler but indexed physically */
-cpumask_t phys_cpu_present_map = CPU_MASK_NONE;
+static cpumask_t voyager_phys_cpu_present_map = CPU_MASK_NONE;
 
 /* The internal functions */
 static void send_CPI(__u32 cpuset, __u8 cpi);
@@ -366,19 +366,19 @@ void __init find_smp_config(void)
         /* set up everything for just this CPU, we can alter
          * this as we start the other CPUs later */
         /* now get the CPU disposition from the extended CMOS */
-        cpus_addr(phys_cpu_present_map)[0] =
+        cpus_addr(voyager_phys_cpu_present_map)[0] =
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK);
-        cpus_addr(phys_cpu_present_map)[0] |=
+        cpus_addr(voyager_phys_cpu_present_map)[0] |=
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK + 1) << 8;
-        cpus_addr(phys_cpu_present_map)[0] |=
+        cpus_addr(voyager_phys_cpu_present_map)[0] |=
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK +
                                        2) << 16;
-        cpus_addr(phys_cpu_present_map)[0] |=
+        cpus_addr(voyager_phys_cpu_present_map)[0] |=
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK +
                                        3) << 24;
-        init_cpu_possible(&phys_cpu_present_map);
-        printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n",
-               cpus_addr(phys_cpu_present_map)[0]);
+        init_cpu_possible(&voyager_phys_cpu_present_map);
+        printk("VOYAGER SMP: voyager_phys_cpu_present_map = 0x%lx\n",
+               cpus_addr(voyager_phys_cpu_present_map)[0]);
         /* Here we set up the VIC to enable SMP */
         /* enable the CPIs by writing the base vector to their register */
         outb(VIC_DEFAULT_CPI_BASE, VIC_CPI_BASE_REGISTER);
@@ -628,15 +628,15 @@ void __init smp_boot_cpus(void)
                 /* now that the cat has probed the Voyager System Bus, sanity
                  * check the cpu map */
                 if (((voyager_quad_processors | voyager_extended_vic_processors)
-                     & cpus_addr(phys_cpu_present_map)[0]) !=
-                    cpus_addr(phys_cpu_present_map)[0]) {
+                     & cpus_addr(voyager_phys_cpu_present_map)[0]) !=
+                    cpus_addr(voyager_phys_cpu_present_map)[0]) {
                         /* should panic */
                         printk("\n\n***WARNING*** "
                                "Sanity check of CPU present map FAILED\n");
                 }
         } else if (voyager_level == 4)
                 voyager_extended_vic_processors =
-                    cpus_addr(phys_cpu_present_map)[0];
+                    cpus_addr(voyager_phys_cpu_present_map)[0];
 
         /* this sets up the idle task to run on the current cpu */
         voyager_extended_cpus = 1;
@@ -670,7 +670,7 @@ void __init smp_boot_cpus(void)
         /* loop over all the extended VIC CPUs and boot them.  The
          * Quad CPUs must be bootstrapped by their extended VIC cpu */
         for (i = 0; i < nr_cpu_ids; i++) {
-                if (i == boot_cpu_id || !cpu_isset(i, phys_cpu_present_map))
+                if (i == boot_cpu_id || !cpu_isset(i, voyager_phys_cpu_present_map))
                         continue;
                 do_boot_cpu(i);
                 /* This udelay seems to be needed for the Quad boots
diff --git a/arch/x86/math-emu/fpu_aux.c b/arch/x86/math-emu/fpu_aux.c
index 491e737ce547..aa0987088774 100644
--- a/arch/x86/math-emu/fpu_aux.c
+++ b/arch/x86/math-emu/fpu_aux.c
@@ -30,20 +30,29 @@ static void fclex(void)
 }
 
 /* Needs to be externally visible */
-void finit(void)
+void finit_task(struct task_struct *tsk)
 {
-        control_word = 0x037f;
-        partial_status = 0;
-        top = 0;                /* We don't keep top in the status word internally. */
-        fpu_tag_word = 0xffff;
+        struct i387_soft_struct *soft = &tsk->thread.xstate->soft;
+        struct address *oaddr, *iaddr;
+        soft->cwd = 0x037f;
+        soft->swd = 0;
+        soft->ftop = 0; /* We don't keep top in the status word internally. */
+        soft->twd = 0xffff;
         /* The behaviour is different from that detailed in
            Section 15.1.6 of the Intel manual */
-        operand_address.offset = 0;
-        operand_address.selector = 0;
-        instruction_address.offset = 0;
-        instruction_address.selector = 0;
-        instruction_address.opcode = 0;
-        no_ip_update = 1;
+        oaddr = (struct address *)&soft->foo;
+        oaddr->offset = 0;
+        oaddr->selector = 0;
+        iaddr = (struct address *)&soft->fip;
+        iaddr->offset = 0;
+        iaddr->selector = 0;
+        iaddr->opcode = 0;
+        soft->no_update = 1;
+}
+
+void finit(void)
+{
+        finit_task(current);
 }
 
 /*
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index e6d36b490250..b1352250096e 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -714,6 +714,8 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
         pos = start_pfn << PAGE_SHIFT;
         end_pfn = ((pos + (PMD_SIZE - 1)) >> PMD_SHIFT)
                         << (PMD_SHIFT - PAGE_SHIFT);
+        if (end_pfn > (end >> PAGE_SHIFT))
+                end_pfn = end >> PAGE_SHIFT;
         if (start_pfn < end_pfn) {
                 nr_range = save_mr(mr, nr_range, start_pfn, end_pfn, 0);
                 pos = end_pfn << PAGE_SHIFT;
diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
index ca53224fc56c..04102d42ff42 100644
--- a/arch/x86/mm/iomap_32.c
+++ b/arch/x86/mm/iomap_32.c
@@ -20,6 +20,17 @@
 #include <asm/pat.h>
 #include <linux/module.h>
 
+int is_io_mapping_possible(resource_size_t base, unsigned long size)
+{
+#ifndef CONFIG_X86_PAE
+        /* There is no way to map greater than 1 << 32 address without PAE */
+        if (base + size > 0x100000000ULL)
+                return 0;
+#endif
+        return 1;
+}
+EXPORT_SYMBOL_GPL(is_io_mapping_possible);
+
 /* Map 'pfn' using fixed map 'type' and protections 'prot'
  */
 void *
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 93d82038af4b..6a518dd08a36 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -32,11 +32,14 @@ struct kmmio_fault_page {
         struct list_head list;
         struct kmmio_fault_page *release_next;
         unsigned long page; /* location of the fault page */
+        bool old_presence; /* page presence prior to arming */
+        bool armed;
 
         /*
          * Number of times this page has been registered as a part
          * of a probe. If zero, page is disarmed and this may be freed.
-         * Used only by writers (RCU).
+         * Used only by writers (RCU) and post_kmmio_handler().
+         * Protected by kmmio_lock, when linked into kmmio_page_table.
          */
         int count;
 };
@@ -105,57 +108,85 @@ static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long page)
         return NULL;
 }
 
-static void set_page_present(unsigned long addr, bool present,
-                                                        unsigned int *pglevel)
+static void set_pmd_presence(pmd_t *pmd, bool present, bool *old)
+{
+        pmdval_t v = pmd_val(*pmd);
+        *old = !!(v & _PAGE_PRESENT);
+        v &= ~_PAGE_PRESENT;
+        if (present)
+                v |= _PAGE_PRESENT;
+        set_pmd(pmd, __pmd(v));
+}
+
+static void set_pte_presence(pte_t *pte, bool present, bool *old)
+{
+        pteval_t v = pte_val(*pte);
+        *old = !!(v & _PAGE_PRESENT);
+        v &= ~_PAGE_PRESENT;
+        if (present)
+                v |= _PAGE_PRESENT;
+        set_pte_atomic(pte, __pte(v));
+}
+
+static int set_page_presence(unsigned long addr, bool present, bool *old)
 {
-        pteval_t pteval;
-        pmdval_t pmdval;
         unsigned int level;
-        pmd_t *pmd;
         pte_t *pte = lookup_address(addr, &level);
 
         if (!pte) {
                 pr_err("kmmio: no pte for page 0x%08lx\n", addr);
-                return;
+                return -1;
         }
 
-        if (pglevel)
-                *pglevel = level;
-
         switch (level) {
         case PG_LEVEL_2M:
-                pmd = (pmd_t *)pte;
-                pmdval = pmd_val(*pmd) & ~_PAGE_PRESENT;
-                if (present)
-                        pmdval |= _PAGE_PRESENT;
-                set_pmd(pmd, __pmd(pmdval));
+                set_pmd_presence((pmd_t *)pte, present, old);
                 break;
-
         case PG_LEVEL_4K:
-                pteval = pte_val(*pte) & ~_PAGE_PRESENT;
-                if (present)
-                        pteval |= _PAGE_PRESENT;
-                set_pte_atomic(pte, __pte(pteval));
+                set_pte_presence(pte, present, old);
                 break;
-
         default:
                 pr_err("kmmio: unexpected page level 0x%x.\n", level);
-                return;
+                return -1;
         }
 
         __flush_tlb_one(addr);
+        return 0;
 }
 
-/** Mark the given page as not present. Access to it will trigger a fault. */
-static void arm_kmmio_fault_page(unsigned long page, unsigned int *pglevel)
+/*
+ * Mark the given page as not present. Access to it will trigger a fault.
+ *
+ * Struct kmmio_fault_page is protected by RCU and kmmio_lock, but the
+ * protection is ignored here. RCU read lock is assumed held, so the struct
+ * will not disappear unexpectedly. Furthermore, the caller must guarantee,
+ * that double arming the same virtual address (page) cannot occur.
+ *
+ * Double disarming on the other hand is allowed, and may occur when a fault
+ * and mmiotrace shutdown happen simultaneously.
+ */
+static int arm_kmmio_fault_page(struct kmmio_fault_page *f)
 {
-        set_page_present(page & PAGE_MASK, false, pglevel);
+        int ret;
+        WARN_ONCE(f->armed, KERN_ERR "kmmio page already armed.\n");
+        if (f->armed) {
+                pr_warning("kmmio double-arm: page 0x%08lx, ref %d, old %d\n",
+                                        f->page, f->count, f->old_presence);
+        }
+        ret = set_page_presence(f->page, false, &f->old_presence);
+        WARN_ONCE(ret < 0, KERN_ERR "kmmio arming 0x%08lx failed.\n", f->page);
+        f->armed = true;
+        return ret;
 }
 
-/** Mark the given page as present. */
-static void disarm_kmmio_fault_page(unsigned long page, unsigned int *pglevel)
+/** Restore the given page to saved presence state. */
+static void disarm_kmmio_fault_page(struct kmmio_fault_page *f)
 {
-        set_page_present(page & PAGE_MASK, true, pglevel);
+        bool tmp;
+        int ret = set_page_presence(f->page, f->old_presence, &tmp);
+        WARN_ONCE(ret < 0,
+                        KERN_ERR "kmmio disarming 0x%08lx failed.\n", f->page);
+        f->armed = false;
 }
 
 /*
@@ -202,28 +233,32 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
 
         ctx = &get_cpu_var(kmmio_ctx);
         if (ctx->active) {
-                disarm_kmmio_fault_page(faultpage->page, NULL);
                 if (addr == ctx->addr) {
                         /*
-                         * On SMP we sometimes get recursive probe hits on the
-                         * same address. Context is already saved, fall out.
+                         * A second fault on the same page means some other
+                         * condition needs handling by do_page_fault(), the
+                         * page really not being present is the most common.
                          */
-                        pr_debug("kmmio: duplicate probe hit on CPU %d, for "
-                                                "address 0x%08lx.\n",
-                                                smp_processor_id(), addr);
-                        ret = 1;
-                        goto no_kmmio_ctx;
-                }
-                /*
-                 * Prevent overwriting already in-flight context.
-                 * This should not happen, let's hope disarming at least
-                 * prevents a panic.
-                 */
-                pr_emerg("kmmio: recursive probe hit on CPU %d, "
+                        pr_debug("kmmio: secondary hit for 0x%08lx CPU %d.\n",
+                                        addr, smp_processor_id());
+
+                        if (!faultpage->old_presence)
+                                pr_info("kmmio: unexpected secondary hit for "
+                                        "address 0x%08lx on CPU %d.\n", addr,
+                                        smp_processor_id());
+                } else {
+                        /*
+                         * Prevent overwriting already in-flight context.
+                         * This should not happen, let's hope disarming at
+                         * least prevents a panic.
+                         */
+                        pr_emerg("kmmio: recursive probe hit on CPU %d, "
                                         "for address 0x%08lx. Ignoring.\n",
                                         smp_processor_id(), addr);
-                pr_emerg("kmmio: previous hit was at 0x%08lx.\n",
-                                        ctx->addr);
+                        pr_emerg("kmmio: previous hit was at 0x%08lx.\n",
+                                                ctx->addr);
+                        disarm_kmmio_fault_page(faultpage);
+                }
                 goto no_kmmio_ctx;
         }
         ctx->active++;
@@ -244,7 +279,7 @@ int kmmio_handler(struct pt_regs *regs, unsigned long addr)
         regs->flags &= ~X86_EFLAGS_IF;
 
         /* Now we set present bit in PTE and single step. */
-        disarm_kmmio_fault_page(ctx->fpage->page, NULL);
+        disarm_kmmio_fault_page(ctx->fpage);
 
         /*
          * If another cpu accesses the same page while we are stepping,
@@ -275,7 +310,7 @@ static int post_kmmio_handler(unsigned long condition, struct pt_regs *regs)
         struct kmmio_context *ctx = &get_cpu_var(kmmio_ctx);
 
         if (!ctx->active) {
-                pr_debug("kmmio: spurious debug trap on CPU %d.\n",
+                pr_warning("kmmio: spurious debug trap on CPU %d.\n",
                                                         smp_processor_id());
                 goto out;
         }
@@ -283,7 +318,11 @@ static int post_kmmio_handler(unsigned long condition, struct pt_regs *regs)
         if (ctx->probe && ctx->probe->post_handler)
                 ctx->probe->post_handler(ctx->probe, condition, regs);
 
-        arm_kmmio_fault_page(ctx->fpage->page, NULL);
+        /* Prevent racing against release_kmmio_fault_page(). */
+        spin_lock(&kmmio_lock);
+        if (ctx->fpage->count)
+                arm_kmmio_fault_page(ctx->fpage);
+        spin_unlock(&kmmio_lock);
 
         regs->flags &= ~X86_EFLAGS_TF;
         regs->flags |= ctx->saved_flags;
@@ -315,20 +354,24 @@ static int add_kmmio_fault_page(unsigned long page)
         f = get_kmmio_fault_page(page);
         if (f) {
                 if (!f->count)
-                        arm_kmmio_fault_page(f->page, NULL);
+                        arm_kmmio_fault_page(f);
                 f->count++;
                 return 0;
         }
 
-        f = kmalloc(sizeof(*f), GFP_ATOMIC);
+        f = kzalloc(sizeof(*f), GFP_ATOMIC);
         if (!f)
                 return -1;
 
         f->count = 1;
         f->page = page;
-        list_add_rcu(&f->list, kmmio_page_list(f->page));
 
-        arm_kmmio_fault_page(f->page, NULL);
+        if (arm_kmmio_fault_page(f)) {
+                kfree(f);
+                return -1;
+        }
+
+        list_add_rcu(&f->list, kmmio_page_list(f->page));
 
         return 0;
 }
@@ -347,7 +390,7 @@ static void release_kmmio_fault_page(unsigned long page,
         f->count--;
         BUG_ON(f->count < 0);
         if (!f->count) {
-                disarm_kmmio_fault_page(f->page, NULL);
+                disarm_kmmio_fault_page(f);
                 f->release_next = *release_list;
                 *release_list = f;
         }
@@ -408,23 +451,24 @@ static void rcu_free_kmmio_fault_pages(struct rcu_head *head)
 
 static void remove_kmmio_fault_pages(struct rcu_head *head)
 {
-        struct kmmio_delayed_release *dr = container_of(
-                                                head,
-                                                struct kmmio_delayed_release,
-                                                rcu);
+        struct kmmio_delayed_release *dr =
+                container_of(head, struct kmmio_delayed_release, rcu);
         struct kmmio_fault_page *p = dr->release_list;
         struct kmmio_fault_page **prevp = &dr->release_list;
         unsigned long flags;
+
         spin_lock_irqsave(&kmmio_lock, flags);
         while (p) {
-                if (!p->count)
+                if (!p->count) {
                         list_del_rcu(&p->list);
-                else
+                        prevp = &p->release_next;
+                } else {
                         *prevp = p->release_next;
-                prevp = &p->release_next;
+                }
                 p = p->release_next;
         }
         spin_unlock_irqrestore(&kmmio_lock, flags);
+
         /* This is the real RCU destroy call. */
         call_rcu(&dr->rcu, rcu_free_kmmio_fault_pages);
 }
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 7be47d1a97e4..7233bd7e357b 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -515,6 +515,17 @@ static int split_large_page(pte_t *kpte, unsigned long address)
          * primary protection behavior:
          */
         __set_pmd_pte(kpte, address, mk_pte(base, __pgprot(_KERNPG_TABLE)));
+
+        /*
+         * Intel Atom errata AAH41 workaround.
+         *
+         * The real fix should be in hw or in a microcode update, but
+         * we also probabilistically try to reduce the window of having
+         * a large TLB mixed with 4K TLBs while instruction fetches are
+         * going on.
+         */
+        __flush_tlb_all();
+
         base = NULL;
 
 out_unlock:
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index aebbf67a79d0..e0ab173b6974 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -11,6 +11,7 @@
 #include <linux/bootmem.h>
 #include <linux/debugfs.h>
 #include <linux/kernel.h>
+#include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
@@ -868,6 +869,7 @@ pgprot_t pgprot_writecombine(pgprot_t prot)
         else
                 return pgprot_noncached(prot);
 }
+EXPORT_SYMBOL_GPL(pgprot_writecombine);
 
 #if defined(CONFIG_DEBUG_FS) && defined(CONFIG_X86_PAT)
 
diff --git a/arch/x86/mm/testmmiotrace.c b/arch/x86/mm/testmmiotrace.c
index ab50a8d7402c..427fd1b56df5 100644
--- a/arch/x86/mm/testmmiotrace.c
+++ b/arch/x86/mm/testmmiotrace.c
@@ -1,5 +1,5 @@
 /*
- * Written by Pekka Paalanen, 2008 <pq@iki.fi>
+ * Written by Pekka Paalanen, 2008-2009 <pq@iki.fi>
  */
 #include <linux/module.h>
 #include <linux/io.h>
@@ -9,35 +9,74 @@
 
 static unsigned long mmio_address;
 module_param(mmio_address, ulong, 0);
-MODULE_PARM_DESC(mmio_address, "Start address of the mapping of 16 kB.");
+MODULE_PARM_DESC(mmio_address, " Start address of the mapping of 16 kB "
+                                "(or 8 MB if read_far is non-zero).");
+
+static unsigned long read_far = 0x400100;
+module_param(read_far, ulong, 0);
+MODULE_PARM_DESC(read_far, " Offset of a 32-bit read within 8 MB "
+                                "(default: 0x400100).");
+
+static unsigned v16(unsigned i)
+{
+        return i * 12 + 7;
+}
+
+static unsigned v32(unsigned i)
+{
+        return i * 212371 + 13;
+}
 
 static void do_write_test(void __iomem *p)
 {
         unsigned int i;
+        pr_info(MODULE_NAME ": write test.\n");
         mmiotrace_printk("Write test.\n");
+
         for (i = 0; i < 256; i++)
                 iowrite8(i, p + i);
+
         for (i = 1024; i < (5 * 1024); i += 2)
-                iowrite16(i * 12 + 7, p + i);
+                iowrite16(v16(i), p + i);
+
         for (i = (5 * 1024); i < (16 * 1024); i += 4)
-                iowrite32(i * 212371 + 13, p + i);
+                iowrite32(v32(i), p + i);
 }
 
 static void do_read_test(void __iomem *p)
 {
         unsigned int i;
+        unsigned errs[3] = { 0 };
+        pr_info(MODULE_NAME ": read test.\n");
         mmiotrace_printk("Read test.\n");
+
         for (i = 0; i < 256; i++)
-                ioread8(p + i);
+                if (ioread8(p + i) != i)
+                        ++errs[0];
+
         for (i = 1024; i < (5 * 1024); i += 2)
-                ioread16(p + i);
+                if (ioread16(p + i) != v16(i))
+                        ++errs[1];
+
         for (i = (5 * 1024); i < (16 * 1024); i += 4)
-                ioread32(p + i);
+                if (ioread32(p + i) != v32(i))
+                        ++errs[2];
+
+        mmiotrace_printk("Read errors: 8-bit %d, 16-bit %d, 32-bit %d.\n",
+                                                errs[0], errs[1], errs[2]);
 }
 
-static void do_test(void)
+static void do_read_far_test(void __iomem *p)
 {
-        void __iomem *p = ioremap_nocache(mmio_address, 0x4000);
+        pr_info(MODULE_NAME ": read far test.\n");
+        mmiotrace_printk("Read far test.\n");
+
+        ioread32(p + read_far);
+}
+
+static void do_test(unsigned long size)
+{
+        void __iomem *p = ioremap_nocache(mmio_address, size);
         if (!p) {
                 pr_err(MODULE_NAME ": could not ioremap, aborting.\n");
                 return;
@@ -45,11 +84,15 @@ static void do_test(void)
         mmiotrace_printk("ioremap returned %p.\n", p);
         do_write_test(p);
         do_read_test(p);
+        if (read_far && read_far < size - 4)
+                do_read_far_test(p);
         iounmap(p);
 }
 
 static int __init init(void)
 {
+        unsigned long size = (read_far) ? (8 << 20) : (16 << 10);
+
         if (mmio_address == 0) {
                 pr_err(MODULE_NAME ": you have to use the module argument "
                                                         "mmio_address.\n");
@@ -58,10 +101,11 @@ static int __init init(void)
                 return -ENXIO;
         }
 
-        pr_warning(MODULE_NAME ": WARNING: mapping 16 kB @ 0x%08lx "
-                                        "in PCI address space, and writing "
-                                        "rubbish in there.\n", mmio_address);
-        do_test();
+        pr_warning(MODULE_NAME ": WARNING: mapping %lu kB @ 0x%08lx in PCI "
+                "address space, and writing 16 kB of rubbish in there.\n",
+                 size >> 10, mmio_address);
+        do_test(size);
+        pr_info(MODULE_NAME ": All done.\n");
         return 0;
 }
 
diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c
index e9f80c744cf3..10131fbdaada 100644
--- a/arch/x86/oprofile/op_model_ppro.c
+++ b/arch/x86/oprofile/op_model_ppro.c
@@ -78,8 +78,18 @@ static void ppro_setup_ctrs(struct op_msrs const * const msrs)
         if (cpu_has_arch_perfmon) {
                 union cpuid10_eax eax;
                 eax.full = cpuid_eax(0xa);
-                if (counter_width < eax.split.bit_width)
-                        counter_width = eax.split.bit_width;
+
+                /*
+                 * For Core2 (family 6, model 15), don't reset the
+                 * counter width:
+                 */
+                if (!(eax.split.version_id == 0 &&
+                        current_cpu_data.x86 == 6 &&
+                                current_cpu_data.x86_model == 15)) {
+
+                        if (counter_width < eax.split.bit_width)
+                                counter_width = eax.split.bit_width;
+                }
         }
 
         /* clear all counters */
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index bea215230b20..b58e96338149 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1672,6 +1672,9 @@ asmlinkage void __init xen_start_kernel(void)
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
 
+        local_irq_disable();
+        early_boot_irqs_off();
+
         xen_raw_console_write("mapping kernel into physical memory\n");
         pgd = xen_setup_kernel_pagetable(pgd, xen_start_info->nr_pages);
 
diff --git a/arch/xtensa/Kconfig b/arch/xtensa/Kconfig
index 6c873dceb177..981200830432 100644
--- a/arch/xtensa/Kconfig
+++ b/arch/xtensa/Kconfig
@@ -103,9 +103,6 @@ config MATH_EMULATION
         help
         Can we use information of configuration file?
 
-config HIGHMEM
-        bool "High memory support"
-
 endmenu
 
 menu "Platform options"
diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 9606d2bd1dd9..4ec1633c2941 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -44,6 +44,8 @@
 #include <asm/setup.h>
 #include <asm/param.h>
 
+#include <platform/hardware.h>
+
 #if defined(CONFIG_VGA_CONSOLE) || defined(CONFIG_DUMMY_CONSOLE)
 struct screen_info screen_info = { 0, 24, 0, 0, 0, 80, 0, 0, 0, 24, 1, 16};
 #endif
diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c
index c7a021d9f696..c44f830b6c7a 100644
--- a/arch/xtensa/kernel/traps.c
+++ b/arch/xtensa/kernel/traps.c
@@ -30,6 +30,7 @@
 #include <linux/stringify.h>
 #include <linux/kallsyms.h>
 #include <linux/delay.h>
+#include <linux/hardirq.h>
 
 #include <asm/ptrace.h>
 #include <asm/timex.h>
diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
index 33f366be323f..bdd860d93f72 100644
--- a/arch/xtensa/mm/fault.c
+++ b/arch/xtensa/mm/fault.c
@@ -14,6 +14,7 @@
 
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/hardirq.h>
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
 #include <asm/hardirq.h>
diff --git a/arch/xtensa/platforms/iss/console.c b/arch/xtensa/platforms/iss/console.c
index efed8897bef3..25d46c84eb08 100644
--- a/arch/xtensa/platforms/iss/console.c
+++ b/arch/xtensa/platforms/iss/console.c
@@ -140,16 +140,14 @@ static void rs_poll(unsigned long priv)
 }
 
 
-static void rs_put_char(struct tty_struct *tty, unsigned char ch)
+static int rs_put_char(struct tty_struct *tty, unsigned char ch)
 {
         char buf[2];
 
-        if (!tty)
-                return;
-
         buf[0] = ch;
         buf[1] = '\0';          /* Is this NULL necessary? */
         __simc (SYS_write, 1, (unsigned long) buf, 1, 0, 0);
+        return 1;
 }
 
 static void rs_flush_chars(struct tty_struct *tty)
diff --git a/block/blk-merge.c b/block/blk-merge.c
index b92f5b0866b0..5a244f05360f 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -38,72 +38,77 @@ void blk_recalc_rq_sectors(struct request *rq, int nsect)
         }
 }
 
-void blk_recalc_rq_segments(struct request *rq)
+static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
+                                             struct bio *bio)
 {
-        int nr_phys_segs;
         unsigned int phys_size;
         struct bio_vec *bv, *bvprv = NULL;
-        int seg_size;
-        int cluster;
-        struct req_iterator iter;
-        int high, highprv = 1;
-        struct request_queue *q = rq->q;
+        int cluster, i, high, highprv = 1;
+        unsigned int seg_size, nr_phys_segs;
+        struct bio *fbio, *bbio;
 
-        if (!rq->bio)
-                return;
+        if (!bio)
+                return 0;
 
+        fbio = bio;
         cluster = test_bit(QUEUE_FLAG_CLUSTER, &q->queue_flags);
         seg_size = 0;
         phys_size = nr_phys_segs = 0;
-        rq_for_each_segment(bv, rq, iter) {
-                /*
-                 * the trick here is making sure that a high page is never
-                 * considered part of another segment, since that might
-                 * change with the bounce page.
-                 */
-                high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
-                if (high || highprv)
-                        goto new_segment;
-                if (cluster) {
-                        if (seg_size + bv->bv_len > q->max_segment_size)
-                                goto new_segment;
-                        if (!BIOVEC_PHYS_MERGEABLE(bvprv, bv))
-                                goto new_segment;
-                        if (!BIOVEC_SEG_BOUNDARY(q, bvprv, bv))
+        for_each_bio(bio) {
+                bio_for_each_segment(bv, bio, i) {
+                        /*
+                         * the trick here is making sure that a high page is
+                         * never considered part of another segment, since that
+                         * might change with the bounce page.
+                         */
+                        high = page_to_pfn(bv->bv_page) > q->bounce_pfn;
+                        if (high || highprv)
                                 goto new_segment;
+                        if (cluster) {
+                                if (seg_size + bv->bv_len > q->max_segment_size)
+                                        goto new_segment;
+                                if (!BIOVEC_PHYS_MERGEABLE(bvprv, bv))
+                                        goto new_segment;
+                                if (!BIOVEC_SEG_BOUNDARY(q, bvprv, bv))
+                                        goto new_segment;
+
+                                seg_size += bv->bv_len;
+                                bvprv = bv;
+                                continue;
+                        }
+new_segment:
+                        if (nr_phys_segs == 1 && seg_size >
+                            fbio->bi_seg_front_size)
+                                fbio->bi_seg_front_size = seg_size;
 
-                        seg_size += bv->bv_len;
+                        nr_phys_segs++;
                         bvprv = bv;
-                        continue;
+                        seg_size = bv->bv_len;
+                        highprv = high;
                 }
-new_segment:
-                if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
-                        rq->bio->bi_seg_front_size = seg_size;
-
-                nr_phys_segs++;
-                bvprv = bv;
-                seg_size = bv->bv_len;
-                highprv = high;
+                bbio = bio;
         }
 
-        if (nr_phys_segs == 1 && seg_size > rq->bio->bi_seg_front_size)
-                rq->bio->bi_seg_front_size = seg_size;
-        if (seg_size > rq->biotail->bi_seg_back_size)
-                rq->biotail->bi_seg_back_size = seg_size;
+        if (nr_phys_segs == 1 && seg_size > fbio->bi_seg_front_size)
+                fbio->bi_seg_front_size = seg_size;
+        if (seg_size > bbio->bi_seg_back_size)
+                bbio->bi_seg_back_size = seg_size;
+
+        return nr_phys_segs;
+}
 
-        rq->nr_phys_segments = nr_phys_segs;
+void blk_recalc_rq_segments(struct request *rq)
+{
+        rq->nr_phys_segments = __blk_recalc_rq_segments(rq->q, rq->bio);
 }
 
 void blk_recount_segments(struct request_queue *q, struct bio *bio)
 {
-        struct request rq;
         struct bio *nxt = bio->bi_next;
-        rq.q = q;
-        rq.bio = rq.biotail = bio;
+
         bio->bi_next = NULL;
-        blk_recalc_rq_segments(&rq);
+        bio->bi_phys_segments = __blk_recalc_rq_segments(q, bio);
         bio->bi_next = nxt;
-        bio->bi_phys_segments = rq.nr_phys_segments;
         bio->bi_flags |= (1 << BIO_SEG_VALID);
 }
 EXPORT_SYMBOL(blk_recount_segments);
diff --git a/block/genhd.c b/block/genhd.c
index e1eadcc9546a..a9ec910974c1 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -256,6 +256,22 @@ void blkdev_show(struct seq_file *seqf, off_t offset)
 }
 #endif /* CONFIG_PROC_FS */
 
+/**
+ * register_blkdev - register a new block device
+ *
+ * @major: the requested major device number [1..255]. If @major=0, try to
+ *         allocate any unused major number.
+ * @name: the name of the new block device as a zero terminated string
+ *
+ * The @name must be unique within the system.
+ *
+ * The return value depends on the @major input parameter.
+ *  - if a major device number was requested in range [1..255] then the
+ *    function returns zero on success, or a negative error code
+ *  - if any unused major number was requested with @major=0 parameter
+ *    then the return value is the allocated major number in range
+ *    [1..255] or a negative error code otherwise
+ */
 int register_blkdev(unsigned int major, const char *name)
 {
         struct blk_major_name **n, *p;
diff --git a/crypto/api.c b/crypto/api.c
index efe77df6863f..38a2bc02a98c 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -215,8 +215,19 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask)
         mask &= ~(CRYPTO_ALG_LARVAL | CRYPTO_ALG_DEAD);
         type &= mask;
 
-        alg = try_then_request_module(crypto_alg_lookup(name, type, mask),
-                                      name);
+        alg = crypto_alg_lookup(name, type, mask);
+        if (!alg) {
+                char tmp[CRYPTO_MAX_ALG_NAME];
+
+                request_module(name);
+
+                if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask) &&
+                    snprintf(tmp, sizeof(tmp), "%s-all", name) < sizeof(tmp))
+                        request_module(tmp);
+
+                alg = crypto_alg_lookup(name, type, mask);
+        }
+
         if (alg)
                 return crypto_is_larval(alg) ? crypto_larval_wait(alg) : alg;
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index a603bbf9b1b7..66e012cd3271 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -582,18 +582,18 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(NVIDIA, 0x0abd), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abe), board_ahci },            /* MCP79 */
         { PCI_VDEVICE(NVIDIA, 0x0abf), board_ahci },            /* MCP79 */
-        { PCI_VDEVICE(NVIDIA, 0x0bc8), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc9), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bca), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcb), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcc), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcd), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bce), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bcf), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc4), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc5), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc6), board_ahci },            /* MCP7B */
-        { PCI_VDEVICE(NVIDIA, 0x0bc7), board_ahci },            /* MCP7B */
+        { PCI_VDEVICE(NVIDIA, 0x0d84), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d85), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d86), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d87), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d88), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d89), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8a), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8b), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8c), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8d), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8e), board_ahci },            /* MCP89 */
+        { PCI_VDEVICE(NVIDIA, 0x0d8f), board_ahci },            /* MCP89 */
 
         /* SiS */
         { PCI_VDEVICE(SI, 0x1184), board_ahci },                /* SiS 966 */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 9fbf0595f3d4..060bcd601f57 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1322,14 +1322,16 @@ static u64 ata_id_n_sectors(const u16 *id)
 {
         if (ata_id_has_lba(id)) {
                 if (ata_id_has_lba48(id))
-                        return ata_id_u64(id, 100);
+                        return ata_id_u64(id, ATA_ID_LBA_CAPACITY_2);
                 else
-                        return ata_id_u32(id, 60);
+                        return ata_id_u32(id, ATA_ID_LBA_CAPACITY);
         } else {
                 if (ata_id_current_chs_valid(id))
-                        return ata_id_u32(id, 57);
+                        return id[ATA_ID_CUR_CYLS] * id[ATA_ID_CUR_HEADS] *
+                               id[ATA_ID_CUR_SECTORS];
                 else
-                        return id[1] * id[3] * id[6];
+                        return id[ATA_ID_CYLS] * id[ATA_ID_HEADS] *
+                               id[ATA_ID_SECTORS];
         }
 }
 
@@ -4612,7 +4614,7 @@ void ata_sg_clean(struct ata_queued_cmd *qc)
         VPRINTK("unmapping %u sg elements\n", qc->n_elem);
 
         if (qc->n_elem)
-                dma_unmap_sg(ap->dev, sg, qc->n_elem, dir);
+                dma_unmap_sg(ap->dev, sg, qc->orig_n_elem, dir);
 
         qc->flags &= ~ATA_QCFLAG_DMAMAP;
         qc->sg = NULL;
@@ -4727,7 +4729,7 @@ static int ata_sg_setup(struct ata_queued_cmd *qc)
                 return -1;
 
         DPRINTK("%d sg elements mapped\n", n_elem);
-
+        qc->orig_n_elem = qc->n_elem;
         qc->n_elem = n_elem;
         qc->flags |= ATA_QCFLAG_DMAMAP;
 
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index ce2ef0475339..ea890911d4fa 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2423,11 +2423,14 @@ int ata_eh_reset(struct ata_link *link, int classify,
                 }
 
                 /* prereset() might have cleared ATA_EH_RESET.  If so,
-                 * bang classes and return.
+                 * bang classes, thaw and return.
                  */
                 if (reset && !(ehc->i.action & ATA_EH_RESET)) {
                         ata_for_each_dev(dev, link, ALL)
                                 classes[dev->devno] = ATA_DEV_NONE;
+                        if ((ap->pflags & ATA_PFLAG_FROZEN) &&
+                            ata_is_host_link(link))
+                                ata_eh_thaw_port(ap);
                         rc = 0;
                         goto out;
                 }
@@ -2901,7 +2904,7 @@ static int atapi_eh_clear_ua(struct ata_device *dev)
         int i;
 
         for (i = 0; i < ATA_EH_UA_TRIES; i++) {
-                u8 sense_buffer[SCSI_SENSE_BUFFERSIZE];
+                u8 *sense_buffer = dev->link->ap->sector_buf;
                 u8 sense_key = 0;
                 unsigned int err_mask;
 
diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c
index 63719ab9ea44..115b1cd6dcf5 100644
--- a/drivers/ata/pata_amd.c
+++ b/drivers/ata/pata_amd.c
@@ -24,7 +24,7 @@
 #include <linux/libata.h>
 
 #define DRV_NAME "pata_amd"
-#define DRV_VERSION "0.3.11"
+#define DRV_VERSION "0.4.1"
 
 /**
  *      timing_setup            -       shared timing computation and load
@@ -145,6 +145,13 @@ static int amd_pre_reset(struct ata_link *link, unsigned long deadline)
         return ata_sff_prereset(link, deadline);
 }
 
+/**
+ *      amd_cable_detect        -       report cable type
+ *      @ap: port
+ *
+ *      AMD controller/BIOS setups record the cable type in word 0x42
+ */
+
 static int amd_cable_detect(struct ata_port *ap)
 {
         static const u32 bitmask[2] = {0x03, 0x0C};
@@ -158,6 +165,40 @@ static int amd_cable_detect(struct ata_port *ap)
 }
 
 /**
+ *      amd_fifo_setup          -       set the PIO FIFO for ATA/ATAPI
+ *      @ap: ATA interface
+ *      @adev: ATA device
+ *
+ *      Set the PCI fifo for this device according to the devices present
+ *      on the bus at this point in time. We need to turn the post write buffer
+ *      off for ATAPI devices as we may need to issue a word sized write to the
+ *      device as the final I/O
+ */
+
+static void amd_fifo_setup(struct ata_port *ap)
+{
+        struct ata_device *adev;
+        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
+        static const u8 fifobit[2] = { 0xC0, 0x30};
+        u8 fifo = fifobit[ap->port_no];
+        u8 r;
+
+
+        ata_for_each_dev(adev, &ap->link, ENABLED) {
+                if (adev->class == ATA_DEV_ATAPI)
+                        fifo = 0;
+        }
+        if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7411) /* FIFO is broken */
+                fifo = 0;
+
+        /* On the later chips the read prefetch bits become no-op bits */
+        pci_read_config_byte(pdev, 0x41, &r);
+        r &= ~fifobit[ap->port_no];
+        r |= fifo;
+        pci_write_config_byte(pdev, 0x41, r);
+}
+
+/**
  *      amd33_set_piomode       -       set initial PIO mode data
  *      @ap: ATA interface
  *      @adev: ATA device
@@ -167,21 +208,25 @@ static int amd_cable_detect(struct ata_port *ap)
 
 static void amd33_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 1);
 }
 
 static void amd66_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 2);
 }
 
 static void amd100_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 3);
 }
 
 static void amd133_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
+        amd_fifo_setup(ap);
         timing_setup(ap, adev, 0x40, adev->pio_mode, 4);
 }
 
@@ -397,6 +442,16 @@ static struct ata_port_operations nv133_port_ops = {
         .set_dmamode    = nv133_set_dmamode,
 };
 
+static void amd_clear_fifo(struct pci_dev *pdev)
+{
+        u8 fifo;
+        /* Disable the FIFO, the FIFO logic will re-enable it as
+           appropriate */
+        pci_read_config_byte(pdev, 0x41, &fifo);
+        fifo &= 0x0F;
+        pci_write_config_byte(pdev, 0x41, fifo);
+}
+
 static int amd_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 {
         static const struct ata_port_info info[10] = {
@@ -503,14 +558,8 @@ static int amd_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
 
         if (type < 3)
                 ata_pci_bmdma_clear_simplex(pdev);
-
-        /* Check for AMD7411 */
-        if (type == 3)
-                /* FIFO is broken */
-                pci_write_config_byte(pdev, 0x41, fifo & 0x0F);
-        else
-                pci_write_config_byte(pdev, 0x41, fifo | 0xF0);
-
+        if (pdev->vendor == PCI_VENDOR_ID_AMD)
+                amd_clear_fifo(pdev);
         /* Cable detection on Nvidia chips doesn't work too well,
          * cache BIOS programmed UDMA mode.
          */
@@ -536,18 +585,11 @@ static int amd_reinit_one(struct pci_dev *pdev)
                 return rc;
 
         if (pdev->vendor == PCI_VENDOR_ID_AMD) {
-                u8 fifo;
-                pci_read_config_byte(pdev, 0x41, &fifo);
-                if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7411)
-                        /* FIFO is broken */
-                        pci_write_config_byte(pdev, 0x41, fifo & 0x0F);
-                else
-                        pci_write_config_byte(pdev, 0x41, fifo | 0xF0);
+                amd_clear_fifo(pdev);
                 if (pdev->device == PCI_DEVICE_ID_AMD_VIPER_7409 ||
                     pdev->device == PCI_DEVICE_ID_AMD_COBRA_7401)
                         ata_pci_bmdma_clear_simplex(pdev);
         }
-
         ata_host_resume(host);
         return 0;
 }
diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
index f1bb2f9fecbf..b05b86a912c5 100644
--- a/drivers/ata/pata_it821x.c
+++ b/drivers/ata/pata_it821x.c
@@ -557,6 +557,9 @@ static unsigned int it821x_read_id(struct ata_device *adev,
                 id[83] |= 0x4400;       /* Word 83 is valid and LBA48 */
                 id[86] |= 0x0400;       /* LBA48 on */
                 id[ATA_ID_MAJOR_VER] |= 0x1F;
+                /* Clear the serial number because it's different each boot
+                   which breaks validation on resume */
+                memset(&id[ATA_ID_SERNO], 0x20, ATA_ID_SERNO_LEN);
         }
         return err_mask;
 }
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index 6c1d778b63a9..e3bc1b436284 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -283,9 +283,10 @@ static void pdc20230_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static unsigned int pdc_data_xfer_vlb(struct ata_device *dev,
                         unsigned char *buf, unsigned int buflen, int rw)
 {
-        if (ata_id_has_dword_io(dev->id)) {
+        int slop = buflen & 3;
+        /* 32bit I/O capable *and* we need to write a whole number of dwords */
+        if (ata_id_has_dword_io(dev->id) && (slop == 0 || slop == 3)) {
                 struct ata_port *ap = dev->link->ap;
-                int slop = buflen & 3;
                 unsigned long flags;
 
                 local_irq_save(flags);
@@ -735,7 +736,7 @@ static unsigned int vlb32_data_xfer(struct ata_device *adev, unsigned char *buf,
         struct ata_port *ap = adev->link->ap;
         int slop = buflen & 3;
 
-        if (ata_id_has_dword_io(adev->id)) {
+        if (ata_id_has_dword_io(adev->id) && (slop == 0 || slop == 3)) {
                 if (rw == WRITE)
                         iowrite32_rep(ap->ioaddr.data_addr, buf, buflen >> 2);
                 else
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 4ae1a4138b47..7007edd2d451 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -3114,19 +3114,17 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
                 writelfl(0, hc_mmio + HC_IRQ_CAUSE_OFS);
         }
 
-        if (!IS_SOC(hpriv)) {
-                /* Clear any currently outstanding host interrupt conditions */
-                writelfl(0, mmio + hpriv->irq_cause_ofs);
+        /* Clear any currently outstanding host interrupt conditions */
+        writelfl(0, mmio + hpriv->irq_cause_ofs);
 
-                /* and unmask interrupt generation for host regs */
-                writelfl(hpriv->unmask_all_irqs, mmio + hpriv->irq_mask_ofs);
+        /* and unmask interrupt generation for host regs */
+        writelfl(hpriv->unmask_all_irqs, mmio + hpriv->irq_mask_ofs);
 
-                /*
-                 * enable only global host interrupts for now.
-                 * The per-port interrupts get done later as ports are set up.
-                 */
-                mv_set_main_irq_mask(host, 0, PCI_ERR);
-        }
+        /*
+         * enable only global host interrupts for now.
+         * The per-port interrupts get done later as ports are set up.
+         */
+        mv_set_main_irq_mask(host, 0, PCI_ERR);
 done:
         return rc;
 }
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 55a8eed3f3a3..f65b53785a8f 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -2523,7 +2523,7 @@ static void __exit nv_exit(void)
 module_init(nv_init);
 module_exit(nv_exit);
 module_param_named(adma, adma_enabled, bool, 0444);
-MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: true)");
+MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: false)");
 module_param_named(swncq, swncq_enabled, bool, 0444);
 MODULE_PARM_DESC(swncq, "Enable use of SWNCQ (Default: true)");
 
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 43fa90b837ee..f8f578a71b25 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -303,7 +303,7 @@ int unregister_mem_sect_under_nodes(struct memory_block *mem_blk)
         sect_start_pfn = section_nr_to_pfn(mem_blk->phys_index);
         sect_end_pfn = sect_start_pfn + PAGES_PER_SECTION - 1;
         for (pfn = sect_start_pfn; pfn <= sect_end_pfn; pfn++) {
-                unsigned int nid;
+                int nid;
 
                 nid = get_nid_for_pfn(pfn);
                 if (nid < 0)
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index cc250577d405..eeea477d9601 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -173,7 +173,7 @@ skbfree(struct sk_buff *skb)
                 return;
         while (atomic_read(&skb_shinfo(skb)->dataref) != 1 && i-- > 0)
                 msleep(Sms);
-        if (i <= 0) {
+        if (i < 0) {
                 printk(KERN_ERR
                         "aoe: %s holds ref: %s\n",
                         skb->dev ? skb->dev->name : "netif",
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index d2cb67b61176..4f9b6d792017 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -3606,16 +3606,18 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
                 if (cciss_hard_reset_controller(pdev) || cciss_reset_msi(pdev))
                         return -ENODEV;
 
-                /* Some devices (notably the HP Smart Array 5i Controller)
-                   need a little pause here */
-                schedule_timeout_uninterruptible(30*HZ);
-
-                /* Now try to get the controller to respond to a no-op */
-                for (i=0; i<12; i++) {
+                /* Now try to get the controller to respond to a no-op. Some
+                   devices (notably the HP Smart Array 5i Controller) need
+                   up to 30 seconds to respond. */
+                for (i=0; i<30; i++) {
                         if (cciss_noop(pdev) == 0)
                                 break;
-                        else
-                                printk("cciss: no-op failed%s\n", (i < 11 ? "; re-trying" : ""));
+
+                        schedule_timeout_uninterruptible(HZ);
+                }
+                if (i == 30) {
+                        printk(KERN_ERR "cciss: controller seems dead\n");
+                        return -EBUSY;
                 }
         }
 
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index edbaac6c0573..bf0345577672 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -392,8 +392,7 @@ lo_splice_actor(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
         struct loop_device *lo = p->lo;
         struct page *page = buf->page;
         sector_t IV;
-        size_t size;
-        int ret;
+        int size, ret;
 
         ret = buf->ops->confirm(pipe, buf);
         if (unlikely(ret))
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 918ef725de41..8f905089b72b 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -40,6 +40,7 @@
 #include <linux/hdreg.h>
 #include <linux/cdrom.h>
 #include <linux/module.h>
+#include <linux/scatterlist.h>
 
 #include <xen/xenbus.h>
 #include <xen/grant_table.h>
@@ -82,6 +83,7 @@ struct blkfront_info
         enum blkif_state connected;
         int ring_ref;
         struct blkif_front_ring ring;
+        struct scatterlist sg[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         unsigned int evtchn, irq;
         struct request_queue *rq;
         struct work_struct work;
@@ -204,12 +206,11 @@ static int blkif_queue_request(struct request *req)
         struct blkfront_info *info = req->rq_disk->private_data;
         unsigned long buffer_mfn;
         struct blkif_request *ring_req;
-        struct req_iterator iter;
-        struct bio_vec *bvec;
         unsigned long id;
         unsigned int fsect, lsect;
-        int ref;
+        int i, ref;
         grant_ref_t gref_head;
+        struct scatterlist *sg;
 
         if (unlikely(info->connected != BLKIF_STATE_CONNECTED))
                 return 1;
@@ -238,12 +239,13 @@ static int blkif_queue_request(struct request *req)
         if (blk_barrier_rq(req))
                 ring_req->operation = BLKIF_OP_WRITE_BARRIER;
 
-        ring_req->nr_segments = 0;
-        rq_for_each_segment(bvec, req, iter) {
-                BUG_ON(ring_req->nr_segments == BLKIF_MAX_SEGMENTS_PER_REQUEST);
-                buffer_mfn = pfn_to_mfn(page_to_pfn(bvec->bv_page));
-                fsect = bvec->bv_offset >> 9;
-                lsect = fsect + (bvec->bv_len >> 9) - 1;
+        ring_req->nr_segments = blk_rq_map_sg(req->q, req, info->sg);
+        BUG_ON(ring_req->nr_segments > BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
+        for_each_sg(info->sg, sg, ring_req->nr_segments, i) {
+                buffer_mfn = pfn_to_mfn(page_to_pfn(sg_page(sg)));
+                fsect = sg->offset >> 9;
+                lsect = fsect + (sg->length >> 9) - 1;
                 /* install a grant reference. */
                 ref = gnttab_claim_grant_reference(&gref_head);
                 BUG_ON(ref == -ENOSPC);
@@ -254,16 +256,12 @@ static int blkif_queue_request(struct request *req)
                                 buffer_mfn,
                                 rq_data_dir(req) );
 
-                info->shadow[id].frame[ring_req->nr_segments] =
-                                mfn_to_pfn(buffer_mfn);
-
-                ring_req->seg[ring_req->nr_segments] =
+                info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
+                ring_req->seg[i] =
                                 (struct blkif_request_segment) {
                                         .gref       = ref,
                                         .first_sect = fsect,
                                         .last_sect  = lsect };
-
-                ring_req->nr_segments++;
         }
 
         info->ring.req_prod_pvt++;
@@ -622,6 +620,8 @@ static int setup_blkring(struct xenbus_device *dev,
         SHARED_RING_INIT(sring);
         FRONT_RING_INIT(&info->ring, sring, PAGE_SIZE);
 
+        sg_init_table(info->sg, BLKIF_MAX_SEGMENTS_PER_REQUEST);
+
         err = xenbus_grant_ring(dev, virt_to_mfn(info->ring.sring));
         if (err < 0) {
                 free_page((unsigned long)sring);
@@ -977,6 +977,8 @@ static void backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosing:
+                if (info->gd == NULL)
+                        xenbus_dev_fatal(dev, -ENODEV, "gd is NULL");
                 bd = bdget_disk(info->gd, 0);
                 if (bd == NULL)
                         xenbus_dev_fatal(dev, -ENODEV, "bdget failed");
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 52f4361eb6e4..d765afda9c2a 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -271,15 +271,15 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
         nb_order = (nb_order >> 1) & 7;
         pci_read_config_dword(nb, AMD64_GARTAPERTUREBASE, &nb_base);
         nb_aper = nb_base << 25;
-        if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order)) {
-                return 0;
-        }
 
         /* Northbridge seems to contain crap. Try the AGP bridge. */
 
         pci_read_config_word(agp, cap+0x14, &apsize);
-        if (apsize == 0xffff)
+        if (apsize == 0xffff) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
                 return -1;
+        }
 
         apsize &= 0xfff;
         /* Some BIOS use weird encodings not in the AGPv3 table. */
@@ -301,6 +301,11 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
                 order = nb_order;
         }
 
+        if (nb_order >= order) {
+                if (agp_aperture_valid(nb_aper, (32*1024*1024)<<nb_order))
+                        return 0;
+        }
+
         dev_info(&agp->dev, "aperture from AGP @ %Lx size %u MB\n",
                  aper, 32 << order);
         if (order < 0 || !agp_aperture_valid(aper, (32*1024*1024)<<order))
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index c7714185f831..4373adb2119a 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -633,13 +633,15 @@ static void intel_i830_init_gtt_entries(void)
                         break;
                 }
         }
-        if (gtt_entries > 0)
+        if (gtt_entries > 0) {
                 dev_info(&agp_bridge->dev->dev, "detected %dK %s memory\n",
                        gtt_entries / KB(1), local ? "local" : "stolen");
-        else
+                gtt_entries /= KB(4);
+        } else {
                 dev_info(&agp_bridge->dev->dev,
                        "no pre-allocated video memory detected\n");
-        gtt_entries /= KB(4);
+                gtt_entries = 0;
+        }
 
         intel_private.gtt_entries = gtt_entries;
 }
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 6e6eb445d374..c76bccf5354d 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -1139,15 +1139,6 @@ static int hvcs_open(struct tty_struct *tty, struct file *filp)
         hvcsd->tty = tty;
         tty->driver_data = hvcsd;
 
-        /*
-         * Set this driver to low latency so that we actually have a chance at
-         * catching a throttled TTY after we flip_buffer_push.  Otherwise the
-         * flush_to_async may not execute until after the kernel_thread has
-         * yielded and resumed the next flip_buffer_push resulting in data
-         * loss.
-         */
-        tty->low_latency = 1;
-
         memset(&hvcsd->buffer[0], 0x00, HVCS_BUFF_LEN);
 
         /*
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index 406f8742a260..2989056a9e39 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -810,7 +810,6 @@ static int hvsi_open(struct tty_struct *tty, struct file *filp)
         hp = &hvsi_ports[line];
 
         tty->driver_data = hp;
-        tty->low_latency = 1; /* avoid throttle/tty_flip_buffer_push race */
 
         mb();
         if (hp->state == HVSI_FSP_DIED)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index b55cb67435bd..d6daf3c507d3 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -754,11 +754,6 @@ static struct kobj_type ktype_cpufreq = {
         .release        = cpufreq_sysfs_release,
 };
 
-static struct kobj_type ktype_empty_cpufreq = {
-        .sysfs_ops      = &sysfs_ops,
-        .release        = cpufreq_sysfs_release,
-};
-
 
 /**
  * cpufreq_add_dev - add a CPU device
@@ -892,36 +887,26 @@ static int cpufreq_add_dev(struct sys_device *sys_dev)
         memcpy(&new_policy, policy, sizeof(struct cpufreq_policy));
 
         /* prepare interface data */
-        if (!cpufreq_driver->hide_interface) {
-                ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq,
-                                           &sys_dev->kobj, "cpufreq");
+        ret = kobject_init_and_add(&policy->kobj, &ktype_cpufreq, &sys_dev->kobj,
+                                   "cpufreq");
+        if (ret)
+                goto err_out_driver_exit;
+
+        /* set up files for this cpu device */
+        drv_attr = cpufreq_driver->attr;
+        while ((drv_attr) && (*drv_attr)) {
+                ret = sysfs_create_file(&policy->kobj, &((*drv_attr)->attr));
                 if (ret)
                         goto err_out_driver_exit;
-
-                /* set up files for this cpu device */
-                drv_attr = cpufreq_driver->attr;
-                while ((drv_attr) && (*drv_attr)) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &((*drv_attr)->attr));
-                        if (ret)
-                                goto err_out_driver_exit;
-                        drv_attr++;
-                }
-                if (cpufreq_driver->get) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &cpuinfo_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-                if (cpufreq_driver->target) {
-                        ret = sysfs_create_file(&policy->kobj,
-                                                &scaling_cur_freq.attr);
-                        if (ret)
-                                goto err_out_driver_exit;
-                }
-        } else {
-                ret = kobject_init_and_add(&policy->kobj, &ktype_empty_cpufreq,
-                                           &sys_dev->kobj, "cpufreq");
+                drv_attr++;
+        }
+        if (cpufreq_driver->get) {
+                ret = sysfs_create_file(&policy->kobj, &cpuinfo_cur_freq.attr);
+                if (ret)
+                        goto err_out_driver_exit;
+        }
+        if (cpufreq_driver->target) {
+                ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
                 if (ret)
                         goto err_out_driver_exit;
         }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 2d637e0fbc03..d9e751be8c5f 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -457,10 +457,12 @@ static int init_ixp_crypto(void)
         if (!ctx_pool) {
                 goto err;
         }
-        ret = qmgr_request_queue(SEND_QID, NPE_QLEN_TOTAL, 0, 0);
+        ret = qmgr_request_queue(SEND_QID, NPE_QLEN_TOTAL, 0, 0,
+                                 "ixp_crypto:out", NULL);
         if (ret)
                 goto err;
-        ret = qmgr_request_queue(RECV_QID, NPE_QLEN, 0, 0);
+        ret = qmgr_request_queue(RECV_QID, NPE_QLEN, 0, 0,
+                                 "ixp_crypto:in", NULL);
         if (ret) {
                 qmgr_release_queue(SEND_QID);
                 goto err;
diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c
index 856b3cc25583..3f0fdd18255d 100644
--- a/drivers/crypto/padlock-aes.c
+++ b/drivers/crypto/padlock-aes.c
@@ -489,4 +489,4 @@ MODULE_DESCRIPTION("VIA PadLock AES algorithm support");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("aes");
+MODULE_ALIAS("aes-all");
diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
index a7fbadebf623..a2c8e8514b63 100644
--- a/drivers/crypto/padlock-sha.c
+++ b/drivers/crypto/padlock-sha.c
@@ -304,7 +304,7 @@ MODULE_DESCRIPTION("VIA PadLock SHA1/SHA256 algorithms support.");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Michal Ludvig");
 
-MODULE_ALIAS("sha1");
-MODULE_ALIAS("sha256");
+MODULE_ALIAS("sha1-all");
+MODULE_ALIAS("sha256-all");
 MODULE_ALIAS("sha1-padlock");
 MODULE_ALIAS("sha256-padlock");
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 33bd75347518..25b743abfb59 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 732fa1ec36ab..e190d8b30700 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -430,13 +430,15 @@ late_initcall(dmatest_init);
 static void __exit dmatest_exit(void)
 {
         struct dmatest_chan *dtc, *_dtc;
+        struct dma_chan *chan;
 
         list_for_each_entry_safe(dtc, _dtc, &dmatest_channels, node) {
                 list_del(&dtc->node);
+                chan = dtc->chan;
                 dmatest_cleanup_channel(dtc);
                 pr_debug("dmatest: dropped channel %s\n",
-                         dma_chan_name(dtc->chan));
-                dma_release_channel(dtc->chan);
+                         dma_chan_name(chan));
+                dma_release_channel(chan);
         }
 }
 module_exit(dmatest_exit);
diff --git a/drivers/dma/fsldma.c b/drivers/dma/fsldma.c
index 70126a606239..86d6da47f558 100644
--- a/drivers/dma/fsldma.c
+++ b/drivers/dma/fsldma.c
@@ -158,7 +158,8 @@ static void dma_start(struct fsl_dma_chan *fsl_chan)
 
 static void dma_halt(struct fsl_dma_chan *fsl_chan)
 {
-        int i = 0;
+        int i;
+
         DMA_OUT(fsl_chan, &fsl_chan->reg_base->mr,
                 DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) | FSL_DMA_MR_CA,
                 32);
@@ -166,8 +167,11 @@ static void dma_halt(struct fsl_dma_chan *fsl_chan)
                 DMA_IN(fsl_chan, &fsl_chan->reg_base->mr, 32) & ~(FSL_DMA_MR_CS
                 | FSL_DMA_MR_EMS_EN | FSL_DMA_MR_CA), 32);
 
-        while (!dma_is_idle(fsl_chan) && (i++ < 100))
+        for (i = 0; i < 100; i++) {
+                if (dma_is_idle(fsl_chan))
+                        break;
                 udelay(10);
+        }
         if (i >= 100 && !dma_is_idle(fsl_chan))
                 dev_err(fsl_chan->dev, "DMA halt timeout!\n");
 }
diff --git a/drivers/dma/ioat.c b/drivers/dma/ioat.c
index 4105d6575b64..ed83dd9df192 100644
--- a/drivers/dma/ioat.c
+++ b/drivers/dma/ioat.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2007 Intel Corporation.
+ * Copyright(c) 2007 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
diff --git a/drivers/dma/ioat_dca.c b/drivers/dma/ioat_dca.c
index 6cf622da0286..c012a1e15043 100644
--- a/drivers/dma/ioat_dca.c
+++ b/drivers/dma/ioat_dca.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2007 Intel Corporation.
+ * Copyright(c) 2007 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -49,6 +49,23 @@
 
 #define DCA_TAG_MAP_MASK 0xDF
 
+/* expected tag map bytes for I/OAT ver.2 */
+#define DCA2_TAG_MAP_BYTE0 0x80
+#define DCA2_TAG_MAP_BYTE1 0x0
+#define DCA2_TAG_MAP_BYTE2 0x81
+#define DCA2_TAG_MAP_BYTE3 0x82
+#define DCA2_TAG_MAP_BYTE4 0x82
+
+/* verify if tag map matches expected values */
+static inline int dca2_tag_map_valid(u8 *tag_map)
+{
+        return ((tag_map[0] == DCA2_TAG_MAP_BYTE0) &&
+                (tag_map[1] == DCA2_TAG_MAP_BYTE1) &&
+                (tag_map[2] == DCA2_TAG_MAP_BYTE2) &&
+                (tag_map[3] == DCA2_TAG_MAP_BYTE3) &&
+                (tag_map[4] == DCA2_TAG_MAP_BYTE4));
+}
+
 /*
  * "Legacy" DCA systems do not implement the DCA register set in the
  * I/OAT device.  Software needs direct support for their tag mappings.
@@ -452,6 +469,13 @@ struct dca_provider *ioat2_dca_init(struct pci_dev *pdev, void __iomem *iobase)
                         ioatdca->tag_map[i] = 0;
         }
 
+        if (!dca2_tag_map_valid(ioatdca->tag_map)) {
+                dev_err(&pdev->dev, "APICID_TAG_MAP set incorrectly by BIOS, "
+                        "disabling DCA\n");
+                free_dca_provider(dca);
+                return NULL;
+        }
+
         err = register_dca_provider(dca, &pdev->dev);
         if (err) {
                 free_dca_provider(dca);
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index b3759c4b6536..5905cd36bcd2 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1,6 +1,6 @@
 /*
  * Intel I/OAT DMA Linux driver
- * Copyright(c) 2004 - 2007 Intel Corporation.
+ * Copyright(c) 2004 - 2009 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms and conditions of the GNU General Public License,
@@ -189,11 +189,13 @@ static int ioat_dma_enumerate_channels(struct ioatdma_device *device)
                 ioat_chan->xfercap = xfercap;
                 ioat_chan->desccount = 0;
                 INIT_DELAYED_WORK(&ioat_chan->work, ioat_dma_chan_reset_part2);
-                if (ioat_chan->device->version != IOAT_VER_1_2) {
-                        writel(IOAT_DCACTRL_CMPL_WRITE_ENABLE
-                                        | IOAT_DMA_DCA_ANY_CPU,
-                                ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
-                }
+                if (ioat_chan->device->version == IOAT_VER_2_0)
+                        writel(IOAT_DCACTRL_CMPL_WRITE_ENABLE |
+                               IOAT_DMA_DCA_ANY_CPU,
+                               ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
+                else if (ioat_chan->device->version == IOAT_VER_3_0)
+                        writel(IOAT_DMA_DCA_ANY_CPU,
+                               ioat_chan->reg_base + IOAT_DCACTRL_OFFSET);
                 spin_lock_init(&ioat_chan->cleanup_lock);
                 spin_lock_init(&ioat_chan->desc_lock);
                 INIT_LIST_HEAD(&ioat_chan->free_desc);
@@ -1169,9 +1171,8 @@ static void ioat_dma_memcpy_cleanup(struct ioat_dma_chan *ioat_chan)
                                  * up if the client is done with the descriptor
                                  */
                                 if (async_tx_test_ack(&desc->async_tx)) {
-                                        list_del(&desc->node);
-                                        list_add_tail(&desc->node,
-                                                      &ioat_chan->free_desc);
+                                        list_move_tail(&desc->node,
+                                                       &ioat_chan->free_desc);
                                 } else
                                         desc->async_tx.cookie = 0;
                         } else {
@@ -1362,6 +1363,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         dma_cookie_t cookie;
         int err = 0;
         struct completion cmp;
+        unsigned long tmo;
 
         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
@@ -1413,9 +1415,10 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         }
         device->common.device_issue_pending(dma_chan);
 
-        wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
+        tmo = wait_for_completion_timeout(&cmp, msecs_to_jiffies(3000));
 
-        if (device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
+        if (tmo == 0 ||
+            device->common.device_is_tx_complete(dma_chan, cookie, NULL, NULL)
                                         != DMA_SUCCESS) {
                 dev_err(&device->pdev->dev,
                         "Self-test copy timed out, disabling\n");
@@ -1657,6 +1660,13 @@ struct ioatdma_device *ioat_dma_probe(struct pci_dev *pdev,
                 " %d channels, device version 0x%02x, driver version %s\n",
                 device->common.chancnt, device->version, IOAT_DMA_VERSION);
 
+        if (!device->common.chancnt) {
+                dev_err(&device->pdev->dev,
+                        "Intel(R) I/OAT DMA Engine problem found: "
+                        "zero channels detected\n");
+                goto err_setup_interrupts;
+        }
+
         err = ioat_dma_setup_interrupts(device);
         if (err)
                 goto err_setup_interrupts;
@@ -1696,6 +1706,9 @@ void ioat_dma_remove(struct ioatdma_device *device)
         struct dma_chan *chan, *_chan;
         struct ioat_dma_chan *ioat_chan;
 
+        if (device->version != IOAT_VER_3_0)
+                cancel_delayed_work(&device->work);
+
         ioat_dma_remove_interrupts(device);
 
         dma_async_device_unregister(&device->common);
@@ -1707,10 +1720,6 @@ void ioat_dma_remove(struct ioatdma_device *device)
         pci_release_regions(device->pdev);
         pci_disable_device(device->pdev);
 
-        if (device->version != IOAT_VER_3_0) {
-                cancel_delayed_work(&device->work);
-        }
-
         list_for_each_entry_safe(chan, _chan,
                                  &device->common.channels, device_node) {
                 ioat_chan = to_ioat_chan(chan);
diff --git a/drivers/dma/ioatdma.h b/drivers/dma/ioatdma.h
index a3306d0e1372..a52ff4bd4601 100644
--- a/drivers/dma/ioatdma.h
+++ b/drivers/dma/ioatdma.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
@@ -29,7 +29,7 @@
 #include <linux/pci_ids.h>
 #include <net/tcp.h>
 
-#define IOAT_DMA_VERSION  "3.30"
+#define IOAT_DMA_VERSION  "3.64"
 
 enum ioat_interrupt {
         none = 0,
@@ -135,12 +135,14 @@ static inline void ioat_set_tcp_copy_break(struct ioatdma_device *dev)
         #ifdef CONFIG_NET_DMA
         switch (dev->version) {
         case IOAT_VER_1_2:
-        case IOAT_VER_3_0:
                 sysctl_tcp_dma_copybreak = 4096;
                 break;
         case IOAT_VER_2_0:
                 sysctl_tcp_dma_copybreak = 2048;
                 break;
+        case IOAT_VER_3_0:
+                sysctl_tcp_dma_copybreak = 262144;
+                break;
         }
         #endif
 }
diff --git a/drivers/dma/ioatdma_hw.h b/drivers/dma/ioatdma_hw.h
index f1ae2c776f74..afa57eef86c9 100644
--- a/drivers/dma/ioatdma_hw.h
+++ b/drivers/dma/ioatdma_hw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/ioatdma_registers.h b/drivers/dma/ioatdma_registers.h
index 827cb503cac6..49bc277424f8 100644
--- a/drivers/dma/ioatdma_registers.h
+++ b/drivers/dma/ioatdma_registers.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2004 - 2007 Intel Corporation. All rights reserved.
+ * Copyright(c) 2004 - 2009 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the Free
diff --git a/drivers/dma/iop-adma.c b/drivers/dma/iop-adma.c
index ea5440dd10dc..16adbe61cfb2 100644
--- a/drivers/dma/iop-adma.c
+++ b/drivers/dma/iop-adma.c
@@ -928,19 +928,19 @@ iop_adma_xor_zero_sum_self_test(struct iop_adma_device *device)
 
         for (src_idx = 0; src_idx < IOP_ADMA_NUM_SRC_TEST; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
-                if (!xor_srcs[src_idx])
-                        while (src_idx--) {
+                if (!xor_srcs[src_idx]) {
+                        while (src_idx--)
                                 __free_page(xor_srcs[src_idx]);
-                                return -ENOMEM;
-                        }
+                        return -ENOMEM;
+                }
         }
 
         dest = alloc_page(GFP_KERNEL);
-        if (!dest)
-                while (src_idx--) {
+        if (!dest) {
+                while (src_idx--)
                         __free_page(xor_srcs[src_idx]);
-                        return -ENOMEM;
-                }
+                return -ENOMEM;
+        }
 
         /* Fill in src buffers */
         for (src_idx = 0; src_idx < IOP_ADMA_NUM_SRC_TEST; src_idx++) {
@@ -1401,7 +1401,7 @@ MODULE_ALIAS("platform:iop-adma");
 
 static struct platform_driver iop_adma_driver = {
         .probe          = iop_adma_probe,
-        .remove         = iop_adma_remove,
+        .remove         = __devexit_p(iop_adma_remove),
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = "iop-adma",
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index 1f154d08e98f..ae50a9d1a4e6 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -729,7 +729,7 @@ static int ipu_init_channel_buffer(struct idmac_channel *ichan,
 
         ichan->status = IPU_CHANNEL_READY;
 
-        spin_unlock_irqrestore(ipu->lock, flags);
+        spin_unlock_irqrestore(&ipu->lock, flags);
 
         return 0;
 }
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index d35cbd1ff0b3..cb7f26fb9f18 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1019,19 +1019,19 @@ mv_xor_xor_self_test(struct mv_xor_device *device)
 
         for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
                 xor_srcs[src_idx] = alloc_page(GFP_KERNEL);
-                if (!xor_srcs[src_idx])
-                        while (src_idx--) {
+                if (!xor_srcs[src_idx]) {
+                        while (src_idx--)
                                 __free_page(xor_srcs[src_idx]);
-                                return -ENOMEM;
-                        }
+                        return -ENOMEM;
+                }
         }
 
         dest = alloc_page(GFP_KERNEL);
-        if (!dest)
-                while (src_idx--) {
+        if (!dest) {
+                while (src_idx--)
                         __free_page(xor_srcs[src_idx]);
-                        return -ENOMEM;
-                }
+                return -ENOMEM;
+        }
 
         /* Fill in src buffers */
         for (src_idx = 0; src_idx < MV_XOR_NUM_SRC_TEST; src_idx++) {
@@ -1287,7 +1287,7 @@ mv_xor_conf_mbus_windows(struct mv_xor_shared_private *msp,
 
 static struct platform_driver mv_xor_driver = {
         .probe          = mv_xor_probe,
-        .remove         = mv_xor_remove,
+        .remove         = __devexit_p(mv_xor_remove),
         .driver         = {
                 .owner  = THIS_MODULE,
                 .name   = MV_XOR_NAME,
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index 72c667f9bee1..12715d3c078d 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -420,7 +420,7 @@ int drm_rmmap_locked(struct drm_device *dev, drm_local_map_t *map)
                                 dev->sigdata.lock = NULL;
                         master->lock.hw_lock = NULL;   /* SHM removed */
                         master->lock.file_priv = NULL;
-                        wake_up_interruptible(&master->lock.lock_queue);
+                        wake_up_interruptible_all(&master->lock.lock_queue);
                 }
                 break;
         case _DRM_AGP:
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index 733028b4d45e..1c3a8c557140 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -452,6 +452,59 @@ static void drm_setup_crtcs(struct drm_device *dev)
         kfree(modes);
         kfree(enabled);
 }
+
+/**
+ * drm_encoder_crtc_ok - can a given crtc drive a given encoder?
+ * @encoder: encoder to test
+ * @crtc: crtc to test
+ *
+ * Return false if @encoder can't be driven by @crtc, true otherwise.
+ */
+static bool drm_encoder_crtc_ok(struct drm_encoder *encoder,
+                                struct drm_crtc *crtc)
+{
+        struct drm_device *dev;
+        struct drm_crtc *tmp;
+        int crtc_mask = 1;
+
+        WARN(!crtc, "checking null crtc?");
+
+        dev = crtc->dev;
+
+        list_for_each_entry(tmp, &dev->mode_config.crtc_list, head) {
+                if (tmp == crtc)
+                        break;
+                crtc_mask <<= 1;
+        }
+
+        if (encoder->possible_crtcs & crtc_mask)
+                return true;
+        return false;
+}
+
+/*
+ * Check the CRTC we're going to map each output to vs. its current
+ * CRTC.  If they don't match, we have to disable the output and the CRTC
+ * since the driver will have to re-route things.
+ */
+static void
+drm_crtc_prepare_encoders(struct drm_device *dev)
+{
+        struct drm_encoder_helper_funcs *encoder_funcs;
+        struct drm_encoder *encoder;
+
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
+                encoder_funcs = encoder->helper_private;
+                /* Disable unused encoders */
+                if (encoder->crtc == NULL)
+                        (*encoder_funcs->dpms)(encoder, DRM_MODE_DPMS_OFF);
+                /* Disable encoders whose CRTC is about to change */
+                if (encoder_funcs->get_crtc &&
+                    encoder->crtc != (*encoder_funcs->get_crtc)(encoder))
+                        (*encoder_funcs->dpms)(encoder, DRM_MODE_DPMS_OFF);
+        }
+}
+
 /**
  * drm_crtc_set_mode - set a mode
  * @crtc: CRTC to program
@@ -547,6 +600,8 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
                 encoder_funcs->prepare(encoder);
         }
 
+        drm_crtc_prepare_encoders(dev);
+
         crtc_funcs->prepare(crtc);
 
         /* Set up the DPLL and any encoders state that needs to adjust or depend
@@ -617,7 +672,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
         struct drm_device *dev;
         struct drm_crtc **save_crtcs, *new_crtc;
         struct drm_encoder **save_encoders, *new_encoder;
-        struct drm_framebuffer *old_fb;
+        struct drm_framebuffer *old_fb = NULL;
         bool save_enabled;
         bool mode_changed = false;
         bool fb_changed = false;
@@ -668,9 +723,10 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
          * and then just flip_or_move it */
         if (set->crtc->fb != set->fb) {
                 /* If we have no fb then treat it as a full mode set */
-                if (set->crtc->fb == NULL)
+                if (set->crtc->fb == NULL) {
+                        DRM_DEBUG("crtc has no fb, full mode set\n");
                         mode_changed = true;
-                else if ((set->fb->bits_per_pixel !=
+                } else if ((set->fb->bits_per_pixel !=
                          set->crtc->fb->bits_per_pixel) ||
                          set->fb->depth != set->crtc->fb->depth)
                         fb_changed = true;
@@ -682,7 +738,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 fb_changed = true;
 
         if (set->mode && !drm_mode_equal(set->mode, &set->crtc->mode)) {
-                DRM_DEBUG("modes are different\n");
+                DRM_DEBUG("modes are different, full mode set\n");
                 drm_mode_debug_printmodeline(&set->crtc->mode);
                 drm_mode_debug_printmodeline(set->mode);
                 mode_changed = true;
@@ -708,6 +764,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 }
 
                 if (new_encoder != connector->encoder) {
+                        DRM_DEBUG("encoder changed, full mode switch\n");
                         mode_changed = true;
                         connector->encoder = new_encoder;
                 }
@@ -734,10 +791,20 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                         if (set->connectors[ro] == connector)
                                 new_crtc = set->crtc;
                 }
+
+                /* Make sure the new CRTC will work with the encoder */
+                if (new_crtc &&
+                    !drm_encoder_crtc_ok(connector->encoder, new_crtc)) {
+                        ret = -EINVAL;
+                        goto fail_set_mode;
+                }
                 if (new_crtc != connector->encoder->crtc) {
+                        DRM_DEBUG("crtc changed, full mode switch\n");
                         mode_changed = true;
                         connector->encoder->crtc = new_crtc;
                 }
+                DRM_DEBUG("setting connector %d crtc to %p\n",
+                          connector->base.id, new_crtc);
         }
 
         /* mode_set_base is not a required function */
@@ -781,6 +848,7 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
 
 fail_set_mode:
         set->crtc->enabled = save_enabled;
+        set->crtc->fb = old_fb;
         count = 0;
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 if (!connector->encoder)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 5a4d3244758a..a839a28d8ee6 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -125,7 +125,7 @@ static bool edid_is_valid(struct edid *edid)
                 DRM_ERROR("EDID has major version %d, instead of 1\n", edid->version);
                 goto bad;
         }
-        if (edid->revision <= 0 || edid->revision > 3) {
+        if (edid->revision > 3) {
                 DRM_ERROR("EDID has minor version %d, which is not between 0-3\n", edid->revision);
                 goto bad;
         }
@@ -320,10 +320,10 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
         mode->htotal = mode->hdisplay + ((pt->hblank_hi << 8) | pt->hblank_lo);
 
         mode->vdisplay = (pt->vactive_hi << 8) | pt->vactive_lo;
-        mode->vsync_start = mode->vdisplay + ((pt->vsync_offset_hi << 8) |
+        mode->vsync_start = mode->vdisplay + ((pt->vsync_offset_hi << 4) |
                                               pt->vsync_offset_lo);
         mode->vsync_end = mode->vsync_start +
-                ((pt->vsync_pulse_width_hi << 8) |
+                ((pt->vsync_pulse_width_hi << 4) |
                  pt->vsync_pulse_width_lo);
         mode->vtotal = mode->vdisplay + ((pt->vblank_hi << 8) | pt->vblank_lo);
 
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 6c020fe5431c..f52663ebe016 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -484,6 +484,7 @@ int drm_release(struct inode *inode, struct file *filp)
         mutex_lock(&dev->struct_mutex);
 
         if (file_priv->is_master) {
+                struct drm_master *master = file_priv->master;
                 struct drm_file *temp;
                 list_for_each_entry(temp, &dev->filelist, lhead) {
                         if ((temp->master == file_priv->master) &&
@@ -491,6 +492,19 @@ int drm_release(struct inode *inode, struct file *filp)
                                 temp->authenticated = 0;
                 }
 
+                /**
+                 * Since the master is disappearing, so is the
+                 * possibility to lock.
+                 */
+
+                if (master->lock.hw_lock) {
+                        if (dev->sigdata.lock == master->lock.hw_lock)
+                                dev->sigdata.lock = NULL;
+                        master->lock.hw_lock = NULL;
+                        master->lock.file_priv = NULL;
+                        wake_up_interruptible_all(&master->lock.lock_queue);
+                }
+
                 if (file_priv->minor->master == file_priv->master) {
                         /* drop the reference held my the minor */
                         drm_master_put(&file_priv->minor->master);
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3795dbc0f50c..93e677a481f5 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -435,6 +435,8 @@ EXPORT_SYMBOL(drm_vblank_get);
  */
 void drm_vblank_put(struct drm_device *dev, int crtc)
 {
+        BUG_ON (atomic_read (&dev->vblank_refcount[crtc]) == 0);
+
         /* Last user schedules interrupt disable */
         if (atomic_dec_and_test(&dev->vblank_refcount[crtc]))
                 mod_timer(&dev->vblank_disable_timer, jiffies + 5*DRM_HZ);
@@ -460,8 +462,9 @@ void drm_vblank_pre_modeset(struct drm_device *dev, int crtc)
          * so that interrupts remain enabled in the interim.
          */
         if (!dev->vblank_inmodeset[crtc]) {
-                dev->vblank_inmodeset[crtc] = 1;
-                drm_vblank_get(dev, crtc);
+                dev->vblank_inmodeset[crtc] = 0x1;
+                if (drm_vblank_get(dev, crtc) == 0)
+                        dev->vblank_inmodeset[crtc] |= 0x2;
         }
 }
 EXPORT_SYMBOL(drm_vblank_pre_modeset);
@@ -473,9 +476,12 @@ void drm_vblank_post_modeset(struct drm_device *dev, int crtc)
         if (dev->vblank_inmodeset[crtc]) {
                 spin_lock_irqsave(&dev->vbl_lock, irqflags);
                 dev->vblank_disable_allowed = 1;
-                dev->vblank_inmodeset[crtc] = 0;
                 spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
-                drm_vblank_put(dev, crtc);
+
+                if (dev->vblank_inmodeset[crtc] & 0x2)
+                        drm_vblank_put(dev, crtc);
+
+                dev->vblank_inmodeset[crtc] = 0;
         }
 }
 EXPORT_SYMBOL(drm_vblank_post_modeset);
diff --git a/drivers/gpu/drm/drm_lock.c b/drivers/gpu/drm/drm_lock.c
index 46e7b28f0707..e2f70a516c34 100644
--- a/drivers/gpu/drm/drm_lock.c
+++ b/drivers/gpu/drm/drm_lock.c
@@ -80,6 +80,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                 __set_current_state(TASK_INTERRUPTIBLE);
                 if (!master->lock.hw_lock) {
                         /* Device has been unregistered */
+                        send_sig(SIGTERM, current, 0);
                         ret = -EINTR;
                         break;
                 }
@@ -93,7 +94,7 @@ int drm_lock(struct drm_device *dev, void *data, struct drm_file *file_priv)
                 /* Contention */
                 schedule();
                 if (signal_pending(current)) {
-                        ret = -ERESTARTSYS;
+                        ret = -EINTR;
                         break;
                 }
         }
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index 46bb923b097c..7c8b15b22bf2 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -146,14 +146,6 @@ static void drm_master_destroy(struct kref *kref)
 
         drm_ht_remove(&master->magiclist);
 
-        if (master->lock.hw_lock) {
-                if (dev->sigdata.lock == master->lock.hw_lock)
-                        dev->sigdata.lock = NULL;
-                master->lock.hw_lock = NULL;
-                master->lock.file_priv = NULL;
-                wake_up_interruptible(&master->lock.lock_queue);
-        }
-
         drm_free(master, sizeof(*master), DRM_MEM_DRIVER);
 }
 
@@ -176,7 +168,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
             file_priv->minor->master != file_priv->master) {
                 mutex_lock(&dev->struct_mutex);
                 file_priv->minor->master = drm_master_get(file_priv->master);
-                mutex_lock(&dev->struct_mutex);
+                mutex_unlock(&dev->struct_mutex);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 2d797ffe8137..6d21b9e48b89 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -811,7 +811,7 @@ static int i915_set_status_page(struct drm_device *dev, void *data,
         dev_priv->hws_map.flags = 0;
         dev_priv->hws_map.mtrr = 0;
 
-        drm_core_ioremap(&dev_priv->hws_map, dev);
+        drm_core_ioremap_wc(&dev_priv->hws_map, dev);
         if (dev_priv->hws_map.handle == NULL) {
                 i915_dma_cleanup(dev);
                 dev_priv->status_gfx_addr = 0;
@@ -1090,6 +1090,11 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->mm.gtt_mapping =
                 io_mapping_create_wc(dev->agp->base,
                                      dev->agp->agp_info.aper_size * 1024*1024);
+        if (dev_priv->mm.gtt_mapping == NULL) {
+                ret = -EIO;
+                goto out_rmmap;
+        }
+
         /* Set up a WC MTRR for non-PAT systems.  This is more common than
          * one would think, because the kernel disables PAT on first
          * generation Core chips because WC PAT gets overridden by a UC
@@ -1100,7 +1105,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                                          1024 * 1024,
                                          MTRR_TYPE_WRCOMB, 1);
         if (dev_priv->mm.gtt_mtrr < 0) {
-                DRM_INFO("MTRR allocation failed\n.  Graphics "
+                DRM_INFO("MTRR allocation failed.  Graphics "
                          "performance may suffer.\n");
         }
 
@@ -1122,7 +1127,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         if (!I915_NEED_GFX_HWS(dev)) {
                 ret = i915_init_phys_hws(dev);
                 if (ret != 0)
-                        goto out_rmmap;
+                        goto out_iomapfree;
         }
 
         /* On the 945G/GM, the chipset reports the MSI capability on the
@@ -1161,6 +1166,8 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
 
         return 0;
 
+out_iomapfree:
+        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
         iounmap(dev_priv->regs);
 free_priv:
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 17fa40858d26..d6cc9861e0a1 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -279,7 +279,6 @@ typedef struct drm_i915_private {
         u8 saveAR_INDEX;
         u8 saveAR[21];
         u8 saveDACMASK;
-        u8 saveDACDATA[256*3]; /* 256 3-byte colors */
         u8 saveCR[37];
 
         struct {
@@ -457,6 +456,12 @@ struct drm_i915_gem_object {
 
         /** for phy allocated objects */
         struct drm_i915_gem_phys_object *phys_obj;
+
+        /**
+         * Used for checking the object doesn't appear more than once
+         * in an execbuffer object list.
+         */
+        int in_execbuffer;
 };
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 28b726d07a0c..37427e4016cb 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1476,7 +1476,7 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int regnum = obj_priv->fence_reg;
         int tile_width;
-        uint32_t val;
+        uint32_t fence_reg, val;
         uint32_t pitch_val;
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
@@ -1503,7 +1503,11 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         val |= pitch_val << I830_FENCE_PITCH_SHIFT;
         val |= I830_FENCE_REG_VALID;
 
-        I915_WRITE(FENCE_REG_830_0 + (regnum * 4), val);
+        if (regnum < 8)
+                fence_reg = FENCE_REG_830_0 + (regnum * 4);
+        else
+                fence_reg = FENCE_REG_945_8 + ((regnum - 8) * 4);
+        I915_WRITE(fence_reg, val);
 }
 
 static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
@@ -1557,7 +1561,8 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         struct drm_i915_fence_reg *reg = NULL;
-        int i, ret;
+        struct drm_i915_gem_object *old_obj_priv = NULL;
+        int i, ret, avail;
 
         switch (obj_priv->tiling_mode) {
         case I915_TILING_NONE:
@@ -1580,25 +1585,46 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
         }
 
         /* First try to find a free reg */
+try_again:
+        avail = 0;
         for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
                 reg = &dev_priv->fence_regs[i];
                 if (!reg->obj)
                         break;
+
+                old_obj_priv = reg->obj->driver_private;
+                if (!old_obj_priv->pin_count)
+                    avail++;
         }
 
         /* None available, try to steal one or wait for a user to finish */
         if (i == dev_priv->num_fence_regs) {
-                struct drm_i915_gem_object *old_obj_priv = NULL;
+                uint32_t seqno = dev_priv->mm.next_gem_seqno;
                 loff_t offset;
 
-try_again:
-                /* Could try to use LRU here instead... */
+                if (avail == 0)
+                        return -ENOMEM;
+
                 for (i = dev_priv->fence_reg_start;
                      i < dev_priv->num_fence_regs; i++) {
+                        uint32_t this_seqno;
+
                         reg = &dev_priv->fence_regs[i];
                         old_obj_priv = reg->obj->driver_private;
-                        if (!old_obj_priv->pin_count)
+
+                        if (old_obj_priv->pin_count)
+                                continue;
+
+                        /* i915 uses fences for GPU access to tiled buffers */
+                        if (IS_I965G(dev) || !old_obj_priv->active)
                                 break;
+
+                        /* find the seqno of the first available fence */
+                        this_seqno = old_obj_priv->last_rendering_seqno;
+                        if (this_seqno != 0 &&
+                            reg->obj->write_domain == 0 &&
+                            i915_seqno_passed(seqno, this_seqno))
+                                seqno = this_seqno;
                 }
 
                 /*
@@ -1606,15 +1632,25 @@ try_again:
                  * objects to finish before trying again.
                  */
                 if (i == dev_priv->num_fence_regs) {
-                        ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
-                        if (ret) {
-                                WARN(ret != -ERESTARTSYS,
-                                     "switch to GTT domain failed: %d\n", ret);
-                                return ret;
+                        if (seqno == dev_priv->mm.next_gem_seqno) {
+                                i915_gem_flush(dev,
+                                               I915_GEM_GPU_DOMAINS,
+                                               I915_GEM_GPU_DOMAINS);
+                                seqno = i915_add_request(dev,
+                                                         I915_GEM_GPU_DOMAINS);
+                                if (seqno == 0)
+                                        return -ENOMEM;
                         }
+
+                        ret = i915_wait_request(dev, seqno);
+                        if (ret)
+                                return ret;
                         goto try_again;
                 }
 
+                BUG_ON(old_obj_priv->active ||
+                       (reg->obj->write_domain & I915_GEM_GPU_DOMAINS));
+
                 /*
                  * Zap this virtual mapping so we can set up a fence again
                  * for this object next time we need it.
@@ -1655,8 +1691,17 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
 
         if (IS_I965G(dev))
                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
-        else
-                I915_WRITE(FENCE_REG_830_0 + (obj_priv->fence_reg * 4), 0);
+        else {
+                uint32_t fence_reg;
+
+                if (obj_priv->fence_reg < 8)
+                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
+                else
+                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg -
+                                                       8) * 4;
+
+                I915_WRITE(fence_reg, 0);
+        }
 
         dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
         obj_priv->fence_reg = I915_FENCE_REG_NONE;
@@ -2469,6 +2514,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
         struct drm_i915_gem_exec_object *exec_list = NULL;
         struct drm_gem_object **object_list = NULL;
         struct drm_gem_object *batch_obj;
+        struct drm_i915_gem_object *obj_priv;
         int ret, i, pinned = 0;
         uint64_t exec_offset;
         uint32_t seqno, flush_domains;
@@ -2533,6 +2579,15 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
                         ret = -EBADF;
                         goto err;
                 }
+
+                obj_priv = object_list[i]->driver_private;
+                if (obj_priv->in_execbuffer) {
+                        DRM_ERROR("Object %p appears more than once in object list\n",
+                                   object_list[i]);
+                        ret = -EBADF;
+                        goto err;
+                }
+                obj_priv->in_execbuffer = true;
         }
 
         /* Pin and relocate */
@@ -2674,8 +2729,13 @@ err:
         for (i = 0; i < pinned; i++)
                 i915_gem_object_unpin(object_list[i]);
 
-        for (i = 0; i < args->buffer_count; i++)
+        for (i = 0; i < args->buffer_count; i++) {
+                if (object_list[i]) {
+                        obj_priv = object_list[i]->driver_private;
+                        obj_priv->in_execbuffer = false;
+                }
                 drm_gem_object_unreference(object_list[i]);
+        }
 
         mutex_unlock(&dev->struct_mutex);
 
@@ -2712,17 +2772,24 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
                 ret = i915_gem_object_bind_to_gtt(obj, alignment);
                 if (ret != 0) {
                         if (ret != -EBUSY && ret != -ERESTARTSYS)
-                                DRM_ERROR("Failure to bind: %d", ret);
+                                DRM_ERROR("Failure to bind: %d\n", ret);
+                        return ret;
+                }
+        }
+        /*
+         * Pre-965 chips need a fence register set up in order to
+         * properly handle tiled surfaces.
+         */
+        if (!IS_I965G(dev) &&
+            obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+            obj_priv->tiling_mode != I915_TILING_NONE) {
+                ret = i915_gem_object_get_fence_reg(obj, true);
+                if (ret != 0) {
+                        if (ret != -EBUSY && ret != -ERESTARTSYS)
+                                DRM_ERROR("Failure to install fence: %d\n",
+                                          ret);
                         return ret;
                 }
-                /*
-                 * Pre-965 chips need a fence register set up in order to
-                 * properly handle tiled surfaces.
-                 */
-                if (!IS_I965G(dev) &&
-                    obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-                    obj_priv->tiling_mode != I915_TILING_NONE)
-                        i915_gem_object_get_fence_reg(obj, true);
         }
         obj_priv->pin_count++;
 
@@ -3548,7 +3615,7 @@ i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
         user_data = (char __user *) (uintptr_t) args->data_ptr;
         obj_addr = obj_priv->phys_obj->handle->vaddr + args->offset;
 
-        DRM_ERROR("obj_addr %p, %lld\n", obj_addr, args->size);
+        DRM_DEBUG("obj_addr %p, %lld\n", obj_addr, args->size);
         ret = copy_from_user(obj_addr, user_data, args->size);
         if (ret)
                 return -EFAULT;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 548ff2c66431..87b6b603469e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -383,12 +383,13 @@ int i915_irq_emit(struct drm_device *dev, void *data,
         drm_i915_irq_emit_t *emit = data;
         int result;
 
-        RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
-
         if (!dev_priv) {
                 DRM_ERROR("called with no initialization\n");
                 return -EINVAL;
         }
+
+        RING_LOCK_TEST_WITH_RETURN(dev, file_priv);
+
         mutex_lock(&dev->struct_mutex);
         result = i915_emit_irq(dev);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 9d6539a868b3..90600d899413 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -184,6 +184,7 @@
  * Fence registers
  */
 #define FENCE_REG_830_0                 0x2000
+#define FENCE_REG_945_8                 0x3000
 #define   I830_FENCE_START_MASK         0x07f80000
 #define   I830_FENCE_TILING_Y_SHIFT     12
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 5d84027ee8f3..d669cc2b42c0 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -119,11 +119,6 @@ static void i915_save_vga(struct drm_device *dev)
 
         /* VGA color palette registers */
         dev_priv->saveDACMASK = I915_READ8(VGA_DACMASK);
-        /* DACCRX automatically increments during read */
-        I915_WRITE8(VGA_DACRX, 0);
-        /* Read 3 bytes of color data from each index */
-        for (i = 0; i < 256 * 3; i++)
-                dev_priv->saveDACDATA[i] = I915_READ8(VGA_DACDATA);
 
         /* MSR bits */
         dev_priv->saveMSR = I915_READ8(VGA_MSR_READ);
@@ -225,12 +220,6 @@ static void i915_restore_vga(struct drm_device *dev)
 
         /* VGA color palette registers */
         I915_WRITE8(VGA_DACMASK, dev_priv->saveDACMASK);
-        /* DACCRX automatically increments during read */
-        I915_WRITE8(VGA_DACWX, 0);
-        /* Read 3 bytes of color data from each index */
-        for (i = 0; i < 256 * 3; i++)
-                I915_WRITE8(VGA_DACDATA, dev_priv->saveDACDATA[i]);
-
 }
 
 int i915_save_state(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 65be30dccc77..fc28e2bbd542 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -111,6 +111,12 @@ parse_panel_data(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         panel_fixed_mode->clock = dvo_timing->clock * 10;
         panel_fixed_mode->type = DRM_MODE_TYPE_PREFERRED;
 
+        /* Some VBTs have bogus h/vtotal values */
+        if (panel_fixed_mode->hsync_end > panel_fixed_mode->htotal)
+                panel_fixed_mode->htotal = panel_fixed_mode->hsync_end + 1;
+        if (panel_fixed_mode->vsync_end > panel_fixed_mode->vtotal)
+                panel_fixed_mode->vtotal = panel_fixed_mode->vsync_end + 1;
+
         drm_mode_set_name(panel_fixed_mode);
 
         dev_priv->vbt_mode = panel_fixed_mode;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 65b635ce28c8..a2834276cb38 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -217,7 +217,7 @@ bool intel_pipe_has_type (struct drm_crtc *crtc, int type)
     return false;
 }
 
-#define INTELPllInvalid(s)   do { DRM_DEBUG(s); return false; } while (0)
+#define INTELPllInvalid(s)   do { /* DRM_DEBUG(s); */ return false; } while (0)
 /**
  * Returns whether the given set of divisors are valid for a given refclk with
  * the given connectors.
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index b84bf066879b..b4eea0292c1a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -543,8 +543,8 @@ config SENSORS_LM90
         help
           If you say yes here you get support for National Semiconductor LM90,
           LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, and Maxim
-          MAX6646, MAX6647, MAX6649, MAX6657, MAX6658, MAX6659, MAX6680 and
-          MAX6681 sensor chips.
+          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          MAX6680, MAX6681 and MAX6692 sensor chips.
 
           This driver can also be built as a module.  If so, the module
           will be called lm90.
diff --git a/drivers/hwmon/abituguru3.c b/drivers/hwmon/abituguru3.c
index e52b38806d03..ad2b3431b725 100644
--- a/drivers/hwmon/abituguru3.c
+++ b/drivers/hwmon/abituguru3.c
@@ -760,8 +760,11 @@ static int abituguru3_read_increment_offset(struct abituguru3_data *data,
 
         for (i = 0; i < offset_count; i++)
                 if ((x = abituguru3_read(data, bank, offset + i, count,
-                                buf + i * count)) != count)
-                        return i * count + (i && (x < 0)) ? 0 : x;
+                                buf + i * count)) != count) {
+                        if (x < 0)
+                                return x;
+                        return i * count + x;
+                }
 
         return i * count;
 }
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 1692de369969..18a1ba888165 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -617,7 +617,7 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 static int f75375_probe(struct i2c_client *client,
                 const struct i2c_device_id *id)
 {
-        struct f75375_data *data = i2c_get_clientdata(client);
+        struct f75375_data *data;
         struct f75375s_platform_data *f75375s_pdata = client->dev.platform_data;
         int err;
 
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 95a99c590da2..9157247fed8e 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -213,7 +213,7 @@ static inline u16 FAN16_TO_REG(long rpm)
 
 #define TEMP_TO_REG(val) (SENSORS_LIMIT(((val)<0?(((val)-500)/1000):\
                                         ((val)+500)/1000),-128,127))
-#define TEMP_FROM_REG(val) (((val)>0x80?(val)-0x100:(val))*1000)
+#define TEMP_FROM_REG(val) ((val) * 1000)
 
 #define PWM_TO_REG(val)   ((val) >> 1)
 #define PWM_FROM_REG(val) (((val)&0x7f) << 1)
@@ -267,9 +267,9 @@ struct it87_data {
         u8 has_fan;             /* Bitfield, fans enabled */
         u16 fan[5];             /* Register values, possibly combined */
         u16 fan_min[5];         /* Register values, possibly combined */
-        u8 temp[3];             /* Register value */
-        u8 temp_high[3];        /* Register value */
-        u8 temp_low[3];         /* Register value */
+        s8 temp[3];             /* Register value */
+        s8 temp_high[3];        /* Register value */
+        s8 temp_low[3];         /* Register value */
         u8 sensor;              /* Register value */
         u8 fan_div[3];          /* Register encoding, shifted right */
         u8 vid;                 /* Register encoding, combined */
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index cfc1ee90f5a3..b251d8674b41 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -72,6 +72,7 @@ I2C_CLIENT_INSMOD_7(lm85b, lm85c, adm1027, adt7463, adt7468, emc6d100,
 #define LM85_COMPANY_SMSC               0x5c
 #define LM85_VERSTEP_VMASK              0xf0
 #define LM85_VERSTEP_GENERIC            0x60
+#define LM85_VERSTEP_GENERIC2           0x70
 #define LM85_VERSTEP_LM85C              0x60
 #define LM85_VERSTEP_LM85B              0x62
 #define LM85_VERSTEP_ADM1027            0x60
@@ -334,6 +335,7 @@ static struct lm85_data *lm85_update_device(struct device *dev);
 static const struct i2c_device_id lm85_id[] = {
         { "adm1027", adm1027 },
         { "adt7463", adt7463 },
+        { "adt7468", adt7468 },
         { "lm85", any_chip },
         { "lm85b", lm85b },
         { "lm85c", lm85c },
@@ -408,7 +410,8 @@ static ssize_t show_vid_reg(struct device *dev, struct device_attribute *attr,
         struct lm85_data *data = lm85_update_device(dev);
         int vid;
 
-        if (data->type == adt7463 && (data->vid & 0x80)) {
+        if ((data->type == adt7463 || data->type == adt7468) &&
+            (data->vid & 0x80)) {
                 /* 6-pin VID (VRM 10) */
                 vid = vid_from_reg(data->vid & 0x3f, data->vrm);
         } else {
@@ -1153,7 +1156,8 @@ static int lm85_detect(struct i2c_client *client, int kind,
                         address, company, verstep);
 
                 /* All supported chips have the version in common */
-                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC) {
+                if ((verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC &&
+                    (verstep & LM85_VERSTEP_VMASK) != LM85_VERSTEP_GENERIC2) {
                         dev_dbg(&adapter->dev, "Autodetection failed: "
                                 "unsupported version\n");
                         return -ENODEV;
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 96a701866726..1aff7575799d 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -32,10 +32,10 @@
  * supported by this driver. These chips lack the remote temperature
  * offset feature.
  *
- * This driver also supports the MAX6646, MAX6647 and MAX6649 chips
- * made by Maxim.  These are again similar to the LM86, but they use
- * unsigned temperature values and can report temperatures from 0 to
- * 145 degrees.
+ * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
+ * MAX6692 chips made by Maxim.  These are again similar to the LM86,
+ * but they use unsigned temperature values and can report temperatures
+ * from 0 to 145 degrees.
  *
  * This driver also supports the MAX6680 and MAX6681, two other sensor
  * chips made by Maxim. These are quite similar to the other Maxim
diff --git a/drivers/i2c/busses/i2c-acorn.c b/drivers/i2c/busses/i2c-acorn.c
index 9fee3ca17344..9aefb5e5864d 100644
--- a/drivers/i2c/busses/i2c-acorn.c
+++ b/drivers/i2c/busses/i2c-acorn.c
@@ -79,10 +79,11 @@ static struct i2c_algo_bit_data ioc_data = {
         .getsda         = ioc_getsda,
         .getscl         = ioc_getscl,
         .udelay         = 80,
-        .timeout        = 100
+        .timeout        = HZ,
 };
 
 static struct i2c_adapter ioc_ops = {
+        .nr                     = 0,
         .algo_data              = &ioc_data,
 };
 
@@ -90,7 +91,7 @@ static int __init i2c_ioc_init(void)
 {
         force_ones = FORCE_ONES | SCL | SDA;
 
-        return i2c_bit_add_bus(&ioc_ops);
+        return i2c_bit_add_numbered_bus(&ioc_ops);
 }
 
 module_init(i2c_ioc_init);
diff --git a/drivers/i2c/busses/i2c-amd8111.c b/drivers/i2c/busses/i2c-amd8111.c
index edab51973bf5..a7c59908c457 100644
--- a/drivers/i2c/busses/i2c-amd8111.c
+++ b/drivers/i2c/busses/i2c-amd8111.c
@@ -72,7 +72,7 @@ static unsigned int amd_ec_wait_write(struct amd_smbus *smbus)
 {
         int timeout = 500;
 
-        while (timeout-- && (inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF))
+        while ((inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_IBF) && --timeout)
                 udelay(1);
 
         if (!timeout) {
@@ -88,7 +88,7 @@ static unsigned int amd_ec_wait_read(struct amd_smbus *smbus)
 {
         int timeout = 500;
 
-        while (timeout-- && (~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF))
+        while ((~inb(smbus->base + AMD_EC_SC) & AMD_EC_SC_OBF) && --timeout)
                 udelay(1);
 
         if (!timeout) {
diff --git a/drivers/i2c/busses/i2c-ixp2000.c b/drivers/i2c/busses/i2c-ixp2000.c
index 8e8467970481..c016f7a2c5fc 100644
--- a/drivers/i2c/busses/i2c-ixp2000.c
+++ b/drivers/i2c/busses/i2c-ixp2000.c
@@ -114,7 +114,7 @@ static int ixp2000_i2c_probe(struct platform_device *plat_dev)
         drv_data->algo_data.getsda = ixp2000_bit_getsda;
         drv_data->algo_data.getscl = ixp2000_bit_getscl;
         drv_data->algo_data.udelay = 6;
-        drv_data->algo_data.timeout = 100;
+        drv_data->algo_data.timeout = HZ;
 
         strlcpy(drv_data->adapter.name, plat_dev->dev.driver->name,
                 sizeof(drv_data->adapter.name));
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index eeda276f8f16..7f186bbcb99d 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -482,7 +482,7 @@ mv64xxx_i2c_map_regs(struct platform_device *pd,
         return 0;
 }
 
-static void __devexit
+static void
 mv64xxx_i2c_unmap_regs(struct mv64xxx_i2c_data *drv_data)
 {
         if (drv_data->reg_base) {
@@ -577,7 +577,7 @@ mv64xxx_i2c_remove(struct platform_device *dev)
 
 static struct platform_driver mv64xxx_i2c_driver = {
         .probe  = mv64xxx_i2c_probe,
-        .remove = mv64xxx_i2c_remove,
+        .remove = __devexit_p(mv64xxx_i2c_remove),
         .driver = {
                 .owner  = THIS_MODULE,
                 .name   = MV64XXX_I2C_CTLR_NAME,
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index 6af68146c342..bdb1f7510e91 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -644,7 +644,7 @@ static int i2c_pxa_do_pio_xfer(struct pxa_i2c *i2c,
 
         i2c_pxa_start_message(i2c);
 
-        while (timeout-- && i2c->msg_num > 0) {
+        while (i2c->msg_num > 0 && --timeout) {
                 i2c_pxa_handler(0, i2c);
                 udelay(10);
         }
diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
index 162b74a04886..42df0eca43d5 100644
--- a/drivers/i2c/busses/scx200_i2c.c
+++ b/drivers/i2c/busses/scx200_i2c.c
@@ -76,7 +76,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
         .getsda         = scx200_i2c_getsda,
         .getscl         = scx200_i2c_getscl,
         .udelay         = 10,
-        .timeout        = 100,
+        .timeout        = HZ,
 };
 
 static struct i2c_adapter scx200_i2c_ops = {
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index b1c9abe24c7b..e7d984866de0 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -1831,7 +1831,8 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter * adapter, u16 addr,
         case I2C_SMBUS_QUICK:
                 msg[0].len = 0;
                 /* Special case: The read/write field is used as data */
-                msg[0].flags = flags | (read_write==I2C_SMBUS_READ)?I2C_M_RD:0;
+                msg[0].flags = flags | (read_write == I2C_SMBUS_READ ?
+                                        I2C_M_RD : 0);
                 num = 1;
                 break;
         case I2C_SMBUS_BYTE:
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index c171988a9f51..7e13d2df9af3 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -35,6 +35,7 @@
 #include <linux/i2c.h>
 #include <linux/i2c-dev.h>
 #include <linux/smp_lock.h>
+#include <linux/jiffies.h>
 #include <asm/uaccess.h>
 
 static struct i2c_driver i2cdev_driver;
@@ -422,7 +423,10 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 client->adapter->retries = arg;
                 break;
         case I2C_TIMEOUT:
-                client->adapter->timeout = arg;
+                /* For historical reasons, user-space sets the timeout
+                 * value in units of 10 ms.
+                 */
+                client->adapter->timeout = msecs_to_jiffies(arg * 10);
                 break;
         default:
                 /* NOTE:  returning a fault code here could cause trouble
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 3dad2299d9c5..5ea3bfad172a 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -46,7 +46,7 @@ menuconfig IDE
           SMART parameters from disk drives.
 
           To compile this driver as a module, choose M here: the
-          module will be called ide.
+          module will be called ide-core.ko.
 
           For further information, please read <file:Documentation/ide/ide.txt>.
 
@@ -721,6 +721,11 @@ config BLK_DEV_IDE_TX4939
         depends on SOC_TX4939
         select BLK_DEV_IDEDMA_SFF
 
+config BLK_DEV_IDE_AT91
+        tristate "Atmel AT91 (SAM9, CAP9, AT572D940HF) IDE support"
+        depends on ARM && ARCH_AT91 && !ARCH_AT91RM9200 && !ARCH_AT91X40
+        select IDE_TIMINGS
+
 config IDE_ARM
         tristate "ARM IDE support"
         depends on ARM && (ARCH_RPC || ARCH_SHARK)
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index d0e3d7d5b467..1c326d94aa6d 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -116,3 +116,4 @@ obj-$(CONFIG_BLK_DEV_IDE_AU1XXX)	+= au1xxx-ide.o
 
 obj-$(CONFIG_BLK_DEV_IDE_TX4938)        += tx4938ide.o
 obj-$(CONFIG_BLK_DEV_IDE_TX4939)        += tx4939ide.o
+obj-$(CONFIG_BLK_DEV_IDE_AT91)          += at91_ide.o
diff --git a/drivers/ide/amd74xx.c b/drivers/ide/amd74xx.c
index 69660a431cd9..77267c859965 100644
--- a/drivers/ide/amd74xx.c
+++ b/drivers/ide/amd74xx.c
@@ -166,7 +166,7 @@ static unsigned int init_chipset_amd74xx(struct pci_dev *dev)
          * Check for broken FIFO support.
          */
         if (dev->vendor == PCI_VENDOR_ID_AMD &&
-            dev->vendor == PCI_DEVICE_ID_AMD_VIPER_7411)
+            dev->device == PCI_DEVICE_ID_AMD_VIPER_7411)
                 t &= 0x0f;
         else
                 t |= 0xf0;
diff --git a/drivers/ide/at91_ide.c b/drivers/ide/at91_ide.c
new file mode 100644
index 000000000000..1bb50f46388d
--- /dev/null
+++ b/drivers/ide/at91_ide.c
@@ -0,0 +1,467 @@
+/*
+ * IDE host driver for AT91 (SAM9, CAP9, AT572D940HF) Static Memory Controller
+ * with Compact Flash True IDE logic
+ *
+ * Copyright (c) 2008, 2009 Kelvatek Ltd.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ */
+
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/ide.h>
+#include <linux/platform_device.h>
+
+#include <mach/board.h>
+#include <mach/gpio.h>
+#include <mach/at91sam9263.h>
+#include <mach/at91sam9_smc.h>
+#include <mach/at91sam9263_matrix.h>
+
+#define DRV_NAME "at91_ide"
+
+#define perr(fmt, args...) pr_err(DRV_NAME ": " fmt, ##args)
+#define pdbg(fmt, args...) pr_debug("%s " fmt, __func__, ##args)
+
+/*
+ * Access to IDE device is possible through EBI Static Memory Controller
+ * with Compact Flash logic. For details see EBI and SMC datasheet sections
+ * of any microcontroller from AT91SAM9 family.
+ *
+ * Within SMC chip select address space, lines A[23:21] distinguish Compact
+ * Flash modes (I/O, common memory, attribute memory, True IDE). IDE modes are:
+ *   0x00c0000 - True IDE
+ *   0x00e0000 - Alternate True IDE (Alt Status Register)
+ *
+ * On True IDE mode Task File and Data Register are mapped at the same address.
+ * To distinguish access between these two different bus data width is used:
+ * 8Bit for Task File, 16Bit for Data I/O.
+ *
+ * After initialization we do 8/16 bit flipping (changes in SMC MODE register)
+ * only inside IDE callback routines which are serialized by IDE layer,
+ * so no additional locking needed.
+ */
+
+#define TASK_FILE       0x00c00000
+#define ALT_MODE        0x00e00000
+#define REGS_SIZE       8
+
+#define enter_16bit(cs, mode) do {                                      \
+        mode = at91_sys_read(AT91_SMC_MODE(cs));                        \
+        at91_sys_write(AT91_SMC_MODE(cs), mode | AT91_SMC_DBW_16);      \
+} while (0)
+
+#define leave_16bit(cs, mode) at91_sys_write(AT91_SMC_MODE(cs), mode);
+
+static void set_smc_timings(const u8 chipselect, const u16 cycle,
+                            const u16 setup, const u16 pulse,
+                            const u16 data_float, int use_iordy)
+{
+        unsigned long mode = AT91_SMC_READMODE | AT91_SMC_WRITEMODE |
+                             AT91_SMC_BAT_SELECT;
+
+        /* disable or enable waiting for IORDY signal */
+        if (use_iordy)
+                mode |= AT91_SMC_EXNWMODE_READY;
+
+        /* add data float cycles if needed */
+        if (data_float)
+                mode |= AT91_SMC_TDF_(data_float);
+
+        at91_sys_write(AT91_SMC_MODE(chipselect), mode);
+
+        /* setup timings in SMC */
+        at91_sys_write(AT91_SMC_SETUP(chipselect), AT91_SMC_NWESETUP_(setup) |
+                                                   AT91_SMC_NCS_WRSETUP_(0) |
+                                                   AT91_SMC_NRDSETUP_(setup) |
+                                                   AT91_SMC_NCS_RDSETUP_(0));
+        at91_sys_write(AT91_SMC_PULSE(chipselect), AT91_SMC_NWEPULSE_(pulse) |
+                                                   AT91_SMC_NCS_WRPULSE_(cycle) |
+                                                   AT91_SMC_NRDPULSE_(pulse) |
+                                                   AT91_SMC_NCS_RDPULSE_(cycle));
+        at91_sys_write(AT91_SMC_CYCLE(chipselect), AT91_SMC_NWECYCLE_(cycle) |
+                                                   AT91_SMC_NRDCYCLE_(cycle));
+}
+
+static unsigned int calc_mck_cycles(unsigned int ns, unsigned int mck_hz)
+{
+        u64 tmp = ns;
+
+        tmp *= mck_hz;
+        tmp += 1000*1000*1000 - 1; /* round up */
+        do_div(tmp, 1000*1000*1000);
+        return (unsigned int) tmp;
+}
+
+static void apply_timings(const u8 chipselect, const u8 pio,
+                          const struct ide_timing *timing, int use_iordy)
+{
+        unsigned int t0, t1, t2, t6z;
+        unsigned int cycle, setup, pulse, data_float;
+        unsigned int mck_hz;
+        struct clk *mck;
+
+        /* see table 22 of Compact Flash standard 4.1 for the meaning,
+         * we do not stretch active (t2) time, so setup (t1) + hold time (th)
+         * assure at least minimal recovery (t2i) time */
+        t0 = timing->cyc8b;
+        t1 = timing->setup;
+        t2 = timing->act8b;
+        t6z = (pio < 5) ? 30 : 20;
+
+        pdbg("t0=%u t1=%u t2=%u t6z=%u\n", t0, t1, t2, t6z);
+
+        mck = clk_get(NULL, "mck");
+        BUG_ON(IS_ERR(mck));
+        mck_hz = clk_get_rate(mck);
+        pdbg("mck_hz=%u\n", mck_hz);
+
+        cycle = calc_mck_cycles(t0, mck_hz);
+        setup = calc_mck_cycles(t1, mck_hz);
+        pulse = calc_mck_cycles(t2, mck_hz);
+        data_float = calc_mck_cycles(t6z, mck_hz);
+
+        pdbg("cycle=%u setup=%u pulse=%u data_float=%u\n",
+             cycle, setup, pulse, data_float);
+
+        set_smc_timings(chipselect, cycle, setup, pulse, data_float, use_iordy);
+}
+
+static void at91_ide_input_data(ide_drive_t *drive, struct request *rq,
+                                void *buf, unsigned int len)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        u8 chipselect = hwif->select_data;
+        unsigned long mode;
+
+        pdbg("cs %u buf %p len %d\n", chipselect, buf, len);
+
+        len++;
+
+        enter_16bit(chipselect, mode);
+        __ide_mm_insw((void __iomem *) io_ports->data_addr, buf, len / 2);
+        leave_16bit(chipselect, mode);
+}
+
+static void at91_ide_output_data(ide_drive_t *drive, struct request *rq,
+                                 void *buf, unsigned int len)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        u8 chipselect = hwif->select_data;
+        unsigned long mode;
+
+        pdbg("cs %u buf %p len %d\n", chipselect,  buf, len);
+
+        enter_16bit(chipselect, mode);
+        __ide_mm_outsw((void __iomem *) io_ports->data_addr, buf, len / 2);
+        leave_16bit(chipselect, mode);
+}
+
+static u8 ide_mm_inb(unsigned long port)
+{
+        return readb((void __iomem *) port);
+}
+
+static void ide_mm_outb(u8 value, unsigned long port)
+{
+        writeb(value, (void __iomem *) port);
+}
+
+static void at91_ide_tf_load(ide_drive_t *drive, ide_task_t *task)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        struct ide_taskfile *tf = &task->tf;
+        u8 HIHI = (task->tf_flags & IDE_TFLAG_LBA48) ? 0xE0 : 0xEF;
+
+        if (task->tf_flags & IDE_TFLAG_FLAGGED)
+                HIHI = 0xFF;
+
+        if (task->tf_flags & IDE_TFLAG_OUT_DATA) {
+                u16 data = (tf->hob_data << 8) | tf->data;
+
+                at91_ide_output_data(drive, NULL, &data, 2);
+        }
+
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_FEATURE)
+                ide_mm_outb(tf->hob_feature, io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_NSECT)
+                ide_mm_outb(tf->hob_nsect, io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAL)
+                ide_mm_outb(tf->hob_lbal, io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAM)
+                ide_mm_outb(tf->hob_lbam, io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_HOB_LBAH)
+                ide_mm_outb(tf->hob_lbah, io_ports->lbah_addr);
+
+        if (task->tf_flags & IDE_TFLAG_OUT_FEATURE)
+                ide_mm_outb(tf->feature, io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_NSECT)
+                ide_mm_outb(tf->nsect, io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAL)
+                ide_mm_outb(tf->lbal, io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAM)
+                ide_mm_outb(tf->lbam, io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_OUT_LBAH)
+                ide_mm_outb(tf->lbah, io_ports->lbah_addr);
+
+        if (task->tf_flags & IDE_TFLAG_OUT_DEVICE)
+                ide_mm_outb((tf->device & HIHI) | drive->select, io_ports->device_addr);
+}
+
+static void at91_ide_tf_read(ide_drive_t *drive, ide_task_t *task)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct ide_io_ports *io_ports = &hwif->io_ports;
+        struct ide_taskfile *tf = &task->tf;
+
+        if (task->tf_flags & IDE_TFLAG_IN_DATA) {
+                u16 data;
+
+                at91_ide_input_data(drive, NULL, &data, 2);
+                tf->data = data & 0xff;
+                tf->hob_data = (data >> 8) & 0xff;
+        }
+
+        /* be sure we're looking at the low order bits */
+        ide_mm_outb(ATA_DEVCTL_OBS & ~0x80, io_ports->ctl_addr);
+
+        if (task->tf_flags & IDE_TFLAG_IN_FEATURE)
+                tf->feature = ide_mm_inb(io_ports->feature_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_NSECT)
+                tf->nsect  = ide_mm_inb(io_ports->nsect_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAL)
+                tf->lbal   = ide_mm_inb(io_ports->lbal_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAM)
+                tf->lbam   = ide_mm_inb(io_ports->lbam_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_LBAH)
+                tf->lbah   = ide_mm_inb(io_ports->lbah_addr);
+        if (task->tf_flags & IDE_TFLAG_IN_DEVICE)
+                tf->device = ide_mm_inb(io_ports->device_addr);
+
+        if (task->tf_flags & IDE_TFLAG_LBA48) {
+                ide_mm_outb(ATA_DEVCTL_OBS | 0x80, io_ports->ctl_addr);
+
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_FEATURE)
+                        tf->hob_feature = ide_mm_inb(io_ports->feature_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_NSECT)
+                        tf->hob_nsect   = ide_mm_inb(io_ports->nsect_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAL)
+                        tf->hob_lbal    = ide_mm_inb(io_ports->lbal_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAM)
+                        tf->hob_lbam    = ide_mm_inb(io_ports->lbam_addr);
+                if (task->tf_flags & IDE_TFLAG_IN_HOB_LBAH)
+                        tf->hob_lbah    = ide_mm_inb(io_ports->lbah_addr);
+        }
+}
+
+static void at91_ide_set_pio_mode(ide_drive_t *drive, const u8 pio)
+{
+        struct ide_timing *timing;
+        u8 chipselect = drive->hwif->select_data;
+        int use_iordy = 0;
+
+        pdbg("chipselect %u pio %u\n", chipselect, pio);
+
+        timing = ide_timing_find_mode(XFER_PIO_0 + pio);
+        BUG_ON(!timing);
+
+        if ((pio > 2 || ata_id_has_iordy(drive->id)) &&
+            !(ata_id_is_cfa(drive->id) && pio > 4))
+                use_iordy = 1;
+
+        apply_timings(chipselect, pio, timing, use_iordy);
+}
+
+static const struct ide_tp_ops at91_ide_tp_ops = {
+        .exec_command   = ide_exec_command,
+        .read_status    = ide_read_status,
+        .read_altstatus = ide_read_altstatus,
+        .set_irq        = ide_set_irq,
+
+        .tf_load        = at91_ide_tf_load,
+        .tf_read        = at91_ide_tf_read,
+
+        .input_data     = at91_ide_input_data,
+        .output_data    = at91_ide_output_data,
+};
+
+static const struct ide_port_ops at91_ide_port_ops = {
+        .set_pio_mode   = at91_ide_set_pio_mode,
+};
+
+static const struct ide_port_info at91_ide_port_info __initdata = {
+        .port_ops       = &at91_ide_port_ops,
+        .tp_ops         = &at91_ide_tp_ops,
+        .host_flags     = IDE_HFLAG_MMIO | IDE_HFLAG_NO_DMA | IDE_HFLAG_SINGLE |
+                          IDE_HFLAG_NO_IO_32BIT | IDE_HFLAG_UNMASK_IRQS,
+        .pio_mask       = ATA_PIO5,
+};
+
+/*
+ * If interrupt is delivered through GPIO, IRQ are triggered on falling
+ * and rising edge of signal. Whereas IDE device request interrupt on high
+ * level (rising edge in our case). This mean we have fake interrupts, so
+ * we need to check interrupt pin and exit instantly from ISR when line
+ * is on low level.
+ */
+
+irqreturn_t at91_irq_handler(int irq, void *dev_id)
+{
+        int ntries = 8;
+        int pin_val1, pin_val2;
+
+        /* additional deglitch, line can be noisy in badly designed PCB */
+        do {
+                pin_val1 = at91_get_gpio_value(irq);
+                pin_val2 = at91_get_gpio_value(irq);
+        } while (pin_val1 != pin_val2 && --ntries > 0);
+
+        if (pin_val1 == 0 || ntries <= 0)
+                return IRQ_HANDLED;
+
+        return ide_intr(irq, dev_id);
+}
+
+static int __init at91_ide_probe(struct platform_device *pdev)
+{
+        int ret;
+        hw_regs_t hw;
+        hw_regs_t *hws[] = { &hw, NULL, NULL, NULL };
+        struct ide_host *host;
+        struct resource *res;
+        unsigned long tf_base = 0, ctl_base = 0;
+        struct at91_cf_data *board = pdev->dev.platform_data;
+
+        if (!board)
+                return -ENODEV;
+
+        if (board->det_pin && at91_get_gpio_value(board->det_pin) != 0) {
+                perr("no device detected\n");
+                return -ENODEV;
+        }
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res) {
+                perr("can't get memory resource\n");
+                return -ENODEV;
+        }
+
+        if (!devm_request_mem_region(&pdev->dev, res->start + TASK_FILE,
+                                     REGS_SIZE, "ide") ||
+            !devm_request_mem_region(&pdev->dev, res->start + ALT_MODE,
+                                     REGS_SIZE, "alt")) {
+                perr("memory resources in use\n");
+                return -EBUSY;
+        }
+
+        pdbg("chipselect %u irq %u res %08lx\n", board->chipselect,
+             board->irq_pin, (unsigned long) res->start);
+
+        tf_base = (unsigned long) devm_ioremap(&pdev->dev, res->start + TASK_FILE,
+                                               REGS_SIZE);
+        ctl_base = (unsigned long) devm_ioremap(&pdev->dev, res->start + ALT_MODE,
+                                                REGS_SIZE);
+        if (!tf_base || !ctl_base) {
+                perr("can't map memory regions\n");
+                return -EBUSY;
+        }
+
+        memset(&hw, 0, sizeof(hw));
+
+        if (board->flags & AT91_IDE_SWAP_A0_A2) {
+                /* workaround for stupid hardware bug */
+                hw.io_ports.data_addr   = tf_base + 0;
+                hw.io_ports.error_addr  = tf_base + 4;
+                hw.io_ports.nsect_addr  = tf_base + 2;
+                hw.io_ports.lbal_addr   = tf_base + 6;
+                hw.io_ports.lbam_addr   = tf_base + 1;
+                hw.io_ports.lbah_addr   = tf_base + 5;
+                hw.io_ports.device_addr = tf_base + 3;
+                hw.io_ports.command_addr = tf_base + 7;
+                hw.io_ports.ctl_addr    = ctl_base + 3;
+        } else
+                ide_std_init_ports(&hw, tf_base, ctl_base + 6);
+
+        hw.irq = board->irq_pin;
+        hw.chipset = ide_generic;
+        hw.dev = &pdev->dev;
+
+        host = ide_host_alloc(&at91_ide_port_info, hws);
+        if (!host) {
+                perr("failed to allocate ide host\n");
+                return -ENOMEM;
+        }
+
+        /* setup Static Memory Controller - PIO 0 as default */
+        apply_timings(board->chipselect, 0, ide_timing_find_mode(XFER_PIO_0), 0);
+
+        /* with GPIO interrupt we have to do quirks in handler */
+        if (board->irq_pin >= PIN_BASE)
+                host->irq_handler = at91_irq_handler;
+
+        host->ports[0]->select_data = board->chipselect;
+
+        ret = ide_host_register(host, &at91_ide_port_info, hws);
+        if (ret) {
+                perr("failed to register ide host\n");
+                goto err_free_host;
+        }
+        platform_set_drvdata(pdev, host);
+        return 0;
+
+err_free_host:
+        ide_host_free(host);
+        return ret;
+}
+
+static int __exit at91_ide_remove(struct platform_device *pdev)
+{
+        struct ide_host *host = platform_get_drvdata(pdev);
+
+        ide_host_remove(host);
+        return 0;
+}
+
+static struct platform_driver at91_ide_driver = {
+        .driver = {
+                .name = DRV_NAME,
+                .owner = THIS_MODULE,
+        },
+        .remove = __exit_p(at91_ide_remove),
+};
+
+static int __init at91_ide_init(void)
+{
+        return platform_driver_probe(&at91_ide_driver, at91_ide_probe);
+}
+
+static void __exit at91_ide_exit(void)
+{
+        platform_driver_unregister(&at91_ide_driver);
+}
+
+module_init(at91_ide_init);
+module_exit(at91_ide_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Stanislaw Gruszka <stf_xl@wp.pl>");
+
diff --git a/drivers/ide/atiixp.c b/drivers/ide/atiixp.c
index b2735d28f5cc..ecd1e62ca91a 100644
--- a/drivers/ide/atiixp.c
+++ b/drivers/ide/atiixp.c
@@ -52,7 +52,7 @@ static void atiixp_set_pio_mode(ide_drive_t *drive, const u8 pio)
 {
         struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
         unsigned long flags;
-        int timing_shift = (drive->dn & 2) ? 16 : 0 + (drive->dn & 1) ? 0 : 8;
+        int timing_shift = (drive->dn ^ 1) * 8;
         u32 pio_timing_data;
         u16 pio_mode_data;
 
@@ -85,7 +85,7 @@ static void atiixp_set_dma_mode(ide_drive_t *drive, const u8 speed)
 {
         struct pci_dev *dev = to_pci_dev(drive->hwif->dev);
         unsigned long flags;
-        int timing_shift = (drive->dn & 2) ? 16 : 0 + (drive->dn & 1) ? 0 : 8;
+        int timing_shift = (drive->dn ^ 1) * 8;
         u32 tmp32;
         u16 tmp16;
         u16 udma_ctl = 0;
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 0bfeb0c79d6e..ddfbea41d296 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -55,7 +55,7 @@
 
 static DEFINE_MUTEX(idecd_ref_mutex);
 
-static void ide_cd_release(struct kref *);
+static void ide_cd_release(struct device *);
 
 static struct cdrom_info *ide_cd_get(struct gendisk *disk)
 {
@@ -67,7 +67,7 @@ static struct cdrom_info *ide_cd_get(struct gendisk *disk)
                 if (ide_device_get(cd->drive))
                         cd = NULL;
                 else
-                        kref_get(&cd->kref);
+                        get_device(&cd->dev);
 
         }
         mutex_unlock(&idecd_ref_mutex);
@@ -79,7 +79,7 @@ static void ide_cd_put(struct cdrom_info *cd)
         ide_drive_t *drive = cd->drive;
 
         mutex_lock(&idecd_ref_mutex);
-        kref_put(&cd->kref, ide_cd_release);
+        put_device(&cd->dev);
         ide_device_put(drive);
         mutex_unlock(&idecd_ref_mutex);
 }
@@ -194,6 +194,14 @@ static void cdrom_analyze_sense_data(ide_drive_t *drive,
                         bio_sectors = max(bio_sectors(failed_command->bio), 4U);
                         sector &= ~(bio_sectors - 1);
 
+                        /*
+                         * The SCSI specification allows for the value
+                         * returned by READ CAPACITY to be up to 75 2K
+                         * sectors past the last readable block.
+                         * Therefore, if we hit a medium error within the
+                         * last 75 2K sectors, we decrease the saved size
+                         * value.
+                         */
                         if (sector < get_capacity(info->disk) &&
                             drive->probed_capacity - sector < 4 * 75)
                                 set_capacity(info->disk, sector);
@@ -1790,15 +1798,17 @@ static void ide_cd_remove(ide_drive_t *drive)
         ide_debug_log(IDE_DBG_FUNC, "Call %s\n", __func__);
 
         ide_proc_unregister_driver(drive, info->driver);
-
+        device_del(&info->dev);
         del_gendisk(info->disk);
 
-        ide_cd_put(info);
+        mutex_lock(&idecd_ref_mutex);
+        put_device(&info->dev);
+        mutex_unlock(&idecd_ref_mutex);
 }
 
-static void ide_cd_release(struct kref *kref)
+static void ide_cd_release(struct device *dev)
 {
-        struct cdrom_info *info = to_ide_drv(kref, cdrom_info);
+        struct cdrom_info *info = to_ide_drv(dev, cdrom_info);
         struct cdrom_device_info *devinfo = &info->devinfo;
         ide_drive_t *drive = info->drive;
         struct gendisk *g = info->disk;
@@ -1997,7 +2007,12 @@ static int ide_cd_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&info->kref);
+        info->dev.parent = &drive->gendev;
+        info->dev.release = ide_cd_release;
+        dev_set_name(&info->dev, dev_name(&drive->gendev));
+
+        if (device_register(&info->dev))
+                goto out_free_disk;
 
         info->drive = drive;
         info->driver = &ide_cdrom_driver;
@@ -2011,7 +2026,7 @@ static int ide_cd_probe(ide_drive_t *drive)
         g->driverfs_dev = &drive->gendev;
         g->flags = GENHD_FL_CD | GENHD_FL_REMOVABLE;
         if (ide_cdrom_setup(drive)) {
-                ide_cd_release(&info->kref);
+                put_device(&info->dev);
                 goto failed;
         }
 
@@ -2021,6 +2036,8 @@ static int ide_cd_probe(ide_drive_t *drive)
         add_disk(g);
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_cd:
         kfree(info);
 failed:
diff --git a/drivers/ide/ide-cd.h b/drivers/ide/ide-cd.h
index ac40d6cb90a2..c878bfcf1116 100644
--- a/drivers/ide/ide-cd.h
+++ b/drivers/ide/ide-cd.h
@@ -80,7 +80,7 @@ struct cdrom_info {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
 
         /* Buffer for table of contents.  NULL if we haven't allocated
            a TOC buffer for this device yet. */
diff --git a/drivers/ide/ide-disk_proc.c b/drivers/ide/ide-disk_proc.c
index 1146f4204c6e..1f86dcbd2b1c 100644
--- a/drivers/ide/ide-disk_proc.c
+++ b/drivers/ide/ide-disk_proc.c
@@ -125,5 +125,5 @@ const struct ide_proc_devset ide_disk_settings[] = {
         IDE_PROC_DEVSET(multcount,      0,    16),
         IDE_PROC_DEVSET(nowerr,         0,     1),
         IDE_PROC_DEVSET(wcache,         0,     1),
-        { 0 },
+        { NULL },
 };
diff --git a/drivers/ide/ide-floppy_proc.c b/drivers/ide/ide-floppy_proc.c
index 3ec762cb60ab..fcd4d8153df5 100644
--- a/drivers/ide/ide-floppy_proc.c
+++ b/drivers/ide/ide-floppy_proc.c
@@ -29,5 +29,5 @@ const struct ide_proc_devset ide_floppy_settings[] = {
         IDE_PROC_DEVSET(bios_head, 0,  255),
         IDE_PROC_DEVSET(bios_sect, 0,   63),
         IDE_PROC_DEVSET(ticks,     0,  255),
-        { 0 },
+        { NULL },
 };
diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
index 7857b209c6df..047109419902 100644
--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -25,7 +25,7 @@ module_param(debug_mask, ulong, 0644);
 
 static DEFINE_MUTEX(ide_disk_ref_mutex);
 
-static void ide_disk_release(struct kref *);
+static void ide_disk_release(struct device *);
 
 static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
 {
@@ -37,7 +37,7 @@ static struct ide_disk_obj *ide_disk_get(struct gendisk *disk)
                 if (ide_device_get(idkp->drive))
                         idkp = NULL;
                 else
-                        kref_get(&idkp->kref);
+                        get_device(&idkp->dev);
         }
         mutex_unlock(&ide_disk_ref_mutex);
         return idkp;
@@ -48,7 +48,7 @@ static void ide_disk_put(struct ide_disk_obj *idkp)
         ide_drive_t *drive = idkp->drive;
 
         mutex_lock(&ide_disk_ref_mutex);
-        kref_put(&idkp->kref, ide_disk_release);
+        put_device(&idkp->dev);
         ide_device_put(drive);
         mutex_unlock(&ide_disk_ref_mutex);
 }
@@ -66,17 +66,18 @@ static void ide_gd_remove(ide_drive_t *drive)
         struct gendisk *g = idkp->disk;
 
         ide_proc_unregister_driver(drive, idkp->driver);
-
+        device_del(&idkp->dev);
         del_gendisk(g);
-
         drive->disk_ops->flush(drive);
 
-        ide_disk_put(idkp);
+        mutex_lock(&ide_disk_ref_mutex);
+        put_device(&idkp->dev);
+        mutex_unlock(&ide_disk_ref_mutex);
 }
 
-static void ide_disk_release(struct kref *kref)
+static void ide_disk_release(struct device *dev)
 {
-        struct ide_disk_obj *idkp = to_ide_drv(kref, ide_disk_obj);
+        struct ide_disk_obj *idkp = to_ide_drv(dev, ide_disk_obj);
         ide_drive_t *drive = idkp->drive;
         struct gendisk *g = idkp->disk;
 
@@ -348,7 +349,12 @@ static int ide_gd_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&idkp->kref);
+        idkp->dev.parent = &drive->gendev;
+        idkp->dev.release = ide_disk_release;
+        dev_set_name(&idkp->dev, dev_name(&drive->gendev));
+
+        if (device_register(&idkp->dev))
+                goto out_free_disk;
 
         idkp->drive = drive;
         idkp->driver = &ide_gd_driver;
@@ -373,6 +379,8 @@ static int ide_gd_probe(ide_drive_t *drive)
         add_disk(g);
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_idkp:
         kfree(idkp);
 failed:
diff --git a/drivers/ide/ide-gd.h b/drivers/ide/ide-gd.h
index a86779f0756b..b604bdd318a1 100644
--- a/drivers/ide/ide-gd.h
+++ b/drivers/ide/ide-gd.h
@@ -17,7 +17,7 @@ struct ide_disk_obj {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
         unsigned int            openers;        /* protected by BKL for now */
 
         /* Last failed packet command */
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 9ee51adf567f..a9a6c208288a 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -908,7 +908,7 @@ void ide_timer_expiry (unsigned long data)
         ide_drive_t     *uninitialized_var(drive);
         ide_handler_t   *handler;
         unsigned long   flags;
-        unsigned long   wait = -1;
+        int             wait = -1;
         int             plug_device = 0;
 
         spin_lock_irqsave(&hwif->lock, flags);
@@ -1162,6 +1162,7 @@ out_early:
 
         return irq_ret;
 }
+EXPORT_SYMBOL_GPL(ide_intr);
 
 /**
  *      ide_do_drive_cmd        -       issue IDE special command
diff --git a/drivers/ide/ide-iops.c b/drivers/ide/ide-iops.c
index 753b92ebe0ae..b1892bd95c6f 100644
--- a/drivers/ide/ide-iops.c
+++ b/drivers/ide/ide-iops.c
@@ -315,6 +315,8 @@ void ide_output_data(ide_drive_t *drive, struct request *rq, void *buf,
         u8 io_32bit = drive->io_32bit;
         u8 mmio = (hwif->host_flags & IDE_HFLAG_MMIO) ? 1 : 0;
 
+        len++;
+
         if (io_32bit) {
                 unsigned long uninitialized_var(flags);
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index ce0818a993f6..ee8e3e7cad51 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -950,6 +950,7 @@ static int ide_port_setup_devices(ide_hwif_t *hwif)
 static int init_irq (ide_hwif_t *hwif)
 {
         struct ide_io_ports *io_ports = &hwif->io_ports;
+        irq_handler_t irq_handler;
         int sa = 0;
 
         mutex_lock(&ide_cfg_mtx);
@@ -959,6 +960,10 @@ static int init_irq (ide_hwif_t *hwif)
         hwif->timer.function = &ide_timer_expiry;
         hwif->timer.data = (unsigned long)hwif;
 
+        irq_handler = hwif->host->irq_handler;
+        if (irq_handler == NULL)
+                irq_handler = ide_intr;
+
 #if defined(__mc68000__)
         sa = IRQF_SHARED;
 #endif /* __mc68000__ */
@@ -969,7 +974,7 @@ static int init_irq (ide_hwif_t *hwif)
         if (io_ports->ctl_addr)
                 hwif->tp_ops->set_irq(hwif, 1);
 
-        if (request_irq(hwif->irq, &ide_intr, sa, hwif->name, hwif))
+        if (request_irq(hwif->irq, irq_handler, sa, hwif->name, hwif))
                 goto out_up;
 
         if (!hwif->rqsize) {
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 1d8978b3314a..a7b9287ee0d4 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -231,7 +231,7 @@ static const struct ide_proc_devset ide_generic_settings[] = {
         IDE_PROC_DEVSET(pio_mode, 0, 255),
         IDE_PROC_DEVSET(unmaskirq, 0, 1),
         IDE_PROC_DEVSET(using_dma, 0, 1),
-        { 0 },
+        { NULL },
 };
 
 static void proc_ide_settings_warn(void)
diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index d7ecd3c79757..4e6181c7bbda 100644
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -169,7 +169,7 @@ typedef struct ide_tape_obj {
         ide_drive_t             *drive;
         struct ide_driver       *driver;
         struct gendisk          *disk;
-        struct kref             kref;
+        struct device           dev;
 
         /*
          *      failed_pc points to the last failed packet command, or contains
@@ -267,7 +267,7 @@ static DEFINE_MUTEX(idetape_ref_mutex);
 
 static struct class *idetape_sysfs_class;
 
-static void ide_tape_release(struct kref *);
+static void ide_tape_release(struct device *);
 
 static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
 {
@@ -279,7 +279,7 @@ static struct ide_tape_obj *ide_tape_get(struct gendisk *disk)
                 if (ide_device_get(tape->drive))
                         tape = NULL;
                 else
-                        kref_get(&tape->kref);
+                        get_device(&tape->dev);
         }
         mutex_unlock(&idetape_ref_mutex);
         return tape;
@@ -290,7 +290,7 @@ static void ide_tape_put(struct ide_tape_obj *tape)
         ide_drive_t *drive = tape->drive;
 
         mutex_lock(&idetape_ref_mutex);
-        kref_put(&tape->kref, ide_tape_release);
+        put_device(&tape->dev);
         ide_device_put(drive);
         mutex_unlock(&idetape_ref_mutex);
 }
@@ -308,7 +308,7 @@ static struct ide_tape_obj *ide_tape_chrdev_get(unsigned int i)
         mutex_lock(&idetape_ref_mutex);
         tape = idetape_devs[i];
         if (tape)
-                kref_get(&tape->kref);
+                get_device(&tape->dev);
         mutex_unlock(&idetape_ref_mutex);
         return tape;
 }
@@ -2166,7 +2166,7 @@ static const struct ide_proc_devset idetape_settings[] = {
         __IDE_PROC_DEVSET(speed,        0, 0xffff, NULL, NULL),
         __IDE_PROC_DEVSET(tdsc,         IDETAPE_DSC_RW_MIN, IDETAPE_DSC_RW_MAX,
                                         mulf_tdsc, divf_tdsc),
-        { 0 },
+        { NULL },
 };
 #endif
 
@@ -2256,15 +2256,17 @@ static void ide_tape_remove(ide_drive_t *drive)
         idetape_tape_t *tape = drive->driver_data;
 
         ide_proc_unregister_driver(drive, tape->driver);
-
+        device_del(&tape->dev);
         ide_unregister_region(tape->disk);
 
-        ide_tape_put(tape);
+        mutex_lock(&idetape_ref_mutex);
+        put_device(&tape->dev);
+        mutex_unlock(&idetape_ref_mutex);
 }
 
-static void ide_tape_release(struct kref *kref)
+static void ide_tape_release(struct device *dev)
 {
-        struct ide_tape_obj *tape = to_ide_drv(kref, ide_tape_obj);
+        struct ide_tape_obj *tape = to_ide_drv(dev, ide_tape_obj);
         ide_drive_t *drive = tape->drive;
         struct gendisk *g = tape->disk;
 
@@ -2407,7 +2409,12 @@ static int ide_tape_probe(ide_drive_t *drive)
 
         ide_init_disk(g, drive);
 
-        kref_init(&tape->kref);
+        tape->dev.parent = &drive->gendev;
+        tape->dev.release = ide_tape_release;
+        dev_set_name(&tape->dev, dev_name(&drive->gendev));
+
+        if (device_register(&tape->dev))
+                goto out_free_disk;
 
         tape->drive = drive;
         tape->driver = &idetape_driver;
@@ -2436,6 +2443,8 @@ static int ide_tape_probe(ide_drive_t *drive)
 
         return 0;
 
+out_free_disk:
+        put_disk(g);
 out_free_tape:
         kfree(tape);
 failed:
diff --git a/drivers/ide/ide.c b/drivers/ide/ide.c
index 258805da15c3..0920e3b0c962 100644
--- a/drivers/ide/ide.c
+++ b/drivers/ide/ide.c
@@ -337,6 +337,7 @@ static int ide_set_dev_param_mask(const char *s, struct kernel_param *kp)
         int a, b, i, j = 1;
         unsigned int *dev_param_mask = (unsigned int *)kp->arg;
 
+        /* controller . device (0 or 1) [ : 1 (set) | 0 (clear) ] */
         if (sscanf(s, "%d.%d:%d", &a, &b, &j) != 3 &&
             sscanf(s, "%d.%d", &a, &b) != 2)
                 return -EINVAL;
@@ -349,7 +350,7 @@ static int ide_set_dev_param_mask(const char *s, struct kernel_param *kp)
         if (j)
                 *dev_param_mask |= (1 << i);
         else
-                *dev_param_mask &= (1 << i);
+                *dev_param_mask &= ~(1 << i);
 
         return 0;
 }
@@ -392,6 +393,8 @@ static int ide_set_disk_chs(const char *str, struct kernel_param *kp)
 {
         int a, b, c = 0, h = 0, s = 0, i, j = 1;
 
+        /* controller . device (0 or 1) : Cylinders , Heads , Sectors */
+        /* controller . device (0 or 1) : 1 (use CHS) | 0 (ignore CHS) */
         if (sscanf(str, "%d.%d:%d,%d,%d", &a, &b, &c, &h, &s) != 5 &&
             sscanf(str, "%d.%d:%d", &a, &b, &j) != 3)
                 return -EINVAL;
@@ -407,7 +410,7 @@ static int ide_set_disk_chs(const char *str, struct kernel_param *kp)
         if (j)
                 ide_disks |= (1 << i);
         else
-                ide_disks &= (1 << i);
+                ide_disks &= ~(1 << i);
 
         ide_disks_chs[i].cyl  = c;
         ide_disks_chs[i].head = h;
@@ -469,6 +472,8 @@ static int ide_set_ignore_cable(const char *s, struct kernel_param *kp)
 {
         int i, j = 1;
 
+        /* controller (ignore) */
+        /* controller : 1 (ignore) | 0 (use) */
         if (sscanf(s, "%d:%d", &i, &j) != 2 && sscanf(s, "%d", &i) != 1)
                 return -EINVAL;
 
@@ -478,7 +483,7 @@ static int ide_set_ignore_cable(const char *s, struct kernel_param *kp)
         if (j)
                 ide_ignore_cable |= (1 << i);
         else
-                ide_ignore_cable &= (1 << i);
+                ide_ignore_cable &= ~(1 << i);
 
         return 0;
 }
diff --git a/drivers/ide/it821x.c b/drivers/ide/it821x.c
index e1c4f5437396..13b8153112ed 100644
--- a/drivers/ide/it821x.c
+++ b/drivers/ide/it821x.c
@@ -5,9 +5,8 @@
  *  May be copied or modified under the terms of the GNU General Public License
  *  Based in part on the ITE vendor provided SCSI driver.
  *
- *  Documentation available from
- *      http://www.ite.com.tw/pc/IT8212F_V04.pdf
- *  Some other documents are NDA.
+ *  Documentation:
+ *      Datasheet is freely available, some other documents under NDA.
  *
  *  The ITE8212 isn't exactly a standard IDE controller. It has two
  *  modes. In pass through mode then it is an IDE controller. In its smart
diff --git a/drivers/ieee1394/dma.h b/drivers/ieee1394/dma.h
index 2727bcd24194..467373cab8e5 100644
--- a/drivers/ieee1394/dma.h
+++ b/drivers/ieee1394/dma.h
@@ -12,6 +12,7 @@
 
 #include <asm/types.h>
 
+struct file;
 struct pci_dev;
 struct scatterlist;
 struct vm_area_struct;
diff --git a/drivers/ieee1394/ieee1394_core.c b/drivers/ieee1394/ieee1394_core.c
index 2beb8d94f7bd..872338003721 100644
--- a/drivers/ieee1394/ieee1394_core.c
+++ b/drivers/ieee1394/ieee1394_core.c
@@ -1275,7 +1275,7 @@ static void __exit ieee1394_cleanup(void)
         unregister_chrdev_region(IEEE1394_CORE_DEV, 256);
 }
 
-module_init(ieee1394_init);
+fs_initcall(ieee1394_init);
 module_exit(ieee1394_cleanup);
 
 /* Exported symbols */
@@ -1314,6 +1314,7 @@ EXPORT_SYMBOL(hpsb_make_lock64packet);
 EXPORT_SYMBOL(hpsb_make_phypacket);
 EXPORT_SYMBOL(hpsb_read);
 EXPORT_SYMBOL(hpsb_write);
+EXPORT_SYMBOL(hpsb_lock);
 EXPORT_SYMBOL(hpsb_packet_success);
 
 /** highlevel.c **/
diff --git a/drivers/ieee1394/ieee1394_transactions.c b/drivers/ieee1394/ieee1394_transactions.c
index 10c3d9f8c038..675b3135d5f1 100644
--- a/drivers/ieee1394/ieee1394_transactions.c
+++ b/drivers/ieee1394/ieee1394_transactions.c
@@ -501,8 +501,6 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
         if (length == 0)
                 return -EINVAL;
 
-        BUG_ON(in_interrupt()); // We can't be called in an interrupt, yet
-
         packet = hpsb_make_readpacket(host, node, addr, length);
 
         if (!packet) {
@@ -550,8 +548,6 @@ int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
         if (length == 0)
                 return -EINVAL;
 
-        BUG_ON(in_interrupt()); // We can't be called in an interrupt, yet
-
         packet = hpsb_make_writepacket(host, node, addr, buffer, length);
 
         if (!packet)
@@ -570,3 +566,30 @@ int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
 
         return retval;
 }
+
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+              u64 addr, int extcode, quadlet_t *data, quadlet_t arg)
+{
+        struct hpsb_packet *packet;
+        int retval = 0;
+
+        packet = hpsb_make_lockpacket(host, node, addr, extcode, data, arg);
+        if (!packet)
+                return -ENOMEM;
+
+        packet->generation = generation;
+        retval = hpsb_send_packet_and_wait(packet);
+        if (retval < 0)
+                goto hpsb_lock_fail;
+
+        retval = hpsb_packet_success(packet);
+
+        if (retval == 0)
+                *data = packet->data[0];
+
+hpsb_lock_fail:
+        hpsb_free_tlabel(packet);
+        hpsb_free_packet(packet);
+
+        return retval;
+}
diff --git a/drivers/ieee1394/ieee1394_transactions.h b/drivers/ieee1394/ieee1394_transactions.h
index d2d5bc3546d7..20b693be14b2 100644
--- a/drivers/ieee1394/ieee1394_transactions.h
+++ b/drivers/ieee1394/ieee1394_transactions.h
@@ -30,6 +30,8 @@ int hpsb_read(struct hpsb_host *host, nodeid_t node, unsigned int generation,
               u64 addr, quadlet_t *buffer, size_t length);
 int hpsb_write(struct hpsb_host *host, nodeid_t node, unsigned int generation,
                u64 addr, quadlet_t *buffer, size_t length);
+int hpsb_lock(struct hpsb_host *host, nodeid_t node, unsigned int generation,
+              u64 addr, int extcode, quadlet_t *data, quadlet_t arg);
 
 #ifdef HPSB_DEBUG_TLABELS
 extern spinlock_t hpsb_tlabel_lock;
diff --git a/drivers/ieee1394/iso.h b/drivers/ieee1394/iso.h
index b5de5f21ef78..c2089c093aa7 100644
--- a/drivers/ieee1394/iso.h
+++ b/drivers/ieee1394/iso.h
@@ -13,6 +13,7 @@
 #define IEEE1394_ISO_H
 
 #include <linux/spinlock_types.h>
+#include <linux/wait.h>
 #include <asm/atomic.h>
 #include <asm/types.h>
 
diff --git a/drivers/ieee1394/nodemgr.c b/drivers/ieee1394/nodemgr.c
index 906c5a98d814..53aada5bbe1e 100644
--- a/drivers/ieee1394/nodemgr.c
+++ b/drivers/ieee1394/nodemgr.c
@@ -971,6 +971,9 @@ static struct unit_directory *nodemgr_process_unit_directory
         ud->ud_kv = ud_kv;
         ud->id = (*id)++;
 
+        /* inherit vendor_id from root directory if none exists in unit dir */
+        ud->vendor_id = ne->vendor_id;
+
         csr1212_for_each_dir_entry(ne->csr, kv, ud_kv, dentry) {
                 switch (kv->key.id) {
                 case CSR1212_KV_ID_VENDOR:
@@ -1265,7 +1268,8 @@ static void nodemgr_update_node(struct node_entry *ne, struct csr1212_csr *csr,
                 csr1212_destroy_csr(csr);
         }
 
-        /* Mark the node current */
+        /* Finally, mark the node current */
+        smp_wmb();
         ne->generation = generation;
 
         if (ne->in_limbo) {
@@ -1798,7 +1802,7 @@ void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet)
 {
         packet->host = ne->host;
         packet->generation = ne->generation;
-        barrier();
+        smp_rmb();
         packet->node_id = ne->nodeid;
 }
 
@@ -1807,7 +1811,7 @@ int hpsb_node_write(struct node_entry *ne, u64 addr,
 {
         unsigned int generation = ne->generation;
 
-        barrier();
+        smp_rmb();
         return hpsb_write(ne->host, ne->nodeid, generation,
                           addr, buffer, length);
 }
diff --git a/drivers/ieee1394/nodemgr.h b/drivers/ieee1394/nodemgr.h
index 15ea09733e84..ee5acdbd114a 100644
--- a/drivers/ieee1394/nodemgr.h
+++ b/drivers/ieee1394/nodemgr.h
@@ -21,9 +21,11 @@
 #define _IEEE1394_NODEMGR_H
 
 #include <linux/device.h>
+#include <asm/system.h>
 #include <asm/types.h>
 
 #include "ieee1394_core.h"
+#include "ieee1394_transactions.h"
 #include "ieee1394_types.h"
 
 struct csr1212_csr;
@@ -154,6 +156,22 @@ static inline int hpsb_node_entry_valid(struct node_entry *ne)
 void hpsb_node_fill_packet(struct node_entry *ne, struct hpsb_packet *packet);
 int hpsb_node_write(struct node_entry *ne, u64 addr,
                     quadlet_t *buffer, size_t length);
+static inline int hpsb_node_read(struct node_entry *ne, u64 addr,
+                                 quadlet_t *buffer, size_t length)
+{
+        unsigned int g = ne->generation;
+
+        smp_rmb();
+        return hpsb_read(ne->host, ne->nodeid, g, addr, buffer, length);
+}
+static inline int hpsb_node_lock(struct node_entry *ne, u64 addr, int extcode,
+                                 quadlet_t *buffer, quadlet_t arg)
+{
+        unsigned int g = ne->generation;
+
+        smp_rmb();
+        return hpsb_lock(ne->host, ne->nodeid, g, addr, extcode, buffer, arg);
+}
 int nodemgr_for_each_host(void *data, int (*cb)(struct hpsb_host *, void *));
 
 int init_ieee1394_nodemgr(void);
diff --git a/drivers/infiniband/hw/nes/nes_cm.c b/drivers/infiniband/hw/nes/nes_cm.c
index a01b4488208b..4a65b96db2c8 100644
--- a/drivers/infiniband/hw/nes/nes_cm.c
+++ b/drivers/infiniband/hw/nes/nes_cm.c
@@ -2490,12 +2490,14 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         int ret = 0;
         struct nes_vnic *nesvnic;
         struct nes_device *nesdev;
+        struct nes_ib_device *nesibdev;
 
         nesvnic = to_nesvnic(nesqp->ibqp.device);
         if (!nesvnic)
                 return -EINVAL;
 
         nesdev = nesvnic->nesdev;
+        nesibdev = nesvnic->nesibdev;
 
         nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
                         atomic_read(&nesvnic->netdev->refcnt));
@@ -2507,6 +2509,8 @@ static int nes_disconnect(struct nes_qp *nesqp, int abrupt)
         } else {
                 /* Need to free the Last Streaming Mode Message */
                 if (nesqp->ietf_frame) {
+                        if (nesqp->lsmm_mr)
+                                nesibdev->ibdev.dereg_mr(nesqp->lsmm_mr);
                         pci_free_consistent(nesdev->pcidev,
                                         nesqp->private_data_len+sizeof(struct ietf_mpa_frame),
                                         nesqp->ietf_frame, nesqp->ietf_frame_pbase);
@@ -2543,6 +2547,12 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         u32 crc_value;
         int ret;
         int passive_state;
+        struct nes_ib_device *nesibdev;
+        struct ib_mr *ibmr = NULL;
+        struct ib_phys_buf ibphysbuf;
+        struct nes_pd *nespd;
+
+
 
         ibqp = nes_get_qp(cm_id->device, conn_param->qpn);
         if (!ibqp)
@@ -2601,6 +2611,26 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         if (cm_id->remote_addr.sin_addr.s_addr !=
                         cm_id->local_addr.sin_addr.s_addr) {
                 u64temp = (unsigned long)nesqp;
+                nesibdev = nesvnic->nesibdev;
+                nespd = nesqp->nespd;
+                ibphysbuf.addr = nesqp->ietf_frame_pbase;
+                ibphysbuf.size = conn_param->private_data_len +
+                                        sizeof(struct ietf_mpa_frame);
+                ibmr = nesibdev->ibdev.reg_phys_mr((struct ib_pd *)nespd,
+                                                &ibphysbuf, 1,
+                                                IB_ACCESS_LOCAL_WRITE,
+                                                (u64 *)&nesqp->ietf_frame);
+                if (!ibmr) {
+                        nes_debug(NES_DBG_CM, "Unable to register memory region"
+                                        "for lSMM for cm_node = %p \n",
+                                        cm_node);
+                        return -ENOMEM;
+                }
+
+                ibmr->pd = &nespd->ibpd;
+                ibmr->device = nespd->ibpd.device;
+                nesqp->lsmm_mr = ibmr;
+
                 u64temp |= NES_SW_CONTEXT_ALIGN>>1;
                 set_wqe_64bit_value(wqe->wqe_words,
                         NES_IWARP_SQ_WQE_COMP_CTX_LOW_IDX,
@@ -2611,14 +2641,13 @@ int nes_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
                 wqe->wqe_words[NES_IWARP_SQ_WQE_TOTAL_PAYLOAD_IDX] =
                         cpu_to_le32(conn_param->private_data_len +
                         sizeof(struct ietf_mpa_frame));
-                wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_LOW_IDX] =
-                        cpu_to_le32((u32)nesqp->ietf_frame_pbase);
-                wqe->wqe_words[NES_IWARP_SQ_WQE_FRAG0_HIGH_IDX] =
-                        cpu_to_le32((u32)((u64)nesqp->ietf_frame_pbase >> 32));
+                set_wqe_64bit_value(wqe->wqe_words,
+                                        NES_IWARP_SQ_WQE_FRAG0_LOW_IDX,
+                                        (u64)nesqp->ietf_frame);
                 wqe->wqe_words[NES_IWARP_SQ_WQE_LENGTH0_IDX] =
                         cpu_to_le32(conn_param->private_data_len +
                         sizeof(struct ietf_mpa_frame));
-                wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = 0;
+                wqe->wqe_words[NES_IWARP_SQ_WQE_STAG0_IDX] = ibmr->lkey;
 
                 nesqp->nesqp_context->ird_ord_sizes |=
                         cpu_to_le32(NES_QPCONTEXT_ORDIRD_LSMM_PRESENT |
diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c
index 4fdb72454f94..d93a6562817c 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.c
+++ b/drivers/infiniband/hw/nes/nes_verbs.c
@@ -1360,8 +1360,10 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd,
                                         NES_QPCONTEXT_MISC_RQ_SIZE_SHIFT);
                         nesqp->nesqp_context->misc |= cpu_to_le32((u32)nesqp->hwqp.sq_encoded_size <<
                                         NES_QPCONTEXT_MISC_SQ_SIZE_SHIFT);
+                        if (!udata) {
                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_PRIV_EN);
                                 nesqp->nesqp_context->misc |= cpu_to_le32(NES_QPCONTEXT_MISC_FAST_REGISTER_EN);
+                        }
                         nesqp->nesqp_context->cqs = cpu_to_le32(nesqp->nesscq->hw_cq.cq_number +
                                         ((u32)nesqp->nesrcq->hw_cq.cq_number << 16));
                         u64temp = (u64)nesqp->hwqp.sq_pbase;
diff --git a/drivers/infiniband/hw/nes/nes_verbs.h b/drivers/infiniband/hw/nes/nes_verbs.h
index 6c6b4da5184f..ae0ca9bc83bd 100644
--- a/drivers/infiniband/hw/nes/nes_verbs.h
+++ b/drivers/infiniband/hw/nes/nes_verbs.h
@@ -134,6 +134,7 @@ struct nes_qp {
         struct ietf_mpa_frame *ietf_frame;
         dma_addr_t            ietf_frame_pbase;
         wait_queue_head_t     state_waitq;
+        struct ib_mr          *lsmm_mr;
         unsigned long         socket;
         struct nes_hw_qp      hwqp;
         struct work_struct    work;
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index c3c8b9bc40ae..45470f18d7e9 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -839,7 +839,7 @@ static void atkbd_disconnect(struct serio *serio)
  */
 static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
 {
-        const unsigned int forced_release_keys[] = {
+        static const unsigned int forced_release_keys[] = {
                 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x8b, 0x8f, 0x93,
         };
         int i;
@@ -856,7 +856,7 @@ static void atkbd_dell_laptop_keymap_fixup(struct atkbd *atkbd)
  */
 static void atkbd_hp_keymap_fixup(struct atkbd *atkbd)
 {
-        const unsigned int forced_release_keys[] = {
+        static const unsigned int forced_release_keys[] = {
                 0x94,
         };
         int i;
diff --git a/drivers/input/keyboard/bf54x-keys.c b/drivers/input/keyboard/bf54x-keys.c
index 19284016e0f4..ee855c5202e8 100644
--- a/drivers/input/keyboard/bf54x-keys.c
+++ b/drivers/input/keyboard/bf54x-keys.c
@@ -209,8 +209,8 @@ static int __devinit bfin_kpad_probe(struct platform_device *pdev)
                 goto out;
         }
 
-        if (!pdata->debounce_time || !pdata->debounce_time > MAX_MULT ||
-            !pdata->coldrive_time || !pdata->coldrive_time > MAX_MULT) {
+        if (!pdata->debounce_time || pdata->debounce_time > MAX_MULT ||
+            !pdata->coldrive_time || pdata->coldrive_time > MAX_MULT) {
                 printk(KERN_ERR DRV_NAME
                         ": Invalid Debounce/Columdrive Time from pdata\n");
                 bfin_write_KPAD_MSEL(0xFF0);    /* Default MSEL */
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
index c8ed065ea0cb..abb04c82c622 100644
--- a/drivers/input/keyboard/corgikbd.c
+++ b/drivers/input/keyboard/corgikbd.c
@@ -288,7 +288,7 @@ static int corgikbd_resume(struct platform_device *dev)
 #define corgikbd_resume         NULL
 #endif
 
-static int __init corgikbd_probe(struct platform_device *pdev)
+static int __devinit corgikbd_probe(struct platform_device *pdev)
 {
         struct corgikbd *corgikbd;
         struct input_dev *input_dev;
@@ -368,7 +368,7 @@ static int __init corgikbd_probe(struct platform_device *pdev)
         return err;
 }
 
-static int corgikbd_remove(struct platform_device *pdev)
+static int __devexit corgikbd_remove(struct platform_device *pdev)
 {
         int i;
         struct corgikbd *corgikbd = platform_get_drvdata(pdev);
@@ -388,7 +388,7 @@ static int corgikbd_remove(struct platform_device *pdev)
 
 static struct platform_driver corgikbd_driver = {
         .probe          = corgikbd_probe,
-        .remove         = corgikbd_remove,
+        .remove         = __devexit_p(corgikbd_remove),
         .suspend        = corgikbd_suspend,
         .resume         = corgikbd_resume,
         .driver         = {
@@ -397,7 +397,7 @@ static struct platform_driver corgikbd_driver = {
         },
 };
 
-static int __devinit corgikbd_init(void)
+static int __init corgikbd_init(void)
 {
         return platform_driver_register(&corgikbd_driver);
 }
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index 3f3d1198cdb1..058fa8b02c21 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -279,7 +279,7 @@ static int omap_kp_resume(struct platform_device *dev)
 #define omap_kp_resume  NULL
 #endif
 
-static int __init omap_kp_probe(struct platform_device *pdev)
+static int __devinit omap_kp_probe(struct platform_device *pdev)
 {
         struct omap_kp *omap_kp;
         struct input_dev *input_dev;
@@ -422,7 +422,7 @@ err1:
         return -EINVAL;
 }
 
-static int omap_kp_remove(struct platform_device *pdev)
+static int __devexit omap_kp_remove(struct platform_device *pdev)
 {
         struct omap_kp *omap_kp = platform_get_drvdata(pdev);
 
@@ -454,7 +454,7 @@ static int omap_kp_remove(struct platform_device *pdev)
 
 static struct platform_driver omap_kp_driver = {
         .probe          = omap_kp_probe,
-        .remove         = omap_kp_remove,
+        .remove         = __devexit_p(omap_kp_remove),
         .suspend        = omap_kp_suspend,
         .resume         = omap_kp_resume,
         .driver         = {
@@ -463,7 +463,7 @@ static struct platform_driver omap_kp_driver = {
         },
 };
 
-static int __devinit omap_kp_init(void)
+static int __init omap_kp_init(void)
 {
         printk(KERN_INFO "OMAP Keypad Driver\n");
         return platform_driver_register(&omap_kp_driver);
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index c48b76a46a58..9d1781a618e9 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -343,7 +343,7 @@ static int spitzkbd_resume(struct platform_device *dev)
 #define spitzkbd_resume         NULL
 #endif
 
-static int __init spitzkbd_probe(struct platform_device *dev)
+static int __devinit spitzkbd_probe(struct platform_device *dev)
 {
         struct spitzkbd *spitzkbd;
         struct input_dev *input_dev;
@@ -444,7 +444,7 @@ static int __init spitzkbd_probe(struct platform_device *dev)
         return err;
 }
 
-static int spitzkbd_remove(struct platform_device *dev)
+static int __devexit spitzkbd_remove(struct platform_device *dev)
 {
         int i;
         struct spitzkbd *spitzkbd = platform_get_drvdata(dev);
@@ -470,7 +470,7 @@ static int spitzkbd_remove(struct platform_device *dev)
 
 static struct platform_driver spitzkbd_driver = {
         .probe          = spitzkbd_probe,
-        .remove         = spitzkbd_remove,
+        .remove         = __devexit_p(spitzkbd_remove),
         .suspend        = spitzkbd_suspend,
         .resume         = spitzkbd_resume,
         .driver         = {
@@ -479,7 +479,7 @@ static struct platform_driver spitzkbd_driver = {
         },
 };
 
-static int __devinit spitzkbd_init(void)
+static int __init spitzkbd_init(void)
 {
         return platform_driver_register(&spitzkbd_driver);
 }
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index 093c8c1bca74..9705f3a00a3d 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -70,7 +70,7 @@ config MOUSE_PS2_SYNAPTICS
 config MOUSE_PS2_LIFEBOOK
         bool "Fujitsu Lifebook PS/2 mouse protocol extension" if EMBEDDED
         default y
-        depends on MOUSE_PS2
+        depends on MOUSE_PS2 && X86
         help
           Say Y here if you have a Fujitsu B-series Lifebook PS/2
           TouchScreen connected to your system.
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index b9a25d57bc5e..6ab0eb1ada1c 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -542,7 +542,7 @@ int elantech_detect(struct psmouse *psmouse, int set_properties)
             ps2_command(ps2dev,  NULL, PSMOUSE_CMD_SETSCALE11) ||
             ps2_command(ps2dev,  NULL, PSMOUSE_CMD_SETSCALE11) ||
             ps2_command(ps2dev, param, PSMOUSE_CMD_GETINFO)) {
-                pr_err("elantech.c: sending Elantech magic knock failed.\n");
+                pr_debug("elantech.c: sending Elantech magic knock failed.\n");
                 return -1;
         }
 
@@ -551,8 +551,27 @@ int elantech_detect(struct psmouse *psmouse, int set_properties)
          * set of magic numbers
          */
         if (param[0] != 0x3c || param[1] != 0x03 || param[2] != 0xc8) {
-                pr_info("elantech.c: unexpected magic knock result 0x%02x, 0x%02x, 0x%02x.\n",
-                        param[0], param[1], param[2]);
+                pr_debug("elantech.c: "
+                         "unexpected magic knock result 0x%02x, 0x%02x, 0x%02x.\n",
+                         param[0], param[1], param[2]);
+                return -1;
+        }
+
+        /*
+         * Query touchpad's firmware version and see if it reports known
+         * value to avoid mis-detection. Logitech mice are known to respond
+         * to Elantech magic knock and there might be more.
+         */
+        if (synaptics_send_cmd(psmouse, ETP_FW_VERSION_QUERY, param)) {
+                pr_debug("elantech.c: failed to query firmware version.\n");
+                return -1;
+        }
+
+        pr_debug("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
+                 param[0], param[1], param[2]);
+
+        if (param[0] == 0 || param[1] != 0) {
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
                 return -1;
         }
 
@@ -600,8 +619,7 @@ int elantech_init(struct psmouse *psmouse)
         int i, error;
         unsigned char param[3];
 
-        etd = kzalloc(sizeof(struct elantech_data), GFP_KERNEL);
-        psmouse->private = etd;
+        psmouse->private = etd = kzalloc(sizeof(struct elantech_data), GFP_KERNEL);
         if (!etd)
                 return -1;
 
@@ -610,14 +628,12 @@ int elantech_init(struct psmouse *psmouse)
                 etd->parity[i] = etd->parity[i & (i - 1)] ^ 1;
 
         /*
-         * Find out what version hardware this is
+         * Do the version query again so we can store the result
          */
         if (synaptics_send_cmd(psmouse, ETP_FW_VERSION_QUERY, param)) {
                 pr_err("elantech.c: failed to query firmware version.\n");
                 goto init_fail;
         }
-        pr_info("elantech.c: Elantech version query result 0x%02x, 0x%02x, 0x%02x.\n",
-                param[0], param[1], param[2]);
         etd->fw_version_maj = param[0];
         etd->fw_version_min = param[2];
 
diff --git a/drivers/input/mouse/pxa930_trkball.c b/drivers/input/mouse/pxa930_trkball.c
index d297accf9a7f..1e827ad0afbe 100644
--- a/drivers/input/mouse/pxa930_trkball.c
+++ b/drivers/input/mouse/pxa930_trkball.c
@@ -83,7 +83,7 @@ static int write_tbcr(struct pxa930_trkball *trkball, int v)
 
         __raw_writel(v, trkball->mmio_base + TBCR);
 
-        while (i--) {
+        while (--i) {
                 if (__raw_readl(trkball->mmio_base + TBCR) == v)
                         break;
                 msleep(1);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 865fc69e9bc3..f3e4f7b0240d 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -182,11 +182,6 @@ static int synaptics_identify(struct psmouse *psmouse)
 
 static int synaptics_query_hardware(struct psmouse *psmouse)
 {
-        int retries = 0;
-
-        while ((retries++ < 3) && psmouse_reset(psmouse))
-                /* empty */;
-
         if (synaptics_identify(psmouse))
                 return -1;
         if (synaptics_model_id(psmouse))
@@ -582,6 +577,8 @@ static int synaptics_reconnect(struct psmouse *psmouse)
         struct synaptics_data *priv = psmouse->private;
         struct synaptics_data old_priv = *priv;
 
+        psmouse_reset(psmouse);
+
         if (synaptics_detect(psmouse, 0))
                 return -1;
 
@@ -640,6 +637,8 @@ int synaptics_init(struct psmouse *psmouse)
         if (!priv)
                 return -1;
 
+        psmouse_reset(psmouse);
+
         if (synaptics_query_hardware(psmouse)) {
                 printk(KERN_ERR "Unable to query Synaptics hardware.\n");
                 goto init_fail;
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index b10ffae7c39b..e29cdc13a199 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -57,7 +57,7 @@ static int amba_kmi_write(struct serio *io, unsigned char val)
         struct amba_kmi_port *kmi = io->port_data;
         unsigned int timeleft = 10000; /* timeout in 100ms */
 
-        while ((readb(KMISTAT) & KMISTAT_TXEMPTY) == 0 && timeleft--)
+        while ((readb(KMISTAT) & KMISTAT_TXEMPTY) == 0 && --timeleft)
                 udelay(10);
 
         if (timeleft)
@@ -129,8 +129,8 @@ static int amba_kmi_probe(struct amba_device *dev, void *id)
         io->write       = amba_kmi_write;
         io->open        = amba_kmi_open;
         io->close       = amba_kmi_close;
-        strlcpy(io->name, dev->dev.bus_id, sizeof(io->name));
-        strlcpy(io->phys, dev->dev.bus_id, sizeof(io->phys));
+        strlcpy(io->name, dev_name(&dev->dev), sizeof(io->name));
+        strlcpy(io->phys, dev_name(&dev->dev), sizeof(io->phys));
         io->port_data   = kmi;
         io->dev.parent  = &dev->dev;
 
diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
index adc3bd6e7f7b..bd0f92d9f40f 100644
--- a/drivers/input/serio/gscps2.c
+++ b/drivers/input/serio/gscps2.c
@@ -359,7 +359,7 @@ static int __init gscps2_probe(struct parisc_device *dev)
 
         snprintf(serio->name, sizeof(serio->name), "GSC PS/2 %s",
                  (ps2port->id == GSC_ID_KEYBOARD) ? "keyboard" : "mouse");
-        strlcpy(serio->phys, dev->dev.bus_id, sizeof(serio->phys));
+        strlcpy(serio->phys, dev_name(&dev->dev), sizeof(serio->phys));
         serio->id.type          = SERIO_8042;
         serio->write            = gscps2_write;
         serio->open             = gscps2_open;
diff --git a/drivers/input/serio/sa1111ps2.c b/drivers/input/serio/sa1111ps2.c
index 2ad88780a170..57953c0eb82f 100644
--- a/drivers/input/serio/sa1111ps2.c
+++ b/drivers/input/serio/sa1111ps2.c
@@ -246,8 +246,8 @@ static int __devinit ps2_probe(struct sa1111_dev *dev)
         serio->write            = ps2_write;
         serio->open             = ps2_open;
         serio->close            = ps2_close;
-        strlcpy(serio->name, dev->dev.bus_id, sizeof(serio->name));
-        strlcpy(serio->phys, dev->dev.bus_id, sizeof(serio->phys));
+        strlcpy(serio->name, dev_name(&dev->dev), sizeof(serio->name));
+        strlcpy(serio->phys, dev_name(&dev->dev), sizeof(serio->phys));
         serio->port_data        = ps2if;
         serio->dev.parent       = &dev->dev;
         ps2if->io               = serio;
diff --git a/drivers/input/touchscreen/atmel_tsadcc.c b/drivers/input/touchscreen/atmel_tsadcc.c
index a89a6a8f05e6..055969e8be13 100644
--- a/drivers/input/touchscreen/atmel_tsadcc.c
+++ b/drivers/input/touchscreen/atmel_tsadcc.c
@@ -236,7 +236,7 @@ static int __devinit atmel_tsadcc_probe(struct platform_device *pdev)
         ts_dev->bufferedmeasure = 0;
 
         snprintf(ts_dev->phys, sizeof(ts_dev->phys),
-                 "%s/input0", pdev->dev.bus_id);
+                 "%s/input0", dev_name(&pdev->dev));
 
         input_dev->name = "atmel touch screen controller";
         input_dev->phys = ts_dev->phys;
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
index 65202c9f63ff..3fb51b54fe61 100644
--- a/drivers/input/touchscreen/corgi_ts.c
+++ b/drivers/input/touchscreen/corgi_ts.c
@@ -268,7 +268,7 @@ static int corgits_resume(struct platform_device *dev)
 #define corgits_resume          NULL
 #endif
 
-static int __init corgits_probe(struct platform_device *pdev)
+static int __devinit corgits_probe(struct platform_device *pdev)
 {
         struct corgi_ts *corgi_ts;
         struct input_dev *input_dev;
@@ -343,7 +343,7 @@ static int __init corgits_probe(struct platform_device *pdev)
         return err;
 }
 
-static int corgits_remove(struct platform_device *pdev)
+static int __devexit corgits_remove(struct platform_device *pdev)
 {
         struct corgi_ts *corgi_ts = platform_get_drvdata(pdev);
 
@@ -352,12 +352,13 @@ static int corgits_remove(struct platform_device *pdev)
         corgi_ts->machinfo->put_hsync();
         input_unregister_device(corgi_ts->input);
         kfree(corgi_ts);
+
         return 0;
 }
 
 static struct platform_driver corgits_driver = {
         .probe          = corgits_probe,
-        .remove         = corgits_remove,
+        .remove         = __devexit_p(corgits_remove),
         .suspend        = corgits_suspend,
         .resume         = corgits_resume,
         .driver         = {
@@ -366,7 +367,7 @@ static struct platform_driver corgits_driver = {
         },
 };
 
-static int __devinit corgits_init(void)
+static int __init corgits_init(void)
 {
         return platform_driver_register(&corgits_driver);
 }
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index b75dc2990574..4ab070246892 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -289,7 +289,8 @@ static int tsc2007_probe(struct i2c_client *client,
 
         pdata->init_platform_hw();
 
-        snprintf(ts->phys, sizeof(ts->phys), "%s/input0", client->dev.bus_id);
+        snprintf(ts->phys, sizeof(ts->phys),
+                 "%s/input0", dev_name(&client->dev));
 
         input_dev->name = "TSC2007 Touchscreen";
         input_dev->phys = ts->phys;
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 5080b26ba160..fb7cb9bdfbd5 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -60,6 +60,10 @@ static int swap_xy;
 module_param(swap_xy, bool, 0644);
 MODULE_PARM_DESC(swap_xy, "If set X and Y axes are swapped.");
 
+static int hwcalib_xy;
+module_param(hwcalib_xy, bool, 0644);
+MODULE_PARM_DESC(hwcalib_xy, "If set hw-calibrated X/Y are used if available");
+
 /* device specifc data/functions */
 struct usbtouch_usb;
 struct usbtouch_device_info {
@@ -118,6 +122,7 @@ enum {
 
 #define USB_DEVICE_HID_CLASS(vend, prod) \
         .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS \
+                | USB_DEVICE_ID_MATCH_INT_PROTOCOL \
                 | USB_DEVICE_ID_MATCH_DEVICE, \
         .idVendor = (vend), \
         .idProduct = (prod), \
@@ -260,8 +265,13 @@ static int panjit_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 
 static int mtouch_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
-        dev->x = (pkt[8] << 8) | pkt[7];
-        dev->y = (pkt[10] << 8) | pkt[9];
+        if (hwcalib_xy) {
+                dev->x = (pkt[4] << 8) | pkt[3];
+                dev->y = 0xffff - ((pkt[6] << 8) | pkt[5]);
+        } else {
+                dev->x = (pkt[8] << 8) | pkt[7];
+                dev->y = (pkt[10] << 8) | pkt[9];
+        }
         dev->touch = (pkt[2] & 0x40) ? 1 : 0;
 
         return 1;
@@ -294,6 +304,12 @@ static int mtouch_init(struct usbtouch_usb *usbtouch)
                         return ret;
         }
 
+        /* Default min/max xy are the raw values, override if using hw-calib */
+        if (hwcalib_xy) {
+                input_set_abs_params(usbtouch->input, ABS_X, 0, 0xffff, 0, 0);
+                input_set_abs_params(usbtouch->input, ABS_Y, 0, 0xffff, 0, 0);
+        }
+
         return 0;
 }
 #endif
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index b4d44e571d76..8132533d71f9 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -212,6 +212,9 @@ static void lg_notify(struct virtqueue *vq)
         hcall(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT, 0, 0);
 }
 
+/* An extern declaration inside a C file is bad form.  Don't do it. */
+extern void lguest_setup_irq(unsigned int irq);
+
 /* This routine finds the first virtqueue described in the configuration of
  * this device and sets it up.
  *
@@ -266,6 +269,9 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
                 goto unmap;
         }
 
+        /* Make sure the interrupt is allocated. */
+        lguest_setup_irq(lvq->config.irq);
+
         /* Tell the interrupt for this virtqueue to go to the virtio_ring
          * interrupt handler. */
         /* FIXME: We used to have a flag for the Host to tell us we could use
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 03b4cd0a6344..a307f87eb90e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -214,12 +214,7 @@ static inline mddev_t *mddev_get(mddev_t *mddev)
         return mddev;
 }
 
-static void mddev_delayed_delete(struct work_struct *ws)
-{
-        mddev_t *mddev = container_of(ws, mddev_t, del_work);
-        kobject_del(&mddev->kobj);
-        kobject_put(&mddev->kobj);
-}
+static void mddev_delayed_delete(struct work_struct *ws);
 
 static void mddev_put(mddev_t *mddev)
 {
@@ -3542,6 +3537,21 @@ static struct kobj_type md_ktype = {
 
 int mdp_major = 0;
 
+static void mddev_delayed_delete(struct work_struct *ws)
+{
+        mddev_t *mddev = container_of(ws, mddev_t, del_work);
+
+        if (mddev->private == &md_redundancy_group) {
+                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->sysfs_action)
+                        sysfs_put(mddev->sysfs_action);
+                mddev->sysfs_action = NULL;
+                mddev->private = NULL;
+        }
+        kobject_del(&mddev->kobj);
+        kobject_put(&mddev->kobj);
+}
+
 static int md_alloc(dev_t dev, char *name)
 {
         static DEFINE_MUTEX(disks_mutex);
@@ -4033,13 +4043,9 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                         mddev->queue->merge_bvec_fn = NULL;
                         mddev->queue->unplug_fn = NULL;
                         mddev->queue->backing_dev_info.congested_fn = NULL;
-                        if (mddev->pers->sync_request) {
-                                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
-                                if (mddev->sysfs_action)
-                                        sysfs_put(mddev->sysfs_action);
-                                mddev->sysfs_action = NULL;
-                        }
                         module_put(mddev->pers->owner);
+                        if (mddev->pers->sync_request)
+                                mddev->private = &md_redundancy_group;
                         mddev->pers = NULL;
                         /* tell userspace to handle 'inactive' */
                         sysfs_notify_dirent(mddev->sysfs_state);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 01e3cffd03b8..e2466425d9ca 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1237,8 +1237,9 @@ static void end_sync_write(struct bio *bio, int error)
         update_head_pos(mirror, r1_bio);
 
         if (atomic_dec_and_test(&r1_bio->remaining)) {
-                md_done_sync(mddev, r1_bio->sectors, uptodate);
+                sector_t s = r1_bio->sectors;
                 put_buf(r1_bio);
+                md_done_sync(mddev, s, uptodate);
         }
 }
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6736d6dff981..7301631abe04 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1236,6 +1236,7 @@ static void end_sync_read(struct bio *bio, int error)
         /* for reconstruct, we always reschedule after a read.
          * for resync, only after all reads
          */
+        rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
         if (test_bit(R10BIO_IsRecover, &r10_bio->state) ||
             atomic_dec_and_test(&r10_bio->remaining)) {
                 /* we have read all the blocks,
@@ -1243,7 +1244,6 @@ static void end_sync_read(struct bio *bio, int error)
                  */
                 reschedule_retry(r10_bio);
         }
-        rdev_dec_pending(conf->mirrors[d].rdev, conf->mddev);
 }
 
 static void end_sync_write(struct bio *bio, int error)
@@ -1264,11 +1264,13 @@ static void end_sync_write(struct bio *bio, int error)
 
         update_head_pos(i, r10_bio);
 
+        rdev_dec_pending(conf->mirrors[d].rdev, mddev);
         while (atomic_dec_and_test(&r10_bio->remaining)) {
                 if (r10_bio->master_bio == NULL) {
                         /* the primary of several recovery bios */
-                        md_done_sync(mddev, r10_bio->sectors, 1);
+                        sector_t s = r10_bio->sectors;
                         put_buf(r10_bio);
+                        md_done_sync(mddev, s, 1);
                         break;
                 } else {
                         r10bio_t *r10_bio2 = (r10bio_t *)r10_bio->master_bio;
@@ -1276,7 +1278,6 @@ static void end_sync_write(struct bio *bio, int error)
                         r10_bio = r10_bio2;
                 }
         }
-        rdev_dec_pending(conf->mirrors[d].rdev, mddev);
 }
 
 /*
@@ -1749,8 +1750,6 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         if (!go_faster && conf->nr_waiting)
                 msleep_interruptible(1000);
 
-        bitmap_cond_end_sync(mddev->bitmap, sector_nr);
-
         /* Again, very different code for resync and recovery.
          * Both must result in an r10bio with a list of bios that
          * have bi_end_io, bi_sector, bi_bdev set,
@@ -1886,6 +1885,8 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                 /* resync. Schedule a read for every block at this virt offset */
                 int count = 0;
 
+                bitmap_cond_end_sync(mddev->bitmap, sector_nr);
+
                 if (!bitmap_start_sync(mddev->bitmap, sector_nr,
                                        &sync_blocks, mddev->degraded) &&
                     !conf->fullsync && !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
@@ -2010,13 +2011,13 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
         /* There is nowhere to write, so all non-sync
          * drives must be failed, so try the next chunk...
          */
-        {
-        sector_t sec = max_sector - sector_nr;
-        sectors_skipped += sec;
+        if (sector_nr + max_sync < max_sector)
+                max_sector = sector_nr + max_sync;
+
+        sectors_skipped += (max_sector - sector_nr);
         chunks_skipped ++;
         sector_nr = max_sector;
         goto skipped;
-        }
 }
 
 static int run(mddev_t *mddev)
diff --git a/drivers/media/dvb/Kconfig b/drivers/media/dvb/Kconfig
index 40ebde53b3ce..b0198691892a 100644
--- a/drivers/media/dvb/Kconfig
+++ b/drivers/media/dvb/Kconfig
@@ -51,6 +51,10 @@ comment "Supported SDMC DM1105 Adapters"
         depends on DVB_CORE && PCI && I2C
 source "drivers/media/dvb/dm1105/Kconfig"
 
+comment "Supported FireWire (IEEE 1394) Adapters"
+        depends on DVB_CORE && IEEE1394
+source "drivers/media/dvb/firewire/Kconfig"
+
 comment "Supported DVB Frontends"
         depends on DVB_CORE
 source "drivers/media/dvb/frontends/Kconfig"
diff --git a/drivers/media/dvb/Makefile b/drivers/media/dvb/Makefile
index f91e9eb15e52..6092a5bb5a7d 100644
--- a/drivers/media/dvb/Makefile
+++ b/drivers/media/dvb/Makefile
@@ -3,3 +3,5 @@
 #
 
 obj-y        := dvb-core/ frontends/ ttpci/ ttusb-dec/ ttusb-budget/ b2c2/ bt8xx/ dvb-usb/ pluto2/ siano/ dm1105/
+
+obj-$(CONFIG_DVB_FIREDTV)       += firewire/
diff --git a/drivers/media/dvb/b2c2/flexcop-hw-filter.c b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
index b386cc66c6b3..451974ba32f3 100644
--- a/drivers/media/dvb/b2c2/flexcop-hw-filter.c
+++ b/drivers/media/dvb/b2c2/flexcop-hw-filter.c
@@ -192,6 +192,7 @@ int flexcop_pid_feed_control(struct flexcop_device *fc, struct dvb_demux_feed *d
 
         return 0;
 }
+EXPORT_SYMBOL(flexcop_pid_feed_control);
 
 void flexcop_hw_filter_init(struct flexcop_device *fc)
 {
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 5b30dfc7846b..76e37fd96bb6 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -13,9 +13,9 @@ static int enable_pid_filtering = 1;
 module_param(enable_pid_filtering, int, 0444);
 MODULE_PARM_DESC(enable_pid_filtering, "enable hardware pid filtering: supported values: 0 (fullts), 1");
 
-static int irq_chk_intv;
+static int irq_chk_intv = 100;
 module_param(irq_chk_intv, int, 0644);
-MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ watchdog (currently just debugging).");
+MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ streaming watchdog.");
 
 #ifdef CONFIG_DVB_B2C2_FLEXCOP_DEBUG
 #define dprintk(level,args...) \
@@ -34,7 +34,9 @@ MODULE_PARM_DESC(irq_chk_intv, "set the interval for IRQ watchdog (currently jus
 
 static int debug;
 module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug, "set debug level (1=info,2=regs,4=TS,8=irqdma (|-able))." DEBSTATUS);
+MODULE_PARM_DESC(debug,
+        "set debug level (1=info,2=regs,4=TS,8=irqdma,16=check (|-able))."
+         DEBSTATUS);
 
 #define DRIVER_VERSION "0.1"
 #define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
@@ -58,6 +60,8 @@ struct flexcop_pci {
         int active_dma1_addr; /* 0 = addr0 of dma1; 1 = addr1 of dma1 */
         u32 last_dma1_cur_pos; /* position of the pointer last time the timer/packet irq occured */
         int count;
+        int count_prev;
+        int stream_problem;
 
         spinlock_t irq_lock;
 
@@ -103,18 +107,32 @@ static void flexcop_pci_irq_check_work(struct work_struct *work)
                 container_of(work, struct flexcop_pci, irq_check_work.work);
         struct flexcop_device *fc = fc_pci->fc_dev;
 
-        flexcop_ibi_value v = fc->read_ibi_reg(fc,sram_dest_reg_714);
-
-        flexcop_dump_reg(fc_pci->fc_dev,dma1_000,4);
-
-        if (v.sram_dest_reg_714.net_ovflow_error)
-                deb_chk("sram net_ovflow_error\n");
-        if (v.sram_dest_reg_714.media_ovflow_error)
-                deb_chk("sram media_ovflow_error\n");
-        if (v.sram_dest_reg_714.cai_ovflow_error)
-                deb_chk("sram cai_ovflow_error\n");
-        if (v.sram_dest_reg_714.cai_ovflow_error)
-                deb_chk("sram cai_ovflow_error\n");
+        if (fc->feedcount) {
+
+                if (fc_pci->count == fc_pci->count_prev) {
+                        deb_chk("no IRQ since the last check\n");
+                        if (fc_pci->stream_problem++ == 3) {
+                                struct dvb_demux_feed *feed;
+
+                                spin_lock_irq(&fc->demux.lock);
+                                list_for_each_entry(feed, &fc->demux.feed_list,
+                                        list_head) {
+                                        flexcop_pid_feed_control(fc, feed, 0);
+                                }
+
+                                list_for_each_entry(feed, &fc->demux.feed_list,
+                                        list_head) {
+                                        flexcop_pid_feed_control(fc, feed, 1);
+                                }
+                                spin_unlock_irq(&fc->demux.lock);
+
+                                fc_pci->stream_problem = 0;
+                        }
+                } else {
+                        fc_pci->stream_problem = 0;
+                        fc_pci->count_prev = fc_pci->count;
+                }
+        }
 
         schedule_delayed_work(&fc_pci->irq_check_work,
                         msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
@@ -216,16 +234,12 @@ static int flexcop_pci_stream_control(struct flexcop_device *fc, int onoff)
                 flexcop_dma_control_timer_irq(fc,FC_DMA_1,1);
                 deb_irq("IRQ enabled\n");
 
+                fc_pci->count_prev = fc_pci->count;
+
 //              fc_pci->active_dma1_addr = 0;
 //              flexcop_dma_control_size_irq(fc,FC_DMA_1,1);
 
-                if (irq_chk_intv > 0)
-                        schedule_delayed_work(&fc_pci->irq_check_work,
-                                        msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
         } else {
-                if (irq_chk_intv > 0)
-                        cancel_delayed_work(&fc_pci->irq_check_work);
-
                 flexcop_dma_control_timer_irq(fc,FC_DMA_1,0);
                 deb_irq("IRQ disabled\n");
 
@@ -299,8 +313,6 @@ static int flexcop_pci_init(struct flexcop_pci *fc_pci)
                                         IRQF_SHARED, DRIVER_NAME, fc_pci)) != 0)
                 goto err_pci_iounmap;
 
-
-
         fc_pci->init_state |= FC_PCI_INIT;
         return ret;
 
@@ -375,6 +387,10 @@ static int flexcop_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         INIT_DELAYED_WORK(&fc_pci->irq_check_work, flexcop_pci_irq_check_work);
 
+                if (irq_chk_intv > 0)
+                        schedule_delayed_work(&fc_pci->irq_check_work,
+                msecs_to_jiffies(irq_chk_intv < 100 ? 100 : irq_chk_intv));
+
         return ret;
 
 err_fc_exit:
@@ -393,6 +409,9 @@ static void flexcop_pci_remove(struct pci_dev *pdev)
 {
         struct flexcop_pci *fc_pci = pci_get_drvdata(pdev);
 
+        if (irq_chk_intv > 0)
+                cancel_delayed_work(&fc_pci->irq_check_work);
+
         flexcop_pci_dma_exit(fc_pci);
         flexcop_device_exit(fc_pci->fc_dev);
         flexcop_pci_exit(fc_pci);
diff --git a/drivers/media/dvb/b2c2/flexcop.c b/drivers/media/dvb/b2c2/flexcop.c
index 676413a915b4..91068952b502 100644
--- a/drivers/media/dvb/b2c2/flexcop.c
+++ b/drivers/media/dvb/b2c2/flexcop.c
@@ -212,8 +212,7 @@ void flexcop_reset_block_300(struct flexcop_device *fc)
         v210.sw_reset_210.Block_reset_enable = 0xb2;
 
         fc->write_ibi_reg(fc,sw_reset_210,v210);
-        msleep(1);
-
+        udelay(1000);
         fc->write_ibi_reg(fc,ctrl_208,v208_save);
 }
 
diff --git a/drivers/media/dvb/firewire/Kconfig b/drivers/media/dvb/firewire/Kconfig
new file mode 100644
index 000000000000..69028253e984
--- /dev/null
+++ b/drivers/media/dvb/firewire/Kconfig
@@ -0,0 +1,22 @@
+config DVB_FIREDTV
+        tristate "FireDTV and FloppyDTV"
+        depends on DVB_CORE && IEEE1394
+        help
+          Support for DVB receivers from Digital Everywhere
+          which are connected via IEEE 1394 (FireWire).
+
+          These devices don't have an MPEG decoder built in,
+          so you need an external software decoder to watch TV.
+
+          To compile this driver as a module, say M here:
+          the module will be called firedtv.
+
+if DVB_FIREDTV
+
+config DVB_FIREDTV_IEEE1394
+        def_bool IEEE1394
+
+config DVB_FIREDTV_INPUT
+        def_bool INPUT = y || (INPUT = m && DVB_FIREDTV = m)
+
+endif # DVB_FIREDTV
diff --git a/drivers/media/dvb/firewire/Makefile b/drivers/media/dvb/firewire/Makefile
new file mode 100644
index 000000000000..2034695ba194
--- /dev/null
+++ b/drivers/media/dvb/firewire/Makefile
@@ -0,0 +1,8 @@
+obj-$(CONFIG_DVB_FIREDTV) += firedtv.o
+
+firedtv-y := firedtv-avc.o firedtv-ci.o firedtv-dvb.o firedtv-fe.o
+firedtv-$(CONFIG_DVB_FIREDTV_IEEE1394) += firedtv-1394.o
+firedtv-$(CONFIG_DVB_FIREDTV_INPUT)    += firedtv-rc.o
+
+ccflags-y += -Idrivers/media/dvb/dvb-core
+ccflags-$(CONFIG_DVB_FIREDTV_IEEE1394) += -Idrivers/ieee1394
diff --git a/drivers/media/dvb/firewire/firedtv-1394.c b/drivers/media/dvb/firewire/firedtv-1394.c
new file mode 100644
index 000000000000..4e207658c5d9
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-1394.c
@@ -0,0 +1,285 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2007-2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/types.h>
+
+#include <dma.h>
+#include <csr1212.h>
+#include <highlevel.h>
+#include <hosts.h>
+#include <ieee1394.h>
+#include <iso.h>
+#include <nodemgr.h>
+
+#include "firedtv.h"
+
+static LIST_HEAD(node_list);
+static DEFINE_SPINLOCK(node_list_lock);
+
+#define FIREWIRE_HEADER_SIZE    4
+#define CIP_HEADER_SIZE         8
+
+static void rawiso_activity_cb(struct hpsb_iso *iso)
+{
+        struct firedtv *f, *fdtv = NULL;
+        unsigned int i, num, packet;
+        unsigned char *buf;
+        unsigned long flags;
+        int count;
+
+        spin_lock_irqsave(&node_list_lock, flags);
+        list_for_each_entry(f, &node_list, list)
+                if (f->backend_data == iso) {
+                        fdtv = f;
+                        break;
+                }
+        spin_unlock_irqrestore(&node_list_lock, flags);
+
+        packet = iso->first_packet;
+        num = hpsb_iso_n_ready(iso);
+
+        if (!fdtv) {
+                dev_err(fdtv->device, "received at unknown iso channel\n");
+                goto out;
+        }
+
+        for (i = 0; i < num; i++, packet = (packet + 1) % iso->buf_packets) {
+                buf = dma_region_i(&iso->data_buf, unsigned char,
+                        iso->infos[packet].offset + CIP_HEADER_SIZE);
+                count = (iso->infos[packet].len - CIP_HEADER_SIZE) /
+                        (188 + FIREWIRE_HEADER_SIZE);
+
+                /* ignore empty packet */
+                if (iso->infos[packet].len <= CIP_HEADER_SIZE)
+                        continue;
+
+                while (count--) {
+                        if (buf[FIREWIRE_HEADER_SIZE] == 0x47)
+                                dvb_dmx_swfilter_packets(&fdtv->demux,
+                                                &buf[FIREWIRE_HEADER_SIZE], 1);
+                        else
+                                dev_err(fdtv->device,
+                                        "skipping invalid packet\n");
+                        buf += 188 + FIREWIRE_HEADER_SIZE;
+                }
+        }
+out:
+        hpsb_iso_recv_release_packets(iso, num);
+}
+
+static inline struct node_entry *node_of(struct firedtv *fdtv)
+{
+        return container_of(fdtv->device, struct unit_directory, device)->ne;
+}
+
+static int node_lock(struct firedtv *fdtv, u64 addr, void *data, __be32 arg)
+{
+        return hpsb_node_lock(node_of(fdtv), addr, EXTCODE_COMPARE_SWAP, data,
+                              (__force quadlet_t)arg);
+}
+
+static int node_read(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+{
+        return hpsb_node_read(node_of(fdtv), addr, data, len);
+}
+
+static int node_write(struct firedtv *fdtv, u64 addr, void *data, size_t len)
+{
+        return hpsb_node_write(node_of(fdtv), addr, data, len);
+}
+
+#define FDTV_ISO_BUFFER_PACKETS 256
+#define FDTV_ISO_BUFFER_SIZE (FDTV_ISO_BUFFER_PACKETS * 200)
+
+static int start_iso(struct firedtv *fdtv)
+{
+        struct hpsb_iso *iso_handle;
+        int ret;
+
+        iso_handle = hpsb_iso_recv_init(node_of(fdtv)->host,
+                                FDTV_ISO_BUFFER_SIZE, FDTV_ISO_BUFFER_PACKETS,
+                                fdtv->isochannel, HPSB_ISO_DMA_DEFAULT,
+                                -1, /* stat.config.irq_interval */
+                                rawiso_activity_cb);
+        if (iso_handle == NULL) {
+                dev_err(fdtv->device, "cannot initialize iso receive\n");
+                return -ENOMEM;
+        }
+        fdtv->backend_data = iso_handle;
+
+        ret = hpsb_iso_recv_start(iso_handle, -1, -1, 0);
+        if (ret != 0) {
+                dev_err(fdtv->device, "cannot start iso receive\n");
+                hpsb_iso_shutdown(iso_handle);
+                fdtv->backend_data = NULL;
+        }
+        return ret;
+}
+
+static void stop_iso(struct firedtv *fdtv)
+{
+        struct hpsb_iso *iso_handle = fdtv->backend_data;
+
+        if (iso_handle != NULL) {
+                hpsb_iso_stop(iso_handle);
+                hpsb_iso_shutdown(iso_handle);
+        }
+        fdtv->backend_data = NULL;
+}
+
+static const struct firedtv_backend fdtv_1394_backend = {
+        .lock           = node_lock,
+        .read           = node_read,
+        .write          = node_write,
+        .start_iso      = start_iso,
+        .stop_iso       = stop_iso,
+};
+
+static void fcp_request(struct hpsb_host *host, int nodeid, int direction,
+                        int cts, u8 *data, size_t length)
+{
+        struct firedtv *f, *fdtv = NULL;
+        unsigned long flags;
+        int su;
+
+        if (length == 0 || (data[0] & 0xf0) != 0)
+                return;
+
+        su = data[1] & 0x7;
+
+        spin_lock_irqsave(&node_list_lock, flags);
+        list_for_each_entry(f, &node_list, list)
+                if (node_of(f)->host == host &&
+                    node_of(f)->nodeid == nodeid &&
+                    (f->subunit == su || (f->subunit == 0 && su == 0x7))) {
+                        fdtv = f;
+                        break;
+                }
+        spin_unlock_irqrestore(&node_list_lock, flags);
+
+        if (fdtv)
+                avc_recv(fdtv, data, length);
+}
+
+static int node_probe(struct device *dev)
+{
+        struct unit_directory *ud =
+                        container_of(dev, struct unit_directory, device);
+        struct firedtv *fdtv;
+        int kv_len, err;
+        void *kv_str;
+
+        kv_len = (ud->model_name_kv->value.leaf.len - 2) * sizeof(quadlet_t);
+        kv_str = CSR1212_TEXTUAL_DESCRIPTOR_LEAF_DATA(ud->model_name_kv);
+
+        fdtv = fdtv_alloc(dev, &fdtv_1394_backend, kv_str, kv_len);
+        if (!fdtv)
+                return -ENOMEM;
+
+        /*
+         * Work around a bug in udev's path_id script:  Use the fw-host's dev
+         * instead of the unit directory's dev as parent of the input device.
+         */
+        err = fdtv_register_rc(fdtv, dev->parent->parent);
+        if (err)
+                goto fail_free;
+
+        spin_lock_irq(&node_list_lock);
+        list_add_tail(&fdtv->list, &node_list);
+        spin_unlock_irq(&node_list_lock);
+
+        err = avc_identify_subunit(fdtv);
+        if (err)
+                goto fail;
+
+        err = fdtv_dvb_register(fdtv);
+        if (err)
+                goto fail;
+
+        avc_register_remote_control(fdtv);
+        return 0;
+fail:
+        spin_lock_irq(&node_list_lock);
+        list_del(&fdtv->list);
+        spin_unlock_irq(&node_list_lock);
+        fdtv_unregister_rc(fdtv);
+fail_free:
+        kfree(fdtv);
+        return err;
+}
+
+static int node_remove(struct device *dev)
+{
+        struct firedtv *fdtv = dev->driver_data;
+
+        fdtv_dvb_unregister(fdtv);
+
+        spin_lock_irq(&node_list_lock);
+        list_del(&fdtv->list);
+        spin_unlock_irq(&node_list_lock);
+
+        cancel_work_sync(&fdtv->remote_ctrl_work);
+        fdtv_unregister_rc(fdtv);
+
+        kfree(fdtv);
+        return 0;
+}
+
+static int node_update(struct unit_directory *ud)
+{
+        struct firedtv *fdtv = ud->device.driver_data;
+
+        if (fdtv->isochannel >= 0)
+                cmp_establish_pp_connection(fdtv, fdtv->subunit,
+                                            fdtv->isochannel);
+        return 0;
+}
+
+static struct hpsb_protocol_driver fdtv_driver = {
+        .name           = "firedtv",
+        .update         = node_update,
+        .driver         = {
+                .probe  = node_probe,
+                .remove = node_remove,
+        },
+};
+
+static struct hpsb_highlevel fdtv_highlevel = {
+        .name           = "firedtv",
+        .fcp_request    = fcp_request,
+};
+
+int __init fdtv_1394_init(struct ieee1394_device_id id_table[])
+{
+        int ret;
+
+        hpsb_register_highlevel(&fdtv_highlevel);
+        fdtv_driver.id_table = id_table;
+        ret = hpsb_register_protocol(&fdtv_driver);
+        if (ret) {
+                printk(KERN_ERR "firedtv: failed to register protocol\n");
+                hpsb_unregister_highlevel(&fdtv_highlevel);
+        }
+        return ret;
+}
+
+void __exit fdtv_1394_exit(void)
+{
+        hpsb_unregister_protocol(&fdtv_driver);
+        hpsb_unregister_highlevel(&fdtv_highlevel);
+}
diff --git a/drivers/media/dvb/firewire/firedtv-avc.c b/drivers/media/dvb/firewire/firedtv-avc.c
new file mode 100644
index 000000000000..b55d9ccaf33e
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-avc.c
@@ -0,0 +1,1315 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Ben Backx <ben@bbackx.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bug.h>
+#include <linux/crc32.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/jiffies.h>
+#include <linux/kernel.h>
+#include <linux/moduleparam.h>
+#include <linux/mutex.h>
+#include <linux/string.h>
+#include <linux/stringify.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include "firedtv.h"
+
+#define FCP_COMMAND_REGISTER            0xfffff0000b00ULL
+
+#define AVC_CTYPE_CONTROL               0x0
+#define AVC_CTYPE_STATUS                0x1
+#define AVC_CTYPE_NOTIFY                0x3
+
+#define AVC_RESPONSE_ACCEPTED           0x9
+#define AVC_RESPONSE_STABLE             0xc
+#define AVC_RESPONSE_CHANGED            0xd
+#define AVC_RESPONSE_INTERIM            0xf
+
+#define AVC_SUBUNIT_TYPE_TUNER          (0x05 << 3)
+#define AVC_SUBUNIT_TYPE_UNIT           (0x1f << 3)
+
+#define AVC_OPCODE_VENDOR               0x00
+#define AVC_OPCODE_READ_DESCRIPTOR      0x09
+#define AVC_OPCODE_DSIT                 0xc8
+#define AVC_OPCODE_DSD                  0xcb
+
+#define DESCRIPTOR_TUNER_STATUS         0x80
+#define DESCRIPTOR_SUBUNIT_IDENTIFIER   0x00
+
+#define SFE_VENDOR_DE_COMPANYID_0       0x00 /* OUI of Digital Everywhere */
+#define SFE_VENDOR_DE_COMPANYID_1       0x12
+#define SFE_VENDOR_DE_COMPANYID_2       0x87
+
+#define SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL 0x0a
+#define SFE_VENDOR_OPCODE_LNB_CONTROL           0x52
+#define SFE_VENDOR_OPCODE_TUNE_QPSK             0x58 /* for DVB-S */
+
+#define SFE_VENDOR_OPCODE_GET_FIRMWARE_VERSION  0x00
+#define SFE_VENDOR_OPCODE_HOST2CA               0x56
+#define SFE_VENDOR_OPCODE_CA2HOST               0x57
+#define SFE_VENDOR_OPCODE_CISTATUS              0x59
+#define SFE_VENDOR_OPCODE_TUNE_QPSK2            0x60 /* for DVB-S2 */
+
+#define SFE_VENDOR_TAG_CA_RESET                 0x00
+#define SFE_VENDOR_TAG_CA_APPLICATION_INFO      0x01
+#define SFE_VENDOR_TAG_CA_PMT                   0x02
+#define SFE_VENDOR_TAG_CA_DATE_TIME             0x04
+#define SFE_VENDOR_TAG_CA_MMI                   0x05
+#define SFE_VENDOR_TAG_CA_ENTER_MENU            0x07
+
+#define EN50221_LIST_MANAGEMENT_ONLY    0x03
+#define EN50221_TAG_APP_INFO            0x9f8021
+#define EN50221_TAG_CA_INFO             0x9f8031
+
+struct avc_command_frame {
+        int length;
+        u8 ctype;
+        u8 subunit;
+        u8 opcode;
+        u8 operand[509];
+};
+
+struct avc_response_frame {
+        int length;
+        u8 response;
+        u8 subunit;
+        u8 opcode;
+        u8 operand[509];
+};
+
+#define AVC_DEBUG_FCP_SUBACTIONS        1
+#define AVC_DEBUG_FCP_PAYLOADS          2
+
+static int avc_debug;
+module_param_named(debug, avc_debug, int, 0644);
+MODULE_PARM_DESC(debug, "Verbose logging (default = 0"
+        ", FCP subactions = "   __stringify(AVC_DEBUG_FCP_SUBACTIONS)
+        ", FCP payloads = "     __stringify(AVC_DEBUG_FCP_PAYLOADS)
+        ", or all = -1)");
+
+static const char *debug_fcp_ctype(unsigned int ctype)
+{
+        static const char *ctypes[] = {
+                [0x0] = "CONTROL",              [0x1] = "STATUS",
+                [0x2] = "SPECIFIC INQUIRY",     [0x3] = "NOTIFY",
+                [0x4] = "GENERAL INQUIRY",      [0x8] = "NOT IMPLEMENTED",
+                [0x9] = "ACCEPTED",             [0xa] = "REJECTED",
+                [0xb] = "IN TRANSITION",        [0xc] = "IMPLEMENTED/STABLE",
+                [0xd] = "CHANGED",              [0xf] = "INTERIM",
+        };
+        const char *ret = ctype < ARRAY_SIZE(ctypes) ? ctypes[ctype] : NULL;
+
+        return ret ? ret : "?";
+}
+
+static const char *debug_fcp_opcode(unsigned int opcode,
+                                    const u8 *data, size_t length)
+{
+        switch (opcode) {
+        case AVC_OPCODE_VENDOR:                 break;
+        case AVC_OPCODE_READ_DESCRIPTOR:        return "ReadDescriptor";
+        case AVC_OPCODE_DSIT:                   return "DirectSelectInfo.Type";
+        case AVC_OPCODE_DSD:                    return "DirectSelectData";
+        default:                                return "?";
+        }
+
+        if (length < 7 ||
+            data[3] != SFE_VENDOR_DE_COMPANYID_0 ||
+            data[4] != SFE_VENDOR_DE_COMPANYID_1 ||
+            data[5] != SFE_VENDOR_DE_COMPANYID_2)
+                return "Vendor";
+
+        switch (data[6]) {
+        case SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL: return "RegisterRC";
+        case SFE_VENDOR_OPCODE_LNB_CONTROL:             return "LNBControl";
+        case SFE_VENDOR_OPCODE_TUNE_QPSK:               return "TuneQPSK";
+        case SFE_VENDOR_OPCODE_HOST2CA:                 return "Host2CA";
+        case SFE_VENDOR_OPCODE_CA2HOST:                 return "CA2Host";
+        }
+        return "Vendor";
+}
+
+static void debug_fcp(const u8 *data, size_t length)
+{
+        unsigned int subunit_type, subunit_id, op;
+        const char *prefix = data[0] > 7 ? "FCP <- " : "FCP -> ";
+
+        if (avc_debug & AVC_DEBUG_FCP_SUBACTIONS) {
+                subunit_type = data[1] >> 3;
+                subunit_id = data[1] & 7;
+                op = subunit_type == 0x1e || subunit_id == 5 ? ~0 : data[2];
+                printk(KERN_INFO "%ssu=%x.%x l=%d: %-8s - %s\n",
+                       prefix, subunit_type, subunit_id, length,
+                       debug_fcp_ctype(data[0]),
+                       debug_fcp_opcode(op, data, length));
+        }
+
+        if (avc_debug & AVC_DEBUG_FCP_PAYLOADS)
+                print_hex_dump(KERN_INFO, prefix, DUMP_PREFIX_NONE, 16, 1,
+                               data, length, false);
+}
+
+static int __avc_write(struct firedtv *fdtv,
+                const struct avc_command_frame *c, struct avc_response_frame *r)
+{
+        int err, retry;
+
+        if (r)
+                fdtv->avc_reply_received = false;
+
+        for (retry = 0; retry < 6; retry++) {
+                if (unlikely(avc_debug))
+                        debug_fcp(&c->ctype, c->length);
+
+                err = fdtv->backend->write(fdtv, FCP_COMMAND_REGISTER,
+                                           (void *)&c->ctype, c->length);
+                if (err) {
+                        fdtv->avc_reply_received = true;
+                        dev_err(fdtv->device, "FCP command write failed\n");
+                        return err;
+                }
+
+                if (!r)
+                        return 0;
+
+                /*
+                 * AV/C specs say that answers should be sent within 150 ms.
+                 * Time out after 200 ms.
+                 */
+                if (wait_event_timeout(fdtv->avc_wait,
+                                       fdtv->avc_reply_received,
+                                       msecs_to_jiffies(200)) != 0) {
+                        r->length = fdtv->response_length;
+                        memcpy(&r->response, fdtv->response, r->length);
+
+                        return 0;
+                }
+        }
+        dev_err(fdtv->device, "FCP response timed out\n");
+        return -ETIMEDOUT;
+}
+
+static int avc_write(struct firedtv *fdtv,
+                const struct avc_command_frame *c, struct avc_response_frame *r)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = __avc_write(fdtv, c, r);
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+int avc_recv(struct firedtv *fdtv, void *data, size_t length)
+{
+        struct avc_response_frame *r =
+                        data - offsetof(struct avc_response_frame, response);
+
+        if (unlikely(avc_debug))
+                debug_fcp(data, length);
+
+        if (length >= 8 &&
+            r->operand[0] == SFE_VENDOR_DE_COMPANYID_0 &&
+            r->operand[1] == SFE_VENDOR_DE_COMPANYID_1 &&
+            r->operand[2] == SFE_VENDOR_DE_COMPANYID_2 &&
+            r->operand[3] == SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL) {
+                if (r->response == AVC_RESPONSE_CHANGED) {
+                        fdtv_handle_rc(fdtv,
+                            r->operand[4] << 8 | r->operand[5]);
+                        schedule_work(&fdtv->remote_ctrl_work);
+                } else if (r->response != AVC_RESPONSE_INTERIM) {
+                        dev_info(fdtv->device,
+                                 "remote control result = %d\n", r->response);
+                }
+                return 0;
+        }
+
+        if (fdtv->avc_reply_received) {
+                dev_err(fdtv->device, "out-of-order AVC response, ignored\n");
+                return -EIO;
+        }
+
+        memcpy(fdtv->response, data, length);
+        fdtv->response_length = length;
+
+        fdtv->avc_reply_received = true;
+        wake_up(&fdtv->avc_wait);
+
+        return 0;
+}
+
+/*
+ * tuning command for setting the relative LNB frequency
+ * (not supported by the AVC standard)
+ */
+static void avc_tuner_tuneqpsk(struct firedtv *fdtv,
+                               struct dvb_frontend_parameters *params,
+                               struct avc_command_frame *c)
+{
+        c->opcode = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_TUNE_QPSK;
+
+        c->operand[4] = (params->frequency >> 24) & 0xff;
+        c->operand[5] = (params->frequency >> 16) & 0xff;
+        c->operand[6] = (params->frequency >> 8) & 0xff;
+        c->operand[7] = params->frequency & 0xff;
+
+        c->operand[8] = ((params->u.qpsk.symbol_rate / 1000) >> 8) & 0xff;
+        c->operand[9] = (params->u.qpsk.symbol_rate / 1000) & 0xff;
+
+        switch (params->u.qpsk.fec_inner) {
+        case FEC_1_2:   c->operand[10] = 0x1; break;
+        case FEC_2_3:   c->operand[10] = 0x2; break;
+        case FEC_3_4:   c->operand[10] = 0x3; break;
+        case FEC_5_6:   c->operand[10] = 0x4; break;
+        case FEC_7_8:   c->operand[10] = 0x5; break;
+        case FEC_4_5:
+        case FEC_8_9:
+        case FEC_AUTO:
+        default:        c->operand[10] = 0x0;
+        }
+
+        if (fdtv->voltage == 0xff)
+                c->operand[11] = 0xff;
+        else if (fdtv->voltage == SEC_VOLTAGE_18) /* polarisation */
+                c->operand[11] = 0;
+        else
+                c->operand[11] = 1;
+
+        if (fdtv->tone == 0xff)
+                c->operand[12] = 0xff;
+        else if (fdtv->tone == SEC_TONE_ON) /* band */
+                c->operand[12] = 1;
+        else
+                c->operand[12] = 0;
+
+        if (fdtv->type == FIREDTV_DVB_S2) {
+                c->operand[13] = 0x1;
+                c->operand[14] = 0xff;
+                c->operand[15] = 0xff;
+                c->length = 20;
+        } else {
+                c->length = 16;
+        }
+}
+
+static void avc_tuner_dsd_dvb_c(struct dvb_frontend_parameters *params,
+                                struct avc_command_frame *c)
+{
+        c->opcode = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;    /* source plug */
+        c->operand[1] = 0xd2; /* subfunction replace */
+        c->operand[2] = 0x20; /* system id = DVB */
+        c->operand[3] = 0x00; /* antenna number */
+        c->operand[4] = 0x11; /* system_specific_multiplex selection_length */
+
+        /* multiplex_valid_flags, high byte */
+        c->operand[5] =   0 << 7 /* reserved */
+                        | 0 << 6 /* Polarisation */
+                        | 0 << 5 /* Orbital_Pos */
+                        | 1 << 4 /* Frequency */
+                        | 1 << 3 /* Symbol_Rate */
+                        | 0 << 2 /* FEC_outer */
+                        | (params->u.qam.fec_inner  != FEC_AUTO ? 1 << 1 : 0)
+                        | (params->u.qam.modulation != QAM_AUTO ? 1 << 0 : 0);
+
+        /* multiplex_valid_flags, low byte */
+        c->operand[6] =   0 << 7 /* NetworkID */
+                        | 0 << 0 /* reserved */ ;
+
+        c->operand[7]  = 0x00;
+        c->operand[8]  = 0x00;
+        c->operand[9]  = 0x00;
+        c->operand[10] = 0x00;
+
+        c->operand[11] = (((params->frequency / 4000) >> 16) & 0xff) | (2 << 6);
+        c->operand[12] = ((params->frequency / 4000) >> 8) & 0xff;
+        c->operand[13] = (params->frequency / 4000) & 0xff;
+        c->operand[14] = ((params->u.qpsk.symbol_rate / 1000) >> 12) & 0xff;
+        c->operand[15] = ((params->u.qpsk.symbol_rate / 1000) >> 4) & 0xff;
+        c->operand[16] = ((params->u.qpsk.symbol_rate / 1000) << 4) & 0xf0;
+        c->operand[17] = 0x00;
+
+        switch (params->u.qpsk.fec_inner) {
+        case FEC_1_2:   c->operand[18] = 0x1; break;
+        case FEC_2_3:   c->operand[18] = 0x2; break;
+        case FEC_3_4:   c->operand[18] = 0x3; break;
+        case FEC_5_6:   c->operand[18] = 0x4; break;
+        case FEC_7_8:   c->operand[18] = 0x5; break;
+        case FEC_8_9:   c->operand[18] = 0x6; break;
+        case FEC_4_5:   c->operand[18] = 0x8; break;
+        case FEC_AUTO:
+        default:        c->operand[18] = 0x0;
+        }
+
+        switch (params->u.qam.modulation) {
+        case QAM_16:    c->operand[19] = 0x08; break;
+        case QAM_32:    c->operand[19] = 0x10; break;
+        case QAM_64:    c->operand[19] = 0x18; break;
+        case QAM_128:   c->operand[19] = 0x20; break;
+        case QAM_256:   c->operand[19] = 0x28; break;
+        case QAM_AUTO:
+        default:        c->operand[19] = 0x00;
+        }
+
+        c->operand[20] = 0x00;
+        c->operand[21] = 0x00;
+        /* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+        c->operand[22] = 0x00;
+
+        c->length = 28;
+}
+
+static void avc_tuner_dsd_dvb_t(struct dvb_frontend_parameters *params,
+                                struct avc_command_frame *c)
+{
+        struct dvb_ofdm_parameters *ofdm = &params->u.ofdm;
+
+        c->opcode = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;    /* source plug */
+        c->operand[1] = 0xd2; /* subfunction replace */
+        c->operand[2] = 0x20; /* system id = DVB */
+        c->operand[3] = 0x00; /* antenna number */
+        c->operand[4] = 0x0c; /* system_specific_multiplex selection_length */
+
+        /* multiplex_valid_flags, high byte */
+        c->operand[5] =
+              0 << 7 /* reserved */
+            | 1 << 6 /* CenterFrequency */
+            | (ofdm->bandwidth      != BANDWIDTH_AUTO        ? 1 << 5 : 0)
+            | (ofdm->constellation  != QAM_AUTO              ? 1 << 4 : 0)
+            | (ofdm->hierarchy_information != HIERARCHY_AUTO ? 1 << 3 : 0)
+            | (ofdm->code_rate_HP   != FEC_AUTO              ? 1 << 2 : 0)
+            | (ofdm->code_rate_LP   != FEC_AUTO              ? 1 << 1 : 0)
+            | (ofdm->guard_interval != GUARD_INTERVAL_AUTO   ? 1 << 0 : 0);
+
+        /* multiplex_valid_flags, low byte */
+        c->operand[6] =
+              0 << 7 /* NetworkID */
+            | (ofdm->transmission_mode != TRANSMISSION_MODE_AUTO ? 1 << 6 : 0)
+            | 0 << 5 /* OtherFrequencyFlag */
+            | 0 << 0 /* reserved */ ;
+
+        c->operand[7]  = 0x0;
+        c->operand[8]  = (params->frequency / 10) >> 24;
+        c->operand[9]  = ((params->frequency / 10) >> 16) & 0xff;
+        c->operand[10] = ((params->frequency / 10) >>  8) & 0xff;
+        c->operand[11] = (params->frequency / 10) & 0xff;
+
+        switch (ofdm->bandwidth) {
+        case BANDWIDTH_7_MHZ:   c->operand[12] = 0x20; break;
+        case BANDWIDTH_8_MHZ:
+        case BANDWIDTH_6_MHZ:   /* not defined by AVC spec */
+        case BANDWIDTH_AUTO:
+        default:                c->operand[12] = 0x00;
+        }
+
+        switch (ofdm->constellation) {
+        case QAM_16:    c->operand[13] = 1 << 6; break;
+        case QAM_64:    c->operand[13] = 2 << 6; break;
+        case QPSK:
+        default:        c->operand[13] = 0x00;
+        }
+
+        switch (ofdm->hierarchy_information) {
+        case HIERARCHY_1:       c->operand[13] |= 1 << 3; break;
+        case HIERARCHY_2:       c->operand[13] |= 2 << 3; break;
+        case HIERARCHY_4:       c->operand[13] |= 3 << 3; break;
+        case HIERARCHY_AUTO:
+        case HIERARCHY_NONE:
+        default:                break;
+        }
+
+        switch (ofdm->code_rate_HP) {
+        case FEC_2_3:   c->operand[13] |= 1; break;
+        case FEC_3_4:   c->operand[13] |= 2; break;
+        case FEC_5_6:   c->operand[13] |= 3; break;
+        case FEC_7_8:   c->operand[13] |= 4; break;
+        case FEC_1_2:
+        default:        break;
+        }
+
+        switch (ofdm->code_rate_LP) {
+        case FEC_2_3:   c->operand[14] = 1 << 5; break;
+        case FEC_3_4:   c->operand[14] = 2 << 5; break;
+        case FEC_5_6:   c->operand[14] = 3 << 5; break;
+        case FEC_7_8:   c->operand[14] = 4 << 5; break;
+        case FEC_1_2:
+        default:        c->operand[14] = 0x00; break;
+        }
+
+        switch (ofdm->guard_interval) {
+        case GUARD_INTERVAL_1_16:       c->operand[14] |= 1 << 3; break;
+        case GUARD_INTERVAL_1_8:        c->operand[14] |= 2 << 3; break;
+        case GUARD_INTERVAL_1_4:        c->operand[14] |= 3 << 3; break;
+        case GUARD_INTERVAL_1_32:
+        case GUARD_INTERVAL_AUTO:
+        default:                        break;
+        }
+
+        switch (ofdm->transmission_mode) {
+        case TRANSMISSION_MODE_8K:      c->operand[14] |= 1 << 1; break;
+        case TRANSMISSION_MODE_2K:
+        case TRANSMISSION_MODE_AUTO:
+        default:                        break;
+        }
+
+        c->operand[15] = 0x00; /* network_ID[0] */
+        c->operand[16] = 0x00; /* network_ID[1] */
+        /* Nr_of_dsd_sel_specs = 0 -> no PIDs are transmitted */
+        c->operand[17] = 0x00;
+
+        c->length = 24;
+}
+
+int avc_tuner_dsd(struct firedtv *fdtv,
+                  struct dvb_frontend_parameters *params)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+
+        switch (fdtv->type) {
+        case FIREDTV_DVB_S:
+        case FIREDTV_DVB_S2: avc_tuner_tuneqpsk(fdtv, params, c); break;
+        case FIREDTV_DVB_C: avc_tuner_dsd_dvb_c(params, c); break;
+        case FIREDTV_DVB_T: avc_tuner_dsd_dvb_t(params, c); break;
+        default:
+                BUG();
+        }
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(500);
+#if 0
+        /* FIXME: */
+        /* u8 *status was an out-parameter of avc_tuner_dsd, unused by caller */
+        if (status)
+                *status = r->operand[2];
+#endif
+        return 0;
+}
+
+int avc_tuner_set_pids(struct firedtv *fdtv, unsigned char pidc, u16 pid[])
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+        int pos, k;
+
+        if (pidc > 16 && pidc != 0xff)
+                return -EINVAL;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_DSD;
+
+        c->operand[0] = 0;      /* source plug */
+        c->operand[1] = 0xd2;   /* subfunction replace */
+        c->operand[2] = 0x20;   /* system id = DVB */
+        c->operand[3] = 0x00;   /* antenna number */
+        c->operand[4] = 0x00;   /* system_specific_multiplex selection_length */
+        c->operand[5] = pidc;   /* Nr_of_dsd_sel_specs */
+
+        pos = 6;
+        if (pidc != 0xff)
+                for (k = 0; k < pidc; k++) {
+                        c->operand[pos++] = 0x13; /* flowfunction relay */
+                        c->operand[pos++] = 0x80; /* dsd_sel_spec_valid_flags -> PID */
+                        c->operand[pos++] = (pid[k] >> 8) & 0x1f;
+                        c->operand[pos++] = pid[k] & 0xff;
+                        c->operand[pos++] = 0x00; /* tableID */
+                        c->operand[pos++] = 0x00; /* filter_length */
+                }
+
+        c->length = ALIGN(3 + pos, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(50);
+        return 0;
+}
+
+int avc_tuner_get_ts(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+        int sl;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_DSIT;
+
+        sl = fdtv->type == FIREDTV_DVB_T ? 0x0c : 0x11;
+
+        c->operand[0] = 0;      /* source plug */
+        c->operand[1] = 0xd2;   /* subfunction replace */
+        c->operand[2] = 0xff;   /* status */
+        c->operand[3] = 0x20;   /* system id = DVB */
+        c->operand[4] = 0x00;   /* antenna number */
+        c->operand[5] = 0x0;    /* system_specific_search_flags */
+        c->operand[6] = sl;     /* system_specific_multiplex selection_length */
+        c->operand[7] = 0x00;   /* valid_flags [0] */
+        c->operand[8] = 0x00;   /* valid_flags [1] */
+        c->operand[7 + sl] = 0x00; /* nr_of_dsit_sel_specs (always 0) */
+
+        c->length = fdtv->type == FIREDTV_DVB_T ? 24 : 28;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        msleep(250);
+        return 0;
+}
+
+int avc_identify_subunit(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
+
+        c->operand[0] = DESCRIPTOR_SUBUNIT_IDENTIFIER;
+        c->operand[1] = 0xff;
+        c->operand[2] = 0x00;
+        c->operand[3] = 0x00; /* length highbyte */
+        c->operand[4] = 0x08; /* length lowbyte  */
+        c->operand[5] = 0x00; /* offset highbyte */
+        c->operand[6] = 0x0d; /* offset lowbyte  */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if ((r->response != AVC_RESPONSE_STABLE &&
+             r->response != AVC_RESPONSE_ACCEPTED) ||
+            (r->operand[3] << 8) + r->operand[4] != 8) {
+                dev_err(fdtv->device, "cannot read subunit identifier\n");
+                return -EINVAL;
+        }
+        return 0;
+}
+
+#define SIZEOF_ANTENNA_INPUT_INFO 22
+
+int avc_tuner_status(struct firedtv *fdtv, struct firedtv_tuner_status *stat)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int length;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_READ_DESCRIPTOR;
+
+        c->operand[0] = DESCRIPTOR_TUNER_STATUS;
+        c->operand[1] = 0xff;   /* read_result_status */
+        c->operand[2] = 0x00;   /* reserved */
+        c->operand[3] = 0;      /* SIZEOF_ANTENNA_INPUT_INFO >> 8; */
+        c->operand[4] = 0;      /* SIZEOF_ANTENNA_INPUT_INFO & 0xff; */
+        c->operand[5] = 0x00;
+        c->operand[6] = 0x00;
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_STABLE &&
+            r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device, "cannot read tuner status\n");
+                return -EINVAL;
+        }
+
+        length = r->operand[9];
+        if (r->operand[1] != 0x10 || length != SIZEOF_ANTENNA_INPUT_INFO) {
+                dev_err(fdtv->device, "got invalid tuner status\n");
+                return -EINVAL;
+        }
+
+        stat->active_system             = r->operand[10];
+        stat->searching                 = r->operand[11] >> 7 & 1;
+        stat->moving                    = r->operand[11] >> 6 & 1;
+        stat->no_rf                     = r->operand[11] >> 5 & 1;
+        stat->input                     = r->operand[12] >> 7 & 1;
+        stat->selected_antenna          = r->operand[12] & 0x7f;
+        stat->ber                       = r->operand[13] << 24 |
+                                          r->operand[14] << 16 |
+                                          r->operand[15] << 8 |
+                                          r->operand[16];
+        stat->signal_strength           = r->operand[17];
+        stat->raster_frequency          = r->operand[18] >> 6 & 2;
+        stat->rf_frequency              = (r->operand[18] & 0x3f) << 16 |
+                                          r->operand[19] << 8 |
+                                          r->operand[20];
+        stat->man_dep_info_length       = r->operand[21];
+        stat->front_end_error           = r->operand[22] >> 4 & 1;
+        stat->antenna_error             = r->operand[22] >> 3 & 1;
+        stat->front_end_power_status    = r->operand[22] >> 1 & 1;
+        stat->power_supply              = r->operand[22] & 1;
+        stat->carrier_noise_ratio       = r->operand[23] << 8 |
+                                          r->operand[24];
+        stat->power_supply_voltage      = r->operand[27];
+        stat->antenna_voltage           = r->operand[28];
+        stat->firewire_bus_voltage      = r->operand[29];
+        stat->ca_mmi                    = r->operand[30] & 1;
+        stat->ca_pmt_reply              = r->operand[31] >> 7 & 1;
+        stat->ca_date_time_request      = r->operand[31] >> 6 & 1;
+        stat->ca_application_info       = r->operand[31] >> 5 & 1;
+        stat->ca_module_present_status  = r->operand[31] >> 4 & 1;
+        stat->ca_dvb_flag               = r->operand[31] >> 3 & 1;
+        stat->ca_error_flag             = r->operand[31] >> 2 & 1;
+        stat->ca_initialization_status  = r->operand[31] >> 1 & 1;
+
+        return 0;
+}
+
+int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
+                    char conttone, char nrdiseq,
+                    struct dvb_diseqc_master_cmd *diseqcmd)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int i, j, k;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_LNB_CONTROL;
+
+        c->operand[4] = voltage;
+        c->operand[5] = nrdiseq;
+
+        i = 6;
+
+        for (j = 0; j < nrdiseq; j++) {
+                c->operand[i++] = diseqcmd[j].msg_len;
+
+                for (k = 0; k < diseqcmd[j].msg_len; k++)
+                        c->operand[i++] = diseqcmd[j].msg[k];
+        }
+
+        c->operand[i++] = burst;
+        c->operand[i++] = conttone;
+
+        c->length = ALIGN(3 + i, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device, "LNB control failed\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+int avc_register_remote_control(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_NOTIFY;
+        c->subunit = AVC_SUBUNIT_TYPE_UNIT | 7;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_REGISTER_REMOTE_CONTROL;
+
+        c->length = 8;
+
+        return avc_write(fdtv, c, NULL);
+}
+
+void avc_remote_ctrl_work(struct work_struct *work)
+{
+        struct firedtv *fdtv =
+                        container_of(work, struct firedtv, remote_ctrl_work);
+
+        /* Should it be rescheduled in failure cases? */
+        avc_register_remote_control(fdtv);
+}
+
+#if 0 /* FIXME: unused */
+int avc_tuner_host2ca(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+#endif
+
+static int get_ca_object_pos(struct avc_response_frame *r)
+{
+        int length = 1;
+
+        /* Check length of length field */
+        if (r->operand[7] & 0x80)
+                length = (r->operand[7] & 0x7f) + 1;
+        return length + 7;
+}
+
+static int get_ca_object_length(struct avc_response_frame *r)
+{
+#if 0 /* FIXME: unused */
+        int size = 0;
+        int i;
+
+        if (r->operand[7] & 0x80)
+                for (i = 0; i < (r->operand[7] & 0x7f); i++) {
+                        size <<= 8;
+                        size += r->operand[8 + i];
+                }
+#endif
+        return r->operand[7];
+}
+
+int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int pos;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        pos = get_ca_object_pos(r);
+        app_info[0] = (EN50221_TAG_APP_INFO >> 16) & 0xff;
+        app_info[1] = (EN50221_TAG_APP_INFO >>  8) & 0xff;
+        app_info[2] = (EN50221_TAG_APP_INFO >>  0) & 0xff;
+        app_info[3] = 6 + r->operand[pos + 4];
+        app_info[4] = 0x01;
+        memcpy(&app_info[5], &r->operand[pos], 5 + r->operand[pos + 4]);
+        *len = app_info[3] + 4;
+
+        return 0;
+}
+
+int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int pos;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_APPLICATION_INFO; /* ca tag */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        pos = get_ca_object_pos(r);
+        app_info[0] = (EN50221_TAG_CA_INFO >> 16) & 0xff;
+        app_info[1] = (EN50221_TAG_CA_INFO >>  8) & 0xff;
+        app_info[2] = (EN50221_TAG_CA_INFO >>  0) & 0xff;
+        app_info[3] = 2;
+        app_info[4] = r->operand[pos + 0];
+        app_info[5] = r->operand[pos + 1];
+        *len = app_info[3] + 4;
+
+        return 0;
+}
+
+int avc_ca_reset(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_RESET; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 1; /* length */
+        c->operand[8] = 0; /* force hardware reset */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+
+int avc_ca_pmt(struct firedtv *fdtv, char *msg, int length)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+        int list_management;
+        int program_info_length;
+        int pmt_cmd_id;
+        int read_pos;
+        int write_pos;
+        int es_info_length;
+        int crc32_csum;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_CONTROL;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        if (msg[0] != EN50221_LIST_MANAGEMENT_ONLY) {
+                dev_info(fdtv->device, "forcing list_management to ONLY\n");
+                msg[0] = EN50221_LIST_MANAGEMENT_ONLY;
+        }
+        /* We take the cmd_id from the programme level only! */
+        list_management = msg[0];
+        program_info_length = ((msg[4] & 0x0f) << 8) + msg[5];
+        if (program_info_length > 0)
+                program_info_length--; /* Remove pmt_cmd_id */
+        pmt_cmd_id = msg[6];
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_PMT; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        /* c->operand[7] = XXXprogram_info_length + 17; */ /* length */
+        c->operand[8] = list_management;
+        c->operand[9] = 0x01; /* pmt_cmd=OK_descramble */
+
+        /* TS program map table */
+
+        c->operand[10] = 0x02; /* Table id=2 */
+        c->operand[11] = 0x80; /* Section syntax + length */
+        /* c->operand[12] = XXXprogram_info_length + 12; */
+        c->operand[13] = msg[1]; /* Program number */
+        c->operand[14] = msg[2];
+        c->operand[15] = 0x01; /* Version number=0 + current/next=1 */
+        c->operand[16] = 0x00; /* Section number=0 */
+        c->operand[17] = 0x00; /* Last section number=0 */
+        c->operand[18] = 0x1f; /* PCR_PID=1FFF */
+        c->operand[19] = 0xff;
+        c->operand[20] = (program_info_length >> 8); /* Program info length */
+        c->operand[21] = (program_info_length & 0xff);
+
+        /* CA descriptors at programme level */
+        read_pos = 6;
+        write_pos = 22;
+        if (program_info_length > 0) {
+                pmt_cmd_id = msg[read_pos++];
+                if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+                        dev_err(fdtv->device,
+                                "invalid pmt_cmd_id %d\n", pmt_cmd_id);
+
+                memcpy(&c->operand[write_pos], &msg[read_pos],
+                       program_info_length);
+                read_pos += program_info_length;
+                write_pos += program_info_length;
+        }
+        while (read_pos < length) {
+                c->operand[write_pos++] = msg[read_pos++];
+                c->operand[write_pos++] = msg[read_pos++];
+                c->operand[write_pos++] = msg[read_pos++];
+                es_info_length =
+                        ((msg[read_pos] & 0x0f) << 8) + msg[read_pos + 1];
+                read_pos += 2;
+                if (es_info_length > 0)
+                        es_info_length--; /* Remove pmt_cmd_id */
+                c->operand[write_pos++] = es_info_length >> 8;
+                c->operand[write_pos++] = es_info_length & 0xff;
+                if (es_info_length > 0) {
+                        pmt_cmd_id = msg[read_pos++];
+                        if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
+                                dev_err(fdtv->device, "invalid pmt_cmd_id %d "
+                                        "at stream level\n", pmt_cmd_id);
+
+                        memcpy(&c->operand[write_pos], &msg[read_pos],
+                               es_info_length);
+                        read_pos += es_info_length;
+                        write_pos += es_info_length;
+                }
+        }
+
+        /* CRC */
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+        c->operand[write_pos++] = 0x00;
+
+        c->operand[7] = write_pos - 8;
+        c->operand[12] = write_pos - 13;
+
+        crc32_csum = crc32_be(0, &c->operand[10], c->operand[12] - 1);
+        c->operand[write_pos - 4] = (crc32_csum >> 24) & 0xff;
+        c->operand[write_pos - 3] = (crc32_csum >> 16) & 0xff;
+        c->operand[write_pos - 2] = (crc32_csum >>  8) & 0xff;
+        c->operand[write_pos - 1] = (crc32_csum >>  0) & 0xff;
+
+        c->length = ALIGN(3 + write_pos, 4);
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        if (r->response != AVC_RESPONSE_ACCEPTED) {
+                dev_err(fdtv->device,
+                        "CA PMT failed with response 0x%x\n", r->response);
+                return -EFAULT;
+        }
+
+        return 0;
+}
+
+int avc_ca_get_time_date(struct firedtv *fdtv, int *interval)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_DATE_TIME; /* ca tag */
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        *interval = r->operand[get_ca_object_pos(r)];
+
+        return 0;
+}
+
+int avc_ca_enter_menu(struct firedtv *fdtv)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer; /* FIXME: unused */
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_HOST2CA;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_ENTER_MENU;
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        return 0;
+}
+
+int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len)
+{
+        char buffer[sizeof(struct avc_command_frame)];
+        struct avc_command_frame *c = (void *)buffer;
+        struct avc_response_frame *r = (void *)buffer;
+
+        memset(c, 0, sizeof(*c));
+
+        c->ctype   = AVC_CTYPE_STATUS;
+        c->subunit = AVC_SUBUNIT_TYPE_TUNER | fdtv->subunit;
+        c->opcode  = AVC_OPCODE_VENDOR;
+
+        c->operand[0] = SFE_VENDOR_DE_COMPANYID_0;
+        c->operand[1] = SFE_VENDOR_DE_COMPANYID_1;
+        c->operand[2] = SFE_VENDOR_DE_COMPANYID_2;
+        c->operand[3] = SFE_VENDOR_OPCODE_CA2HOST;
+        c->operand[4] = 0; /* slot */
+        c->operand[5] = SFE_VENDOR_TAG_CA_MMI;
+        c->operand[6] = 0; /* more/last */
+        c->operand[7] = 0; /* length */
+
+        c->length = 12;
+
+        if (avc_write(fdtv, c, r) < 0)
+                return -EIO;
+
+        /* FIXME: check response code and validate response data */
+
+        *len = get_ca_object_length(r);
+        memcpy(mmi_object, &r->operand[get_ca_object_pos(r)], *len);
+
+        return 0;
+}
+
+#define CMP_OUTPUT_PLUG_CONTROL_REG_0   0xfffff0000904ULL
+
+static int cmp_read(struct firedtv *fdtv, void *buf, u64 addr, size_t len)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = fdtv->backend->read(fdtv, addr, buf, len);
+        if (ret < 0)
+                dev_err(fdtv->device, "CMP: read I/O error\n");
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+static int cmp_lock(struct firedtv *fdtv, void *data, u64 addr, __be32 arg)
+{
+        int ret;
+
+        if (mutex_lock_interruptible(&fdtv->avc_mutex))
+                return -EINTR;
+
+        ret = fdtv->backend->lock(fdtv, addr, data, arg);
+        if (ret < 0)
+                dev_err(fdtv->device, "CMP: lock I/O error\n");
+
+        mutex_unlock(&fdtv->avc_mutex);
+        return ret;
+}
+
+static inline u32 get_opcr(__be32 opcr, u32 mask, u32 shift)
+{
+        return (be32_to_cpu(opcr) >> shift) & mask;
+}
+
+static inline void set_opcr(__be32 *opcr, u32 value, u32 mask, u32 shift)
+{
+        *opcr &= ~cpu_to_be32(mask << shift);
+        *opcr |= cpu_to_be32((value & mask) << shift);
+}
+
+#define get_opcr_online(v)              get_opcr((v), 0x1, 31)
+#define get_opcr_p2p_connections(v)     get_opcr((v), 0x3f, 24)
+#define get_opcr_channel(v)             get_opcr((v), 0x3f, 16)
+
+#define set_opcr_p2p_connections(p, v)  set_opcr((p), (v), 0x3f, 24)
+#define set_opcr_channel(p, v)          set_opcr((p), (v), 0x3f, 16)
+#define set_opcr_data_rate(p, v)        set_opcr((p), (v), 0x3, 14)
+#define set_opcr_overhead_id(p, v)      set_opcr((p), (v), 0xf, 10)
+
+int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel)
+{
+        __be32 old_opcr, opcr;
+        u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+        int attempts = 0;
+        int ret;
+
+        ret = cmp_read(fdtv, &opcr, opcr_address, 4);
+        if (ret < 0)
+                return ret;
+
+repeat:
+        if (!get_opcr_online(opcr)) {
+                dev_err(fdtv->device, "CMP: output offline\n");
+                return -EBUSY;
+        }
+
+        old_opcr = opcr;
+
+        if (get_opcr_p2p_connections(opcr)) {
+                if (get_opcr_channel(opcr) != channel) {
+                        dev_err(fdtv->device, "CMP: cannot change channel\n");
+                        return -EBUSY;
+                }
+                dev_info(fdtv->device, "CMP: overlaying connection\n");
+
+                /* We don't allocate isochronous resources. */
+        } else {
+                set_opcr_channel(&opcr, channel);
+                set_opcr_data_rate(&opcr, 2); /* S400 */
+
+                /* FIXME: this is for the worst case - optimize */
+                set_opcr_overhead_id(&opcr, 0);
+
+                /*
+                 * FIXME: allocate isochronous channel and bandwidth at IRM
+                 * fdtv->backend->alloc_resources(fdtv, channels_mask, bw);
+                 */
+        }
+
+        set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) + 1);
+
+        ret = cmp_lock(fdtv, &opcr, opcr_address, old_opcr);
+        if (ret < 0)
+                return ret;
+
+        if (old_opcr != opcr) {
+                /*
+                 * FIXME: if old_opcr.P2P_Connections > 0,
+                 * deallocate isochronous channel and bandwidth at IRM
+                 * if (...)
+                 *      fdtv->backend->dealloc_resources(fdtv, channel, bw);
+                 */
+
+                if (++attempts < 6) /* arbitrary limit */
+                        goto repeat;
+                return -EBUSY;
+        }
+
+        return 0;
+}
+
+void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel)
+{
+        __be32 old_opcr, opcr;
+        u64 opcr_address = CMP_OUTPUT_PLUG_CONTROL_REG_0 + (plug << 2);
+        int attempts = 0;
+
+        if (cmp_read(fdtv, &opcr, opcr_address, 4) < 0)
+                return;
+
+repeat:
+        if (!get_opcr_online(opcr) || !get_opcr_p2p_connections(opcr) ||
+            get_opcr_channel(opcr) != channel) {
+                dev_err(fdtv->device, "CMP: no connection to break\n");
+                return;
+        }
+
+        old_opcr = opcr;
+        set_opcr_p2p_connections(&opcr, get_opcr_p2p_connections(opcr) - 1);
+
+        if (cmp_lock(fdtv, &opcr, opcr_address, old_opcr) < 0)
+                return;
+
+        if (old_opcr != opcr) {
+                /*
+                 * FIXME: if old_opcr.P2P_Connections == 1, i.e. we were last
+                 * owner, deallocate isochronous channel and bandwidth at IRM
+                 * if (...)
+                 *      fdtv->backend->dealloc_resources(fdtv, channel, bw);
+                 */
+
+                if (++attempts < 6) /* arbitrary limit */
+                        goto repeat;
+        }
+}
diff --git a/drivers/media/dvb/firewire/firedtv-ci.c b/drivers/media/dvb/firewire/firedtv-ci.c
new file mode 100644
index 000000000000..eeb80d0ea3ff
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-ci.c
@@ -0,0 +1,260 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/dvb/ca.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+
+#include <dvbdev.h>
+
+#include "firedtv.h"
+
+#define EN50221_TAG_APP_INFO_ENQUIRY    0x9f8020
+#define EN50221_TAG_CA_INFO_ENQUIRY     0x9f8030
+#define EN50221_TAG_CA_PMT              0x9f8032
+#define EN50221_TAG_ENTER_MENU          0x9f8022
+
+static int fdtv_ca_ready(struct firedtv_tuner_status *stat)
+{
+        return stat->ca_initialization_status   == 1 &&
+               stat->ca_error_flag              == 0 &&
+               stat->ca_dvb_flag                == 1 &&
+               stat->ca_module_present_status   == 1;
+}
+
+static int fdtv_get_ca_flags(struct firedtv_tuner_status *stat)
+{
+        int flags = 0;
+
+        if (stat->ca_module_present_status == 1)
+                flags |= CA_CI_MODULE_PRESENT;
+        if (stat->ca_initialization_status == 1 &&
+            stat->ca_error_flag            == 0 &&
+            stat->ca_dvb_flag              == 1)
+                flags |= CA_CI_MODULE_READY;
+        return flags;
+}
+
+static int fdtv_ca_reset(struct firedtv *fdtv)
+{
+        return avc_ca_reset(fdtv) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_caps(void *arg)
+{
+        struct ca_caps *cap = arg;
+
+        cap->slot_num = 1;
+        cap->slot_type = CA_CI;
+        cap->descr_num = 1;
+        cap->descr_type = CA_ECD;
+        return 0;
+}
+
+static int fdtv_ca_get_slot_info(struct firedtv *fdtv, void *arg)
+{
+        struct firedtv_tuner_status stat;
+        struct ca_slot_info *slot = arg;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EFAULT;
+
+        if (slot->num != 0)
+                return -EFAULT;
+
+        slot->type = CA_CI;
+        slot->flags = fdtv_get_ca_flags(&stat);
+        return 0;
+}
+
+static int fdtv_ca_app_info(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_app_info(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_info(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_info(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_mmi(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *reply = arg;
+
+        return avc_ca_get_mmi(fdtv, reply->msg, &reply->length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_get_msg(struct firedtv *fdtv, void *arg)
+{
+        struct firedtv_tuner_status stat;
+        int err;
+
+        switch (fdtv->ca_last_command) {
+        case EN50221_TAG_APP_INFO_ENQUIRY:
+                err = fdtv_ca_app_info(fdtv, arg);
+                break;
+        case EN50221_TAG_CA_INFO_ENQUIRY:
+                err = fdtv_ca_info(fdtv, arg);
+                break;
+        default:
+                if (avc_tuner_status(fdtv, &stat))
+                        err = -EFAULT;
+                else if (stat.ca_mmi == 1)
+                        err = fdtv_ca_get_mmi(fdtv, arg);
+                else {
+                        dev_info(fdtv->device, "unhandled CA message 0x%08x\n",
+                                 fdtv->ca_last_command);
+                        err = -EFAULT;
+                }
+        }
+        fdtv->ca_last_command = 0;
+        return err;
+}
+
+static int fdtv_ca_pmt(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *msg = arg;
+        int data_pos;
+        int data_length;
+        int i;
+
+        data_pos = 4;
+        if (msg->msg[3] & 0x80) {
+                data_length = 0;
+                for (i = 0; i < (msg->msg[3] & 0x7f); i++)
+                        data_length = (data_length << 8) + msg->msg[data_pos++];
+        } else {
+                data_length = msg->msg[3];
+        }
+
+        return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length) ? -EFAULT : 0;
+}
+
+static int fdtv_ca_send_msg(struct firedtv *fdtv, void *arg)
+{
+        struct ca_msg *msg = arg;
+        int err;
+
+        /* Do we need a semaphore for this? */
+        fdtv->ca_last_command =
+                (msg->msg[0] << 16) + (msg->msg[1] << 8) + msg->msg[2];
+        switch (fdtv->ca_last_command) {
+        case EN50221_TAG_CA_PMT:
+                err = fdtv_ca_pmt(fdtv, arg);
+                break;
+        case EN50221_TAG_APP_INFO_ENQUIRY:
+                /* handled in ca_get_msg */
+                err = 0;
+                break;
+        case EN50221_TAG_CA_INFO_ENQUIRY:
+                /* handled in ca_get_msg */
+                err = 0;
+                break;
+        case EN50221_TAG_ENTER_MENU:
+                err = avc_ca_enter_menu(fdtv);
+                break;
+        default:
+                dev_err(fdtv->device, "unhandled CA message 0x%08x\n",
+                        fdtv->ca_last_command);
+                err = -EFAULT;
+        }
+        return err;
+}
+
+static int fdtv_ca_ioctl(struct inode *inode, struct file *file,
+                            unsigned int cmd, void *arg)
+{
+        struct dvb_device *dvbdev = file->private_data;
+        struct firedtv *fdtv = dvbdev->priv;
+        struct firedtv_tuner_status stat;
+        int err;
+
+        switch (cmd) {
+        case CA_RESET:
+                err = fdtv_ca_reset(fdtv);
+                break;
+        case CA_GET_CAP:
+                err = fdtv_ca_get_caps(arg);
+                break;
+        case CA_GET_SLOT_INFO:
+                err = fdtv_ca_get_slot_info(fdtv, arg);
+                break;
+        case CA_GET_MSG:
+                err = fdtv_ca_get_msg(fdtv, arg);
+                break;
+        case CA_SEND_MSG:
+                err = fdtv_ca_send_msg(fdtv, arg);
+                break;
+        default:
+                dev_info(fdtv->device, "unhandled CA ioctl %u\n", cmd);
+                err = -EOPNOTSUPP;
+        }
+
+        /* FIXME Is this necessary? */
+        avc_tuner_status(fdtv, &stat);
+
+        return err;
+}
+
+static unsigned int fdtv_ca_io_poll(struct file *file, poll_table *wait)
+{
+        return POLLIN;
+}
+
+static struct file_operations fdtv_ca_fops = {
+        .owner          = THIS_MODULE,
+        .ioctl          = dvb_generic_ioctl,
+        .open           = dvb_generic_open,
+        .release        = dvb_generic_release,
+        .poll           = fdtv_ca_io_poll,
+};
+
+static struct dvb_device fdtv_ca = {
+        .users          = 1,
+        .readers        = 1,
+        .writers        = 1,
+        .fops           = &fdtv_ca_fops,
+        .kernel_ioctl   = fdtv_ca_ioctl,
+};
+
+int fdtv_ca_register(struct firedtv *fdtv)
+{
+        struct firedtv_tuner_status stat;
+        int err;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        if (!fdtv_ca_ready(&stat))
+                return -EFAULT;
+
+        err = dvb_register_device(&fdtv->adapter, &fdtv->cadev,
+                                  &fdtv_ca, fdtv, DVB_DEVICE_CA);
+
+        if (stat.ca_application_info == 0)
+                dev_err(fdtv->device, "CaApplicationInfo is not set\n");
+        if (stat.ca_date_time_request == 1)
+                avc_ca_get_time_date(fdtv, &fdtv->ca_time_interval);
+
+        return err;
+}
+
+void fdtv_ca_release(struct firedtv *fdtv)
+{
+        if (fdtv->cadev)
+                dvb_unregister_device(fdtv->cadev);
+}
diff --git a/drivers/media/dvb/firewire/firedtv-dvb.c b/drivers/media/dvb/firewire/firedtv-dvb.c
new file mode 100644
index 000000000000..9d308dd32a5c
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-dvb.c
@@ -0,0 +1,364 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvbdev.h>
+#include <dvb_frontend.h>
+
+#include "firedtv.h"
+
+static int alloc_channel(struct firedtv *fdtv)
+{
+        int i;
+
+        for (i = 0; i < 16; i++)
+                if (!__test_and_set_bit(i, &fdtv->channel_active))
+                        break;
+        return i;
+}
+
+static void collect_channels(struct firedtv *fdtv, int *pidc, u16 pid[])
+{
+        int i, n;
+
+        for (i = 0, n = 0; i < 16; i++)
+                if (test_bit(i, &fdtv->channel_active))
+                        pid[n++] = fdtv->channel_pid[i];
+        *pidc = n;
+}
+
+static inline void dealloc_channel(struct firedtv *fdtv, int i)
+{
+        __clear_bit(i, &fdtv->channel_active);
+}
+
+int fdtv_start_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct firedtv *fdtv = dvbdmxfeed->demux->priv;
+        int pidc, c, ret;
+        u16 pids[16];
+
+        switch (dvbdmxfeed->type) {
+        case DMX_TYPE_TS:
+        case DMX_TYPE_SEC:
+                break;
+        default:
+                dev_err(fdtv->device, "can't start dmx feed: invalid type %u\n",
+                        dvbdmxfeed->type);
+                return -EINVAL;
+        }
+
+        if (mutex_lock_interruptible(&fdtv->demux_mutex))
+                return -EINTR;
+
+        if (dvbdmxfeed->type == DMX_TYPE_TS) {
+                switch (dvbdmxfeed->pes_type) {
+                case DMX_TS_PES_VIDEO:
+                case DMX_TS_PES_AUDIO:
+                case DMX_TS_PES_TELETEXT:
+                case DMX_TS_PES_PCR:
+                case DMX_TS_PES_OTHER:
+                        c = alloc_channel(fdtv);
+                        break;
+                default:
+                        dev_err(fdtv->device,
+                                "can't start dmx feed: invalid pes type %u\n",
+                                dvbdmxfeed->pes_type);
+                        ret = -EINVAL;
+                        goto out;
+                }
+        } else {
+                c = alloc_channel(fdtv);
+        }
+
+        if (c > 15) {
+                dev_err(fdtv->device, "can't start dmx feed: busy\n");
+                ret = -EBUSY;
+                goto out;
+        }
+
+        dvbdmxfeed->priv = (typeof(dvbdmxfeed->priv))(unsigned long)c;
+        fdtv->channel_pid[c] = dvbdmxfeed->pid;
+        collect_channels(fdtv, &pidc, pids);
+
+        if (dvbdmxfeed->pid == 8192) {
+                ret = avc_tuner_get_ts(fdtv);
+                if (ret) {
+                        dealloc_channel(fdtv, c);
+                        dev_err(fdtv->device, "can't get TS\n");
+                        goto out;
+                }
+        } else {
+                ret = avc_tuner_set_pids(fdtv, pidc, pids);
+                if (ret) {
+                        dealloc_channel(fdtv, c);
+                        dev_err(fdtv->device, "can't set PIDs\n");
+                        goto out;
+                }
+        }
+out:
+        mutex_unlock(&fdtv->demux_mutex);
+
+        return ret;
+}
+
+int fdtv_stop_feed(struct dvb_demux_feed *dvbdmxfeed)
+{
+        struct dvb_demux *demux = dvbdmxfeed->demux;
+        struct firedtv *fdtv = demux->priv;
+        int pidc, c, ret;
+        u16 pids[16];
+
+        if (dvbdmxfeed->type == DMX_TYPE_TS &&
+            !((dvbdmxfeed->ts_type & TS_PACKET) &&
+              (demux->dmx.frontend->source != DMX_MEMORY_FE))) {
+
+                if (dvbdmxfeed->ts_type & TS_DECODER) {
+                        if (dvbdmxfeed->pes_type >= DMX_TS_PES_OTHER ||
+                            !demux->pesfilter[dvbdmxfeed->pes_type])
+                                return -EINVAL;
+
+                        demux->pids[dvbdmxfeed->pes_type] |= 0x8000;
+                        demux->pesfilter[dvbdmxfeed->pes_type] = NULL;
+                }
+
+                if (!(dvbdmxfeed->ts_type & TS_DECODER &&
+                      dvbdmxfeed->pes_type < DMX_TS_PES_OTHER))
+                        return 0;
+        }
+
+        if (mutex_lock_interruptible(&fdtv->demux_mutex))
+                return -EINTR;
+
+        c = (unsigned long)dvbdmxfeed->priv;
+        dealloc_channel(fdtv, c);
+        collect_channels(fdtv, &pidc, pids);
+
+        ret = avc_tuner_set_pids(fdtv, pidc, pids);
+
+        mutex_unlock(&fdtv->demux_mutex);
+
+        return ret;
+}
+
+DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
+
+int fdtv_dvb_register(struct firedtv *fdtv)
+{
+        int err;
+
+        err = dvb_register_adapter(&fdtv->adapter, fdtv_model_names[fdtv->type],
+                                   THIS_MODULE, fdtv->device, adapter_nr);
+        if (err < 0)
+                goto fail_log;
+
+        /*DMX_TS_FILTERING | DMX_SECTION_FILTERING*/
+        fdtv->demux.dmx.capabilities = 0;
+
+        fdtv->demux.priv        = fdtv;
+        fdtv->demux.filternum   = 16;
+        fdtv->demux.feednum     = 16;
+        fdtv->demux.start_feed  = fdtv_start_feed;
+        fdtv->demux.stop_feed   = fdtv_stop_feed;
+        fdtv->demux.write_to_decoder = NULL;
+
+        err = dvb_dmx_init(&fdtv->demux);
+        if (err)
+                goto fail_unreg_adapter;
+
+        fdtv->dmxdev.filternum    = 16;
+        fdtv->dmxdev.demux        = &fdtv->demux.dmx;
+        fdtv->dmxdev.capabilities = 0;
+
+        err = dvb_dmxdev_init(&fdtv->dmxdev, &fdtv->adapter);
+        if (err)
+                goto fail_dmx_release;
+
+        fdtv->frontend.source = DMX_FRONTEND_0;
+
+        err = fdtv->demux.dmx.add_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+        if (err)
+                goto fail_dmxdev_release;
+
+        err = fdtv->demux.dmx.connect_frontend(&fdtv->demux.dmx,
+                                               &fdtv->frontend);
+        if (err)
+                goto fail_rem_frontend;
+
+        dvb_net_init(&fdtv->adapter, &fdtv->dvbnet, &fdtv->demux.dmx);
+
+        fdtv_frontend_init(fdtv);
+        err = dvb_register_frontend(&fdtv->adapter, &fdtv->fe);
+        if (err)
+                goto fail_net_release;
+
+        err = fdtv_ca_register(fdtv);
+        if (err)
+                dev_info(fdtv->device,
+                         "Conditional Access Module not enabled\n");
+        return 0;
+
+fail_net_release:
+        dvb_net_release(&fdtv->dvbnet);
+        fdtv->demux.dmx.close(&fdtv->demux.dmx);
+fail_rem_frontend:
+        fdtv->demux.dmx.remove_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+fail_dmxdev_release:
+        dvb_dmxdev_release(&fdtv->dmxdev);
+fail_dmx_release:
+        dvb_dmx_release(&fdtv->demux);
+fail_unreg_adapter:
+        dvb_unregister_adapter(&fdtv->adapter);
+fail_log:
+        dev_err(fdtv->device, "DVB initialization failed\n");
+        return err;
+}
+
+void fdtv_dvb_unregister(struct firedtv *fdtv)
+{
+        fdtv_ca_release(fdtv);
+        dvb_unregister_frontend(&fdtv->fe);
+        dvb_net_release(&fdtv->dvbnet);
+        fdtv->demux.dmx.close(&fdtv->demux.dmx);
+        fdtv->demux.dmx.remove_frontend(&fdtv->demux.dmx, &fdtv->frontend);
+        dvb_dmxdev_release(&fdtv->dmxdev);
+        dvb_dmx_release(&fdtv->demux);
+        dvb_unregister_adapter(&fdtv->adapter);
+}
+
+const char *fdtv_model_names[] = {
+        [FIREDTV_UNKNOWN] = "unknown type",
+        [FIREDTV_DVB_S]   = "FireDTV S/CI",
+        [FIREDTV_DVB_C]   = "FireDTV C/CI",
+        [FIREDTV_DVB_T]   = "FireDTV T/CI",
+        [FIREDTV_DVB_S2]  = "FireDTV S2  ",
+};
+
+struct firedtv *fdtv_alloc(struct device *dev,
+                           const struct firedtv_backend *backend,
+                           const char *name, size_t name_len)
+{
+        struct firedtv *fdtv;
+        int i;
+
+        fdtv = kzalloc(sizeof(*fdtv), GFP_KERNEL);
+        if (!fdtv)
+                return NULL;
+
+        dev->driver_data        = fdtv;
+        fdtv->device            = dev;
+        fdtv->isochannel        = -1;
+        fdtv->voltage           = 0xff;
+        fdtv->tone              = 0xff;
+        fdtv->backend           = backend;
+
+        mutex_init(&fdtv->avc_mutex);
+        init_waitqueue_head(&fdtv->avc_wait);
+        fdtv->avc_reply_received = true;
+        mutex_init(&fdtv->demux_mutex);
+        INIT_WORK(&fdtv->remote_ctrl_work, avc_remote_ctrl_work);
+
+        for (i = ARRAY_SIZE(fdtv_model_names); --i; )
+                if (strlen(fdtv_model_names[i]) <= name_len &&
+                    strncmp(name, fdtv_model_names[i], name_len) == 0)
+                        break;
+        fdtv->type = i;
+
+        return fdtv;
+}
+
+#define MATCH_FLAGS (IEEE1394_MATCH_VENDOR_ID | IEEE1394_MATCH_MODEL_ID | \
+                     IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION)
+
+#define DIGITAL_EVERYWHERE_OUI  0x001287
+#define AVC_UNIT_SPEC_ID_ENTRY  0x00a02d
+#define AVC_SW_VERSION_ENTRY    0x010001
+
+static struct ieee1394_device_id fdtv_id_table[] = {
+        {
+                /* FloppyDTV S/CI and FloppyDTV S2 */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000024,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FloppyDTV T/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000025,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FloppyDTV C/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000026,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV S/CI and FloppyDTV S2 */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000034,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV T/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000035,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {
+                /* FireDTV C/CI */
+                .match_flags    = MATCH_FLAGS,
+                .vendor_id      = DIGITAL_EVERYWHERE_OUI,
+                .model_id       = 0x000036,
+                .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY,
+                .version        = AVC_SW_VERSION_ENTRY,
+        }, {}
+};
+MODULE_DEVICE_TABLE(ieee1394, fdtv_id_table);
+
+static int __init fdtv_init(void)
+{
+        return fdtv_1394_init(fdtv_id_table);
+}
+
+static void __exit fdtv_exit(void)
+{
+        fdtv_1394_exit();
+}
+
+module_init(fdtv_init);
+module_exit(fdtv_exit);
+
+MODULE_AUTHOR("Andreas Monitzer <andy@monitzer.com>");
+MODULE_AUTHOR("Ben Backx <ben@bbackx.com>");
+MODULE_DESCRIPTION("FireDTV DVB Driver");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("FireDTV DVB");
diff --git a/drivers/media/dvb/firewire/firedtv-fe.c b/drivers/media/dvb/firewire/firedtv-fe.c
new file mode 100644
index 000000000000..7ba43630a25d
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-fe.c
@@ -0,0 +1,247 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include <dvb_frontend.h>
+
+#include "firedtv.h"
+
+static int fdtv_dvb_init(struct dvb_frontend *fe)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        int err;
+
+        /* FIXME - allocate free channel at IRM */
+        fdtv->isochannel = fdtv->adapter.num;
+
+        err = cmp_establish_pp_connection(fdtv, fdtv->subunit,
+                                          fdtv->isochannel);
+        if (err) {
+                dev_err(fdtv->device,
+                        "could not establish point to point connection\n");
+                return err;
+        }
+
+        return fdtv->backend->start_iso(fdtv);
+}
+
+static int fdtv_sleep(struct dvb_frontend *fe)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->backend->stop_iso(fdtv);
+        cmp_break_pp_connection(fdtv, fdtv->subunit, fdtv->isochannel);
+        fdtv->isochannel = -1;
+        return 0;
+}
+
+#define LNBCONTROL_DONTCARE 0xff
+
+static int fdtv_diseqc_send_master_cmd(struct dvb_frontend *fe,
+                                       struct dvb_diseqc_master_cmd *cmd)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        return avc_lnb_control(fdtv, LNBCONTROL_DONTCARE, LNBCONTROL_DONTCARE,
+                               LNBCONTROL_DONTCARE, 1, cmd);
+}
+
+static int fdtv_diseqc_send_burst(struct dvb_frontend *fe,
+                                  fe_sec_mini_cmd_t minicmd)
+{
+        return 0;
+}
+
+static int fdtv_set_tone(struct dvb_frontend *fe, fe_sec_tone_mode_t tone)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->tone = tone;
+        return 0;
+}
+
+static int fdtv_set_voltage(struct dvb_frontend *fe,
+                            fe_sec_voltage_t voltage)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        fdtv->voltage = voltage;
+        return 0;
+}
+
+static int fdtv_read_status(struct dvb_frontend *fe, fe_status_t *status)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        if (stat.no_rf)
+                *status = 0;
+        else
+                *status = FE_HAS_SIGNAL | FE_HAS_VITERBI | FE_HAS_SYNC |
+                          FE_HAS_CARRIER | FE_HAS_LOCK;
+        return 0;
+}
+
+static int fdtv_read_ber(struct dvb_frontend *fe, u32 *ber)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        *ber = stat.ber;
+        return 0;
+}
+
+static int fdtv_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        *strength = stat.signal_strength << 8;
+        return 0;
+}
+
+static int fdtv_read_snr(struct dvb_frontend *fe, u16 *snr)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+        struct firedtv_tuner_status stat;
+
+        if (avc_tuner_status(fdtv, &stat))
+                return -EINVAL;
+
+        /* C/N[dB] = -10 * log10(snr / 65535) */
+        *snr = stat.carrier_noise_ratio * 257;
+        return 0;
+}
+
+static int fdtv_read_uncorrected_blocks(struct dvb_frontend *fe, u32 *ucblocks)
+{
+        return -EOPNOTSUPP;
+}
+
+#define ACCEPTED 0x9
+
+static int fdtv_set_frontend(struct dvb_frontend *fe,
+                             struct dvb_frontend_parameters *params)
+{
+        struct firedtv *fdtv = fe->sec_priv;
+
+        /* FIXME: avc_tuner_dsd never returns ACCEPTED. Check status? */
+        if (avc_tuner_dsd(fdtv, params) != ACCEPTED)
+                return -EINVAL;
+        else
+                return 0; /* not sure of this... */
+}
+
+static int fdtv_get_frontend(struct dvb_frontend *fe,
+                             struct dvb_frontend_parameters *params)
+{
+        return -EOPNOTSUPP;
+}
+
+void fdtv_frontend_init(struct firedtv *fdtv)
+{
+        struct dvb_frontend_ops *ops = &fdtv->fe.ops;
+        struct dvb_frontend_info *fi = &ops->info;
+
+        ops->init                       = fdtv_dvb_init;
+        ops->sleep                      = fdtv_sleep;
+
+        ops->set_frontend               = fdtv_set_frontend;
+        ops->get_frontend               = fdtv_get_frontend;
+
+        ops->read_status                = fdtv_read_status;
+        ops->read_ber                   = fdtv_read_ber;
+        ops->read_signal_strength       = fdtv_read_signal_strength;
+        ops->read_snr                   = fdtv_read_snr;
+        ops->read_ucblocks              = fdtv_read_uncorrected_blocks;
+
+        ops->diseqc_send_master_cmd     = fdtv_diseqc_send_master_cmd;
+        ops->diseqc_send_burst          = fdtv_diseqc_send_burst;
+        ops->set_tone                   = fdtv_set_tone;
+        ops->set_voltage                = fdtv_set_voltage;
+
+        switch (fdtv->type) {
+        case FIREDTV_DVB_S:
+        case FIREDTV_DVB_S2:
+                fi->type                = FE_QPSK;
+
+                fi->frequency_min       = 950000;
+                fi->frequency_max       = 2150000;
+                fi->frequency_stepsize  = 125;
+                fi->symbol_rate_min     = 1000000;
+                fi->symbol_rate_max     = 40000000;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO |
+                                          FE_CAN_FEC_1_2        |
+                                          FE_CAN_FEC_2_3        |
+                                          FE_CAN_FEC_3_4        |
+                                          FE_CAN_FEC_5_6        |
+                                          FE_CAN_FEC_7_8        |
+                                          FE_CAN_FEC_AUTO       |
+                                          FE_CAN_QPSK;
+                break;
+
+        case FIREDTV_DVB_C:
+                fi->type                = FE_QAM;
+
+                fi->frequency_min       = 47000000;
+                fi->frequency_max       = 866000000;
+                fi->frequency_stepsize  = 62500;
+                fi->symbol_rate_min     = 870000;
+                fi->symbol_rate_max     = 6900000;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO |
+                                          FE_CAN_QAM_16         |
+                                          FE_CAN_QAM_32         |
+                                          FE_CAN_QAM_64         |
+                                          FE_CAN_QAM_128        |
+                                          FE_CAN_QAM_256        |
+                                          FE_CAN_QAM_AUTO;
+                break;
+
+        case FIREDTV_DVB_T:
+                fi->type                = FE_OFDM;
+
+                fi->frequency_min       = 49000000;
+                fi->frequency_max       = 861000000;
+                fi->frequency_stepsize  = 62500;
+
+                fi->caps                = FE_CAN_INVERSION_AUTO         |
+                                          FE_CAN_FEC_2_3                |
+                                          FE_CAN_TRANSMISSION_MODE_AUTO |
+                                          FE_CAN_GUARD_INTERVAL_AUTO    |
+                                          FE_CAN_HIERARCHY_AUTO;
+                break;
+
+        default:
+                dev_err(fdtv->device, "no frontend for model type %d\n",
+                        fdtv->type);
+        }
+        strcpy(fi->name, fdtv_model_names[fdtv->type]);
+
+        fdtv->fe.dvb = &fdtv->adapter;
+        fdtv->fe.sec_priv = fdtv;
+}
diff --git a/drivers/media/dvb/firewire/firedtv-rc.c b/drivers/media/dvb/firewire/firedtv-rc.c
new file mode 100644
index 000000000000..46a6324d7b73
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv-rc.c
@@ -0,0 +1,190 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/input.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/types.h>
+
+#include "firedtv.h"
+
+/* fixed table with older keycodes, geared towards MythTV */
+const static u16 oldtable[] = {
+
+        /* code from device: 0x4501...0x451f */
+
+        KEY_ESC,
+        KEY_F9,
+        KEY_1,
+        KEY_2,
+        KEY_3,
+        KEY_4,
+        KEY_5,
+        KEY_6,
+        KEY_7,
+        KEY_8,
+        KEY_9,
+        KEY_I,
+        KEY_0,
+        KEY_ENTER,
+        KEY_RED,
+        KEY_UP,
+        KEY_GREEN,
+        KEY_F10,
+        KEY_SPACE,
+        KEY_F11,
+        KEY_YELLOW,
+        KEY_DOWN,
+        KEY_BLUE,
+        KEY_Z,
+        KEY_P,
+        KEY_PAGEDOWN,
+        KEY_LEFT,
+        KEY_W,
+        KEY_RIGHT,
+        KEY_P,
+        KEY_M,
+
+        /* code from device: 0x4540...0x4542 */
+
+        KEY_R,
+        KEY_V,
+        KEY_C,
+};
+
+/* user-modifiable table for a remote as sold in 2008 */
+const static u16 keytable[] = {
+
+        /* code from device: 0x0300...0x031f */
+
+        [0x00] = KEY_POWER,
+        [0x01] = KEY_SLEEP,
+        [0x02] = KEY_STOP,
+        [0x03] = KEY_OK,
+        [0x04] = KEY_RIGHT,
+        [0x05] = KEY_1,
+        [0x06] = KEY_2,
+        [0x07] = KEY_3,
+        [0x08] = KEY_LEFT,
+        [0x09] = KEY_4,
+        [0x0a] = KEY_5,
+        [0x0b] = KEY_6,
+        [0x0c] = KEY_UP,
+        [0x0d] = KEY_7,
+        [0x0e] = KEY_8,
+        [0x0f] = KEY_9,
+        [0x10] = KEY_DOWN,
+        [0x11] = KEY_TITLE,     /* "OSD" - fixme */
+        [0x12] = KEY_0,
+        [0x13] = KEY_F20,       /* "16:9" - fixme */
+        [0x14] = KEY_SCREEN,    /* "FULL" - fixme */
+        [0x15] = KEY_MUTE,
+        [0x16] = KEY_SUBTITLE,
+        [0x17] = KEY_RECORD,
+        [0x18] = KEY_TEXT,
+        [0x19] = KEY_AUDIO,
+        [0x1a] = KEY_RED,
+        [0x1b] = KEY_PREVIOUS,
+        [0x1c] = KEY_REWIND,
+        [0x1d] = KEY_PLAYPAUSE,
+        [0x1e] = KEY_NEXT,
+        [0x1f] = KEY_VOLUMEUP,
+
+        /* code from device: 0x0340...0x0354 */
+
+        [0x20] = KEY_CHANNELUP,
+        [0x21] = KEY_F21,       /* "4:3" - fixme */
+        [0x22] = KEY_TV,
+        [0x23] = KEY_DVD,
+        [0x24] = KEY_VCR,
+        [0x25] = KEY_AUX,
+        [0x26] = KEY_GREEN,
+        [0x27] = KEY_YELLOW,
+        [0x28] = KEY_BLUE,
+        [0x29] = KEY_CHANNEL,   /* "CH.LIST" */
+        [0x2a] = KEY_VENDOR,    /* "CI" - fixme */
+        [0x2b] = KEY_VOLUMEDOWN,
+        [0x2c] = KEY_CHANNELDOWN,
+        [0x2d] = KEY_LAST,
+        [0x2e] = KEY_INFO,
+        [0x2f] = KEY_FORWARD,
+        [0x30] = KEY_LIST,
+        [0x31] = KEY_FAVORITES,
+        [0x32] = KEY_MENU,
+        [0x33] = KEY_EPG,
+        [0x34] = KEY_EXIT,
+};
+
+int fdtv_register_rc(struct firedtv *fdtv, struct device *dev)
+{
+        struct input_dev *idev;
+        int i, err;
+
+        idev = input_allocate_device();
+        if (!idev)
+                return -ENOMEM;
+
+        fdtv->remote_ctrl_dev = idev;
+        idev->name = "FireDTV remote control";
+        idev->dev.parent = dev;
+        idev->evbit[0] = BIT_MASK(EV_KEY);
+        idev->keycode = kmemdup(keytable, sizeof(keytable), GFP_KERNEL);
+        if (!idev->keycode) {
+                err = -ENOMEM;
+                goto fail;
+        }
+        idev->keycodesize = sizeof(keytable[0]);
+        idev->keycodemax = ARRAY_SIZE(keytable);
+
+        for (i = 0; i < ARRAY_SIZE(keytable); i++)
+                set_bit(keytable[i], idev->keybit);
+
+        err = input_register_device(idev);
+        if (err)
+                goto fail_free_keymap;
+
+        return 0;
+
+fail_free_keymap:
+        kfree(idev->keycode);
+fail:
+        input_free_device(idev);
+        return err;
+}
+
+void fdtv_unregister_rc(struct firedtv *fdtv)
+{
+        kfree(fdtv->remote_ctrl_dev->keycode);
+        input_unregister_device(fdtv->remote_ctrl_dev);
+}
+
+void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code)
+{
+        u16 *keycode = fdtv->remote_ctrl_dev->keycode;
+
+        if (code >= 0x0300 && code <= 0x031f)
+                code = keycode[code - 0x0300];
+        else if (code >= 0x0340 && code <= 0x0354)
+                code = keycode[code - 0x0320];
+        else if (code >= 0x4501 && code <= 0x451f)
+                code = oldtable[code - 0x4501];
+        else if (code >= 0x4540 && code <= 0x4542)
+                code = oldtable[code - 0x4521];
+        else {
+                printk(KERN_DEBUG "firedtv: invalid key code 0x%04x "
+                       "from remote control\n", code);
+                return;
+        }
+
+        input_report_key(fdtv->remote_ctrl_dev, code, 1);
+        input_report_key(fdtv->remote_ctrl_dev, code, 0);
+}
diff --git a/drivers/media/dvb/firewire/firedtv.h b/drivers/media/dvb/firewire/firedtv.h
new file mode 100644
index 000000000000..d48530b81e61
--- /dev/null
+++ b/drivers/media/dvb/firewire/firedtv.h
@@ -0,0 +1,182 @@
+/*
+ * FireDTV driver (formerly known as FireSAT)
+ *
+ * Copyright (C) 2004 Andreas Monitzer <andy@monitzer.com>
+ * Copyright (C) 2008 Henrik Kurelid <henrik@kurelid.se>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ */
+
+#ifndef _FIREDTV_H
+#define _FIREDTV_H
+
+#include <linux/dvb/dmx.h>
+#include <linux/dvb/frontend.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/spinlock_types.h>
+#include <linux/types.h>
+#include <linux/wait.h>
+#include <linux/workqueue.h>
+
+#include <demux.h>
+#include <dmxdev.h>
+#include <dvb_demux.h>
+#include <dvb_frontend.h>
+#include <dvb_net.h>
+#include <dvbdev.h>
+
+struct firedtv_tuner_status {
+        unsigned active_system:8;
+        unsigned searching:1;
+        unsigned moving:1;
+        unsigned no_rf:1;
+        unsigned input:1;
+        unsigned selected_antenna:7;
+        unsigned ber:32;
+        unsigned signal_strength:8;
+        unsigned raster_frequency:2;
+        unsigned rf_frequency:22;
+        unsigned man_dep_info_length:8;
+        unsigned front_end_error:1;
+        unsigned antenna_error:1;
+        unsigned front_end_power_status:1;
+        unsigned power_supply:1;
+        unsigned carrier_noise_ratio:16;
+        unsigned power_supply_voltage:8;
+        unsigned antenna_voltage:8;
+        unsigned firewire_bus_voltage:8;
+        unsigned ca_mmi:1;
+        unsigned ca_pmt_reply:1;
+        unsigned ca_date_time_request:1;
+        unsigned ca_application_info:1;
+        unsigned ca_module_present_status:1;
+        unsigned ca_dvb_flag:1;
+        unsigned ca_error_flag:1;
+        unsigned ca_initialization_status:1;
+};
+
+enum model_type {
+        FIREDTV_UNKNOWN = 0,
+        FIREDTV_DVB_S   = 1,
+        FIREDTV_DVB_C   = 2,
+        FIREDTV_DVB_T   = 3,
+        FIREDTV_DVB_S2  = 4,
+};
+
+struct device;
+struct input_dev;
+struct firedtv;
+
+struct firedtv_backend {
+        int (*lock)(struct firedtv *fdtv, u64 addr, void *data, __be32 arg);
+        int (*read)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
+        int (*write)(struct firedtv *fdtv, u64 addr, void *data, size_t len);
+        int (*start_iso)(struct firedtv *fdtv);
+        void (*stop_iso)(struct firedtv *fdtv);
+};
+
+struct firedtv {
+        struct device *device;
+        struct list_head list;
+
+        struct dvb_adapter      adapter;
+        struct dmxdev           dmxdev;
+        struct dvb_demux        demux;
+        struct dmx_frontend     frontend;
+        struct dvb_net          dvbnet;
+        struct dvb_frontend     fe;
+
+        struct dvb_device       *cadev;
+        int                     ca_last_command;
+        int                     ca_time_interval;
+
+        struct mutex            avc_mutex;
+        wait_queue_head_t       avc_wait;
+        bool                    avc_reply_received;
+        struct work_struct      remote_ctrl_work;
+        struct input_dev        *remote_ctrl_dev;
+
+        enum model_type         type;
+        char                    subunit;
+        char                    isochannel;
+        fe_sec_voltage_t        voltage;
+        fe_sec_tone_mode_t      tone;
+
+        const struct firedtv_backend *backend;
+        void                    *backend_data;
+
+        struct mutex            demux_mutex;
+        unsigned long           channel_active;
+        u16                     channel_pid[16];
+
+        size_t                  response_length;
+        u8                      response[512];
+};
+
+/* firedtv-1394.c */
+#ifdef CONFIG_DVB_FIREDTV_IEEE1394
+int fdtv_1394_init(struct ieee1394_device_id id_table[]);
+void fdtv_1394_exit(void);
+#else
+static inline int fdtv_1394_init(struct ieee1394_device_id it[]) { return 0; }
+static inline void fdtv_1394_exit(void) {}
+#endif
+
+/* firedtv-avc.c */
+int avc_recv(struct firedtv *fdtv, void *data, size_t length);
+int avc_tuner_status(struct firedtv *fdtv, struct firedtv_tuner_status *stat);
+struct dvb_frontend_parameters;
+int avc_tuner_dsd(struct firedtv *fdtv, struct dvb_frontend_parameters *params);
+int avc_tuner_set_pids(struct firedtv *fdtv, unsigned char pidc, u16 pid[]);
+int avc_tuner_get_ts(struct firedtv *fdtv);
+int avc_identify_subunit(struct firedtv *fdtv);
+struct dvb_diseqc_master_cmd;
+int avc_lnb_control(struct firedtv *fdtv, char voltage, char burst,
+                    char conttone, char nrdiseq,
+                    struct dvb_diseqc_master_cmd *diseqcmd);
+void avc_remote_ctrl_work(struct work_struct *work);
+int avc_register_remote_control(struct firedtv *fdtv);
+int avc_ca_app_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+int avc_ca_info(struct firedtv *fdtv, char *app_info, unsigned int *len);
+int avc_ca_reset(struct firedtv *fdtv);
+int avc_ca_pmt(struct firedtv *fdtv, char *app_info, int length);
+int avc_ca_get_time_date(struct firedtv *fdtv, int *interval);
+int avc_ca_enter_menu(struct firedtv *fdtv);
+int avc_ca_get_mmi(struct firedtv *fdtv, char *mmi_object, unsigned int *len);
+int cmp_establish_pp_connection(struct firedtv *fdtv, int plug, int channel);
+void cmp_break_pp_connection(struct firedtv *fdtv, int plug, int channel);
+
+/* firedtv-ci.c */
+int fdtv_ca_register(struct firedtv *fdtv);
+void fdtv_ca_release(struct firedtv *fdtv);
+
+/* firedtv-dvb.c */
+int fdtv_start_feed(struct dvb_demux_feed *dvbdmxfeed);
+int fdtv_stop_feed(struct dvb_demux_feed *dvbdmxfeed);
+int fdtv_dvb_register(struct firedtv *fdtv);
+void fdtv_dvb_unregister(struct firedtv *fdtv);
+struct firedtv *fdtv_alloc(struct device *dev,
+                           const struct firedtv_backend *backend,
+                           const char *name, size_t name_len);
+extern const char *fdtv_model_names[];
+
+/* firedtv-fe.c */
+void fdtv_frontend_init(struct firedtv *fdtv);
+
+/* firedtv-rc.c */
+#ifdef CONFIG_DVB_FIREDTV_INPUT
+int fdtv_register_rc(struct firedtv *fdtv, struct device *dev);
+void fdtv_unregister_rc(struct firedtv *fdtv);
+void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code);
+#else
+static inline int fdtv_register_rc(struct firedtv *fdtv,
+                                   struct device *dev) { return 0; }
+static inline void fdtv_unregister_rc(struct firedtv *fdtv) {}
+static inline void fdtv_handle_rc(struct firedtv *fdtv, unsigned int code) {}
+#endif
+
+#endif /* _FIREDTV_H */
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 5d882a44e3ee..2ac738fa6a07 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -463,6 +463,8 @@ static int em28xx_audio_init(struct em28xx *dev)
         pcm->info_flags = 0;
         pcm->private_data = dev;
         strcpy(pcm->name, "Empia 28xx Capture");
+
+        snd_card_set_dev(card, &dev->udev->dev);
         strcpy(card->driver, "Empia Em28xx Audio");
         strcpy(card->shortname, "Em28xx Audio");
         strcpy(card->longname, "Empia Em28xx Audio");
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index a1d6008efcbb..07c334f25aae 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -1155,23 +1155,23 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
 {
         struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
         struct pxa_camera_dev *pcdev = ici->priv;
-        const struct soc_camera_data_format *host_fmt, *cam_fmt = NULL;
-        const struct soc_camera_format_xlate *xlate;
+        const struct soc_camera_data_format *cam_fmt = NULL;
+        const struct soc_camera_format_xlate *xlate = NULL;
         struct soc_camera_sense sense = {
                 .master_clock = pcdev->mclk,
                 .pixel_clock_max = pcdev->ciclk / 4,
         };
-        int ret, buswidth;
+        int ret;
 
-        xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
-        if (!xlate) {
-                dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
-                return -EINVAL;
-        }
+        if (pixfmt) {
+                xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
+                if (!xlate) {
+                        dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
+                        return -EINVAL;
+                }
 
-        buswidth = xlate->buswidth;
-        host_fmt = xlate->host_fmt;
-        cam_fmt = xlate->cam_fmt;
+                cam_fmt = xlate->cam_fmt;
+        }
 
         /* If PCLK is used to latch data from the sensor, check sense */
         if (pcdev->platform_flags & PXA_CAMERA_PCLK_EN)
@@ -1201,8 +1201,8 @@ static int pxa_camera_set_fmt(struct soc_camera_device *icd,
         }
 
         if (pixfmt && !ret) {
-                icd->buswidth = buswidth;
-                icd->current_fmt = host_fmt;
+                icd->buswidth = xlate->buswidth;
+                icd->current_fmt = xlate->host_fmt;
         }
 
         return ret;
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 9a2586b07a05..ddcb81d0b81a 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -603,21 +603,18 @@ static int sh_mobile_ceu_set_fmt(struct soc_camera_device *icd,
         const struct soc_camera_format_xlate *xlate;
         int ret;
 
+        if (!pixfmt)
+                return icd->ops->set_fmt(icd, pixfmt, rect);
+
         xlate = soc_camera_xlate_by_fourcc(icd, pixfmt);
         if (!xlate) {
                 dev_warn(&ici->dev, "Format %x not found\n", pixfmt);
                 return -EINVAL;
         }
 
-        switch (pixfmt) {
-        case 0:                         /* Only geometry change */
-                ret = icd->ops->set_fmt(icd, pixfmt, rect);
-                break;
-        default:
-                ret = icd->ops->set_fmt(icd, xlate->cam_fmt->fourcc, rect);
-        }
+        ret = icd->ops->set_fmt(icd, xlate->cam_fmt->fourcc, rect);
 
-        if (pixfmt && !ret) {
+        if (!ret) {
                 icd->buswidth = xlate->buswidth;
                 icd->current_fmt = xlate->host_fmt;
                 pcdev->camera_fmt = xlate->cam_fmt;
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index c1e4ae27c613..c705f248da88 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -46,8 +46,8 @@ static int uvc_input_init(struct uvc_device *dev)
         usb_to_input_id(udev, &input->id);
         input->dev.parent = &dev->intf->dev;
 
-        set_bit(EV_KEY, input->evbit);
-        set_bit(BTN_0, input->keybit);
+        __set_bit(EV_KEY, input->evbit);
+        __set_bit(KEY_CAMERA, input->keybit);
 
         if ((ret = input_register_device(input)) < 0)
                 goto error;
@@ -70,8 +70,10 @@ static void uvc_input_cleanup(struct uvc_device *dev)
 static void uvc_input_report_key(struct uvc_device *dev, unsigned int code,
         int value)
 {
-        if (dev->input)
+        if (dev->input) {
                 input_report_key(dev->input, code, value);
+                input_sync(dev->input);
+        }
 }
 
 #else
@@ -96,7 +98,7 @@ static void uvc_event_streaming(struct uvc_device *dev, __u8 *data, int len)
                         return;
                 uvc_trace(UVC_TRACE_STATUS, "Button (intf %u) %s len %d\n",
                         data[1], data[3] ? "pressed" : "released", len);
-                uvc_input_report_key(dev, BTN_0, data[3]);
+                uvc_input_report_key(dev, KEY_CAMERA, data[3]);
         } else {
                 uvc_trace(UVC_TRACE_STATUS, "Stream %u error event %02x %02x "
                         "len %d.\n", data[1], data[2], data[3], len);
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 96ac88317b8e..ea3aafbbda44 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -91,9 +91,9 @@ MODULE_PARM_DESC(mpt_msi_enable_fc, " Enable MSI Support for FC \
                 controllers (default=0)");
 
 static int mpt_msi_enable_sas;
-module_param(mpt_msi_enable_sas, int, 1);
+module_param(mpt_msi_enable_sas, int, 0);
 MODULE_PARM_DESC(mpt_msi_enable_sas, " Enable MSI Support for SAS \
-                controllers (default=1)");
+                controllers (default=0)");
 
 
 static int mpt_channel_mapping;
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index 84d5ea1ec171..b457a05b28d9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -1383,6 +1383,11 @@ int wm8350_device_init(struct wm8350 *wm8350, int irq,
                         wm8350->power.rev_g_coeff = 1;
                         break;
 
+                case 1:
+                        dev_info(wm8350->dev, "WM8351 Rev B\n");
+                        wm8350->power.rev_g_coeff = 1;
+                        break;
+
                 default:
                         dev_err(wm8350->dev, "Unknown WM8351 CHIP_REV\n");
                         ret = -ENODEV;
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index f26667a7abf7..cf991850f01b 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -710,6 +710,7 @@ out:
 
 static struct pci_device_id ilo_devices[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_COMPAQ, 0xB204) },
+        { PCI_DEVICE(PCI_VENDOR_ID_HP, 0x3307) },
         { }
 };
 MODULE_DEVICE_TABLE(pci, ilo_devices);
@@ -758,7 +759,7 @@ static void __exit ilo_exit(void)
         class_destroy(ilo_class);
 }
 
-MODULE_VERSION("0.06");
+MODULE_VERSION("1.0");
 MODULE_ALIAS(ILO_NAME);
 MODULE_DESCRIPTION(ILO_NAME);
 MODULE_AUTHOR("David Altobelli <david.altobelli@hp.com>");
diff --git a/drivers/mmc/core/mmc_ops.c b/drivers/mmc/core/mmc_ops.c
index 9c50e6f1c236..34ce2703d29a 100644
--- a/drivers/mmc/core/mmc_ops.c
+++ b/drivers/mmc/core/mmc_ops.c
@@ -248,12 +248,15 @@ mmc_send_cxd_data(struct mmc_card *card, struct mmc_host *host,
 
         sg_init_one(&sg, data_buf, len);
 
-        /*
-         * The spec states that CSR and CID accesses have a timeout
-         * of 64 clock cycles.
-         */
-        data.timeout_ns = 0;
-        data.timeout_clks = 64;
+        if (opcode == MMC_SEND_CSD || opcode == MMC_SEND_CID) {
+                /*
+                 * The spec states that CSR and CID accesses have a timeout
+                 * of 64 clock cycles.
+                 */
+                data.timeout_ns = 0;
+                data.timeout_clks = 64;
+        } else
+                mmc_set_data_timeout(&data, card);
 
         mmc_wait_for_req(host, &mrq);
 
diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c
index f4a67c65d301..2db166b7096f 100644
--- a/drivers/mmc/host/s3cmci.c
+++ b/drivers/mmc/host/s3cmci.c
@@ -793,8 +793,7 @@ static void s3cmci_dma_setup(struct s3cmci_host *host,
                               host->mem->start + host->sdidata);
 
         if (!setup_ok) {
-                s3c2410_dma_config(host->dma, 4,
-                        (S3C2410_DCON_HWTRIG | S3C2410_DCON_CH0_SDI));
+                s3c2410_dma_config(host->dma, 4, 0);
                 s3c2410_dma_set_buffdone_fn(host->dma,
                                             s3cmci_dma_done_callback);
                 s3c2410_dma_setflags(host->dma, S3C2410_DMAF_AUTOSTART);
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index 8cff5f5e7f86..406da9a8d453 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -107,6 +107,7 @@ static const struct sdhci_pci_fixes sdhci_ene_714 = {
 
 static const struct sdhci_pci_fixes sdhci_cafe = {
         .quirks         = SDHCI_QUIRK_NO_SIMULT_VDD_AND_POWER |
+                          SDHCI_QUIRK_NO_BUSY_IRQ |
                           SDHCI_QUIRK_BROKEN_TIMEOUT_VAL,
 };
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index f52f3053ed92..accb592764ed 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1291,8 +1291,11 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
                 if (host->cmd->data)
                         DBG("Cannot wait for busy signal when also "
                                 "doing a data transfer");
-                else
+                else if (!(host->quirks & SDHCI_QUIRK_NO_BUSY_IRQ))
                         return;
+
+                /* The controller does not support the end-of-busy IRQ,
+                 * fall through and take the SDHCI_INT_RESPONSE */
         }
 
         if (intmask & SDHCI_INT_RESPONSE)
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index ebb83657e27a..43c37c68d07a 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -208,6 +208,8 @@ struct sdhci_host {
 #define SDHCI_QUIRK_BROKEN_TIMEOUT_VAL                  (1<<12)
 /* Controller has an issue with buffer bits for small transfers */
 #define SDHCI_QUIRK_BROKEN_SMALL_PIO                    (1<<13)
+/* Controller does not provide transfer-complete interrupt when not busy */
+#define SDHCI_QUIRK_NO_BUSY_IRQ                         (1<<14)
 
         int                     irq;            /* Device IRQ */
         void __iomem *          ioaddr;         /* Mapped address */
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 821d0ed6bae3..c76d6e5f47ee 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -19,6 +19,7 @@ static int maprom_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int maprom_write (struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
 static void maprom_nop (struct mtd_info *);
 static struct mtd_info *map_rom_probe(struct map_info *map);
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info);
 
 static struct mtd_chip_driver maprom_chipdrv = {
         .probe  = map_rom_probe,
@@ -42,6 +43,7 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
         mtd->read = maprom_read;
         mtd->write = maprom_write;
         mtd->sync = maprom_nop;
+        mtd->erase = maprom_erase;
         mtd->flags = MTD_CAP_ROM;
         mtd->erasesize = map->size;
         mtd->writesize = 1;
@@ -71,6 +73,12 @@ static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *re
         return -EIO;
 }
 
+static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)
+{
+        /* We do our best 8) */
+        return -EROFS;
+}
+
 static int __init map_rom_init(void)
 {
         register_mtd_chip_driver(&maprom_chipdrv);
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index d44f741ae229..6d9f810565c8 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -821,7 +821,8 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
                                         if (!(info->flags & IS_POW2PS))
                                                 return info;
                                 }
-                        }
+                        } else
+                                return info;
                 }
         }
 
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index a425d09f35a0..00248e81ecd5 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -267,22 +267,28 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
         if (*(szlength) != '+') {
                 devlength = simple_strtoul(szlength, &buffer, 0);
                 devlength = handle_unit(devlength, buffer) - devstart;
+                if (devlength < devstart)
+                        goto err_out;
+
+                devlength -= devstart;
         } else {
                 devlength = simple_strtoul(szlength + 1, &buffer, 0);
                 devlength = handle_unit(devlength, buffer);
         }
         T("slram: devname=%s, devstart=0x%lx, devlength=0x%lx\n",
                         devname, devstart, devlength);
-        if ((devstart < 0) || (devlength < 0) || (devlength % SLRAM_BLK_SZ != 0)) {
-                E("slram: Illegal start / length parameter.\n");
-                return(-EINVAL);
-        }
+        if (devlength % SLRAM_BLK_SZ != 0)
+                goto err_out;
 
         if ((devstart = register_device(devname, devstart, devlength))){
                 unregister_devices();
                 return((int)devstart);
         }
         return(0);
+
+err_out:
+        E("slram: Illegal length parameter.\n");
+        return(-EINVAL);
 }
 
 #ifndef MODULE
diff --git a/drivers/mtd/lpddr/Kconfig b/drivers/mtd/lpddr/Kconfig
index acd4ea9b2278..5a401d8047ab 100644
--- a/drivers/mtd/lpddr/Kconfig
+++ b/drivers/mtd/lpddr/Kconfig
@@ -12,6 +12,7 @@ config MTD_LPDDR
           DDR memories, intended for battery-operated systems.
 
 config MTD_QINFO_PROBE
+        depends on MTD_LPDDR
         tristate "Detect flash chips by QINFO probe"
         help
             Device Information for LPDDR chips is offered through the Overlay
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 0225cbbf22de..043d50fb6ef6 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -491,7 +491,7 @@ config MTD_PCMCIA_ANONYMOUS
 
 config MTD_BFIN_ASYNC
         tristate "Blackfin BF533-STAMP Flash Chip Support"
-        depends on BFIN533_STAMP && MTD_CFI
+        depends on BFIN533_STAMP && MTD_CFI && MTD_COMPLEX_MAPPINGS
         select MTD_PARTITIONS
         default y
         help
diff --git a/drivers/mtd/maps/bfin-async-flash.c b/drivers/mtd/maps/bfin-async-flash.c
index 6fec86aaed7e..576611f605db 100644
--- a/drivers/mtd/maps/bfin-async-flash.c
+++ b/drivers/mtd/maps/bfin-async-flash.c
@@ -152,14 +152,18 @@ static int __devinit bfin_flash_probe(struct platform_device *pdev)
 
         if (gpio_request(state->enet_flash_pin, DRIVER_NAME)) {
                 pr_devinit(KERN_ERR DRIVER_NAME ": Failed to request gpio %d\n", state->enet_flash_pin);
+                kfree(state);
                 return -EBUSY;
         }
         gpio_direction_output(state->enet_flash_pin, 1);
 
         pr_devinit(KERN_NOTICE DRIVER_NAME ": probing %d-bit flash bus\n", state->map.bankwidth * 8);
         state->mtd = do_map_probe(memory->name, &state->map);
-        if (!state->mtd)
+        if (!state->mtd) {
+                gpio_free(state->enet_flash_pin);
+                kfree(state);
                 return -ENXIO;
+        }
 
 #ifdef CONFIG_MTD_PARTITIONS
         ret = parse_mtd_partitions(state->mtd, part_probe_types, &pdata->parts, 0);
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 5f7a245ed132..424f17d6ffd1 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -342,9 +342,9 @@ static struct pci_device_id ck804xrom_pci_tbl[] = {
         { 0, }
 };
 
+#if 0
 MODULE_DEVICE_TABLE(pci, ck804xrom_pci_tbl);
 
-#if 0
 static struct pci_driver ck804xrom_driver = {
         .name =         MOD_NAME,
         .id_table =     ck804xrom_pci_tbl,
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 87743661d48e..229718222db7 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -29,6 +29,7 @@ struct physmap_flash_info {
         struct map_info         map[MAX_RESOURCES];
 #ifdef CONFIG_MTD_PARTITIONS
         int                     nr_parts;
+        struct mtd_partition    *parts;
 #endif
 };
 
@@ -45,25 +46,29 @@ static int physmap_flash_remove(struct platform_device *dev)
 
         physmap_data = dev->dev.platform_data;
 
-#ifdef CONFIG_MTD_CONCAT
-        if (info->cmtd != info->mtd[0]) {
+        if (info->cmtd) {
+#ifdef CONFIG_MTD_PARTITIONS
+                if (info->nr_parts || physmap_data->nr_parts)
+                        del_mtd_partitions(info->cmtd);
+                else
+                        del_mtd_device(info->cmtd);
+#else
                 del_mtd_device(info->cmtd);
-                mtd_concat_destroy(info->cmtd);
+#endif
         }
+#ifdef CONFIG_MTD_PARTITIONS
+        if (info->nr_parts)
+                kfree(info->parts);
 #endif
 
-        for (i = 0; i < MAX_RESOURCES; i++) {
-                if (info->mtd[i] != NULL) {
-#ifdef CONFIG_MTD_PARTITIONS
-                        if (info->nr_parts || physmap_data->nr_parts)
-                                del_mtd_partitions(info->mtd[i]);
-                        else
-                                del_mtd_device(info->mtd[i]);
-#else
-                        del_mtd_device(info->mtd[i]);
+#ifdef CONFIG_MTD_CONCAT
+        if (info->cmtd != info->mtd[0])
+                mtd_concat_destroy(info->cmtd);
 #endif
+
+        for (i = 0; i < MAX_RESOURCES; i++) {
+                if (info->mtd[i] != NULL)
                         map_destroy(info->mtd[i]);
-                }
         }
         return 0;
 }
@@ -86,9 +91,6 @@ static int physmap_flash_probe(struct platform_device *dev)
         int err = 0;
         int i;
         int devices_found = 0;
-#ifdef CONFIG_MTD_PARTITIONS
-        struct mtd_partition *parts;
-#endif
 
         physmap_data = dev->dev.platform_data;
         if (physmap_data == NULL)
@@ -167,10 +169,11 @@ static int physmap_flash_probe(struct platform_device *dev)
                 goto err_out;
 
 #ifdef CONFIG_MTD_PARTITIONS
-        err = parse_mtd_partitions(info->cmtd, part_probe_types, &parts, 0);
+        err = parse_mtd_partitions(info->cmtd, part_probe_types,
+                                &info->parts, 0);
         if (err > 0) {
-                add_mtd_partitions(info->cmtd, parts, err);
-                kfree(parts);
+                add_mtd_partitions(info->cmtd, info->parts, err);
+                info->nr_parts = err;
                 return 0;
         }
 
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 917cf8d3ae95..c2dfd3ea353d 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -149,7 +149,7 @@ static int __devexit orion_nand_remove(struct platform_device *pdev)
 
 static struct platform_driver orion_nand_driver = {
         .probe          = orion_nand_probe,
-        .remove         = orion_nand_remove,
+        .remove         = __devexit_p(orion_nand_remove),
         .driver         = {
                 .name   = "orion_nand",
                 .owner  = THIS_MODULE,
diff --git a/drivers/net/arm/Makefile b/drivers/net/arm/Makefile
index c69c0cdba4a2..811a3ccd14c1 100644
--- a/drivers/net/arm/Makefile
+++ b/drivers/net/arm/Makefile
@@ -4,7 +4,7 @@
 #
 
 obj-$(CONFIG_ARM_AM79C961A)     += am79c961a.o
-obj-$(CONFIG_ARM_ETHERH)        += etherh.o ../8390.o
+obj-$(CONFIG_ARM_ETHERH)        += etherh.o
 obj-$(CONFIG_ARM_ETHER3)        += ether3.o
 obj-$(CONFIG_ARM_ETHER1)        += ether1.o
 obj-$(CONFIG_ARM_AT91_ETHER)    += at91_ether.o
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index 54b52e5b1821..f52f668c49bf 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -641,15 +641,15 @@ static const struct net_device_ops etherh_netdev_ops = {
         .ndo_open               = etherh_open,
         .ndo_stop               = etherh_close,
         .ndo_set_config         = etherh_set_config,
-        .ndo_start_xmit         = ei_start_xmit,
-        .ndo_tx_timeout         = ei_tx_timeout,
-        .ndo_get_stats          = ei_get_stats,
-        .ndo_set_multicast_list = ei_set_multicast_list,
+        .ndo_start_xmit         = __ei_start_xmit,
+        .ndo_tx_timeout         = __ei_tx_timeout,
+        .ndo_get_stats          = __ei_get_stats,
+        .ndo_set_multicast_list = __ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        .ndo_poll_controller    = ei_poll,
+        .ndo_poll_controller    = __ei_poll,
 #endif
 };
 
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 1cf2f949c0b4..f3a127434897 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -560,7 +560,7 @@ ks8695_reset(struct ks8695_priv *ksp)
                 msleep(1);
         }
 
-        if (reset_timeout == 0) {
+        if (reset_timeout < 0) {
                 dev_crit(ksp->dev,
                          "Timeout waiting for DMA engines to reset\n");
                 /* And blithely carry on */
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index c38512ebcea6..dc5f051005fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1264,8 +1264,14 @@ static void b44_clear_stats(struct b44 *bp)
 static void b44_chip_reset(struct b44 *bp, int reset_kind)
 {
         struct ssb_device *sdev = bp->sdev;
+        bool was_enabled;
 
-        if (ssb_device_is_enabled(bp->sdev)) {
+        was_enabled = ssb_device_is_enabled(bp->sdev);
+
+        ssb_device_enable(bp->sdev, 0);
+        ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+
+        if (was_enabled) {
                 bw32(bp, B44_RCV_LAZY, 0);
                 bw32(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE);
                 b44_wait_bit(bp, B44_ENET_CTRL, ENET_CTRL_DISABLE, 200, 1);
@@ -1277,10 +1283,8 @@ static void b44_chip_reset(struct b44 *bp, int reset_kind)
                 }
                 bw32(bp, B44_DMARX_CTRL, 0);
                 bp->rx_prod = bp->rx_cons = 0;
-        } else
-                ssb_pcicore_dev_irqvecs_enable(&sdev->bus->pcicore, sdev);
+        }
 
-        ssb_device_enable(bp->sdev, 0);
         b44_clear_stats(bp);
 
         /*
@@ -2236,6 +2240,7 @@ static void __devexit b44_remove_one(struct ssb_device *sdev)
         struct net_device *dev = ssb_get_drvdata(sdev);
 
         unregister_netdev(dev);
+        ssb_device_disable(sdev, 0);
         ssb_bus_may_powerdown(sdev->bus);
         free_netdev(dev);
         ssb_pcihost_set_power_state(sdev, PCI_D3hot);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 9fb388388fb7..e0578fe8c0db 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4113,7 +4113,7 @@ static int bond_neigh_setup(struct net_device *dev, struct neigh_parms *parms)
                 const struct net_device_ops *slave_ops
                         = slave->dev->netdev_ops;
                 if (slave_ops->ndo_neigh_setup)
-                        return slave_ops->ndo_neigh_setup(dev, parms);
+                        return slave_ops->ndo_neigh_setup(slave->dev, parms);
         }
         return 0;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 9b12a13a640f..9831b3f408aa 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1284,7 +1284,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         spin_lock_irqsave(&priv->txlock, flags);
 
         /* check if there is space to queue this packet */
-        if (nr_frags > priv->num_txbdfree) {
+        if ((nr_frags+1) > priv->num_txbdfree) {
                 /* no space, stop the queue */
                 netif_stop_queue(dev);
                 dev->stats.tx_fifo_errors++;
diff --git a/drivers/net/hp-plus.c b/drivers/net/hp-plus.c
index 5e070f446635..0486cbe01adb 100644
--- a/drivers/net/hp-plus.c
+++ b/drivers/net/hp-plus.c
@@ -467,7 +467,7 @@ init_module(void)
                         if (this_dev != 0) break; /* only autoprobe 1st one */
                         printk(KERN_NOTICE "hp-plus.c: Presently autoprobing (not recommended) for a single card.\n");
                 }
-                dev = alloc_ei_netdev();
+                dev = alloc_eip_netdev();
                 if (!dev)
                         break;
                 dev->irq = irq[this_dev];
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 08b34051c646..a6e1a35a13cb 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -957,13 +957,14 @@ jme_process_receive(struct jme_adapter *jme, int limit)
                 goto out_inc;
 
         i = atomic_read(&rxring->next_to_clean);
-        while (limit-- > 0) {
+        while (limit > 0) {
                 rxdesc = rxring->desc;
                 rxdesc += i;
 
                 if ((rxdesc->descwb.flags & cpu_to_le16(RXWBFLAG_OWN)) ||
                 !(rxdesc->descwb.desccnt & RXWBDCNT_WBCPL))
                         goto out;
+                --limit;
 
                 desccnt = rxdesc->descwb.desccnt & RXWBDCNT_DCNT;
 
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f33e442f403..13087782ac40 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -588,7 +588,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 adapter->pci_mem_read = netxen_nic_pci_mem_read_2M;
                 adapter->pci_mem_write = netxen_nic_pci_mem_write_2M;
 
-                mem_ptr0 = ioremap(mem_base, mem_len);
+                mem_ptr0 = pci_ioremap_bar(pdev, 0);
+                if (mem_ptr0 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        return -EIO;
+                }
+
                 pci_len0 = mem_len;
                 first_page_group_start = 0;
                 first_page_group_end   = 0;
@@ -795,9 +800,12 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * See if the firmware gave us a virtual-physical port mapping.
          */
         adapter->physical_port = adapter->portnum;
-        i = adapter->pci_read_normalize(adapter, CRB_V2P(adapter->portnum));
-        if (i != 0x55555555)
-                adapter->physical_port = i;
+        if (adapter->fw_major < 4) {
+                i = adapter->pci_read_normalize(adapter,
+                                CRB_V2P(adapter->portnum));
+                if (i != 0x55555555)
+                        adapter->physical_port = i;
+        }
 
         adapter->flags &= ~(NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED);
 
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index e5cb6b1f0ebd..2404a838b1fe 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -1035,7 +1035,8 @@ static int el3_rx(struct net_device *dev, int worklimit)
         DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
                   dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RxStatus));
         while (!((rx_status = inw(ioaddr + RxStatus)) & 0x8000) &&
-                   (--worklimit >= 0)) {
+                        worklimit > 0) {
+                worklimit--;
                 if (rx_status & 0x4000) { /* Error, update stats. */
                         short error = rx_status & 0x3800;
                         dev->stats.rx_errors++;
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 73ecc657999d..1e01b8a6dbf3 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -857,7 +857,8 @@ static int el3_rx(struct net_device *dev)
     DEBUG(3, "%s: in rx_packet(), status %4.4x, rx_status %4.4x.\n",
           dev->name, inw(ioaddr+EL3_STATUS), inw(ioaddr+RX_STATUS));
     while (!((rx_status = inw(ioaddr + RX_STATUS)) & 0x8000) &&
-           (--worklimit >= 0)) {
+                    worklimit > 0) {
+        worklimit--;
         if (rx_status & 0x4000) { /* Error, update stats. */
             short error = rx_status & 0x3800;
             dev->stats.rx_errors++;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 0771eb6fc6eb..b3473401c83a 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -81,9 +81,9 @@ static const int multicast_filter_limit = 32;
 #define RTL8169_TX_TIMEOUT      (6*HZ)
 #define RTL8169_PHY_TIMEOUT     (10*HZ)
 
-#define RTL_EEPROM_SIG          cpu_to_le32(0x8129)
-#define RTL_EEPROM_SIG_MASK     cpu_to_le32(0xffff)
+#define RTL_EEPROM_SIG          0x8129
 #define RTL_EEPROM_SIG_ADDR     0x0000
+#define RTL_EEPROM_MAC_ADDR     0x0007
 
 /* write/read MMIO register */
 #define RTL_W8(reg, val8)       writeb ((val8), ioaddr + (reg))
@@ -293,6 +293,11 @@ enum rtl_register_content {
         /* Cfg9346Bits */
         Cfg9346_Lock    = 0x00,
         Cfg9346_Unlock  = 0xc0,
+        Cfg9346_Program = 0x80,         /* Programming mode */
+        Cfg9346_EECS    = 0x08,         /* Chip select */
+        Cfg9346_EESK    = 0x04,         /* Serial data clock */
+        Cfg9346_EEDI    = 0x02,         /* Data input */
+        Cfg9346_EEDO    = 0x01,         /* Data output */
 
         /* rx_mode_bits */
         AcceptErr       = 0x20,
@@ -305,6 +310,7 @@ enum rtl_register_content {
         /* RxConfigBits */
         RxCfgFIFOShift  = 13,
         RxCfgDMAShift   =  8,
+        RxCfg9356SEL    =  6,           /* EEPROM type: 0 = 9346, 1 = 9356 */
 
         /* TxConfigBits */
         TxInterFrameGapShift = 24,
@@ -1963,6 +1969,108 @@ static const struct net_device_ops rtl8169_netdev_ops = {
 
 };
 
+/* Delay between EEPROM clock transitions. Force out buffered PCI writes. */
+#define RTL_EEPROM_DELAY()      RTL_R8(Cfg9346)
+#define RTL_EEPROM_READ_CMD     6
+
+/* read 16bit word stored in EEPROM. EEPROM is addressed by words. */
+static u16 rtl_eeprom_read(void __iomem *ioaddr, int addr)
+{
+        u16 result = 0;
+        int cmd, cmd_len, i;
+
+        /* check for EEPROM address size (in bits) */
+        if (RTL_R32(RxConfig) & (1 << RxCfg9356SEL)) {
+                /* EEPROM is 93C56 */
+                cmd_len = 3 + 8; /* 3 bits for command id and 8 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 8) | (addr & 0xff);
+        } else {
+                /* EEPROM is 93C46 */
+                cmd_len = 3 + 6; /* 3 bits for command id and 6 for address */
+                cmd = (RTL_EEPROM_READ_CMD << 6) | (addr & 0x3f);
+        }
+
+        /* enter programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* write command and requested address */
+        while (cmd_len--) {
+                u8 x = Cfg9346_Program | Cfg9346_EECS;
+
+                x |= (cmd & (1 << cmd_len)) ? Cfg9346_EEDI : 0;
+
+                /* write a bit */
+                RTL_W8(Cfg9346, x);
+                RTL_EEPROM_DELAY();
+
+                /* raise clock */
+                RTL_W8(Cfg9346, x | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+        }
+
+        /* lower clock */
+        RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+        RTL_EEPROM_DELAY();
+
+        /* read back 16bit value */
+        for (i = 16; i > 0; i--) {
+                /* raise clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS | Cfg9346_EESK);
+                RTL_EEPROM_DELAY();
+
+                result <<= 1;
+                result |= (RTL_R8(Cfg9346) & Cfg9346_EEDO) ? 1 : 0;
+
+                /* lower clock */
+                RTL_W8(Cfg9346, Cfg9346_Program | Cfg9346_EECS);
+                RTL_EEPROM_DELAY();
+        }
+
+        RTL_W8(Cfg9346, Cfg9346_Program);
+        /* leave programming mode */
+        RTL_W8(Cfg9346, Cfg9346_Lock);
+
+        return result;
+}
+
+static void rtl_init_mac_address(struct rtl8169_private *tp,
+                                 void __iomem *ioaddr)
+{
+        struct pci_dev *pdev = tp->pci_dev;
+        u16 x;
+        u8 mac[8];
+
+        /* read EEPROM signature */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_SIG_ADDR);
+
+        if (x != RTL_EEPROM_SIG) {
+                dev_info(&pdev->dev, "Missing EEPROM signature: %04x\n", x);
+                return;
+        }
+
+        /* read MAC address */
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR);
+        mac[0] = x & 0xff;
+        mac[1] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 1);
+        mac[2] = x & 0xff;
+        mac[3] = x >> 8;
+        x = rtl_eeprom_read(ioaddr, RTL_EEPROM_MAC_ADDR + 2);
+        mac[4] = x & 0xff;
+        mac[5] = x >> 8;
+
+        if (netif_msg_probe(tp)) {
+                DECLARE_MAC_BUF(buf);
+
+                dev_info(&pdev->dev, "MAC address found in EEPROM: %s\n",
+                         print_mac(buf, mac));
+        }
+
+        if (is_valid_ether_addr(mac))
+                rtl_rar_set(tp, mac);
+}
+
 static int __devinit
 rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
@@ -2141,6 +2249,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         tp->mmio_addr = ioaddr;
 
+        rtl_init_mac_address(tp, ioaddr);
+
         /* Get MAC address */
         for (i = 0; i < MAC_ADDR_LEN; i++)
                 dev->dev_addr[i] = RTL_R8(MAC0 + i);
diff --git a/drivers/net/smc911x.h b/drivers/net/smc911x.h
index 870b4c33f108..a45952e72018 100644
--- a/drivers/net/smc911x.h
+++ b/drivers/net/smc911x.h
@@ -42,6 +42,16 @@
   #define SMC_USE_16BIT         0
   #define SMC_USE_32BIT         1
   #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+#elif defined(CONFIG_ARCH_OMAP34XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
+#elif defined(CONFIG_ARCH_OMAP24XX)
+  #define SMC_USE_16BIT         0
+  #define SMC_USE_32BIT         1
+  #define SMC_IRQ_SENSE         IRQF_TRIGGER_LOW
+  #define SMC_MEM_RESERVED      1
 #else
 /*
  * Default configuration
@@ -675,6 +685,7 @@ smc_pxa_dma_outsl(struct smc911x_local *lp, u_long physaddr,
 #define CHIP_9116       0x0116
 #define CHIP_9117       0x0117
 #define CHIP_9118       0x0118
+#define CHIP_9211       0x9211
 #define CHIP_9215       0x115A
 #define CHIP_9217       0x117A
 #define CHIP_9218       0x118A
@@ -689,6 +700,7 @@ static const struct chip_id chip_ids[] =  {
         { CHIP_9116, "LAN9116" },
         { CHIP_9117, "LAN9117" },
         { CHIP_9118, "LAN9118" },
+        { CHIP_9211, "LAN9211" },
         { CHIP_9215, "LAN9215" },
         { CHIP_9217, "LAN9217" },
         { CHIP_9218, "LAN9218" },
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 8d64b1da0465..0fcb7503363d 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -1229,7 +1229,7 @@ static void gem_reset(struct gem *gp)
                         break;
         } while (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST));
 
-        if (limit <= 0)
+        if (limit < 0)
                 printk(KERN_ERR "%s: SW reset is ghetto.\n", gp->dev->name);
 
         if (gp->phy_type == phy_serialink || gp->phy_type == phy_serdes)
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index d4fb4acdbebd..4e9bd380a5c2 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2649,8 +2649,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         int err = -ENODEV;
 
         sbus_dp = to_of_device(op->dev.parent)->node;
-        if (is_qfe)
-                sbus_dp = to_of_device(op->dev.parent->parent)->node;
 
         /* We can match PCI devices too, do not accept those here. */
         if (strcmp(sbus_dp->name, "sbus"))
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index b080f9493d83..dabdf59f8016 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -1473,7 +1473,8 @@ static void tg3_phy_toggle_apd(struct tg3 *tp, bool enable)
 {
         u32 reg;
 
-        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
+        if (!(tp->tg3_flags2 & TG3_FLG2_5705_PLUS) ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                 return;
 
         reg = MII_TG3_MISC_SHDW_WREN |
diff --git a/drivers/net/tokenring/tmspci.c b/drivers/net/tokenring/tmspci.c
index 5f601773c260..e2150b3c83d9 100644
--- a/drivers/net/tokenring/tmspci.c
+++ b/drivers/net/tokenring/tmspci.c
@@ -121,11 +121,6 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
                 goto err_out_trdev;
         }
 
-        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
-                          dev->name, dev);
-        if (ret)
-                goto err_out_region;
-
         dev->base_addr  = pci_ioaddr;
         dev->irq        = pci_irq_line;
         dev->dma        = 0;
@@ -142,7 +137,7 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
         ret = tmsdev_init(dev, &pdev->dev);
         if (ret) {
                 printk("%s: unable to get memory for dev->priv.\n", dev->name);
-                goto err_out_irq;
+                goto err_out_region;
         }
 
         tp = netdev_priv(dev);
@@ -157,6 +152,11 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
         tp->tmspriv = cardinfo;
 
+        ret = request_irq(pdev->irq, tms380tr_interrupt, IRQF_SHARED,
+                          dev->name, dev);
+        if (ret)
+                goto err_out_tmsdev;
+
         dev->open = tms380tr_open;
         dev->stop = tms380tr_close;
         pci_set_drvdata(pdev, dev);
@@ -164,15 +164,15 @@ static int __devinit tms_pci_attach(struct pci_dev *pdev, const struct pci_devic
 
         ret = register_netdev(dev);
         if (ret)
-                goto err_out_tmsdev;
+                goto err_out_irq;
         
         return 0;
 
+err_out_irq:
+        free_irq(pdev->irq, dev);
 err_out_tmsdev:
         pci_set_drvdata(pdev, NULL);
         tmsdev_term(dev);
-err_out_irq:
-        free_irq(pdev->irq, dev);
 err_out_region:
         release_region(pci_ioaddr, TMS_PCI_IO_EXTENT);
 err_out_trdev:
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index 54635911305c..0ada4edd56eb 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -107,7 +107,7 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum)
 static int uec_mdio_reset(struct mii_bus *bus)
 {
         struct ucc_mii_mng __iomem *regs = (void __iomem *)bus->priv;
-        unsigned int timeout = PHY_INIT_TIMEOUT;
+        int timeout = PHY_INIT_TIMEOUT;
 
         mutex_lock(&bus->mdio_lock);
 
@@ -123,7 +123,7 @@ static int uec_mdio_reset(struct mii_bus *bus)
 
         mutex_unlock(&bus->mdio_lock);
 
-        if (timeout <= 0) {
+        if (timeout < 0) {
                 printk(KERN_ERR "%s: The MII Bus is stuck!\n", bus->name);
                 return -EBUSY;
         }
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index e009481c606c..396f821b5ff0 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1451,6 +1451,14 @@ static const struct usb_device_id	products [] = {
         // Cables-to-Go USB Ethernet Adapter
         USB_DEVICE(0x0b95, 0x772a),
         .driver_info = (unsigned long) &ax88772_info,
+}, {
+        // ABOCOM for pci
+        USB_DEVICE(0x14ea, 0xab11),
+        .driver_info = (unsigned long) &ax88178_info,
+}, {
+        // ASIX 88772a
+        USB_DEVICE(0x0db0, 0xa877),
+        .driver_info = (unsigned long) &ax88772_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 0e061dfea78d..55e8ecc3a9e5 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -559,6 +559,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
+}, {
+        /* Ericsson F3507g */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &cdc_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 5b67bbf1987e..81682c6defa0 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -635,6 +635,10 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0a47, 0x9601),     /* Hirose USB-100 */
         .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+        USB_DEVICE(0x0fe6, 0x8101),     /* DM9601 USB to Fast Ethernet Adapter */
+        .driver_info = (unsigned long)&dm9601_info,
+         },
         {},                     // END
 };
 
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index aa3149078888..c32284ff3f54 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -723,8 +723,8 @@ u32 usbnet_get_link (struct net_device *net)
         if (dev->mii.mdio_read)
                 return mii_link_ok(&dev->mii);
 
-        /* Otherwise, say we're up (to avoid breaking scripts) */
-        return 1;
+        /* Otherwise, dtrt for drivers calling netif_carrier_{on,off} */
+        return ethtool_op_get_link(net);
 }
 EXPORT_SYMBOL_GPL(usbnet_get_link);
 
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index e24f7b3ace4b..04882c8f9bf1 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -341,6 +341,11 @@ static const struct usb_device_id	products [] = {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
+        /* Motorola MOTOMAGX phones */
+        USB_DEVICE_AND_INTERFACE_INFO(0x22b8, 0x6425, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
 },
 
 /* Olympus has some models with a Zaurus-compatible option.
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 108bbbeacfb6..124fe75b8a8a 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -239,6 +239,16 @@ static int veth_open(struct net_device *dev)
         return 0;
 }
 
+static int veth_close(struct net_device *dev)
+{
+        struct veth_priv *priv = netdev_priv(dev);
+
+        netif_carrier_off(dev);
+        netif_carrier_off(priv->peer);
+
+        return 0;
+}
+
 static int veth_dev_init(struct net_device *dev)
 {
         struct veth_net_stats *stats;
@@ -265,6 +275,7 @@ static void veth_dev_free(struct net_device *dev)
 static const struct net_device_ops veth_netdev_ops = {
         .ndo_init            = veth_dev_init,
         .ndo_open            = veth_open,
+        .ndo_stop            = veth_close,
         .ndo_start_xmit      = veth_xmit,
         .ndo_get_stats       = veth_get_stats,
         .ndo_set_mac_address = eth_mac_addr,
@@ -280,44 +291,6 @@ static void veth_setup(struct net_device *dev)
         dev->destructor = veth_dev_free;
 }
 
-static void veth_change_state(struct net_device *dev)
-{
-        struct net_device *peer;
-        struct veth_priv *priv;
-
-        priv = netdev_priv(dev);
-        peer = priv->peer;
-
-        if (netif_carrier_ok(peer)) {
-                if (!netif_carrier_ok(dev))
-                        netif_carrier_on(dev);
-        } else {
-                if (netif_carrier_ok(dev))
-                        netif_carrier_off(dev);
-        }
-}
-
-static int veth_device_event(struct notifier_block *unused,
-                             unsigned long event, void *ptr)
-{
-        struct net_device *dev = ptr;
-
-        if (dev->netdev_ops->ndo_open != veth_open)
-                goto out;
-
-        switch (event) {
-        case NETDEV_CHANGE:
-                veth_change_state(dev);
-                break;
-        }
-out:
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block veth_notifier_block __read_mostly = {
-        .notifier_call  = veth_device_event,
-};
-
 /*
  * netlink interface
  */
@@ -468,14 +441,12 @@ static struct rtnl_link_ops veth_link_ops = {
 
 static __init int veth_init(void)
 {
-        register_netdevice_notifier(&veth_notifier_block);
         return rtnl_link_register(&veth_link_ops);
 }
 
 static __exit void veth_exit(void)
 {
         rtnl_link_unregister(&veth_link_ops);
-        unregister_netdevice_notifier(&veth_notifier_block);
 }
 
 module_init(veth_init);
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 727f067aca4f..0e80990d8e84 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1538,6 +1538,7 @@ bad2:
 bad:
         if (ah)
                 ath9k_hw_detach(ah);
+        ath9k_exit_debug(sc);
 
         return error;
 }
@@ -1545,7 +1546,7 @@ bad:
 static int ath_attach(u16 devid, struct ath_softc *sc)
 {
         struct ieee80211_hw *hw = sc->hw;
-        int error = 0;
+        int error = 0, i;
 
         DPRINTF(sc, ATH_DBG_CONFIG, "Attach ATH hw\n");
 
@@ -1589,11 +1590,11 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         /* initialize tx/rx engine */
         error = ath_tx_init(sc, ATH_TXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
         error = ath_rx_init(sc, ATH_RXBUF);
         if (error != 0)
-                goto detach;
+                goto error_attach;
 
 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
         /* Initialze h/w Rfkill */
@@ -1601,8 +1602,9 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
                 INIT_DELAYED_WORK(&sc->rf_kill.rfkill_poll, ath_rfkill_poll);
 
         /* Initialize s/w rfkill */
-        if (ath_init_sw_rfkill(sc))
-                goto detach;
+        error = ath_init_sw_rfkill(sc);
+        if (error)
+                goto error_attach;
 #endif
 
         error = ieee80211_register_hw(hw);
@@ -1611,8 +1613,16 @@ static int ath_attach(u16 devid, struct ath_softc *sc)
         ath_init_leds(sc);
 
         return 0;
-detach:
-        ath_detach(sc);
+
+error_attach:
+        /* cleanup tx queues */
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                if (ATH_TXQ_SETUP(sc, i))
+                        ath_tx_cleanupq(sc, &sc->tx.txq[i]);
+
+        ath9k_hw_detach(sc->sc_ah);
+        ath9k_exit_debug(sc);
+
         return error;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 36bafeb353ce..129e2d330abb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3868,7 +3868,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         err = iwl_eeprom_check_version(priv);
         if (err)
-                goto out_iounmap;
+                goto out_free_eeprom;
 
         /* extract MAC Address */
         iwl_eeprom_get_mac(priv, priv->mac_addr);
@@ -3945,6 +3945,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
  out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
         sysfs_remove_group(&pdev->dev.kobj, &iwl_attribute_group);
  out_uninit_drv:
         iwl_uninit_drv(priv);
@@ -3953,8 +3955,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
  out_iounmap:
         pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
-        pci_release_regions(pdev);
         pci_set_drvdata(pdev, NULL);
+        pci_release_regions(pdev);
  out_pci_disable_device:
         pci_disable_device(pdev);
  out_ieee80211_free_hw:
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index b0ee86c62685..ab13ff22a8c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -148,7 +148,7 @@ static void iwl_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
                 pci_unmap_single(dev,
                                 pci_unmap_addr(&txq->cmd[index]->meta, mapping),
                                 pci_unmap_len(&txq->cmd[index]->meta, len),
-                                PCI_DMA_TODEVICE);
+                                PCI_DMA_BIDIRECTIONAL);
 
         /* Unmap chunks, if any. */
         for (i = 1; i < num_tbs; i++) {
@@ -964,7 +964,7 @@ int iwl_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
          * within command buffer array. */
         txcmd_phys = pci_map_single(priv->pci_dev,
                                     out_cmd, sizeof(struct iwl_cmd),
-                                    PCI_DMA_TODEVICE);
+                                    PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, txcmd_phys);
         pci_unmap_len_set(&out_cmd->meta, len, sizeof(struct iwl_cmd));
         /* Add buffer containing Tx command and MAC(!) header to TFD's
@@ -1115,7 +1115,7 @@ int iwl_enqueue_hcmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                         IWL_MAX_SCAN_SIZE : sizeof(struct iwl_cmd);
 
         phys_addr = pci_map_single(priv->pci_dev, out_cmd,
-                                   len, PCI_DMA_TODEVICE);
+                                   len, PCI_DMA_BIDIRECTIONAL);
         pci_unmap_addr_set(&out_cmd->meta, mapping, phys_addr);
         pci_unmap_len_set(&out_cmd->meta, len, len);
         phys_addr += offsetof(struct iwl_cmd, hdr);
@@ -1212,7 +1212,7 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
         pci_unmap_single(priv->pci_dev,
                 pci_unmap_addr(&txq->cmd[cmd_idx]->meta, mapping),
                 pci_unmap_len(&txq->cmd[cmd_idx]->meta, len),
-                PCI_DMA_TODEVICE);
+                PCI_DMA_BIDIRECTIONAL);
 
         for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
              q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 93be74a1f139..57dd34e256d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -7911,7 +7911,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
                                 CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY, 25000);
         if (err < 0) {
                 IWL_DEBUG_INFO("Failed to init the card\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
         }
 
         /***********************
@@ -7921,7 +7921,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         err = iwl3945_eeprom_init(priv);
         if (err) {
                 IWL_ERROR("Unable to init EEPROM\n");
-                goto out_remove_sysfs;
+                goto out_iounmap;
         }
         /* MAC Address location in EEPROM same for 3945/4965 */
         get_eeprom_mac(priv, priv->mac_addr);
@@ -7975,7 +7975,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         err = iwl3945_init_channel_map(priv);
         if (err) {
                 IWL_ERROR("initializing regulatory failed: %d\n", err);
-                goto out_release_irq;
+                goto out_unset_hw_setting;
         }
 
         err = iwl3945_init_geos(priv);
@@ -8045,25 +8045,22 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         return 0;
 
  out_remove_sysfs:
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
         sysfs_remove_group(&pdev->dev.kobj, &iwl3945_attribute_group);
  out_free_geos:
         iwl3945_free_geos(priv);
  out_free_channel_map:
         iwl3945_free_channel_map(priv);
-
-
- out_release_irq:
-        destroy_workqueue(priv->workqueue);
-        priv->workqueue = NULL;
+ out_unset_hw_setting:
         iwl3945_unset_hw_setting(priv);
-
  out_iounmap:
         pci_iounmap(pdev, priv->hw_base);
  out_pci_release_regions:
         pci_release_regions(pdev);
  out_pci_disable_device:
-        pci_disable_device(pdev);
         pci_set_drvdata(pdev, NULL);
+        pci_disable_device(pdev);
  out_ieee80211_free_hw:
         ieee80211_free_hw(priv->hw);
  out:
diff --git a/drivers/net/wireless/libertas/ethtool.c b/drivers/net/wireless/libertas/ethtool.c
index 61d2f50470c8..b118a35ec605 100644
--- a/drivers/net/wireless/libertas/ethtool.c
+++ b/drivers/net/wireless/libertas/ethtool.c
@@ -23,7 +23,7 @@ static const char * mesh_stat_strings[]= {
 static void lbs_ethtool_get_drvinfo(struct net_device *dev,
                                          struct ethtool_drvinfo *info)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         snprintf(info->fw_version, 32, "%u.%u.%u.p%u",
                 priv->fwrelease >> 24 & 0xff,
@@ -47,7 +47,7 @@ static int lbs_ethtool_get_eeprom_len(struct net_device *dev)
 static int lbs_ethtool_get_eeprom(struct net_device *dev,
                                   struct ethtool_eeprom *eeprom, u8 * bytes)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_802_11_eeprom_access cmd;
         int ret;
 
@@ -76,7 +76,7 @@ out:
 static void lbs_ethtool_get_stats(struct net_device *dev,
                                   struct ethtool_stats *stats, uint64_t *data)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -113,7 +113,7 @@ static void lbs_ethtool_get_stats(struct net_device *dev,
 
 static int lbs_ethtool_get_sset_count(struct net_device *dev, int sset)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (sset == ETH_SS_STATS && dev == priv->mesh_dev)
                 return MESH_STATS_NUM;
@@ -143,7 +143,7 @@ static void lbs_ethtool_get_strings(struct net_device *dev,
 static void lbs_ethtool_get_wol(struct net_device *dev,
                                 struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         if (priv->wol_criteria == 0xffffffff) {
                 /* Interface driver didn't configure wake */
@@ -166,7 +166,7 @@ static void lbs_ethtool_get_wol(struct net_device *dev,
 static int lbs_ethtool_set_wol(struct net_device *dev,
                                struct ethtool_wolinfo *wol)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         uint32_t criteria = 0;
 
         if (priv->wol_criteria == 0xffffffff && wol->wolopts)
diff --git a/drivers/net/wireless/libertas/if_usb.c b/drivers/net/wireless/libertas/if_usb.c
index 2fc637ad85c7..ea3dc038be76 100644
--- a/drivers/net/wireless/libertas/if_usb.c
+++ b/drivers/net/wireless/libertas/if_usb.c
@@ -59,7 +59,7 @@ static int if_usb_reset_device(struct if_usb_card *cardp);
 static ssize_t if_usb_firmware_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
@@ -86,7 +86,7 @@ static DEVICE_ATTR(lbs_flash_fw, 0200, NULL, if_usb_firmware_set);
 static ssize_t if_usb_boot2_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct if_usb_card *cardp = priv->card;
         char fwname[FIRMWARE_NAME_MAX];
         int ret;
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 4e0007d20030..f76623e0ff9a 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -222,7 +222,7 @@ u8 lbs_data_rate_to_fw_index(u32 rate)
 static ssize_t lbs_anycast_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
 
@@ -241,7 +241,7 @@ static ssize_t lbs_anycast_get(struct device *dev,
 static ssize_t lbs_anycast_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         uint32_t datum;
         int ret;
@@ -263,7 +263,7 @@ static ssize_t lbs_anycast_set(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         u32 retry_limit;
@@ -286,7 +286,7 @@ static ssize_t lbs_prb_rsp_limit_get(struct device *dev,
 static ssize_t lbs_prb_rsp_limit_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_access mesh_access;
         int ret;
         unsigned long retry_limit;
@@ -321,7 +321,7 @@ static void lbs_remove_mesh(struct lbs_private *priv);
 static ssize_t lbs_rtap_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", priv->monitormode);
 }
 
@@ -332,7 +332,7 @@ static ssize_t lbs_rtap_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
         int monitor_mode;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
 
         sscanf(buf, "%x", &monitor_mode);
         if (monitor_mode) {
@@ -383,7 +383,7 @@ static DEVICE_ATTR(lbs_rtap, 0644, lbs_rtap_get, lbs_rtap_set );
 static ssize_t lbs_mesh_get(struct device *dev,
                 struct device_attribute *attr, char * buf)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         return snprintf(buf, 5, "0x%X\n", !!priv->mesh_dev);
 }
 
@@ -393,7 +393,7 @@ static ssize_t lbs_mesh_get(struct device *dev,
 static ssize_t lbs_mesh_set(struct device *dev,
                 struct device_attribute *attr, const char * buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int enable;
         int ret, action = CMD_ACT_MESH_CONFIG_STOP;
 
@@ -452,7 +452,7 @@ static struct attribute_group lbs_mesh_attr_group = {
  */
 static int lbs_dev_open(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev) ;
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_NET);
@@ -521,7 +521,7 @@ static int lbs_mesh_stop(struct net_device *dev)
  */
 static int lbs_eth_stop(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
 
@@ -538,7 +538,7 @@ static int lbs_eth_stop(struct net_device *dev)
 
 static void lbs_tx_timeout(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_TX);
 
@@ -590,7 +590,7 @@ EXPORT_SYMBOL_GPL(lbs_host_to_card_done);
  */
 static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_NET);
         return &priv->stats;
@@ -599,7 +599,7 @@ static struct net_device_stats *lbs_get_stats(struct net_device *dev)
 static int lbs_set_mac_address(struct net_device *dev, void *addr)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct sockaddr *phwaddr = addr;
         struct cmd_ds_802_11_mac_address cmd;
 
@@ -732,7 +732,7 @@ static void lbs_set_mcast_worker(struct work_struct *work)
 
 static void lbs_set_multicast_list(struct net_device *dev)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         schedule_work(&priv->mcast_work);
 }
@@ -748,7 +748,7 @@ static void lbs_set_multicast_list(struct net_device *dev)
 static int lbs_thread(void *data)
 {
         struct net_device *dev = data;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         wait_queue_t wait;
 
         lbs_deb_enter(LBS_DEB_THREAD);
@@ -1184,6 +1184,7 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
                 goto done;
         }
         priv = netdev_priv(dev);
+        dev->ml_priv = priv;
 
         if (lbs_init_adapter(priv)) {
                 lbs_pr_err("failed to initialize adapter structure.\n");
diff --git a/drivers/net/wireless/libertas/persistcfg.c b/drivers/net/wireless/libertas/persistcfg.c
index d42b7a5a1b3f..18fe29faf99b 100644
--- a/drivers/net/wireless/libertas/persistcfg.c
+++ b/drivers/net/wireless/libertas/persistcfg.c
@@ -18,7 +18,7 @@
 static int mesh_get_default_parameters(struct device *dev,
                                        struct mrvl_mesh_defaults *defs)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         int ret;
 
@@ -57,7 +57,7 @@ static ssize_t bootflag_get(struct device *dev,
 static ssize_t bootflag_set(struct device *dev, struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -100,7 +100,7 @@ static ssize_t boottime_get(struct device *dev,
 static ssize_t boottime_set(struct device *dev,
                 struct device_attribute *attr, const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -152,7 +152,7 @@ static ssize_t channel_get(struct device *dev,
 static ssize_t channel_set(struct device *dev, struct device_attribute *attr,
                            const char *buf, size_t count)
 {
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         struct cmd_ds_mesh_config cmd;
         uint32_t datum;
         int ret;
@@ -210,7 +210,7 @@ static ssize_t mesh_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         int len;
         int ret;
 
@@ -269,7 +269,7 @@ static ssize_t protocol_id_set(struct device *dev,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -323,7 +323,7 @@ static ssize_t metric_id_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
@@ -377,7 +377,7 @@ static ssize_t capability_set(struct device *dev, struct device_attribute *attr,
         struct cmd_ds_mesh_config cmd;
         struct mrvl_mesh_defaults defs;
         struct mrvl_meshie *ie;
-        struct lbs_private *priv = netdev_priv(to_net_dev(dev));
+        struct lbs_private *priv = to_net_dev(dev)->ml_priv;
         uint32_t datum;
         int ret;
 
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 57f6c12cda20..9014950f4328 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -945,7 +945,7 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
                  union iwreq_data *wrqu, char *extra)
 {
         DECLARE_SSID_BUF(ssid);
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1008,7 +1008,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                  struct iw_point *dwrq, char *extra)
 {
 #define SCAN_ITEM_SIZE 128
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int err = 0;
         char *ev = extra;
         char *stop = ev + dwrq->length;
diff --git a/drivers/net/wireless/libertas/tx.c b/drivers/net/wireless/libertas/tx.c
index dac462641170..68bec31ae03b 100644
--- a/drivers/net/wireless/libertas/tx.c
+++ b/drivers/net/wireless/libertas/tx.c
@@ -60,7 +60,7 @@ static u32 convert_radiotap_rate_to_mv(u8 rate)
 int lbs_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         unsigned long flags;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct txpd *txpd;
         char *p802x_hdr;
         uint16_t pkt_len;
diff --git a/drivers/net/wireless/libertas/wext.c b/drivers/net/wireless/libertas/wext.c
index c6102e08179e..f16d136ab4bb 100644
--- a/drivers/net/wireless/libertas/wext.c
+++ b/drivers/net/wireless/libertas/wext.c
@@ -163,7 +163,7 @@ static int lbs_get_name(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
                          struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -189,7 +189,7 @@ static int lbs_get_freq(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
                         struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -207,7 +207,7 @@ static int lbs_get_wap(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -231,7 +231,7 @@ static int lbs_set_nick(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -248,7 +248,7 @@ static int lbs_get_nick(struct net_device *dev, struct iw_request_info *info,
 static int mesh_get_nick(struct net_device *dev, struct iw_request_info *info,
                          struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -273,7 +273,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 val = vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -293,7 +293,7 @@ static int lbs_set_rts(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_rts(struct net_device *dev, struct iw_request_info *info,
                         struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -315,7 +315,7 @@ out:
 static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u32 val = vwrq->value;
 
@@ -336,7 +336,7 @@ static int lbs_set_frag(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_frag(struct net_device *dev, struct iw_request_info *info,
                          struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -359,7 +359,7 @@ out:
 static int lbs_get_mode(struct net_device *dev,
                          struct iw_request_info *info, u32 * uwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -385,7 +385,7 @@ static int lbs_get_txpow(struct net_device *dev,
                           struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 curlevel = 0;
         int ret = 0;
 
@@ -418,7 +418,7 @@ out:
 static int lbs_set_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 slimit = 0, llimit = 0;
 
@@ -466,7 +466,7 @@ out:
 static int lbs_get_retry(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u16 val = 0;
 
@@ -542,7 +542,7 @@ static int lbs_get_range(struct net_device *dev, struct iw_request_info *info,
                           struct iw_point *dwrq, char *extra)
 {
         int i, j;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_range *range = (struct iw_range *)extra;
         struct chan_freq_power *cfp;
         u8 rates[MAX_RATES + 1];
@@ -708,7 +708,7 @@ out:
 static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -758,7 +758,7 @@ static int lbs_set_power(struct net_device *dev, struct iw_request_info *info,
 static int lbs_get_power(struct net_device *dev, struct iw_request_info *info,
                           struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -781,7 +781,7 @@ static struct iw_statistics *lbs_get_wireless_stats(struct net_device *dev)
                 EXCELLENT = 95,
                 PERFECT = 100
         };
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u32 rssi_qual;
         u32 tx_qual;
         u32 quality = 0;
@@ -886,7 +886,7 @@ static int lbs_set_freq(struct net_device *dev, struct iw_request_info *info,
                   struct iw_freq *fwrq, char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         struct assoc_request * assoc_req;
 
@@ -943,7 +943,7 @@ static int lbs_mesh_set_freq(struct net_device *dev,
                              struct iw_request_info *info,
                              struct iw_freq *fwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct chan_freq_power *cfp;
         int ret = -EINVAL;
 
@@ -994,7 +994,7 @@ out:
 static int lbs_set_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         u8 new_rate = 0;
         int ret = -EINVAL;
         u8 rates[MAX_RATES + 1];
@@ -1054,7 +1054,7 @@ out:
 static int lbs_get_rate(struct net_device *dev, struct iw_request_info *info,
                   struct iw_param *vwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1079,7 +1079,7 @@ static int lbs_set_mode(struct net_device *dev,
                   struct iw_request_info *info, u32 * uwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1124,7 +1124,7 @@ static int lbs_get_encode(struct net_device *dev,
                            struct iw_request_info *info,
                            struct iw_point *dwrq, u8 * extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int index = (dwrq->flags & IW_ENCODE_INDEX) - 1;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1319,7 +1319,7 @@ static int lbs_set_encode(struct net_device *dev,
                     struct iw_point *dwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         u16 is_default = 0, index = 0, set_tx_key = 0;
 
@@ -1395,7 +1395,7 @@ static int lbs_get_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = -EINVAL;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int index, max_key_len;
 
@@ -1501,7 +1501,7 @@ static int lbs_set_encodeext(struct net_device *dev,
                               char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct iw_encode_ext *ext = (struct iw_encode_ext *)extra;
         int alg = ext->alg;
         struct assoc_request * assoc_req;
@@ -1639,7 +1639,7 @@ static int lbs_set_genie(struct net_device *dev,
                           struct iw_point *dwrq,
                           char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         struct assoc_request * assoc_req;
 
@@ -1685,7 +1685,7 @@ static int lbs_get_genie(struct net_device *dev,
                           char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1713,7 +1713,7 @@ static int lbs_set_auth(struct net_device *dev,
                          struct iw_param *dwrq,
                          char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
         int updated = 0;
@@ -1816,7 +1816,7 @@ static int lbs_get_auth(struct net_device *dev,
                          char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1857,7 +1857,7 @@ static int lbs_set_txpow(struct net_device *dev, struct iw_request_info *info,
                    struct iw_param *vwrq, char *extra)
 {
         int ret = 0;
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         s16 dbm = (s16) vwrq->value;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -1936,7 +1936,7 @@ out:
 static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -1971,7 +1971,7 @@ static int lbs_get_essid(struct net_device *dev, struct iw_request_info *info,
 static int lbs_set_essid(struct net_device *dev, struct iw_request_info *info,
                    struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
         u8 ssid[IW_ESSID_MAX_SIZE];
         u8 ssid_len = 0;
@@ -2040,7 +2040,7 @@ static int lbs_mesh_get_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
 
         lbs_deb_enter(LBS_DEB_WEXT);
 
@@ -2058,7 +2058,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
                               struct iw_request_info *info,
                               struct iw_point *dwrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         int ret = 0;
 
         lbs_deb_enter(LBS_DEB_WEXT);
@@ -2102,7 +2102,7 @@ static int lbs_mesh_set_essid(struct net_device *dev,
 static int lbs_set_wap(struct net_device *dev, struct iw_request_info *info,
                  struct sockaddr *awrq, char *extra)
 {
-        struct lbs_private *priv = netdev_priv(dev);
+        struct lbs_private *priv = dev->ml_priv;
         struct assoc_request * assoc_req;
         int ret = 0;
 
diff --git a/drivers/net/wireless/orinoco/orinoco.c b/drivers/net/wireless/orinoco/orinoco.c
index 45a04faa7818..067d1a9c728b 100644
--- a/drivers/net/wireless/orinoco/orinoco.c
+++ b/drivers/net/wireless/orinoco/orinoco.c
@@ -3157,8 +3157,20 @@ static int orinoco_pm_notifier(struct notifier_block *notifier,
 
         return NOTIFY_DONE;
 }
+
+static void orinoco_register_pm_notifier(struct orinoco_private *priv)
+{
+        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
+        register_pm_notifier(&priv->pm_notifier);
+}
+
+static void orinoco_unregister_pm_notifier(struct orinoco_private *priv)
+{
+        unregister_pm_notifier(&priv->pm_notifier);
+}
 #else /* !PM_SLEEP || HERMES_CACHE_FW_ON_INIT */
-#define orinoco_pm_notifier NULL
+#define orinoco_register_pm_notifier(priv) do { } while(0)
+#define orinoco_unregister_pm_notifier(priv) do { } while(0)
 #endif
 
 /********************************************************************/
@@ -3648,8 +3660,7 @@ struct net_device
         priv->cached_fw = NULL;
 
         /* Register PM notifiers */
-        priv->pm_notifier.notifier_call = orinoco_pm_notifier;
-        register_pm_notifier(&priv->pm_notifier);
+        orinoco_register_pm_notifier(priv);
 
         return dev;
 }
@@ -3673,7 +3684,7 @@ void free_orinocodev(struct net_device *dev)
                 kfree(rx_data);
         }
 
-        unregister_pm_notifier(&priv->pm_notifier);
+        orinoco_unregister_pm_notifier(priv);
         orinoco_uncache_fw(priv);
 
         priv->wpa_ie_len = 0;
diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 34561e6e816b..f170106bf0ae 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -710,10 +710,11 @@ static struct sk_buff *p54_find_tx_entry(struct ieee80211_hw *dev,
                                            __le32 req_id)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct p54_hdr *hdr = (struct p54_hdr *) entry->data;
 
@@ -732,7 +733,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         struct p54_common *priv = dev->priv;
         struct p54_hdr *hdr = (struct p54_hdr *) skb->data;
         struct p54_frame_sent *payload = (struct p54_frame_sent *) hdr->data;
-        struct sk_buff *entry = (struct sk_buff *) priv->tx_queue.next;
+        struct sk_buff *entry;
         u32 addr = le32_to_cpu(hdr->req_id) - priv->headroom;
         struct memrecord *range = NULL;
         u32 freed = 0;
@@ -741,6 +742,7 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         int count, idx;
 
         spin_lock_irqsave(&priv->tx_queue.lock, flags);
+        entry = (struct sk_buff *) priv->tx_queue.next;
         while (entry != (struct sk_buff *)&priv->tx_queue) {
                 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                 struct p54_hdr *entry_hdr;
@@ -976,7 +978,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                                struct p54_hdr *data, u32 len)
 {
         struct p54_common *priv = dev->priv;
-        struct sk_buff *entry = priv->tx_queue.next;
+        struct sk_buff *entry;
         struct sk_buff *target_skb = NULL;
         struct ieee80211_tx_info *info;
         struct memrecord *range;
@@ -1014,6 +1016,7 @@ static int p54_assign_address(struct ieee80211_hw *dev, struct sk_buff *skb,
                 }
         }
 
+        entry = priv->tx_queue.next;
         while (left--) {
                 u32 hole_size;
                 info = IEEE80211_SKB_CB(entry);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index af6b5847be5c..3e2ac2bbb12f 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1952,6 +1952,8 @@ static struct usb_device_id rt2500usb_device_table[] = {
         { USB_DEVICE(0x13b1, 0x000d), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x13b1, 0x0011), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x13b1, 0x001a), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* CNet */
+        { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Conceptronic */
         { USB_DEVICE(0x14b2, 0x3c02), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* D-LINK */
@@ -1976,14 +1978,20 @@ static struct usb_device_id rt2500usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x2570), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt2500usb_ops) },
         { USB_DEVICE(0x148f, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* Sagem */
+        { USB_DEVICE(0x079b, 0x004b), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Siemens */
         { USB_DEVICE(0x0681, 0x3c06), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* SMC */
         { USB_DEVICE(0x0707, 0xee13), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Spairon */
         { USB_DEVICE(0x114b, 0x0110), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* SURECOM */
+        { USB_DEVICE(0x0769, 0x11f3), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Trust */
         { USB_DEVICE(0x0eb0, 0x9020), USB_DEVICE_DATA(&rt2500usb_ops) },
+        /* VTech */
+        { USB_DEVICE(0x0f88, 0x3012), USB_DEVICE_DATA(&rt2500usb_ops) },
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0260), USB_DEVICE_DATA(&rt2500usb_ops) },
         { 0, }
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 96a8d69f8790..cefee1b26cd8 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2281,7 +2281,18 @@ static const struct rt2x00_ops rt73usb_ops = {
  */
 static struct usb_device_id rt73usb_device_table[] = {
         /* AboCom */
+        { USB_DEVICE(0x07b8, 0xb21b), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21c), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07b8, 0xb21d), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21e), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x07b8, 0xb21f), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AL */
+        { USB_DEVICE(0x14b2, 0x3c10), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Amigo */
+        { USB_DEVICE(0x148f, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0eb0, 0x9021), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* AMIT  */
+        { USB_DEVICE(0x18c5, 0x0002), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Askey */
         { USB_DEVICE(0x1690, 0x0722), USB_DEVICE_DATA(&rt73usb_ops) },
         /* ASUS */
@@ -2294,7 +2305,9 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x050d, 0x905c), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Billionton */
         { USB_DEVICE(0x1631, 0xc019), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x08dd, 0x0120), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Buffalo */
+        { USB_DEVICE(0x0411, 0x00d8), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0411, 0x00f4), USB_DEVICE_DATA(&rt73usb_ops) },
         /* CNet */
         { USB_DEVICE(0x1371, 0x9022), USB_DEVICE_DATA(&rt73usb_ops) },
@@ -2308,6 +2321,11 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c04), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c06), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c07), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Edimax */
+        { USB_DEVICE(0x7392, 0x7318), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x7392, 0x7618), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* EnGenius */
+        { USB_DEVICE(0x1740, 0x3701), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0004), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Gigabyte */
@@ -2328,22 +2346,34 @@ static struct usb_device_id rt73usb_device_table[] = {
         { USB_DEVICE(0x0db0, 0xa861), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0db0, 0xa874), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Ralink */
+        { USB_DEVICE(0x04bb, 0x093d), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2573), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x148f, 0x2671), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Qcom */
         { USB_DEVICE(0x18e8, 0x6196), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6229), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x18e8, 0x6238), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Samsung */
+        { USB_DEVICE(0x04e8, 0x4471), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Senao */
         { USB_DEVICE(0x1740, 0x7100), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Sitecom */
-        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0024), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0027), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x002f), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x0df6, 0x90ac), USB_DEVICE_DATA(&rt73usb_ops) },
+        { USB_DEVICE(0x0df6, 0x9712), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Surecom */
         { USB_DEVICE(0x0769, 0x31f3), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Philips */
+        { USB_DEVICE(0x0471, 0x200a), USB_DEVICE_DATA(&rt73usb_ops) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xab01), USB_DEVICE_DATA(&rt73usb_ops) },
         { USB_DEVICE(0x2019, 0xab50), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* Zcom */
+        { USB_DEVICE(0x0cde, 0x001c), USB_DEVICE_DATA(&rt73usb_ops) },
+        /* ZyXEL */
+        { USB_DEVICE(0x0586, 0x3415), USB_DEVICE_DATA(&rt73usb_ops) },
         { 0, }
 };
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 22bc07ef2f37..f4747a1134ba 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -48,6 +48,10 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B},
         {USB_DEVICE(0x0bda, 0x8198), .driver_info = DEVICE_RTL8187B},
+        /* Surecom */
+        {USB_DEVICE(0x0769, 0x11F2), .driver_info = DEVICE_RTL8187},
+        /* Logitech */
+        {USB_DEVICE(0x0789, 0x010C), .driver_info = DEVICE_RTL8187},
         /* Netgear */
         {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
@@ -57,8 +61,16 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        /* Sphairon Access Systems GmbH */
+        {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
+        /* Dick Smith Electronics */
+        {USB_DEVICE(0x1371, 0x9401), .driver_info = DEVICE_RTL8187},
         /* Abocom */
         {USB_DEVICE(0x13d1, 0xabe6), .driver_info = DEVICE_RTL8187},
+        /* Qcom */
+        {USB_DEVICE(0x18E8, 0x6232), .driver_info = DEVICE_RTL8187},
+        /* AirLive */
+        {USB_DEVICE(0x1b75, 0x8187), .driver_info = DEVICE_RTL8187},
         {}
 };
 
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index f5a662a50acb..26c536b51c5a 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -330,6 +330,14 @@ parse_dmar_table(void)
         entry_header = (struct acpi_dmar_header *)(dmar + 1);
         while (((unsigned long)entry_header) <
                         (((unsigned long)dmar) + dmar_tbl->length)) {
+                /* Avoid looping forever on bad ACPI tables */
+                if (entry_header->length == 0) {
+                        printk(KERN_WARNING PREFIX
+                                "Invalid 0-length structure\n");
+                        ret = -EINVAL;
+                        break;
+                }
+
                 dmar_table_print_dmar_entry(entry_header);
 
                 switch (entry_header->type) {
@@ -491,7 +499,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
         int map_size;
         u32 ver;
         static int iommu_allocated = 0;
-        int agaw;
+        int agaw = 0;
 
         iommu = kzalloc(sizeof(*iommu), GFP_KERNEL);
         if (!iommu)
@@ -507,6 +515,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
         iommu->cap = dmar_readq(iommu->reg + DMAR_CAP_REG);
         iommu->ecap = dmar_readq(iommu->reg + DMAR_ECAP_REG);
 
+#ifdef CONFIG_DMAR
         agaw = iommu_calculate_agaw(iommu);
         if (agaw < 0) {
                 printk(KERN_ERR
@@ -514,6 +523,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
                         iommu->seq_id);
                 goto error;
         }
+#endif
         iommu->agaw = agaw;
 
         /* the registers might be more than one page */
@@ -571,19 +581,49 @@ static inline void reclaim_free_desc(struct q_inval *qi)
         }
 }
 
+static int qi_check_fault(struct intel_iommu *iommu, int index)
+{
+        u32 fault;
+        int head;
+        struct q_inval *qi = iommu->qi;
+        int wait_index = (index + 1) % QI_LENGTH;
+
+        fault = readl(iommu->reg + DMAR_FSTS_REG);
+
+        /*
+         * If IQE happens, the head points to the descriptor associated
+         * with the error. No new descriptors are fetched until the IQE
+         * is cleared.
+         */
+        if (fault & DMA_FSTS_IQE) {
+                head = readl(iommu->reg + DMAR_IQH_REG);
+                if ((head >> 4) == index) {
+                        memcpy(&qi->desc[index], &qi->desc[wait_index],
+                                        sizeof(struct qi_desc));
+                        __iommu_flush_cache(iommu, &qi->desc[index],
+                                        sizeof(struct qi_desc));
+                        writel(DMA_FSTS_IQE, iommu->reg + DMAR_FSTS_REG);
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
 /*
  * Submit the queued invalidation descriptor to the remapping
  * hardware unit and wait for its completion.
  */
-void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
+int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
 {
+        int rc = 0;
         struct q_inval *qi = iommu->qi;
         struct qi_desc *hw, wait_desc;
         int wait_index, index;
         unsigned long flags;
 
         if (!qi)
-                return;
+                return 0;
 
         hw = qi->desc;
 
@@ -601,7 +641,8 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
 
         hw[index] = *desc;
 
-        wait_desc.low = QI_IWD_STATUS_DATA(2) | QI_IWD_STATUS_WRITE | QI_IWD_TYPE;
+        wait_desc.low = QI_IWD_STATUS_DATA(QI_DONE) |
+                        QI_IWD_STATUS_WRITE | QI_IWD_TYPE;
         wait_desc.high = virt_to_phys(&qi->desc_status[wait_index]);
 
         hw[wait_index] = wait_desc;
@@ -612,13 +653,11 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
         qi->free_head = (qi->free_head + 2) % QI_LENGTH;
         qi->free_cnt -= 2;
 
-        spin_lock(&iommu->register_lock);
         /*
          * update the HW tail register indicating the presence of
          * new descriptors.
          */
         writel(qi->free_head << 4, iommu->reg + DMAR_IQT_REG);
-        spin_unlock(&iommu->register_lock);
 
         while (qi->desc_status[wait_index] != QI_DONE) {
                 /*
@@ -628,15 +667,21 @@ void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu)
                  * a deadlock where the interrupt context can wait indefinitely
                  * for free slots in the queue.
                  */
+                rc = qi_check_fault(iommu, index);
+                if (rc)
+                        goto out;
+
                 spin_unlock(&qi->q_lock);
                 cpu_relax();
                 spin_lock(&qi->q_lock);
         }
-
-        qi->desc_status[index] = QI_DONE;
+out:
+        qi->desc_status[index] = qi->desc_status[wait_index] = QI_DONE;
 
         reclaim_free_desc(qi);
         spin_unlock_irqrestore(&qi->q_lock, flags);
+
+        return rc;
 }
 
 /*
@@ -649,13 +694,13 @@ void qi_global_iec(struct intel_iommu *iommu)
         desc.low = QI_IEC_TYPE;
         desc.high = 0;
 
+        /* should never fail */
         qi_submit_sync(&desc, iommu);
 }
 
 int qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, u8 fm,
                      u64 type, int non_present_entry_flush)
 {
-
         struct qi_desc desc;
 
         if (non_present_entry_flush) {
@@ -669,10 +714,7 @@ int qi_flush_context(struct intel_iommu *iommu, u16 did, u16 sid, u8 fm,
                         | QI_CC_GRAN(type) | QI_CC_TYPE;
         desc.high = 0;
 
-        qi_submit_sync(&desc, iommu);
-
-        return 0;
-
+        return qi_submit_sync(&desc, iommu);
 }
 
 int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
@@ -702,10 +744,7 @@ int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
         desc.high = QI_IOTLB_ADDR(addr) | QI_IOTLB_IH(ih)
                 | QI_IOTLB_AM(size_order);
 
-        qi_submit_sync(&desc, iommu);
-
-        return 0;
-
+        return qi_submit_sync(&desc, iommu);
 }
 
 /*
diff --git a/drivers/pci/hotplug/Kconfig b/drivers/pci/hotplug/Kconfig
index eacfb13998bb..9aa4fe100a0d 100644
--- a/drivers/pci/hotplug/Kconfig
+++ b/drivers/pci/hotplug/Kconfig
@@ -143,7 +143,7 @@ config HOTPLUG_PCI_SHPC
 
 config HOTPLUG_PCI_RPA
         tristate "RPA PCI Hotplug driver"
-        depends on PPC_PSERIES && PPC64 && !HOTPLUG_PCI_FAKE
+        depends on PPC_PSERIES && EEH && !HOTPLUG_PCI_FAKE
         help
           Say Y here if you have a RPA system that supports PCI Hotplug.
 
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index db85284ffb62..39ae37589fda 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -111,6 +111,7 @@ struct controller {
         int cmd_busy;
         unsigned int no_cmd_complete:1;
         unsigned int link_active_reporting:1;
+        unsigned int notification_enabled:1;
 };
 
 #define INT_BUTTON_IGNORE               0
@@ -170,6 +171,7 @@ extern int pciehp_configure_device(struct slot *p_slot);
 extern int pciehp_unconfigure_device(struct slot *p_slot);
 extern void pciehp_queue_pushbutton_work(struct work_struct *work);
 struct controller *pcie_init(struct pcie_device *dev);
+int pcie_init_notification(struct controller *ctrl);
 int pciehp_enable_slot(struct slot *p_slot);
 int pciehp_disable_slot(struct slot *p_slot);
 int pcie_enable_notification(struct controller *ctrl);
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index c2485542f543..681e3912b821 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -434,6 +434,13 @@ static int pciehp_probe(struct pcie_device *dev, const struct pcie_port_service_
                 goto err_out_release_ctlr;
         }
 
+        /* Enable events after we have setup the data structures */
+        rc = pcie_init_notification(ctrl);
+        if (rc) {
+                ctrl_err(ctrl, "Notification initialization failed\n");
+                goto err_out_release_ctlr;
+        }
+
         /* Check if slot is occupied */
         t_slot = pciehp_find_slot(ctrl, ctrl->slot_device_offset);
         t_slot->hpc_ops->get_adapter_status(t_slot, &value);
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 71a8012886b0..7a16c6897bb9 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -934,7 +934,7 @@ static void pcie_disable_notification(struct controller *ctrl)
                 ctrl_warn(ctrl, "Cannot disable software notification\n");
 }
 
-static int pcie_init_notification(struct controller *ctrl)
+int pcie_init_notification(struct controller *ctrl)
 {
         if (pciehp_request_irq(ctrl))
                 return -1;
@@ -942,13 +942,17 @@ static int pcie_init_notification(struct controller *ctrl)
                 pciehp_free_irq(ctrl);
                 return -1;
         }
+        ctrl->notification_enabled = 1;
         return 0;
 }
 
 static void pcie_shutdown_notification(struct controller *ctrl)
 {
-        pcie_disable_notification(ctrl);
-        pciehp_free_irq(ctrl);
+        if (ctrl->notification_enabled) {
+                pcie_disable_notification(ctrl);
+                pciehp_free_irq(ctrl);
+                ctrl->notification_enabled = 0;
+        }
 }
 
 static int pcie_init_slot(struct controller *ctrl)
@@ -1110,13 +1114,8 @@ struct controller *pcie_init(struct pcie_device *dev)
         if (pcie_init_slot(ctrl))
                 goto abort_ctrl;
 
-        if (pcie_init_notification(ctrl))
-                goto abort_slot;
-
         return ctrl;
 
-abort_slot:
-        pcie_cleanup_slot(ctrl);
 abort_ctrl:
         kfree(ctrl);
 abort:
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index f78371b22529..45effc5726c0 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -207,7 +207,7 @@ int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
         return index;
 }
 
-static void qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
+static int qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
 {
         struct qi_desc desc;
 
@@ -215,7 +215,7 @@ static void qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
                    | QI_IEC_SELECTIVE;
         desc.high = 0;
 
-        qi_submit_sync(&desc, iommu);
+        return qi_submit_sync(&desc, iommu);
 }
 
 int map_irq_to_irte_handle(int irq, u16 *sub_handle)
@@ -283,6 +283,7 @@ int clear_irte_irq(int irq, struct intel_iommu *iommu, u16 index)
 
 int modify_irte(int irq, struct irte *irte_modified)
 {
+        int rc;
         int index;
         struct irte *irte;
         struct intel_iommu *iommu;
@@ -303,14 +304,15 @@ int modify_irte(int irq, struct irte *irte_modified)
         set_64bit((unsigned long *)irte, irte_modified->low | (1 << 1));
         __iommu_flush_cache(iommu, irte, sizeof(*irte));
 
-        qi_flush_iec(iommu, index, 0);
-
+        rc = qi_flush_iec(iommu, index, 0);
         spin_unlock(&irq_2_ir_lock);
-        return 0;
+
+        return rc;
 }
 
 int flush_irte(int irq)
 {
+        int rc;
         int index;
         struct intel_iommu *iommu;
         struct irq_2_iommu *irq_iommu;
@@ -326,10 +328,10 @@ int flush_irte(int irq)
 
         index = irq_iommu->irte_index + irq_iommu->sub_handle;
 
-        qi_flush_iec(iommu, index, irq_iommu->irte_mask);
+        rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
         spin_unlock(&irq_2_ir_lock);
 
-        return 0;
+        return rc;
 }
 
 struct intel_iommu *map_ioapic_to_ir(int apic)
@@ -355,6 +357,7 @@ struct intel_iommu *map_dev_to_ir(struct pci_dev *dev)
 
 int free_irte(int irq)
 {
+        int rc = 0;
         int index, i;
         struct irte *irte;
         struct intel_iommu *iommu;
@@ -375,7 +378,7 @@ int free_irte(int irq)
         if (!irq_iommu->sub_handle) {
                 for (i = 0; i < (1 << irq_iommu->irte_mask); i++)
                         set_64bit((unsigned long *)irte, 0);
-                qi_flush_iec(iommu, index, irq_iommu->irte_mask);
+                rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
         }
 
         irq_iommu->iommu = NULL;
@@ -385,7 +388,7 @@ int free_irte(int irq)
 
         spin_unlock(&irq_2_ir_lock);
 
-        return 0;
+        return rc;
 }
 
 static void iommu_set_intr_remapping(struct intel_iommu *iommu, int mode)
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index aac7006949f1..382575007382 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -108,6 +108,37 @@ int pci_cleanup_aer_correct_error_status(struct pci_dev *dev)
 }
 #endif  /*  0  */
 
+
+static void set_device_error_reporting(struct pci_dev *dev, void *data)
+{
+        bool enable = *((bool *)data);
+
+        if (dev->pcie_type != PCIE_RC_PORT &&
+            dev->pcie_type != PCIE_SW_UPSTREAM_PORT &&
+            dev->pcie_type != PCIE_SW_DOWNSTREAM_PORT)
+                return;
+
+        if (enable)
+                pci_enable_pcie_error_reporting(dev);
+        else
+                pci_disable_pcie_error_reporting(dev);
+}
+
+/**
+ * set_downstream_devices_error_reporting - enable/disable the error reporting  bits on the root port and its downstream ports.
+ * @dev: pointer to root port's pci_dev data structure
+ * @enable: true = enable error reporting, false = disable error reporting.
+ */
+static void set_downstream_devices_error_reporting(struct pci_dev *dev,
+                                                   bool enable)
+{
+        set_device_error_reporting(dev, &enable);
+
+        if (!dev->subordinate)
+                return;
+        pci_walk_bus(dev->subordinate, set_device_error_reporting, &enable);
+}
+
 static int find_device_iter(struct device *device, void *data)
 {
         struct pci_dev *dev;
@@ -525,15 +556,11 @@ void aer_enable_rootport(struct aer_rpc *rpc)
         pci_read_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, &reg32);
         pci_write_config_dword(pdev, aer_pos + PCI_ERR_UNCOR_STATUS, reg32);
 
-        /* Enable Root Port device reporting error itself */
-        pci_read_config_word(pdev, pos+PCI_EXP_DEVCTL, &reg16);
-        reg16 = reg16 |
-                PCI_EXP_DEVCTL_CERE |
-                PCI_EXP_DEVCTL_NFERE |
-                PCI_EXP_DEVCTL_FERE |
-                PCI_EXP_DEVCTL_URRE;
-        pci_write_config_word(pdev, pos+PCI_EXP_DEVCTL,
-                reg16);
+        /*
+         * Enable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, true);
 
         /* Enable Root Port's interrupt in response to error messages */
         pci_write_config_dword(pdev,
@@ -553,6 +580,12 @@ static void disable_root_aer(struct aer_rpc *rpc)
         u32 reg32;
         int pos;
 
+        /*
+         * Disable error reporting for the root port device and downstream port
+         * devices.
+         */
+        set_downstream_devices_error_reporting(pdev, false);
+
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
         /* Disable Root's interrupt in response to error messages */
         pci_write_config_dword(pdev, pos + PCI_ERR_ROOT_COMMAND, 0);
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index f9b874eaeb9f..5ea566e20b37 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -97,14 +97,13 @@ static int __devinit pcie_portdrv_probe (struct pci_dev *dev,
 
         pcie_portdrv_save_config(dev);
 
-        pci_enable_pcie_error_reporting(dev);
-
         return 0;
 }
 
 static void pcie_portdrv_remove (struct pci_dev *dev)
 {
         pcie_port_device_remove(dev);
+        pci_disable_device(dev);
         kfree(pci_get_drvdata(dev));
 }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index baad093aafe3..92b9efe9bcaf 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -23,6 +23,7 @@
 #include <linux/acpi.h>
 #include <linux/kallsyms.h>
 #include <linux/dmi.h>
+#include <linux/pci-aspm.h>
 #include "pci.h"
 
 int isa_dma_bridge_buggy;
@@ -1584,6 +1585,7 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_SERVERWORKS,   PCI_DEVICE_ID_SERVERWORKS_
  */
 #define AMD_813X_MISC                   0x40
 #define AMD_813X_NOIOAMODE              (1<<0)
+#define AMD_813X_REV_B2                 0x13
 
 static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 {
@@ -1591,6 +1593,8 @@ static void quirk_disable_amd_813x_boot_interrupt(struct pci_dev *dev)
 
         if (noioapicquirk)
                 return;
+        if (dev->revision == AMD_813X_REV_B2)
+                return;
 
         pci_read_config_dword(dev, AMD_813X_MISC, &pci_config_dword);
         pci_config_dword &= ~AMD_813X_NOIOAMODE;
@@ -1746,6 +1750,30 @@ static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_e100_interrupt);
 
+/*
+ * The 82575 and 82598 may experience data corruption issues when transitioning
+ * out of L0S.  To prevent this we need to disable L0S on the pci-e link
+ */
+static void __devinit quirk_disable_aspm_l0s(struct pci_dev *dev)
+{
+        dev_info(&dev->dev, "Disabling L0s\n");
+        pci_disable_link_state(dev, PCIE_LINK_STATE_L0S);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a7, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10a9, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10b6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c7, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10c8, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10d6, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10db, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10dd, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10e1, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10ec, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+
 static void __devinit fixup_rev1_53c810(struct pci_dev* dev)
 {
         /* rev 1 ncr53c810 chips don't set the class at all which means
@@ -1981,7 +2009,6 @@ static void __devinit quirk_msi_ht_cap(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_HT2000_PCIE,
                         quirk_msi_ht_cap);
 
-
 /* The nVidia CK804 chipset may have 2 HT MSI mappings.
  * MSI are supported if the MSI capability set in any of these mappings.
  */
@@ -2032,6 +2059,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SERVERWORKS,
                          PCI_DEVICE_ID_SERVERWORKS_HT1000_PXB,
                          ht_enable_msi_mapping);
 
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8132_BRIDGE,
+                         ht_enable_msi_mapping);
+
 /* The P5N32-SLI Premium motherboard from Asus has a problem with msi
  * for the MCP55 NIC. It is not yet determined whether the msi problem
  * also affects other devices. As for now, turn off msi for this device.
@@ -2048,11 +2078,105 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_NVIDIA,
                         PCI_DEVICE_ID_NVIDIA_NVENET_15,
                         nvenet_msi_disable);
 
-static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+static void __devinit nv_ht_enable_msi_mapping(struct pci_dev *dev)
 {
         struct pci_dev *host_bridge;
+        int pos;
+        int i, dev_no;
+        int found = 0;
+
+        dev_no = dev->devfn >> 3;
+        for (i = dev_no; i >= 0; i--) {
+                host_bridge = pci_get_slot(dev->bus, PCI_DEVFN(i, 0));
+                if (!host_bridge)
+                        continue;
+
+                pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
+                if (pos != 0) {
+                        found = 1;
+                        break;
+                }
+                pci_dev_put(host_bridge);
+        }
+
+        if (!found)
+                return;
+
+        /* root did that ! */
+        if (msi_ht_cap_enabled(host_bridge))
+                goto out;
+
+        ht_enable_msi_mapping(dev);
+
+out:
+        pci_dev_put(host_bridge);
+}
+
+static void __devinit ht_disable_msi_mapping(struct pci_dev *dev)
+{
         int pos, ttl = 48;
 
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        dev_info(&dev->dev, "Disabling HT MSI Mapping\n");
+
+                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
+                                              flags & ~HT_MSI_FLAGS_ENABLE);
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+}
+
+static int __devinit ht_check_msi_mapping(struct pci_dev *dev)
+{
+        int pos, ttl = 48;
+        int found = 0;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
+        while (pos && ttl--) {
+                u8 flags;
+
+                if (found < 1)
+                        found = 1;
+                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
+                                         &flags) == 0) {
+                        if (flags & HT_MSI_FLAGS_ENABLE) {
+                                if (found < 2) {
+                                        found = 2;
+                                        break;
+                                }
+                        }
+                }
+                pos = pci_find_next_ht_capability(dev, pos,
+                                                  HT_CAPTYPE_MSI_MAPPING);
+        }
+
+        return found;
+}
+
+static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
+{
+        struct pci_dev *host_bridge;
+        int pos;
+        int found;
+
+        /* Enabling HT MSI mapping on this device breaks MCP51 */
+        if (dev->device == 0x270)
+                return;
+
+        /* check if there is HT MSI cap or enabled on this device */
+        found = ht_check_msi_mapping(dev);
+
+        /* no HT MSI CAP */
+        if (found == 0)
+                return;
+
         /*
          * HT MSI mapping should be disabled on devices that are below
          * a non-Hypertransport host bridge. Locate the host bridge...
@@ -2067,24 +2191,19 @@ static void __devinit nv_msi_ht_cap_quirk(struct pci_dev *dev)
         pos = pci_find_ht_capability(host_bridge, HT_CAPTYPE_SLAVE);
         if (pos != 0) {
                 /* Host bridge is to HT */
-                ht_enable_msi_mapping(dev);
+                if (found == 1) {
+                        /* it is not enabled, try to enable it */
+                        nv_ht_enable_msi_mapping(dev);
+                }
                 return;
         }
 
-        /* Host bridge is not to HT, disable HT MSI mapping on this device */
-        pos = pci_find_ht_capability(dev, HT_CAPTYPE_MSI_MAPPING);
-        while (pos && ttl--) {
-                u8 flags;
+        /* HT MSI is not enabled */
+        if (found == 1)
+                return;
 
-                if (pci_read_config_byte(dev, pos + HT_MSI_FLAGS,
-                                         &flags) == 0) {
-                        dev_info(&dev->dev, "Disabling HT MSI mapping");
-                        pci_write_config_byte(dev, pos + HT_MSI_FLAGS,
-                                              flags & ~HT_MSI_FLAGS_ENABLE);
-                }
-                pos = pci_find_next_ht_capability(dev, pos,
-                                                  HT_CAPTYPE_MSI_MAPPING);
-        }
+        /* Host bridge is not to HT, disable HT MSI mapping on this device */
+        ht_disable_msi_mapping(dev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID, nv_msi_ht_cap_quirk);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AL, PCI_ANY_ID, nv_msi_ht_cap_quirk);
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 94c9f911824e..6bcca616a704 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1297,7 +1297,7 @@ static int __init acer_wmi_init(void)
 
         set_quirks();
 
-        if (!acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
+        if (acpi_video_backlight_support() && has_cap(ACER_CAP_BRIGHTNESS)) {
                 interface->capability &= ~ACER_CAP_BRIGHTNESS;
                 printk(ACER_INFO "Brightness must be controlled by "
                        "generic video driver\n");
diff --git a/drivers/power/ds2760_battery.c b/drivers/power/ds2760_battery.c
index 1d768928e0bb..a52d4a11652d 100644
--- a/drivers/power/ds2760_battery.c
+++ b/drivers/power/ds2760_battery.c
@@ -180,10 +180,13 @@ static int ds2760_battery_read_status(struct ds2760_device_info *di)
         di->empty_uAh = battery_interpolate(scale, di->temp_C / 10);
         di->empty_uAh *= 1000; /* convert to µAh */
 
-        /* From Maxim Application Note 131: remaining capacity =
-         * ((ICA - Empty Value) / (Full Value - Empty Value)) x 100% */
-        di->rem_capacity = ((di->accum_current_uAh - di->empty_uAh) * 100L) /
-                            (di->full_active_uAh - di->empty_uAh);
+        if (di->full_active_uAh == di->empty_uAh)
+                di->rem_capacity = 0;
+        else
+                /* From Maxim Application Note 131: remaining capacity =
+                 * ((ICA - Empty Value) / (Full Value - Empty Value)) x 100% */
+                di->rem_capacity = ((di->accum_current_uAh - di->empty_uAh) * 100L) /
+                                    (di->full_active_uAh - di->empty_uAh);
 
         if (di->rem_capacity < 0)
                 di->rem_capacity = 0;
diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
index f08e169ba1b5..7e30e5f6e032 100644
--- a/drivers/sbus/char/bbc_i2c.c
+++ b/drivers/sbus/char/bbc_i2c.c
@@ -129,7 +129,7 @@ static int wait_for_pin(struct bbc_i2c_bus *bp, u8 *status)
         bp->waiting = 1;
         add_wait_queue(&bp->wq, &wait);
         while (limit-- > 0) {
-                unsigned long val;
+                long val;
 
                 val = wait_event_interruptible_timeout(
                                 bp->wq,
diff --git a/drivers/sbus/char/jsflash.c b/drivers/sbus/char/jsflash.c
index a9a9893a5f95..e6d1fc8c54f1 100644
--- a/drivers/sbus/char/jsflash.c
+++ b/drivers/sbus/char/jsflash.c
@@ -38,9 +38,6 @@
 #include <linux/string.h>
 #include <linux/genhd.h>
 #include <linux/blkdev.h>
-
-#define MAJOR_NR        JSFD_MAJOR
-
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
diff --git a/drivers/scsi/cxgb3i/cxgb3i.h b/drivers/scsi/cxgb3i/cxgb3i.h
index fde6e4c634e7..a7cf550b9cca 100644
--- a/drivers/scsi/cxgb3i/cxgb3i.h
+++ b/drivers/scsi/cxgb3i/cxgb3i.h
@@ -20,6 +20,7 @@
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/scatterlist.h>
+#include <linux/skbuff.h>
 #include <scsi/libiscsi_tcp.h>
 
 /* from cxgb3 LLD */
@@ -113,6 +114,26 @@ struct cxgb3i_endpoint {
         struct cxgb3i_conn *cconn;
 };
 
+/**
+ * struct cxgb3i_task_data - private iscsi task data
+ *
+ * @nr_frags:   # of coalesced page frags (from scsi sgl)
+ * @frags:      coalesced page frags (from scsi sgl)
+ * @skb:        tx pdu skb
+ * @offset:     data offset for the next pdu
+ * @count:      max. possible pdu payload
+ * @sgoffset:   offset to the first sg entry for a given offset
+ */
+#define MAX_PDU_FRAGS   ((ULP2_MAX_PDU_PAYLOAD + 512 - 1) / 512)
+struct cxgb3i_task_data {
+        unsigned short nr_frags;
+        skb_frag_t frags[MAX_PDU_FRAGS];
+        struct sk_buff *skb;
+        unsigned int offset;
+        unsigned int count;
+        unsigned int sgoffset;
+};
+
 int cxgb3i_iscsi_init(void);
 void cxgb3i_iscsi_cleanup(void);
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.c b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
index 08f3a09d9233..a83d36e4926f 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.c
@@ -639,10 +639,11 @@ static int ddp_init(struct t3cdev *tdev)
         write_unlock(&cxgb3i_ddp_rwlock);
 
         ddp_log_info("nppods %u (0x%x ~ 0x%x), bits %u, mask 0x%x,0x%x "
-                        "pkt %u,%u.\n",
+                        "pkt %u/%u, %u/%u.\n",
                         ppmax, ddp->llimit, ddp->ulimit, ddp->idx_bits,
                         ddp->idx_mask, ddp->rsvd_tag_mask,
-                        ddp->max_txsz, ddp->max_rxsz);
+                        ddp->max_txsz, uinfo.max_txsz,
+                        ddp->max_rxsz, uinfo.max_rxsz);
         return 0;
 
 free_ddp_map:
@@ -654,8 +655,8 @@ free_ddp_map:
  * cxgb3i_adapter_ddp_init - initialize the adapter's ddp resource
  * @tdev: t3cdev adapter
  * @tformat: tag format
- * @txsz: max tx pkt size, filled in by this func.
- * @rxsz: max rx pkt size, filled in by this func.
+ * @txsz: max tx pdu payload size, filled in by this func.
+ * @rxsz: max rx pdu payload size, filled in by this func.
  * initialize the ddp pagepod manager for a given adapter if needed and
  * setup the tag format for a given iscsi entity
  */
@@ -685,10 +686,12 @@ int cxgb3i_adapter_ddp_init(struct t3cdev *tdev,
                       tformat->sw_bits, tformat->rsvd_bits,
                       tformat->rsvd_shift, tformat->rsvd_mask);
 
-        *txsz = ddp->max_txsz;
-        *rxsz = ddp->max_rxsz;
-        ddp_log_info("ddp max pkt size: %u, %u.\n",
-                     ddp->max_txsz, ddp->max_rxsz);
+        *txsz = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
+                        ddp->max_txsz - ISCSI_PDU_NONPAYLOAD_LEN);
+        *rxsz = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
+                        ddp->max_rxsz - ISCSI_PDU_NONPAYLOAD_LEN);
+        ddp_log_info("max payload size: %u/%u, %u/%u.\n",
+                     *txsz, ddp->max_txsz, *rxsz, ddp->max_rxsz);
         return 0;
 }
 EXPORT_SYMBOL_GPL(cxgb3i_adapter_ddp_init);
diff --git a/drivers/scsi/cxgb3i/cxgb3i_ddp.h b/drivers/scsi/cxgb3i/cxgb3i_ddp.h
index 5c7c4d95c493..3faae7831c83 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_ddp.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_ddp.h
@@ -13,6 +13,8 @@
 #ifndef __CXGB3I_ULP2_DDP_H__
 #define __CXGB3I_ULP2_DDP_H__
 
+#include <linux/vmalloc.h>
+
 /**
  * struct cxgb3i_tag_format - cxgb3i ulp tag format for an iscsi entity
  *
@@ -85,8 +87,9 @@ struct cxgb3i_ddp_info {
         struct sk_buff **gl_skb;
 };
 
+#define ISCSI_PDU_NONPAYLOAD_LEN        312 /* bhs(48) + ahs(256) + digest(8) */
 #define ULP2_MAX_PKT_SIZE       16224
-#define ULP2_MAX_PDU_PAYLOAD    (ULP2_MAX_PKT_SIZE - ISCSI_PDU_NONPAYLOAD_MAX)
+#define ULP2_MAX_PDU_PAYLOAD    (ULP2_MAX_PKT_SIZE - ISCSI_PDU_NONPAYLOAD_LEN)
 #define PPOD_PAGES_MAX          4
 #define PPOD_PAGES_SHIFT        2       /* 4 pages per pod */
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_init.c b/drivers/scsi/cxgb3i/cxgb3i_init.c
index 091ecb4d9f3d..1ce9f244e46c 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_init.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_init.c
@@ -12,8 +12,8 @@
 #include "cxgb3i.h"
 
 #define DRV_MODULE_NAME         "cxgb3i"
-#define DRV_MODULE_VERSION      "1.0.0"
-#define DRV_MODULE_RELDATE      "Jun. 1, 2008"
+#define DRV_MODULE_VERSION      "1.0.1"
+#define DRV_MODULE_RELDATE      "Jan. 2009"
 
 static char version[] =
         "Chelsio S3xx iSCSI Driver " DRV_MODULE_NAME
diff --git a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
index d83464b9b3f9..fa2a44f37b36 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
@@ -364,7 +364,8 @@ cxgb3i_session_create(struct iscsi_endpoint *ep, u16 cmds_max, u16 qdepth,
 
         cls_session = iscsi_session_setup(&cxgb3i_iscsi_transport, shost,
                                           cmds_max,
-                                          sizeof(struct iscsi_tcp_task),
+                                          sizeof(struct iscsi_tcp_task) +
+                                          sizeof(struct cxgb3i_task_data),
                                           initial_cmdsn, ISCSI_MAX_TARGET);
         if (!cls_session)
                 return NULL;
@@ -402,17 +403,15 @@ static inline int cxgb3i_conn_max_xmit_dlength(struct iscsi_conn *conn)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
-        unsigned int max = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
-                                 cconn->hba->snic->tx_max_size -
-                                 ISCSI_PDU_NONPAYLOAD_MAX);
+        unsigned int max = max(512 * MAX_SKB_FRAGS, SKB_TX_HEADROOM);
 
+        max = min(cconn->hba->snic->tx_max_size, max);
         if (conn->max_xmit_dlength)
-                conn->max_xmit_dlength = min_t(unsigned int,
-                                                conn->max_xmit_dlength, max);
+                conn->max_xmit_dlength = min(conn->max_xmit_dlength, max);
         else
                 conn->max_xmit_dlength = max;
         align_pdu_size(conn->max_xmit_dlength);
-        cxgb3i_log_info("conn 0x%p, max xmit %u.\n",
+        cxgb3i_api_debug("conn 0x%p, max xmit %u.\n",
                          conn, conn->max_xmit_dlength);
         return 0;
 }
@@ -427,9 +426,7 @@ static inline int cxgb3i_conn_max_recv_dlength(struct iscsi_conn *conn)
 {
         struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
-        unsigned int max = min_t(unsigned int, ULP2_MAX_PDU_PAYLOAD,
-                                 cconn->hba->snic->rx_max_size -
-                                 ISCSI_PDU_NONPAYLOAD_MAX);
+        unsigned int max = cconn->hba->snic->rx_max_size;
 
         align_pdu_size(max);
         if (conn->max_recv_dlength) {
@@ -439,8 +436,7 @@ static inline int cxgb3i_conn_max_recv_dlength(struct iscsi_conn *conn)
                                          conn->max_recv_dlength, max);
                         return -EINVAL;
                 }
-                conn->max_recv_dlength = min_t(unsigned int,
-                                                conn->max_recv_dlength, max);
+                conn->max_recv_dlength = min(conn->max_recv_dlength, max);
                 align_pdu_size(conn->max_recv_dlength);
         } else
                 conn->max_recv_dlength = max;
@@ -844,7 +840,7 @@ static struct scsi_host_template cxgb3i_host_template = {
         .proc_name              = "cxgb3i",
         .queuecommand           = iscsi_queuecommand,
         .change_queue_depth     = iscsi_change_queue_depth,
-        .can_queue              = 128 * (ISCSI_DEF_XMIT_CMDS_MAX - 1),
+        .can_queue              = CXGB3I_SCSI_QDEPTH_DFLT - 1,
         .sg_tablesize           = SG_ALL,
         .max_sectors            = 0xFFFF,
         .cmd_per_lun            = ISCSI_DEF_CMD_PER_LUN,
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.c b/drivers/scsi/cxgb3i/cxgb3i_offload.c
index a865f1fefe8b..de3b3b614cca 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.c
@@ -23,19 +23,19 @@
 #include "cxgb3i_ddp.h"
 
 #ifdef __DEBUG_C3CN_CONN__
-#define c3cn_conn_debug         cxgb3i_log_info
+#define c3cn_conn_debug         cxgb3i_log_debug
 #else
 #define c3cn_conn_debug(fmt...)
 #endif
 
 #ifdef __DEBUG_C3CN_TX__
-#define c3cn_tx_debug         cxgb3i_log_debug
+#define c3cn_tx_debug           cxgb3i_log_debug
 #else
 #define c3cn_tx_debug(fmt...)
 #endif
 
 #ifdef __DEBUG_C3CN_RX__
-#define c3cn_rx_debug         cxgb3i_log_debug
+#define c3cn_rx_debug           cxgb3i_log_debug
 #else
 #define c3cn_rx_debug(fmt...)
 #endif
@@ -47,9 +47,9 @@ static int cxgb3_rcv_win = 256 * 1024;
 module_param(cxgb3_rcv_win, int, 0644);
 MODULE_PARM_DESC(cxgb3_rcv_win, "TCP receive window in bytes (default=256KB)");
 
-static int cxgb3_snd_win = 64 * 1024;
+static int cxgb3_snd_win = 128 * 1024;
 module_param(cxgb3_snd_win, int, 0644);
-MODULE_PARM_DESC(cxgb3_snd_win, "TCP send window in bytes (default=64KB)");
+MODULE_PARM_DESC(cxgb3_snd_win, "TCP send window in bytes (default=128KB)");
 
 static int cxgb3_rx_credit_thres = 10 * 1024;
 module_param(cxgb3_rx_credit_thres, int, 0644);
@@ -301,8 +301,8 @@ static void act_open_req_arp_failure(struct t3cdev *dev, struct sk_buff *skb)
 static void skb_entail(struct s3_conn *c3cn, struct sk_buff *skb,
                        int flags)
 {
-        CXGB3_SKB_CB(skb)->seq = c3cn->write_seq;
-        CXGB3_SKB_CB(skb)->flags = flags;
+        skb_tcp_seq(skb) = c3cn->write_seq;
+        skb_flags(skb) = flags;
         __skb_queue_tail(&c3cn->write_queue, skb);
 }
 
@@ -457,12 +457,9 @@ static unsigned int wrlen __read_mostly;
  * The number of WRs needed for an skb depends on the number of fragments
  * in the skb and whether it has any payload in its main body.  This maps the
  * length of the gather list represented by an skb into the # of necessary WRs.
- *
- * The max. length of an skb is controlled by the max pdu size which is ~16K.
- * Also, assume the min. fragment length is the sector size (512), then add
- * extra fragment counts for iscsi bhs and payload padding.
+ * The extra two fragments are for iscsi bhs and payload padding.
  */
-#define SKB_WR_LIST_SIZE        (16384/512 + 3)
+#define SKB_WR_LIST_SIZE        (MAX_SKB_FRAGS + 2)
 static unsigned int skb_wrs[SKB_WR_LIST_SIZE] __read_mostly;
 
 static void s3_init_wr_tab(unsigned int wr_len)
@@ -485,7 +482,7 @@ static void s3_init_wr_tab(unsigned int wr_len)
 
 static inline void reset_wr_list(struct s3_conn *c3cn)
 {
-        c3cn->wr_pending_head = NULL;
+        c3cn->wr_pending_head = c3cn->wr_pending_tail = NULL;
 }
 
 /*
@@ -496,7 +493,7 @@ static inline void reset_wr_list(struct s3_conn *c3cn)
 static inline void enqueue_wr(struct s3_conn *c3cn,
                               struct sk_buff *skb)
 {
-        skb_wr_data(skb) = NULL;
+        skb_tx_wr_next(skb) = NULL;
 
         /*
          * We want to take an extra reference since both us and the driver
@@ -509,10 +506,22 @@ static inline void enqueue_wr(struct s3_conn *c3cn,
         if (!c3cn->wr_pending_head)
                 c3cn->wr_pending_head = skb;
         else
-                skb_wr_data(skb) = skb;
+                skb_tx_wr_next(c3cn->wr_pending_tail) = skb;
         c3cn->wr_pending_tail = skb;
 }
 
+static int count_pending_wrs(struct s3_conn *c3cn)
+{
+        int n = 0;
+        const struct sk_buff *skb = c3cn->wr_pending_head;
+
+        while (skb) {
+                n += skb->csum;
+                skb = skb_tx_wr_next(skb);
+        }
+        return n;
+}
+
 static inline struct sk_buff *peek_wr(const struct s3_conn *c3cn)
 {
         return c3cn->wr_pending_head;
@@ -529,8 +538,8 @@ static inline struct sk_buff *dequeue_wr(struct s3_conn *c3cn)
 
         if (likely(skb)) {
                 /* Don't bother clearing the tail */
-                c3cn->wr_pending_head = skb_wr_data(skb);
-                skb_wr_data(skb) = NULL;
+                c3cn->wr_pending_head = skb_tx_wr_next(skb);
+                skb_tx_wr_next(skb) = NULL;
         }
         return skb;
 }
@@ -543,13 +552,14 @@ static void purge_wr_queue(struct s3_conn *c3cn)
 }
 
 static inline void make_tx_data_wr(struct s3_conn *c3cn, struct sk_buff *skb,
-                                   int len)
+                                   int len, int req_completion)
 {
         struct tx_data_wr *req;
 
         skb_reset_transport_header(skb);
         req = (struct tx_data_wr *)__skb_push(skb, sizeof(*req));
-        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
+        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA) |
+                        (req_completion ? F_WR_COMPL : 0));
         req->wr_lo = htonl(V_WR_TID(c3cn->tid));
         req->sndseq = htonl(c3cn->snd_nxt);
         /* len includes the length of any HW ULP additions */
@@ -592,7 +602,7 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
 
         if (unlikely(c3cn->state == C3CN_STATE_CONNECTING ||
                      c3cn->state == C3CN_STATE_CLOSE_WAIT_1 ||
-                     c3cn->state == C3CN_STATE_ABORTING)) {
+                     c3cn->state >= C3CN_STATE_ABORTING)) {
                 c3cn_tx_debug("c3cn 0x%p, in closing state %u.\n",
                               c3cn, c3cn->state);
                 return 0;
@@ -615,7 +625,7 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
                 if (c3cn->wr_avail < wrs_needed) {
                         c3cn_tx_debug("c3cn 0x%p, skb len %u/%u, frag %u, "
                                       "wr %d < %u.\n",
-                                      c3cn, skb->len, skb->datalen, frags,
+                                      c3cn, skb->len, skb->data_len, frags,
                                       wrs_needed, c3cn->wr_avail);
                         break;
                 }
@@ -627,20 +637,24 @@ static int c3cn_push_tx_frames(struct s3_conn *c3cn, int req_completion)
                 c3cn->wr_unacked += wrs_needed;
                 enqueue_wr(c3cn, skb);
 
-                if (likely(CXGB3_SKB_CB(skb)->flags & C3CB_FLAG_NEED_HDR)) {
-                        len += ulp_extra_len(skb);
-                        make_tx_data_wr(c3cn, skb, len);
-                        c3cn->snd_nxt += len;
-                        if ((req_completion
-                             && c3cn->wr_unacked == wrs_needed)
-                            || (CXGB3_SKB_CB(skb)->flags & C3CB_FLAG_COMPL)
-                            || c3cn->wr_unacked >= c3cn->wr_max / 2) {
-                                struct work_request_hdr *wr = cplhdr(skb);
+                c3cn_tx_debug("c3cn 0x%p, enqueue, skb len %u/%u, frag %u, "
+                                "wr %d, left %u, unack %u.\n",
+                                c3cn, skb->len, skb->data_len, frags,
+                                wrs_needed, c3cn->wr_avail, c3cn->wr_unacked);
+
 
-                                wr->wr_hi |= htonl(F_WR_COMPL);
+                if (likely(skb_flags(skb) & C3CB_FLAG_NEED_HDR)) {
+                        if ((req_completion &&
+                                c3cn->wr_unacked == wrs_needed) ||
+                            (skb_flags(skb) & C3CB_FLAG_COMPL) ||
+                            c3cn->wr_unacked >= c3cn->wr_max / 2) {
+                                req_completion = 1;
                                 c3cn->wr_unacked = 0;
                         }
-                        CXGB3_SKB_CB(skb)->flags &= ~C3CB_FLAG_NEED_HDR;
+                        len += ulp_extra_len(skb);
+                        make_tx_data_wr(c3cn, skb, len, req_completion);
+                        c3cn->snd_nxt += len;
+                        skb_flags(skb) &= ~C3CB_FLAG_NEED_HDR;
                 }
 
                 total_size += skb->truesize;
@@ -735,8 +749,11 @@ static void process_act_establish(struct s3_conn *c3cn, struct sk_buff *skb)
         if (unlikely(c3cn_flag(c3cn, C3CN_ACTIVE_CLOSE_NEEDED)))
                 /* upper layer has requested closing */
                 send_abort_req(c3cn);
-        else if (c3cn_push_tx_frames(c3cn, 1))
+        else {
+                if (skb_queue_len(&c3cn->write_queue))
+                        c3cn_push_tx_frames(c3cn, 1);
                 cxgb3i_conn_tx_open(c3cn);
+        }
 }
 
 static int do_act_establish(struct t3cdev *cdev, struct sk_buff *skb,
@@ -1082,8 +1099,8 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
                 return;
         }
 
-        CXGB3_SKB_CB(skb)->seq = ntohl(hdr_cpl->seq);
-        CXGB3_SKB_CB(skb)->flags = 0;
+        skb_tcp_seq(skb) = ntohl(hdr_cpl->seq);
+        skb_flags(skb) = 0;
 
         skb_reset_transport_header(skb);
         __skb_pull(skb, sizeof(struct cpl_iscsi_hdr));
@@ -1103,12 +1120,12 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
                 goto abort_conn;
 
         skb_ulp_mode(skb) = ULP2_FLAG_DATA_READY;
-        skb_ulp_pdulen(skb) = ntohs(ddp_cpl.len);
-        skb_ulp_ddigest(skb) = ntohl(ddp_cpl.ulp_crc);
+        skb_rx_pdulen(skb) = ntohs(ddp_cpl.len);
+        skb_rx_ddigest(skb) = ntohl(ddp_cpl.ulp_crc);
         status = ntohl(ddp_cpl.ddp_status);
 
         c3cn_rx_debug("rx skb 0x%p, len %u, pdulen %u, ddp status 0x%x.\n",
-                      skb, skb->len, skb_ulp_pdulen(skb), status);
+                      skb, skb->len, skb_rx_pdulen(skb), status);
 
         if (status & (1 << RX_DDP_STATUS_HCRC_SHIFT))
                 skb_ulp_mode(skb) |= ULP2_FLAG_HCRC_ERROR;
@@ -1126,7 +1143,7 @@ static void process_rx_iscsi_hdr(struct s3_conn *c3cn, struct sk_buff *skb)
         } else if (status & (1 << RX_DDP_STATUS_DDP_SHIFT))
                 skb_ulp_mode(skb) |= ULP2_FLAG_DATA_DDPED;
 
-        c3cn->rcv_nxt = ntohl(ddp_cpl.seq) + skb_ulp_pdulen(skb);
+        c3cn->rcv_nxt = ntohl(ddp_cpl.seq) + skb_rx_pdulen(skb);
         __pskb_trim(skb, len);
         __skb_queue_tail(&c3cn->receive_queue, skb);
         cxgb3i_conn_pdu_ready(c3cn);
@@ -1151,12 +1168,27 @@ static int do_iscsi_hdr(struct t3cdev *t3dev, struct sk_buff *skb, void *ctx)
  * Process an acknowledgment of WR completion.  Advance snd_una and send the
  * next batch of work requests from the write queue.
  */
+static void check_wr_invariants(struct s3_conn *c3cn)
+{
+        int pending = count_pending_wrs(c3cn);
+
+        if (unlikely(c3cn->wr_avail + pending != c3cn->wr_max))
+                cxgb3i_log_error("TID %u: credit imbalance: avail %u, "
+                                "pending %u, total should be %u\n",
+                                c3cn->tid, c3cn->wr_avail, pending,
+                                c3cn->wr_max);
+}
+
 static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
 {
         struct cpl_wr_ack *hdr = cplhdr(skb);
         unsigned int credits = ntohs(hdr->credits);
         u32 snd_una = ntohl(hdr->snd_una);
 
+        c3cn_tx_debug("%u WR credits, avail %u, unack %u, TID %u, state %u.\n",
+                        credits, c3cn->wr_avail, c3cn->wr_unacked,
+                        c3cn->tid, c3cn->state);
+
         c3cn->wr_avail += credits;
         if (c3cn->wr_unacked > c3cn->wr_max - c3cn->wr_avail)
                 c3cn->wr_unacked = c3cn->wr_max - c3cn->wr_avail;
@@ -1171,6 +1203,17 @@ static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
                         break;
                 }
                 if (unlikely(credits < p->csum)) {
+                        struct tx_data_wr *w = cplhdr(p);
+                        cxgb3i_log_error("TID %u got %u WR credits need %u, "
+                                         "len %u, main body %u, frags %u, "
+                                         "seq # %u, ACK una %u, ACK nxt %u, "
+                                         "WR_AVAIL %u, WRs pending %u\n",
+                                         c3cn->tid, credits, p->csum, p->len,
+                                         p->len - p->data_len,
+                                         skb_shinfo(p)->nr_frags,
+                                         ntohl(w->sndseq), snd_una,
+                                         ntohl(hdr->snd_nxt), c3cn->wr_avail,
+                                         count_pending_wrs(c3cn) - credits);
                         p->csum -= credits;
                         break;
                 } else {
@@ -1180,15 +1223,24 @@ static void process_wr_ack(struct s3_conn *c3cn, struct sk_buff *skb)
                 }
         }
 
-        if (unlikely(before(snd_una, c3cn->snd_una)))
+        check_wr_invariants(c3cn);
+
+        if (unlikely(before(snd_una, c3cn->snd_una))) {
+                cxgb3i_log_error("TID %u, unexpected sequence # %u in WR_ACK "
+                                 "snd_una %u\n",
+                                 c3cn->tid, snd_una, c3cn->snd_una);
                 goto out_free;
+        }
 
         if (c3cn->snd_una != snd_una) {
                 c3cn->snd_una = snd_una;
                 dst_confirm(c3cn->dst_cache);
         }
 
-        if (skb_queue_len(&c3cn->write_queue) && c3cn_push_tx_frames(c3cn, 0))
+        if (skb_queue_len(&c3cn->write_queue)) {
+                if (c3cn_push_tx_frames(c3cn, 0))
+                        cxgb3i_conn_tx_open(c3cn);
+        } else
                 cxgb3i_conn_tx_open(c3cn);
 out_free:
         __kfree_skb(skb);
@@ -1452,7 +1504,7 @@ static void init_offload_conn(struct s3_conn *c3cn,
                               struct dst_entry *dst)
 {
         BUG_ON(c3cn->cdev != cdev);
-        c3cn->wr_max = c3cn->wr_avail = T3C_DATA(cdev)->max_wrs;
+        c3cn->wr_max = c3cn->wr_avail = T3C_DATA(cdev)->max_wrs - 1;
         c3cn->wr_unacked = 0;
         c3cn->mss_idx = select_mss(c3cn, dst_mtu(dst));
 
@@ -1671,9 +1723,17 @@ int cxgb3i_c3cn_send_pdus(struct s3_conn *c3cn, struct sk_buff *skb)
                 goto out_err;
         }
 
-        err = -EPIPE;
         if (c3cn->err) {
                 c3cn_tx_debug("c3cn 0x%p, err %d.\n", c3cn, c3cn->err);
+                err = -EPIPE;
+                goto out_err;
+        }
+
+        if (c3cn->write_seq - c3cn->snd_una >= cxgb3_snd_win) {
+                c3cn_tx_debug("c3cn 0x%p, snd %u - %u > %u.\n",
+                                c3cn, c3cn->write_seq, c3cn->snd_una,
+                                cxgb3_snd_win);
+                err = -EAGAIN;
                 goto out_err;
         }
 
diff --git a/drivers/scsi/cxgb3i/cxgb3i_offload.h b/drivers/scsi/cxgb3i/cxgb3i_offload.h
index d23156907ffd..6344b9eb2589 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_offload.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_offload.h
@@ -178,25 +178,33 @@ void cxgb3i_c3cn_release(struct s3_conn *);
  * @flag:       see C3CB_FLAG_* below
  * @ulp_mode:   ULP mode/submode of sk_buff
  * @seq:        tcp sequence number
- * @ddigest:    pdu data digest
- * @pdulen:     recovered pdu length
- * @wr_data:    scratch area for tx wr
  */
+struct cxgb3_skb_rx_cb {
+        __u32 ddigest;                  /* data digest */
+        __u32 pdulen;                   /* recovered pdu length */
+};
+
+struct cxgb3_skb_tx_cb {
+        struct sk_buff *wr_next;        /* next wr */
+};
+
 struct cxgb3_skb_cb {
         __u8 flags;
         __u8 ulp_mode;
         __u32 seq;
-        __u32 ddigest;
-        __u32 pdulen;
-        struct sk_buff *wr_data;
+        union {
+                struct cxgb3_skb_rx_cb rx;
+                struct cxgb3_skb_tx_cb tx;
+        };
 };
 
 #define CXGB3_SKB_CB(skb)       ((struct cxgb3_skb_cb *)&((skb)->cb[0]))
-
+#define skb_flags(skb)          (CXGB3_SKB_CB(skb)->flags)
 #define skb_ulp_mode(skb)       (CXGB3_SKB_CB(skb)->ulp_mode)
-#define skb_ulp_ddigest(skb)    (CXGB3_SKB_CB(skb)->ddigest)
-#define skb_ulp_pdulen(skb)     (CXGB3_SKB_CB(skb)->pdulen)
-#define skb_wr_data(skb)        (CXGB3_SKB_CB(skb)->wr_data)
+#define skb_tcp_seq(skb)        (CXGB3_SKB_CB(skb)->seq)
+#define skb_rx_ddigest(skb)     (CXGB3_SKB_CB(skb)->rx.ddigest)
+#define skb_rx_pdulen(skb)      (CXGB3_SKB_CB(skb)->rx.pdulen)
+#define skb_tx_wr_next(skb)     (CXGB3_SKB_CB(skb)->tx.wr_next)
 
 enum c3cb_flags {
         C3CB_FLAG_NEED_HDR = 1 << 0,    /* packet needs a TX_DATA_WR header */
@@ -217,6 +225,7 @@ struct sge_opaque_hdr {
 /* for TX: a skb must have a headroom of at least TX_HEADER_LEN bytes */
 #define TX_HEADER_LEN \
                 (sizeof(struct tx_data_wr) + sizeof(struct sge_opaque_hdr))
+#define SKB_TX_HEADROOM         SKB_MAX_HEAD(TX_HEADER_LEN)
 
 /*
  * get and set private ip for iscsi traffic
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.c b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
index ce7ce8c6094c..17115c230d65 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.c
@@ -32,6 +32,10 @@
 #define cxgb3i_tx_debug(fmt...)
 #endif
 
+/* always allocate rooms for AHS */
+#define SKB_TX_PDU_HEADER_LEN   \
+        (sizeof(struct iscsi_hdr) + ISCSI_MAX_AHS_SIZE)
+static unsigned int skb_extra_headroom;
 static struct page *pad_page;
 
 /*
@@ -146,12 +150,13 @@ static inline void tx_skb_setmode(struct sk_buff *skb, int hcrc, int dcrc)
 
 void cxgb3i_conn_cleanup_task(struct iscsi_task *task)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = task->dd_data +
+                                        sizeof(struct iscsi_tcp_task);
 
         /* never reached the xmit task callout */
-        if (tcp_task->dd_data)
-                kfree_skb(tcp_task->dd_data);
-        tcp_task->dd_data = NULL;
+        if (tdata->skb)
+                __kfree_skb(tdata->skb);
+        memset(tdata, 0, sizeof(struct cxgb3i_task_data));
 
         /* MNC - Do we need a check in case this is called but
          * cxgb3i_conn_alloc_pdu has never been called on the task */
@@ -159,28 +164,102 @@ void cxgb3i_conn_cleanup_task(struct iscsi_task *task)
         iscsi_tcp_cleanup_task(task);
 }
 
-/*
- * We do not support ahs yet
- */
+static int sgl_seek_offset(struct scatterlist *sgl, unsigned int sgcnt,
+                                unsigned int offset, unsigned int *off,
+                                struct scatterlist **sgp)
+{
+        int i;
+        struct scatterlist *sg;
+
+        for_each_sg(sgl, sg, sgcnt, i) {
+                if (offset < sg->length) {
+                        *off = offset;
+                        *sgp = sg;
+                        return 0;
+                }
+                offset -= sg->length;
+        }
+        return -EFAULT;
+}
+
+static int sgl_read_to_frags(struct scatterlist *sg, unsigned int sgoffset,
+                                unsigned int dlen, skb_frag_t *frags,
+                                int frag_max)
+{
+        unsigned int datalen = dlen;
+        unsigned int sglen = sg->length - sgoffset;
+        struct page *page = sg_page(sg);
+        int i;
+
+        i = 0;
+        do {
+                unsigned int copy;
+
+                if (!sglen) {
+                        sg = sg_next(sg);
+                        if (!sg) {
+                                cxgb3i_log_error("%s, sg NULL, len %u/%u.\n",
+                                                 __func__, datalen, dlen);
+                                return -EINVAL;
+                        }
+                        sgoffset = 0;
+                        sglen = sg->length;
+                        page = sg_page(sg);
+
+                }
+                copy = min(datalen, sglen);
+                if (i && page == frags[i - 1].page &&
+                    sgoffset + sg->offset ==
+                        frags[i - 1].page_offset + frags[i - 1].size) {
+                        frags[i - 1].size += copy;
+                } else {
+                        if (i >= frag_max) {
+                                cxgb3i_log_error("%s, too many pages %u, "
+                                                 "dlen %u.\n", __func__,
+                                                 frag_max, dlen);
+                                return -EINVAL;
+                        }
+
+                        frags[i].page = page;
+                        frags[i].page_offset = sg->offset + sgoffset;
+                        frags[i].size = copy;
+                        i++;
+                }
+                datalen -= copy;
+                sgoffset += copy;
+                sglen -= copy;
+        } while (datalen);
+
+        return i;
+}
+
 int cxgb3i_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
 {
+        struct iscsi_conn *conn = task->conn;
         struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb;
+        struct cxgb3i_task_data *tdata = task->dd_data + sizeof(*tcp_task);
+        struct scsi_cmnd *sc = task->sc;
+        int headroom = SKB_TX_PDU_HEADER_LEN;
 
+        tcp_task->dd_data = tdata;
         task->hdr = NULL;
-        /* always allocate rooms for AHS */
-        skb = alloc_skb(sizeof(struct iscsi_hdr) + ISCSI_MAX_AHS_SIZE +
-                        TX_HEADER_LEN,  GFP_ATOMIC);
-        if (!skb)
+
+        /* write command, need to send data pdus */
+        if (skb_extra_headroom && (opcode == ISCSI_OP_SCSI_DATA_OUT ||
+            (opcode == ISCSI_OP_SCSI_CMD &&
+            (scsi_bidi_cmnd(sc) || sc->sc_data_direction == DMA_TO_DEVICE))))
+                headroom += min(skb_extra_headroom, conn->max_xmit_dlength);
+
+        tdata->skb = alloc_skb(TX_HEADER_LEN + headroom, GFP_ATOMIC);
+        if (!tdata->skb)
                 return -ENOMEM;
+        skb_reserve(tdata->skb, TX_HEADER_LEN);
 
         cxgb3i_tx_debug("task 0x%p, opcode 0x%x, skb 0x%p.\n",
-                        task, opcode, skb);
+                        task, opcode, tdata->skb);
 
-        tcp_task->dd_data = skb;
-        skb_reserve(skb, TX_HEADER_LEN);
-        task->hdr = (struct iscsi_hdr *)skb->data;
-        task->hdr_max = sizeof(struct iscsi_hdr);
+        task->hdr = (struct iscsi_hdr *)tdata->skb->data;
+        task->hdr_max = SKB_TX_PDU_HEADER_LEN;
 
         /* data_out uses scsi_cmd's itt */
         if (opcode != ISCSI_OP_SCSI_DATA_OUT)
@@ -192,13 +271,13 @@ int cxgb3i_conn_alloc_pdu(struct iscsi_task *task, u8 opcode)
 int cxgb3i_conn_init_pdu(struct iscsi_task *task, unsigned int offset,
                               unsigned int count)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb = tcp_task->dd_data;
         struct iscsi_conn *conn = task->conn;
-        struct page *pg;
+        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = tcp_task->dd_data;
+        struct sk_buff *skb = tdata->skb;
         unsigned int datalen = count;
         int i, padlen = iscsi_padding(count);
-        skb_frag_t *frag;
+        struct page *pg;
 
         cxgb3i_tx_debug("task 0x%p,0x%p, offset %u, count %u, skb 0x%p.\n",
                         task, task->sc, offset, count, skb);
@@ -209,90 +288,94 @@ int cxgb3i_conn_init_pdu(struct iscsi_task *task, unsigned int offset,
                 return 0;
 
         if (task->sc) {
-                struct scatterlist *sg;
-                struct scsi_data_buffer *sdb;
-                unsigned int sgoffset = offset;
-                struct page *sgpg;
-                unsigned int sglen;
-
-                sdb = scsi_out(task->sc);
-                sg = sdb->table.sgl;
-
-                for_each_sg(sdb->table.sgl, sg, sdb->table.nents, i) {
-                        cxgb3i_tx_debug("sg %d, page 0x%p, len %u offset %u\n",
-                                        i, sg_page(sg), sg->length, sg->offset);
-
-                        if (sgoffset < sg->length)
-                                break;
-                        sgoffset -= sg->length;
+                struct scsi_data_buffer *sdb = scsi_out(task->sc);
+                struct scatterlist *sg = NULL;
+                int err;
+
+                tdata->offset = offset;
+                tdata->count = count;
+                err = sgl_seek_offset(sdb->table.sgl, sdb->table.nents,
+                                        tdata->offset, &tdata->sgoffset, &sg);
+                if (err < 0) {
+                        cxgb3i_log_warn("tpdu, sgl %u, bad offset %u/%u.\n",
+                                        sdb->table.nents, tdata->offset,
+                                        sdb->length);
+                        return err;
                 }
-                sgpg = sg_page(sg);
-                sglen = sg->length - sgoffset;
-
-                do {
-                        int j = skb_shinfo(skb)->nr_frags;
-                        unsigned int copy;
-
-                        if (!sglen) {
-                                sg = sg_next(sg);
-                                sgpg = sg_page(sg);
-                                sgoffset = 0;
-                                sglen = sg->length;
-                                ++i;
+                err = sgl_read_to_frags(sg, tdata->sgoffset, tdata->count,
+                                        tdata->frags, MAX_PDU_FRAGS);
+                if (err < 0) {
+                        cxgb3i_log_warn("tpdu, sgl %u, bad offset %u + %u.\n",
+                                        sdb->table.nents, tdata->offset,
+                                        tdata->count);
+                        return err;
+                }
+                tdata->nr_frags = err;
+
+                if (tdata->nr_frags > MAX_SKB_FRAGS ||
+                    (padlen && tdata->nr_frags == MAX_SKB_FRAGS)) {
+                        char *dst = skb->data + task->hdr_len;
+                        skb_frag_t *frag = tdata->frags;
+
+                        /* data fits in the skb's headroom */
+                        for (i = 0; i < tdata->nr_frags; i++, frag++) {
+                                char *src = kmap_atomic(frag->page,
+                                                        KM_SOFTIRQ0);
+
+                                memcpy(dst, src+frag->page_offset, frag->size);
+                                dst += frag->size;
+                                kunmap_atomic(src, KM_SOFTIRQ0);
                         }
-                        copy = min(sglen, datalen);
-                        if (j && skb_can_coalesce(skb, j, sgpg,
-                                                  sg->offset + sgoffset)) {
-                                skb_shinfo(skb)->frags[j - 1].size += copy;
-                        } else {
-                                get_page(sgpg);
-                                skb_fill_page_desc(skb, j, sgpg,
-                                                   sg->offset + sgoffset, copy);
+                        if (padlen) {
+                                memset(dst, 0, padlen);
+                                padlen = 0;
                         }
-                        sgoffset += copy;
-                        sglen -= copy;
-                        datalen -= copy;
-                } while (datalen);
+                        skb_put(skb, count + padlen);
+                } else {
+                        /* data fit into frag_list */
+                        for (i = 0; i < tdata->nr_frags; i++)
+                                get_page(tdata->frags[i].page);
+
+                        memcpy(skb_shinfo(skb)->frags, tdata->frags,
+                                sizeof(skb_frag_t) * tdata->nr_frags);
+                        skb_shinfo(skb)->nr_frags = tdata->nr_frags;
+                        skb->len += count;
+                        skb->data_len += count;
+                        skb->truesize += count;
+                }
+
         } else {
                 pg = virt_to_page(task->data);
 
-                while (datalen) {
-                        i = skb_shinfo(skb)->nr_frags;
-                        frag = &skb_shinfo(skb)->frags[i];
-
-                        get_page(pg);
-                        frag->page = pg;
-                        frag->page_offset = 0;
-                        frag->size = min((unsigned int)PAGE_SIZE, datalen);
-
-                        skb_shinfo(skb)->nr_frags++;
-                        datalen -= frag->size;
-                        pg++;
-                }
+                get_page(pg);
+                skb_fill_page_desc(skb, 0, pg, offset_in_page(task->data),
+                                        count);
+                skb->len += count;
+                skb->data_len += count;
+                skb->truesize += count;
         }
 
         if (padlen) {
                 i = skb_shinfo(skb)->nr_frags;
-                frag = &skb_shinfo(skb)->frags[i];
-                frag->page = pad_page;
-                frag->page_offset = 0;
-                frag->size = padlen;
-                skb_shinfo(skb)->nr_frags++;
+                get_page(pad_page);
+                skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags, pad_page, 0,
+                                 padlen);
+
+                skb->data_len += padlen;
+                skb->truesize += padlen;
+                skb->len += padlen;
         }
 
-        datalen = count + padlen;
-        skb->data_len += datalen;
-        skb->truesize += datalen;
-        skb->len += datalen;
         return 0;
 }
 
 int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
 {
-        struct iscsi_tcp_task *tcp_task = task->dd_data;
-        struct sk_buff *skb = tcp_task->dd_data;
         struct iscsi_tcp_conn *tcp_conn = task->conn->dd_data;
         struct cxgb3i_conn *cconn = tcp_conn->dd_data;
+        struct iscsi_tcp_task *tcp_task = task->dd_data;
+        struct cxgb3i_task_data *tdata = tcp_task->dd_data;
+        struct sk_buff *skb = tdata->skb;
         unsigned int datalen;
         int err;
 
@@ -300,13 +383,14 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
                 return 0;
 
         datalen = skb->data_len;
-        tcp_task->dd_data = NULL;
+        tdata->skb = NULL;
         err = cxgb3i_c3cn_send_pdus(cconn->cep->c3cn, skb);
-        cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
-                        task, skb, skb->len, skb->data_len, err);
         if (err > 0) {
                 int pdulen = err;
 
+        cxgb3i_tx_debug("task 0x%p, skb 0x%p, len %u/%u, rv %d.\n",
+                        task, skb, skb->len, skb->data_len, err);
+
                 if (task->conn->hdrdgst_en)
                         pdulen += ISCSI_DIGEST_SIZE;
                 if (datalen && task->conn->datadgst_en)
@@ -325,12 +409,14 @@ int cxgb3i_conn_xmit_pdu(struct iscsi_task *task)
                 return err;
         }
         /* reset skb to send when we are called again */
-        tcp_task->dd_data = skb;
+        tdata->skb = skb;
         return -EAGAIN;
 }
 
 int cxgb3i_pdu_init(void)
 {
+        if (SKB_TX_HEADROOM > (512 * MAX_SKB_FRAGS))
+                skb_extra_headroom = SKB_TX_HEADROOM;
         pad_page = alloc_page(GFP_KERNEL);
         if (!pad_page)
                 return -ENOMEM;
@@ -366,7 +452,9 @@ void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn)
         skb = skb_peek(&c3cn->receive_queue);
         while (!err && skb) {
                 __skb_unlink(skb, &c3cn->receive_queue);
-                read += skb_ulp_pdulen(skb);
+                read += skb_rx_pdulen(skb);
+                cxgb3i_rx_debug("conn 0x%p, cn 0x%p, rx skb 0x%p, pdulen %u.\n",
+                                conn, c3cn, skb, skb_rx_pdulen(skb));
                 err = cxgb3i_conn_read_pdu_skb(conn, skb);
                 __kfree_skb(skb);
                 skb = skb_peek(&c3cn->receive_queue);
@@ -377,6 +465,11 @@ void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn)
                 cxgb3i_c3cn_rx_credits(c3cn, read);
         }
         conn->rxdata_octets += read;
+
+        if (err) {
+                cxgb3i_log_info("conn 0x%p rx failed err %d.\n", conn, err);
+                iscsi_conn_failure(conn, ISCSI_ERR_CONN_FAILED);
+        }
 }
 
 void cxgb3i_conn_tx_open(struct s3_conn *c3cn)
diff --git a/drivers/scsi/cxgb3i/cxgb3i_pdu.h b/drivers/scsi/cxgb3i/cxgb3i_pdu.h
index a3f685cc2362..0770b23d90da 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_pdu.h
+++ b/drivers/scsi/cxgb3i/cxgb3i_pdu.h
@@ -53,7 +53,7 @@ struct cpl_rx_data_ddp_norss {
 #define ULP2_FLAG_DCRC_ERROR            0x20
 #define ULP2_FLAG_PAD_ERROR             0x40
 
-void cxgb3i_conn_closing(struct s3_conn *);
+void cxgb3i_conn_closing(struct s3_conn *c3cn);
 void cxgb3i_conn_pdu_ready(struct s3_conn *c3cn);
 void cxgb3i_conn_tx_open(struct s3_conn *c3cn);
 #endif
diff --git a/drivers/scsi/hptiop.c b/drivers/scsi/hptiop.c
index a48e4990fe12..34be88d7afa5 100644
--- a/drivers/scsi/hptiop.c
+++ b/drivers/scsi/hptiop.c
@@ -1251,6 +1251,7 @@ static struct pci_device_id hptiop_id_table[] = {
         { PCI_VDEVICE(TTI, 0x3530), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x3560), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4322), (kernel_ulong_t)&hptiop_itl_ops },
+        { PCI_VDEVICE(TTI, 0x4321), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4210), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4211), (kernel_ulong_t)&hptiop_itl_ops },
         { PCI_VDEVICE(TTI, 0x4310), (kernel_ulong_t)&hptiop_itl_ops },
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 940dc32ff0dc..b82ffd90632e 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1040,12 +1040,11 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                                 action = ACTION_FAIL;
                         break;
                 case ABORTED_COMMAND:
+                        action = ACTION_FAIL;
                         if (sshdr.asc == 0x10) { /* DIF */
                                 description = "Target Data Integrity Failure";
-                                action = ACTION_FAIL;
                                 error = -EILSEQ;
-                        } else
-                                action = ACTION_RETRY;
+                        }
                         break;
                 case NOT_READY:
                         /* If the device is in the process of becoming
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index d57566b8be0a..55310dbc10a6 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -107,6 +107,7 @@ static void scsi_disk_release(struct device *cdev);
 static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
 static void sd_print_result(struct scsi_disk *, int);
 
+static DEFINE_SPINLOCK(sd_index_lock);
 static DEFINE_IDA(sd_index_ida);
 
 /* This semaphore is used to mediate the 0->1 reference get in the
@@ -1914,7 +1915,9 @@ static int sd_probe(struct device *dev)
                 if (!ida_pre_get(&sd_index_ida, GFP_KERNEL))
                         goto out_put;
 
+                spin_lock(&sd_index_lock);
                 error = ida_get_new(&sd_index_ida, &index);
+                spin_unlock(&sd_index_lock);
         } while (error == -EAGAIN);
 
         if (error)
@@ -1936,7 +1939,9 @@ static int sd_probe(struct device *dev)
         return 0;
 
  out_free_index:
+        spin_lock(&sd_index_lock);
         ida_remove(&sd_index_ida, index);
+        spin_unlock(&sd_index_lock);
  out_put:
         put_disk(gd);
  out_free:
@@ -1986,7 +1991,9 @@ static void scsi_disk_release(struct device *dev)
         struct scsi_disk *sdkp = to_scsi_disk(dev);
         struct gendisk *disk = sdkp->disk;
         
+        spin_lock(&sd_index_lock);
         ida_remove(&sd_index_ida, sdkp->index);
+        spin_unlock(&sd_index_lock);
 
         disk->private_data = NULL;
         put_disk(disk);
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index 3599828b9766..022e89ffec1d 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -133,7 +133,7 @@
 # define SCSPTR3        0xffed0024      /* 16 bit SCIF */
 # define SCSPTR4        0xffee0024      /* 16 bit SCIF */
 # define SCSPTR5        0xffef0024      /* 16 bit SCIF */
-# define SCIF_OPER      0x0001          /* Overrun error bit */
+# define SCIF_ORER      0x0001          /* Overrun error bit */
 # define SCSCR_INIT(port)       0x3a    /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 #elif defined(CONFIG_CPU_SUBTYPE_SH7201) || \
       defined(CONFIG_CPU_SUBTYPE_SH7203) || \
diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
index ab69c1bf36a8..c2747bc88c6f 100644
--- a/drivers/staging/panel/panel.c
+++ b/drivers/staging/panel/panel.c
@@ -2164,19 +2164,20 @@ static void __exit panel_cleanup_module(void)
         if (scan_timer.function != NULL)
                 del_timer(&scan_timer);
 
-        if (keypad_enabled)
-                misc_deregister(&keypad_dev);
+        if (pprt != NULL) {
+                if (keypad_enabled)
+                        misc_deregister(&keypad_dev);
+
+                if (lcd_enabled) {
+                        panel_lcd_print("\x0cLCD driver " PANEL_VERSION
+                                        "\nunloaded.\x1b[Lc\x1b[Lb\x1b[L-");
+                        misc_deregister(&lcd_dev);
+                }
 
-        if (lcd_enabled) {
-                panel_lcd_print("\x0cLCD driver " PANEL_VERSION
-                                "\nunloaded.\x1b[Lc\x1b[Lb\x1b[L-");
-                misc_deregister(&lcd_dev);
+                /* TODO: free all input signals */
+                parport_release(pprt);
+                parport_unregister_device(pprt);
         }
-
-        /* TODO: free all input signals */
-
-        parport_release(pprt);
-        parport_unregister_device(pprt);
         parport_unregister_driver(&panel_driver);
 }
 
diff --git a/drivers/staging/rtl8187se/Kconfig b/drivers/staging/rtl8187se/Kconfig
index 79c225acd1ad..f636296b54bc 100644
--- a/drivers/staging/rtl8187se/Kconfig
+++ b/drivers/staging/rtl8187se/Kconfig
@@ -1,5 +1,6 @@
 config RTL8187SE
         tristate "RealTek RTL8187SE Wireless LAN NIC driver"
         depends on PCI
+        depends on WIRELESS_EXT && COMPAT_NET_DEV_OPS
         default N
         ---help---
diff --git a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
index af64cfbe16db..7370296225e1 100644
--- a/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
+++ b/drivers/staging/rtl8187se/ieee80211/ieee80211_crypt.c
@@ -234,20 +234,21 @@ out:
 void ieee80211_crypto_deinit(void)
 {
         struct list_head *ptr, *n;
+        struct ieee80211_crypto_alg *alg = NULL;
 
         if (hcrypt == NULL)
                 return;
 
-        for (ptr = hcrypt->algs.next, n = ptr->next; ptr != &hcrypt->algs;
-             ptr = n, n = ptr->next) {
-                struct ieee80211_crypto_alg *alg =
-                        (struct ieee80211_crypto_alg *) ptr;
-                list_del(ptr);
-                printk(KERN_DEBUG "ieee80211_crypt: unregistered algorithm "
-                       "'%s' (deinit)\n", alg->ops->name);
-                kfree(alg);
+        list_for_each_safe(ptr, n, &hcrypt->algs) {
+                alg = list_entry(ptr, struct ieee80211_crypto_alg, list);
+                if (alg) {
+                        list_del(ptr);
+                        printk(KERN_DEBUG
+                               "ieee80211_crypt: unregistered algorithm '%s' (deinit)\n",
+                               alg->ops->name);
+                        kfree(alg);
+                }
         }
-
         kfree(hcrypt);
 }
 
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 94534955e38b..66de5cc8ddf1 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -6161,10 +6161,10 @@ static void __exit rtl8180_pci_module_exit(void)
 {
         pci_unregister_driver (&rtl8180_pci_driver);
         rtl8180_proc_module_remove();
-        ieee80211_crypto_deinit();
         ieee80211_crypto_tkip_exit();
         ieee80211_crypto_ccmp_exit();
         ieee80211_crypto_wep_exit();
+        ieee80211_crypto_deinit();
         DMESG("Exiting");
 }
 
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index b003f9a7e151..f716b2e92b65 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -319,16 +319,18 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         struct usb_device *udev = interface_to_usbdev(intf);
         struct wbsoft_priv *priv;
         struct ieee80211_hw *dev;
-        int err;
+        int nr, err;
 
         usb_get_dev(udev);
 
         // 20060630.2 Check the device if it already be opened
-        err = usb_control_msg(udev, usb_rcvctrlpipe( udev, 0 ),
-                              0x01, USB_TYPE_VENDOR|USB_RECIP_DEVICE|USB_DIR_IN,
-                              0x0, 0x400, &ltmp, 4, HZ*100 );
-        if (err)
+        nr = usb_control_msg(udev, usb_rcvctrlpipe( udev, 0 ),
+                             0x01, USB_TYPE_VENDOR|USB_RECIP_DEVICE|USB_DIR_IN,
+                             0x0, 0x400, &ltmp, 4, HZ*100 );
+        if (nr < 0) {
+                err = nr;
                 goto error;
+        }
 
         ltmp = cpu_to_le32(ltmp);
         if (ltmp) {  // Is already initialized?
@@ -337,8 +339,10 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         }
 
         dev = ieee80211_alloc_hw(sizeof(*priv), &wbsoft_ops);
-        if (!dev)
+        if (!dev) {
+                err = -ENOMEM;
                 goto error;
+        }
 
         priv = dev->priv;
 
@@ -369,9 +373,11 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         }
 
         dev->extra_tx_headroom = 12;    /* FIXME */
-        dev->flags = 0;
+        dev->flags = IEEE80211_HW_SIGNAL_UNSPEC;
+        dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 
         dev->channel_change_time = 1000;
+        dev->max_signal = 100;
         dev->queues = 1;
 
         dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &wbsoft_band_2GHz;
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 326dd7f65ee9..b3d5a23ab56f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1376,6 +1376,15 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1324), /* Conexant USB MODEM RD02-D400 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
+        },
+        { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+        .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+                                           data interface instead of
+                                           communications interface.
+                                           Maybe we should define a new
+                                           quirk for this. */
+        },
 
         /* control interfaces with various AT-command sets */
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 31fb204f44c6..49e7f56e0d7f 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -653,7 +653,7 @@ int usb_get_descriptor(struct usb_device *dev, unsigned char type,
                 if (result <= 0 && result != -ETIMEDOUT)
                         continue;
                 if (result > 1 && ((u8 *)buf)[1] != type) {
-                        result = -EPROTO;
+                        result = -ENODATA;
                         continue;
                 }
                 break;
@@ -696,8 +696,13 @@ static int usb_get_string(struct usb_device *dev, unsigned short langid,
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
                         (USB_DT_STRING << 8) + index, langid, buf, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (!(result == 0 || result == -EPIPE))
-                        break;
+                if (result == 0 || result == -EPIPE)
+                        continue;
+                if (result > 1 && ((u8 *) buf)[1] != USB_DT_STRING) {
+                        result = -ENODATA;
+                        continue;
+                }
+                break;
         }
         return result;
 }
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 3219d137340a..e55fef52a5dc 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -191,6 +191,7 @@ config USB_GADGET_OMAP
         boolean "OMAP USB Device Controller"
         depends on ARCH_OMAP
         select ISP1301_OMAP if MACH_OMAP_H2 || MACH_OMAP_H3 || MACH_OMAP_H4_OTG
+        select USB_OTG_UTILS if ARCH_OMAP
         help
            Many Texas Instruments OMAP processors have flexible full
            speed USB device controllers, with support for up to 30
diff --git a/drivers/usb/gadget/f_obex.c b/drivers/usb/gadget/f_obex.c
index 80c2e7e9622f..38aa896cc5db 100644
--- a/drivers/usb/gadget/f_obex.c
+++ b/drivers/usb/gadget/f_obex.c
@@ -366,9 +366,9 @@ obex_bind(struct usb_configuration *c, struct usb_function *f)
                 f->hs_descriptors = usb_copy_descriptors(hs_function);
 
                 obex->hs.obex_in = usb_find_endpoint(hs_function,
-                                f->descriptors, &obex_hs_ep_in_desc);
+                                f->hs_descriptors, &obex_hs_ep_in_desc);
                 obex->hs.obex_out = usb_find_endpoint(hs_function,
-                                f->descriptors, &obex_hs_ep_out_desc);
+                                f->hs_descriptors, &obex_hs_ep_out_desc);
         }
 
         /* Avoid letting this gadget enumerate until the userspace
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index b10fa31cc915..1ab9dac7e12d 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -3879,7 +3879,11 @@ static int __init check_parameters(struct fsg_dev *fsg)
         mod_data.protocol_type = USB_SC_SCSI;
         mod_data.protocol_name = "Transparent SCSI";
 
-        if (gadget_is_sh(fsg->gadget))
+        /* Some peripheral controllers are known not to be able to
+         * halt bulk endpoints correctly.  If one of them is present,
+         * disable stalls.
+         */
+        if (gadget_is_sh(fsg->gadget) || gadget_is_at91(fsg->gadget))
                 mod_data.can_stall = 0;
 
         if (mod_data.release == 0xffff) {       // Parameter wasn't set
diff --git a/drivers/usb/gadget/fsl_usb2_udc.c b/drivers/usb/gadget/fsl_usb2_udc.c
index f3c6703cffda..d8d9a52a44b3 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.c
+++ b/drivers/usb/gadget/fsl_usb2_udc.c
@@ -404,7 +404,10 @@ static void struct_ep_qh_setup(struct fsl_udc *udc, unsigned char ep_num,
         }
         if (zlt)
                 tmp |= EP_QUEUE_HEAD_ZLT_SEL;
+
         p_QH->max_pkt_length = cpu_to_le32(tmp);
+        p_QH->next_dtd_ptr = 1;
+        p_QH->size_ioc_int_sts = 0;
 
         return;
 }
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 4725d15d096f..e551bb38852b 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -485,6 +485,7 @@ static int ehci_init(struct usb_hcd *hcd)
          * periodic_size can shrink by USBCMD update if hcc_params allows.
          */
         ehci->periodic_size = DEFAULT_I_TDPS;
+        INIT_LIST_HEAD(&ehci->cached_itd_list);
         if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                 return retval;
 
@@ -497,6 +498,7 @@ static int ehci_init(struct usb_hcd *hcd)
 
         ehci->reclaim = NULL;
         ehci->next_uframe = -1;
+        ehci->clock_frame = -1;
 
         /*
          * dedicate a qh for the async ring head, since we couldn't unlink
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index 0431397836f6..10d52919abbb 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -128,6 +128,7 @@ static inline void qh_put (struct ehci_qh *qh)
 
 static void ehci_mem_cleanup (struct ehci_hcd *ehci)
 {
+        free_cached_itd_list(ehci);
         if (ehci->async)
                 qh_put (ehci->async);
         ehci->async = NULL;
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a081ee65bde6..07bcb931021b 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1004,7 +1004,8 @@ iso_stream_put(struct ehci_hcd *ehci, struct ehci_iso_stream *stream)
 
                 is_in = (stream->bEndpointAddress & USB_DIR_IN) ? 0x10 : 0;
                 stream->bEndpointAddress &= 0x0f;
-                stream->ep->hcpriv = NULL;
+                if (stream->ep)
+                        stream->ep->hcpriv = NULL;
 
                 if (stream->rescheduled) {
                         ehci_info (ehci, "ep%d%s-iso rescheduled "
@@ -1653,14 +1654,28 @@ itd_complete (
                         (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
         }
         iso_stream_put (ehci, stream);
-        /* OK to recycle this ITD now that its completion callback ran. */
+
 done:
         usb_put_urb(urb);
         itd->urb = NULL;
-        itd->stream = NULL;
-        list_move(&itd->itd_list, &stream->free_list);
-        iso_stream_put(ehci, stream);
-
+        if (ehci->clock_frame != itd->frame || itd->index[7] != -1) {
+                /* OK to recycle this ITD now. */
+                itd->stream = NULL;
+                list_move(&itd->itd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        } else {
+                /* HW might remember this ITD, so we can't recycle it yet.
+                 * Move it to a safe place until a new frame starts.
+                 */
+                list_move(&itd->itd_list, &ehci->cached_itd_list);
+                if (stream->refcount == 2) {
+                        /* If iso_stream_put() were called here, stream
+                         * would be freed.  Instead, just prevent reuse.
+                         */
+                        stream->ep->hcpriv = NULL;
+                        stream->ep = NULL;
+                }
+        }
         return retval;
 }
 
@@ -2101,6 +2116,20 @@ done:
 
 /*-------------------------------------------------------------------------*/
 
+static void free_cached_itd_list(struct ehci_hcd *ehci)
+{
+        struct ehci_itd *itd, *n;
+
+        list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
+                struct ehci_iso_stream  *stream = itd->stream;
+                itd->stream = NULL;
+                list_move(&itd->itd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        }
+}
+
+/*-------------------------------------------------------------------------*/
+
 static void
 scan_periodic (struct ehci_hcd *ehci)
 {
@@ -2115,10 +2144,17 @@ scan_periodic (struct ehci_hcd *ehci)
          * Touches as few pages as possible:  cache-friendly.
          */
         now_uframe = ehci->next_uframe;
-        if (HC_IS_RUNNING (ehci_to_hcd(ehci)->state))
+        if (HC_IS_RUNNING(ehci_to_hcd(ehci)->state)) {
                 clock = ehci_readl(ehci, &ehci->regs->frame_index);
-        else
+                clock_frame = (clock >> 3) % ehci->periodic_size;
+        } else  {
                 clock = now_uframe + mod - 1;
+                clock_frame = -1;
+        }
+        if (ehci->clock_frame != clock_frame) {
+                free_cached_itd_list(ehci);
+                ehci->clock_frame = clock_frame;
+        }
         clock %= mod;
         clock_frame = clock >> 3;
 
@@ -2277,6 +2313,10 @@ restart:
                         /* rescan the rest of this frame, then ... */
                         clock = now;
                         clock_frame = clock >> 3;
+                        if (ehci->clock_frame != clock_frame) {
+                                free_cached_itd_list(ehci);
+                                ehci->clock_frame = clock_frame;
+                        }
                 } else {
                         now_uframe++;
                         now_uframe %= mod;
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index fb7054ccf4fc..262b00c9b334 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -87,6 +87,10 @@ struct ehci_hcd {			/* one per controller */
         int                     next_uframe;    /* scan periodic, start here */
         unsigned                periodic_sched; /* periodic activity count */
 
+        /* list of itds completed while clock_frame was still active */
+        struct list_head        cached_itd_list;
+        unsigned                clock_frame;
+
         /* per root hub port */
         unsigned long           reset_done [EHCI_MAX_ROOT_PORTS];
 
@@ -220,6 +224,8 @@ timer_action (struct ehci_hcd *ehci, enum ehci_timer_action action)
         }
 }
 
+static void free_cached_itd_list(struct ehci_hcd *ehci);
+
 /*-------------------------------------------------------------------------*/
 
 #include <linux/usb/ehci_def.h>
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 5a8fd5d57a11..2dc7606f319c 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -377,18 +377,8 @@ int __init musb_platform_init(struct musb *musb)
         u32             revision;
 
         musb->mregs += DAVINCI_BASE_OFFSET;
-#if 0
-        /* REVISIT there's something odd about clocking, this
-         * didn't appear do the job ...
-         */
-        musb->clock = clk_get(pDevice, "usb");
-        if (IS_ERR(musb->clock))
-                return PTR_ERR(musb->clock);
 
-        status = clk_enable(musb->clock);
-        if (status < 0)
-                return -ENODEV;
-#endif
+        clk_enable(musb->clock);
 
         /* returns zero if e.g. not clocked */
         revision = musb_readl(tibase, DAVINCI_USB_VERSION_REG);
@@ -453,5 +443,8 @@ int musb_platform_exit(struct musb *musb)
         }
 
         phy_off();
+
+        clk_disable(musb->clock);
+
         return 0;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 2cc34fa05b73..af77e4659006 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -115,7 +115,7 @@
 
 
 unsigned musb_debug;
-module_param(musb_debug, uint, S_IRUGO | S_IWUSR);
+module_param_named(debug, musb_debug, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Debug message level. Default = 0");
 
 #define DRIVER_AUTHOR "Mentor Graphics, Texas Instruments, Nokia"
@@ -767,6 +767,7 @@ static irqreturn_t musb_stage2_irq(struct musb *musb, u8 int_usb,
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
                 case OTG_STATE_A_HOST:
                 case OTG_STATE_A_SUSPEND:
+                        usb_hcd_resume_root_hub(musb_to_hcd(musb));
                         musb_root_disconnect(musb);
                         if (musb->a_wait_bcon != 0)
                                 musb_platform_try_idle(musb, jiffies
@@ -1815,7 +1816,7 @@ static void musb_free(struct musb *musb)
 #ifdef CONFIG_SYSFS
         device_remove_file(musb->controller, &dev_attr_mode);
         device_remove_file(musb->controller, &dev_attr_vbus);
-#ifdef CONFIG_USB_MUSB_OTG
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         device_remove_file(musb->controller, &dev_attr_srp);
 #endif
 #endif
@@ -2063,7 +2064,7 @@ fail2:
 #ifdef CONFIG_SYSFS
         device_remove_file(musb->controller, &dev_attr_mode);
         device_remove_file(musb->controller, &dev_attr_vbus);
-#ifdef CONFIG_USB_MUSB_OTG
+#ifdef CONFIG_USB_GADGET_MUSB_HDRC
         device_remove_file(musb->controller, &dev_attr_srp);
 #endif
 #endif
@@ -2243,10 +2244,10 @@ static int __init musb_init(void)
         return platform_driver_probe(&musb_driver, musb_probe);
 }
 
-/* make us init after usbcore and before usb
- * gadget and host-side drivers start to register
+/* make us init after usbcore and i2c (transceivers, regulators, etc)
+ * and before usb gadget and host-side drivers start to register
  */
-subsys_initcall(musb_init);
+fs_initcall(musb_init);
 
 static void __exit musb_cleanup(void)
 {
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 4ea305387981..c7ebd0867fcc 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -575,7 +575,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
         struct usb_request      *request = &req->request;
         struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
         void __iomem            *epio = musb->endpoints[epnum].regs;
-        u16                     fifo_count = 0;
+        unsigned                fifo_count = 0;
         u16                     len = musb_ep->packet_sz;
 
         csr = musb_readw(epio, MUSB_RXCSR);
@@ -687,7 +687,7 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                         len, fifo_count,
                                         musb_ep->packet_sz);
 
-                        fifo_count = min(len, fifo_count);
+                        fifo_count = min_t(unsigned, len, fifo_count);
 
 #ifdef  CONFIG_USB_TUSB_OMAP_DMA
                         if (tusb_dma_omap() && musb_ep->dma) {
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index a035ceccf950..6dbbd0786a6a 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -335,16 +335,11 @@ musb_save_toggle(struct musb_hw_ep *ep, int is_in, struct urb *urb)
 static struct musb_qh *
 musb_giveback(struct musb_qh *qh, struct urb *urb, int status)
 {
-        int                     is_in;
         struct musb_hw_ep       *ep = qh->hw_ep;
         struct musb             *musb = ep->musb;
+        int                     is_in = usb_pipein(urb->pipe);
         int                     ready = qh->is_ready;
 
-        if (ep->is_shared_fifo)
-                is_in = 1;
-        else
-                is_in = usb_pipein(urb->pipe);
-
         /* save toggle eagerly, for paranoia */
         switch (qh->type) {
         case USB_ENDPOINT_XFER_BULK:
@@ -432,7 +427,7 @@ musb_advance_schedule(struct musb *musb, struct urb *urb,
         else
                 qh = musb_giveback(qh, urb, urb->status);
 
-        if (qh && qh->is_ready && !list_empty(&qh->hep->urb_list)) {
+        if (qh != NULL && qh->is_ready) {
                 DBG(4, "... next ep%d %cX urb %p\n",
                                 hw_ep->epnum, is_in ? 'R' : 'T',
                                 next_urb(qh));
@@ -942,8 +937,8 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
         switch (musb->ep0_stage) {
         case MUSB_EP0_IN:
                 fifo_dest = urb->transfer_buffer + urb->actual_length;
-                fifo_count = min(len, ((u16) (urb->transfer_buffer_length
-                                        - urb->actual_length)));
+                fifo_count = min_t(size_t, len, urb->transfer_buffer_length -
+                                   urb->actual_length);
                 if (fifo_count < len)
                         urb->status = -EOVERFLOW;
 
@@ -976,10 +971,9 @@ static bool musb_h_ep0_continue(struct musb *musb, u16 len, struct urb *urb)
                 }
                 /* FALLTHROUGH */
         case MUSB_EP0_OUT:
-                fifo_count = min(qh->maxpacket, ((u16)
-                                (urb->transfer_buffer_length
-                                - urb->actual_length)));
-
+                fifo_count = min_t(size_t, qh->maxpacket,
+                                   urb->transfer_buffer_length -
+                                   urb->actual_length);
                 if (fifo_count) {
                         fifo_dest = (u8 *) (urb->transfer_buffer
                                         + urb->actual_length);
@@ -1161,7 +1155,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
         struct urb              *urb;
         struct musb_hw_ep       *hw_ep = musb->endpoints + epnum;
         void __iomem            *epio = hw_ep->regs;
-        struct musb_qh          *qh = hw_ep->out_qh;
+        struct musb_qh          *qh = hw_ep->is_shared_fifo ? hw_ep->in_qh
+                                                            : hw_ep->out_qh;
         u32                     status = 0;
         void __iomem            *mbase = musb->mregs;
         struct dma_channel      *dma;
@@ -1308,7 +1303,8 @@ void musb_host_tx(struct musb *musb, u8 epnum)
                  * packets before updating TXCSR ... other docs disagree ...
                  */
                 /* PIO:  start next packet in this URB */
-                wLength = min(qh->maxpacket, (u16) wLength);
+                if (wLength > qh->maxpacket)
+                        wLength = qh->maxpacket;
                 musb_write_fifo(hw_ep, wLength, buf);
                 qh->segsize = wLength;
 
@@ -1867,19 +1863,21 @@ static int musb_urb_enqueue(
         }
         qh->type_reg = type_reg;
 
-        /* precompute rxinterval/txinterval register */
-        interval = min((u8)16, epd->bInterval); /* log encoding */
+        /* Precompute RXINTERVAL/TXINTERVAL register */
         switch (qh->type) {
         case USB_ENDPOINT_XFER_INT:
-                /* fullspeed uses linear encoding */
-                if (USB_SPEED_FULL == urb->dev->speed) {
-                        interval = epd->bInterval;
-                        if (!interval)
-                                interval = 1;
+                /*
+                 * Full/low speeds use the  linear encoding,
+                 * high speed uses the logarithmic encoding.
+                 */
+                if (urb->dev->speed <= USB_SPEED_FULL) {
+                        interval = max_t(u8, epd->bInterval, 1);
+                        break;
                 }
                 /* FALLTHROUGH */
         case USB_ENDPOINT_XFER_ISOC:
-                /* iso always uses log encoding */
+                /* ISO always uses logarithmic encoding */
+                interval = min_t(u8, epd->bInterval, 16);
                 break;
         default:
                 /* REVISIT we actually want to use NAK limits, hinting to the
@@ -2037,9 +2035,9 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 goto done;
 
         /* Any URB not actively programmed into endpoint hardware can be
-         * immediately given back.  Such an URB must be at the head of its
+         * immediately given back; that's any URB not at the head of an
          * endpoint queue, unless someday we get real DMA queues.  And even
-         * then, it might not be known to the hardware...
+         * if it's at the head, it might not be known to the hardware...
          *
          * Otherwise abort current transfer, pending dma, etc.; urb->status
          * has already been updated.  This is a synchronous abort; it'd be
@@ -2078,6 +2076,15 @@ static int musb_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
                 qh->is_ready = 0;
                 __musb_giveback(musb, urb, 0);
                 qh->is_ready = ready;
+
+                /* If nothing else (usually musb_giveback) is using it
+                 * and its URB list has emptied, recycle this qh.
+                 */
+                if (ready && list_empty(&qh->hep->urb_list)) {
+                        qh->hep->hcpriv = NULL;
+                        list_del(&qh->ring);
+                        kfree(qh);
+                }
         } else
                 ret = musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN);
 done:
@@ -2093,15 +2100,16 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
         unsigned long           flags;
         struct musb             *musb = hcd_to_musb(hcd);
         u8                      is_in = epnum & USB_DIR_IN;
-        struct musb_qh          *qh = hep->hcpriv;
-        struct urb              *urb, *tmp;
+        struct musb_qh          *qh;
+        struct urb              *urb;
         struct list_head        *sched;
 
-        if (!qh)
-                return;
-
         spin_lock_irqsave(&musb->lock, flags);
 
+        qh = hep->hcpriv;
+        if (qh == NULL)
+                goto exit;
+
         switch (qh->type) {
         case USB_ENDPOINT_XFER_CONTROL:
                 sched = &musb->control;
@@ -2135,13 +2143,28 @@ musb_h_disable(struct usb_hcd *hcd, struct usb_host_endpoint *hep)
 
                 /* cleanup */
                 musb_cleanup_urb(urb, qh, urb->pipe & USB_DIR_IN);
-        } else
-                urb = NULL;
 
-        /* then just nuke all the others */
-        list_for_each_entry_safe_from(urb, tmp, &hep->urb_list, urb_list)
-                musb_giveback(qh, urb, -ESHUTDOWN);
+                /* Then nuke all the others ... and advance the
+                 * queue on hw_ep (e.g. bulk ring) when we're done.
+                 */
+                while (!list_empty(&hep->urb_list)) {
+                        urb = next_urb(qh);
+                        urb->status = -ESHUTDOWN;
+                        musb_advance_schedule(musb, urb, qh->hw_ep, is_in);
+                }
+        } else {
+                /* Just empty the queue; the hardware is busy with
+                 * other transfers, and since !qh->is_ready nothing
+                 * will activate any of these as it advances.
+                 */
+                while (!list_empty(&hep->urb_list))
+                        __musb_giveback(musb, next_urb(qh), -ESHUTDOWN);
 
+                hep->hcpriv = NULL;
+                list_del(&qh->ring);
+                kfree(qh);
+        }
+exit:
         spin_unlock_irqrestore(&musb->lock, flags);
 }
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index bfd0b68ceccd..b7c132bded7f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -294,7 +294,11 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 
 /* Ericsson products */
 #define ERICSSON_VENDOR_ID                      0x0bdb
-#define ERICSSON_PRODUCT_F3507G                 0x1900
+#define ERICSSON_PRODUCT_F3507G_1               0x1900
+#define ERICSSON_PRODUCT_F3507G_2               0x1902
+
+#define BENQ_VENDOR_ID                          0x04a5
+#define BENQ_PRODUCT_H10                        0x4068
 
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
@@ -509,7 +513,10 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF626) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
-        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
+        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G_1) },
+        { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G_2) },
+        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
+        { USB_DEVICE(0x1da5, 0x4515) }, /* BenQ H20 */
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 50dc33a6065b..6f59c8e510ea 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -907,13 +907,13 @@ UNUSUAL_DEV(  0x05e3, 0x0701, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Optical",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
 
 UNUSUAL_DEV(  0x05e3, 0x0702, 0x0000, 0xffff,
                 "Genesys Logic",
                 "USB to IDE Disk",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 ),
+                US_FL_GO_SLOW | US_FL_MAX_SECTORS_64 | US_FL_IGNORE_RESIDUE ),
 
 /* Reported by Ben Efros <ben@pc-doctor.com> */
 UNUSUAL_DEV(  0x05e3, 0x0723, 0x9451, 0x9451,
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 2181ce4d7ebd..35e8eb02b9e9 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1853,13 +1853,14 @@ static void aty128_bl_exit(struct backlight_device *bd)
  *  Initialisation
  */
 
-#ifdef CONFIG_PPC_PMAC
+#ifdef CONFIG_PPC_PMAC__disabled
 static void aty128_early_resume(void *data)
 {
         struct aty128fb_par *par = data;
 
         if (try_acquire_console_sem())
                 return;
+        pci_restore_state(par->pdev);
         aty128_do_resume(par->pdev);
         release_console_sem();
 }
@@ -1907,7 +1908,14 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
                 /* Indicate sleep capability */
                 if (par->chip_gen == rage_M3) {
                         pmac_call_feature(PMAC_FTR_DEVICE_CAN_WAKE, NULL, 0, 1);
+#if 0 /* Disable the early video resume hack for now as it's causing problems, among
+       * others we now rely on the PCI core restoring the config space for us, which
+       * isn't the case with that hack, and that code path causes various things to
+       * be called with interrupts off while they shouldn't. I'm leaving the code in
+       * as it can be useful for debugging purposes
+       */
                         pmac_set_early_video_resume(aty128_early_resume, par);
+#endif
                 }
 
                 /* Find default mode */
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index ca5f0dc28546..81603f85e17e 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -2762,12 +2762,13 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         return rc;
 }
 
-#ifdef CONFIG_PPC_OF
+#ifdef CONFIG_PPC_OF__disabled
 static void radeonfb_early_resume(void *data)
 {
         struct radeonfb_info *rinfo = data;
 
         rinfo->no_schedule = 1;
+        pci_restore_state(rinfo->pdev);
         radeonfb_pci_resume(rinfo->pdev);
         rinfo->no_schedule = 0;
 }
@@ -2834,7 +2835,14 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlis
                  */
                 if (rinfo->pm_mode != radeon_pm_none) {
                         pmac_call_feature(PMAC_FTR_DEVICE_CAN_WAKE, rinfo->of_node, 0, 1);
+#if 0 /* Disable the early video resume hack for now as it's causing problems, among
+       * others we now rely on the PCI core restoring the config space for us, which
+       * isn't the case with that hack, and that code path causes various things to
+       * be called with interrupts off while they shouldn't. I'm leaving the code in
+       * as it can be useful for debugging purposes
+       */
                         pmac_set_early_video_resume(radeonfb_early_resume, rinfo);
+#endif
                 }
 
 #if 0
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index a24e680d2b9c..2e940199fc89 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -993,6 +993,7 @@ static int i810_check_params(struct fb_var_screeninfo *var,
         struct i810fb_par *par = info->par;
         int line_length, vidmem, mode_valid = 0, retval = 0;
         u32 vyres = var->yres_virtual, vxres = var->xres_virtual;
+
         /*
          *  Memory limit
          */
@@ -1002,12 +1003,12 @@ static int i810_check_params(struct fb_var_screeninfo *var,
         if (vidmem > par->fb.size) {
                 vyres = par->fb.size/line_length;
                 if (vyres < var->yres) {
-                        vyres = yres;
+                        vyres = info->var.yres;
                         vxres = par->fb.size/vyres;
                         vxres /= var->bits_per_pixel >> 3;
                         line_length = get_line_length(par, vxres, 
                                                       var->bits_per_pixel);
-                        vidmem = line_length * yres;
+                        vidmem = line_length * info->var.yres;
                         if (vxres < var->xres) {
                                 printk("i810fb: required video memory, "
                                        "%d bytes, for %dx%d-%d (virtual) "
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 48ff701d3a72..2552b9f325ee 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -2230,7 +2230,7 @@ static int __devexit pxafb_remove(struct platform_device *dev)
 
 static struct platform_driver pxafb_driver = {
         .probe          = pxafb_probe,
-        .remove         = pxafb_remove,
+        .remove         = __devexit_p(pxafb_remove),
         .suspend        = pxafb_suspend,
         .resume         = pxafb_resume,
         .driver         = {
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 0e2b8fd24df1..2c5d069e5f06 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -446,7 +446,6 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
 {
         struct sh_mobile_lcdc_chan *ch;
         struct sh_mobile_lcdc_board_cfg *board_cfg;
-        unsigned long tmp;
         int k;
 
         /* tell the board code to disable the panel */
@@ -456,9 +455,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
                 if (board_cfg->display_off)
                         board_cfg->display_off(board_cfg->board_data);
 
-                /* cleanup deferred io if SYS bus */
-                tmp = ch->cfg.sys_bus_cfg.deferred_io_msec;
-                if (ch->ldmt1r_value & (1 << 12) && tmp) {
+                /* cleanup deferred io if enabled */
+                if (ch->info.fbdefio) {
                         fb_deferred_io_cleanup(&ch->info);
                         ch->info.fbdefio = NULL;
                 }
diff --git a/drivers/w1/masters/w1-gpio.c b/drivers/w1/masters/w1-gpio.c
index 9e1138a75e8b..a411702413d6 100644
--- a/drivers/w1/masters/w1-gpio.c
+++ b/drivers/w1/masters/w1-gpio.c
@@ -39,7 +39,7 @@ static u8 w1_gpio_read_bit(void *data)
 {
         struct w1_gpio_platform_data *pdata = data;
 
-        return gpio_get_value(pdata->pin);
+        return gpio_get_value(pdata->pin) ? 1 : 0;
 }
 
 static int __init w1_gpio_probe(struct platform_device *pdev)
diff --git a/drivers/w1/slaves/Kconfig b/drivers/w1/slaves/Kconfig
index 8d0b1fb1e52e..1f51366417b9 100644
--- a/drivers/w1/slaves/Kconfig
+++ b/drivers/w1/slaves/Kconfig
@@ -16,6 +16,12 @@ config W1_SLAVE_SMEM
           Say Y here if you want to connect 1-wire
           simple 64bit memory rom(ds2401/ds2411/ds1990*) to your wire.
 
+config W1_SLAVE_DS2431
+        tristate "1kb EEPROM family support (DS2431)"
+        help
+          Say Y here if you want to use a 1-wire
+          1kb EEPROM family device (DS2431)
+
 config W1_SLAVE_DS2433
         tristate "4kb EEPROM family support (DS2433)"
         help
diff --git a/drivers/w1/slaves/Makefile b/drivers/w1/slaves/Makefile
index 990f400b6d22..f1f51f19b129 100644
--- a/drivers/w1/slaves/Makefile
+++ b/drivers/w1/slaves/Makefile
@@ -4,6 +4,7 @@
 
 obj-$(CONFIG_W1_SLAVE_THERM)    += w1_therm.o
 obj-$(CONFIG_W1_SLAVE_SMEM)     += w1_smem.o
+obj-$(CONFIG_W1_SLAVE_DS2431)   += w1_ds2431.o
 obj-$(CONFIG_W1_SLAVE_DS2433)   += w1_ds2433.o
 obj-$(CONFIG_W1_SLAVE_DS2760)   += w1_ds2760.o
 obj-$(CONFIG_W1_SLAVE_BQ27000)  += w1_bq27000.o
diff --git a/drivers/w1/slaves/w1_ds2433.c b/drivers/w1/slaves/w1_ds2433.c
index 858c16a544c2..139447148822 100644
--- a/drivers/w1/slaves/w1_ds2433.c
+++ b/drivers/w1/slaves/w1_ds2433.c
@@ -156,6 +156,9 @@ out_up:
  */
 static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 {
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        struct w1_f23_data *f23 = sl->family_data;
+#endif
         u8 wrbuf[4];
         u8 rdbuf[W1_PAGE_SIZE + 3];
         u8 es = (addr + len - 1) & 0x1f;
@@ -196,7 +199,9 @@ static int w1_f23_write(struct w1_slave *sl, int addr, int len, const u8 *data)
 
         /* Reset the bus to wake up the EEPROM (this may not be needed) */
         w1_reset_bus(sl->master);
-
+#ifdef CONFIG_W1_SLAVE_DS2433_CRC
+        f23->validcrc &= ~(1 << (addr >> W1_PAGE_BITS));
+#endif
         return 0;
 }
 
diff --git a/drivers/watchdog/gef_wdt.c b/drivers/watchdog/gef_wdt.c
index f0c2b7a1a175..734d9806a872 100644
--- a/drivers/watchdog/gef_wdt.c
+++ b/drivers/watchdog/gef_wdt.c
@@ -269,7 +269,7 @@ static int __devinit gef_wdt_probe(struct of_device *dev,
         bus_clk = 133; /* in MHz */
 
         freq = fsl_get_sys_freq();
-        if (freq > 0)
+        if (freq != -1)
                 bus_clk = freq;
 
         /* Map devices registers into memory */
diff --git a/drivers/watchdog/ks8695_wdt.c b/drivers/watchdog/ks8695_wdt.c
index 0b798fdaa378..74c92d384112 100644
--- a/drivers/watchdog/ks8695_wdt.c
+++ b/drivers/watchdog/ks8695_wdt.c
@@ -21,6 +21,7 @@
 #include <linux/watchdog.h>
 #include <linux/io.h>
 #include <linux/uaccess.h>
+#include <mach/timex.h>
 #include <mach/regs-timer.h>
 
 #define WDT_DEFAULT_TIME        5       /* seconds */
diff --git a/drivers/watchdog/orion5x_wdt.c b/drivers/watchdog/orion5x_wdt.c
index 14a339f58b6a..b64ae1a17832 100644
--- a/drivers/watchdog/orion5x_wdt.c
+++ b/drivers/watchdog/orion5x_wdt.c
@@ -29,6 +29,7 @@
 #define  WDT_EN                 0x0010
 #define WDT_VAL                 (TIMER_VIRT_BASE + 0x0024)
 
+#define ORION5X_TCLK            166666667
 #define WDT_MAX_DURATION        (0xffffffff / ORION5X_TCLK)
 #define WDT_IN_USE              0
 #define WDT_OK_TO_CLOSE         1
diff --git a/drivers/watchdog/rc32434_wdt.c b/drivers/watchdog/rc32434_wdt.c
index 57027f4653ce..f3553fa40b17 100644
--- a/drivers/watchdog/rc32434_wdt.c
+++ b/drivers/watchdog/rc32434_wdt.c
@@ -34,104 +34,89 @@
 #include <asm/time.h>
 #include <asm/mach-rc32434/integ.h>
 
-#define MAX_TIMEOUT                     20
-#define RC32434_WDT_INTERVAL            (15 * HZ)
-
-#define VERSION "0.2"
+#define VERSION "0.4"
 
 static struct {
-        struct completion stop;
-        int running;
-        struct timer_list timer;
-        int queue;
-        int default_ticks;
         unsigned long inuse;
 } rc32434_wdt_device;
 
 static struct integ __iomem *wdt_reg;
-static int ticks = 100 * HZ;
 
 static int expect_close;
-static int timeout;
+
+/* Board internal clock speed in Hz,
+ * the watchdog timer ticks at. */
+extern unsigned int idt_cpu_freq;
+
+/* translate wtcompare value to seconds and vice versa */
+#define WTCOMP2SEC(x)   (x / idt_cpu_freq)
+#define SEC2WTCOMP(x)   (x * idt_cpu_freq)
+
+/* Use a default timeout of 20s. This should be
+ * safe for CPU clock speeds up to 400MHz, as
+ * ((2 ^ 32) - 1) / (400MHz / 2) = 21s.  */
+#define WATCHDOG_TIMEOUT 20
+
+static int timeout = WATCHDOG_TIMEOUT;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+/* apply or and nand masks to data read from addr and write back */
+#define SET_BITS(addr, or, nand) \
+        writel((readl(&addr) | or) & ~nand, &addr)
 
 static void rc32434_wdt_start(void)
 {
-        u32 val;
-
-        if (!rc32434_wdt_device.inuse) {
-                writel(0, &wdt_reg->wtcount);
+        u32 or, nand;
 
-                val = RC32434_ERR_WRE;
-                writel(readl(&wdt_reg->errcs) | val, &wdt_reg->errcs);
+        /* zero the counter before enabling */
+        writel(0, &wdt_reg->wtcount);
 
-                val = RC32434_WTC_EN;
-                writel(readl(&wdt_reg->wtc) | val, &wdt_reg->wtc);
-        }
-        rc32434_wdt_device.running++;
-}
+        /* don't generate a non-maskable interrupt,
+         * do a warm reset instead */
+        nand = 1 << RC32434_ERR_WNE;
+        or = 1 << RC32434_ERR_WRE;
 
-static void rc32434_wdt_stop(void)
-{
-        u32 val;
+        /* reset the ERRCS timeout bit in case it's set */
+        nand |= 1 << RC32434_ERR_WTO;
 
-        if (rc32434_wdt_device.running) {
+        SET_BITS(wdt_reg->errcs, or, nand);
 
-                val = ~RC32434_WTC_EN;
-                writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
+        /* reset WTC timeout bit and enable WDT */
+        nand = 1 << RC32434_WTC_TO;
+        or = 1 << RC32434_WTC_EN;
 
-                val = ~RC32434_ERR_WRE;
-                writel(readl(&wdt_reg->errcs) & val, &wdt_reg->errcs);
+        SET_BITS(wdt_reg->wtc, or, nand);
+}
 
-                rc32434_wdt_device.running = 0;
-        }
+static void rc32434_wdt_stop(void)
+{
+        /* Disable WDT */
+        SET_BITS(wdt_reg->wtc, 0, 1 << RC32434_WTC_EN);
 }
 
-static void rc32434_wdt_set(int new_timeout)
+static int rc32434_wdt_set(int new_timeout)
 {
-        u32 cmp = new_timeout * HZ;
-        u32 state, val;
+        int max_to = WTCOMP2SEC((u32)-1);
 
+        if (new_timeout < 0 || new_timeout > max_to) {
+                printk(KERN_ERR KBUILD_MODNAME
+                        ": timeout value must be between 0 and %d",
+                        max_to);
+                return -EINVAL;
+        }
         timeout = new_timeout;
-        /*
-         * store and disable WTC
-         */
-        state = (u32)(readl(&wdt_reg->wtc) & RC32434_WTC_EN);
-        val = ~RC32434_WTC_EN;
-        writel(readl(&wdt_reg->wtc) & val, &wdt_reg->wtc);
-
-        writel(0, &wdt_reg->wtcount);
-        writel(cmp, &wdt_reg->wtcompare);
-
-        /*
-         * restore WTC
-         */
-
-        writel(readl(&wdt_reg->wtc) | state, &wdt_reg);
-}
+        writel(SEC2WTCOMP(timeout), &wdt_reg->wtcompare);
 
-static void rc32434_wdt_reset(void)
-{
-        ticks = rc32434_wdt_device.default_ticks;
+        return 0;
 }
 
-static void rc32434_wdt_update(unsigned long unused)
+static void rc32434_wdt_ping(void)
 {
-        if (rc32434_wdt_device.running)
-                ticks--;
-
         writel(0, &wdt_reg->wtcount);
-
-        if (rc32434_wdt_device.queue && ticks)
-                mod_timer(&rc32434_wdt_device.timer,
-                        jiffies + RC32434_WDT_INTERVAL);
-        else
-                complete(&rc32434_wdt_device.stop);
 }
 
 static int rc32434_wdt_open(struct inode *inode, struct file *file)
@@ -142,19 +127,23 @@ static int rc32434_wdt_open(struct inode *inode, struct file *file)
         if (nowayout)
                 __module_get(THIS_MODULE);
 
+        rc32434_wdt_start();
+        rc32434_wdt_ping();
+
         return nonseekable_open(inode, file);
 }
 
 static int rc32434_wdt_release(struct inode *inode, struct file *file)
 {
-        if (expect_close && nowayout == 0) {
+        if (expect_close == 42) {
                 rc32434_wdt_stop();
                 printk(KERN_INFO KBUILD_MODNAME ": disabling watchdog timer\n");
                 module_put(THIS_MODULE);
-        } else
+        } else {
                 printk(KERN_CRIT KBUILD_MODNAME
                         ": device closed unexpectedly. WDT will not stop !\n");
-
+                rc32434_wdt_ping();
+        }
         clear_bit(0, &rc32434_wdt_device.inuse);
         return 0;
 }
@@ -174,10 +163,10 @@ static ssize_t rc32434_wdt_write(struct file *file, const char *data,
                                 if (get_user(c, data + i))
                                         return -EFAULT;
                                 if (c == 'V')
-                                        expect_close = 1;
+                                        expect_close = 42;
                         }
                 }
-                rc32434_wdt_update(0);
+                rc32434_wdt_ping();
                 return len;
         }
         return 0;
@@ -197,11 +186,11 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
         };
         switch (cmd) {
         case WDIOC_KEEPALIVE:
-                rc32434_wdt_reset();
+                rc32434_wdt_ping();
                 break;
         case WDIOC_GETSTATUS:
         case WDIOC_GETBOOTSTATUS:
-                value = readl(&wdt_reg->wtcount);
+                value = 0;
                 if (copy_to_user(argp, &value, sizeof(int)))
                         return -EFAULT;
                 break;
@@ -218,6 +207,7 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
                         break;
                 case WDIOS_DISABLECARD:
                         rc32434_wdt_stop();
+                        break;
                 default:
                         return -EINVAL;
                 }
@@ -225,11 +215,9 @@ static long rc32434_wdt_ioctl(struct file *file, unsigned int cmd,
         case WDIOC_SETTIMEOUT:
                 if (copy_from_user(&new_timeout, argp, sizeof(int)))
                         return -EFAULT;
-                if (new_timeout < 1)
+                if (rc32434_wdt_set(new_timeout))
                         return -EINVAL;
-                if (new_timeout > MAX_TIMEOUT)
-                        return -EINVAL;
-                rc32434_wdt_set(new_timeout);
+                /* Fall through */
         case WDIOC_GETTIMEOUT:
                 return copy_to_user(argp, &timeout, sizeof(int));
         default:
@@ -254,15 +242,15 @@ static struct miscdevice rc32434_wdt_miscdev = {
         .fops   = &rc32434_wdt_fops,
 };
 
-static char banner[] = KERN_INFO KBUILD_MODNAME
+static char banner[] __devinitdata = KERN_INFO KBUILD_MODNAME
                 ": Watchdog Timer version " VERSION ", timer margin: %d sec\n";
 
-static int rc32434_wdt_probe(struct platform_device *pdev)
+static int __devinit rc32434_wdt_probe(struct platform_device *pdev)
 {
         int ret;
         struct resource *r;
 
-        r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb500_wdt_res");
+        r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "rb532_wdt_res");
         if (!r) {
                 printk(KERN_ERR KBUILD_MODNAME
                         "failed to retrieve resources\n");
@@ -277,24 +265,12 @@ static int rc32434_wdt_probe(struct platform_device *pdev)
         }
 
         ret = misc_register(&rc32434_wdt_miscdev);
-
         if (ret < 0) {
                 printk(KERN_ERR KBUILD_MODNAME
                         "failed to register watchdog device\n");
                 goto unmap;
         }
 
-        init_completion(&rc32434_wdt_device.stop);
-        rc32434_wdt_device.queue = 0;
-
-        clear_bit(0, &rc32434_wdt_device.inuse);
-
-        setup_timer(&rc32434_wdt_device.timer, rc32434_wdt_update, 0L);
-
-        rc32434_wdt_device.default_ticks = ticks;
-
-        rc32434_wdt_start();
-
         printk(banner, timeout);
 
         return 0;
@@ -304,23 +280,17 @@ unmap:
         return ret;
 }
 
-static int rc32434_wdt_remove(struct platform_device *pdev)
+static int __devexit rc32434_wdt_remove(struct platform_device *pdev)
 {
-        if (rc32434_wdt_device.queue) {
-                rc32434_wdt_device.queue = 0;
-                wait_for_completion(&rc32434_wdt_device.stop);
-        }
         misc_deregister(&rc32434_wdt_miscdev);
-
         iounmap(wdt_reg);
-
         return 0;
 }
 
 static struct platform_driver rc32434_wdt = {
         .probe  = rc32434_wdt_probe,
-        .remove = rc32434_wdt_remove,
-        .driver = {
+        .remove = __devexit_p(rc32434_wdt_remove),
+        .driver = {
                 .name = "rc32434_wdt",
         }
 };
diff --git a/fs/Makefile b/fs/Makefile
index 38bc735c67ad..dc20db348679 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -69,10 +69,12 @@ obj-$(CONFIG_DLM)		+= dlm/
 # Do not add any filesystems before this line
 obj-$(CONFIG_REISERFS_FS)       += reiserfs/
 obj-$(CONFIG_EXT3_FS)           += ext3/ # Before ext2 so root fs can be ext3
-obj-$(CONFIG_EXT4_FS)           += ext4/ # Before ext2 so root fs can be ext4
+obj-$(CONFIG_EXT2_FS)           += ext2/
+# We place ext4 after ext2 so plain ext2 root fs's are mounted using ext2
+# unless explicitly requested by rootfstype
+obj-$(CONFIG_EXT4_FS)           += ext4/
 obj-$(CONFIG_JBD)               += jbd/
 obj-$(CONFIG_JBD2)              += jbd2/
-obj-$(CONFIG_EXT2_FS)           += ext2/
 obj-$(CONFIG_CRAMFS)            += cramfs/
 obj-$(CONFIG_SQUASHFS)          += squashfs/
 obj-y                           += ramfs/
diff --git a/fs/bio.c b/fs/bio.c
index 72ab251cdb9c..124b95c4d582 100644
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -302,7 +302,7 @@ void bio_init(struct bio *bio)
 struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs)
 {
         struct bio *bio = NULL;
-        void *p;
+        void *uninitialized_var(p);
 
         if (bs) {
                 p = mempool_alloc(bs->bio_pool, gfp_mask);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index a8c9693b75ac..72677ce2b74f 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -66,6 +66,9 @@ struct btrfs_inode {
          */
         struct list_head delalloc_inodes;
 
+        /* the space_info for where this inode's data allocations are done */
+        struct btrfs_space_info *space_info;
+
         /* full 64 bit generation number, struct vfs_inode doesn't have a big
          * enough field for this.
          */
@@ -94,6 +97,11 @@ struct btrfs_inode {
          */
         u64 delalloc_bytes;
 
+        /* total number of bytes that may be used for this inode for
+         * delalloc
+         */
+        u64 reserved_bytes;
+
         /*
          * the size of the file stored in the metadata on disk.  data=ordered
          * means the in-memory i_size might be larger than the size on disk
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 42491d728e99..37f31b5529aa 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -277,7 +277,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
         if (*cow_ret == buf)
                 unlock_orig = 1;
 
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
 
         if (parent)
                 parent_start = parent->start;
@@ -2365,7 +2365,7 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
         if (slot >= btrfs_header_nritems(upper) - 1)
                 return 1;
 
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
 
         right = read_node_slot(root, upper, slot + 1);
         btrfs_tree_lock(right);
@@ -2562,7 +2562,7 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
         if (right_nritems == 0)
                 return 1;
 
-        WARN_ON(!btrfs_tree_locked(path->nodes[1]));
+        btrfs_assert_tree_locked(path->nodes[1]);
 
         left = read_node_slot(root, path->nodes[1], slot - 1);
         btrfs_tree_lock(left);
@@ -4101,7 +4101,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
 
                 next = read_node_slot(root, c, slot);
                 if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(c));
+                        btrfs_assert_tree_locked(c);
                         btrfs_tree_lock(next);
                         btrfs_set_lock_blocking(next);
                 }
@@ -4126,7 +4126,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                         reada_for_search(root, path, level, slot, 0);
                 next = read_node_slot(root, next, 0);
                 if (!path->skip_locking) {
-                        WARN_ON(!btrfs_tree_locked(path->nodes[level]));
+                        btrfs_assert_tree_locked(path->nodes[level]);
                         btrfs_tree_lock(next);
                         btrfs_set_lock_blocking(next);
                 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 766b31ae3186..82491ba8fa40 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -596,13 +596,27 @@ struct btrfs_block_group_item {
 
 struct btrfs_space_info {
         u64 flags;
-        u64 total_bytes;
-        u64 bytes_used;
-        u64 bytes_pinned;
-        u64 bytes_reserved;
-        u64 bytes_readonly;
-        int full;
-        int force_alloc;
+
+        u64 total_bytes;        /* total bytes in the space */
+        u64 bytes_used;         /* total bytes used on disk */
+        u64 bytes_pinned;       /* total bytes pinned, will be freed when the
+                                   transaction finishes */
+        u64 bytes_reserved;     /* total bytes the allocator has reserved for
+                                   current allocations */
+        u64 bytes_readonly;     /* total bytes that are read only */
+
+        /* delalloc accounting */
+        u64 bytes_delalloc;     /* number of bytes reserved for allocation,
+                                   this space is not necessarily reserved yet
+                                   by the allocator */
+        u64 bytes_may_use;      /* number of bytes that may be used for
+                                   delalloc */
+
+        int full;               /* indicates that we cannot allocate any more
+                                   chunks for this space */
+        int force_alloc;        /* set if we need to force a chunk alloc for
+                                   this space */
+
         struct list_head list;
 
         /* for block groups in our same type */
@@ -1782,6 +1796,16 @@ int btrfs_add_dead_reloc_root(struct btrfs_root *root);
 int btrfs_cleanup_reloc_trees(struct btrfs_root *root);
 int btrfs_reloc_clone_csums(struct inode *inode, u64 file_pos, u64 len);
 u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags);
+void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *ionde);
+int btrfs_check_metadata_free_space(struct btrfs_root *root);
+int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
+                                u64 bytes);
+void btrfs_free_reserved_data_space(struct btrfs_root *root,
+                                    struct inode *inode, u64 bytes);
+void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
+                                 u64 bytes);
+void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
+                              u64 bytes);
 /* ctree.c */
 int btrfs_previous_item(struct btrfs_root *root,
                         struct btrfs_path *path, u64 min_objectid,
@@ -2027,8 +2051,6 @@ int btrfs_merge_bio_hook(struct page *page, unsigned long offset,
 unsigned long btrfs_force_ra(struct address_space *mapping,
                               struct file_ra_state *ra, struct file *file,
                               pgoff_t offset, pgoff_t last_index);
-int btrfs_check_free_space(struct btrfs_root *root, u64 num_required,
-                           int for_del);
 int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page);
 int btrfs_readpage(struct file *file, struct page *page);
 void btrfs_delete_inode(struct inode *inode);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index adda739a0215..3e18175248e0 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -857,7 +857,7 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         struct inode *btree_inode = root->fs_info->btree_inode;
         if (btrfs_header_generation(buf) ==
             root->fs_info->running_transaction->transid) {
-                WARN_ON(!btrfs_tree_locked(buf));
+                btrfs_assert_tree_locked(buf);
 
                 /* ugh, clear_extent_buffer_dirty can be expensive */
                 btrfs_set_lock_blocking(buf);
@@ -2361,7 +2361,7 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
 
         btrfs_set_lock_blocking(buf);
 
-        WARN_ON(!btrfs_tree_locked(buf));
+        btrfs_assert_tree_locked(buf);
         if (transid != root->fs_info->generation) {
                 printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
                        "found %llu running %llu\n",
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 0a5d796c9f7e..9abf81f71c46 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -60,6 +60,10 @@ static int update_block_group(struct btrfs_trans_handle *trans,
                               u64 bytenr, u64 num_bytes, int alloc,
                               int mark_free);
 
+static int do_chunk_alloc(struct btrfs_trans_handle *trans,
+                          struct btrfs_root *extent_root, u64 alloc_bytes,
+                          u64 flags, int force);
+
 static int block_group_bits(struct btrfs_block_group_cache *cache, u64 bits)
 {
         return (cache->flags & bits) == bits;
@@ -1909,6 +1913,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags,
         found->bytes_pinned = 0;
         found->bytes_reserved = 0;
         found->bytes_readonly = 0;
+        found->bytes_delalloc = 0;
         found->full = 0;
         found->force_alloc = 0;
         *space_info = found;
@@ -1972,6 +1977,233 @@ u64 btrfs_reduce_alloc_profile(struct btrfs_root *root, u64 flags)
         return flags;
 }
 
+static u64 btrfs_get_alloc_profile(struct btrfs_root *root, u64 data)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        u64 alloc_profile;
+
+        if (data) {
+                alloc_profile = info->avail_data_alloc_bits &
+                        info->data_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_DATA | alloc_profile;
+        } else if (root == root->fs_info->chunk_root) {
+                alloc_profile = info->avail_system_alloc_bits &
+                        info->system_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_SYSTEM | alloc_profile;
+        } else {
+                alloc_profile = info->avail_metadata_alloc_bits &
+                        info->metadata_alloc_profile;
+                data = BTRFS_BLOCK_GROUP_METADATA | alloc_profile;
+        }
+
+        return btrfs_reduce_alloc_profile(root, data);
+}
+
+void btrfs_set_inode_space_info(struct btrfs_root *root, struct inode *inode)
+{
+        u64 alloc_target;
+
+        alloc_target = btrfs_get_alloc_profile(root, 1);
+        BTRFS_I(inode)->space_info = __find_space_info(root->fs_info,
+                                                       alloc_target);
+}
+
+/*
+ * for now this just makes sure we have at least 5% of our metadata space free
+ * for use.
+ */
+int btrfs_check_metadata_free_space(struct btrfs_root *root)
+{
+        struct btrfs_fs_info *info = root->fs_info;
+        struct btrfs_space_info *meta_sinfo;
+        u64 alloc_target, thresh;
+        int committed = 0, ret;
+
+        /* get the space info for where the metadata will live */
+        alloc_target = btrfs_get_alloc_profile(root, 0);
+        meta_sinfo = __find_space_info(info, alloc_target);
+
+again:
+        spin_lock(&meta_sinfo->lock);
+        if (!meta_sinfo->full)
+                thresh = meta_sinfo->total_bytes * 80;
+        else
+                thresh = meta_sinfo->total_bytes * 95;
+
+        do_div(thresh, 100);
+
+        if (meta_sinfo->bytes_used + meta_sinfo->bytes_reserved +
+            meta_sinfo->bytes_pinned + meta_sinfo->bytes_readonly > thresh) {
+                struct btrfs_trans_handle *trans;
+                if (!meta_sinfo->full) {
+                        meta_sinfo->force_alloc = 1;
+                        spin_unlock(&meta_sinfo->lock);
+
+                        trans = btrfs_start_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+
+                        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
+                                             2 * 1024 * 1024, alloc_target, 0);
+                        btrfs_end_transaction(trans, root);
+                        goto again;
+                }
+                spin_unlock(&meta_sinfo->lock);
+
+                if (!committed) {
+                        committed = 1;
+                        trans = btrfs_join_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+                        ret = btrfs_commit_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+                return -ENOSPC;
+        }
+        spin_unlock(&meta_sinfo->lock);
+
+        return 0;
+}
+
+/*
+ * This will check the space that the inode allocates from to make sure we have
+ * enough space for bytes.
+ */
+int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
+                                u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+        int ret = 0, committed = 0;
+
+        /* make sure bytes are sectorsize aligned */
+        bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
+
+        data_sinfo = BTRFS_I(inode)->space_info;
+again:
+        /* make sure we have enough space to handle the data first */
+        spin_lock(&data_sinfo->lock);
+        if (data_sinfo->total_bytes - data_sinfo->bytes_used -
+            data_sinfo->bytes_delalloc - data_sinfo->bytes_reserved -
+            data_sinfo->bytes_pinned - data_sinfo->bytes_readonly -
+            data_sinfo->bytes_may_use < bytes) {
+                struct btrfs_trans_handle *trans;
+
+                /*
+                 * if we don't have enough free bytes in this space then we need
+                 * to alloc a new chunk.
+                 */
+                if (!data_sinfo->full) {
+                        u64 alloc_target;
+
+                        data_sinfo->force_alloc = 1;
+                        spin_unlock(&data_sinfo->lock);
+
+                        alloc_target = btrfs_get_alloc_profile(root, 1);
+                        trans = btrfs_start_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+
+                        ret = do_chunk_alloc(trans, root->fs_info->extent_root,
+                                             bytes + 2 * 1024 * 1024,
+                                             alloc_target, 0);
+                        btrfs_end_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+                spin_unlock(&data_sinfo->lock);
+
+                /* commit the current transaction and try again */
+                if (!committed) {
+                        committed = 1;
+                        trans = btrfs_join_transaction(root, 1);
+                        if (!trans)
+                                return -ENOMEM;
+                        ret = btrfs_commit_transaction(trans, root);
+                        if (ret)
+                                return ret;
+                        goto again;
+                }
+
+                printk(KERN_ERR "no space left, need %llu, %llu delalloc bytes"
+                       ", %llu bytes_used, %llu bytes_reserved, "
+                       "%llu bytes_pinned, %llu bytes_readonly, %llu may use"
+                       "%llu total\n", bytes, data_sinfo->bytes_delalloc,
+                       data_sinfo->bytes_used, data_sinfo->bytes_reserved,
+                       data_sinfo->bytes_pinned, data_sinfo->bytes_readonly,
+                       data_sinfo->bytes_may_use, data_sinfo->total_bytes);
+                return -ENOSPC;
+        }
+        data_sinfo->bytes_may_use += bytes;
+        BTRFS_I(inode)->reserved_bytes += bytes;
+        spin_unlock(&data_sinfo->lock);
+
+        return btrfs_check_metadata_free_space(root);
+}
+
+/*
+ * if there was an error for whatever reason after calling
+ * btrfs_check_data_free_space, call this so we can cleanup the counters.
+ */
+void btrfs_free_reserved_data_space(struct btrfs_root *root,
+                                    struct inode *inode, u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+
+        /* make sure bytes are sectorsize aligned */
+        bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
+
+        data_sinfo = BTRFS_I(inode)->space_info;
+        spin_lock(&data_sinfo->lock);
+        data_sinfo->bytes_may_use -= bytes;
+        BTRFS_I(inode)->reserved_bytes -= bytes;
+        spin_unlock(&data_sinfo->lock);
+}
+
+/* called when we are adding a delalloc extent to the inode's io_tree */
+void btrfs_delalloc_reserve_space(struct btrfs_root *root, struct inode *inode,
+                                  u64 bytes)
+{
+        struct btrfs_space_info *data_sinfo;
+
+        /* get the space info for where this inode will be storing its data */
+        data_sinfo = BTRFS_I(inode)->space_info;
+
+        /* make sure we have enough space to handle the data first */
+        spin_lock(&data_sinfo->lock);
+        data_sinfo->bytes_delalloc += bytes;
+
+        /*
+         * we are adding a delalloc extent without calling
+         * btrfs_check_data_free_space first.  This happens on a weird
+         * writepage condition, but shouldn't hurt our accounting
+         */
+        if (unlikely(bytes > BTRFS_I(inode)->reserved_bytes)) {
+                data_sinfo->bytes_may_use -= BTRFS_I(inode)->reserved_bytes;
+                BTRFS_I(inode)->reserved_bytes = 0;
+        } else {
+                data_sinfo->bytes_may_use -= bytes;
+                BTRFS_I(inode)->reserved_bytes -= bytes;
+        }
+
+        spin_unlock(&data_sinfo->lock);
+}
+
+/* called when we are clearing an delalloc extent from the inode's io_tree */
+void btrfs_delalloc_free_space(struct btrfs_root *root, struct inode *inode,
+                              u64 bytes)
+{
+        struct btrfs_space_info *info;
+
+        info = BTRFS_I(inode)->space_info;
+
+        spin_lock(&info->lock);
+        info->bytes_delalloc -= bytes;
+        spin_unlock(&info->lock);
+}
+
 static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 alloc_bytes,
                           u64 flags, int force)
@@ -3105,6 +3337,10 @@ static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
                (unsigned long long)(info->total_bytes - info->bytes_used -
                                     info->bytes_pinned - info->bytes_reserved),
                (info->full) ? "" : "not ");
+        printk(KERN_INFO "space_info total=%llu, pinned=%llu, delalloc=%llu,"
+               " may_use=%llu, used=%llu\n", info->total_bytes,
+               info->bytes_pinned, info->bytes_delalloc, info->bytes_may_use,
+               info->bytes_used);
 
         down_read(&info->groups_sem);
         list_for_each_entry(cache, &info->block_groups, list) {
@@ -3131,24 +3367,10 @@ static int __btrfs_reserve_extent(struct btrfs_trans_handle *trans,
 {
         int ret;
         u64 search_start = 0;
-        u64 alloc_profile;
         struct btrfs_fs_info *info = root->fs_info;
 
-        if (data) {
-                alloc_profile = info->avail_data_alloc_bits &
-                        info->data_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_DATA | alloc_profile;
-        } else if (root == root->fs_info->chunk_root) {
-                alloc_profile = info->avail_system_alloc_bits &
-                        info->system_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_SYSTEM | alloc_profile;
-        } else {
-                alloc_profile = info->avail_metadata_alloc_bits &
-                        info->metadata_alloc_profile;
-                data = BTRFS_BLOCK_GROUP_METADATA | alloc_profile;
-        }
+        data = btrfs_get_alloc_profile(root, data);
 again:
-        data = btrfs_reduce_alloc_profile(root, data);
         /*
          * the only place that sets empty_size is btrfs_realloc_node, which
          * is not called recursively on allocations
@@ -4196,13 +4418,13 @@ int btrfs_drop_subtree(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         BUG_ON(!path);
 
-        BUG_ON(!btrfs_tree_locked(parent));
+        btrfs_assert_tree_locked(parent);
         parent_level = btrfs_header_level(parent);
         extent_buffer_get(parent);
         path->nodes[parent_level] = parent;
         path->slots[parent_level] = btrfs_header_nritems(parent);
 
-        BUG_ON(!btrfs_tree_locked(node));
+        btrfs_assert_tree_locked(node);
         level = btrfs_header_level(node);
         extent_buffer_get(node);
         path->nodes[level] = node;
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 872f104576e5..dc78954861b3 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1091,19 +1091,24 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 WARN_ON(num_pages > nrptrs);
                 memset(pages, 0, sizeof(struct page *) * nrptrs);
 
-                ret = btrfs_check_free_space(root, write_bytes, 0);
+                ret = btrfs_check_data_free_space(root, inode, write_bytes);
                 if (ret)
                         goto out;
 
                 ret = prepare_pages(root, file, pages, num_pages,
                                     pos, first_index, last_index,
                                     write_bytes);
-                if (ret)
+                if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         goto out;
+                }
 
                 ret = btrfs_copy_from_user(pos, num_pages,
                                            write_bytes, pages, buf);
                 if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         btrfs_drop_pages(pages, num_pages);
                         goto out;
                 }
@@ -1111,8 +1116,11 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
                 ret = dirty_and_release_pages(NULL, root, file, pages,
                                               num_pages, pos, write_bytes);
                 btrfs_drop_pages(pages, num_pages);
-                if (ret)
+                if (ret) {
+                        btrfs_free_reserved_data_space(root, inode,
+                                                       write_bytes);
                         goto out;
+                }
 
                 if (will_write) {
                         btrfs_fdatawrite_range(inode->i_mapping, pos,
@@ -1136,6 +1144,8 @@ static ssize_t btrfs_file_write(struct file *file, const char __user *buf,
         }
 out:
         mutex_unlock(&inode->i_mutex);
+        if (ret)
+                err = ret;
 
 out_nolock:
         kfree(pages);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 3cee77ae03c8..7d4f948bc22a 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -102,34 +102,6 @@ static int btrfs_init_inode_security(struct inode *inode,  struct inode *dir)
 }
 
 /*
- * a very lame attempt at stopping writes when the FS is 85% full.  There
- * are countless ways this is incorrect, but it is better than nothing.
- */
-int btrfs_check_free_space(struct btrfs_root *root, u64 num_required,
-                           int for_del)
-{
-        u64 total;
-        u64 used;
-        u64 thresh;
-        int ret = 0;
-
-        spin_lock(&root->fs_info->delalloc_lock);
-        total = btrfs_super_total_bytes(&root->fs_info->super_copy);
-        used = btrfs_super_bytes_used(&root->fs_info->super_copy);
-        if (for_del)
-                thresh = total * 90;
-        else
-                thresh = total * 85;
-
-        do_div(thresh, 100);
-
-        if (used + root->fs_info->delalloc_bytes + num_required > thresh)
-                ret = -ENOSPC;
-        spin_unlock(&root->fs_info->delalloc_lock);
-        return ret;
-}
-
-/*
  * this does all the hard work for inserting an inline extent into
  * the btree.  The caller should have done a btrfs_drop_extents so that
  * no overlapping inline items exist in the btree
@@ -1190,6 +1162,7 @@ static int btrfs_set_bit_hook(struct inode *inode, u64 start, u64 end,
          */
         if (!(old & EXTENT_DELALLOC) && (bits & EXTENT_DELALLOC)) {
                 struct btrfs_root *root = BTRFS_I(inode)->root;
+                btrfs_delalloc_reserve_space(root, inode, end - start + 1);
                 spin_lock(&root->fs_info->delalloc_lock);
                 BTRFS_I(inode)->delalloc_bytes += end - start + 1;
                 root->fs_info->delalloc_bytes += end - start + 1;
@@ -1223,9 +1196,12 @@ static int btrfs_clear_bit_hook(struct inode *inode, u64 start, u64 end,
                                (unsigned long long)end - start + 1,
                                (unsigned long long)
                                root->fs_info->delalloc_bytes);
+                        btrfs_delalloc_free_space(root, inode, (u64)-1);
                         root->fs_info->delalloc_bytes = 0;
                         BTRFS_I(inode)->delalloc_bytes = 0;
                 } else {
+                        btrfs_delalloc_free_space(root, inode,
+                                                  end - start + 1);
                         root->fs_info->delalloc_bytes -= end - start + 1;
                         BTRFS_I(inode)->delalloc_bytes -= end - start + 1;
                 }
@@ -2245,10 +2221,6 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
 
         root = BTRFS_I(dir)->root;
 
-        ret = btrfs_check_free_space(root, 1, 1);
-        if (ret)
-                goto fail;
-
         trans = btrfs_start_transaction(root, 1);
 
         btrfs_set_trans_block_group(trans, dir);
@@ -2261,7 +2233,6 @@ static int btrfs_unlink(struct inode *dir, struct dentry *dentry)
         nr = trans->blocks_used;
 
         btrfs_end_transaction_throttle(trans, root);
-fail:
         btrfs_btree_balance_dirty(root, nr);
         return ret;
 }
@@ -2284,10 +2255,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
                 return -ENOTEMPTY;
         }
 
-        ret = btrfs_check_free_space(root, 1, 1);
-        if (ret)
-                goto fail;
-
         trans = btrfs_start_transaction(root, 1);
         btrfs_set_trans_block_group(trans, dir);
 
@@ -2304,7 +2271,6 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
 fail_trans:
         nr = trans->blocks_used;
         ret = btrfs_end_transaction_throttle(trans, root);
-fail:
         btrfs_btree_balance_dirty(root, nr);
 
         if (ret && !err)
@@ -2818,7 +2784,7 @@ int btrfs_cont_expand(struct inode *inode, loff_t size)
         if (size <= hole_start)
                 return 0;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 return err;
 
@@ -3014,6 +2980,7 @@ static noinline void init_btrfs_i(struct inode *inode)
         bi->last_trans = 0;
         bi->logged_trans = 0;
         bi->delalloc_bytes = 0;
+        bi->reserved_bytes = 0;
         bi->disk_i_size = 0;
         bi->flags = 0;
         bi->index_cnt = (u64)-1;
@@ -3035,6 +3002,7 @@ static int btrfs_init_locked_inode(struct inode *inode, void *p)
         inode->i_ino = args->ino;
         init_btrfs_i(inode);
         BTRFS_I(inode)->root = args->root;
+        btrfs_set_inode_space_info(args->root, inode);
         return 0;
 }
 
@@ -3455,6 +3423,7 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
         BTRFS_I(inode)->index_cnt = 2;
         BTRFS_I(inode)->root = root;
         BTRFS_I(inode)->generation = trans->transid;
+        btrfs_set_inode_space_info(root, inode);
 
         if (mode & S_IFDIR)
                 owner = 0;
@@ -3602,7 +3571,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         if (!new_valid_dev(rdev))
                 return -EINVAL;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
 
@@ -3665,7 +3634,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         u64 objectid;
         u64 index = 0;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
         trans = btrfs_start_transaction(root, 1);
@@ -3733,7 +3702,7 @@ static int btrfs_link(struct dentry *old_dentry, struct inode *dir,
                 return -ENOENT;
 
         btrfs_inc_nlink(inode);
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto fail;
         err = btrfs_set_inode_index(dir, &index);
@@ -3779,7 +3748,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         u64 index = 0;
         unsigned long nr = 1;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto out_unlock;
 
@@ -4336,7 +4305,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct page *page)
         u64 page_start;
         u64 page_end;
 
-        ret = btrfs_check_free_space(root, PAGE_CACHE_SIZE, 0);
+        ret = btrfs_check_data_free_space(root, inode, PAGE_CACHE_SIZE);
         if (ret)
                 goto out;
 
@@ -4349,6 +4318,7 @@ again:
 
         if ((page->mapping != inode->i_mapping) ||
             (page_start >= size)) {
+                btrfs_free_reserved_data_space(root, inode, PAGE_CACHE_SIZE);
                 /* page got truncated out from underneath us */
                 goto out_unlock;
         }
@@ -4631,7 +4601,7 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
         if (old_inode->i_ino == BTRFS_FIRST_FREE_OBJECTID)
                 return -EXDEV;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto out_unlock;
 
@@ -4749,7 +4719,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
         if (name_len > BTRFS_MAX_INLINE_DATA_SIZE(root))
                 return -ENAMETOOLONG;
 
-        err = btrfs_check_free_space(root, 1, 0);
+        err = btrfs_check_metadata_free_space(root);
         if (err)
                 goto out_fail;
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 988fdc8b49eb..bca729fc80c8 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -70,7 +70,7 @@ static noinline int create_subvol(struct btrfs_root *root,
         u64 index = 0;
         unsigned long nr = 1;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto fail_commit;
 
@@ -203,7 +203,7 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
         if (!root->ref_cows)
                 return -EINVAL;
 
-        ret = btrfs_check_free_space(root, 1, 0);
+        ret = btrfs_check_metadata_free_space(root);
         if (ret)
                 goto fail_unlock;
 
@@ -374,7 +374,7 @@ static int btrfs_defrag_file(struct file *file)
         unsigned long i;
         int ret;
 
-        ret = btrfs_check_free_space(root, inode->i_size, 0);
+        ret = btrfs_check_data_free_space(root, inode, inode->i_size);
         if (ret)
                 return -ENOSPC;
 
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 85506c4a3af7..47b0a88c12a2 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -220,8 +220,8 @@ int btrfs_tree_unlock(struct extent_buffer *eb)
         return 0;
 }
 
-int btrfs_tree_locked(struct extent_buffer *eb)
+void btrfs_assert_tree_locked(struct extent_buffer *eb)
 {
-        return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
-                        spin_is_locked(&eb->lock);
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                assert_spin_locked(&eb->lock);
 }
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index 6bb0afbff928..6c4ce457168c 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -21,11 +21,11 @@
 
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
-int btrfs_tree_locked(struct extent_buffer *eb);
 
 int btrfs_try_tree_lock(struct extent_buffer *eb);
 int btrfs_try_spin_lock(struct extent_buffer *eb);
 
 void btrfs_set_lock_blocking(struct extent_buffer *eb);
 void btrfs_clear_lock_blocking(struct extent_buffer *eb);
+void btrfs_assert_tree_locked(struct extent_buffer *eb);
 #endif
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 39bd4d38e889..45e59d3c7f1f 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -1913,6 +1913,9 @@ COMPATIBLE_IOCTL(FIONREAD)  /* This is also TIOCINQ */
 /* 0x00 */
 COMPATIBLE_IOCTL(FIBMAP)
 COMPATIBLE_IOCTL(FIGETBSZ)
+/* 'X' - originally XFS but some now in the VFS */
+COMPATIBLE_IOCTL(FIFREEZE)
+COMPATIBLE_IOCTL(FITHAW)
 /* RAID */
 COMPATIBLE_IOCTL(RAID_VERSION)
 COMPATIBLE_IOCTL(GET_ARRAY_INFO)
diff --git a/fs/dcache.c b/fs/dcache.c
index 937df0fb0da5..07e2d4a44bda 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1180,7 +1180,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
         iput(inode);
         return res;
 }
-EXPORT_SYMBOL_GPL(d_obtain_alias);
+EXPORT_SYMBOL(d_obtain_alias);
 
 /**
  * d_splice_alias - splice a disconnected dentry into the tree if one exists
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 5f3231b9633f..bff4052b05e7 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -198,9 +198,6 @@ static int mknod_ptmx(struct super_block *sb)
 
         fsi->ptmx_dentry = dentry;
         rc = 0;
-
-        printk(KERN_DEBUG "Created ptmx node in devpts ino %lu\n",
-                        inode->i_ino);
 out:
         mutex_unlock(&root->d_inode->i_mutex);
         return rc;
@@ -369,8 +366,6 @@ static int new_pts_mount(struct file_system_type *fs_type, int flags,
         struct pts_fs_info *fsi;
         struct pts_mount_opts *opts;
 
-        printk(KERN_NOTICE "devpts: newinstance mount\n");
-
         err = get_sb_nodev(fs_type, flags, data, devpts_fill_super, mnt);
         if (err)
                 return err;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 9a50b8052dcf..de9459b4cb94 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -609,7 +609,9 @@ int ext4_claim_free_blocks(struct ext4_sb_info *sbi,
  */
 int ext4_should_retry_alloc(struct super_block *sb, int *retries)
 {
-        if (!ext4_has_free_blocks(EXT4_SB(sb), 1) || (*retries)++ > 3)
+        if (!ext4_has_free_blocks(EXT4_SB(sb), 1) ||
+            (*retries)++ > 3 ||
+            !EXT4_SB(sb)->s_journal)
                 return 0;
 
         jbd_debug(1, "%s: retrying operation after ENOSPC\n", sb->s_id);
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 4fb86a0061d0..627f8c3337a3 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -188,7 +188,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
         struct ext4_group_desc *gdp;
         struct ext4_super_block *es;
         struct ext4_sb_info *sbi;
-        int fatal = 0, err, count;
+        int fatal = 0, err, count, cleared;
         ext4_group_t flex_group;
 
         if (atomic_read(&inode->i_count) > 1) {
@@ -248,8 +248,10 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
                 goto error_return;
 
         /* Ok, now we can actually update the inode bitmaps.. */
-        if (!ext4_clear_bit_atomic(sb_bgl_lock(sbi, block_group),
-                                        bit, bitmap_bh->b_data))
+        spin_lock(sb_bgl_lock(sbi, block_group));
+        cleared = ext4_clear_bit(bit, bitmap_bh->b_data);
+        spin_unlock(sb_bgl_lock(sbi, block_group));
+        if (!cleared)
                 ext4_error(sb, "ext4_free_inode",
                            "bit already cleared for inode %lu", ino);
         else {
@@ -715,6 +717,13 @@ struct inode *ext4_new_inode(handle_t *handle, struct inode *dir, int mode)
 
         if (sbi->s_log_groups_per_flex) {
                 ret2 = find_group_flex(sb, dir, &group);
+                if (ret2 == -1) {
+                        ret2 = find_group_other(sb, dir, &group);
+                        if (ret2 == 0 && printk_ratelimit())
+                                printk(KERN_NOTICE "ext4: find_group_flex "
+                                       "failed, fallback succeeded dir %lu\n",
+                                       dir->i_ino);
+                }
                 goto got_group;
         }
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index cbd2ca99d113..c7fed5b18745 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1368,6 +1368,10 @@ retry:
                 goto out;
         }
 
+        /* We cannot recurse into the filesystem as the transaction is already
+         * started */
+        flags |= AOP_FLAG_NOFS;
+
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page) {
                 ext4_journal_stop(handle);
@@ -1377,7 +1381,7 @@ retry:
         *pagep = page;
 
         ret = block_write_begin(file, mapping, pos, len, flags, pagep, fsdata,
-                                                        ext4_get_block);
+                                ext4_get_block);
 
         if (!ret && ext4_should_journal_data(inode)) {
                 ret = walk_page_buffers(handle, page_buffers(page),
@@ -2540,7 +2544,7 @@ retry:
 
                 ext4_journal_stop(handle);
 
-                if (mpd.retval == -ENOSPC) {
+                if ((mpd.retval == -ENOSPC) && sbi->s_journal) {
                         /* commit the transaction which would
                          * free blocks released in the transaction
                          * and try again
@@ -2667,6 +2671,9 @@ retry:
                 ret = PTR_ERR(handle);
                 goto out;
         }
+        /* We cannot recurse into the filesystem as the transaction is already
+         * started */
+        flags |= AOP_FLAG_NOFS;
 
         page = grab_cache_page_write_begin(mapping, index, flags);
         if (!page) {
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index a5732c58f676..39d1993cfa13 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3091,7 +3091,6 @@ static int ext4_freeze(struct super_block *sb)
 
                 /* Journal blocked and flushed, clear needs_recovery flag. */
                 EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
-                ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
                 error = ext4_commit_super(sb, EXT4_SB(sb)->s_es, 1);
                 if (error)
                         goto out;
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 6b74d09adbe5..de0004fe6e00 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -202,9 +202,9 @@ static sector_t _fat_bmap(struct address_space *mapping, sector_t block)
         sector_t blocknr;
 
         /* fat_get_cluster() assumes the requested blocknr isn't truncated. */
-        mutex_lock(&mapping->host->i_mutex);
+        down_read(&mapping->host->i_alloc_sem);
         blocknr = generic_block_bmap(mapping, block, fat_get_block);
-        mutex_unlock(&mapping->host->i_mutex);
+        up_read(&mapping->host->i_alloc_sem);
 
         return blocknr;
 }
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index e5eaa62fd17f..e3fe9918faaf 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -274,6 +274,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         int ret;
 
         BUG_ON(inode->i_state & I_SYNC);
+        WARN_ON(inode->i_state & I_NEW);
 
         /* Set I_SYNC, reset I_DIRTY */
         dirty = inode->i_state & I_DIRTY;
@@ -298,6 +299,7 @@ __sync_single_inode(struct inode *inode, struct writeback_control *wbc)
         }
 
         spin_lock(&inode_lock);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state &= ~I_SYNC;
         if (!(inode->i_state & I_FREEING)) {
                 if (!(inode->i_state & I_DIRTY) &&
@@ -470,6 +472,11 @@ void generic_sync_sb_inodes(struct super_block *sb,
                         break;
                 }
 
+                if (inode->i_state & I_NEW) {
+                        requeue_io(inode);
+                        continue;
+                }
+
                 if (wbc->nonblocking && bdi_write_congested(bdi)) {
                         wbc->encountered_congestion = 1;
                         if (!sb_is_blkdev_sb(sb))
@@ -531,7 +538,7 @@ void generic_sync_sb_inodes(struct super_block *sb,
                 list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                         struct address_space *mapping;
 
-                        if (inode->i_state & (I_FREEING|I_WILL_FREE))
+                        if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
                                 continue;
                         mapping = inode->i_mapping;
                         if (mapping->nrpages == 0)
diff --git a/fs/inode.c b/fs/inode.c
index 913ab2d9a5d1..826fb0b9d1c3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -359,6 +359,7 @@ static int invalidate_list(struct list_head *head, struct list_head *dispose)
                 invalidate_inode_buffers(inode);
                 if (!atomic_read(&inode->i_count)) {
                         list_move(&inode->i_list, dispose);
+                        WARN_ON(inode->i_state & I_NEW);
                         inode->i_state |= I_FREEING;
                         count++;
                         continue;
@@ -460,6 +461,7 @@ static void prune_icache(int nr_to_scan)
                                 continue;
                 }
                 list_move(&inode->i_list, &freeable);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_FREEING;
                 nr_pruned++;
         }
@@ -656,6 +658,7 @@ void unlock_new_inode(struct inode *inode)
          * just created it (so there can be no old holders
          * that haven't tested I_LOCK).
          */
+        WARN_ON((inode->i_state & (I_LOCK|I_NEW)) != (I_LOCK|I_NEW));
         inode->i_state &= ~(I_LOCK|I_NEW);
         wake_up_inode(inode);
 }
@@ -1145,6 +1148,7 @@ void generic_delete_inode(struct inode *inode)
 
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
@@ -1186,16 +1190,19 @@ static void generic_forget_inode(struct inode *inode)
                         spin_unlock(&inode_lock);
                         return;
                 }
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state |= I_WILL_FREE;
                 spin_unlock(&inode_lock);
                 write_inode_now(inode, 1);
                 spin_lock(&inode_lock);
+                WARN_ON(inode->i_state & I_NEW);
                 inode->i_state &= ~I_WILL_FREE;
                 inodes_stat.nr_unused--;
                 hlist_del_init(&inode->i_hash);
         }
         list_del_init(&inode->i_list);
         list_del_init(&inode->i_sb_list);
+        WARN_ON(inode->i_state & I_NEW);
         inode->i_state |= I_FREEING;
         inodes_stat.nr_inodes--;
         spin_unlock(&inode_lock);
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 3cceef4ad2b7..e9580104b6ba 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -95,13 +95,17 @@ static int jffs2_garbage_collect_thread(void *_c)
                         spin_unlock(&c->erase_completion_lock);
                         
 
-                /* This thread is purely an optimisation. But if it runs when
-                   other things could be running, it actually makes things a
-                   lot worse. Use yield() and put it at the back of the runqueue
-                   every time. Especially during boot, pulling an inode in
-                   with read_inode() is much preferable to having the GC thread
-                   get there first. */
-                yield();
+                /* Problem - immediately after bootup, the GCD spends a lot
+                 * of time in places like jffs2_kill_fragtree(); so much so
+                 * that userspace processes (like gdm and X) are starved
+                 * despite plenty of cond_resched()s and renicing.  Yield()
+                 * doesn't help, either (presumably because userspace and GCD
+                 * are generally competing for a higher latency resource -
+                 * disk).
+                 * This forces the GCD to slow the hell down.   Pulling an
+                 * inode in with read_inode() is much preferable to having
+                 * the GC thread get there first. */
+                schedule_timeout_interruptible(msecs_to_jiffies(50));
 
                 /* Put_super will send a SIGKILL and then wait on the sem.
                  */
diff --git a/fs/jffs2/readinode.c b/fs/jffs2/readinode.c
index 6ca08ad887c0..1fc1e92356ee 100644
--- a/fs/jffs2/readinode.c
+++ b/fs/jffs2/readinode.c
@@ -220,7 +220,7 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                                 struct jffs2_tmp_dnode_info *tn)
 {
         uint32_t fn_end = tn->fn->ofs + tn->fn->size;
-        struct jffs2_tmp_dnode_info *this;
+        struct jffs2_tmp_dnode_info *this, *ptn;
 
         dbg_readinode("insert fragment %#04x-%#04x, ver %u at %08x\n", tn->fn->ofs, fn_end, tn->version, ref_offset(tn->fn->raw));
 
@@ -251,11 +251,18 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
         if (this) {
                 /* If the node is coincident with another at a lower address,
                    back up until the other node is found. It may be relevant */
-                while (this->overlapped)
-                        this = tn_prev(this);
-
-                /* First node should never be marked overlapped */
-                BUG_ON(!this);
+                while (this->overlapped) {
+                        ptn = tn_prev(this);
+                        if (!ptn) {
+                                /*
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
+                }
                 dbg_readinode("'this' found %#04x-%#04x (%s)\n", this->fn->ofs, this->fn->ofs + this->fn->size, this->fn ? "data" : "hole");
         }
 
@@ -360,7 +367,17 @@ static int jffs2_add_tn_to_tree(struct jffs2_sb_info *c,
                         }
                         if (!this->overlapped)
                                 break;
-                        this = tn_prev(this);
+
+                        ptn = tn_prev(this);
+                        if (!ptn) {
+                                /*
+                                 * We killed a node which set the overlapped
+                                 * flags during the scan. Fix it up.
+                                 */
+                                this->overlapped = 0;
+                                break;
+                        }
+                        this = ptn;
                 }
         }
 
@@ -456,8 +473,15 @@ static int jffs2_build_inode_fragtree(struct jffs2_sb_info *c,
                 eat_last(&rii->tn_root, &last->rb);
                 ver_insert(&ver_root, last);
 
-                if (unlikely(last->overlapped))
-                        continue;
+                if (unlikely(last->overlapped)) {
+                        if (pen)
+                                continue;
+                        /*
+                         * We killed a node which set the overlapped
+                         * flags during the scan. Fix it up.
+                         */
+                        last->overlapped = 0;
+                }
 
                 /* Now we have a bunch of nodes in reverse version
                    order, in the tree at ver_root. Most of the time,
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 60fe74035db5..3a9e5deed74d 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -4796,6 +4796,29 @@ out:
         return ret;
 }
 
+static int ocfs2_replace_extent_rec(struct inode *inode,
+                                    handle_t *handle,
+                                    struct ocfs2_path *path,
+                                    struct ocfs2_extent_list *el,
+                                    int split_index,
+                                    struct ocfs2_extent_rec *split_rec)
+{
+        int ret;
+
+        ret = ocfs2_path_bh_journal_access(handle, inode, path,
+                                           path_num_items(path) - 1);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
+        }
+
+        el->l_recs[split_index] = *split_rec;
+
+        ocfs2_journal_dirty(handle, path_leaf_bh(path));
+out:
+        return ret;
+}
+
 /*
  * Mark part or all of the extent record at split_index in the leaf
  * pointed to by path as written. This removes the unwritten
@@ -4885,7 +4908,9 @@ static int __ocfs2_mark_extent_written(struct inode *inode,
 
         if (ctxt.c_contig_type == CONTIG_NONE) {
                 if (ctxt.c_split_covers_rec)
-                        el->l_recs[split_index] = *split_rec;
+                        ret = ocfs2_replace_extent_rec(inode, handle,
+                                                       path, el,
+                                                       split_index, split_rec);
                 else
                         ret = ocfs2_split_and_insert(inode, handle, path, et,
                                                      &last_eb_bh, split_index,
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 54e182a27caf..0a2813947853 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1849,12 +1849,12 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
                 if (!mle) {
                         if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN &&
                             res->owner != assert->node_idx) {
-                                mlog(ML_ERROR, "assert_master from "
-                                          "%u, but current owner is "
-                                          "%u! (%.*s)\n",
-                                       assert->node_idx, res->owner,
-                                       namelen, name);
-                                goto kill;
+                                mlog(ML_ERROR, "DIE! Mastery assert from %u, "
+                                     "but current owner is %u! (%.*s)\n",
+                                     assert->node_idx, res->owner, namelen,
+                                     name);
+                                __dlm_print_one_lock_resource(res);
+                                BUG();
                         }
                 } else if (mle->type != DLM_MLE_MIGRATION) {
                         if (res->owner != DLM_LOCK_RES_OWNER_UNKNOWN) {
diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
index d1295203029f..4060bb328bc8 100644
--- a/fs/ocfs2/dlm/dlmthread.c
+++ b/fs/ocfs2/dlm/dlmthread.c
@@ -181,8 +181,7 @@ static int dlm_purge_lockres(struct dlm_ctxt *dlm,
 
                 spin_lock(&res->spinlock);
                 /* This ensures that clear refmap is sent after the set */
-                __dlm_wait_on_lockres_flags(res, (DLM_LOCK_RES_SETREF_INPROG |
-                                                  DLM_LOCK_RES_MIGRATING));
+                __dlm_wait_on_lockres_flags(res, DLM_LOCK_RES_SETREF_INPROG);
                 spin_unlock(&res->spinlock);
 
                 /* clear our bit from the master's refmap, ignore errors */
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 86ca085ef324..fcf879ed6930 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -117,11 +117,11 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
         else
                 BUG_ON(res->owner == dlm->node_num);
 
-        spin_lock(&dlm->spinlock);
+        spin_lock(&dlm->ast_lock);
         /* We want to be sure that we're not freeing a lock
          * that still has AST's pending... */
         in_use = !list_empty(&lock->ast_list);
-        spin_unlock(&dlm->spinlock);
+        spin_unlock(&dlm->ast_lock);
         if (in_use) {
                mlog(ML_ERROR, "lockres %.*s: Someone is calling dlmunlock "
                     "while waiting for an ast!", res->lockname.len,
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 206a2370876a..7219a86d34cc 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -320,9 +320,14 @@ static void ocfs2_schedule_blocked_lock(struct ocfs2_super *osb,
                                         struct ocfs2_lock_res *lockres);
 static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
                                                 int convert);
-#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                 \
-        mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n", \
-             _err, _func, _lockres->l_name);                            \
+#define ocfs2_log_dlm_error(_func, _err, _lockres) do {                                 \
+        if ((_lockres)->l_type != OCFS2_LOCK_TYPE_DENTRY)                               \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %s\n",        \
+                     _err, _func, _lockres->l_name);                                    \
+        else                                                                            \
+                mlog(ML_ERROR, "DLM error %d while calling %s on resource %.*s%08x\n",  \
+                     _err, _func, OCFS2_DENTRY_LOCK_INO_START - 1, (_lockres)->l_name,  \
+                     (unsigned int)ocfs2_get_dentry_lock_ino(_lockres));                \
 } while (0)
 static int ocfs2_downconvert_thread(void *arg);
 static void ocfs2_downconvert_on_unlock(struct ocfs2_super *osb,
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 077384135f4e..946d3c34b90b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -341,6 +341,9 @@ struct ocfs2_super
         struct ocfs2_node_map           osb_recovering_orphan_dirs;
         unsigned int                    *osb_orphan_wipes;
         wait_queue_head_t               osb_wipe_event;
+
+        /* used to protect metaecc calculation check of xattr. */
+        spinlock_t osb_xattr_lock;
 };
 
 #define OCFS2_SB(sb)        ((struct ocfs2_super *)(sb)->s_fs_info)
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index b1cb38fbe807..7ac83a81ee55 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1537,6 +1537,13 @@ static int ocfs2_get_sector(struct super_block *sb,
         unlock_buffer(*bh);
         ll_rw_block(READ, 1, bh);
         wait_on_buffer(*bh);
+        if (!buffer_uptodate(*bh)) {
+                mlog_errno(-EIO);
+                brelse(*bh);
+                *bh = NULL;
+                return -EIO;
+        }
+
         return 0;
 }
 
@@ -1747,6 +1754,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
         INIT_LIST_HEAD(&osb->blocked_lock_list);
         osb->blocked_lock_count = 0;
         spin_lock_init(&osb->osb_lock);
+        spin_lock_init(&osb->osb_xattr_lock);
         ocfs2_init_inode_steal_slot(osb);
 
         atomic_set(&osb->alloc_stats.moves, 0);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index 915039fffe6e..4ddd788add67 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -82,13 +82,14 @@ struct ocfs2_xattr_set_ctxt {
 
 #define OCFS2_XATTR_ROOT_SIZE   (sizeof(struct ocfs2_xattr_def_value_root))
 #define OCFS2_XATTR_INLINE_SIZE 80
+#define OCFS2_XATTR_HEADER_GAP  4
 #define OCFS2_XATTR_FREE_IN_IBODY       (OCFS2_MIN_XATTR_INLINE_SIZE \
                                          - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 #define OCFS2_XATTR_FREE_IN_BLOCK(ptr)  ((ptr)->i_sb->s_blocksize \
                                          - sizeof(struct ocfs2_xattr_block) \
                                          - sizeof(struct ocfs2_xattr_header) \
-                                         - sizeof(__u32))
+                                         - OCFS2_XATTR_HEADER_GAP)
 
 static struct ocfs2_xattr_def_value_root def_xv = {
         .xv.xr_list.l_count = cpu_to_le16(1),
@@ -274,10 +275,12 @@ static int ocfs2_read_xattr_bucket(struct ocfs2_xattr_bucket *bucket,
                                bucket->bu_blocks, bucket->bu_bhs, 0,
                                NULL);
         if (!rc) {
+                spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                 rc = ocfs2_validate_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                                  bucket->bu_bhs,
                                                  bucket->bu_blocks,
                                                  &bucket_xh(bucket)->xh_check);
+                spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
                 if (rc)
                         mlog_errno(rc);
         }
@@ -310,9 +313,11 @@ static void ocfs2_xattr_bucket_journal_dirty(handle_t *handle,
 {
         int i;
 
+        spin_lock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
         ocfs2_compute_meta_ecc_bhs(bucket->bu_inode->i_sb,
                                    bucket->bu_bhs, bucket->bu_blocks,
                                    &bucket_xh(bucket)->xh_check);
+        spin_unlock(&OCFS2_SB(bucket->bu_inode->i_sb)->osb_xattr_lock);
 
         for (i = 0; i < bucket->bu_blocks; i++)
                 ocfs2_journal_dirty(handle, bucket->bu_bhs[i]);
@@ -1507,7 +1512,7 @@ static int ocfs2_xattr_set_entry(struct inode *inode,
                 last += 1;
         }
 
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
         if (free < 0)
                 return -EIO;
 
@@ -2190,7 +2195,7 @@ static int ocfs2_xattr_can_be_in_inode(struct inode *inode,
                 last += 1;
         }
 
-        free = min_offs - ((void *)last - xs->base) - sizeof(__u32);
+        free = min_offs - ((void *)last - xs->base) - OCFS2_XATTR_HEADER_GAP;
         if (free < 0)
                 return 0;
 
@@ -2592,8 +2597,9 @@ static int __ocfs2_xattr_set_handle(struct inode *inode,
 
         if (!ret) {
                 /* Update inode ctime. */
-                ret = ocfs2_journal_access(ctxt->handle, inode, xis->inode_bh,
-                                           OCFS2_JOURNAL_ACCESS_WRITE);
+                ret = ocfs2_journal_access_di(ctxt->handle, inode,
+                                              xis->inode_bh,
+                                              OCFS2_JOURNAL_ACCESS_WRITE);
                 if (ret) {
                         mlog_errno(ret);
                         goto out;
@@ -5060,8 +5066,8 @@ try_again:
         xh_free_start = le16_to_cpu(xh->xh_free_start);
         header_size = sizeof(struct ocfs2_xattr_header) +
                         count * sizeof(struct ocfs2_xattr_entry);
-        max_free = OCFS2_XATTR_BUCKET_SIZE -
-                le16_to_cpu(xh->xh_name_value_len) - header_size;
+        max_free = OCFS2_XATTR_BUCKET_SIZE - header_size -
+                le16_to_cpu(xh->xh_name_value_len) - OCFS2_XATTR_HEADER_GAP;
 
         mlog_bug_on_msg(header_size > blocksize, "bucket %llu has header size "
                         "of %u which exceed block size\n",
@@ -5094,7 +5100,7 @@ try_again:
                         need = 0;
         }
 
-        free = xh_free_start - header_size;
+        free = xh_free_start - header_size - OCFS2_XATTR_HEADER_GAP;
         /*
          * We need to make sure the new name/value pair
          * can exist in the same block.
@@ -5127,7 +5133,8 @@ try_again:
                         }
 
                         xh_free_start = le16_to_cpu(xh->xh_free_start);
-                        free = xh_free_start - header_size;
+                        free = xh_free_start - header_size
+                                - OCFS2_XATTR_HEADER_GAP;
                         if (xh_free_start % blocksize < need)
                                 free -= xh_free_start % blocksize;
 
diff --git a/fs/pipe.c b/fs/pipe.c
index 3a48ba5179d5..14f502b89cf5 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -699,12 +699,12 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
         int retval;
 
         mutex_lock(&inode->i_mutex);
-
         retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
-
-        if (retval >= 0)
+        if (retval >= 0) {
                 retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
-
+                if (retval < 0) /* this can happen only if on == T */
+                        fasync_helper(-1, filp, 0, &pipe->fasync_readers);
+        }
         mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
diff --git a/fs/proc/page.c b/fs/proc/page.c
index 767d95a6d1b1..e9983837d08d 100644
--- a/fs/proc/page.c
+++ b/fs/proc/page.c
@@ -80,7 +80,7 @@ static const struct file_operations proc_kpagecount_operations = {
 #define KPF_RECLAIM    9
 #define KPF_BUDDY     10
 
-#define kpf_copy_bit(flags, srcpos, dstpos) (((flags >> srcpos) & 1) << dstpos)
+#define kpf_copy_bit(flags, dstpos, srcpos) (((flags >> srcpos) & 1) << dstpos)
 
 static ssize_t kpageflags_read(struct file *file, char __user *buf,
                              size_t count, loff_t *ppos)
@@ -107,7 +107,7 @@ static ssize_t kpageflags_read(struct file *file, char __user *buf,
                 else
                         kflags = ppage->flags;
 
-                uflags = kpf_copy_bit(KPF_LOCKED, PG_locked, kflags) |
+                uflags = kpf_copy_bit(kflags, KPF_LOCKED, PG_locked) |
                         kpf_copy_bit(kflags, KPF_ERROR, PG_error) |
                         kpf_copy_bit(kflags, KPF_REFERENCED, PG_referenced) |
                         kpf_copy_bit(kflags, KPF_UPTODATE, PG_uptodate) |
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
index c837dfc2b3c6..2a7960310349 100644
--- a/fs/squashfs/block.c
+++ b/fs/squashfs/block.c
@@ -80,7 +80,7 @@ static struct buffer_head *get_block_length(struct super_block *sb,
  * generated a larger block - this does occasionally happen with zlib).
  */
 int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
-                        int length, u64 *next_index, int srclength)
+                        int length, u64 *next_index, int srclength, int pages)
 {
         struct squashfs_sb_info *msblk = sb->s_fs_info;
         struct buffer_head **bh;
@@ -184,7 +184,7 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                 offset = 0;
                         }
 
-                        if (msblk->stream.avail_out == 0) {
+                        if (msblk->stream.avail_out == 0 && page < pages) {
                                 msblk->stream.next_out = buffer[page++];
                                 msblk->stream.avail_out = PAGE_CACHE_SIZE;
                         }
@@ -201,25 +201,20 @@ int squashfs_read_data(struct super_block *sb, void **buffer, u64 index,
                                 zlib_init = 1;
                         }
 
-                        zlib_err = zlib_inflate(&msblk->stream, Z_NO_FLUSH);
+                        zlib_err = zlib_inflate(&msblk->stream, Z_SYNC_FLUSH);
 
                         if (msblk->stream.avail_in == 0 && k < b)
                                 put_bh(bh[k++]);
                 } while (zlib_err == Z_OK);
 
                 if (zlib_err != Z_STREAM_END) {
-                        ERROR("zlib_inflate returned unexpected result"
-                                " 0x%x, srclength %d, avail_in %d,"
-                                " avail_out %d\n", zlib_err, srclength,
-                                msblk->stream.avail_in,
-                                msblk->stream.avail_out);
+                        ERROR("zlib_inflate error, data probably corrupt\n");
                         goto release_mutex;
                 }
 
                 zlib_err = zlib_inflateEnd(&msblk->stream);
                 if (zlib_err != Z_OK) {
-                        ERROR("zlib_inflateEnd returned unexpected result 0x%x,"
-                                " srclength %d\n", zlib_err, srclength);
+                        ERROR("zlib_inflate error, data probably corrupt\n");
                         goto release_mutex;
                 }
                 length = msblk->stream.total_out;
@@ -268,7 +263,8 @@ block_release:
                 put_bh(bh[k]);
 
 read_failure:
-        ERROR("sb_bread failed reading block 0x%llx\n", cur_index);
+        ERROR("squashfs_read_data failed to read block 0x%llx\n",
+                                        (unsigned long long) index);
         kfree(bh);
         return -EIO;
 }
diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c
index f29eda16d25e..1c4739e33af6 100644
--- a/fs/squashfs/cache.c
+++ b/fs/squashfs/cache.c
@@ -119,7 +119,7 @@ struct squashfs_cache_entry *squashfs_cache_get(struct super_block *sb,
 
                         entry->length = squashfs_read_data(sb, entry->data,
                                 block, length, &entry->next_index,
-                                cache->block_size);
+                                cache->block_size, cache->pages);
 
                         spin_lock(&cache->lock);
 
@@ -406,7 +406,7 @@ int squashfs_read_table(struct super_block *sb, void *buffer, u64 block,
         for (i = 0; i < pages; i++, buffer += PAGE_CACHE_SIZE)
                 data[i] = buffer;
         res = squashfs_read_data(sb, data, block, length |
-                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length);
+                SQUASHFS_COMPRESSED_BIT_BLOCK, NULL, length, pages);
         kfree(data);
         return res;
 }
diff --git a/fs/squashfs/inode.c b/fs/squashfs/inode.c
index 7a63398bb855..9101dbde39ec 100644
--- a/fs/squashfs/inode.c
+++ b/fs/squashfs/inode.c
@@ -133,7 +133,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
         type = le16_to_cpu(sqshb_ino->inode_type);
         switch (type) {
         case SQUASHFS_REG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                 u64 frag_blk;
                 struct squashfs_reg_inode *sqsh_ino = &squashfs_ino.reg;
 
@@ -175,7 +176,8 @@ int squashfs_read_inode(struct inode *inode, long long ino)
                 break;
         }
         case SQUASHFS_LREG_TYPE: {
-                unsigned int frag_offset, frag_size, frag;
+                unsigned int frag_offset, frag;
+                int frag_size;
                 u64 frag_blk;
                 struct squashfs_lreg_inode *sqsh_ino = &squashfs_ino.lreg;
 
diff --git a/fs/squashfs/squashfs.h b/fs/squashfs/squashfs.h
index 6b2515d027d5..0e9feb6adf7e 100644
--- a/fs/squashfs/squashfs.h
+++ b/fs/squashfs/squashfs.h
@@ -34,7 +34,7 @@ static inline struct squashfs_inode_info *squashfs_i(struct inode *inode)
 
 /* block.c */
 extern int squashfs_read_data(struct super_block *, void **, u64, int, u64 *,
-                                int);
+                                int, int);
 
 /* cache.c */
 extern struct squashfs_cache *squashfs_cache_init(char *, int, int);
diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c
index 071df5b5b491..681ec0d83799 100644
--- a/fs/squashfs/super.c
+++ b/fs/squashfs/super.c
@@ -389,7 +389,7 @@ static int __init init_squashfs_fs(void)
                 return err;
         }
 
-        printk(KERN_INFO "squashfs: version 4.0 (2009/01/03) "
+        printk(KERN_INFO "squashfs: version 4.0 (2009/01/31) "
                 "Phillip Lougher\n");
 
         return 0;
diff --git a/fs/super.c b/fs/super.c
index 8349ed6b1412..6ce501447ada 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -371,8 +371,10 @@ retry:
                                 continue;
                         if (!grab_super(old))
                                 goto retry;
-                        if (s)
+                        if (s) {
+                                up_write(&s->s_umount);
                                 destroy_super(s);
+                        }
                         return old;
                 }
         }
@@ -387,6 +389,7 @@ retry:
         err = set(s, data);
         if (err) {
                 spin_unlock(&sb_lock);
+                up_write(&s->s_umount);
                 destroy_super(s);
                 return ERR_PTR(err);
         }
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index cb329edc925b..aa1016bb9134 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -34,6 +34,12 @@
 #include <linux/backing-dev.h>
 #include <linux/freezer.h>
 
+#include "xfs_sb.h"
+#include "xfs_inum.h"
+#include "xfs_ag.h"
+#include "xfs_dmapi.h"
+#include "xfs_mount.h"
+
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
 STATIC int xfsbufd_wakeup(int, gfp_t);
@@ -1435,10 +1441,12 @@ xfs_unregister_buftarg(
 
 void
 xfs_free_buftarg(
-        xfs_buftarg_t           *btp)
+        struct xfs_mount        *mp,
+        struct xfs_buftarg      *btp)
 {
         xfs_flush_buftarg(btp, 1);
-        xfs_blkdev_issue_flush(btp);
+        if (mp->m_flags & XFS_MOUNT_BARRIER)
+                xfs_blkdev_issue_flush(btp);
         xfs_free_bufhash(btp);
         iput(btp->bt_mapping->host);
 
diff --git a/fs/xfs/linux-2.6/xfs_buf.h b/fs/xfs/linux-2.6/xfs_buf.h
index 288ae7c4c800..9b4d666ad31f 100644
--- a/fs/xfs/linux-2.6/xfs_buf.h
+++ b/fs/xfs/linux-2.6/xfs_buf.h
@@ -413,7 +413,7 @@ static inline int XFS_bwrite(xfs_buf_t *bp)
  *      Handling of buftargs.
  */
 extern xfs_buftarg_t *xfs_alloc_buftarg(struct block_device *, int);
-extern void xfs_free_buftarg(xfs_buftarg_t *);
+extern void xfs_free_buftarg(struct xfs_mount *, struct xfs_buftarg *);
 extern void xfs_wait_buftarg(xfs_buftarg_t *);
 extern int xfs_setsize_buftarg(xfs_buftarg_t *, unsigned int, unsigned int);
 extern int xfs_flush_buftarg(xfs_buftarg_t *, int);
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index c71e226da7f5..32ae5028e96b 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -734,15 +734,15 @@ xfs_close_devices(
 {
         if (mp->m_logdev_targp && mp->m_logdev_targp != mp->m_ddev_targp) {
                 struct block_device *logdev = mp->m_logdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_logdev_targp);
+                xfs_free_buftarg(mp, mp->m_logdev_targp);
                 xfs_blkdev_put(logdev);
         }
         if (mp->m_rtdev_targp) {
                 struct block_device *rtdev = mp->m_rtdev_targp->bt_bdev;
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
                 xfs_blkdev_put(rtdev);
         }
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
 }
 
 /*
@@ -811,9 +811,9 @@ xfs_open_devices(
 
  out_free_rtdev_targ:
         if (mp->m_rtdev_targp)
-                xfs_free_buftarg(mp->m_rtdev_targp);
+                xfs_free_buftarg(mp, mp->m_rtdev_targp);
  out_free_ddev_targ:
-        xfs_free_buftarg(mp->m_ddev_targp);
+        xfs_free_buftarg(mp, mp->m_ddev_targp);
  out_close_rtdev:
         if (rtdev)
                 xfs_blkdev_put(rtdev);
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index e2fb6210d4c5..478e587087fe 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -246,9 +246,6 @@ xfs_iget_cache_miss(
                 goto out_destroy;
         }
 
-        if (lock_flags)
-                xfs_ilock(ip, lock_flags);
-
         /*
          * Preload the radix tree so we can insert safely under the
          * write spinlock. Note that we cannot sleep inside the preload
@@ -256,7 +253,16 @@ xfs_iget_cache_miss(
          */
         if (radix_tree_preload(GFP_KERNEL)) {
                 error = EAGAIN;
-                goto out_unlock;
+                goto out_destroy;
+        }
+
+        /*
+         * Because the inode hasn't been added to the radix-tree yet it can't
+         * be found by another thread, so we can do the non-sleeping lock here.
+         */
+        if (lock_flags) {
+                if (!xfs_ilock_nowait(ip, lock_flags))
+                        BUG();
         }
 
         mask = ~(((XFS_INODE_CLUSTER_SIZE(mp) >> mp->m_sb.sb_inodelog)) - 1);
@@ -284,7 +290,6 @@ xfs_iget_cache_miss(
 out_preload_end:
         write_unlock(&pag->pag_ici_lock);
         radix_tree_preload_end();
-out_unlock:
         if (lock_flags)
                 xfs_iunlock(ip, lock_flags);
 out_destroy:
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index b1047de2fffd..61af610d79b3 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1455,10 +1455,19 @@ xlog_recover_add_to_trans(
         item = item->ri_prev;
 
         if (item->ri_total == 0) {              /* first region to be added */
-                item->ri_total  = in_f->ilf_size;
-                ASSERT(item->ri_total <= XLOG_MAX_REGIONS_IN_ITEM);
-                item->ri_buf = kmem_zalloc((item->ri_total *
-                                            sizeof(xfs_log_iovec_t)), KM_SLEEP);
+                if (in_f->ilf_size == 0 ||
+                    in_f->ilf_size > XLOG_MAX_REGIONS_IN_ITEM) {
+                        xlog_warn(
+        "XFS: bad number of regions (%d) in inode log format",
+                                  in_f->ilf_size);
+                        ASSERT(0);
+                        return XFS_ERROR(EIO);
+                }
+
+                item->ri_total = in_f->ilf_size;
+                item->ri_buf =
+                        kmem_zalloc(item->ri_total * sizeof(xfs_log_iovec_t),
+                                    KM_SLEEP);
         }
         ASSERT(item->ri_total > item->ri_cnt);
         /* Description region is ri_buf[0] */
diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h
index 0b0d236c2154..c7d4b2e606a5 100644
--- a/include/drm/drm_crtc_helper.h
+++ b/include/drm/drm_crtc_helper.h
@@ -76,6 +76,7 @@ struct drm_encoder_helper_funcs {
         void (*mode_set)(struct drm_encoder *encoder,
                          struct drm_display_mode *mode,
                          struct drm_display_mode *adjusted_mode);
+        struct drm_crtc *(*get_crtc)(struct drm_encoder *encoder);
         /* detect for DAC style encoders */
         enum drm_connector_status (*detect)(struct drm_encoder *encoder,
                                             struct drm_connector *connector);
diff --git a/include/drm/drm_edid.h b/include/drm/drm_edid.h
index c707c15f5164..a11cc9d32591 100644
--- a/include/drm/drm_edid.h
+++ b/include/drm/drm_edid.h
@@ -58,10 +58,10 @@ struct detailed_pixel_timing {
         u8 hsync_pulse_width_lo;
         u8 vsync_pulse_width_lo:4;
         u8 vsync_offset_lo:4;
-        u8 hsync_pulse_width_hi:2;
-        u8 hsync_offset_hi:2;
         u8 vsync_pulse_width_hi:2;
         u8 vsync_offset_hi:2;
+        u8 hsync_pulse_width_hi:2;
+        u8 hsync_offset_hi:2;
         u8 width_mm_lo;
         u8 height_mm_lo;
         u8 height_mm_hi:4;
@@ -69,8 +69,8 @@ struct detailed_pixel_timing {
         u8 hborder;
         u8 vborder;
         u8 unknown0:1;
-        u8 vsync_positive:1;
         u8 hsync_positive:1;
+        u8 vsync_positive:1;
         u8 separate_sync:2;
         u8 stereo:1;
         u8 unknown6:1;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index b97cdc516a8f..106c3ba50844 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -52,6 +52,7 @@ header-y += const.h
 header-y += cgroupstats.h
 header-y += cramfs_fs.h
 header-y += cycx_cfm.h
+header-y += dcbnl.h
 header-y += dlmconstants.h
 header-y += dlm_device.h
 header-y += dlm_netlink.h
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 08a86d5cdf1b..9a061accd8b8 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -89,6 +89,8 @@ enum {
         ATA_ID_DLF              = 128,
         ATA_ID_CSFO             = 129,
         ATA_ID_CFA_POWER        = 160,
+        ATA_ID_CFA_KEY_MGMT     = 162,
+        ATA_ID_CFA_MODES        = 163,
         ATA_ID_ROT_SPEED        = 217,
         ATA_ID_PIO4             = (1 << 1),
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index dcaa0fd84b02..465d6babc847 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -708,6 +708,8 @@ struct req_iterator {
 };
 
 /* This should not be used directly - use rq_for_each_segment */
+#define for_each_bio(_bio)              \
+        for (; _bio; _bio = _bio->bi_next)
 #define __rq_for_each_bio(_bio, rq)     \
         if ((rq->bio))                  \
                 for (_bio = (rq)->bio; _bio; _bio = _bio->bi_next)
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 384b38d3e8e2..161042746afc 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -234,7 +234,6 @@ struct cpufreq_driver {
         int     (*suspend)      (struct cpufreq_policy *policy, pm_message_t pmsg);
         int     (*resume)       (struct cpufreq_policy *policy);
         struct freq_attr        **attr;
-        bool                    hide_interface;
 };
 
 /* flags */
diff --git a/include/linux/dcbnl.h b/include/linux/dcbnl.h
index b0ef274e0031..7d2e10006188 100644
--- a/include/linux/dcbnl.h
+++ b/include/linux/dcbnl.h
@@ -20,10 +20,12 @@
 #ifndef __LINUX_DCBNL_H__
 #define __LINUX_DCBNL_H__
 
+#include <linux/types.h>
+
 #define DCB_PROTO_VERSION 1
 
 struct dcbmsg {
-        unsigned char      dcb_family;
+        __u8               dcb_family;
         __u8               cmd;
         __u16              dcb_pad;
 };
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index f0413845f20e..1956c8d46d32 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -97,7 +97,6 @@ typedef struct { DECLARE_BITMAP(bits, DMA_TX_TYPE_END); } dma_cap_mask_t;
 
 /**
  * struct dma_chan_percpu - the per-CPU part of struct dma_chan
- * @refcount: local_t used for open-coded "bigref" counting
  * @memcpy_count: transaction counter
  * @bytes_transferred: byte counter
  */
@@ -114,9 +113,6 @@ struct dma_chan_percpu {
  * @cookie: last cookie value returned to client
  * @chan_id: channel ID for sysfs
  * @dev: class device for sysfs
- * @refcount: kref, used in "bigref" slow-mode
- * @slow_ref: indicates that the DMA channel is free
- * @rcu: the DMA channel's RCU head
  * @device_node: used to add this to the device chan list
  * @local: per-cpu pointer to a struct dma_chan_percpu
  * @client-count: how many clients are using this channel
@@ -213,8 +209,6 @@ struct dma_async_tx_descriptor {
  * @global_node: list_head for global dma_device_list
  * @cap_mask: one or more dma_capability flags
  * @max_xor: maximum number of xor sources, 0 if no capability
- * @refcount: reference count
- * @done: IO completion struct
  * @dev_id: unique device ID
  * @dev: struct device reference for dma mapping api
  * @device_alloc_chan_resources: allocate resources and return the
@@ -227,6 +221,7 @@ struct dma_async_tx_descriptor {
  * @device_prep_dma_interrupt: prepares an end of chain interrupt operation
  * @device_prep_slave_sg: prepares a slave dma operation
  * @device_terminate_all: terminate all pending operations
+ * @device_is_tx_complete: poll for transaction completion
  * @device_issue_pending: push pending transactions to hardware
  */
 struct dma_device {
diff --git a/include/linux/hdreg.h b/include/linux/hdreg.h
index c37e9241fae7..ed21bd3dbd25 100644
--- a/include/linux/hdreg.h
+++ b/include/linux/hdreg.h
@@ -511,7 +511,6 @@ struct hd_driveid {
         unsigned short  words69_70[2];  /* reserved words 69-70
                                          * future command overlap and queuing
                                          */
-        /* HDIO_GET_IDENTITY currently returns only words 0 through 70 */
         unsigned short  words71_74[4];  /* reserved words 71-74
                                          * for IDENTIFY PACKET DEVICE command
                                          */
diff --git a/include/linux/i2c-dev.h b/include/linux/i2c-dev.h
index 311315b56b61..fd53bfd26470 100644
--- a/include/linux/i2c-dev.h
+++ b/include/linux/i2c-dev.h
@@ -33,7 +33,7 @@
  */
 #define I2C_RETRIES     0x0701  /* number of times a device address should
                                    be polled when not acknowledging */
-#define I2C_TIMEOUT     0x0702  /* set timeout in jiffies - call with int */
+#define I2C_TIMEOUT     0x0702  /* set timeout in units of 10 ms */
 
 /* NOTE: Slave address is 7 or 10 bits, but 10-bit addresses
  * are NOT supported! (due to code brokenness)
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index fcfbfea3af72..c86c3b07604c 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -361,7 +361,7 @@ struct i2c_adapter {
         struct mutex bus_lock;
         struct mutex clist_lock;
 
-        int timeout;
+        int timeout;                    /* in jiffies */
         int retries;
         struct device dev;              /* the adapter device */
 
diff --git a/include/linux/ide.h b/include/linux/ide.h
index 194da5a4b0d6..e0cedfe9fad4 100644
--- a/include/linux/ide.h
+++ b/include/linux/ide.h
@@ -663,7 +663,7 @@ typedef struct ide_drive_s ide_drive_t;
 #define to_ide_device(dev)              container_of(dev, ide_drive_t, gendev)
 
 #define to_ide_drv(obj, cont_type)      \
-        container_of(obj, struct cont_type, kref)
+        container_of(obj, struct cont_type, dev)
 
 #define ide_drv_g(disk, cont_type)      \
         container_of((disk)->private_data, struct cont_type, driver)
@@ -866,6 +866,7 @@ struct ide_host {
         unsigned int    n_ports;
         struct device   *dev[2];
         unsigned int    (*init_chipset)(struct pci_dev *);
+        irq_handler_t   irq_handler;
         unsigned long   host_flags;
         void            *host_priv;
         ide_hwif_t      *cur_port;      /* for hosts requiring serialization */
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index c4f6c101dbcd..d2e3cbfba14f 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -194,6 +194,7 @@ static inline void dmar_writeq(void __iomem *addr, u64 val)
 /* FSTS_REG */
 #define DMA_FSTS_PPF ((u32)2)
 #define DMA_FSTS_PFO ((u32)1)
+#define DMA_FSTS_IQE (1 << 4)
 #define dma_fsts_fault_record_index(s) (((s) >> 8) & 0xff)
 
 /* FRCD_REG, 32 bits access */
@@ -328,7 +329,7 @@ extern int qi_flush_iotlb(struct intel_iommu *iommu, u16 did, u64 addr,
                           unsigned int size_order, u64 type,
                           int non_present_entry_flush);
 
-extern void qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
+extern int qi_submit_sync(struct qi_desc *desc, struct intel_iommu *iommu);
 
 extern void *intel_alloc_coherent(struct device *, size_t, dma_addr_t *, gfp_t);
 extern void intel_free_coherent(struct device *, size_t, void *, dma_addr_t);
diff --git a/include/linux/io-mapping.h b/include/linux/io-mapping.h
index 82df31726a54..0adb0f91568c 100644
--- a/include/linux/io-mapping.h
+++ b/include/linux/io-mapping.h
@@ -30,11 +30,14 @@
  * See Documentation/io_mapping.txt
  */
 
-/* this struct isn't actually defined anywhere */
-struct io_mapping;
-
 #ifdef CONFIG_HAVE_ATOMIC_IOMAP
 
+struct io_mapping {
+        resource_size_t base;
+        unsigned long size;
+        pgprot_t prot;
+};
+
 /*
  * For small address space machines, mapping large objects
  * into the kernel virtual space isn't practical. Where
@@ -43,23 +46,40 @@ struct io_mapping;
  */
 
 static inline struct io_mapping *
-io_mapping_create_wc(unsigned long base, unsigned long size)
+io_mapping_create_wc(resource_size_t base, unsigned long size)
 {
-        return (struct io_mapping *) base;
+        struct io_mapping *iomap;
+
+        if (!is_io_mapping_possible(base, size))
+                return NULL;
+
+        iomap = kmalloc(sizeof(*iomap), GFP_KERNEL);
+        if (!iomap)
+                return NULL;
+
+        iomap->base = base;
+        iomap->size = size;
+        iomap->prot = pgprot_writecombine(__pgprot(__PAGE_KERNEL));
+        return iomap;
 }
 
 static inline void
 io_mapping_free(struct io_mapping *mapping)
 {
+        kfree(mapping);
 }
 
 /* Atomic map/unmap */
 static inline void *
 io_mapping_map_atomic_wc(struct io_mapping *mapping, unsigned long offset)
 {
-        offset += (unsigned long) mapping;
-        return iomap_atomic_prot_pfn(offset >> PAGE_SHIFT, KM_USER0,
-                                     __pgprot(__PAGE_KERNEL_WC));
+        resource_size_t phys_addr;
+        unsigned long pfn;
+
+        BUG_ON(offset >= mapping->size);
+        phys_addr = mapping->base + offset;
+        pfn = (unsigned long) (phys_addr >> PAGE_SHIFT);
+        return iomap_atomic_prot_pfn(pfn, KM_USER0, mapping->prot);
 }
 
 static inline void
@@ -71,8 +91,12 @@ io_mapping_unmap_atomic(void *vaddr)
 static inline void *
 io_mapping_map_wc(struct io_mapping *mapping, unsigned long offset)
 {
-        offset += (unsigned long) mapping;
-        return ioremap_wc(offset, PAGE_SIZE);
+        resource_size_t phys_addr;
+
+        BUG_ON(offset >= mapping->size);
+        phys_addr = mapping->base + offset;
+
+        return ioremap_wc(phys_addr, PAGE_SIZE);
 }
 
 static inline void
@@ -83,9 +107,12 @@ io_mapping_unmap(void *vaddr)
 
 #else
 
+/* this struct isn't actually defined anywhere */
+struct io_mapping;
+
 /* Create the io_mapping object*/
 static inline struct io_mapping *
-io_mapping_create_wc(unsigned long base, unsigned long size)
+io_mapping_create_wc(resource_size_t base, unsigned long size)
 {
         return (struct io_mapping *) ioremap_wc(base, size);
 }
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 5d87bc09a1f5..dc18b87ed722 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -275,7 +275,7 @@ enum {
          * advised to wait only for the following duration before
          * doing SRST.
          */
-        ATA_TMOUT_PMP_SRST_WAIT = 1000,
+        ATA_TMOUT_PMP_SRST_WAIT = 5000,
 
         /* ATA bus states */
         BUS_UNKNOWN             = 0,
@@ -530,6 +530,7 @@ struct ata_queued_cmd {
         unsigned long           flags;          /* ATA_QCFLAG_xxx */
         unsigned int            tag;
         unsigned int            n_elem;
+        unsigned int            orig_n_elem;
 
         int                     dma_dir;
 
@@ -750,7 +751,8 @@ struct ata_port {
         acpi_handle             acpi_handle;
         struct ata_acpi_gtm     __acpi_init_gtm; /* use ata_acpi_init_gtm() */
 #endif
-        u8                      sector_buf[ATA_SECT_SIZE]; /* owned by EH */
+        /* owned by EH */
+        u8                      sector_buf[ATA_SECT_SIZE] ____cacheline_aligned;
 };
 
 /* The following initializer overrides a method to NULL whether one of
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 92915e81443f..d84feb7bdbf0 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -276,4 +276,7 @@ struct mm_struct {
 #endif
 };
 
+/* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
+#define mm_cpumask(mm) (&(mm)->cpu_vm_mask)
+
 #endif /* _LINUX_MM_TYPES_H */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index ec54785d34f9..659366734f3f 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1079,6 +1079,7 @@ extern void		synchronize_net(void);
 extern int              register_netdevice_notifier(struct notifier_block *nb);
 extern int              unregister_netdevice_notifier(struct notifier_block *nb);
 extern int              init_dummy_netdev(struct net_device *dev);
+extern void             netdev_resync_ops(struct net_device *dev);
 
 extern int call_netdevice_notifiers(unsigned long val, struct net_device *dev);
 extern struct net_device        *dev_get_by_index(struct net *net, int ifindex);
diff --git a/include/linux/netfilter/xt_NFLOG.h b/include/linux/netfilter/xt_NFLOG.h
index cdcd0ed58f7a..4b36aeb46a10 100644
--- a/include/linux/netfilter/xt_NFLOG.h
+++ b/include/linux/netfilter/xt_NFLOG.h
@@ -2,7 +2,7 @@
 #define _XT_NFLOG_TARGET
 
 #define XT_NFLOG_DEFAULT_GROUP          0x1
-#define XT_NFLOG_DEFAULT_THRESHOLD      1
+#define XT_NFLOG_DEFAULT_THRESHOLD      0
 
 #define XT_NFLOG_MASK                   0x0
 
diff --git a/include/linux/rcuclassic.h b/include/linux/rcuclassic.h
index f3f697df1d71..80044a4f3ab9 100644
--- a/include/linux/rcuclassic.h
+++ b/include/linux/rcuclassic.h
@@ -181,4 +181,10 @@ extern long rcu_batches_completed_bh(void);
 #define rcu_enter_nohz()        do { } while (0)
 #define rcu_exit_nohz()         do { } while (0)
 
+/* A context switch is a grace period for rcuclassic. */
+static inline int rcu_blocking_is_gp(void)
+{
+        return num_online_cpus() == 1;
+}
+
 #endif /* __LINUX_RCUCLASSIC_H */
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 921340a7b71c..528343e6da51 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -52,6 +52,9 @@ struct rcu_head {
         void (*func)(struct rcu_head *head);
 };
 
+/* Internal to kernel, but needed by rcupreempt.h. */
+extern int rcu_scheduler_active;
+
 #if defined(CONFIG_CLASSIC_RCU)
 #include <linux/rcuclassic.h>
 #elif defined(CONFIG_TREE_RCU)
@@ -265,6 +268,7 @@ extern void rcu_barrier_sched(void);
 
 /* Internal to kernel */
 extern void rcu_init(void);
+extern void rcu_scheduler_starting(void);
 extern int rcu_needs_cpu(int cpu);
 
 #endif /* __LINUX_RCUPDATE_H */
diff --git a/include/linux/rcupreempt.h b/include/linux/rcupreempt.h
index 3e05c09b54a2..74304b4538d8 100644
--- a/include/linux/rcupreempt.h
+++ b/include/linux/rcupreempt.h
@@ -142,4 +142,19 @@ static inline void rcu_exit_nohz(void)
 #define rcu_exit_nohz()         do { } while (0)
 #endif /* CONFIG_NO_HZ */
 
+/*
+ * A context switch is a grace period for rcupreempt synchronize_rcu()
+ * only during early boot, before the scheduler has been initialized.
+ * So, how the heck do we get a context switch?  Well, if the caller
+ * invokes synchronize_rcu(), they are willing to accept a context
+ * switch, so we simply pretend that one happened.
+ *
+ * After boot, there might be a blocked or preempted task in an RCU
+ * read-side critical section, so we cannot then take the fastpath.
+ */
+static inline int rcu_blocking_is_gp(void)
+{
+        return num_online_cpus() == 1 && !rcu_scheduler_active;
+}
+
 #endif /* __LINUX_RCUPREEMPT_H */
diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h
index d4368b7975c3..a722fb67bb2d 100644
--- a/include/linux/rcutree.h
+++ b/include/linux/rcutree.h
@@ -326,4 +326,10 @@ static inline void rcu_exit_nohz(void)
 }
 #endif /* CONFIG_NO_HZ */
 
+/* A context switch is a grace period for rcutree. */
+static inline int rcu_blocking_is_gp(void)
+{
+        return num_online_cpus() == 1;
+}
+
 #endif /* __LINUX_RCUTREE_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 8981e52c714f..011db2f4c94c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1419,6 +1419,9 @@ struct task_struct {
 #endif
 };
 
+/* Future-safe accessor for struct task_struct's cpus_allowed. */
+#define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
+
 /*
  * Priority of a process goes from 0..MAX_PRIO-1, valid RT
  * priority is 0..MAX_RT_PRIO-1, and SCHED_NORMAL/SCHED_BATCH
@@ -2291,9 +2294,13 @@ extern long sched_group_rt_runtime(struct task_group *tg);
 extern int sched_group_set_rt_period(struct task_group *tg,
                                       long rt_period_us);
 extern long sched_group_rt_period(struct task_group *tg);
+extern int sched_rt_can_attach(struct task_group *tg, struct task_struct *tsk);
 #endif
 #endif
 
+extern int task_can_switch_user(struct user_struct *up,
+                                        struct task_struct *tsk);
+
 #ifdef CONFIG_TASK_XACCT
 static inline void add_rchar(struct task_struct *tsk, ssize_t amt)
 {
diff --git a/include/linux/serio.h b/include/linux/serio.h
index 1bcb357a01a1..e0417e4d3f15 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -212,7 +212,7 @@ static inline void serio_unpin_driver(struct serio *serio)
 #define SERIO_FUJITSU   0x35
 #define SERIO_ZHENHUA   0x36
 #define SERIO_INEXIO    0x37
-#define SERIO_TOUCHIT213        0x37
+#define SERIO_TOUCHIT213        0x38
 #define SERIO_W8001     0x39
 
 #endif
diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
index 315bcd375224..cc4f45361dbb 100644
--- a/include/linux/user_namespace.h
+++ b/include/linux/user_namespace.h
@@ -13,6 +13,7 @@ struct user_namespace {
         struct kref             kref;
         struct hlist_head       uidhash_table[UIDHASH_SZ];
         struct user_struct      *creator;
+        struct work_struct      destroyer;
 };
 
 extern struct user_namespace init_user_ns;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 6fc13d905c5f..ded434b032a4 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -109,11 +109,6 @@ extern struct list_head net_namespace_list;
 #ifdef CONFIG_NET_NS
 extern void __put_net(struct net *net);
 
-static inline int net_alive(struct net *net)
-{
-        return net && atomic_read(&net->count);
-}
-
 static inline struct net *get_net(struct net *net)
 {
         atomic_inc(&net->count);
@@ -145,11 +140,6 @@ int net_eq(const struct net *net1, const struct net *net2)
 }
 #else
 
-static inline int net_alive(struct net *net)
-{
-        return 1;
-}
-
 static inline struct net *get_net(struct net *net)
 {
         return net;
@@ -234,6 +224,23 @@ struct pernet_operations {
         void (*exit)(struct net *net);
 };
 
+/*
+ * Use these carefully.  If you implement a network device and it
+ * needs per network namespace operations use device pernet operations,
+ * otherwise use pernet subsys operations.
+ *
+ * This is critically important.  Most of the network code cleanup
+ * runs with the assumption that dev_remove_pack has been called so no
+ * new packets will arrive during and after the cleanup functions have
+ * been called.  dev_remove_pack is not per namespace so instead the
+ * guarantee of no more packets arriving in a network namespace is
+ * provided by ensuring that all network devices and all sockets have
+ * left the network namespace before the cleanup methods are called.
+ *
+ * For the longest time the ipv4 icmp code was registered as a pernet
+ * device which caused kernel oops, and panics during network
+ * namespace cleanup.   So please don't get this wrong.
+ */
 extern int register_pernet_subsys(struct pernet_operations *);
 extern void unregister_pernet_subsys(struct pernet_operations *);
 extern int register_pernet_gen_subsys(int *id, struct pernet_operations *);
diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h
index e78afe7f28e3..c25068e38516 100644
--- a/include/net/netfilter/nf_conntrack_core.h
+++ b/include/net/netfilter/nf_conntrack_core.h
@@ -59,7 +59,7 @@ static inline int nf_conntrack_confirm(struct sk_buff *skb)
         struct nf_conn *ct = (struct nf_conn *)skb->nfct;
         int ret = NF_ACCEPT;
 
-        if (ct) {
+        if (ct && ct != &nf_conntrack_untracked) {
                 if (!nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct))
                         ret = __nf_conntrack_confirm(skb);
                 nf_ct_deliver_cached_events(ct);
diff --git a/init/Kconfig b/init/Kconfig
index f068071fcc5d..6a5c5fed66c9 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -675,6 +675,9 @@ config CC_OPTIMIZE_FOR_SIZE
 config SYSCTL
         bool
 
+config ANON_INODES
+        bool
+
 menuconfig EMBEDDED
         bool "Configure standard kernel features (for small systems)"
         help
@@ -780,18 +783,6 @@ config PCSPKR_PLATFORM
           This option allows to disable the internal PC-Speaker
           support, saving some memory.
 
-config COMPAT_BRK
-        bool "Disable heap randomization"
-        default y
-        help
-          Randomizing heap placement makes heap exploits harder, but it
-          also breaks ancient binaries (including anything libc5 based).
-          This option changes the bootup default to heap randomization
-          disabled, and can be overriden runtime by setting
-          /proc/sys/kernel/randomize_va_space to 2.
-
-          On non-ancient distros (post-2000 ones) N is usually a safe choice.
-
 config BASE_FULL
         default y
         bool "Enable full-sized data structures for core" if EMBEDDED
@@ -809,9 +800,6 @@ config FUTEX
           support for "fast userspace mutexes".  The resulting kernel may not
           run glibc-based applications correctly.
 
-config ANON_INODES
-        bool
-
 config EPOLL
         bool "Enable eventpoll support" if EMBEDDED
         default y
@@ -897,6 +885,18 @@ config SLUB_DEBUG
           SLUB sysfs support. /sys/slab will not exist and there will be
           no support for cache validation etc.
 
+config COMPAT_BRK
+        bool "Disable heap randomization"
+        default y
+        help
+          Randomizing heap placement makes heap exploits harder, but it
+          also breaks ancient binaries (including anything libc5 based).
+          This option changes the bootup default to heap randomization
+          disabled, and can be overriden runtime by setting
+          /proc/sys/kernel/randomize_va_space to 2.
+
+          On non-ancient distros (post-2000 ones) N is usually a safe choice.
+
 choice
         prompt "Choose SLAB allocator"
         default SLUB
diff --git a/init/main.c b/init/main.c
index 844209453c02..83697e160b3a 100644
--- a/init/main.c
+++ b/init/main.c
@@ -97,7 +97,7 @@ static inline void mark_rodata_ro(void) { }
 extern void tc_init(void);
 #endif
 
-enum system_states system_state;
+enum system_states system_state __read_mostly;
 EXPORT_SYMBOL(system_state);
 
 /*
@@ -463,6 +463,7 @@ static noinline void __init_refok rest_init(void)
          * at least once to get things moving:
          */
         init_idle_bootup_task(current);
+        rcu_scheduler_starting();
         preempt_enable_no_resched();
         schedule();
         preempt_disable();
diff --git a/kernel/fork.c b/kernel/fork.c
index a66fbde20715..4854c2c4a82e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1179,10 +1179,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
         clear_all_latency_tracing(p);
 
-        /* Our parent execution domain becomes current domain
-           These must match for thread signalling to apply */
-        p->parent_exec_id = p->self_exec_id;
-
         /* ok, now we should be set up.. */
         p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
         p->pdeath_signal = 0;
@@ -1220,10 +1216,13 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                 set_task_cpu(p, smp_processor_id());
 
         /* CLONE_PARENT re-uses the old parent */
-        if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+        if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
                 p->real_parent = current->real_parent;
-        else
+                p->parent_exec_id = current->parent_exec_id;
+        } else {
                 p->real_parent = current;
+                p->parent_exec_id = current->self_exec_id;
+        }
 
         spin_lock(&current->sighand->siglock);
 
diff --git a/kernel/rcuclassic.c b/kernel/rcuclassic.c
index bd5a9003497c..654c640a6b9c 100644
--- a/kernel/rcuclassic.c
+++ b/kernel/rcuclassic.c
@@ -679,8 +679,8 @@ int rcu_needs_cpu(int cpu)
 void rcu_check_callbacks(int cpu, int user)
 {
         if (user ||
-            (idle_cpu(cpu) && !in_softirq() &&
-                                hardirq_count() <= (1 << HARDIRQ_SHIFT))) {
+            (idle_cpu(cpu) && rcu_scheduler_active &&
+             !in_softirq() && hardirq_count() <= (1 << HARDIRQ_SHIFT))) {
 
                 /*
                  * Get here if this CPU took its interrupt from user
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index d92a76a881aa..cae8a059cf47 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -44,6 +44,7 @@
 #include <linux/cpu.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
+#include <linux/kernel_stat.h>
 
 enum rcu_barrier {
         RCU_BARRIER_STD,
@@ -55,6 +56,7 @@ static DEFINE_PER_CPU(struct rcu_head, rcu_barrier_head) = {NULL};
 static atomic_t rcu_barrier_cpu_count;
 static DEFINE_MUTEX(rcu_barrier_mutex);
 static struct completion rcu_barrier_completion;
+int rcu_scheduler_active __read_mostly;
 
 /*
  * Awaken the corresponding synchronize_rcu() instance now that a
@@ -80,6 +82,10 @@ void wakeme_after_rcu(struct rcu_head  *head)
 void synchronize_rcu(void)
 {
         struct rcu_synchronize rcu;
+
+        if (rcu_blocking_is_gp())
+                return;
+
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu(&rcu.head, wakeme_after_rcu);
@@ -175,3 +181,9 @@ void __init rcu_init(void)
         __rcu_init();
 }
 
+void rcu_scheduler_starting(void)
+{
+        WARN_ON(num_online_cpus() != 1);
+        WARN_ON(nr_context_switches() > 0);
+        rcu_scheduler_active = 1;
+}
diff --git a/kernel/rcupreempt.c b/kernel/rcupreempt.c
index 33cfc50781f9..5d59e850fb71 100644
--- a/kernel/rcupreempt.c
+++ b/kernel/rcupreempt.c
@@ -1181,6 +1181,9 @@ void __synchronize_sched(void)
 {
         struct rcu_synchronize rcu;
 
+        if (num_online_cpus() == 1)
+                return;  /* blocking is gp if only one CPU! */
+
         init_completion(&rcu.completion);
         /* Will wake me after RCU finished. */
         call_rcu_sched(&rcu.head, wakeme_after_rcu);
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index b2fd602a6f6f..97ce31579ec0 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -948,8 +948,8 @@ static void rcu_do_batch(struct rcu_data *rdp)
 void rcu_check_callbacks(int cpu, int user)
 {
         if (user ||
-            (idle_cpu(cpu) && !in_softirq() &&
-                                hardirq_count() <= (1 << HARDIRQ_SHIFT))) {
+            (idle_cpu(cpu) && rcu_scheduler_active &&
+             !in_softirq() && hardirq_count() <= (1 << HARDIRQ_SHIFT))) {
 
                 /*
                  * Get here if this CPU took its interrupt from user
diff --git a/kernel/sched.c b/kernel/sched.c
index d4c2749a2998..f1cd71918240 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -223,7 +223,7 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b)
 {
         ktime_t now;
 
-        if (rt_bandwidth_enabled() && rt_b->rt_runtime == RUNTIME_INF)
+        if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF)
                 return;
 
         if (hrtimer_active(&rt_b->rt_period_timer))
@@ -9224,6 +9224,16 @@ static int sched_rt_global_constraints(void)
 
         return ret;
 }
+
+int sched_rt_can_attach(struct task_group *tg, struct task_struct *tsk)
+{
+        /* Don't accept realtime tasks when there is no way for them to run */
+        if (rt_task(tsk) && tg->rt_bandwidth.rt_runtime == 0)
+                return 0;
+
+        return 1;
+}
+
 #else /* !CONFIG_RT_GROUP_SCHED */
 static int sched_rt_global_constraints(void)
 {
@@ -9317,8 +9327,7 @@ cpu_cgroup_can_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
                       struct task_struct *tsk)
 {
 #ifdef CONFIG_RT_GROUP_SCHED
-        /* Don't accept realtime tasks when there is no way for them to run */
-        if (rt_task(tsk) && cgroup_tg(cgrp)->rt_bandwidth.rt_runtime == 0)
+        if (!sched_rt_can_attach(cgroup_tg(cgrp), tsk))
                 return -EINVAL;
 #else
         /* We don't support RT-tasks being in separate groups */
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index ad64fcb731f2..57d4b13b631d 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -8,6 +8,7 @@
 
 #include <linux/seccomp.h>
 #include <linux/sched.h>
+#include <linux/compat.h>
 
 /* #define SECCOMP_DEBUG 1 */
 #define NR_SECCOMP_MODES 1
@@ -22,7 +23,7 @@ static int mode1_syscalls[] = {
         0, /* null terminated */
 };
 
-#ifdef TIF_32BIT
+#ifdef CONFIG_COMPAT
 static int mode1_syscalls_32[] = {
         __NR_seccomp_read_32, __NR_seccomp_write_32, __NR_seccomp_exit_32, __NR_seccomp_sigreturn_32,
         0, /* null terminated */
@@ -37,8 +38,8 @@ void __secure_computing(int this_syscall)
         switch (mode) {
         case 1:
                 syscall = mode1_syscalls;
-#ifdef TIF_32BIT
-                if (test_thread_flag(TIF_32BIT))
+#ifdef CONFIG_COMPAT
+                if (is_compat_task())
                         syscall = mode1_syscalls_32;
 #endif
                 do {
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 48c3d5d627a8..ebe2a4d59f2c 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -626,6 +626,7 @@ static int ksoftirqd(void * __bind_cpu)
                         preempt_enable_no_resched();
                         cond_resched();
                         preempt_disable();
+                        rcu_qsctr_inc((long)__bind_cpu);
                 }
                 preempt_enable();
                 set_current_state(TASK_INTERRUPTIBLE);
diff --git a/kernel/sys.c b/kernel/sys.c
index f145c415bc16..37f458e6882a 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -559,7 +559,7 @@ error:
         abort_creds(new);
         return retval;
 }
-  
+
 /*
  * change the user struct in a credentials set to match the new UID
  */
@@ -571,6 +571,11 @@ static int set_user(struct cred *new)
         if (!new_user)
                 return -EAGAIN;
 
+        if (!task_can_switch_user(new_user, current)) {
+                free_uid(new_user);
+                return -EINVAL;
+        }
+
         if (atomic_read(&new_user->processes) >=
                                 current->signal->rlim[RLIMIT_NPROC].rlim_cur &&
                         new_user != INIT_USER) {
@@ -631,10 +636,11 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
                         goto error;
         }
 
-        retval = -EAGAIN;
-        if (new->uid != old->uid && set_user(new) < 0)
-                goto error;
-
+        if (new->uid != old->uid) {
+                retval = set_user(new);
+                if (retval < 0)
+                        goto error;
+        }
         if (ruid != (uid_t) -1 ||
             (euid != (uid_t) -1 && euid != old->uid))
                 new->suid = new->euid;
@@ -680,9 +686,10 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
         retval = -EPERM;
         if (capable(CAP_SETUID)) {
                 new->suid = new->uid = uid;
-                if (uid != old->uid && set_user(new) < 0) {
-                        retval = -EAGAIN;
-                        goto error;
+                if (uid != old->uid) {
+                        retval = set_user(new);
+                        if (retval < 0)
+                                goto error;
                 }
         } else if (uid != old->uid && uid != new->suid) {
                 goto error;
@@ -734,11 +741,13 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
                         goto error;
         }
 
-        retval = -EAGAIN;
         if (ruid != (uid_t) -1) {
                 new->uid = ruid;
-                if (ruid != old->uid && set_user(new) < 0)
-                        goto error;
+                if (ruid != old->uid) {
+                        retval = set_user(new);
+                        if (retval < 0)
+                                goto error;
+                }
         }
         if (euid != (uid_t) -1)
                 new->euid = euid;
diff --git a/kernel/tsacct.c b/kernel/tsacct.c
index 43f891b05a4b..00d59d048edf 100644
--- a/kernel/tsacct.c
+++ b/kernel/tsacct.c
@@ -122,8 +122,10 @@ void acct_update_integrals(struct task_struct *tsk)
         if (likely(tsk->mm)) {
                 cputime_t time, dtime;
                 struct timeval value;
+                unsigned long flags;
                 u64 delta;
 
+                local_irq_save(flags);
                 time = tsk->stime + tsk->utime;
                 dtime = cputime_sub(time, tsk->acct_timexpd);
                 jiffies_to_timeval(cputime_to_jiffies(dtime), &value);
@@ -131,10 +133,12 @@ void acct_update_integrals(struct task_struct *tsk)
                 delta = delta * USEC_PER_SEC + value.tv_usec;
 
                 if (delta == 0)
-                        return;
+                        goto out;
                 tsk->acct_timexpd = time;
                 tsk->acct_rss_mem1 += delta * get_mm_rss(tsk->mm);
                 tsk->acct_vm_mem1 += delta * tsk->mm->total_vm;
+        out:
+                local_irq_restore(flags);
         }
 }
 
diff --git a/kernel/user.c b/kernel/user.c
index 3551ac742395..fbb300e6191f 100644
--- a/kernel/user.c
+++ b/kernel/user.c
@@ -286,14 +286,12 @@ int __init uids_sysfs_init(void)
 /* work function to remove sysfs directory for a user and free up
  * corresponding structures.
  */
-static void remove_user_sysfs_dir(struct work_struct *w)
+static void cleanup_user_struct(struct work_struct *w)
 {
         struct user_struct *up = container_of(w, struct user_struct, work);
         unsigned long flags;
         int remove_user = 0;
 
-        if (up->user_ns != &init_user_ns)
-                return;
         /* Make uid_hash_remove() + sysfs_remove_file() + kobject_del()
          * atomic.
          */
@@ -312,9 +310,11 @@ static void remove_user_sysfs_dir(struct work_struct *w)
         if (!remove_user)
                 goto done;
 
-        kobject_uevent(&up->kobj, KOBJ_REMOVE);
-        kobject_del(&up->kobj);
-        kobject_put(&up->kobj);
+        if (up->user_ns == &init_user_ns) {
+                kobject_uevent(&up->kobj, KOBJ_REMOVE);
+                kobject_del(&up->kobj);
+                kobject_put(&up->kobj);
+        }
 
         sched_destroy_user(up);
         key_put(up->uid_keyring);
@@ -335,7 +335,7 @@ static void free_user(struct user_struct *up, unsigned long flags)
         atomic_inc(&up->__count);
         spin_unlock_irqrestore(&uidhash_lock, flags);
 
-        INIT_WORK(&up->work, remove_user_sysfs_dir);
+        INIT_WORK(&up->work, cleanup_user_struct);
         schedule_work(&up->work);
 }
 
@@ -362,6 +362,24 @@ static void free_user(struct user_struct *up, unsigned long flags)
 
 #endif
 
+#if defined(CONFIG_RT_GROUP_SCHED) && defined(CONFIG_USER_SCHED)
+/*
+ * We need to check if a setuid can take place. This function should be called
+ * before successfully completing the setuid.
+ */
+int task_can_switch_user(struct user_struct *up, struct task_struct *tsk)
+{
+
+        return sched_rt_can_attach(up->tg, tsk);
+
+}
+#else
+int task_can_switch_user(struct user_struct *up, struct task_struct *tsk)
+{
+        return 1;
+}
+#endif
+
 /*
  * Locate the user_struct for the passed UID.  If found, take a ref on it.  The
  * caller must undo that ref with free_uid().
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 79084311ee57..076c7c8215b0 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -60,12 +60,25 @@ int create_user_ns(struct cred *new)
         return 0;
 }
 
-void free_user_ns(struct kref *kref)
+/*
+ * Deferred destructor for a user namespace.  This is required because
+ * free_user_ns() may be called with uidhash_lock held, but we need to call
+ * back to free_uid() which will want to take the lock again.
+ */
+static void free_user_ns_work(struct work_struct *work)
 {
-        struct user_namespace *ns;
-
-        ns = container_of(kref, struct user_namespace, kref);
+        struct user_namespace *ns =
+                container_of(work, struct user_namespace, destroyer);
         free_uid(ns->creator);
         kfree(ns);
 }
+
+void free_user_ns(struct kref *kref)
+{
+        struct user_namespace *ns =
+                container_of(kref, struct user_namespace, kref);
+
+        INIT_WORK(&ns->destroyer, free_user_ns_work);
+        schedule_work(&ns->destroyer);
+}
 EXPORT_SYMBOL(free_user_ns);
diff --git a/lib/idr.c b/lib/idr.c
index c11c5765cdef..dab4bca86f5d 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -449,6 +449,7 @@ void idr_remove_all(struct idr *idp)
 
         n = idp->layers * IDR_BITS;
         p = idp->top;
+        rcu_assign_pointer(idp->top, NULL);
         max = 1 << n;
 
         id = 0;
@@ -467,7 +468,6 @@ void idr_remove_all(struct idr *idp)
                         p = *--paa;
                 }
         }
-        rcu_assign_pointer(idp->top, NULL);
         idp->layers = 0;
 }
 EXPORT_SYMBOL(idr_remove_all);
diff --git a/mm/shmem.c b/mm/shmem.c
index 19d566ccdeea..4103a239ce84 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -169,13 +169,13 @@ static inline struct shmem_sb_info *SHMEM_SB(struct super_block *sb)
  */
 static inline int shmem_acct_size(unsigned long flags, loff_t size)
 {
-        return (flags & VM_ACCOUNT) ?
-                security_vm_enough_memory_kern(VM_ACCT(size)) : 0;
+        return (flags & VM_NORESERVE) ?
+                0 : security_vm_enough_memory_kern(VM_ACCT(size));
 }
 
 static inline void shmem_unacct_size(unsigned long flags, loff_t size)
 {
-        if (flags & VM_ACCOUNT)
+        if (!(flags & VM_NORESERVE))
                 vm_unacct_memory(VM_ACCT(size));
 }
 
@@ -187,13 +187,13 @@ static inline void shmem_unacct_size(unsigned long flags, loff_t size)
  */
 static inline int shmem_acct_block(unsigned long flags)
 {
-        return (flags & VM_ACCOUNT) ?
-                0 : security_vm_enough_memory_kern(VM_ACCT(PAGE_CACHE_SIZE));
+        return (flags & VM_NORESERVE) ?
+                security_vm_enough_memory_kern(VM_ACCT(PAGE_CACHE_SIZE)) : 0;
 }
 
 static inline void shmem_unacct_blocks(unsigned long flags, long pages)
 {
-        if (!(flags & VM_ACCOUNT))
+        if (flags & VM_NORESERVE)
                 vm_unacct_memory(pages * VM_ACCT(PAGE_CACHE_SIZE));
 }
 
@@ -1515,8 +1515,8 @@ static int shmem_mmap(struct file *file, struct vm_area_struct *vma)
         return 0;
 }
 
-static struct inode *
-shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
+static struct inode *shmem_get_inode(struct super_block *sb, int mode,
+                                        dev_t dev, unsigned long flags)
 {
         struct inode *inode;
         struct shmem_inode_info *info;
@@ -1537,6 +1537,7 @@ shmem_get_inode(struct super_block *sb, int mode, dev_t dev)
                 info = SHMEM_I(inode);
                 memset(info, 0, (char *)inode - (char *)info);
                 spin_lock_init(&info->lock);
+                info->flags = flags & VM_NORESERVE;
                 INIT_LIST_HEAD(&info->swaplist);
 
                 switch (mode & S_IFMT) {
@@ -1779,9 +1780,10 @@ static int shmem_statfs(struct dentry *dentry, struct kstatfs *buf)
 static int
 shmem_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 {
-        struct inode *inode = shmem_get_inode(dir->i_sb, mode, dev);
+        struct inode *inode;
         int error = -ENOSPC;
 
+        inode = shmem_get_inode(dir->i_sb, mode, dev, VM_NORESERVE);
         if (inode) {
                 error = security_inode_init_security(inode, dir, NULL, NULL,
                                                      NULL);
@@ -1920,7 +1922,7 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
         if (len > PAGE_CACHE_SIZE)
                 return -ENAMETOOLONG;
 
-        inode = shmem_get_inode(dir->i_sb, S_IFLNK|S_IRWXUGO, 0);
+        inode = shmem_get_inode(dir->i_sb, S_IFLNK|S_IRWXUGO, 0, VM_NORESERVE);
         if (!inode)
                 return -ENOSPC;
 
@@ -2332,7 +2334,7 @@ static int shmem_fill_super(struct super_block *sb,
         sb->s_flags |= MS_POSIXACL;
 #endif
 
-        inode = shmem_get_inode(sb, S_IFDIR | sbinfo->mode, 0);
+        inode = shmem_get_inode(sb, S_IFDIR | sbinfo->mode, 0, VM_NORESERVE);
         if (!inode)
                 goto failed;
         inode->i_uid = sbinfo->uid;
@@ -2574,12 +2576,12 @@ int shmem_unuse(swp_entry_t entry, struct page *page)
         return 0;
 }
 
-#define shmem_file_operations ramfs_file_operations
-#define shmem_vm_ops generic_file_vm_ops
-#define shmem_get_inode ramfs_get_inode
-#define shmem_acct_size(a, b) 0
-#define shmem_unacct_size(a, b) do {} while (0)
-#define SHMEM_MAX_BYTES LLONG_MAX
+#define shmem_vm_ops                            generic_file_vm_ops
+#define shmem_file_operations                   ramfs_file_operations
+#define shmem_get_inode(sb, mode, dev, flags)   ramfs_get_inode(sb, mode, dev)
+#define shmem_acct_size(flags, size)            0
+#define shmem_unacct_size(flags, size)          do {} while (0)
+#define SHMEM_MAX_BYTES                         LLONG_MAX
 
 #endif /* CONFIG_SHMEM */
 
@@ -2589,7 +2591,7 @@ int shmem_unuse(swp_entry_t entry, struct page *page)
  * shmem_file_setup - get an unlinked file living in tmpfs
  * @name: name for dentry (to be seen in /proc/<pid>/maps
  * @size: size to be set for the file
- * @flags: vm_flags
+ * @flags: VM_NORESERVE suppresses pre-accounting of the entire object size
  */
 struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
 {
@@ -2623,13 +2625,10 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
                 goto put_dentry;
 
         error = -ENOSPC;
-        inode = shmem_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0);
+        inode = shmem_get_inode(root->d_sb, S_IFREG | S_IRWXUGO, 0, flags);
         if (!inode)
                 goto close_file;
 
-#ifdef CONFIG_SHMEM
-        SHMEM_I(inode)->flags = (flags & VM_NORESERVE) ? 0 : VM_ACCOUNT;
-#endif
         d_instantiate(dentry, inode);
         inode->i_size = size;
         inode->i_nlink = 0;     /* It is unlinked */
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 903cad46e796..520a75980269 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -323,6 +323,7 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
         unsigned long addr;
         int purged = 0;
 
+        BUG_ON(!size);
         BUG_ON(size & ~PAGE_MASK);
 
         va = kmalloc_node(sizeof(struct vmap_area),
@@ -334,6 +335,9 @@ retry:
         addr = ALIGN(vstart, align);
 
         spin_lock(&vmap_area_lock);
+        if (addr + size - 1 < addr)
+                goto overflow;
+
         /* XXX: could have a last_hole cache */
         n = vmap_area_root.rb_node;
         if (n) {
@@ -365,6 +369,8 @@ retry:
 
                 while (addr + size > first->va_start && addr + size <= vend) {
                         addr = ALIGN(first->va_end + PAGE_SIZE, align);
+                        if (addr + size - 1 < addr)
+                                goto overflow;
 
                         n = rb_next(&first->rb_node);
                         if (n)
@@ -375,6 +381,7 @@ retry:
         }
 found:
         if (addr + size > vend) {
+overflow:
                 spin_unlock(&vmap_area_lock);
                 if (!purged) {
                         purge_vmap_area_lazy();
@@ -498,6 +505,7 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
         static DEFINE_SPINLOCK(purge_lock);
         LIST_HEAD(valist);
         struct vmap_area *va;
+        struct vmap_area *n_va;
         int nr = 0;
 
         /*
@@ -537,7 +545,7 @@ static void __purge_vmap_area_lazy(unsigned long *start, unsigned long *end,
 
         if (nr) {
                 spin_lock(&vmap_area_lock);
-                list_for_each_entry(va, &valist, purge_list)
+                list_for_each_entry_safe(va, n_va, &valist, purge_list)
                         __free_vmap_area(va);
                 spin_unlock(&vmap_area_lock);
         }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 6177e3bcd66b..e89517141657 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1469,7 +1469,7 @@ static void shrink_zone(int priority, struct zone *zone,
                 int file = is_file_lru(l);
                 int scan;
 
-                scan = zone_page_state(zone, NR_LRU_BASE + l);
+                scan = zone_nr_pages(zone, sc, l);
                 if (priority) {
                         scan >>= priority;
                         scan = (scan * percent[file]) / 100;
diff --git a/net/802/tr.c b/net/802/tr.c
index 158150fee462..f47ae289d83b 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -668,3 +668,5 @@ module_init(rif_init);
 
 EXPORT_SYMBOL(tr_type_trans);
 EXPORT_SYMBOL(alloc_trdev);
+
+MODULE_LICENSE("GPL");
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e9db889d6222..2886d2fb9ab5 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -1,12 +1,16 @@
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/if_vlan.h>
+#include <linux/netpoll.h>
 #include "vlan.h"
 
 /* VLAN rx hw acceleration helper.  This acts like netif_{rx,receive_skb}(). */
 int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
                       u16 vlan_tci, int polling)
 {
+        if (netpoll_rx(skb))
+                return NET_RX_DROP;
+
         if (skb_bond_should_drop(skb))
                 goto drop;
 
@@ -100,6 +104,9 @@ int vlan_gro_receive(struct napi_struct *napi, struct vlan_group *grp,
 {
         int err = NET_RX_SUCCESS;
 
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -126,6 +133,9 @@ int vlan_gro_frags(struct napi_struct *napi, struct vlan_group *grp,
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (vlan_gro_common(napi, grp, vlan_tci, skb)) {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4a19acd3a32b..1b34135cf990 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -553,7 +553,7 @@ static int vlan_dev_neigh_setup(struct net_device *dev, struct neigh_parms *pa)
         int err = 0;
 
         if (netif_device_present(real_dev) && ops->ndo_neigh_setup)
-                err = ops->ndo_neigh_setup(dev, pa);
+                err = ops->ndo_neigh_setup(real_dev, pa);
 
         return err;
 }
@@ -639,6 +639,7 @@ static int vlan_dev_init(struct net_device *dev)
                 dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
                 dev->netdev_ops         = &vlan_netdev_ops;
         }
+        netdev_resync_ops(dev);
 
         if (is_vlan_dev(real_dev))
                 subclass = 1;
diff --git a/net/core/dev.c b/net/core/dev.c
index a17e00662363..f1129706ce7b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2267,12 +2267,6 @@ int netif_receive_skb(struct sk_buff *skb)
 
         rcu_read_lock();
 
-        /* Don't receive packets in an exiting network namespace */
-        if (!net_alive(dev_net(skb->dev))) {
-                kfree_skb(skb);
-                goto out;
-        }
-
 #ifdef CONFIG_NET_CLS_ACT
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -2488,6 +2482,9 @@ static int __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 
 int napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
+        if (netpoll_receive_skb(skb))
+                return NET_RX_DROP;
+
         switch (__napi_gro_receive(napi, skb)) {
         case -1:
                 return netif_receive_skb(skb);
@@ -2558,6 +2555,9 @@ int napi_gro_frags(struct napi_struct *napi, struct napi_gro_fraginfo *info)
         if (!skb)
                 goto out;
 
+        if (netpoll_receive_skb(skb))
+                goto out;
+
         err = NET_RX_SUCCESS;
 
         switch (__napi_gro_receive(napi, skb)) {
@@ -4282,6 +4282,39 @@ unsigned long netdev_fix_features(unsigned long features, const char *name)
 }
 EXPORT_SYMBOL(netdev_fix_features);
 
+/* Some devices need to (re-)set their netdev_ops inside
+ * ->init() or similar.  If that happens, we have to setup
+ * the compat pointers again.
+ */
+void netdev_resync_ops(struct net_device *dev)
+{
+#ifdef CONFIG_COMPAT_NET_DEV_OPS
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        dev->init = ops->ndo_init;
+        dev->uninit = ops->ndo_uninit;
+        dev->open = ops->ndo_open;
+        dev->change_rx_flags = ops->ndo_change_rx_flags;
+        dev->set_rx_mode = ops->ndo_set_rx_mode;
+        dev->set_multicast_list = ops->ndo_set_multicast_list;
+        dev->set_mac_address = ops->ndo_set_mac_address;
+        dev->validate_addr = ops->ndo_validate_addr;
+        dev->do_ioctl = ops->ndo_do_ioctl;
+        dev->set_config = ops->ndo_set_config;
+        dev->change_mtu = ops->ndo_change_mtu;
+        dev->neigh_setup = ops->ndo_neigh_setup;
+        dev->tx_timeout = ops->ndo_tx_timeout;
+        dev->get_stats = ops->ndo_get_stats;
+        dev->vlan_rx_register = ops->ndo_vlan_rx_register;
+        dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
+        dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        dev->poll_controller = ops->ndo_poll_controller;
+#endif
+#endif
+}
+EXPORT_SYMBOL(netdev_resync_ops);
+
 /**
  *      register_netdevice      - register a network device
  *      @dev: device to register
@@ -4326,27 +4359,7 @@ int register_netdevice(struct net_device *dev)
          * This is temporary until all network devices are converted.
          */
         if (dev->netdev_ops) {
-                const struct net_device_ops *ops = dev->netdev_ops;
-
-                dev->init = ops->ndo_init;
-                dev->uninit = ops->ndo_uninit;
-                dev->open = ops->ndo_open;
-                dev->change_rx_flags = ops->ndo_change_rx_flags;
-                dev->set_rx_mode = ops->ndo_set_rx_mode;
-                dev->set_multicast_list = ops->ndo_set_multicast_list;
-                dev->set_mac_address = ops->ndo_set_mac_address;
-                dev->validate_addr = ops->ndo_validate_addr;
-                dev->do_ioctl = ops->ndo_do_ioctl;
-                dev->set_config = ops->ndo_set_config;
-                dev->change_mtu = ops->ndo_change_mtu;
-                dev->tx_timeout = ops->ndo_tx_timeout;
-                dev->get_stats = ops->ndo_get_stats;
-                dev->vlan_rx_register = ops->ndo_vlan_rx_register;
-                dev->vlan_rx_add_vid = ops->ndo_vlan_rx_add_vid;
-                dev->vlan_rx_kill_vid = ops->ndo_vlan_rx_kill_vid;
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                dev->poll_controller = ops->ndo_poll_controller;
-#endif
+                netdev_resync_ops(dev);
         } else {
                 char drivername[64];
                 pr_info("%s (%s): not using net_device_ops yet\n",
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 6ac29a46e23e..484f58750eba 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -77,7 +77,9 @@ static ssize_t netdev_store(struct device *dev, struct device_attribute *attr,
         if (endp == buf)
                 goto err;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
+
         if (dev_isalive(net)) {
                 if ((ret = (*set)(net, new)) == 0)
                         ret = len;
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 2adb1a7d361f..e3bebd36f053 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -157,9 +157,6 @@ static void cleanup_net(struct work_struct *work)
         struct pernet_operations *ops;
         struct net *net;
 
-        /* Be very certain incoming network packets will not find us */
-        rcu_barrier();
-
         net = container_of(work, struct net, work);
 
         mutex_lock(&net_mutex);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 705b33b184a3..fc562d29cc46 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1205,7 +1205,7 @@ static struct pernet_operations __net_initdata icmp_sk_ops = {
 
 int __init icmp_init(void)
 {
-        return register_pernet_device(&icmp_sk_ops);
+        return register_pernet_subsys(&icmp_sk_ops);
 }
 
 EXPORT_SYMBOL(icmp_err_convert);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a6961d75c7ea..c28976a7e596 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1374,7 +1374,8 @@ static u8 tcp_sacktag_one(struct sk_buff *skb, struct sock *sk,
 
 static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                            struct tcp_sacktag_state *state,
-                           unsigned int pcount, int shifted, int mss)
+                           unsigned int pcount, int shifted, int mss,
+                           int dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
@@ -1410,7 +1411,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         }
 
         /* We discard results */
-        tcp_sacktag_one(skb, sk, state, 0, pcount);
+        tcp_sacktag_one(skb, sk, state, dup_sack, pcount);
 
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1561,7 +1562,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 
         if (!skb_shift(prev, skb, len))
                 goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss))
+        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
                 goto out;
 
         /* Hole filled allows collapsing with the next as well, this is very
@@ -1580,7 +1581,7 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         len = skb->len;
         if (skb_shift(prev, skb, len)) {
                 pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss);
+                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
         }
 
 out:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 19d7b429a262..cf74c416831a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2443,7 +2443,7 @@ static struct pernet_operations __net_initdata tcp_sk_ops = {
 void __init tcp_v4_init(void)
 {
         inet_hashinfo_init(&tcp_hashinfo);
-        if (register_pernet_device(&tcp_sk_ops))
+        if (register_pernet_subsys(&tcp_sk_ops))
                 panic("Failed to create the TCP control socket.\n");
 }
 
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 2747ec7bfb63..4660b088a8ce 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -1,6 +1,6 @@
 /* Tom Kelly's Scalable TCP
  *
- * See htt://www-lce.eng.cam.ac.uk/~ctk21/scalable/
+ * See http://www.deneholme.net/tom/scalable/
  *
  * John Heffner <jheffner@sc.edu>
  */
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f9afb452249c..1220e2c7831e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -493,15 +493,17 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         read_unlock(&dev_base_lock);
 }
 
-static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 {
         struct net *net;
 
         net = (struct net *)table->extra2;
         if (p == &net->ipv6.devconf_dflt->forwarding)
-                return;
+                return 0;
+
+        if (!rtnl_trylock())
+                return -ERESTARTSYS;
 
-        rtnl_lock();
         if (p == &net->ipv6.devconf_all->forwarding) {
                 __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
@@ -512,6 +514,7 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 
         if (*p)
                 rt6_purge_dflt_routers(net);
+        return 1;
 }
 #endif
 
@@ -2608,9 +2611,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         ASSERT_RTNL();
 
-        if ((dev->flags & IFF_LOOPBACK) && how == 1)
-                how = 0;
-
         rt6_ifdown(net, dev);
         neigh_ifdown(&nd_tbl, dev);
 
@@ -3983,7 +3983,7 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
         ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
 
         if (write)
-                addrconf_fixup_forwarding(ctl, valp, val);
+                ret = addrconf_fixup_forwarding(ctl, valp, val);
         return ret;
 }
 
@@ -4019,8 +4019,7 @@ static int addrconf_sysctl_forward_strategy(ctl_table *table,
         }
 
         *valp = new;
-        addrconf_fixup_forwarding(table, valp, val);
-        return 1;
+        return addrconf_fixup_forwarding(table, valp, val);
 }
 
 static struct addrconf_sysctl_table
@@ -4446,25 +4445,6 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 
-static void addrconf_net_exit(struct net *net)
-{
-        struct net_device *dev;
-
-        rtnl_lock();
-        /* clean dev list */
-        for_each_netdev(net, dev) {
-                if (__in6_dev_get(dev) == NULL)
-                        continue;
-                addrconf_ifdown(dev, 1);
-        }
-        addrconf_ifdown(net->loopback_dev, 2);
-        rtnl_unlock();
-}
-
-static struct pernet_operations addrconf_net_ops = {
-        .exit = addrconf_net_exit,
-};
-
 /*
  *      Init / cleanup code
  */
@@ -4506,10 +4486,6 @@ int __init addrconf_init(void)
         if (err)
                 goto errlo;
 
-        err = register_pernet_device(&addrconf_net_ops);
-        if (err)
-                return err;
-
         register_netdevice_notifier(&ipv6_dev_notf);
 
         addrconf_verify(0);
@@ -4539,15 +4515,22 @@ errlo:
 void addrconf_cleanup(void)
 {
         struct inet6_ifaddr *ifa;
+        struct net_device *dev;
         int i;
 
         unregister_netdevice_notifier(&ipv6_dev_notf);
-        unregister_pernet_device(&addrconf_net_ops);
-
         unregister_pernet_subsys(&addrconf_ops);
 
         rtnl_lock();
 
+        /* clean dev list */
+        for_each_netdev(&init_net, dev) {
+                if (__in6_dev_get(dev) == NULL)
+                        continue;
+                addrconf_ifdown(dev, 1);
+        }
+        addrconf_ifdown(init_net.loopback_dev, 2);
+
         /*
          *      Check hash table.
          */
@@ -4568,6 +4551,4 @@ void addrconf_cleanup(void)
 
         del_timer(&addr_chk_timer);
         rtnl_unlock();
-
-        unregister_pernet_subsys(&addrconf_net_ops);
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c802bc1658a8..da944eca2ca6 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -72,6 +72,10 @@ MODULE_LICENSE("GPL");
 static struct list_head inetsw6[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw6_lock);
 
+static int disable_ipv6 = 0;
+module_param_named(disable, disable_ipv6, int, 0);
+MODULE_PARM_DESC(disable, "Disable IPv6 such that it is non-functional");
+
 static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
 {
         const int offset = sk->sk_prot->obj_size - sizeof(struct ipv6_pinfo);
@@ -991,10 +995,21 @@ static int __init inet6_init(void)
 {
         struct sk_buff *dummy_skb;
         struct list_head *r;
-        int err;
+        int err = 0;
 
         BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
 
+        /* Register the socket-side information for inet6_create.  */
+        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+                INIT_LIST_HEAD(r);
+
+        if (disable_ipv6) {
+                printk(KERN_INFO
+                       "IPv6: Loaded, but administratively disabled, "
+                       "reboot required to enable\n");
+                goto out;
+        }
+
         err = proto_register(&tcpv6_prot, 1);
         if (err)
                 goto out;
@@ -1012,10 +1027,6 @@ static int __init inet6_init(void)
                 goto out_unregister_udplite_proto;
 
 
-        /* Register the socket-side information for inet6_create.  */
-        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
-                INIT_LIST_HEAD(r);
-
         /* We MUST register RAW sockets before we create the ICMP6,
          * IGMP6, or NDISC control sockets.
          */
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 8fe267feb81e..1bcc3431859e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -258,11 +258,11 @@ unique:
 
         if (twp != NULL) {
                 *twp = tw;
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw != NULL) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c323643ffcf9..72dbb6d1a6b3 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -201,8 +201,9 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 
         if (net->ct.sysctl_checksum && hooknum == NF_INET_PRE_ROUTING &&
             nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
-                nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
-                              "nf_ct_icmpv6: ICMPv6 checksum failed\n");
+                if (LOG_INVALID(net, IPPROTO_ICMPV6))
+                        nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
+                                      "nf_ct_icmpv6: ICMPv6 checksum failed ");
                 return -NF_ACCEPT;
         }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index fa49dc7fe100..c712e9fc6bba 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -39,7 +39,7 @@
 #endif
 
 #define NFULNL_NLBUFSIZ_DEFAULT NLMSG_GOODSIZE
-#define NFULNL_TIMEOUT_DEFAULT  HZ      /* every second */
+#define NFULNL_TIMEOUT_DEFAULT  100     /* every second */
 #define NFULNL_QTHRESH_DEFAULT  100     /* 100 packets */
 #define NFULNL_COPY_RANGE_MAX   0xFFFF  /* max packet size is limited by 16-bit struct nfattr nfa_len field */
 
@@ -590,8 +590,10 @@ nfulnl_log_packet(u_int8_t pf,
 
         qthreshold = inst->qthreshold;
         /* per-rule qthreshold overrides per-instance */
-        if (qthreshold > li->u.ulog.qthreshold)
-                qthreshold = li->u.ulog.qthreshold;
+        if (li->u.ulog.qthreshold)
+                if (qthreshold > li->u.ulog.qthreshold)
+                        qthreshold = li->u.ulog.qthreshold;
+
 
         switch (inst->copy_mode) {
         case NFULNL_COPY_META:
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index bfbf521f6ea5..5baccfa5a0de 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -827,59 +827,143 @@ static const struct file_operations xt_table_ops = {
         .release = seq_release_net,
 };
 
-static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+/*
+ * Traverse state for ip{,6}_{tables,matches} for helping crossing
+ * the multi-AF mutexes.
+ */
+struct nf_mttg_trav {
+        struct list_head *head, *curr;
+        uint8_t class, nfproto;
+};
+
+enum {
+        MTTG_TRAV_INIT,
+        MTTG_TRAV_NFP_UNSPEC,
+        MTTG_TRAV_NFP_SPEC,
+        MTTG_TRAV_DONE,
+};
+
+static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        static const uint8_t next_class[] = {
+                [MTTG_TRAV_NFP_UNSPEC] = MTTG_TRAV_NFP_SPEC,
+                [MTTG_TRAV_NFP_SPEC]   = MTTG_TRAV_DONE,
+        };
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_INIT:
+                trav->class = MTTG_TRAV_NFP_UNSPEC;
+                mutex_lock(&xt[NFPROTO_UNSPEC].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[NFPROTO_UNSPEC].target : &xt[NFPROTO_UNSPEC].match;
+                break;
+        case MTTG_TRAV_NFP_UNSPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                mutex_lock(&xt[trav->nfproto].mutex);
+                trav->head = trav->curr = is_target ?
+                        &xt[trav->nfproto].target : &xt[trav->nfproto].match;
+                trav->class = next_class[trav->class];
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                trav->curr = trav->curr->next;
+                if (trav->curr != trav->head)
+                        break;
+                /* fallthru, _stop will unlock */
+        default:
+                return NULL;
+        }
 
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].match, *pos);
+        if (ppos != NULL)
+                ++*ppos;
+        return trav;
 }
 
-static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_mttg_seq_start(struct seq_file *seq, loff_t *pos,
+    bool is_target)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+        unsigned int j;
 
-        return seq_list_next(v, &xt[af].match, pos);
+        trav->class = MTTG_TRAV_INIT;
+        for (j = 0; j < *pos; ++j)
+                if (xt_mttg_seq_next(seq, NULL, NULL, is_target) == NULL)
+                        return NULL;
+        return trav;
 }
 
-static void xt_match_seq_stop(struct seq_file *seq, void *v)
+static void xt_mttg_seq_stop(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
+        struct nf_mttg_trav *trav = seq->private;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+                mutex_unlock(&xt[NFPROTO_UNSPEC].mutex);
+                break;
+        case MTTG_TRAV_NFP_SPEC:
+                mutex_unlock(&xt[trav->nfproto].mutex);
+                break;
+        }
+}
 
-        mutex_unlock(&xt[af].mutex);
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return xt_mttg_seq_start(seq, pos, false);
 }
 
-static int xt_match_seq_show(struct seq_file *seq, void *v)
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct xt_match *match = list_entry(v, struct xt_match, list);
+        return xt_mttg_seq_next(seq, v, ppos, false);
+}
 
-        if (strlen(match->name))
-                return seq_printf(seq, "%s\n", match->name);
-        else
-                return 0;
+static int xt_match_seq_show(struct seq_file *seq, void *v)
+{
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_match *match;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                match = list_entry(trav->curr, struct xt_match, list);
+                return (*match->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", match->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_match_seq_ops = {
         .start  = xt_match_seq_start,
         .next   = xt_match_seq_next,
-        .stop   = xt_match_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_match_seq_show,
 };
 
 static int xt_match_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_match_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_match_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_match_ops = {
@@ -887,62 +971,63 @@ static const struct file_operations xt_match_ops = {
         .open    = xt_match_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_lock(&xt[af].mutex);
-        return seq_list_start(&xt[af].target, *pos);
+        return xt_mttg_seq_start(seq, pos, true);
 }
 
-static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *ppos)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        return seq_list_next(v, &xt[af].target, pos);
-}
-
-static void xt_target_seq_stop(struct seq_file *seq, void *v)
-{
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data;
-
-        mutex_unlock(&xt[af].mutex);
+        return xt_mttg_seq_next(seq, v, ppos, true);
 }
 
 static int xt_target_seq_show(struct seq_file *seq, void *v)
 {
-        struct xt_target *target = list_entry(v, struct xt_target, list);
-
-        if (strlen(target->name))
-                return seq_printf(seq, "%s\n", target->name);
-        else
-                return 0;
+        const struct nf_mttg_trav *trav = seq->private;
+        const struct xt_target *target;
+
+        switch (trav->class) {
+        case MTTG_TRAV_NFP_UNSPEC:
+        case MTTG_TRAV_NFP_SPEC:
+                if (trav->curr == trav->head)
+                        return 0;
+                target = list_entry(trav->curr, struct xt_target, list);
+                return (*target->name == '\0') ? 0 :
+                       seq_printf(seq, "%s\n", target->name);
+        }
+        return 0;
 }
 
 static const struct seq_operations xt_target_seq_ops = {
         .start  = xt_target_seq_start,
         .next   = xt_target_seq_next,
-        .stop   = xt_target_seq_stop,
+        .stop   = xt_mttg_seq_stop,
         .show   = xt_target_seq_show,
 };
 
 static int xt_target_open(struct inode *inode, struct file *file)
 {
+        struct seq_file *seq;
+        struct nf_mttg_trav *trav;
         int ret;
 
-        ret = seq_open(file, &xt_target_seq_ops);
-        if (!ret) {
-                struct seq_file *seq = file->private_data;
+        trav = kmalloc(sizeof(*trav), GFP_KERNEL);
+        if (trav == NULL)
+                return -ENOMEM;
 
-                seq->private = PDE(inode);
+        ret = seq_open(file, &xt_target_seq_ops);
+        if (ret < 0) {
+                kfree(trav);
+                return ret;
         }
-        return ret;
+
+        seq = file->private_data;
+        seq->private = trav;
+        trav->nfproto = (unsigned long)PDE(inode)->data;
+        return 0;
 }
 
 static const struct file_operations xt_target_ops = {
@@ -950,7 +1035,7 @@ static const struct file_operations xt_target_ops = {
         .open    = xt_target_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 #define FORMAT_TABLES   "_tables_names"
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index fe80b614a400..791e030ea903 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -542,7 +542,7 @@ recent_mt_proc_write(struct file *file, const char __user *input,
         struct recent_entry *e;
         char buf[sizeof("+b335:1d35:1e55:dead:c0de:1715:5afe:c0de")];
         const char *c = buf;
-        union nf_inet_addr addr;
+        union nf_inet_addr addr = {};
         u_int16_t family;
         bool add, succ;
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 9eb895c7a2a9..3ae3cb816563 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1084,6 +1084,13 @@ out:
         return 0;
 }
 
+/**
+ * netlink_set_err - report error to broadcast listeners
+ * @ssk: the kernel netlink socket, as returned by netlink_kernel_create()
+ * @pid: the PID of a process that we want to skip (if any)
+ * @groups: the broadcast group that will notice the error
+ * @code: error code, must be negative (as usual in kernelspace)
+ */
 void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
         struct netlink_set_err_data info;
@@ -1093,7 +1100,8 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
         info.exclude_sk = ssk;
         info.pid = pid;
         info.group = group;
-        info.code = code;
+        /* sk->sk_err wants a positive error value */
+        info.code = -code;
 
         read_lock(&nl_table_lock);
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 5c72a116b1a4..f8f047b61245 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -183,13 +183,6 @@ override:
                 if (R_tab == NULL)
                         goto failure;
 
-                if (!est && (ret == ACT_P_CREATED ||
-                             !gen_estimator_active(&police->tcf_bstats,
-                                                   &police->tcf_rate_est))) {
-                        err = -EINVAL;
-                        goto failure;
-                }
-
                 if (parm->peakrate.rate) {
                         P_tab = qdisc_get_rtab(&parm->peakrate,
                                                tb[TCA_POLICE_PEAKRATE]);
@@ -205,6 +198,12 @@ override:
                                             &police->tcf_lock, est);
                 if (err)
                         goto failure_unlock;
+        } else if (tb[TCA_POLICE_AVRATE] &&
+                   (ret == ACT_P_CREATED ||
+                    !gen_estimator_active(&police->tcf_bstats,
+                                          &police->tcf_rate_est))) {
+                err = -EINVAL;
+                goto failure_unlock;
         }
 
         /* No failure allowed after this point */
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index f6b4fa97df70..e36e94ab4e10 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -66,11 +66,15 @@ static int drr_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 {
         struct drr_sched *q = qdisc_priv(sch);
         struct drr_class *cl = (struct drr_class *)*arg;
+        struct nlattr *opt = tca[TCA_OPTIONS];
         struct nlattr *tb[TCA_DRR_MAX + 1];
         u32 quantum;
         int err;
 
-        err = nla_parse_nested(tb, TCA_DRR_MAX, tca[TCA_OPTIONS], drr_policy);
+        if (!opt)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_DRR_MAX, opt, drr_policy);
         if (err < 0)
                 return err;
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b78e3be69013..c4986d0f7419 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -717,15 +717,20 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
 static int sctp_ctl_sock_init(void)
 {
         int err;
-        sa_family_t family;
+        sa_family_t family = PF_INET;
 
         if (sctp_get_pf_specific(PF_INET6))
                 family = PF_INET6;
-        else
-                family = PF_INET;
 
         err = inet_ctl_sock_create(&sctp_ctl_sock, family,
                                    SOCK_SEQPACKET, IPPROTO_SCTP, &init_net);
+
+        /* If IPv6 socket could not be created, try the IPv4 socket */
+        if (err < 0 && family == PF_INET6)
+                err = inet_ctl_sock_create(&sctp_ctl_sock, AF_INET,
+                                           SOCK_SEQPACKET, IPPROTO_SCTP,
+                                           &init_net);
+
         if (err < 0) {
                 printk(KERN_ERR
                        "SCTP: Failed to create the SCTP control socket.\n");
@@ -1322,9 +1327,8 @@ SCTP_STATIC __init int sctp_init(void)
 out:
         return status;
 err_v6_add_protocol:
-        sctp_v6_del_protocol();
-err_add_protocol:
         sctp_v4_del_protocol();
+err_add_protocol:
         inet_ctl_sock_destroy(sctp_ctl_sock);
 err_ctl_sock_init:
         sctp_v6_protosw_exit();
@@ -1335,7 +1339,6 @@ err_protosw_init:
         sctp_v4_pf_exit();
         sctp_v6_pf_exit();
         sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
         free_pages((unsigned long)sctp_port_hashtable,
                    get_order(sctp_port_hashsize *
                              sizeof(struct sctp_bind_hashbucket)));
@@ -1383,7 +1386,6 @@ SCTP_STATIC __exit void sctp_exit(void)
         sctp_v4_pf_exit();
 
         sctp_sysctl_unregister();
-        list_del(&sctp_af_inet.list);
 
         free_pages((unsigned long)sctp_assoc_hashtable,
                    get_order(sctp_assoc_hashsize *
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index e1d6076b4f59..b5495aecab60 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -787,36 +787,48 @@ static void sctp_cmd_process_operr(sctp_cmd_seq_t *cmds,
                                    struct sctp_association *asoc,
                                    struct sctp_chunk *chunk)
 {
-        struct sctp_operr_chunk *operr_chunk;
         struct sctp_errhdr *err_hdr;
+        struct sctp_ulpevent *ev;
 
-        operr_chunk = (struct sctp_operr_chunk *)chunk->chunk_hdr;
-        err_hdr = &operr_chunk->err_hdr;
+        while (chunk->chunk_end > chunk->skb->data) {
+                err_hdr = (struct sctp_errhdr *)(chunk->skb->data);
 
-        switch (err_hdr->cause) {
-        case SCTP_ERROR_UNKNOWN_CHUNK:
-        {
-                struct sctp_chunkhdr *unk_chunk_hdr;
+                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
+                                                     GFP_ATOMIC);
+                if (!ev)
+                        return;
 
-                unk_chunk_hdr = (struct sctp_chunkhdr *)err_hdr->variable;
-                switch (unk_chunk_hdr->type) {
-                /* ADDIP 4.1 A9) If the peer responds to an ASCONF with an
-                 * ERROR chunk reporting that it did not recognized the ASCONF
-                 * chunk type, the sender of the ASCONF MUST NOT send any
-                 * further ASCONF chunks and MUST stop its T-4 timer.
-                 */
-                case SCTP_CID_ASCONF:
-                        asoc->peer.asconf_capable = 0;
-                        sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
+                sctp_ulpq_tail_event(&asoc->ulpq, ev);
+
+                switch (err_hdr->cause) {
+                case SCTP_ERROR_UNKNOWN_CHUNK:
+                {
+                        sctp_chunkhdr_t *unk_chunk_hdr;
+
+                        unk_chunk_hdr = (sctp_chunkhdr_t *)err_hdr->variable;
+                        switch (unk_chunk_hdr->type) {
+                        /* ADDIP 4.1 A9) If the peer responds to an ASCONF with
+                         * an ERROR chunk reporting that it did not recognized
+                         * the ASCONF chunk type, the sender of the ASCONF MUST
+                         * NOT send any further ASCONF chunks and MUST stop its
+                         * T-4 timer.
+                         */
+                        case SCTP_CID_ASCONF:
+                                if (asoc->peer.asconf_capable == 0)
+                                        break;
+
+                                asoc->peer.asconf_capable = 0;
+                                sctp_add_cmd_sf(cmds, SCTP_CMD_TIMER_STOP,
                                         SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
+                                break;
+                        default:
+                                break;
+                        }
                         break;
+                }
                 default:
                         break;
                 }
-                break;
-        }
-        default:
-                break;
         }
 }
 
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 3a0cd075914f..f88dfded0e3a 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3163,7 +3163,6 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                                         sctp_cmd_seq_t *commands)
 {
         struct sctp_chunk *chunk = arg;
-        struct sctp_ulpevent *ev;
 
         if (!sctp_vtag_verify(chunk, asoc))
                 return sctp_sf_pdiscard(ep, asoc, type, arg, commands);
@@ -3173,21 +3172,10 @@ sctp_disposition_t sctp_sf_operr_notify(const struct sctp_endpoint *ep,
                 return sctp_sf_violation_chunklen(ep, asoc, type, arg,
                                                   commands);
 
-        while (chunk->chunk_end > chunk->skb->data) {
-                ev = sctp_ulpevent_make_remote_error(asoc, chunk, 0,
-                                                     GFP_ATOMIC);
-                if (!ev)
-                        goto nomem;
+        sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
+                        SCTP_CHUNK(chunk));
 
-                sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP,
-                                SCTP_ULPEVENT(ev));
-                sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_OPERR,
-                                SCTP_CHUNK(chunk));
-        }
         return SCTP_DISPOSITION_CONSUME;
-
-nomem:
-        return SCTP_DISPOSITION_NOMEM;
 }
 
 /*
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 85c9034c59b2..bd0a16c3de5e 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -380,7 +380,8 @@ static bool is_valid_reg_rule(const struct ieee80211_reg_rule *rule)
 
         freq_diff = freq_range->end_freq_khz - freq_range->start_freq_khz;
 
-        if (freq_diff <= 0 || freq_range->max_bandwidth_khz > freq_diff)
+        if (freq_range->end_freq_khz <= freq_range->start_freq_khz ||
+                        freq_range->max_bandwidth_khz > freq_diff)
                 return false;
 
         return true;
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 45eb0ae98eba..2d5ece798c4c 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -10,7 +10,7 @@ use strict;
 my $P = $0;
 $P =~ s@.*/@@g;
 
-my $V = '0.27';
+my $V = '0.28';
 
 use Getopt::Long qw(:config no_auto_abbrev);
 
@@ -110,7 +110,8 @@ our $Sparse	= qr{
                         __iomem|
                         __must_check|
                         __init_refok|
-                        __kprobes
+                        __kprobes|
+                        __ref
                 }x;
 our $Attribute  = qr{
                         const|
@@ -1240,7 +1241,8 @@ sub process {
                         $realfile =~ s@^([^/]*)/@@;
 
                         $p1_prefix = $1;
-                        if ($tree && $p1_prefix ne '' && -e "$root/$p1_prefix") {
+                        if (!$file && $tree && $p1_prefix ne '' &&
+                            -e "$root/$p1_prefix") {
                                 WARN("patch prefix '$p1_prefix' exists, appears to be a -p0 patch\n");
                         }
 
@@ -1583,9 +1585,9 @@ sub process {
                 }
 # TEST: allow direct testing of the attribute matcher.
                 if ($dbg_attr) {
-                        if ($line =~ /^.\s*$Attribute\s*$/) {
+                        if ($line =~ /^.\s*$Modifier\s*$/) {
                                 ERROR("TEST: is attr\n" . $herecurr);
-                        } elsif ($dbg_attr > 1 && $line =~ /^.+($Attribute)/) {
+                        } elsif ($dbg_attr > 1 && $line =~ /^.+($Modifier)/) {
                                 ERROR("TEST: is not attr ($1 is)\n". $herecurr);
                         }
                         next;
@@ -1657,7 +1659,7 @@ sub process {
 
 # * goes on variable not on type
                 # (char*[ const])
-                if ($line =~ m{\($NonptrType(\s*\*[\s\*]*(?:$Modifier\s*)*)\)}) {
+                if ($line =~ m{\($NonptrType(\s*(?:$Modifier\b\s*|\*\s*)+)\)}) {
                         my ($from, $to) = ($1, $1);
 
                         # Should start with a space.
@@ -1672,7 +1674,7 @@ sub process {
                         if ($from ne $to) {
                                 ERROR("\"(foo$from)\" should be \"(foo$to)\"\n" .  $herecurr);
                         }
-                } elsif ($line =~ m{\b$NonptrType(\s*\*[\s\*]*(?:$Modifier\s*)?)($Ident)}) {
+                } elsif ($line =~ m{\b$NonptrType(\s*(?:$Modifier\b\s*|\*\s*)+)($Ident)}) {
                         my ($from, $to, $ident) = ($1, $1, $2);
 
                         # Should start with a space.
@@ -1685,8 +1687,8 @@ sub process {
                         # Modifiers should have spaces.
                         $to =~ s/(\b$Modifier$)/$1 /;
 
-                        #print "from<$from> to<$to>\n";
-                        if ($from ne $to) {
+                        #print "from<$from> to<$to> ident<$ident>\n";
+                        if ($from ne $to && $ident !~ /^$Modifier$/) {
                                 ERROR("\"foo${from}bar\" should be \"foo${to}bar\"\n" .  $herecurr);
                         }
                 }
@@ -1885,11 +1887,11 @@ sub process {
                                         if ($ctx !~ /[WEBC]x./ && $ca !~ /(?:\)|!|~|\*|-|\&|\||\+\+|\-\-|\{)$/) {
                                                 ERROR("space required before that '$op' $at\n" . $hereptr);
                                         }
-                                        if ($op eq '*' && $cc =~/\s*const\b/) {
+                                        if ($op eq '*' && $cc =~/\s*$Modifier\b/) {
                                                 # A unary '*' may be const
 
                                         } elsif ($ctx =~ /.xW/) {
-                                                ERROR("space prohibited after that '$op' $at\n" . $hereptr);
+                                                ERROR("Aspace prohibited after that '$op' $at\n" . $hereptr);
                                         }
 
                                 # unary ++ and unary -- are allowed no space on one side.
@@ -2560,7 +2562,7 @@ sub process {
                 if ($line =~ /\bin_atomic\s*\(/) {
                         if ($realfile =~ m@^drivers/@) {
                                 ERROR("do not use in_atomic in drivers\n" . $herecurr);
-                        } else {
+                        } elsif ($realfile !~ m@^kernel/@) {
                                 WARN("use of in_atomic() is incorrect outside core kernel code\n" . $herecurr);
                         }
                 }
diff --git a/scripts/package/Makefile b/scripts/package/Makefile
index 8c6b7b09606a..fa4a0a17b7e0 100644
--- a/scripts/package/Makefile
+++ b/scripts/package/Makefile
@@ -35,9 +35,10 @@ $(objtree)/kernel.spec: $(MKSPEC) $(srctree)/Makefile
 rpm-pkg rpm: $(objtree)/kernel.spec FORCE
         $(MAKE) clean
         $(PREV) ln -sf $(srctree) $(KERNELPATH)
+        $(CONFIG_SHELL) $(srctree)/scripts/setlocalversion > $(objtree)/.scmversion
         $(PREV) tar -cz $(RCS_TAR_IGNORE) -f $(KERNELPATH).tar.gz $(KERNELPATH)/.
         $(PREV) rm $(KERNELPATH)
-
+        rm -f $(objtree)/.scmversion
         set -e; \
         $(CONFIG_SHELL) $(srctree)/scripts/mkversion > $(objtree)/.tmp_version
         set -e; \
diff --git a/scripts/package/mkspec b/scripts/package/mkspec
index ee448cdc6a2b..3d93f8c81252 100755
--- a/scripts/package/mkspec
+++ b/scripts/package/mkspec
@@ -96,7 +96,7 @@ echo "%endif"
 
 echo ""
 echo "%clean"
-echo '#echo -rf $RPM_BUILD_ROOT'
+echo 'rm -rf $RPM_BUILD_ROOT'
 echo ""
 echo "%files"
 echo '%defattr (-, root, root)'
diff --git a/scripts/unifdef.c b/scripts/unifdef.c
index 552025e72acb..05a31a6c7e1b 100644
--- a/scripts/unifdef.c
+++ b/scripts/unifdef.c
@@ -206,7 +206,7 @@ static void             done(void);
 static void             error(const char *);
 static int              findsym(const char *);
 static void             flushline(bool);
-static Linetype         getline(void);
+static Linetype         get_line(void);
 static Linetype         ifeval(const char **);
 static void             ignoreoff(void);
 static void             ignoreon(void);
@@ -512,7 +512,7 @@ process(void)
 
         for (;;) {
                 linenum++;
-                lineval = getline();
+                lineval = get_line();
                 trans_table[ifstate[depth]][lineval]();
                 debug("process %s -> %s depth %d",
                     linetype_name[lineval],
@@ -526,7 +526,7 @@ process(void)
  * help from skipcomment().
  */
 static Linetype
-getline(void)
+get_line(void)
 {
         const char *cp;
         int cursym;
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index 3f4b26647386..350794ab9b42 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -386,11 +386,12 @@ int selinux_netlbl_inode_permission(struct inode *inode, int mask)
         if (!S_ISSOCK(inode->i_mode) ||
             ((mask & (MAY_WRITE | MAY_APPEND)) == 0))
                 return 0;
-
         sock = SOCKET_I(inode);
         sk = sock->sk;
+        if (sk == NULL)
+                return 0;
         sksec = sk->sk_security;
-        if (sksec->nlbl_state != NLBL_REQUIRE)
+        if (sksec == NULL || sksec->nlbl_state != NLBL_REQUIRE)
                 return 0;
 
         local_bh_disable();
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0278bc083044..e7ded1326b0f 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1498,58 +1498,31 @@ static int smack_socket_post_create(struct socket *sock, int family,
  * looks for host based access restrictions
  *
  * This version will only be appropriate for really small
- * sets of single label hosts. Because of the masking
- * it cannot shortcut out on the first match. There are
- * numerious ways to address the problem, but none of them
- * have been applied here.
+ * sets of single label hosts.
  *
  * Returns the label of the far end or NULL if it's not special.
  */
 static char *smack_host_label(struct sockaddr_in *sip)
 {
         struct smk_netlbladdr *snp;
-        char *bestlabel = NULL;
         struct in_addr *siap = &sip->sin_addr;
-        struct in_addr *liap;
-        struct in_addr *miap;
-        struct in_addr bestmask;
 
         if (siap->s_addr == 0)
                 return NULL;
 
-        bestmask.s_addr = 0;
-
         for (snp = smack_netlbladdrs; snp != NULL; snp = snp->smk_next) {
-                liap = &snp->smk_host.sin_addr;
-                miap = &snp->smk_mask;
-                /*
-                 * If the addresses match after applying the list entry mask
-                 * the entry matches the address. If it doesn't move along to
-                 * the next entry.
-                 */
-                if ((liap->s_addr & miap->s_addr) !=
-                    (siap->s_addr & miap->s_addr))
-                        continue;
                 /*
-                 * If the list entry mask identifies a single address
-                 * it can't get any more specific.
+                 * we break after finding the first match because
+                 * the list is sorted from longest to shortest mask
+                 * so we have found the most specific match
                  */
-                if (miap->s_addr == 0xffffffff)
+                if ((&snp->smk_host.sin_addr)->s_addr  ==
+                        (siap->s_addr & (&snp->smk_mask)->s_addr)) {
                         return snp->smk_label;
-                /*
-                 * If the list entry mask is less specific than the best
-                 * already found this entry is uninteresting.
-                 */
-                if ((miap->s_addr | bestmask.s_addr) == bestmask.s_addr)
-                        continue;
-                /*
-                 * This is better than any entry found so far.
-                 */
-                bestmask.s_addr = miap->s_addr;
-                bestlabel = snp->smk_label;
+                }
         }
 
-        return bestlabel;
+        return NULL;
 }
 
 /**
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 8e42800878f4..51f0efc50dab 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -650,10 +650,6 @@ static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
         return skp;
 }
-/*
-#define BEMASK  0x80000000
-*/
-#define BEMASK  0x00000001
 #define BEBITS  (sizeof(__be32) * 8)
 
 /*
@@ -663,12 +659,10 @@ static int netlbladdr_seq_show(struct seq_file *s, void *v)
 {
         struct smk_netlbladdr *skp = (struct smk_netlbladdr *) v;
         unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
-        __be32 bebits;
-        int maskn = 0;
+        int maskn;
+        u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
 
-        for (bebits = BEMASK; bebits != 0; maskn++, bebits <<= 1)
-                if ((skp->smk_mask.s_addr & bebits) == 0)
-                        break;
+        for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
 
         seq_printf(s, "%u.%u.%u.%u/%d %s\n",
                 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
@@ -702,6 +696,42 @@ static int smk_open_netlbladdr(struct inode *inode, struct file *file)
 }
 
 /**
+ * smk_netlbladdr_insert
+ * @new : netlabel to insert
+ *
+ * This helper insert netlabel in the smack_netlbladdrs list
+ * sorted by netmask length (longest to smallest)
+ */
+static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
+{
+        struct smk_netlbladdr *m;
+
+        if (smack_netlbladdrs == NULL) {
+                smack_netlbladdrs = new;
+                return;
+        }
+
+        /* the comparison '>' is a bit hacky, but works */
+        if (new->smk_mask.s_addr > smack_netlbladdrs->smk_mask.s_addr) {
+                new->smk_next = smack_netlbladdrs;
+                smack_netlbladdrs = new;
+                return;
+        }
+        for (m = smack_netlbladdrs; m != NULL; m = m->smk_next) {
+                if (m->smk_next == NULL) {
+                        m->smk_next = new;
+                        return;
+                }
+                if (new->smk_mask.s_addr > m->smk_next->smk_mask.s_addr) {
+                        new->smk_next = m->smk_next;
+                        m->smk_next = new;
+                        return;
+                }
+        }
+}
+
+
+/**
  * smk_write_netlbladdr - write() for /smack/netlabel
  * @filp: file pointer, not actually used
  * @buf: where to get the data from
@@ -724,8 +754,9 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
         struct netlbl_audit audit_info;
         struct in_addr mask;
         unsigned int m;
-        __be32 bebits = BEMASK;
+        u32 mask_bits = (1<<31);
         __be32 nsa;
+        u32 temp_mask;
 
         /*
          * Must have privilege.
@@ -761,10 +792,13 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
         if (sp == NULL)
                 return -EINVAL;
 
-        for (mask.s_addr = 0; m > 0; m--) {
-                mask.s_addr |= bebits;
-                bebits <<= 1;
+        for (temp_mask = 0; m > 0; m--) {
+                temp_mask |= mask_bits;
+                mask_bits >>= 1;
         }
+        mask.s_addr = cpu_to_be32(temp_mask);
+
+        newname.sin_addr.s_addr &= mask.s_addr;
         /*
          * Only allow one writer at a time. Writes should be
          * quite rare and small in any case.
@@ -772,6 +806,7 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
         mutex_lock(&smk_netlbladdr_lock);
 
         nsa = newname.sin_addr.s_addr;
+        /* try to find if the prefix is already in the list */
         for (skp = smack_netlbladdrs; skp != NULL; skp = skp->smk_next)
                 if (skp->smk_host.sin_addr.s_addr == nsa &&
                     skp->smk_mask.s_addr == mask.s_addr)
@@ -787,9 +822,8 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
                         rc = 0;
                         skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
                         skp->smk_mask.s_addr = mask.s_addr;
-                        skp->smk_next = smack_netlbladdrs;
                         skp->smk_label = sp;
-                        smack_netlbladdrs = skp;
+                        smk_netlbladdr_insert(skp);
                 }
         } else {
                 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
diff --git a/sound/core/oss/rate.c b/sound/core/oss/rate.c
index a466443c4a26..2fa9299a440d 100644
--- a/sound/core/oss/rate.c
+++ b/sound/core/oss/rate.c
@@ -157,7 +157,7 @@ static void resample_shrink(struct snd_pcm_plugin *plugin,
                 while (dst_frames1 > 0) {
                         S1 = S2;
                         if (src_frames1-- > 0) {
-                                S1 = *src;
+                                S2 = *src;
                                 src += src_step;
                         }
                         if (pos & ~R_MASK) {
diff --git a/sound/pci/aw2/aw2-alsa.c b/sound/pci/aw2/aw2-alsa.c
index 3f00ddf450f8..c7c54e7748e9 100644
--- a/sound/pci/aw2/aw2-alsa.c
+++ b/sound/pci/aw2/aw2-alsa.c
@@ -165,7 +165,7 @@ module_param_array(enable, bool, NULL, 0444);
 MODULE_PARM_DESC(enable, "Enable Audiowerk2 soundcard.");
 
 static struct pci_device_id snd_aw2_ids[] = {
-        {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, PCI_ANY_ID, PCI_ANY_ID,
+        {PCI_VENDOR_ID_SAA7146, PCI_DEVICE_ID_SAA7146, 0, 0,
          0, 0, 0},
         {0}
 };
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index 7958006a1d66..101a1c13a20d 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1528,6 +1528,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
          .ca0151_chip = 1,
          .spk71 = 1,
          .spdif_bug = 1,
+         .invert_shared_spdif = 1,      /* digital/analog switch swapped */
          .ac97_chip = 1} ,
         {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10021102,
          .driver = "Audigy2", .name = "SB Audigy 2 Platinum [SB0240P]",
diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c
index 482fb0304ca9..4ae51dcb81af 100644
--- a/sound/pci/hda/hda_hwdep.c
+++ b/sound/pci/hda/hda_hwdep.c
@@ -277,18 +277,19 @@ static ssize_t init_verbs_store(struct device *dev,
 {
         struct snd_hwdep *hwdep = dev_get_drvdata(dev);
         struct hda_codec *codec = hwdep->private_data;
-        char *p;
-        struct hda_verb verb, *v;
+        struct hda_verb *v;
+        int nid, verb, param;
 
-        verb.nid = simple_strtoul(buf, &p, 0);
-        verb.verb = simple_strtoul(p, &p, 0);
-        verb.param = simple_strtoul(p, &p, 0);
-        if (!verb.nid || !verb.verb || !verb.param)
+        if (sscanf(buf, "%i %i %i", &nid, &verb, &param) != 3)
+                return -EINVAL;
+        if (!nid || !verb)
                 return -EINVAL;
         v = snd_array_new(&codec->init_verbs);
         if (!v)
                 return -ENOMEM;
-        *v = verb;
+        v->nid = nid;
+        v->verb = verb;
+        v->param = param;
         return count;
 }
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index c8d9178f47e5..5e909e0da04b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2095,6 +2095,8 @@ static struct snd_pci_quirk probe_mask_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1028, 0x20ac, "Dell Studio Desktop", 0x01),
         /* including bogus ALC268 in slot#2 that conflicts with ALC888 */
         SND_PCI_QUIRK(0x17c0, 0x4085, "Medion MD96630", 0x01),
+        /* conflict of ALC268 in slot#3 (digital I/O); a temporary fix */
+        SND_PCI_QUIRK(0x1179, 0xff00, "Toshiba laptop", 0x03),
         {}
 };
 
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index ed8fcbd60003..6c26afcb8262 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7017,6 +7017,7 @@ static int patch_alc882(struct hda_codec *codec)
                 case 0x106b3e00: /* iMac 24 Aluminium */
                         board_config = ALC885_IMAC24;
                         break;
+                case 0x106b00a0: /* MacBookPro3,1 - Another revision */
                 case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */
                 case 0x106b00a4: /* MacbookPro4,1 */
                 case 0x106b2c00: /* Macbook Pro rev3 */
@@ -8469,6 +8470,8 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
                 ALC888_ACER_ASPIRE_4930G),
         SND_PCI_QUIRK(0x1025, 0x015e, "Acer Aspire 6930G",
                 ALC888_ACER_ASPIRE_4930G),
+        SND_PCI_QUIRK(0x1025, 0x0166, "Acer Aspire 6530G",
+                ALC888_ACER_ASPIRE_4930G),
         SND_PCI_QUIRK(0x1025, 0, "Acer laptop", ALC883_ACER), /* default Acer */
         SND_PCI_QUIRK(0x1028, 0x020d, "Dell Inspiron 530", ALC888_6ST_DELL),
         SND_PCI_QUIRK(0x103c, 0x2a3d, "HP Pavillion", ALC883_6ST_DIG),
@@ -10554,6 +10557,7 @@ static struct snd_pci_quirk alc262_cfg_tbl[] = {
         SND_PCI_QUIRK(0x103c, 0x1309, "HP xw4*00", ALC262_HP_BPC),
         SND_PCI_QUIRK(0x103c, 0x130a, "HP xw6*00", ALC262_HP_BPC),
         SND_PCI_QUIRK(0x103c, 0x130b, "HP xw8*00", ALC262_HP_BPC),
+        SND_PCI_QUIRK(0x103c, 0x170b, "HP xw*", ALC262_HP_BPC),
         SND_PCI_QUIRK(0x103c, 0x2800, "HP D7000", ALC262_HP_BPC_D7000_WL),
         SND_PCI_QUIRK(0x103c, 0x2801, "HP D7000", ALC262_HP_BPC_D7000_WF),
         SND_PCI_QUIRK(0x103c, 0x2802, "HP D7000", ALC262_HP_BPC_D7000_WL),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 8027edf3c8f2..6094344fb223 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1207,7 +1207,7 @@ static const char *slave_vols[] = {
         "LFE Playback Volume",
         "Side Playback Volume",
         "Headphone Playback Volume",
-        "Headphone Playback Volume",
+        "Headphone2 Playback Volume",
         "Speaker Playback Volume",
         "External Speaker Playback Volume",
         "Speaker2 Playback Volume",
@@ -1221,7 +1221,7 @@ static const char *slave_sws[] = {
         "LFE Playback Switch",
         "Side Playback Switch",
         "Headphone Playback Switch",
-        "Headphone Playback Switch",
+        "Headphone2 Playback Switch",
         "Speaker Playback Switch",
         "External Speaker Playback Switch",
         "Speaker2 Playback Switch",
@@ -3516,6 +3516,7 @@ static int stac92xx_parse_auto_config(struct hda_codec *codec, hda_nid_t dig_out
         if (! spec->autocfg.line_outs)
                 return 0; /* can't find valid pin config */
 
+#if 0 /* FIXME: temporarily disabled */
         /* If we have no real line-out pin and multiple hp-outs, HPs should
          * be set up as multi-channel outputs.
          */
@@ -3535,6 +3536,7 @@ static int stac92xx_parse_auto_config(struct hda_codec *codec, hda_nid_t dig_out
                 spec->autocfg.line_out_type = AUTO_PIN_HP_OUT;
                 spec->autocfg.hp_outs = 0;
         }
+#endif /* FIXME: temporarily disabled */
         if (spec->autocfg.mono_out_pin) {
                 int dir = get_wcaps(codec, spec->autocfg.mono_out_pin) &
                         (AC_WCAP_OUT_AMP | AC_WCAP_IN_AMP);
@@ -4989,7 +4991,7 @@ again:
         case STAC_DELL_M4_3:
                 spec->num_dmics = 1;
                 spec->num_smuxes = 0;
-                spec->num_dmuxes = 0;
+                spec->num_dmuxes = 1;
                 break;
         default:
                 spec->num_dmics = STAC92HD71BXX_NUM_DMICS;
diff --git a/sound/pci/pcxhr/pcxhr.h b/sound/pci/pcxhr/pcxhr.h
index 84131a916c92..69d87dee6995 100644
--- a/sound/pci/pcxhr/pcxhr.h
+++ b/sound/pci/pcxhr/pcxhr.h
@@ -97,12 +97,12 @@ struct pcxhr_mgr {
         int capture_chips;
         int fw_file_set;
         int firmware_num;
-        int is_hr_stereo:1;
-        int board_has_aes1:1;   /* if 1 board has AES1 plug and SRC */
-        int board_has_analog:1; /* if 0 the board is digital only */
-        int board_has_mic:1;    /* if 1 the board has microphone input */
-        int board_aes_in_192k:1;/* if 1 the aes input plugs do support 192kHz */
-        int mono_capture:1;     /* if 1 the board does mono capture */
+        unsigned int is_hr_stereo:1;
+        unsigned int board_has_aes1:1;  /* if 1 board has AES1 plug and SRC */
+        unsigned int board_has_analog:1; /* if 0 the board is digital only */
+        unsigned int board_has_mic:1; /* if 1 the board has microphone input */
+        unsigned int board_aes_in_192k:1;/* if 1 the aes input plugs do support 192kHz */
+        unsigned int mono_capture:1; /* if 1 the board does mono capture */
 
         struct snd_dma_buffer hostport;